diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index 55cbdb4947c2..cc02ba2530d4 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1167,17 +1167,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
           cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
+        '';
+      }
+    ];
     warnings =
       optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
         [
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 87cd750901e0..8610df3dd029 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";
@@ -8323,12 +8337,13 @@ final: prev: {
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
     version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
     meta.license = unfree;
     meta.hydraPlatforms = [ ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 772ea9f1a312..eb9c680fde58 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,
@@ -592,7 +593,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 836b169fad16..a04b5ccc69ad 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve
diff --git a/pkgs/by-name/ca/capa/package.nix b/pkgs/by-name/ca/capa/package.nix
index fad27bfb2801..f9b436fcaf4b 100644
--- a/pkgs/by-name/ca/capa/package.nix
+++ b/pkgs/by-name/ca/capa/package.nix
@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa
diff --git a/pkgs/by-name/ci/circup/package.nix b/pkgs/by-name/ci/circup/package.nix
index f4b0917e23ec..1059c9c3e6ed 100644
--- a/pkgs/by-name/ci/circup/package.nix
+++ b/pkgs/by-name/ci/circup/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "circup";
-  version = "3.0.4";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = "circup";
     tag = finalAttrs.version;
-    hash = "sha256-sv+ixo5S9JRuVu8JkKt29Kpn1ioRIwGW4Ss/A77YiFU=";
+    hash = "sha256-+/1lL5mVeVPFFLitLYIGzSxmnoizNxjb6+MYWreSijw=";
   };
 
   pythonRelaxDeps = [ "semver" ];
diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index fa1c9634b4db..415dba74842e 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fetchurl,
   installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -32,8 +34,9 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binarySHA=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
@@ -41,6 +44,15 @@ buildGoModule (finalAttrs: {
     installShellCompletion --bash $bashCompletionScript
   '';
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
   meta = {
     description = "Official command line client for Cloud Foundry";
     homepage = "https://github.com/cloudfoundry/cli";
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index bc2241469da7..38cf3ca4e31d 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
+    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
   };
 
-  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
+  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 9b8a3c25a982..f3c3afdf4874 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.547.0";
+  version = "1.551.2";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
+    hash = "sha256-wDV1F8rzO49sp2XxcZdvwyWKSzu+2CWahZ2kLoVoGRE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/db/dbcsr/package.nix b/pkgs/by-name/db/dbcsr/package.nix
index 8024f9c45ea4..0520eb4ce21d 100644
--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@@ -1,41 +1,69 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
-  mpiCheckPhaseHook,
-  pkg-config,
   fypp,
   gfortran,
+  mpi,
+  pkg-config,
+  python3,
+
+  # buildInputs
   blas,
   lapack,
-  python3,
   libxsmm,
-  mpi,
+
+  # nativeCheckInputs
+  mpiCheckPhaseHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbcsr";
   version = "2.10.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
   };
 
+  patches = [
+    # Explicitly export the C API symbols, otherwise hidden with GCC 16
+    # https://github.com/cp2k/dbcsr/pull/1027
+    (fetchpatch {
+      name = "expose-c-api-procedures.patch";
+      url = "https://github.com/cp2k/dbcsr/commit/a5d9bcfcd487e3181b981687334da1b89bc61dce.patch";
+      hash = "sha256-a4glOtMx1EUzYdoQb66bZaRnCgatVFWTqvcQlvU3oIc=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
-
-    # Force build of shared library, otherwise just static.
+  ''
+  # Force build of shared library, otherwise just static.
+  + ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'add_library(dbcsr ''${DBCSR_SRCS})' 'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
-      --replace 'add_library(dbcsr_c ''${DBCSR_C_SRCS})' 'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
-
-    # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+      --replace-fail \
+        'add_library(dbcsr ''${DBCSR_SRCS})' \
+        'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
+      --replace-fail \
+        'add_library(dbcsr_c ''${DBCSR_C_SRCS})' \
+        'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
+  ''
+  # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+  + ''
     substituteInPlace cmake/fypp-sources.cmake \
-      --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
+      --replace-fail \
+        'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' \
+        'COMMAND ''${FYPP_EXECUTABLE}'
   '';
 
