diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml
index 77d09a0ef8c0..88a2b267484a 100644
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@@ -22,17 +22,6 @@
               - doc/**/*
               - nixos/doc/**/*
 
-"backport release-25.11":
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/actions/**/*
-              - .github/workflows/*
-              - .github/labeler*.yml
-              - ci/**/*.*
-              - maintainers/github-teams.json
-      - base-branch: ['master']
-
 "backport release-26.05":
   - all:
       - changed-files:
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 3aac3ccf8b73..d14c482df755 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -31,12 +31,6 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
-          - from: release-25.11
-            into: staging-next-25.11
-          - from: staging-next-25.11
-            into: staging-25.11
-          - from: release-25.11
-            into: staging-nixos-25.11
           - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05
diff --git a/ci/default.nix b/ci/default.nix
index 6ade8164d503..eb7b45e4bbb5 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -38,6 +38,17 @@ let
       check = treefmt.check nixFilesSrc;
     };
 
+  # nixos-render-docs and nixos-render-docs-redirects
+  # Should be used from tree to build the matching in-tree documentation
+  docPkgs = pkgs.extend (
+    final: prev: {
+      nixos-render-docs = final.callPackage ../pkgs/by-name/ni/nixos-render-docs/package.nix { };
+      nixos-render-docs-redirects =
+        final.callPackage ../pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
+          { };
+    }
+  );
+
 in
 rec {
   inherit pkgs fmt;
@@ -53,7 +64,7 @@ rec {
   # CI jobs
   lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { inherit pkgs; });
+  manual-nixpkgs = (import ../doc { pkgs = docPkgs; });
   nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix {
     nix = pkgs.nixVersions.latest;
   };
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 547fcf1f26be..8feaf5cf77aa 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -100,6 +100,7 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
+        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -121,12 +122,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "${preEvalFile}" \
+          --arg preEvalFile "$preEvalFile" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${preEvalFile} \
+          -I "$preEvalFile" \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,12 +165,6 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq '.paths | length' "${preEvalFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -190,29 +185,61 @@ let
           done
         ) &
 
-        seq_end=$(( chunkCount - 1 ))
+        chunkedEval() {
+          local chunkOutputDir=$1
+          local preEvalFile=$2
 
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
+          local attrCount=$(jq '.paths | length' "$preEvalFile")
+          echo "Attribute count: $attrCount"
+          echo "Chunk size: $chunkSize"
+          # Same as `attrCount / chunkSize` but rounded up
+          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+          echo "Chunk count: $chunkCount"
 
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
+          local seq_end=$(( chunkCount - 1 ))
+          ${lib.optionalString quickTest ''
+            seq_end=0
+          ''}
 
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
+          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
+          seq -w 0 "$seq_end" |
+            xargs -I{} -P"$cores" \
+            ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
 
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
+          if (( chunkSize * chunkCount != attrCount )); then
+            # A final incomplete chunk would mess up the stats, don't include it
+            rm "$chunkOutputDir"/stats/"$seq_end"
+          fi
+        }
 
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        chunkOutputDirs=$(mktemp -d)
+
+        # Preparation for the second eval
+        disallowedAttributesPreEvalFile=$(mktemp)
+        jq '{
+          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
+          attrPathsDisallowedForInternalUse: []
+        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
+
+        startEpoch=$(date +%s)
+
+        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
+        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
+        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
+        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
+        echo "Evaluating the internally allowed attributes"
+        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
+        echo "Evaluating the internally disallowed attributes"
+        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
+
+        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
+
+        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
+        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
+
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c66a5b062439..26030f3f2b6c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -598,6 +598,7 @@ in
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
   flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
+  flarum = runTest ./flarum.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;
   fluentd = runTest ./fluentd.nix;
diff --git a/nixos/tests/flarum.nix b/nixos/tests/flarum.nix
new file mode 100644
index 000000000000..17c7df02f44c
--- /dev/null
+++ b/nixos/tests/flarum.nix
@@ -0,0 +1,52 @@
+{ lib, ... }:
+{
+  name = "flarum";
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      fsagbuya
+      jasonodoom
+    ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      # Flarum installs and migrates the database on first boot and runs a
+      # MariaDB server alongside PHP-FPM and nginx, so give the VM some headroom.
+      virtualisation.memorySize = 2048;
+
+      services.flarum = {
+        enable = true;
+        forumTitle = "NixOS Flarum Test Forum";
+        domain = "localhost";
+        baseUrl = "http://localhost";
+
+        # Run `flarum install` against the locally provisioned MariaDB. Safe here
+        # because the VM always starts from a fresh, empty database.
+        createDatabaseLocally = true;
+
+        adminUser = "admin";
+        adminEmail = "admin@example.com";
+        # Flarum rejects admin passwords shorter than 8 characters.
+        initialAdminPassword = "flarum-admin-password";
+      };
+    };
+
+  testScript = ''
+    start_all()
+
+    # PHP-FPM is ordered after the oneshot installer (Type=oneshot, no
+    # RemainAfterExit), so waiting on it implies the install/migrate finished.
+    machine.wait_for_unit("phpfpm-flarum.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+
+    # The forum front page is server-rendered and embeds the configured title.
+    machine.wait_until_succeeds("curl -sf http://localhost/ -o /dev/null")
+    machine.succeed("curl -sf http://localhost/ | grep -F 'NixOS Flarum Test Forum'")
+
+    # The admin API endpoint should respond, confirming the app booted cleanly.
+    machine.succeed("curl -sf http://localhost/api -o /dev/null")
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 3d4138570f74..dd4df835a93c 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -480,13 +480,15 @@ let
       # BUNDLE_WIDEVINE_CDM build flag does work in the way we want though.
       # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn
       # flag (declare_args) so we simply hardcode it to false.
-      ./patches/widevine-disable-auto-download-allow-bundle.patch
+      ./patches/${lib.optionalString (chromiumVersionAtLeast "150") "chromium-150-"}widevine-disable-auto-download-allow-bundle.patch
     ]
-    ++ [
+    ++ lib.optionals (!chromiumVersionAtLeast "150") [
       # Required to fix the build with a more recent wayland-protocols version
       # (we currently package 1.26 in Nixpkgs while Chromium bundles 1.21):
       # Source: https://bugs.chromium.org/p/angleproject/issues/detail?id=7582#c1
       ./patches/angle-wayland-include-protocol.patch
+    ]
+    ++ [
       # Chromium reads initial_preferences from its own executable directory
       # This patch modifies it to read /etc/chromium/initial_preferences
       ./patches/chromium-initial-prefs.patch
@@ -504,11 +506,16 @@ let
       # allowing us to use our rustc and our clang.
       ./patches/chromium-140-rust.patch
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "141") [
+    ++ lib.optionals (versionRange "141" "150") [
       # Rebased variant of the patch above due to
       # https://chromium-review.googlesource.com/c/chromium/src/+/6897026
       ./patches/chromium-141-rust.patch
     ]
+    ++ lib.optionals (chromiumVersionAtLeast "150") [
+      # Rebased variant of the patch above due to
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7858711
+      ./patches/chromium-150-rust.patch
+    ]
     ++ lib.optionals (!chromiumVersionAtLeast "145" && stdenv.hostPlatform.isAarch64) [
       # Reverts decommit pooled pages which causes random crashes of tabs on systems
       # with page sizes different than 4k. It 'supports' runtime page sizes, but has
@@ -676,6 +683,17 @@ let
         revert = true;
         hash = "sha256-7xg8IZ2gO+Wtnv7lWLVE3lLpcmMgvtDtcWwUuMBzkrE=";
       })
+    ]
+    ++ lib.optionals (versionRange "150" "151") [
+      # ninja: Entering directory `out/Release'
+      # ninja: error: 'ar', needed by 'default_for_rust_host_build_tools/obj/build/rust/allocator/liballoc_error_handler_impl.a', missing and no known rule to make it
+      (fetchpatch {
+        name = "chromium-150-backport-build--Omit-ar-from-inputs-when-resolved-via--PATH.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7904982
+        url = "https://chromium.googlesource.com/chromium/src/+/60f987d8d5f7272793a40290d060b8f50933f825^!?format=TEXT";
+        decode = "base64 -d";
+        hash = "sha256-MryWxSwBxSIONhl3X1cDxTWwNWy8a4yt/sqkrueSUNs=";
+      })
     ];
 
     postPatch =
@@ -910,6 +928,12 @@ let
         # TODO: remove opt-out of https://chromium.googlesource.com/chromium/src/+/main/docs/modules.md
         use_clang_modules = false;
       }
+      // lib.optionalAttrs (chromiumVersionAtLeast "150") {
+        # ERROR at //build/modules/BUILD.gn:80:23: Directory does not exist: /usr/include/
+        #     system_headers += expand_directory("${sysroot}/${root_include_dir}", true)
+        #                       ^------------------------------------------------------
+        use_unified_system_module = false;
+      }
       // {
         use_qt5 = false;
         use_qt6 = false;
@@ -986,24 +1010,34 @@ let
       runHook postConfigure
     '';
 
-    # Chromium expects nightly/bleeding edge rustc features to be available.
-    # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires
-    # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to
-    # enable those features in our stable builds.
-    env.RUSTC_BOOTSTRAP = 1;
-    # Mute some warnings that are enabled by default. This is useful because
-    # our Clang is always older than Chromium's and the build logs have a size
-    # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    env.NIX_CFLAGS_COMPILE =
-      "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
-      # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
-      # because of hardeningDisable = [ "strictflexarrays1" ];
-      + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
-    env.BUILD_CC = "$CC_FOR_BUILD";
-    env.BUILD_CXX = "$CXX_FOR_BUILD";
-    env.BUILD_AR = "$AR_FOR_BUILD";
-    env.BUILD_NM = "$NM_FOR_BUILD";
-    env.BUILD_READELF = "$READELF_FOR_BUILD";
+    env = {
+      # Chromium expects nightly/bleeding edge rustc features to be available.
+      # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires
+      # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to
+      # enable those features in our stable builds.
+      RUSTC_BOOTSTRAP = 1;
+
+      # Mute some warnings that are enabled by default. This is useful because
+      # our Clang is always older than Chromium's and the build logs have a size
+      # of approx. 25 MB without this option (and this saves e.g. 66 %).
+      NIX_CFLAGS_COMPILE =
+        "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
+        # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
+        # because of hardeningDisable = [ "strictflexarrays1" ];
+        + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
+
+      BUILD_CC = "$CC_FOR_BUILD";
+      BUILD_CXX = "$CXX_FOR_BUILD";
+      BUILD_AR = "$AR_FOR_BUILD";
+      BUILD_NM = "$NM_FOR_BUILD";
+      BUILD_READELF = "$READELF_FOR_BUILD";
+    }
+    // lib.optionalAttrs (chromiumVersionAtLeast "150") {
+      # [56385/56385] LINK ./chrome
+      # FAILED: [code=1] chrome
+      # /nix/store/[...]/bin/ld.lld: line 288: /nix/store/[...]/bin/ld.lld: Argument list too long
+      NIX_LD_USE_RESPONSE_FILE = 1;
+    };
 
     buildPhase =
       let
diff --git a/pkgs/applications/networking/browsers/chromium/depot_tools.py b/pkgs/applications/networking/browsers/chromium/depot_tools.py
index ab8007a4e910..45f18098ff61 100755
--- a/pkgs/applications/networking/browsers/chromium/depot_tools.py
+++ b/pkgs/applications/networking/browsers/chromium/depot_tools.py
@@ -43,7 +43,14 @@ class Repo:
         )
 
         deps_file = self.get_file("DEPS")
-        evaluated = gclient_eval.Parse(deps_file, vars_override=repo_vars, filename="DEPS")
+        evaluated = gclient_eval.Parse(
+            deps_file,
+            filename="DEPS",
+            vars_override=repo_vars,
+            # KeyError: "host_cpu was used as a variable, but was not declared in the vars dict (file 'DEPS', line 114)"
+            # https://chromium.googlesource.com/webpagereplay.git/+/b2b856131e36c99e9de9c419fe8ca02f857082ba/DEPS#114
+            builtin_vars= {"host_cpu": "*host_cpu_placeholder*"} if path == "src/third_party/webpagereplay" else None,
+        )
 