   outputs = [
@@ -44,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    gfortran
-    python3
     cmake
-    pkg-config
     fypp
+    gfortran
+    mpi
+    pkg-config
+    python3
   ];
 
   buildInputs = [
@@ -60,17 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ mpi ];
 
   cmakeFlags = [
-    "-DUSE_OPENMP=ON"
-    "-DUSE_SMM=libxsmm"
-    "-DWITH_C_API=ON"
-    "-DBUILD_TESTING=ON"
-    "-DTEST_OMP_THREADS=2"
-    "-DTEST_MPI_RANKS=2"
-    "-DENABLE_SHARED=ON"
-    "-DUSE_MPI=ON"
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeFeature "USE_SMM" "libxsmm")
+    (lib.cmakeBool "WITH_C_API" true)
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeFeature "TEST_OMP_THREADS" "2")
+    (lib.cmakeFeature "TEST_MPI_RANKS" "2")
+    (lib.cmakeBool "ENABLE_SHARED" true)
+    (lib.cmakeBool "USE_MPI" true)
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     mpiCheckPhaseHook
   ];
 
@@ -80,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Distributed Block Compressed Sparse Row matrix library";
     license = lib.licenses.gpl2Only;
     homepage = "https://github.com/cp2k/dbcsr";
+    changelog = "https://github.com/cp2k/dbcsr/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ lib.maintainers.sheepforce ];
   };
 })
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index cb6091c0a997..83c161878825 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.2.0";
+  version = "26.2.1";
 
   src =
     let
@@ -31,9 +31,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-9QTnCnR2OqAuC2PWhCuFymRSb2gr5Fez8w4zDMEHSO0=";
-        aarch64-linux = "sha256-atqAOjnAcvyPHHdwZpKY6So1AXRKbh/5GXlKDe35WWM=";
-        aarch64-darwin = "sha256-YqA6qIQp1O7zV2VQOXquddJXagEt7aDIPUtE9fvNSj8=";
+        x86_64-linux = "sha256-Fte9AehPjNj0bWl2rBJ/olZ47AEJU8m03OQZM68gZ+g=";
+        aarch64-linux = "sha256-dvrR2QZNDtra33rIEbM7Z17KeXoQjcRqjjgtoiOZzI4=";
+        aarch64-darwin = "sha256-K/9ehDV8pe4mY/SEI9o52zg9EZbAhvl6oiYYj0qiwKA=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index ca06a0e755f3..1d81a9101d75 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";
 
   __structuredAttrs = true;
 
@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
   };
 
-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index bdf4fb1931d4..d97e1be68719 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -141,7 +141,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
     substituteInPlace frigate/events/audio.py \
-      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}" \
+      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}"
+
+    substituteInPlace frigate/events/audio.py frigate/api/app.py \
       --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
   '';
 
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 77680ff05cab..1ba6f6727185 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 9debe7777978..f03587fb25c7 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.13";
+  version = "0.10.14";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1j3q/n6sC3bIVwbcZfegJQO9WaLPfJWqgibO/XNmj6s=";
+    hash = "sha256-A7Gryk1ZWDu751n3rBfv9HUTiokoGhBol/ve9mWwRjA=";
   };
 
-  cargoHash = "sha256-YfgvcY1yYwlQuoEl21XEAxDR/SDce+OHhZOzp6tkzR0=";
+  cargoHash = "sha256-afYD2cR6VyFSa1M33ktuNcg2/r/Ag3HNKSz95gRCwuE=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 58e3db685e2c..6fe54a243187 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -9,7 +9,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nix-fast-build";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nix-fast-build";
     tag = finalAttrs.version;
-    hash = "sha256-L4HfADUq4Imq1LnvmjBPFBEAZAIKD9Pnj6ExRkVqHC4=";
+    hash = "sha256-sc/NZIHkRhgyAzK8Xn6G++vGrl/Uf7QHh+J5fnZ/o4s=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 5b97a543359d..7cbea42f8597 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -5,7 +5,6 @@
   cudaSupport ? opencv.cudaSupport or false,
 
   # build
-  scons,
   addDriverRunpath,
   autoPatchelfHook,
   cmake,
@@ -37,9 +36,6 @@ let
     getLib
     ;
 
-  # prevent scons from leaking in the default python version
-  scons' = scons.override { inherit python3Packages; };
-
   python = python3Packages.python.withPackages (
     ps: with ps; [
       cython
@@ -83,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchelf
     pkg-config
     python
-    scons'
   ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
@@ -98,21 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./gcc-16-fix.patch
   ];
 
-  # Fix arm computelib ar/ranlib toolchain paths for LTO awareness
-  postPatch = ''
-    substituteInPlace src/plugins/intel_cpu/thirdparty/ComputeLibrary/SConstruct \
-      --replace-fail \
-        "env['AR'] = toolchain_prefix + \"ar\"" \
-        "env['AR'] = \"${lib.getExe' stdenv.cc.cc "gcc-ar"}\"" \
-      --replace-fail \
-        "env['RANLIB'] = toolchain_prefix + \"ranlib\"" \
-        "env['RANLIB'] = \"${lib.getExe' stdenv.cc.cc "gcc-ranlib"}\""
-  '';
-
-  dontUseSconsCheck = true;
-  dontUseSconsBuild = true;
-  dontUseSconsInstall = true;
-
   cmakeFlags = [
     "-Wno-dev"
     "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
@@ -159,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "ENABLE_SYSTEM_PUGIXML" true)
     (cmakeBool "ENABLE_SYSTEM_SNAPPY" true)
     (cmakeBool "ENABLE_SYSTEM_TBB" true)
+    (cmakeBool "ENABLE_ARM_COMPUTE_CMAKE" true)
   ];
 
   # src/graph/src/plugins/intel_gpu/src/graph/include/reorder_inst.h:24:8: error: type 'struct typed_program_node' violates the C++ One Definition Rule [-Werror=odr]
@@ -193,6 +174,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "exec_prefix=\''${prefix}/" "exec_prefix="
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+  ];
+
   meta = {
     changelog = "https://github.com/openvinotoolkit/openvino/releases/tag/${finalAttrs.src.tag}";
     description = "Open-source toolkit for optimizing and deploying AI inference";
diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index 863597cc9341..5e9177d0367d 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "13.3.2";
+  version = "13.3.5";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-pqLjCE7tW7NOAzgFe5grPlRfXTrEXqx1OcFOBCJuO7M=";
+    hash = "sha256-3tbre+82kk8ngpN4JfMEe36YQQZDtY6PgFBUECmUa8o=";
   };
 
-  vendorHash = "sha256-jxV72scmud977MHDItY7wSmZ5j9fUEafty4foSiGH4Y=";
+  vendorHash = "sha256-Pv5O63wsTaQX5owW0XpyQbcSajaGmesorIatfrgZKJk=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/pl/plumed/package.nix b/pkgs/by-name/pl/plumed/package.nix
index e0ea4f987d02..a8cdeed578a2 100644
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -3,6 +3,10 @@
   lib,
   fetchFromGitHub,
   blas,
+
+  # passthru
+  python3Packages,
+  nix-update-script,
 }:
 
 assert !blas.isILP64;
@@ -11,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "plumed";
   version = "2.10.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "plumed";
     repo = "plumed2";
@@ -26,10 +33,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru = {
+    tests = {
+      pythonPackage = python3Packages.plumed;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Molecular metadynamics library";
     homepage = "https://github.com/plumed/plumed2";
     license = lib.licenses.lgpl3Only;
     maintainers = [ lib.maintainers.sheepforce ];
+    mainProgram = "plumed";
   };
 })
diff --git a/pkgs/by-name/ri/ripwire/package.nix b/pkgs/by-name/ri/ripwire/package.nix
index 8bba0f62dc78..87053062b64a 100644
--- a/pkgs/by-name/ri/ripwire/package.nix
+++ b/pkgs/by-name/ri/ripwire/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ripwire";
-  version = "0.6.1";
+  version = "0.6.5";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "redhat-et";
     repo = "ripwire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2a4J9lS0rdJyhkXkpQSkFrSf+NsMyeI2mJJNIYvgA8Y=";
+    hash = "sha256-6TeiT79KcEMhJI0HJIDTIOtrjmWgUxz8t8mkLpa2InQ=";
   };
 
   # Unvendor tree-sitter
diff --git a/pkgs/by-name/si/simplebluez/package.nix b/pkgs/by-name/si/simplebluez/package.nix
index b0d3d7488b00..528f6a5d39e7 100644
--- a/pkgs/by-name/si/simplebluez/package.nix
+++ b/pkgs/by-name/si/simplebluez/package.nix
@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "simplebluez";
 