         repo_vars = dict(evaluated.get("vars", {})) | repo_vars
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index c87e4a647a90..6e075e7f9b3b 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,6 +1,6 @@
 {
   "chromium": {
-    "version": "149.0.7827.200",
+    "version": "150.0.7871.46",
     "chromedriver": {
       "version": "149.0.7827.201",
       "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=",
@@ -8,21 +8,21 @@
     },
     "deps": {
       "depot_tools": {
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
       },
       "gn": {
-        "version": "0-unstable-2026-05-01",
-        "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756",
-        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
+        "version": "0-unstable-2026-05-27",
+        "rev": "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
-        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
+        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
+        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -32,13 +32,13 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b",
-        "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM="
+        "rev": "03641f7a5b05e48e318d64369057db577cafc594",
+        "hash": "sha256-KnWESGG6aI0S+fkJ3/T1x4QSiIYaOOvWUAm6l6l9iME="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "be1c391acca009d8d80535ce924e3d285451cdfa",
-        "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc="
+        "rev": "5abc7f839700f0f17338434e1c1c6a8c87c00c11",
+        "hash": "sha256-vT1km7JgVpotDoNK+ae1gplSHcwrVNLsv/QAFUrDsIM="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@@ -47,13 +47,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "71192be150bbe04d87bb5298512d464e38d2f654",
-        "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw="
+        "rev": "d6c7a21e978f0adaa43accaad53bc64f0b64f6ec",
+        "hash": "sha256-EuaVSYiR7qrlYqBR0UqdWCvwdzJSn0RS2wC/lnP19AE="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db",
-        "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M="
+        "rev": "6e5ec6f78d8b9f2e8a50fcc5692d1fc8b2964bde",
+        "hash": "sha256-qrkx8Z1fc088Ja32obIUPxDwklI7i1wdEw051UZ08u8="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,8 +72,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010",
-        "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY="
+        "rev": "3da515a67f412be05ea1ea6b39832a69aef8f54e",
+        "hash": "sha256-wrkFsPX7jrsjD/Ow1gna/xLvk0E49m5GVxP1G7Vx7HM="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -82,8 +82,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8",
-        "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY="
+        "rev": "997d654308b6a1a17435e472ef5190aecb12e3eb",
+        "hash": "sha256-xgDgW2foZZEWpr0ibSG21kf028FN07/1ecOqFCkNj/I="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
-        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
+        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
+        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -107,13 +107,18 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b",
-        "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI="
+        "rev": "01471f4b3846c97eceb5b16b8acad950808791b2",
+        "hash": "sha256-SrL+G3osTtJGQslfCBEYbslb2kWtHRrwO87PHi+5o6E="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "208ea23596884f6d86476ea88b64e7931cdec08a",
-        "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04="
+        "rev": "92d1fdf881a932e7aa2a9b20e006136a659c7a20",
+        "hash": "sha256-llPt+UR8hY0yaJkYmq+A3ZfRRReuaXN09qpap6C28jc="
+      },
+      "src/third_party/aria-practices/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/w3c/aria-practices.git",
+        "rev": "7b134ce6d19497cce8a67db4a9f59980baf853dc",
+        "hash": "sha256-POnvoO1KfzJj4CbcMPI0pUTRk5EtHLTOyKKmJCZdXOc="
       },
       "src/third_party/readability/src": {
         "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@@ -127,13 +132,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7",
-        "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I="
+        "rev": "62501cc7db378532d7e85ea434b70d57e1ba2cb0",
+        "hash": "sha256-5cpKTUnhR+QzQJR4KbAvdvqsWnT1fpH0g9MObv8Nx0c="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
-        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
+        "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
+        "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -142,8 +147,8 @@
       },
       "src/third_party/dawn/third_party/directx-shader-compiler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb",
-        "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w="
+        "rev": "35c1b99e9e552267da5efaea07c003e322d65777",
+        "hash": "sha256-pzBk+jUp/FUV8ahHquE0942Qw/DjAUemSM9fxdFJ0JA="
       },
       "src/third_party/dawn/third_party/directx-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -152,8 +157,8 @@
       },
       "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
-        "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb",
-        "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I="
+        "rev": "a30033d3e812c9bf10094f1010374a6b15e192eb",
+        "hash": "sha256-xLacUOSy783bCtv+wUnjVnNLwTQ3eLwUJtYXmELqekY="
       },
       "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
@@ -162,8 +167,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4",
-        "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ="
+        "rev": "f08551b0fc4d6cfa5ba582a0235b571aa363102d",
+        "hash": "sha256-f5kWMnaod/Ved1Fz/vTkdL0ihSUnNM8XN5Ht3Vs1YpU="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
@@ -187,8 +192,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "65818adf16411ca394625f5747a1af28faf95d2c",
-        "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo="
+        "rev": "3a9254f16eda7a4c5d2260039ff23456a0a34de4",
+        "hash": "sha256-JuMnNppWhIFHYfk6ANIZLC7ABhqMseoV5LYV7slevBE="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -202,13 +207,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641",
-        "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA="
-      },
-      "src/third_party/catapult/third_party/webpagereplay": {
-        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "2852bb7e91e4995502ffb72b7ed21412ee157914",
+        "hash": "sha256-XYufVvzOXD4voZUWUvumQQqLNsx9sy0QmQzNzrgNEWg="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -227,13 +227,13 @@
       },
       "src/third_party/cpu_features/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git",
-        "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b",
-        "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys="
+        "rev": "81d13c49649f0714dd41fb56bb246398b6584085",
+        "hash": "sha256-TrC1WMLAhko57rAyDCiAC/IJ0unAqVhyjkh7gKibyi4="
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c",
-        "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw="
+        "rev": "ea6b9f1bb6e1001d8b21574d5bc78ddef62e499d",
+        "hash": "sha256-/QsOjDik0TnH3FnK7LOwsJkvX+O+2DRFX4eF3MxD3fc="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -242,28 +242,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f",
-        "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA="
+        "rev": "1c69e700a01a7fd3dd331f526c8a31ac1e5e49d0",
+        "hash": "sha256-qIwUs0KVU9xYFLN3UUayPLfz0ObA+EN6owKPW61J/5w="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af",
-        "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o="
+        "rev": "7d52b4ffbc319a7d5a0e0a0ebff744e5281d60c5",
+        "hash": "sha256-iwwvvIOuRMo/ZEu8Gk0lZaS4P5uGt8zpnYMChpZPcUo="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "baf176aadedccc44329231d5dd40346874c2a63e",
-        "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw="
+        "rev": "7b3de17542cc613aaddbfc72c6e12be37eed7b73",
+        "hash": "sha256-7ly4vaK+Pj4y91t6Q+igQ0890CqKyu9jNBhJnxbNGjI="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361",
-        "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0="
+        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
+        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -277,8 +277,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2cf9891537250255f50df5109ffe9e700e2a73de",
-        "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o="
+        "rev": "662ba79d796a2851b10cdafc6668e45b65b1120f",
+        "hash": "sha256-6bZFDeo7TqWNunkkQv8OJ+7/hfKwoIUtqZoXaeLp6M8="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -287,18 +287,18 @@
       },
       "src/third_party/fast_float/src": {
         "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git",
-        "rev": "05087a303dad9c98768b33c829d398223a649bc6",
-        "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A="
+        "rev": "cfd12ebcf1f82c4fd44a950b1815dd0549bc8d89",
+        "hash": "sha256-hzoB+Mmok3oe6B494uLc5ReWpUcB89zCGPYw4gvanK0="
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "3112513bf1a80872311e7718c5385f535a819b89",
-        "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU="
+        "rev": "8de5837b817f28abc54a387a9417631b905ba90a",
+        "hash": "sha256-GZYo0FjgW8XCplAi6jzzruwDlIzsWjNEVQuCwXBCPz8="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
-        "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk="
+        "rev": "ad41607c61898cf7150e0fb20fe4bbabd44922a3",
+        "hash": "sha256-41qpsOTedB51WMzzHXDiXA19OIzA7wG/Qgbz6IkmWpk="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -327,8 +327,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a",
-        "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4="
+        "rev": "b08a2eb0dd37f4a6c886fa5b0ecf5b3e1d27aac7",
+        "hash": "sha256-xnYeUAJx5n8LSg04AknfiudonfmlUdlj8nzHzSZi65I="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -337,13 +337,13 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3",
-        "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8="
+        "rev": "d639197ed529b05c27f38ebaab365a621d5edad5",
+        "hash": "sha256-uT4zK2hwHzEH6Nrd2rAeyzpQA1TmwtrdcujKYEUbLsY="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd",
-        "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k="
+        "rev": "0f9c6172b2ccc6b830ae313d522caf09e6933e06",
+        "hash": "sha256-LF+OcqNeg+KRuYmGuMZb4tmnr53sZHn/ZW1jg9ArPfc="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -367,8 +367,8 @@
       },
       "src/third_party/libgav1/src": {
         "url": "https://chromium.googlesource.com/codecs/libgav1.git",
-        "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc",
-        "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo="
+        "rev": "66ac17620652635392f6ab24065c77b035e281c9",
+        "hash": "sha256-6/zMaX2DPSKpsaqirhrgi3nL/88Qr2VXacmyL5IyJ3U="
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
@@ -392,8 +392,8 @@
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
-        "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-        "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q="
+        "rev": "d4d072177213b117fb81d4cfda140de090616161",
+        "hash": "sha256-q+DOwkjRlHacgfWf5UVY02aqfnKK9M/1YRBX6aMce9g="
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
@@ -407,8 +407,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be",
-        "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk="
+        "rev": "da27bcae1a8902af1ae6a5c55d3674f22709bbf5",
+        "hash": "sha256-317zRhJPc0D9A58W8fdCGFmpNZ5vACfd/tlZOsp/Cvw="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -417,18 +417,18 @@
       },
       "src/third_party/libaddressinput/src": {
         "url": "https://chromium.googlesource.com/external/libaddressinput.git",
-        "rev": "e20690c8d5178bb282641d5eb06ef0298ff4cbc5",
-        "hash": "sha256-rX7LQNUgk5ZljUrayD1a/SUrBrvpomW0Cs0KBw3lYu4="
+        "rev": "81eb9628382b07d371d8ea0b11badf7de3857fd5",
+        "hash": "sha256-6yDZpZ+CwxGqNO4+lZLFB6ESREeVku1BoOMtR+hKQ3I="
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a",
-        "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs="
+        "rev": "137bcff61e73fdd2836dc04e8258bfb49cef595e",
+        "hash": "sha256-oDubKvgqMk3w0luM//rR3NnCOk1h/WVTyRkuCmYASrw="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c433c9a32320aed983e4106931596fbbae3f77ee",
-        "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q="
+        "rev": "5e140b5abb9a91eb25b5ef66d29f6ee784ab7eab",
+        "hash": "sha256-tN+2YH2O9FTV50o4OVhKcKdwRwTI8NuNA0WqljUcrmo="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -442,8 +442,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "de88e36ae91d5bd13126fa4cc4b0e0346d779842",
-        "hash": "sha256-ZpU0ONqIVmY2VR0MxqtYj8KPNlK0L21gLJuT/Ff7KI8="
+        "rev": "b7babdf323e64e69bd2f6c376189c15825f5c73a",
+        "hash": "sha256-s6UMdUYWZqk/MbhyCi2zdQNgni98gGsYxcuUh/5AUy0="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -482,8 +482,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57",
-        "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k="
+        "rev": "0abb2efaa3d16db861c9710b193c39e657ac3bdf",
+        "hash": "sha256-viuntf6umyLZwDR9BXG+ZOakp9f8rvpZYDBYAUkKzL4="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -492,8 +492,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
-        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
+        "rev": "9bdfbc77e3355405ceefbe59420abed953a5657e",
+        "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -502,8 +502,8 @@
       },
       "src/third_party/libjpeg_turbo": {
         "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-        "rev": "d1f5f2393e0d51f840207342ae86e55a86443288",
-        "hash": "sha256-KGeB/lTjhm8DQBDZVSPENvZEGSHeLTkviJrYsFh5vEM="
+        "rev": "640f254ad0fa03f6b1f29f89b7dd9366f2f6e533",
+        "hash": "sha256-wor4RTF3/5BFL9EWcGEofY+M4HN2+/KJUaOY+u86K5Q="
       },
       "src/third_party/liblouis/src": {
         "url": "https://chromium.googlesource.com/external/liblouis-github.git",
@@ -512,8 +512,8 @@
       },
       "src/third_party/libphonenumber/src": {
         "url": "https://chromium.googlesource.com/external/libphonenumber.git",
-        "rev": "ade546d8856475d0493863ee270eb3be9628106b",
-        "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg="
+        "rev": "c25558e39e2bcc9f26f7a2a1ef804324169eaf8f",
+        "hash": "sha256-Lr/gB5Em+TE092McPwJdOU0Ab4zyP4/2ZxlavMZMm+s="
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
@@ -537,8 +537,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
-        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
+        "rev": "5f00413667d19ad683674524a9d03543d86d188b",
+        "hash": "sha256-uTteQ+z7t5KOtPuBoZazmonRHd8jGS1/YZAq+RAvhX4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -552,8 +552,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
-        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
+        "rev": "3c5fa6ef272f6077d76816ee3d6a697ef1d6d272",
+        "hash": "sha256-FXFSC9dRb/KhSQdhJUqKEUpZbzU8ZpVnoSXtF/HPiJI="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -572,8 +572,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f",
-        "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc="
+        "rev": "525a09a813be0f75b646ee93fc2a31c27b87d722",
+        "hash": "sha256-uC6bGxSdz1V2SXIQjMsDd6555b3gAPN1Y0ZQtWoqDww="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -587,8 +587,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e",
-        "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE="
+        "rev": "37ff938a93cb04c6b77e019b52328c8e9b320317",
+        "hash": "sha256-M57un/TVQPfTnKScVHS1VK1cUs8F/YPT3TwMVdo+mhM="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -602,13 +602,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
-        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
+        "rev": "c052afb72a08d79a26bcf3103d11f344981b09f1",
+        "hash": "sha256-zqfErp0pDXHXIvRpZ1TJu2UGXNZjATRbPgQWTniKTJs="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
-        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
+        "rev": "9ede949f025303868fa0c42418f122ac47312539",
+        "hash": "sha256-IRzEqgunO4Nfz+FkYir8G/Ht+Zsn6wpzncgkEFpsC+k="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -617,8 +617,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "a56dcd79c699366e7ac6466792c3025883ff7704",
-        "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY="
+        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
+        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -647,13 +647,18 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67",
-        "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ="
+        "rev": "1aab872af8d44dcf59362d7ba8255922f74fafde",
+        "hash": "sha256-5/XnNx6Pyk4KBb9krVo9u6i7LWNrsLLOIi4qhEY2PZc="
+      },
+      "src/third_party/sframe/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/cisco/sframe",
+        "rev": "b14090904433bed0d4ec3f875b9b39f3e0555930",
+        "hash": "sha256-bw+6ycUpnFZJhtXFUzr7XTOljNrs+7oFdVY+LN0Rqek="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
-        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
+        "rev": "14d05ec761901b6e9e9193af8b347ab3a7f6fed0",
+        "hash": "sha256-KZGrztOKaT368KSCxiJAqnsgINpNODUlaXnH/maQNIA="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -667,13 +672,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
-        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
+        "rev": "fc121d7d03cd6cbf499ec06a5112b263471b1181",
+        "hash": "sha256-hf9PxQhXEKT49GbkFYCvRPBT0Qu+hDnDpebI92yO1Oo="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305",
-        "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o="
+        "rev": "fce27a96526f54c6d31fdccf57629788e3712220",
+        "hash": "sha256-bmXZLpz3wv7eQWoqTjZmjwnnILWSIjZ8iqo8CeLk5fw="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -682,23 +687,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "2216f531fb72119745382c62f232acf9790f4b6e",
-        "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI="
+        "rev": "999d49c10046e240cd5366d349d3a5f6af16a0d4",
+        "hash": "sha256-eSqaWXtzZ4Bi9ilaJYGdZamzUjmo+AtDZ9KeZhsc/fY="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0",
-        "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts="
+        "rev": "09b4b05203fd7a9402ffcce9cc736d887ff7e3fc",
+        "hash": "sha256-skMOzpsn67mmOAp7Mf6UrJdi2lbiQQ8b6kBy4Ik2ED8="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc",
-        "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk="
+        "rev": "669a28b1f31f89bfc46b74791f127bcc5e5b2f06",
+        "hash": "sha256-lsR+sh+XQP/wKgkBbie6Gp+kQNFnnC8TeNWpiWTdevw="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a",
-        "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw="
+        "rev": "f6d9303ddaf2e879b9155f7186cd234f5a79079c",
+        "hash": "sha256-ru3QVyyyqxZRcvSpy9pYhHHhkjuLVhQbgOT/vQJ/oIw="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -707,43 +712,43 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "126038020c2bd47efaa942ccc364ca5353ffccde",
-        "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc="
+        "rev": "1e770e7de8373a8dd49f23416cf7ca4001d01040",
+        "hash": "sha256-t8Shkoa90TJt1MbTOefnLaguW4eYKsRFO1Jd0AUc70Y="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f",
-        "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q="
+        "rev": "b38c4f83024546d4000b2db8e2294cf81b7f26e0",
+        "hash": "sha256-q5G4B75xBIXl1aG/vzbIDrc3Hs/MFoQ4nwh4ozb8hys="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8",
-        "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ="
+        "rev": "015e25c3c91b70eb1a754d36fb14c4ba6ad9b0b9",
+        "hash": "sha256-pUxPwFGbOzP8ymTooeA1slFWEFsRoqUROSnndVtLiY8="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "15a84652b94e465e9a7b25eb507193929863bc2f",
-        "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84="
+        "rev": "cf0cf82ea16c0ff0be75940f282540d6085b2d3b",
+        "hash": "sha256-uyoysS7lSBNDRfvcwPT+gQqhE20UxiYUEw1UXnYS3fY="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "7c46da2b39036a80ce088576d5794bf39e667f56",
-        "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw="
+        "rev": "e3d18f90c0b8ef1f52539e0674a42f0adfe30381",
+        "hash": "sha256-Hs9N0FM3eWWjLm4BrDJoZIrsPDVFx0iRAJeQ4gHTM7o="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead",
-        "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho="
+        "rev": "8383c46b129c2b3a5f3833e602d946d2fcc57e39",
+        "hash": "sha256-ZBie5uDTVEehxRQW1GZY5Ki/bnp82LoW3jfMUFL0O9A="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c",
-        "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk="
+        "rev": "044eaba8a34a6e3bfb1d6aafac7c01068813a2b6",
+        "hash": "sha256-i3hochkK0LZPg8CsZMFkAL+8tf8QuuwtApAc4FDd0RM="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
-        "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50",
-        "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo="
+        "rev": "7e55b011e16182fc349149abbd3aaf3b1db46421",
+        "hash": "sha256-fOnFkcQDEGIe5yB507qnP9nA1LBBPFblncNiJ8JxAwI="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -777,18 +782,23 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3",
-        "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I="
+        "rev": "b507bd117e53db86f2fb52d0d858d3ae7d684a85",
+        "hash": "sha256-6Y5Z0ErtsZdbuWTHa+PEiOxcZSbjBcnuOHbgtI1/+80="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "b2b856131e36c99e9de9c419fe8ca02f857082ba",
+        "hash": "sha256-+hcaP7C5Eh3SLl5B8mRgOVdM/tvnFnb/oqUIWPoe0NA="
+      },
+      "src/third_party/webpagereplay/third_party/clang-format/script": {
+        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git",
+        "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11",
+        "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
-        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
+        "rev": "1f975dfd761af6e5d76d28333191973b258d82a8",
+        "hash": "sha256-ucH+9HBkFyOKEItAWVoYmEzyU7h/UgWIvp/eC/JqGWU="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -802,8 +812,8 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80",
-        "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg="
+        "rev": "56ac34b3f45fae2eca1f32584f7f0b279be2cf1f",
+        "hash": "sha256-uw3r5g5rWamlFubBkXDb4KRx3hkOAoQyFo8l95GYGZI="
       },
       "src/third_party/libei/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git",
@@ -812,13 +822,18 @@
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
-        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
+        "rev": "5233c58e6ca0b1c4c6b353ad79649191ed195bdc",
+        "hash": "sha256-vEl0s7Mjh+5rciOMxm99PNWiamtCk+sTN4lRYKCIZ+8="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
-        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
+        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
+        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
+      },
+      "src/agents/shared": {
+        "url": "https://chromium.googlesource.com/chromium/agents.git",
+        "rev": "e75efa515896f6bf1dea92eaffbcf8ee711a65d8",
+        "hash": "sha256-z2GrzF8jDkdfBdq1HP3gTgQpoqjmhc80kEZBmlue0os="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch
new file mode 100644
index 000000000000..113097a87be8
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch
@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index e1da11405c1f667280099ee815abc5349d1ad1bd..202992dbbe1c2a70eb6d8b559568d388f98b28f6 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1678,16 +1678,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations.
+-  # We want to use the C++ intrinsics, not the ones in the Rust
+-  # compiler_builtins library. The Rust symbols are marked as weak, so that they
+-  # can be replaced by the C++ symbols. This config ensures the C++ symbols
+-  # exist and are strong in order to cause that replacement to occur by
+-  # explicitly linking in clang's compiler-rt library.
+-  if (is_clang && !(is_a_target_toolchain && is_cronet_build)) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch
new file mode 100644
index 000000000000..84926ab177b3
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch
@@ -0,0 +1,27 @@
+diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn
+index 6d18f9fa163718d95610de9b6229dd38478543c7..93884543edcaa7211f4a7d61175bc068c6fd7dd4 100644
+--- a/third_party/widevine/cdm/BUILD.gn
++++ b/third_party/widevine/cdm/BUILD.gn
+@@ -19,7 +19,7 @@ buildflag_header("buildflags") {
+ 
+   flags = [
+     "ENABLE_WIDEVINE=$enable_widevine",
+-    "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm",
++    "BUNDLE_WIDEVINE_CDM=true",
+     "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component",
+     "ENABLE_MEDIA_FOUNDATION_WIDEVINE_CDM=$enable_media_foundation_widevine_cdm",
+   ]
+diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni
+index 927b2e4809cf76e6b3ef51ee6cd2bbd04a92d60b..41761d10a4105a20fc4acf35f761c7ab23f867dd 100644
+--- a/third_party/widevine/cdm/widevine.gni
++++ b/third_party/widevine/cdm/widevine.gni
+@@ -40,8 +40,7 @@ enable_library_widevine_cdm =
+ # Widevine CDM can be deployed as a component. Currently only supported on
+ # desktop platforms. The CDM can be bundled regardless whether it's a
+ # component. See below.
+-enable_widevine_cdm_component =
+-    enable_library_widevine_cdm && (is_win || is_mac || is_linux || is_chromeos)
++enable_widevine_cdm_component = false
+ 
+ # Enable (Windows) Media Foundation Widevine CDM component.
+ declare_args() {
diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json
index d166f3b4524c..0a8aa45e4ab9 100644
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.18-stable",
+  "version": "1.3.19-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.18-stable/acli_1.3.18-stable_darwin_arm64.tar.gz",
-      "sha256": "9e4890e441e2762adbb6bd94451fdea554177806a6044469ece7b14e603d2040"
+      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_arm64.tar.gz",
+      "sha256": "c5f1b1f6db63972d126a2f8ac9aca9a199739c7b51ac9e352e8ae3ed2b27131c"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.18-stable/acli_1.3.18-stable_linux_arm64.tar.gz",
-      "sha256": "ac71711da43649854689ad0f74e44f18b0da3fd0ee776ceb4307ae7eb1e5da85"
+      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_arm64.tar.gz",
+      "sha256": "72972e74fa9036c5b40175570234a2e79559776c06a3aa29f632a39c7d3674da"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.18-stable/acli_1.3.18-stable_darwin_amd64.tar.gz",
-      "sha256": "4078846601b2e222ecbbc6b314a1c58ca6c41c18d1b118833814c942be00befe"
+      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_amd64.tar.gz",
+      "sha256": "394096ecd5a6082cbbbc8b2f3e1f1fbe694cdb340e25a4014eeb78461b869beb"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.18-stable/acli_1.3.18-stable_linux_amd64.tar.gz",
-      "sha256": "4ad4badc481ac1eff452f531c405a20422eb57513cc898d2a1f8ea945d6c24f6"
+      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_amd64.tar.gz",
+      "sha256": "f29fa8b7f01710053c2f4e07723501ebfe448672b669d32d83e961686d383a6d"
     }
   }
 }
diff --git a/pkgs/by-name/an/ankama-launcher/package.nix b/pkgs/by-name/an/ankama-launcher/package.nix
index 8b7510c8831e..c0791db9e72e 100644
--- a/pkgs/by-name/an/ankama-launcher/package.nix
+++ b/pkgs/by-name/an/ankama-launcher/package.nix
@@ -5,15 +5,15 @@
 }:
 let
   pname = "ankama-launcher";
-  version = "3.14.8";
+  version = "3.14.14";
 