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "simpleble";
     repo = "SimpleBLE";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GNLD62w5zTfW7CaknaZmU0jBro92HFw3gA29KJqOHGA=";
+    hash = "sha256-yA/InInNmK77/VxIX8CH0Nkqy9MJZr0Ci6xrVo76DK4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
new file mode 100644
index 000000000000..51b3e04bfe12
--- /dev/null
+++ b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
@@ -0,0 +1,29 @@
+Mark magicsock's network up before SetPrivateKey starts the first netcheck.
+
+With no non-loopback interface (e.g. the Nix build sandbox) the engine
+starts with magicsock's network down. SetPrivateKey and SetDERPMap kick
+off endpoint updates in the background, and if one of them runs before
+the later SetNetworkUp(true), updateNetInfo bails out on networkDown()
+without ever picking a home DERP. A server then is not reachable over
+DERP until the periodic re-STUN 20-26s later, and clients give up after
+10s with "tailcat Ping: context deadline exceeded".
+
+diff --git a/tailcat.go b/tailcat.go
+--- a/tailcat.go
++++ b/tailcat.go
+@@ -1577,6 +1577,7 @@ func (lb *locoBackend) Start() error {
+ 	mc := lb.sys.MagicSock.Get()
+ 	lb.logf("disco pub key: %v", mc.DiscoPublicKey())
+ 
++	mc.SetNetworkUp(true)
+ 	mc.SetPrivateKey(lb.priv)
+ 	mc.SetDERPMap(lb.dm)
+ 
+@@ -1632,7 +1633,6 @@ func (lb *locoBackend) Start() error {
+ 	mc.SetNetworkMap(nm.SelfNode, nm.Peers)
+ 	e.SetSelfNode(nm.SelfNode)
+ 	lb.sys.Netstack.Get().UpdateNetstackIPs(nm)
+-	mc.SetNetworkUp(true)
+ 	lb.logf("NetworkMap: %v", logger.AsJSON(nm))
+ 
+ 	// Install the live per-peer config sources. WireGuard peers are
diff --git a/pkgs/by-name/ta/tailcat/package.nix b/pkgs/by-name/ta/tailcat/package.nix
index 1a405e5f0303..9c52cbf50dff 100644
--- a/pkgs/by-name/ta/tailcat/package.nix
+++ b/pkgs/by-name/ta/tailcat/package.nix
@@ -8,7 +8,7 @@
 
 buildGo127Module (finalAttrs: {
   pname = "tailcat";
-  version = "0.6.0";
+  version = "0.7.0";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,18 @@ buildGo127Module (finalAttrs: {
     owner = "tailscale";
     repo = "tailcat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TwrEezNpn9ylDl7+Vo4XS/SaVOgU6h6PO1UWSrXnBWk=";
+    hash = "sha256-Hue5NZAmAf8mxFqgoDcjt7YHiROeudpAoanxSFnZkTk=";
   };
 
-  vendorHash = "sha256-hpFVgsUKswE7g69EieoeKGPR1nVkcRmBhDKbnB2CDBg=";
+  patches = [
+    # The sandbox has no non-loopback interface, so magicsock starts with
+    # its network down. The server's first netcheck can then run before
+    # SetNetworkUp(true) and it never picks a home DERP, which makes the
+    # e2e tests time out on "tailcat Ping: context deadline exceeded".
+    ./network-up-before-first-netcheck.patch
+  ];
+
+  vendorHash = "sha256-yfOl/gWIijLlqchXFiTRZ7vlgS/kn0xOmv52TFMYs+E=";
 
   subPackages = [ "cmd/tailcat" ];
 
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index f16b467c5821..ebd2c362f222 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -193,6 +193,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
       substituteInPlace ./Makefile \
           --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
       sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    ''
+    # rquickjs-sys passes the raw rust target to clang, which does not know riscv64gc
+    + lib.optionalString stdenv.hostPlatform.isRiscV64 ''
+      substituteInPlace $cargoDepsCopy/source-*/rquickjs-sys-*/build.rs \
+        --replace-fail \
+          'let mut cflags = vec![format!("--target={}", target)];' \
+          'let mut cflags = vec![format!("--target={}", target.replace("riscv64gc", "riscv64"))];'
     '';
 
   # The Makefile install can't enable the wasm feature.
diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix
index 34edbac94248..13c9e8a9aa44 100644
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -10,6 +10,9 @@
   SDL2_net,
   makeBinaryWrapper,
   SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
   pango,
   gettext,
   boost186,
@@ -22,12 +25,30 @@
   lua5_4,
   curl,
   nix-update-script,
+  versionCheckHook,
   enableDevel ? false,
 }:
 
 let
   boost = boost186;
   suffix = lib.optionalString enableDevel "-devel";
+
+  sdl =
+    if enableDevel then
+      [
+        sdl3
+        sdl3-image
+        sdl3-mixer
+      ]
+    else
+      [
+        SDL2
+        SDL2_image
+        SDL2_mixer
+        SDL2_net
+        SDL2_ttf
+      ];
+
   # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
   lua = lua5_4.override {
     postConfigure = ''
@@ -38,7 +59,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.24" else "1.18.8";
+  version = if enableDevel then "1.19.28" else "1.18.8";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -46,11 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-q6gdzHDPkG/RqpJxIHqWsxD0n8dzKajDhAT49bjmq78="
+        "sha256-5S2kgqn+HZIPguQP+FYaK79Cvx0IRnmcGSeWPQflt/g="
       else
         "sha256-Tgp3y120j5nqoBrDo7D9C0FcVO3TH5lf+/SoCjR+ikc=";
   };
 
+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/wesnothd${suffix}";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -58,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeBinaryWrapper ];
 
   buildInputs = [
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_net
-    SDL2_ttf
     pango
     gettext
     boost
@@ -74,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     icu
     lua
     curl
-  ];
+  ]
+  ++ sdl;
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SYSTEM_LUA" true)
diff --git a/pkgs/by-name/wl/wlc/package.nix b/pkgs/by-name/wl/wlc/package.nix
index 499fa76dfacb..2c508d2a76cf 100644
--- a/pkgs/by-name/wl/wlc/package.nix
+++ b/pkgs/by-name/wl/wlc/package.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "wlc";
-  version = "2.1.1";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z0Ig+SuJ5XdZkDb3I5AXziVFjMAMCIly2vcQRqx62sw=";
+    hash = "sha256-8d5KOfHDY+4gUOc9lGNAayn8IBD5p706lGXpSuskKOU=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 92e2c6b7d5c0..81e03daeebea 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.45.0";
-  npmDepsHash = "sha256-+5eIwbSTpRupYj4gR33MDeJEEDBlt+K4idnlZFWG4Z4=";
+  version = "2.57.0";
+  npmDepsHash = "sha256-mblscdXgrIV2D3MjIqR+uqHh304mGnEKDDqsiFZZrB4=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/HoSAgt7INT5Hharc+ltb2ya8InAuZmhS8Tmftl0VOo=";
+    hash = "sha256-ECRkAs8QhwCp2wEyqGzZ6F9sG9hXaomVEShKXO34tEg=";
   };
 
   npmWorkspace = "apps/desktop";
diff --git a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
index 81bd142fcc70..5057a1debade 100644
--- a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
+++ b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
@@ -54,6 +54,7 @@ mixReleaseRemoveErlangReferences() {
     # use bbe to substitute strings in binary files, because using substituteInPlace
     # on binaries will raise errors
     bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
+    chmod --reference="$file" "$file".tmp
     rm -f "$file"
     mv "$file".tmp "$file"
   done
@@ -75,11 +76,11 @@ mixReleaseStripDebugHook() {
 }
 
 if [ -z "${dontMixReleaseFixup-}" ]; then
-  preFixupHooks+=(mixReleaseFixupHook)
+  postFixupHooks+=(mixReleaseFixupHook)
 fi
 
 if [ -n "${removeCookie-1}" ]; then
-  preFixupHooks+=(mixReleaseRemoveCookieHook)
+  postFixupHooks+=(mixReleaseRemoveCookieHook)
 fi
 
 if [ -n "${stripDebug-}" ]; then
diff --git a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
index 2a2ca6d257a4..b4ff85f0a4c0 100644
--- a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
+++ b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
@@ -24,9 +24,6 @@ buildRedistHookRegistration() {
   postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
   nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"
 