   # The original URL for the launcher is:
   # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
   # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
   # To update the client, head to web.archive.org and create a new snapshot of the download page.
   src = fetchurl {
-    url = "https://web.archive.org/web/20260413125512/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-wHLzF30ZeTgBG1TFlkSt0Tsm82cNb/C/eTUZjjYsgVE=";
+    url = "https://web.archive.org/web/20260605015300/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-9w1ho9DZvDHXQbXjpMY1wnWDwYlMKO1igrJcCahQkVQ=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/an/anydesk/package.nix b/pkgs/by-name/an/anydesk/package.nix
index 5e0d5804dbf2..28c2e9e83788 100644
--- a/pkgs/by-name/an/anydesk/package.nix
+++ b/pkgs/by-name/an/anydesk/package.nix
@@ -4,8 +4,8 @@
   fetchurl,
   makeWrapper,
   makeDesktopItem,
-  genericUpdater,
   writeShellScript,
+  jq,
   atk,
   cairo,
   gdk-pixbuf,
@@ -164,24 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = genericUpdater {
-      versionLister =
-        let
-          arch =
-            if system == "x86_64-linux" then
-              "amd64"
-            else if system == "aarch64-linux" then
-              "arm64"
-            else
-              throw "cannot update AnyDesk on ${system}";
-        in
-        writeShellScript "anydesk-versionLister" ''
-          curl -s https://anydesk.com/en/downloads/linux \
-            | grep "https://[a-z0-9._/-]*-${arch}.tar.gz" -o \
-            | uniq \
-            | sed 's,.*/anydesk-\(.*\)-${arch}.tar.gz,\1,g'
-        '';
-    };
+    updateScript = ./update.sh;
   };
 
   meta = {
diff --git a/pkgs/by-name/an/anydesk/pin.json b/pkgs/by-name/an/anydesk/pin.json
index be59d275a145..5c5c41eb883e 100644
--- a/pkgs/by-name/an/anydesk/pin.json
+++ b/pkgs/by-name/an/anydesk/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "8.0.2",
-  "x86_64-linux": "sha256-6noMPfe0x6kx/whyd66qcmk7WhEivx3xK5q58Se9Ij0=",
-  "aarch64-linux": "sha256-wfY+OCx9OyLCmiA29RjnYzcg/pApMIXWT5UrcdcyRYM="
+  "version": "8.0.3",
+  "x86_64-linux": "sha256-Mjl17hh5A/pwRAi7giL1SJYlQ61O0SXX+KeH8STZ4bs=",
+  "aarch64-linux": "sha256-MhAj5cy81uBMoNeFPvOyhBOlJzBgNRHXyCXrpdvF8nE="
 }
diff --git a/pkgs/by-name/an/anydesk/update.sh b/pkgs/by-name/an/anydesk/update.sh
new file mode 100755
index 000000000000..166540cf7b8b
--- /dev/null
+++ b/pkgs/by-name/an/anydesk/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env -S nix shell nixpkgs#curl nixpkgs#jq nixpkgs#nix --command bash
+
+set -euo pipefail
+
+directory="$(dirname $0 | xargs realpath)"
+
+new_version=$(
+  curl -s https://rpm.anydesk.com/rhel/x86_64/Packages/ \
+    | grep -oP 'anydesk_\K[0-9]+\.[0-9]+\.[0-9]+(?=-[0-9]+_x86_64\.rpm)' \
+    | sort -V \
+    | tail -1
+)
+
+old_version=$(jq -r '.version' "$directory/pin.json")
+
+if [[ "$new_version" == "$old_version" ]]; then
+  echo "anydesk is already up to date ($old_version)"
+  exit 0
+fi
+
+echo "Updating anydesk: $old_version -> $new_version"
+
+hash_amd64=$(nix hash to-sri --type sha256 \
+  "$(nix-prefetch-url --type sha256 \
+    "https://download.anydesk.com/linux/anydesk-${new_version}-amd64.tar.gz")")
+
+hash_arm64=$(nix hash to-sri --type sha256 \
+  "$(nix-prefetch-url --type sha256 \
+    "https://download.anydesk.com/rpi/anydesk-${new_version}-arm64.tar.gz")")
+
+cat > "$directory/pin.json" << EOF
+{
+  "version": "$new_version",
+  "x86_64-linux": "$hash_amd64",
+  "aarch64-linux": "$hash_arm64"
+}
+EOF
+
+cat "$directory/pin.json"
diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 5eb0d22fef51..acdc60aef140 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,17 +8,17 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.6.0";
+  version = "13.7.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E=";
+    hash = "sha256-BrgjkqkVnLYMlouyopUoCTby2z4YWZl4UK7m3Ktm5bE=";
   };
 
-  mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc=";
+  mvnHash = "sha256-IKO61ugVjF03zA6pCwYKmwMVx/Ogy8hrt70ArOUm0NA=";
 
   nativeBuildInputs = [
     maven
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 0efdeb47fcdc..8274263ecb82 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -32,17 +32,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.7.14";
+  version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-tkZc89JOhXCdMVSAOQYGR6HDe7KmCI5/haLH1RP2p7I=";
+    hash = "sha256-jOcIrZj+830XMZJcgTm0C4yDvk96dbW7RYGgyhLHS4Y=";
   };
 
-  cargoHash = "sha256-bFQLsAF4hFBRw04VaL+sxvxIZ9p7nXOLSr2BIZKcwiI=";
+  cargoHash = "sha256-QtCkmNXOrtl4T4NSESV7J3qiyKMwMOoa4oWfTZIJRMc=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/de/deno/rusty-v8/default.nix b/pkgs/by-name/de/deno/rusty-v8/default.nix
index b58fd23d14fc..49aa0314a3f6 100644
--- a/pkgs/by-name/de/deno/rusty-v8/default.nix
+++ b/pkgs/by-name/de/deno/rusty-v8/default.nix
@@ -70,34 +70,26 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusty-v8";
-  version = "147.4.0";
+  version = "149.3.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "rusty_v8";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-cS9oBDY2+9RtdqPuOadNl0Lce89ESpBb1qPiWSHPiCg=";
+    hash = "sha256-hQfSDpdQBeQrOerXi+fI6mGCXkFH2ro90eWZX7xcwjA=";
   };
 
   patches = [
     ./librusty_v8_no_downloads.patch
-    (fetchpatch {
-      name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
-      # https://chromium-review.googlesource.com/c/chromium/src/+/7539408
-      url = "https://chromium.googlesource.com/chromium/src/+/acb47d9a6b56c4889a2ed4216e9968cfc740086c^!?format=TEXT";
-      decode = "base64 -d";
-      revert = true;
-      includes = [ "build/config/compiler/BUILD.gn" ];
-      hash = "sha256-0yEK66IEyS8xABDHY4W8oIvl4Ga1JfL1wxQy8PhXyqI=";
-    })
-    ./librusty_v8_revert_-fno-lifetime-dse.patch
+    ./llvm22.patch
+    ./gn_inputs_fix.patch
   ]
   ++ lib.optionals stdenv.targetPlatform.isDarwin [
     ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch
   ];
 
-  cargoHash = "sha256-e/G9AevaJwqYdr8022kmv05Mwzi4Cishj9imLproNB0=";
+  cargoHash = "sha256-ROz8f+o/OVNKSm4Hp1z4eCI2pmlNTUpBZ5447uvVXUk=";
 
   nativeBuildInputs = [
     llvmPackages.clang
@@ -119,6 +111,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     apple-sdk_15
   ];
 
+  postPatch = ''
+    ln -sv ${rustToolchain} third_party/rust-toolchain
+  '';
+
   env = {
     V8_FROM_SOURCE = 1;
     PYTHON = "python3";
@@ -132,9 +128,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
         "rustc_version=\"${rustc.version}\""
         "rust_sysroot_absolute=\"${rustToolchain}\""
         "rust_bindgen_root=\"${rustToolchain}\""
-        # To accomodate our newer rustc compiler
-        "removed_rust_stdlib_libs=[\"adler\"]"
-        "added_rust_stdlib_libs=[\"adler2\"]"
       ]
       ++ lib.optional stdenv.targetPlatform.isDarwin "mac_deployment_target=\"${stdenv.targetPlatform.darwinMinVersion}\""
     );
diff --git a/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch b/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch
new file mode 100644
index 000000000000..19a8a7a86a0a
--- /dev/null
+++ b/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch
@@ -0,0 +1,105 @@
+Submodule build contains modified content
+diff --git a/build/toolchain/gcc_toolchain.gni b/build/toolchain/gcc_toolchain.gni
+index b9b5b0d76..4004f306e 100644
+--- a/build/toolchain/gcc_toolchain.gni
++++ b/build/toolchain/gcc_toolchain.gni
+@@ -712,7 +712,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $libname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_rlib") {
+@@ -745,7 +744,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $rlibname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_bin") {
+@@ -767,7 +765,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $exename -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_cdylib") {
+@@ -790,7 +787,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_dylib") {
+@@ -815,7 +811,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_macro") {
+@@ -838,7 +833,6 @@ template("single_gcc_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+     }
+ 
+diff --git a/build/toolchain/apple/toolchain.gni b/build/toolchain/apple/toolchain.gni
+index 0aa4e736f..e3f59728d 100644
+--- a/build/toolchain/apple/toolchain.gni
++++ b/build/toolchain/apple/toolchain.gni
+@@ -325,7 +325,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $libname -- -Clinker=\"$_cxx\" {{source}} LDFLAGS $bin_flag RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_rlib") {
+@@ -359,7 +358,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $rlibname -- -Clinker=\"$_cxx\" {{source}} LDFLAGS RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_bin") {
+@@ -392,7 +390,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $exename -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args $bin_flag {{ldflags}} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_cdylib") {
+@@ -427,7 +424,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args $bin_flag {{ldflags}} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_dylib") {
+@@ -464,7 +460,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $dllname -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args {{ldflags}} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+ 
+       tool("rust_macro") {
+@@ -499,7 +494,6 @@ template("single_apple_toolchain") {
+             "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}"
+         command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${_cxx}\" {{source}} LDFLAGS $bin_flag {{ldflags}} RUSTENV {{rustenv}}"
+         rust_sysroot = rust_sysroot_relative
+-        inputs = rustc_wrapper_inputs
+       }
+     }
+ 
diff --git a/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch b/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch
deleted file mode 100644
index 6035fa552d00..000000000000
--- a/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Submodule build contains modified content
-diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
-index ff8022f04..59699e1d4 100644
---- a/build/config/compiler/BUILD.gn
-+++ b/build/config/compiler/BUILD.gn
-@@ -625,13 +625,6 @@ config("compiler") {
-       ]
-     }
- 
--    # The performance improvement does not seem worth the risk. See
--    # https://crbug.com/484082200 for background and https://crrev.com/c/7593035
--    # for discussion.
--    if (!is_wasm) {
--      cflags += [ "-fno-lifetime-dse" ]
--    }
--
-     # TODO(hans): Remove this once Clang generates better optimized debug info
-     # by default. https://crbug.com/765793
-     cflags += [
diff --git a/pkgs/by-name/de/deno/rusty-v8/llvm22.patch b/pkgs/by-name/de/deno/rusty-v8/llvm22.patch
new file mode 100644
index 000000000000..aafc7e322e63
--- /dev/null
+++ b/pkgs/by-name/de/deno/rusty-v8/llvm22.patch
@@ -0,0 +1,60 @@
+Submodule build contains modified content
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 1b53cb1d4..724f867f5 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1916,7 +1916,6 @@ ubsan_hardening("c_array_bounds") {
+   # the related warning about "unsafe-buffer-usage-in-static-sized-array",
+   # since we know that the array bounds sanitizing will catch any out-of-
+   # bounds accesses.
+-  cflags = [ "-Wno-unsafe-buffer-usage-in-static-sized-array" ]
+ }
+ 
+ # Enable UBSan subset to ensure we always hit `return` statement in non-void
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 1b53cb1d4..51367ceb2 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -601,7 +601,6 @@ config("compiler") {
+     # Flags for diagnostics.
+     cflags += [ "-fcolor-diagnostics" ]
+     if (!is_win) {
+-      cflags += [ "-fdiagnostics-show-inlining-chain" ]
+     } else {
+       # Combine after https://github.com/llvm/llvm-project/pull/192241
+       cflags += [ "/clang:-fdiagnostics-show-inlining-chain" ]
+diff --git a/build/config/sanitizers/sanitizers.gni b/build/config/sanitizers/sanitizers.gni
+index 329a2fc8b..083b635e3 100644
+--- a/build/config/sanitizers/sanitizers.gni
++++ b/build/config/sanitizers/sanitizers.gni
+@@ -535,12 +535,6 @@ template("ubsan_hardening") {
+         "-fsanitize=${invoker.sanitizer}",
+         "-fsanitize-trap=${invoker.sanitizer}",
+ 
+-        # Prevents `__has_feature(undefined_behavior_sanitizer)`
+-        # from evaluating true. Configs defined here are intended to
+-        # be usable even in release builds, i.e. as widely as possible.
+-        # It's important not to have full-on UBSan workarounds activate
+-        # just because we built support for a specific sanitizer.
+-        "-fsanitize-ignore-for-ubsan-feature=${invoker.sanitizer}",
+       ]
+       if (defined(invoker.cflags)) {
+         cflags += invoker.cflags
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index ff8022f04..59699e1d4 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -625,13 +625,6 @@ config("compiler") {
+       ]
+     }
+ 
+-    # The performance improvement does not seem worth the risk. See
+-    # https://crbug.com/484082200 for background and https://crrev.com/c/7593035
+-    # for discussion.
+-    if (!is_wasm) {
+-      cflags += [ "-fno-lifetime-dse" ]
+-    }
+-
+     # TODO(hans): Remove this once Clang generates better optimized debug info
+     # by default. https://crbug.com/765793
+     cflags += [
diff --git a/pkgs/by-name/du/dumpifs/package.nix b/pkgs/by-name/du/dumpifs/package.nix
index 6966e375bd7c..c01a80115082 100644
--- a/pkgs/by-name/du/dumpifs/package.nix
+++ b/pkgs/by-name/du/dumpifs/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postUnpack = ''
-    rm source/{dumpifs,exMifsLzo,uuu,zzz}
+    rm ${finalAttrs.src.name}/{dumpifs,exMifsLzo,uuu,zzz}
   '';
 
   patches = [ ./package.patch ];
diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix
index 227eb5b395fe..d79a26a5bb34 100644
--- a/pkgs/by-name/fl/flarum/package.nix
+++ b/pkgs/by-name/fl/flarum/package.nix
@@ -2,6 +2,7 @@
   lib,
   php,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 php.buildComposerProject2 (finalAttrs: {
@@ -19,6 +20,8 @@ php.buildComposerProject2 (finalAttrs: {
   composerStrictValidation = false;
   vendorHash = "sha256-EHl+Mr6y5A51EpLPAWUGtiPkLOky6KvsSY4JWHeyO28=";
 
+  passthru.tests.module = nixosTests.flarum;
+
   meta = {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
     description = "Delightfully simple discussion platform for your website";
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 5ee10e29eb8f..11b14a9bcb6d 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.13.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-tPVGMAP45x/4NTL8px9jEbW6hQyhiOYiZp0tuDdfYL8=";
+    hash = "sha256-BSH7NQV2iTmfGE6dHQEeObQQ5CkKZxsgHAbrjElHHHE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-0/tHzfJrotlCxhiiVC6yddlj62Ef6IAeaZf/xufFiWU=";
+  npmDepsHash = "sha256-0Si+3zHyGoMbgEpNWdZVp+obNE0oqM8ghYDZvloJU5g=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \
diff --git a/pkgs/by-name/gn/gnucash/package.nix b/pkgs/by-name/gn/gnucash/package.nix
index 97a0ed3a40c1..6c5f3669e0dd 100644
--- a/pkgs/by-name/gn/gnucash/package.nix
+++ b/pkgs/by-name/gn/gnucash/package.nix
@@ -37,12 +37,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnucash";
-  version = "5.15";
+  version = "5.16";
 
   # raw source code doesn't work out of box; fetchFromGitHub not usable
   src = fetchurl {
     url = "https://github.com/Gnucash/gnucash/releases/download/${finalAttrs.version}/gnucash-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-sL1K9Dtr3jRUIn1LOY6ex6Db1RQ0acE3P8gkw8qrCQk=";
+    hash = "sha256-u5tsZ+u2o+Btn/T04EF6l77wFZ0mkSvpsOdaMpAf1JM=";
   };
 
   nativeBuildInputs = [
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
         owner = "Gnucash";
         repo = "gnucash-docs";
         tag = finalAttrs.version;
-        hash = "sha256-EI/By0Ek3qDCmi6svX96Wg78UnmsDZzQLRSqErPUuxA=";
+        hash = "sha256-KC2POdwKma2CWpom3kN4X4MAItJFeWHl4SIV7sb+KCo=";
       };
 
       nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index a0b030218353..e639b0005187 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.200";
+    version = "150.0.7871.46";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-HDCPrhH44nKTr6Fzm9SqAV/Vdmtyx1znIZXsPkGmEqg=";
+      hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/ic/icinga2/package.nix b/pkgs/by-name/ic/icinga2/package.nix
index 69aff4ef2cc5..8d5272aa93d2 100644
--- a/pkgs/by-name/ic/icinga2/package.nix
+++ b/pkgs/by-name/ic/icinga2/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icinga2${nameSuffix}";
-  version = "2.15.1";
+  version = "2.15.5";
 
   src = fetchFromGitHub {
     owner = "icinga";
     repo = "icinga2";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w/eD07yzBm3x4G74OuGwkmpBzj63UoklmcKxVi5lx8E=";
+    hash = "sha256-39yGo0pwq+hkpc9re7hOb7HXyWTwsdEMTRWYzZxjAvo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/in/inventree/package.nix b/pkgs/by-name/in/inventree/package.nix
index 8395a06f3d56..b40201deee1e 100644
--- a/pkgs/by-name/in/inventree/package.nix
+++ b/pkgs/by-name/in/inventree/package.nix
@@ -14,12 +14,12 @@
 }:
 let
 
-  version = "1.3.0";
+  version = "1.3.3";
   src = fetchFromGitHub {
     owner = "inventree";
     repo = "inventree";
     tag = "${version}";
-    hash = "sha256-nsGqfm7XTwHblvqHmsMo8yQgl7ZtbtPdjOfrpXSQbn0=";
+    hash = "sha256-Xh3YcVz5OLQ596uWUEac87CKi62xgr63dYiYb6U6qXQ=";
     postCheckout = ''
       git -C $out rev-parse HEAD > $out/commit_hash.txt
       git -C $out show -s --format=%cd --date=short HEAD > $out/commit_date.txt
diff --git a/pkgs/by-name/li/libfprint-tod/package.nix b/pkgs/by-name/li/libfprint-tod/package.nix
index 9abebbb42b25..120082b2029e 100644
--- a/pkgs/by-name/li/libfprint-tod/package.nix
+++ b/pkgs/by-name/li/libfprint-tod/package.nix
@@ -27,6 +27,10 @@ libfprint.overrideAttrs (
       hash = "sha256-xkywuFbt8EFJOlIsSN2hhZfMUhywdgJ/uT17uiO3YV4=";
     };
 
+    # Different source than libfprint, so override any patches, because they
+    # would only apply to the original source tree
+    patches = [ ];
+
     mesonFlags = [
       # Include virtual drivers for fprintd tests
       "-Ddrivers=all"
diff --git a/pkgs/by-name/li/libfprint/package.nix b/pkgs/by-name/li/libfprint/package.nix
index 160cec4aa0f9..edfc4aa8ea74 100644
--- a/pkgs/by-name/li/libfprint/package.nix
+++ b/pkgs/by-name/li/libfprint/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   pkg-config,
   meson,
   python3,
@@ -35,6 +36,35 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-aNBUIKY3PP5A07UNg3N0qq+2cwb6Fk67oKQcXgr2G/4=";
   };
 
+  patches = [
+    # New hardware support since 1.94.10, just new USB Product IDs
+    (fetchpatch {
+      name = "realtek-3274-9003.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/a25f71cf97820c51edc4c32f84686fcdc608d9d1.patch";
+      sha256 = "sha256-T9rvT53Ij+5gtiVOp+xfzQwiVkyF0m6lZAUCXWmaugg=";
+    })
+    (fetchpatch {
+      name = "elan-0c58.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/4610f2285e6373c2fe4ead0dff4ebf8dabe4e532.patch";
+      sha256 = "sha256-VR96V+7FvSa8sE6JpcCx/slZ0MaK9HLuNuAay2P9C6M=";
+    })
+    (fetchpatch {
+      name = "elan-04F3-0C9C.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2bdc2b7ca6d8bedc675054934fbc8f8b6a21deac.patch";
+      sha256 = "sha256-LFMip9Mq55uDRgHkW+XeI+j0mILOb7DIHscHjyKe4yE=";
+    })
+    (fetchpatch {
+      name = "focal-077a-079a.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2c7842c905147a2d127c1b168b2e9d432b8c91a4.patch";
+      sha256 = "sha256-PuISGITn0/6AWY0WVUfViZtdcQFh+0s+4OLIszqdLUs=";
+    })
+    (fetchpatch {
+      name = "focal-a97a.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/0dc384b90ed8cd78b3e8d7c0d30a953bd088b98c.patch";
+      sha256 = "sha256-X/wl4MpxfQ7sLlFTkkiDQGyRFQ6lC9pdcy3XPrSeOZw=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs \
       tests/test-runner.sh \
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index 7995f6b699ea..9c6e1baf5b1f 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "152.0.2-1",
+  "packageVersion": "152.0.4-1",
   "source": {
-    "rev": "152.0.2-1",
-    "hash": "sha256-CgH0HOtNbdoHMZ/MJL/zPK0Gn+e+qqtZjqPDSq63gX8="
+    "rev": "152.0.4-1",
+    "hash": "sha256-sbL3lZyYaewS84Yhb9HOHgV3xPvzbu+IcjdAW1hdlAY="
   },
   "firefox": {
-    "version": "152.0.2",
-    "hash": "sha512-5OVM///P1XUerFgXp7dLDvCqQ/wA7yk5fMnfmqUlcrInK5bmA3OnDXEr5NyEkXDY1cG0SfPql4tKso3uGQVrAw=="
+    "version": "152.0.4",
+    "hash": "sha512-DFZiq6j7iXkCr5Xbsv2YixltnPmui5h66J4KZJKsdTuNS4u3sydJCcLrIAqwmN81biPNYIRVZGf1XmkScxfzmg=="
   }
 }
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index 3425e2bbdfc1..7a553d786a10 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook-desktop";
-  version = "26.6.16";
+  version = "26.6.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-HtmuFN7iNNwuQ0CXzqnEJN4PNh0D7weHniegtF4EuqQ=";
+    hash = "sha256-OgNscshw445uf2PtiYVlyCfx/l2BNZyZK5QwQSunCQ0=";
   };
 
-  cargoHash = "sha256-PUfXwtxuaheoyZA2fAyoc9CyD/oBAjkUsVrP6U7qvA0=";
+  cargoHash = "sha256-USdDHcWexjAllH/kOZVc4XMehESoIozkvvOw47ZeBD8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index 163ac2f273cb..16256eccff09 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.30.2";
-  hash = "sha256-37nJRJL1mxvUdD7L9/yO/Lzyjvn09Tu9xHTEt4pxu2s=";
-  npmDepsHash = "sha256-AApRrIIYC4NtKIFyGQ3lnKIOk7LZNDK8wvUUbSczTrA=";
-  vendorHash = "sha256-em0317Q1u5sl8gws4/qqM8e9H5F4vfBiM7tLCyufgEk=";
+  version = "1.30.3";
+  hash = "sha256-6Vt1GpGWHfaYaORBFa/cB+AxYQxAdkGtGTsrvL08dsA=";
+  npmDepsHash = "sha256-vXAXuvKqLWbwCjSLNS8mLDA9AmaGSRsB67iKQMi+/No=";
+  vendorHash = "sha256-A/kef2PgrA0Jpb/o+f1nUeiwSibOgsnyYLOzJ/HB1Fo=";
 }
diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix
index 886ee73438fe..34ab0e9b72ab 100644
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -7,7 +7,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdns-scanner";
-  version = "0.27.2";
+  version = "0.27.3";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "CramBL";
     repo = "mdns-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oqU7lpDD2umCBAcPYKjo+5kdsCu3gjBiP5MPNvH2fhs=";
+    hash = "sha256-daJEiYOF1N2m4zVbsBuRl8KGrDs62GGDP9lCok9r/3w=";
   };
 