-  preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
-  nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
-
   postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
   nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"
 
@@ -193,16 +190,6 @@ checkCudaHasStubsIffIncludeRemoveStubsFromRunpathHook() {
   return 0
 }
 
-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
-fixupPropagatedBuildOutputsForMultipleOutputs() {
-  nixLog "converting propagatedBuildOutputs to a space-separated string"
-  # shellcheck disable=SC2124
-  export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
-  return 0
-}
-
 # The multiple outputs setup hook only propagates build outputs to dev.
 # We want to propagate them to out as well, in case the user interpolates
 # the package into a string -- in such a case, the dev output is not selected
@@ -217,7 +204,7 @@ fixupCudaPropagatedBuildOutputsToOut() {
   mkdir -p "${out:?}/nix-support"
 
   # NOTE: We must use printWords to ensure the output is a single line.
-  for output in $propagatedBuildOutputs; do
+  for output in "${propagatedBuildOutputs[@]}"; do
     # Propagate the other components to the out output
     nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
     printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 50843b9a6583..68642e38678a 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -4,6 +4,8 @@
   lib,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
   makeBinaryWrapper,
 }:
 
@@ -199,6 +201,13 @@ rec {
 
   luajit_openresty = import ../luajit/openresty.nix {
     self = luajit_openresty;
-    inherit callPackage fetchFromGitHub passthruFun;
+    inherit
+      callPackage
+      fetchFromGitHub
+      fetchpatch2
+      applyPatches
+      stdenv
+      passthruFun
+      ;
   };
 }
diff --git a/pkgs/development/interpreters/luajit/openresty.nix b/pkgs/development/interpreters/luajit/openresty.nix
index 4316871f8f97..856bad91c6ae 100644
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -2,23 +2,45 @@
   self,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
+  stdenv,
   passthruFun,
 }:
 
-callPackage ./default.nix rec {
-  version = "2.1-20260724";
+let
+  version = "2.1-20260824";
 
   src = fetchFromGitHub {
     owner = "openresty";
     repo = "luajit2";
-    rev = "v${version}";
-    hash = "sha256-cvy9FgHWFuacCFl7/conLwNuMgaol1LnIUiqcnXy9H8=";
+    tag = "v${version}";
+    hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
   };
 
+  # upstream LuaJIT has no riscv64.
+  # port submitted at https://github.com/openresty/luajit2/pull/236 same as Debian
+  srcWithRiscv64Port = applyPatches {
+    inherit src;
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/openresty/luajit2/compare/v2.1-20260824...ce14aff834d8d62220fc730a16042c52451f41cc.diff";
+        hash = "sha256-VHDTUr7PWpthmhO3BokCbdL1cricAnX6BjZGTi1wr3Q=";
+      })
+    ];
+  };
+in
+callPackage ./default.nix {
+  inherit version;
+
+  # default luaAttr would be luajit_2_1, the wrong interpreter for the lua package set
+  luaAttr = "luajit_openresty";
+
+  src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
+
   extraMeta = {
     badPlatforms = [
       "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
-      "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
       # 64-bit POWER (LE and BE, either ELF ABI version on the latter) *is* supported, but ELFv1 powerpc64-linux has an
       # issue with memory allocation
       # https://github.com/openresty/luajit2/issues/258
diff --git a/pkgs/development/python-modules/argos-translate-files/default.nix b/pkgs/development/python-modules/argos-translate-files/default.nix
index 6003dd24a067..87c76ef7d43f 100644
--- a/pkgs/development/python-modules/argos-translate-files/default.nix
+++ b/pkgs/development/python-modules/argos-translate-files/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Translate files using Argos Translate";
     homepage = "https://www.argosopentech.com";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ misuzu ];
   };
 })
diff --git a/pkgs/development/python-modules/capa/default.nix b/pkgs/development/python-modules/flare-capa/default.nix
similarity index 91%
rename from pkgs/development/python-modules/capa/default.nix
rename to pkgs/development/python-modules/flare-capa/default.nix
index 4aeb280f6ad1..450c6624282d 100644
--- a/pkgs/development/python-modules/capa/default.nix
+++ b/pkgs/development/python-modules/flare-capa/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   colorama,
   deptry,
@@ -45,7 +46,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "capa";
+  pname = "flare-capa";
   version = "9.4.0";
   pyproject = true;
 
@@ -127,5 +128,8 @@ buildPythonPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "capa";
+    # Never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345235630
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/development/python-modules/plumed/default.nix b/pkgs/development/python-modules/plumed/default.nix
new file mode 100644
index 000000000000..327c41e6cc97
--- /dev/null
+++ b/pkgs/development/python-modules/plumed/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  plumed,
+
+  # build-system
+  cython,
+  setuptools,
+
+  # tests
+  numpy,
+  pandas,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "plumed";
+  inherit (plumed) version src;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  env = {
+    plumed_version = finalAttrs.version;
+    plumed_include_dir = "${lib.getDev plumed}/include/plumed/wrapper";
+
+    # Hardcode the path to the kernel so that PLUMED_KERNEL does not need to be set at runtime
+    plumed_default_kernel = "${lib.getLib plumed}/lib/libplumedKernel${stdenv.hostPlatform.extensions.sharedLibrary}";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  buildInputs = [
+    plumed
+  ];
+
+  pythonImportsCheck = [ "plumed" ];
+
+  nativeCheckInputs = [
+    numpy
+    pandas
+    pytestCheckHook
+  ];
+
+  enabledTestPaths = [ "test" ];
+
+  meta = {
+    description = "Python wrappers for plumed";
+    homepage = "https://github.com/plumed/plumed2/tree/master/python";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 95d589220a20..ae9dcb727dd4 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -82,6 +82,13 @@ let
           '') (builtins.attrNames pythonScriptsToInstall)}
           patchShebangs tools
           patchShebangs scripts
+        ''
+        # This warning got removed in
+        # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=cba90ce82064ad1e6d25f20d8eaa940bd2fc97ed
+        + ''
+          for f in scripts/Makefile.lib dts/upstream/Makefile; do
+            substituteInPlace "$f" --replace-fail -Wno-graph_child_address ""
+          done
         '';
 
         nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9e34e0d03e97..ccfc02caa96b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4395,7 +4395,7 @@ with pkgs;
 
   luaPackages = lua52Packages;
 
-  luajit = luajit_2_1;
+  luajit = if stdenv.hostPlatform.isRiscV64 then luajit_openresty else luajit_2_1;
 
   luarocks = luaPackages.luarocks;
   luarocks-nix = luaPackages.luarocks-nix;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b550b21f511a..00815e899f45 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases {
   bz2file = throw "'bz2file' has beem removed, as it was not longed maintained upstream since 2020"; # added 2025-08-26
   calysto-scheme = throw "'calysto-scheme' has been removed as it is no longer maintained upstream"; # Added 2026-01-31
   can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29
+  capa = flare-capa; # added 2026-09-29
   casbin = pycasbin; # added 2025-06-12
   cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29
   chai = throw "'chai' has been removed as it is no longer maintained upstream and the repository was archived"; # Added 2026-06-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ef18a7b2f4d5..fdd9d676c094 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2877,8 +2877,6 @@ self: super: with self; {
 
   cantools = callPackage ../development/python-modules/cantools { };
 
-  capa = callPackage ../development/python-modules/capa { };
-
   capstone = callPackage ../development/python-modules/capstone { inherit (pkgs) capstone; };
 
   capstone_4 = callPackage ../development/python-modules/capstone/4.nix {
@@ -6201,6 +6199,8 @@ self: super: with self; {
 
   flammkuchen = callPackage ../development/python-modules/flammkuchen { };
 
+  flare-capa = callPackage ../development/python-modules/flare-capa { };
+
   flasgger = callPackage ../development/python-modules/flasgger { };
 
   flash-attn = callPackage ../development/python-modules/flash-attn { };
@@ -13804,6 +13804,10 @@ self: super: with self; {
 
   plumbum = callPackage ../development/python-modules/plumbum { };
 
+  plumed = callPackage ../development/python-modules/plumed {
+    inherit (pkgs) plumed;
+  };
+
   pluralizer = callPackage ../development/python-modules/pluralizer { };
 
   pluthon = callPackage ../development/python-modules/pluthon { };