-  cargoHash = "sha256-TqTN9qXnfvP067kh+bfdXlU1lKaZistIvq1qJsgmJ8o=";
+  cargoHash = "sha256-eCB5nVEucMFX/wz9zrAKO9d3yI7BK/URpjlU39Y4g4I=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index ff037e9b7549..37cbd707d2bc 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -23,7 +23,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nixpkgs-review";
-  version = "3.8.0";
+  version = "3.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nixpkgs-review";
     tag = finalAttrs.version;
-    hash = "sha256-Z8pOct9DtuRo4LERqhVpDxX9uoLNQGgqPFUh0Fn3MrI=";
+    hash = "sha256-u0DbEwe28csVWKbu8x9v9/Ah0ZUUgqXtZU2Rr5IJpWI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/op/openrgb/package.nix b/pkgs/by-name/op/openrgb/package.nix
index d4f91908405a..4e0fe4002e6a 100644
--- a/pkgs/by-name/op/openrgb/package.nix
+++ b/pkgs/by-name/op/openrgb/package.nix
@@ -1,8 +1,7 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
-  fetchpatch,
+  fetchFromCodeberg,
   libusb1,
   hidapi,
   pkg-config,
@@ -16,22 +15,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openrgb";
-  version = "1.0rc2";
+  version = "1.0rc3";
 
-  src = fetchFromGitLab {
-    owner = "CalcProgrammer1";
+  src = fetchFromCodeberg {
+    owner = "OpenRGB";
     repo = "OpenRGB";
     tag = "release_candidate_${finalAttrs.version}";
-    hash = "sha256-vdIA9i1ewcrfX5U7FkcRR+ISdH5uRi9fz9YU5IkPKJQ=";
+    hash = "sha256-x7B3Ht9+JM+w/3qL5Ku08r05BBLrbuO5JBqP4fnJ0nc=";
   };
 
   patches = [
     ./system-plugins-env.patch
-    (fetchpatch {
-      name = "Install-systemd-service-under-PREFIX.patch";
-      url = "https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/b58b3c0402131918b3b988631f42617020df9346.patch";
-      hash = "sha256-q5i5BNjaLbsXSYEXKQOR/cMm5ExckmW1n2r9H0j09T0=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -116,7 +110,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Open source RGB lighting control";
-    homepage = "https://gitlab.com/CalcProgrammer1/OpenRGB";
+    changelog = "https://codeberg.org/OpenRGB/OpenRGB/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://openrgb.org";
     maintainers = with lib.maintainers; [ johnrtitor ];
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 9b3d0a55e9f2..04cb9eb6812d 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -3,13 +3,11 @@
   stdenv,
   fetchFromGitHub,
   makeBinaryWrapper,
-  copyDesktopItems,
   electron_41,
   nodejs-slim_24,
-  pnpm_10_29_2,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
-  makeDesktopItem,
   darwin,
   nix-update-script,
   _experimental-update-script-combinators,
@@ -22,7 +20,7 @@
 
 let
   nodejs-slim = nodejs-slim_24;
-  pnpm = pnpm_10_29_2.override { inherit nodejs-slim; };
+  pnpm = pnpm_10.override { inherit nodejs-slim; };
   electron = electron_41;
   appName = "Podman Desktop";
 in
@@ -96,9 +94,6 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm
     pnpmConfigHook
   ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    copyDesktopItems
-  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.autoSignDarwinBinariesHook
   ];
@@ -147,6 +142,13 @@ stdenv.mkDerivation (finalAttrs: {
 
         install -Dm644 buildResources/icon.svg "$out/share/icons/hicolor/scalable/apps/podman-desktop.svg"
 
+        # Derive the .desktop entry from upstream to keep it aligned and avoid regressions.
+        install -Dm644 .flatpak.desktop "$out/share/applications/podman-desktop.desktop"
+        substituteInPlace "$out/share/applications/podman-desktop.desktop" \
+          --replace-fail 'Exec=run.sh %U' 'Exec=podman-desktop %U' \
+          --replace-fail 'Icon=io.podman_desktop.PodmanDesktop' 'Icon=podman-desktop'
+        sed -i '/^X-Flatpak=/d' "$out/share/applications/podman-desktop.desktop"
+
         makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \
           --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \
           --set XDG_SESSION_TYPE 'x11' \
@@ -159,20 +161,6 @@ stdenv.mkDerivation (finalAttrs: {
       ''
     );
 
-  # see: https://github.com/podman-desktop/podman-desktop/blob/main/.flatpak.desktop
-  desktopItems = [
-    (makeDesktopItem {
-      name = "podman-desktop";
-      exec = "podman-desktop %U";
-      icon = "podman-desktop";
-      desktopName = appName;
-      genericName = "Desktop client for podman";
-      comment = finalAttrs.meta.description;
-      categories = [ "Utility" ];
-      startupWMClass = appName;
-    })
-  ];
-
   meta = {
     description = "Graphical tool for developing on containers and Kubernetes";
     homepage = "https://podman-desktop.io";
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 103f13593b2a..1bf5b113e64c 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -51,13 +51,13 @@ let
   };
 
   pname = "pretix";
-  version = "2026.4.4";
+  version = "2026.4.5";
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${version}";
-    hash = "sha256-aDOI2XZF0n653ZgTtgEOb+JL/R0zDsdHOFvBsQdbwRw=";
+    hash = "sha256-Tj9/fqCjRbjVlH32toSl8XKc1nmIj0gmR0+xRBlvHpY=";
   };
 
   npmDeps = buildNpmPackage {
diff --git a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
index b17d5d52a534..1b3aa88c3a92 100644
--- a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-mollie";
-  version = "2.5.6";
+  version = "2.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-mollie";
     tag = "v${version}";
-    hash = "sha256-XInwUecuC3sEcRpuS+xa7Gb2Isb18SexbZ2+CcUF7/E=";
+    hash = "sha256-LApnvohrNiyqRmBIysxR5ZAMy5nZhPts0znirOUsxq0=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/payone/package.nix b/pkgs/by-name/pr/pretix/plugins/payone/package.nix
index 1d38c6c820b5..60bff54203cd 100644
--- a/pkgs/by-name/pr/pretix/plugins/payone/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/payone/package.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pretix-payone";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-payone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y1BO8Hz/pGKalURCbF3QJ49xn+L/sd8SWTGdCIl43yw=";
+    hash = "sha256-ru944WkeNBYq5XkIMoAFLgGcU2gGxClEYVhCwuZGioI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/ru/run0-sudo-shim/package.nix b/pkgs/by-name/ru/run0-sudo-shim/package.nix
index 937d0da8bfae..e9e8eb0ff4c4 100644
--- a/pkgs/by-name/ru/run0-sudo-shim/package.nix
+++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix
@@ -5,22 +5,31 @@
   nix-update-script,
   coreutils,
   polkit-stdin-agent,
+  installShellFiles,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "run0-sudo-shim";
-  version = "1.3.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "LordGrimmauld";
     repo = "run0-sudo-shim";
     tag = finalAttrs.version;
-    hash = "sha256-QkDoEBgcWh/eKX8jxctMNEy08Sf8kpxXFhWbsygTWz8=";
+    hash = "sha256-J/I7VPXpOwNtEk9H+lbZVT+xJYBsSKgnMlwzlVIJSWk=";
   };
 
-  cargoHash = "sha256-ly2e2x1Z1XEXblGqWi+/r5q2FmvpekVfzGVGm+S1xio=";
+  cargoHash = "sha256-JfxMmYgYLKxVqj8H0/qRGn9z8XNoNpPK3RcIhb/RKOc=";
 
   __structuredAttrs = true;
 
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
   env = {
     POLKIT_STDIN_AGENT = lib.getExe polkit-stdin-agent;
     TRUE = lib.getExe' coreutils "true";
@@ -28,6 +37,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     ln -s $out/bin/run0-sudo-shim $out/bin/sudo
+    installManPage target/tmp/run0-sudo-shim/manpage/*
+    installShellCompletion \
+      target/tmp/run0-sudo-shim/completion/sudo.{bash,fish} \
+      --zsh target/tmp/run0-sudo-shim/completion/_sudo
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
new file mode 100644
index 000000000000..4192588ac4a5
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
@@ -0,0 +1,31 @@
+From 6a2202baf3edff90aea6b66996a8e11e4e7c133e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?=
+ <akssri@vakra.xyz>
+Date: Wed, 13 May 2026 13:31:19 +0530
+Subject: [PATCH] Fix --docker flag default for Click >= 8.2 compatibility
+
+Click 8.2 changed flag_value option handling: default=False is no longer
+normalised to None before the 'is None' guard. Change to default=None so
+sky launch works with Click >= 8.2 (e.g. nixpkgs).
+
+Upstream constrains click<8.2; this makes the code robust to newer versions.
+---
+ sky/client/cli/command.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 6ee1102d0..15a5057d6 100644
+--- a/sky/client/cli/command.py
++++ b/sky/client/cli/command.py
+@@ -1072,7 +1072,7 @@ def _handle_infra_cloud_region_zone_options(infra: Optional[str],
+ @click.option('--docker',
+               'backend_name',
+               flag_value=backends.LocalDockerBackend.NAME,
+-              default=False,
++              default=None,
+               hidden=True,
+               help=('(Deprecated) Local docker support is deprecated. '
+                     'To run locally, create a local Kubernetes cluster with '
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
new file mode 100644
index 000000000000..781741b2dc37
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
@@ -0,0 +1,37 @@
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 15a5057d6..5417cad9f 100644
+--- a/sky/client/cli/command.py
++++ b/sky/client/cli/command.py
+@@ -203,7 +203,6 @@ def _get_cluster_records_and_set_ssh_config(
+             escaped_key_path = shlex.quote(
+                 (cluster_utils.SSHConfigHelper.generate_local_key_file(
+                     handle.cluster_name, credentials)))
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # Instead of directly use websocket_proxy.py, we add an
+@@ -220,8 +219,7 @@ def _get_cluster_records_and_set_ssh_config(
+                 # TODO(zhwu): write the template to a temp file, don't use
+                 # the one in skypilot repo, to avoid changing the file when
+                 # updating skypilot.
+-                f'\"{escaped_executable_path} '
+-                f'{escaped_websocket_proxy_path} '
++                f'\"{escaped_websocket_proxy_path} '
+                 f'{server_common.get_server_url()} '
+                 f'{handle.cluster_name} '
+                 f'kubernetes-pod-ssh-proxy\"')
+@@ -229,13 +227,11 @@ def _get_cluster_records_and_set_ssh_config(
+         elif isinstance(handle.launched_resources.cloud, clouds.Slurm):
+             # Replace the proxy command to proxy through the SkyPilot API
+             # server with websocket.
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # %w is a placeholder for the node index, substituted per-node
+             # in cluster_utils.SSHConfigHelper.add_cluster().
+-            proxy_command = (f'{escaped_executable_path} '
+-                             f'{escaped_websocket_proxy_path} '
++            proxy_command = (f'{escaped_websocket_proxy_path} '
+                              f'{server_common.get_server_url()} '
+                              f'{handle.cluster_name} '
+                              f'slurm-job-ssh-proxy %w')
diff --git a/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch
new file mode 100644
index 000000000000..a6c7766082d6
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch
@@ -0,0 +1,364 @@
+From 2435727f0c6b02d56e254a5ba1d8e041c7c33c86 Mon Sep 17 00:00:00 2001
+From: DanielZhangQD <36026334+DanielZhangQD@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 14:59:48 +0800
+Subject: [PATCH] [Core] Mark non-security MD5/SHA1 hashes with
+ usedforsecurity=False (#9972)
+
+* [Core] Mark non-security MD5/SHA1 hashes with usedforsecurity=False
+
+These hashlib.md5/sha1 calls derive identifiers, cache keys, and resource
+names from non-secret inputs (usernames, paths, region/subscription ids,
+cluster/host names, wheel/catalog contents). None protects a secret or
+makes an authentication decision -- passwords use bcrypt via crypt_ctx and
+auth is enforced by oauth2-proxy / SSO. Pass usedforsecurity=False so
+weak-hash scanners (CWE-328) stop flagging them. The flag does not change
+any digest value, so all derived ids, cache keys and names are unchanged.
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+* [Core] Address review: avoid split hexdigest() call in oauth2_proxy
+
+Compute the digest first, then slice, instead of splitting the empty
+hexdigest() parentheses across lines. yapf-stable and more readable.
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+---------
+
+Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+---
+ sky/backends/backend_utils.py       |  3 ++-
+ sky/backends/wheel_utils.py         |  3 ++-
+ sky/batch/io_formats.py             |  3 ++-
+ sky/catalog/aws_catalog.py          |  6 ++++--
+ sky/catalog/common.py               |  4 +++-
+ sky/clouds/aws.py                   |  2 +-
+ sky/clouds/nebius.py                |  3 ++-
+ sky/data/mounting_utils.py          |  3 ++-
+ sky/data/storage.py                 |  6 ++++--
+ sky/provision/azure/config.py       |  2 +-
+ sky/provision/kubernetes/utils.py   |  3 ++-
+ sky/provision/scp/instance.py       |  2 +-
+ sky/server/auth/oauth2_proxy.py     |  7 +++++--
+ sky/server/server.py                |  5 ++++-
+ sky/users/permission.py             |  6 ++++--
+ sky/users/server.py                 | 13 ++++++++++---
+ sky/utils/command_runner.py         |  7 ++++---
+ sky/utils/common_utils.py           | 13 ++++++++++---
+ sky/utils/kubernetes/gpu_labeler.py |  3 ++-
+ 19 files changed, 65 insertions(+), 29 deletions(-)
+
+diff --git a/sky/backends/backend_utils.py b/sky/backends/backend_utils.py
+index ff4662b4160..ec0b4bf74fb 100644
+--- a/sky/backends/backend_utils.py
++++ b/sky/backends/backend_utils.py
+@@ -707,7 +707,8 @@ def get_expirable_clouds(
+ 
+ 
+ def _get_volume_name(path: str, cluster_name_on_cloud: str) -> str:
+-    path_hash = hashlib.md5(path.encode()).hexdigest()[:6]
++    path_hash = hashlib.md5(path.encode(),
++                            usedforsecurity=False).hexdigest()[:6]
+     return f'{cluster_name_on_cloud}-{path_hash}'
+ 
+ 
+diff --git a/sky/backends/wheel_utils.py b/sky/backends/wheel_utils.py
+index 4cfd4c485a5..f142011bfe1 100644
+--- a/sky/backends/wheel_utils.py
++++ b/sky/backends/wheel_utils.py
+@@ -210,7 +210,8 @@ def _build_sky_wheel() -> pathlib.Path:
+         # wheel content hash doesn't change.
+         with open(wheel_path, 'rb') as f:
+             contents = f.read()
+-        hash_of_latest_wheel = hashlib.md5(contents).hexdigest()
++        hash_of_latest_wheel = hashlib.md5(contents,
++                                           usedforsecurity=False).hexdigest()
+ 
+         wheel_dir = WHEEL_DIR / hash_of_latest_wheel
+         wheel_dir.mkdir(parents=True, exist_ok=True)
+diff --git a/sky/catalog/aws_catalog.py b/sky/catalog/aws_catalog.py
+index c2480965708..e842068beaa 100644
+--- a/sky/catalog/aws_catalog.py
++++ b/sky/catalog/aws_catalog.py
+@@ -113,7 +113,8 @@ def _get_az_mappings(aws_user_hash: str) -> Optional['pd.DataFrame']:
+         # Write md5 of the az_mapping file to a file so we can check it for
+         # any changes when uploading to the controller
+         with open(az_mapping_path, 'r', encoding='utf-8') as f:
+-            az_mapping_hash = hashlib.md5(f.read().encode()).hexdigest()
++            az_mapping_hash = hashlib.md5(f.read().encode(),
++                                          usedforsecurity=False).hexdigest()
+         with open(az_mapping_md5_path, 'w', encoding='utf-8') as f:
+             f.write(az_mapping_hash)
+     else:
+@@ -147,7 +148,8 @@ def _fetch_and_apply_az_mapping(df: common.LazyDataFrame) -> 'pd.DataFrame':
+         user_identity_list = aws.AWS.get_active_user_identity()
+         assert user_identity_list, user_identity_list
+         user_identity = user_identity_list[0]
+-        aws_user_hash = hashlib.md5(user_identity.encode()).hexdigest()[:8]
++        aws_user_hash = hashlib.md5(user_identity.encode(),
++                                    usedforsecurity=False).hexdigest()[:8]
+     except (exceptions.CloudUserIdentityError, ImportError):
+         # If failed to get user identity, or import aws dependencies, we use the
+         # latest mapping file or the default mapping file.
+diff --git a/sky/catalog/common.py b/sky/catalog/common.py
+index 00829871e53..a0397e6301f 100644
+--- a/sky/catalog/common.py
++++ b/sky/catalog/common.py
+@@ -291,7 +291,9 @@ def _update_catalog():
+                         tmp_path = f.name
+                     os.rename(tmp_path, catalog_path)
+                     with open(meta_path + '.md5', 'w', encoding='utf-8') as f:
+-                        f.write(hashlib.md5(r.text.encode()).hexdigest())
++                        f.write(
++                            hashlib.md5(r.text.encode(),
++                                        usedforsecurity=False).hexdigest())
+             logger.debug(f'Updated {cloud} catalog {filename}.')
+         return True
+ 
+diff --git a/sky/clouds/aws.py b/sky/clouds/aws.py
+index af4ca56e911..06607e0d802 100644
+--- a/sky/clouds/aws.py
++++ b/sky/clouds/aws.py
+@@ -1347,7 +1347,7 @@ def get_user_identities(cls) -> Optional[List[List[str]]]:
+             # - aws credentials are not set, proceed anyway to get unified error
+             #   message for users
+             return cls._sts_get_caller_identity()
+-        config_hash = hashlib.md5(stdout).hexdigest()[:8]
++        config_hash = hashlib.md5(stdout, usedforsecurity=False).hexdigest()[:8]
+         # Getting aws identity cost ~1s, so we cache the result with the output of
+         # `aws configure list` as cache key. Different `aws configure list` output
+         # can have same aws identity, our assumption is the output would be stable
+diff --git a/sky/data/mounting_utils.py b/sky/data/mounting_utils.py
+index f49a8db097f..6b97b2d6ef0 100644
+--- a/sky/data/mounting_utils.py
++++ b/sky/data/mounting_utils.py
+@@ -714,7 +714,8 @@ def get_mount_cached_cmd(
+     # This is because the full path may be longer than
+     # the filename length limit.
+     # The hash is a non-negative integer in string form.
+-    hashed_mount_path = hashlib.md5(mount_path.encode()).hexdigest()
++    hashed_mount_path = hashlib.md5(mount_path.encode(),
++                                    usedforsecurity=False).hexdigest()
+     log_file_path = os.path.join(constants.RCLONE_MOUNT_CACHED_LOG_DIR,
+                                  f'{hashed_mount_path}.log')
+     create_log_cmd = (f'mkdir -p {constants.RCLONE_MOUNT_CACHED_LOG_DIR} && '
+diff --git a/sky/data/storage.py b/sky/data/storage.py
+index 022fc471f41..13e068c5be5 100644
+--- a/sky/data/storage.py
++++ b/sky/data/storage.py
+@@ -3367,10 +3367,12 @@ def get_default_storage_account_name(region: Optional[str]) -> str:
+         """
+         assert region is not None
+         subscription_id = azure.get_subscription_id()
+-        subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8'))
++        subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8'),
++                                            usedforsecurity=False)
+         subscription_hash = subscription_hash_obj.hexdigest(
+         )[:AzureBlobStore._SUBSCRIPTION_HASH_LENGTH]
+-        region_hash_obj = hashlib.md5(region.encode('utf-8'))
++        region_hash_obj = hashlib.md5(region.encode('utf-8'),
++                                      usedforsecurity=False)
+         region_hash = region_hash_obj.hexdigest()[:AzureBlobStore.
+                                                   _REGION_HASH_LENGTH]
+ 
+diff --git a/sky/provision/azure/config.py b/sky/provision/azure/config.py
+index 2dbf115807f..074bc801c3e 100644
+--- a/sky/provision/azure/config.py
++++ b/sky/provision/azure/config.py
+@@ -44,7 +44,7 @@ def get_azure_sdk_function(client: Any, function_name: str) -> Callable:
+ 
+ def get_cluster_id_and_nsg_name(resource_group: str,
+                                 cluster_name_on_cloud: str) -> Tuple[str, str]:
+-    hasher = hashlib.md5(resource_group.encode('utf-8'))
++    hasher = hashlib.md5(resource_group.encode('utf-8'), usedforsecurity=False)
+     unique_id = hasher.hexdigest()[:UNIQUE_ID_LEN]
+     # We use the cluster name + resource group hash as the
+     # unique ID for the cluster, as we need to make sure that
+diff --git a/sky/provision/kubernetes/utils.py b/sky/provision/kubernetes/utils.py
+index 1ec32ffb095..e3478c45608 100644
+--- a/sky/provision/kubernetes/utils.py
++++ b/sky/provision/kubernetes/utils.py
+@@ -5085,7 +5085,8 @@ def format_kubeconfig_exec_auth_with_cache(kubeconfig_path: str) -> str:
+     with open(kubeconfig_path, 'r', encoding='utf-8') as file:
+         config = yaml_utils.safe_load(file)
+     normalized = yaml.dump(config, sort_keys=True)
+-    hashed = hashlib.sha1(normalized.encode('utf-8')).hexdigest()
++    hashed = hashlib.sha1(normalized.encode('utf-8'),
++                          usedforsecurity=False).hexdigest()
+     path = os.path.expanduser(
+         f'{kubernetes_constants.SKY_K8S_EXEC_AUTH_KUBECONFIG_CACHE}/{hashed}.yaml'
+     )
+diff --git a/sky/provision/scp/instance.py b/sky/provision/scp/instance.py
+index 9aae05c9196..5a03c308e3f 100644
+--- a/sky/provision/scp/instance.py
++++ b/sky/provision/scp/instance.py
+@@ -223,7 +223,7 @@ def _worker(cluster_name_on_cloud: str):
+ 
+ 
+ def _suffix(name: str, n: int = 5):
+-    return hashlib.sha1(name.encode()).hexdigest()[:n]
++    return hashlib.sha1(name.encode(), usedforsecurity=False).hexdigest()[:n]
+ 
+ 
+ def _get_instance_id(instance_name, cluster_name_on_cloud):
+diff --git a/sky/server/auth/oauth2_proxy.py b/sky/server/auth/oauth2_proxy.py
+index dece4792fa9..7d117642cf7 100644
+--- a/sky/server/auth/oauth2_proxy.py
++++ b/sky/server/auth/oauth2_proxy.py
+@@ -204,8 +204,11 @@ def get_auth_user(
+         """Extract user info from OAuth2 proxy response headers."""
+         email_header = response.headers.get('X-Auth-Request-Email')
+         if email_header:
+-            user_hash = hashlib.md5(email_header.encode()).hexdigest(
+-            )[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user id from the (non-secret) SSO
++            # email; auth itself is done by oauth2-proxy. Not a security use.
++            email_hash = hashlib.md5(email_header.encode(),
++                                     usedforsecurity=False).hexdigest()
++            user_hash = email_hash[:common_utils.USER_HASH_LENGTH]
+             return models.User(id=user_hash,
+                                name=email_header,
+                                user_type=models.UserType.SSO.value)
+diff --git a/sky/server/server.py b/sky/server/server.py
+index 4ec8ce1a86d..995ef89764c 100644
+--- a/sky/server/server.py
++++ b/sky/server/server.py
+@@ -282,8 +282,11 @@ def _extract_user_from_header(
+     if not user_name:
+         return None
+ 
++    # MD5 only derives a stable user id from the (non-secret) user name;
++    # not a security use.
+     user_hash = hashlib.md5(
+-        user_name.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++        user_name.encode(),
++        usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH]
+     if proxy_config.enabled:
+         return models.User(id=user_hash,
+                            name=user_name,
+diff --git a/sky/users/permission.py b/sky/users/permission.py
+index 82fb2877e50..a07be1c9b05 100644
+--- a/sky/users/permission.py
++++ b/sky/users/permission.py
+@@ -182,8 +182,10 @@ def _maybe_initialize_basic_auth_user(self) -> None:
+             return
+         username, password = basic_auth.split(':', 1)
+         if username and password:
+-            user_hash = hashlib.md5(
+-                username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user id from the (non-secret)
++            # username; the password is checked separately. Not a security use.
++            user_hash = hashlib.md5(username.encode(), usedforsecurity=False
++                                   ).hexdigest()[:common_utils.USER_HASH_LENGTH]
+             user_info = global_user_state.get_user(user_hash)
+             if user_info:
+                 logger.debug(f'Basic auth user {username} already exists')
+diff --git a/sky/users/server.py b/sky/users/server.py
+index 7cd42ee1726..8258702a2ff 100644
+--- a/sky/users/server.py
++++ b/sky/users/server.py
+@@ -287,8 +287,12 @@ def user_create(user_create_body: payloads.UserCreateBody) -> None:
+ 
+     # Create user
+     password_hash = server_common.crypt_ctx.hash(password)
++    # MD5 here only derives a stable user identifier from the (non-secret)
++    # username; it is not used for any security purpose (passwords use bcrypt
++    # via crypt_ctx).
+     user_hash = hashlib.md5(
+-        username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++        username.encode(),
++        usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH]
+     with _user_lock(user_hash):
+         # Check if user already exists
+         if global_user_state.get_user_by_name(username):
+@@ -627,8 +631,11 @@ def user_import(user_import_body: payloads.UserImportBody) -> Dict[str, Any]:
+                 # Password is plain text, hash it
+                 password_hash = server_common.crypt_ctx.hash(password)
+ 
+-            user_hash = hashlib.md5(
+-                username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user identifier from the (non-secret)
++            # username; not a security use (passwords use bcrypt via crypt_ctx).
++            user_hash = hashlib.md5(username.encode(),
++                                    usedforsecurity=False).hexdigest()
++            user_hash = user_hash[:common_utils.USER_HASH_LENGTH]
+ 
+             with _user_lock(user_hash):
+                 global_user_state.add_or_update_user(
+diff --git a/sky/utils/command_runner.py b/sky/utils/command_runner.py
+index 344a65eb789..44f981ac520 100644
+--- a/sky/utils/command_runner.py
++++ b/sky/utils/command_runner.py
+@@ -875,8 +875,8 @@ def git_clone(
+             raise exceptions.CommandError(1, '', error_msg, None)
+ 
+         # Remote script path (use a unique name to avoid conflicts)
+-        script_hash = hashlib.md5(
+-            f'{self.node_id}_{target_dir}'.encode()).hexdigest()[:8]
++        script_hash = hashlib.md5(f'{self.node_id}_{target_dir}'.encode(),
++                                  usedforsecurity=False).hexdigest()[:8]
+         remote_script_path = f'/tmp/sky_git_clone_{script_hash}.sh'
+ 
+         # Step 1: Transfer the script to remote machine using rsync
+@@ -992,7 +992,8 @@ def __init__(
+         self.ssh_private_key = ssh_private_key
+         self.ssh_control_name = (
+             None if ssh_control_name is None else hashlib.md5(
+-                ssh_control_name.encode()).hexdigest()[:_HASH_MAX_LENGTH])
++                ssh_control_name.encode(),
++                usedforsecurity=False).hexdigest()[:_HASH_MAX_LENGTH])
+         self._ssh_proxy_command = ssh_proxy_command
+         self._ssh_proxy_jump = ssh_proxy_jump
+         self.disable_control_master = (
+diff --git a/sky/utils/common_utils.py b/sky/utils/common_utils.py
+index 027a59d5bca..71e7034f6a7 100644
+--- a/sky/utils/common_utils.py
++++ b/sky/utils/common_utils.py
+@@ -91,7 +91,10 @@ def is_valid_user_hash(user_hash: Optional[str]) -> bool:
+ def generate_user_hash() -> str:
+     """Generates a unique user-machine specific hash."""
+     hash_str = user_and_hostname_hash()
+-    user_hash = hashlib.md5(hash_str.encode()).hexdigest()[:USER_HASH_LENGTH]
++    # MD5 only derives a stable machine-specific identifier, not a security
++    # use.
++    user_hash = hashlib.md5(
++        hash_str.encode(), usedforsecurity=False).hexdigest()[:USER_HASH_LENGTH]
+     if not is_valid_user_hash(user_hash):
+         # A fallback in case the hash is invalid.
+         user_hash = uuid.uuid4().hex[:USER_HASH_LENGTH]
+@@ -297,7 +300,9 @@ def make_cluster_name_on_cloud(display_name: str,
+     if truncate_cluster_name.endswith('-'):
+         truncate_cluster_name = truncate_cluster_name.rstrip('-')
+     assert truncate_cluster_name_length > 0, (cluster_name_on_cloud, max_length)
+-    display_name_hash = hashlib.md5(display_name.encode()).hexdigest()
++    # MD5 only derives a short suffix for the cluster name, not a security use.
++    display_name_hash = hashlib.md5(display_name.encode(),
++                                    usedforsecurity=False).hexdigest()
+     # Use base36 to reduce the length of the hash.
+     display_name_hash = base36_encode(display_name_hash)
+     return (f'{truncate_cluster_name}'
+@@ -650,7 +655,9 @@ def user_and_hostname_hash() -> str:
+     The reason is AWS security group names are derived from this string, and
+     thus changing the SG name makes these clusters unrecognizable.
+     """
+-    hostname_hash = hashlib.md5(socket.gethostname().encode()).hexdigest()[-4:]
++    # MD5 only derives a short hostname suffix, not a security use.
++    hostname_hash = hashlib.md5(socket.gethostname().encode(),
++                                usedforsecurity=False).hexdigest()[-4:]
+     return f'{getpass.getuser()}-{hostname_hash}'
+ 
+ 
+diff --git a/sky/utils/kubernetes/gpu_labeler.py b/sky/utils/kubernetes/gpu_labeler.py
+index 227847cd50c..5de797139f9 100644
+--- a/sky/utils/kubernetes/gpu_labeler.py
++++ b/sky/utils/kubernetes/gpu_labeler.py
+@@ -71,7 +71,8 @@ def cleanup(context: Optional[str] = None) -> Tuple[bool, str]:
+ 
+ def get_node_hash(node_name: str):
+     # Generates a 32 character md5 hash from a string
+-    md5_hash = hashlib.md5(node_name.encode()).hexdigest()
++    md5_hash = hashlib.md5(node_name.encode(),
++                           usedforsecurity=False).hexdigest()
+     return md5_hash[:32]
+ 
+ 
diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix
index d48db1649d1a..71df3b03526f 100644
--- a/pkgs/by-name/sk/skypilot/package.nix
+++ b/pkgs/by-name/sk/skypilot/package.nix
@@ -35,6 +35,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pyproject = true;
   pythonRelaxDeps = true;
 
+  patches = [
+    ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
+    ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
+    # https://github.com/skypilot-org/skypilot/pull/9972
+    ./CVE-2026-13482.patch
+  ];
+
   nativeBuildInputs = [
     writableTmpDirAsHomeHook
   ];
@@ -217,6 +224,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
     cp -r ${dashboard}/* $out/${python3Packages.python.sitePackages}/sky/dashboard/out/
   '';
 
+  postFixup = ''
+    chmod +x $out/${python3Packages.python.sitePackages}/sky/templates/websocket_proxy.py
+    wrapPythonProgramsIn "$out/${python3Packages.python.sitePackages}/sky/templates" "$out ''${pythonPath[*]}"
+  '';
+
   # Excluding the tests as it fails with error:
   # Message: 'Config loaded from /build/source/examples/admin_policy/restful_policy.yaml:\nadmin_policy: http://localhost:8080\n'
   #Arguments: ()
diff --git a/pkgs/by-name/sl/sleuthkit/package.nix b/pkgs/by-name/sl/sleuthkit/package.nix
index d91930eaa07f..85e26a31d01f 100644
--- a/pkgs/by-name/sl/sleuthkit/package.nix
+++ b/pkgs/by-name/sl/sleuthkit/package.nix
@@ -67,11 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
     export ANT_ARGS="-Doffline=true -Ddefault-jar-location=$IVY_HOME/lib"
 
     # pre-positioning these jar files allows -Doffline=true to work
-    mkdir -p source/{bindings,case-uco}/java $IVY_HOME
-    cp -r ${finalAttrs.rdeps}/bindings/java/lib source/bindings/java
-    chmod -R 755 source/bindings/java
-    cp -r ${finalAttrs.rdeps}/case-uco/java/lib source/case-uco/java
-    chmod -R 755 source/case-uco/java
+    mkdir -p ${finalAttrs.src.name}/{bindings,case-uco}/java $IVY_HOME
+    cp -r ${finalAttrs.rdeps}/bindings/java/lib ${finalAttrs.src.name}/bindings/java
+    chmod -R 755 ${finalAttrs.src.name}/bindings/java
+    cp -r ${finalAttrs.rdeps}/case-uco/java/lib ${finalAttrs.src.name}/case-uco/java
+    chmod -R 755 ${finalAttrs.src.name}/case-uco/java
     cp -r ${finalAttrs.rdeps}/lib $IVY_HOME
     chmod -R 755 $IVY_HOME
   '';
diff --git a/pkgs/by-name/tr/trivy/package.nix b/pkgs/by-name/tr/trivy/package.nix
index 73950a4d7382..dce19339476e 100644
--- a/pkgs/by-name/tr/trivy/package.nix
+++ b/pkgs/by-name/tr/trivy/package.nix
@@ -10,19 +10,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "trivy";
-  version = "0.71.2";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GC9WiGp2Cn0SmErRxAdjpDJvoF0giKrj+NJAC5CaXV8=";
+    hash = "sha256-BfYgHa5Qv5rwJSRLdaDeCU4pz1jrUG72QzsJ98F5Is8=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-Xr24mc1nDevpeACKciw1g1bTfLtCEwxfOuwPNxVhGxo=";
+  vendorHash = "sha256-IeX4c34/AUt9MZCFHVs43+9lmDX2gYJhPAi7/lUeWgI=";
 
   subPackages = [ "cmd/trivy" ];
 
diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix
index 8311c4f3ba47..ddf527f7b93e 100644
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-R5r8aJmIF3FLc4+wESLoNw+xeE6ixSYy2xcg1gIX2YA=";
+    hash = "sha256-DTL27AcPmAI5XEEHb2S74LYWm4f6kUASsTmQeGftDzM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-/cNV0PHxoR8P7JXSArPq2hziQnwH5n858SzQhktvXus=";
+    hash = "sha256-RI6tz8pyqYg/L6wSc0Rt5ZqHT8aktReyVjNgISPqKRQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/low-index/default.nix b/pkgs/development/python-modules/low-index/default.nix
index c753e78d2ff5..6bd1711c40ee 100644
--- a/pkgs/development/python-modules/low-index/default.nix
+++ b/pkgs/development/python-modules/low-index/default.nix
@@ -4,18 +4,19 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "low-index";
-  version = "1.2.1";
+  version = "1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "3-manifolds";
     repo = "low_index";
     tag = "v${version}_as_released";
-    hash = "sha256-T8hzC9ulikQ1pUdbXgjuKAX5oMJEycPvXWv74rCkQGY=";
+    hash = "sha256-m3p05bqu70pMOsb9drW1B6+N893eBSZBFTNNS23OY6w=";
   };
 
   build-system = [ setuptools ];
@@ -28,6 +29,13 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v(.*)_as_released"
+    ];
+  };
+
   meta = {
     description = "Enumerates low index subgroups of a finitely presented group";
     changelog = "https://github.com/3-manifolds/low_index/releases/tag/${src.tag}";
diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index 47836dad8176..896922954a0a 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -23,35 +23,35 @@
     },
     "40": {
         "hashes": {
-            "aarch64-darwin": "dfb6a853acdc547b6eedc97fa4a30693dba0bd310ab673e436b08b890772b529",
-            "aarch64-linux": "7a53169a16775f2b62f9434058c2c0e1cdf3f1718800b80712856f4766cf6043",
-            "armv7l-linux": "ef6ba9eb2e79721f7b1b9957fa71e55fcdbb9b6d1793daf61cd839f48cd1e86b",
-            "headers": "0f9c09vk9kn3c7phw3dm8k1iaf8gw3g2s37r3qdycf9akirprpf2",
-            "x86_64-darwin": "27a4e372ca19394fefedabbf4da0341cfb87c1fa9f5b9cf9b22e8cd8deb4f566",
-            "x86_64-linux": "d2593a23cc1c080b7333381579a65ecaf9628a70efbc466ddb545141257105a3"
+            "aarch64-darwin": "5f84fae97bdf54457e074617acf0d362adb7d0b298311d18bea6efe97b6b301f",
+            "aarch64-linux": "1c6566cf63bed400a2b17b223c4657f199477a7389b2e540a76497d754cb2e78",
+            "armv7l-linux": "be9dd6389e49aeb237647ccb3c7683059e98fbcc33b61ae0dc26f61d29f56a35",
+            "headers": "1rq2wn46l7svsprzhs61h9c26nldacyhhwyawa863kkw68b8r5bd",
+            "x86_64-darwin": "8f3ba9bdfa2e4a2f0681b74befe8ee40f916c590b8ee303f86d48932fe7c9f29",
+            "x86_64-linux": "4664bf23f722c6580ba77af5beb5a2c2db31da83bedb9d402f4277d99fa57639"
         },
-        "version": "40.10.3"
+        "version": "40.10.5"
     },
     "41": {
         "hashes": {
-            "aarch64-darwin": "f48986fa0d60b88eee78fd95c1a36e7fac9ab606c63fdabc28adec916b8f12d1",
-            "aarch64-linux": "d94b0231b05063e5cd959cda2bdb8ec7c94ab86f59698bfba4522343eb48d50e",
-            "armv7l-linux": "e3d04ffa4e020857a2a2554f7f5e41e746fa692c91c51575199473ddb264e551",
-            "headers": "0j9gvjjq9qdvjj33h2xh6qdxxr29aj96y2qs3p0xvy1bc3li9hzn",
-            "x86_64-darwin": "6b561462a94fd02837a525d0bca786a0b4345b61e2e3109c4bf13792235db90d",
-            "x86_64-linux": "a04bb66fd83c516c8b3adc5fb47f8307fe54704f5b1cd7c8ec9be8285d2989b3"
+            "aarch64-darwin": "7d61175263f7aef8957b05966808ca58d3f0db86ba5a59aafc780ddd340135f6",
+            "aarch64-linux": "a77dc2804fda466e704907befa6facd8e7c9d0342db319c742ebb58ebe99a9c5",
+            "armv7l-linux": "b7ff0470b1efc424b96b81ecc3e7f353551bd1694bfbc75b307f319133f26258",
+            "headers": "115rlwjj5yyn4ic9acih1q5x29k5q7fz8q82c0ab7prfi01f9y6h",
+            "x86_64-darwin": "719ad75b073bc34ff3c03694703a896c6ffdc40976c76efd959dfde108798150",
+            "x86_64-linux": "4b8eca04c7f96828e297d8b3b4d303727db9123ae69b86c6041418651b6c227f"
         },
-        "version": "41.7.2"
+        "version": "41.9.1"
     },
     "42": {
         "hashes": {
-            "aarch64-darwin": "3ce55988c9998bcd1e9c69478dd26887b90e8f8010441172e520e94ba575e520",
-            "aarch64-linux": "d3bf612de0b651302fb46e50ed3282b609ea9d4d99bb296f7c9bb8ffd92fd69b",
-            "armv7l-linux": "83f9017f9a77bfdc8628b05237336c319da45f75974c37c68c82687a18106a92",
-            "headers": "1jim5dw909wzczdlcrajn03j4v8gsvq6zpk85nl3713b3rx0pjyz",
-            "x86_64-darwin": "0f141809eebe3f3f8c8f8377c10c93f21a39433f71526598de5e989f452cae29",
-            "x86_64-linux": "9a8194635548490a56099cc4c2b116738ae56834dee4472506d5a8b262bcbda4"
+            "aarch64-darwin": "e019b54b8b63dcc851adc871e011c45bf1510854266bb960dcff3781b24b6f96",
+            "aarch64-linux": "1575fa5cc64b3bf502d03632a915cdca4934e85d2b14fbf900752e8febfadd5c",
+            "armv7l-linux": "861d1ad6e41f395aac18deb6c2b36dd203c6364b7d2f358d5241a1ffeabd96d5",
+            "headers": "1ibm3ds3k2ih6bpmynics2dzhi437l73l8b3bmhx7gh4ghflaln0",
+            "x86_64-darwin": "608f68cc8c5db54b7b3d853e3672a447bd7ad06d5b2caa9bc0a83d56479374fd",
+            "x86_64-linux": "3a729b020acb04aefac2c9b4b29c65b37dd7126a14a04d1ef29acb256d3edbd1"
         },
-        "version": "42.4.0"
+        "version": "42.5.1"
     }
 }
diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index 08852cf6d17e..4577a69901ed 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -23,35 +23,35 @@
     },
     "40": {
         "hashes": {
-            "aarch64-darwin": "8f19ad2223292532b90e1ee4aa0f6f59e1cf0343055610bac3c0b0bdebc0dc1c",
-            "aarch64-linux": "6ce2b44eb560e5d305bef4c5886844ccd025d1edf0b7fe758a4fdf46beb8a0e3",
-            "armv7l-linux": "d2493fa2a16c3dddaccd7b846645ef5b3acd740fb0a206e5b54f9cbc8b288a31",
-            "headers": "0f9c09vk9kn3c7phw3dm8k1iaf8gw3g2s37r3qdycf9akirprpf2",
-            "x86_64-darwin": "9eb305ea485e72bd01d8d9d45e258a3b6708bb480caad048819141f420373c20",
-            "x86_64-linux": "494cd1ddfc0745032223a4995360ed5ab65ea1e2fe88612e1ae32398d13b3470"
+            "aarch64-darwin": "cdcf197edb1d07453b7543b48303f5562284816488f8d615adeff61db0b04664",
+            "aarch64-linux": "1d9c9a5252ea3db9229ded8968ffe2c01a41e676cc18c5a4c87818de029c1442",
+            "armv7l-linux": "5f893df0d9e16ad06ceb53df5ac833298da0ce03d7e63608fcb7f64bf95ec817",
+            "headers": "1rq2wn46l7svsprzhs61h9c26nldacyhhwyawa863kkw68b8r5bd",
+            "x86_64-darwin": "5f461d11062eb20dde58eab29c0c9d7ab293ead00129e365e8f1e45ead533ac8",
+            "x86_64-linux": "6c3476f46d4a7581d74093fcb4c6a24a1b45a26a562443068b91063ba0a098dc"
         },
-        "version": "40.10.3"
+        "version": "40.10.5"
     },
     "41": {
         "hashes": {
-            "aarch64-darwin": "3b820eba3a2ec3805fa437e1d1557cd57634f22960a3232cdfdbadb197df0926",
-            "aarch64-linux": "187c6bd8dd6339c9f3558bd4f0dab5a71713da6fe7146e18160481045124d39e",
-            "armv7l-linux": "187df82834a49211c6cdf55f95c6eacfa94c83a95e84965a4cce8ba04075cd0b",
-            "headers": "0j9gvjjq9qdvjj33h2xh6qdxxr29aj96y2qs3p0xvy1bc3li9hzn",
-            "x86_64-darwin": "24a7018009ea46cc466f09504824379c430f8b4eb8f5cfc7f5235b81e1fa6def",
-            "x86_64-linux": "2af603975c4ee6bbd5332d49ec5bf2ded27db818db398b10a620f5ce0e719af7"
+            "aarch64-darwin": "d270db29c9bd72cb796600510283ff3ba3a57b454a3565508492fa590eec2df5",
+            "aarch64-linux": "bf33e3258036e2fff74795be213060858fdf37f2c61ddfe551289697d7d8b528",
+            "armv7l-linux": "0e65fd875ce97a9bc9241bd7c3476bcdccd22b90da2bc9d5bff6282372c55efe",
+            "headers": "115rlwjj5yyn4ic9acih1q5x29k5q7fz8q82c0ab7prfi01f9y6h",
+            "x86_64-darwin": "d9b5d5c960caf575cdc26dd35edfbd8078198d8b9ba5dfd9653c3753187b5485",
+            "x86_64-linux": "6060783bb08fc89cececf9731290b3f22b6ff847b2577f5cbd768ee8bb3fdee3"
         },
-        "version": "41.7.2"
+        "version": "41.9.1"
     },
     "42": {
         "hashes": {
-            "aarch64-darwin": "0ad0294171f61678036771f0a9e9de84b79a063d6781f166991d52d21d41a31f",
-            "aarch64-linux": "22fc9f5566d3a701965ae2cc77b0625644e827d67a80dfa86fbfd8076354a447",
-            "armv7l-linux": "b1ec1b8aec371b3b13303074739ddcd006a08060150f10a6c7a364c4b1bfd40c",
-            "headers": "1jim5dw909wzczdlcrajn03j4v8gsvq6zpk85nl3713b3rx0pjyz",
-            "x86_64-darwin": "2a736793968997a9f312156a7cb6575b23479ae4f23539d2b0fd1774589576eb",
-            "x86_64-linux": "09b69da1569f2d0bbf2015a976a314cefa212243cbfcfb32dcb82ef263c52942"
+            "aarch64-darwin": "6bc1ce38660096ac4e669e0acf79abd9de22d180fd9f018babaa5da76668a80f",
+            "aarch64-linux": "859700b9cb1e98f70208baa92e431eb1d102bd27621a5a695aa7a75327e072e6",
+            "armv7l-linux": "308bd2664d9797512e93f9b2ed17bf62fae9e12cd12ff6812b4493d388cd0904",
+            "headers": "1ibm3ds3k2ih6bpmynics2dzhi437l73l8b3bmhx7gh4ghflaln0",
+            "x86_64-darwin": "21db8529629a1a69fc5e2b6475d99c44985a78d49b7cc7aa314465d7568d78a6",
+            "x86_64-linux": "e0db56b8781035a48aae7fefdac311abb8993a7f6e72009e7adfb70926565bf0"
         },
-        "version": "42.4.0"
+        "version": "42.5.1"
     }
 }
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 1d3ef8120563..275cd4b88df1 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -56,10 +56,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-fLk+Vs7u/mZFb4mLmytRPez4Fur5e0QugmuD58fulIs=",
+                    "hash": "sha256-egb/uS76XrADbEtnzEVzym47qrNYwIOby1/3J537Vuw=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v40.10.3"
+                    "tag": "v40.10.5"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -1343,7 +1343,7 @@
             }
         },
         "electron_yarn_data": {
-            "hash": "sha256-GPTl9cT6CLfwQx5u7egDiSCGG6hikRDinPuijp97dHE=",
+            "hash": "sha256-JYMafgdlxleQS+kvWs6CGo8y+yGGPBtxw1AK5jklejU=",
             "missing_hashes": {
                 "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                 "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -1387,7 +1387,7 @@
         },
         "modules": "143",
         "node": "24.15.0",
-        "version": "40.10.3"
+        "version": "40.10.5"
     },
     "41": {
         "chrome": "146.0.7680.216",
@@ -1446,10 +1446,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-Bvm6S7otVUmGjRWOA53ua/7EdyIImHJMbDtVH3Xa4wo=",
+                    "hash": "sha256-n7Ev30z9CSqMUifcjrInlk66WH0sfb1jFPcA0/vJOd4=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v41.7.2"
+                    "tag": "v41.9.1"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -1783,10 +1783,10 @@
             },
             "src/third_party/electron_node": {
                 "args": {
-                    "hash": "sha256-Y4FP+AstENp1uTYBo8HeTRDwvKClTdrZ4RztLeHNP3k=",
+                    "hash": "sha256-LUV3ieY+bQ6qhft+xeTSxPuTlnmpbxkRIcIVBz86Aco=",
                     "owner": "nodejs",
                     "repo": "node",
-                    "tag": "v24.15.0"
+                    "tag": "v24.17.0"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -2749,7 +2749,7 @@
             }
         },
         "electron_yarn_data": {
-            "hash": "sha256-Ry8gzsdaR61djEgF+MpXAYGK00lRD5ZLq3cLUV1prFs=",
+            "hash": "sha256-KNbWANdqpF3rypdyGKgj9ykGXQ/+VtkE5L/XR1lqbps=",
             "missing_hashes": {
                 "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                 "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -2792,11 +2792,11 @@
             }
         },
         "modules": "145",
-        "node": "24.15.0",
-        "version": "41.7.2"
+        "node": "24.17.0",
+        "version": "41.9.1"
     },
     "42": {
-        "chrome": "148.0.7778.254",
+        "chrome": "148.0.7778.271",
         "chromium": {
             "deps": {
                 "gn": {
@@ -2805,15 +2805,15 @@
                     "version": "0-unstable-2026-04-01"
                 }
             },
-            "version": "148.0.7778.254"
+            "version": "148.0.7778.271"
         },
         "chromium_npm_hash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8=",
         "deps": {
             "src": {
                 "args": {
-                    "hash": "sha256-anHfDRQGlmW1CsH4T1KSLoGdoYvSBJBNBXebMxdXMHE=",
+                    "hash": "sha256-RdJGQjP6IxEdtPMfF7HdmreurRoah7G90pjF8RSOyNg=",
                     "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "148.0.7778.254",
+                    "tag": "148.0.7778.271",
                     "url": "https://chromium.googlesource.com/chromium/src.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -2852,10 +2852,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-ce/7NTD85RlZtuuYNiuvECxtcLyPHNXAzWwHVdJEqP8=",
+                    "hash": "sha256-OI1/fMv5PTfph7n01dcX3zGYcg6Uov2J2TQBSskqZ4I=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v42.4.0"
+                    "tag": "v42.5.1"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -2885,8 +2885,8 @@
             },
             "src/third_party/angle": {
                 "args": {
-                    "hash": "sha256-P5KpTB/jaUR8MjrEccc1di5u9dvD/YiVw8/QlkdKZcE=",
-                    "rev": "007b92d82773d7a868a6dce85359232921903959",
+                    "hash": "sha256-UC8XJES8ObArvvKZ55KVvKlgUTjqM9Znx5u5BMQXekA=",
+                    "rev": "03e01c80b2176b32bdd2b2181cdd583410242e1c",
                     "url": "https://chromium.googlesource.com/angle/angle.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3085,8 +3085,8 @@
             },
             "src/third_party/dawn": {
                 "args": {
-                    "hash": "sha256-LM5Z57mbH1u7XFnHF/p4fN/D9mO6504S0k8gqO6z3HI=",
-                    "rev": "c7de5291f0edba5398383d5592adcc78ba745bff",
+                    "hash": "sha256-vZHlPC5rlk1ii98M9ALn2qqa/M6ItbqjaAILjJOIAO8=",
+                    "rev": "5fdf5521a2f59e5794fef5085eeef711b760de4f",
                     "url": "https://dawn.googlesource.com/dawn.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3205,10 +3205,10 @@
             },
             "src/third_party/electron_node": {
                 "args": {
-                    "hash": "sha256-LE2x6lkDk2r977zRRApdTTWId/vXql2uOob7aEsnncI=",
+                    "hash": "sha256-LUV3ieY+bQ6qhft+xeTSxPuTlnmpbxkRIcIVBz86Aco=",
                     "owner": "nodejs",
                     "repo": "node",
-                    "tag": "v24.16.0"
+                    "tag": "v24.17.0"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -3263,8 +3263,8 @@
             },
             "src/third_party/ffmpeg": {
                 "args": {
-                    "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs=",
-                    "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
+                    "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk=",
+                    "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
                     "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3583,8 +3583,8 @@
             },
             "src/third_party/libvpx/source/libvpx": {
                 "args": {
-                    "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc=",
-                    "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
+                    "hash": "sha256-WpvbgyCocBm7BCL46kr+Mo7lZIOKSbLK6bog1T+HhQY=",
+                    "rev": "286281b987e08757b9d0e6e23f38f8b0f1b601ce",
                     "url": "https://chromium.googlesource.com/webm/libvpx.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3607,8 +3607,8 @@
             },
             "src/third_party/libyuv": {
                 "args": {
-                    "hash": "sha256-ZONwYhTD5/tPk5cm9Dmz59QB+rVxv1l/7lOhBOCMCf4=",
-                    "rev": "957f295ea946cbbd13fcfc46e7066f2efa801233",
+                    "hash": "sha256-DW7PuRqA1x0K8/uJbxBJ4Cn9YEPFhZ9vhuGVVyGKK98=",
+                    "rev": "30809ff64a9ca5e45f86439c0d474c2d3eef3d05",
                     "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3840,8 +3840,8 @@
             },
             "src/third_party/skia": {
                 "args": {
-                    "hash": "sha256-3yGenYm9OO63FP53odWv6vfy0fOKsXNpygb4vT8HRQM=",
-                    "rev": "2ac66cfda097720cd8d3e481c45b68b4ba096ef7",
+                    "hash": "sha256-2Xu45E9seJ0KfX5cmP07ZFAk8ffZp5RmuUscIqZlwJg=",
+                    "rev": "3a90f6662a2c30a7d270c7738cc70e5980974b02",
                     "url": "https://skia.googlesource.com/skia.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -4115,8 +4115,8 @@
             },
             "src/third_party/webrtc": {
                 "args": {
-                    "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE=",
-                    "rev": "e3ee86921c57b9f8921045e77f098604803cb66c",
+                    "hash": "sha256-GZU7eUSMuWUDswEDlEUNgjpQU5lWRJBmn3mw0Aunefo=",
+                    "rev": "419855526c87360c0352e28ebacc4bf0905b9d3f",
                     "url": "https://webrtc.googlesource.com/src.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -4155,15 +4155,15 @@
             },
             "src/v8": {
                 "args": {
-                    "hash": "sha256-5wkfQsD5pWMAgsXSGTzMYwBADqJpWqSoJEfIyGYkAno=",
-                    "rev": "0b1a7b33935f88a225ca32de62a13478f329b625",
+                    "hash": "sha256-4FU9K9EHtkeK9FLkYRHF7jiJcwS69jcGgpnrRXIhM5o=",
+                    "rev": "30ffa551746d451373b9869d658251b2c21343e9",
                     "url": "https://chromium.googlesource.com/v8/v8.git"
                 },
                 "fetcher": "fetchFromGitiles"
             }
         },
         "electron_yarn_data": {
-            "hash": "sha256-EIVoXfA3O0v+NgBap129bOm2yl9zFuDx78OLYj0Q/o8=",
+            "hash": "sha256-hBJkcohC8tvCIjQgZYeH9tTY6zxa+HCiLQJsgX1HCe4=",
             "missing_hashes": {
                 "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                 "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -4206,7 +4206,7 @@
             }
         },
         "modules": "146",
-        "node": "24.16.0",
-        "version": "42.4.0"
+        "node": "24.17.0",
+        "version": "42.5.1"
     }
 }
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4339c86d09cb..49ab2f14ee5e 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -42,12 +42,13 @@ let
 
   callPnpm =
     variant:
-    callPackage ./generic.nix {
-      inherit (variant) version hash;
-      knownVulnerabilities = variant.knownVulnerabilities or [ ];
-      #FIXME: remove this hack in a future version.
-      nodejs = null; # Passing null to detect out-of-tree overrides
-    };
+    callPackage ./generic.nix (
+      variant
+      // {
+        #FIXME: remove this hack in a future version.
+        nodejs = null; # Passing null to detect out-of-tree overrides
+      }
+    );
 
   mkPnpm = versionSuffix: variant: nameValuePair "pnpm_${versionSuffix}" (callPnpm variant);
 in
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index f3cdc920f26d..9de5e0ab6bef 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -17,7 +17,7 @@
   withNode ? true,
   version,
   hash,
-  knownVulnerabilities,
+  knownVulnerabilities ? [ ],
 }:
 let
   majorVersion = lib.versions.major version;
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index e12da2673ae4..8f05cf345198 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,14 +1,14 @@
 {
-  version = "2026.1";
+  version = "2026.2";
 
   # To get these, run:
   #
   # ```
-  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.1/$tool-2026.1.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
+  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.2/$tool-2026.2.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
   # ```
   sha256 = {
-    alfred = "sha256-Rd+8uKfLuq7j4SYHpGYB3YbOUiUHJTXptJ2kC78CtIk=";
-    batctl = "sha256-hEQWhsHUTtV6Vg8qC+n4brksMQ8iqqSgCTPrbIk2CHo=";
-    batman-adv = "sha256-ZIfdO0rQ+FUQ3tu6M1/nexuHfQ53OTxR3coHp0Ubj0U=";
+    alfred = "sha256-2ZV0i+X2KkIJFSXMwQLfWsZCGG6bkBRpipVaRGm2m5Y=";
+    batctl = "sha256-wdWAr7Bm0xZcI5tnQwuUxpkyYZwGqQsSlegoy1CBsSI=";
+    batman-adv = "sha256-Thf87SyAlF4iYJvodTRIFzP/G10XBQ3k5PMjwXFBgTU=";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 84cf7322c046..92bb741c7e02 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -844,13 +844,15 @@ let
       # enable temporary caching of the last request_key() result
       KEYS_REQUEST_CACHE = yes;
       # randomized slab caches
-      RANDOM_KMALLOC_CACHES = whenAtLeast "6.6" yes;
+      RANDOM_KMALLOC_CACHES = whenBetween "6.6" "7.2" yes;
+      KMALLOC_PARTITION_CACHES = whenAtLeast "7.2" yes;
+      KMALLOC_PARTITION_RANDOM = whenAtLeast "7.2" yes;
 
       # NIST SP800-90A DRBG modes - enabled by most distributions
       #   and required by some out-of-tree modules (ShuffleCake)
       #   This does not include the NSA-backdoored Dual-EC mode from the same NIST publication.
-      CRYPTO_DRBG_HASH = yes;
-      CRYPTO_DRBG_CTR = yes;
+      CRYPTO_DRBG_HASH = whenOlder "7.2" yes;
+      CRYPTO_DRBG_CTR = whenOlder "7.2" yes;
 
       # Enable KFENCE
       # See: https://docs.kernel.org/dev-tools/kfence.html
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 1850e03a312b..b1bbd932a1ee 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.1-rc7",
-        "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7",
+        "version": "7.2-rc1",
+        "hash": "sha256:1gpwr6n3cc2hqg36gy9g9w4rxawpz3y126j752z4zyls6h80b43v",
         "lts": false
     },
     "6.1": {
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 4e19941441da..c9e888067a74 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -216,27 +216,37 @@ let
 
   fixedPoint = boot stages;
 
+  removeInternallyDisallowedAttrPaths =
+    let
+      # Same as `lib.removeAttrs`, but can remove nested attributes (and order of arguments is fixed)
+      # TODO: Consider moving to lib.attrpaths.removeAttrPaths
+      removeAttrPaths =
+        attrPathsToRemove: set:
+        let
+          split = lib.partition (
+            attrPath:
+            assert attrPath != [ ];
+            lib.length attrPath == 1
+          ) attrPathsToRemove;
+          nestedApplied =
+            set
+            // lib.mapAttrs (name: attrPaths: removeAttrPaths (lib.map lib.tail attrPaths) set.${name}) (
+              lib.groupBy (attrPath: lib.head attrPath) split.wrong
+            );
+        in
+        lib.removeAttrs nestedApplied (lib.map lib.head split.right);
+    in
+    removeAttrPaths (map (x: x.attrPath) config.attrPathsDisallowedForInternalUse);
+
   pkgs =
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       fixedPoint
     else
       # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
-      # We replace these attribute paths with their original derivations again,
-      # because CI would just error out from the aborting attributes themselves.
-      # Internally all packages still see the aborting attributes if used as dependencies,
-      # because we do this here after the fixed-point is calculated.
-      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
-      # because unlike aliases, CI still needs to check the packages to evaluate at all,
-      # which it wouldn't if they're removed entirely.
-      lib.updateManyAttrsByPath
-        (map (attrs: {
-          path = attrs.attrPath;
-          update =
-            _:
-            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
-        }) config.attrPathsDisallowedForInternalUse)
-        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
+      # To prevent these attributes from causing CI failures we remove them entirely.
+      # These attrs are still evaluated but in a different way, see ci/eval/default.nix
+      removeInternallyDisallowedAttrPaths fixedPoint;
 
 in
 checked pkgs
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 20a5dfebb9f9..4b4d205d1c44 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -317,20 +317,16 @@ let
   };
 
   # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not warnings because those wouldn't give a backtrace, which is important for debugging
   # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
-  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  # See also ./default.nix, which removes these attributes entirely from the end result
   internallyDisallowedAttrPathsOverlay =
     final: prev:
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       { }
     else
-      {
-        # So that ./default.nix can add them back again outside the fixed point
-        # Don't use this in packages!
-        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
-      }
-      // lib.updateManyAttrsByPath (map (
+      lib.updateManyAttrsByPath (map (
         { attrPath, reason }:
         {
           path = attrPath;