diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 904cb3cbdd79..e73611f4810e 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -84,7 +84,7 @@ function runChecklist({
 
   if (user) {
     checklist[
-      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers).`
+      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers) (_see [requesting a new invitation](https://github.com/NixOS/rfc39-record/blob/main/README.md#requesting-a-new-invitation)_).`
     ] = userIsMaintainer
     if (allByName) {
       // We can only determine the below, if all packages are in by-name, since
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 0bd05ef80140..61904296d91f 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -144,10 +144,14 @@
 
 - [Netbird Relay](https://netbird.io/), a module to relay traffic when a point-to-point connection is not possible.
 
+- [ollaya](https://ollaya.dev), a server for local decision models, with an Ollama-style CLI and a TypeSafe-compatible API. Available as [services.ollaya](#opt-services.ollaya.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `services.autobrr.secretFile` has been removed, as autobrr no longer uses a session secret since version 1.82.0. Remove the option from your configuration.
+
 - Artalk has been updated to 2.10.0. Its default configuration and data
   directory discovery changed; see the [upstream migration
   guide](https://artalk.js.org/en/guide/releases/v2.10.0.html) when invoking
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 141722e2e2d7..fef459fe7e89 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -959,6 +959,7 @@
   ./services/misc/nzbhydra2.nix
   ./services/misc/octoprint.nix
   ./services/misc/ollama.nix
+  ./services/misc/ollaya.nix
   ./services/misc/ombi.nix
   ./services/misc/omnom.nix
   ./services/misc/open-webui.nix
diff --git a/nixos/modules/services/misc/autobrr.nix b/nixos/modules/services/misc/autobrr.nix
index 47ada630cd82..250808da210f 100644
--- a/nixos/modules/services/misc/autobrr.nix
+++ b/nixos/modules/services/misc/autobrr.nix
@@ -11,6 +11,14 @@ let
   configFile = configFormat.generate "autobrr.toml" cfg.settings;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "autobrr"
+      "secretFile"
+    ] "autobrr no longer uses a session secret since version 1.82.0.")
+  ];
+
   options = {
     services.autobrr = {
       enable = lib.mkEnableOption "Autobrr";
@@ -21,11 +29,6 @@ in
         description = "Open ports in the firewall for the Autobrr web interface.";
       };
 
-      secretFile = lib.mkOption {
-        type = lib.types.path;
-        description = "File containing the session secret for the Autobrr web interface.";
-      };
-
       settings = lib.mkOption {
         type = lib.types.submodule {
           freeformType = configFormat.type;
@@ -67,17 +70,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = !(cfg.settings ? sessionSecret);
-        message = ''
-          Session secrets should not be passed via settings, as
-          these are stored in the world-readable nix store.
-
-          Use the secretFile option instead.'';
-      }
-    ];
-
     systemd = {
       tmpfiles.settings = {
         "10-autobrr" = {
@@ -101,8 +93,6 @@ in
         serviceConfig = {
           Type = "simple";
           DynamicUser = true;
-          LoadCredential = "sessionSecret:${cfg.secretFile}";
-          Environment = [ "AUTOBRR__SESSION_SECRET_FILE=%d/sessionSecret" ];
           StateDirectory = "autobrr";
           ExecStart = "${lib.getExe cfg.package} --config %S/autobrr";
           Restart = "on-failure";
diff --git a/nixos/modules/services/misc/ollaya.nix b/nixos/modules/services/misc/ollaya.nix
new file mode 100644
index 000000000000..b242a2e36ab1
--- /dev/null
+++ b/nixos/modules/services/misc/ollaya.nix
@@ -0,0 +1,228 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) literalExpression types;
+
+  cfg = config.services.ollaya;
+  ollaya = lib.getExe cfg.package;
+
+  staticUser = cfg.user != null && cfg.group != null;
+in
+{
+  options.services.ollaya = {
+    enable = lib.mkEnableOption "ollaya server for local decision models";
+
+    package = lib.mkPackageOption pkgs "ollaya" { };
+
+    user = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "ollaya";
+      description = ''
+        User account under which to run ollaya. Defaults to
+        [`DynamicUser`](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=)
+        when set to `null`.
+
+        The user will automatically be created when this option is non-null.
+      '';
+    };
+
+    group = lib.mkOption {
+      type = types.nullOr types.str;
+      default = cfg.user;
+      defaultText = literalExpression "config.services.ollaya.user";
+      example = "ollaya";
+      description = ''
+        Group under which to run ollaya. Only used when `services.ollaya.user` is set.
+      '';
+    };
+
+    home = lib.mkOption {
+      type = types.str;
+      default = "/var/lib/ollaya";
+      example = "/home/foo";
+      description = "The home directory that the ollaya service is started in.";
+    };
+
+    modelsDir = lib.mkOption {
+      type = types.str;
+      default = "${cfg.home}/models";
+      defaultText = literalExpression "\${config.services.ollaya.home}/models";
+      example = "/path/to/ollaya/models";
+      description = ''
+        Directory where ollaya reads and stores downloaded models.
+      '';
+    };
+
+    host = lib.mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "IP address on which the server listens.";
+    };
+
+    port = lib.mkOption {
+      type = types.port;
+      default = 11435;
+      example = 11111;
+      description = "Port on which the server listens.";
+    };
+
+    settings = lib.mkOption {
+      type = types.submodule { freeformType = types.attrsOf types.str; };
+      default = { };
+      example = {
+        OLLAYA_DEVICE = "cuda";
+        OLLAYA_KEEP_ALIVE = "30m";
+      };
+      description = ''
+        Environment variables passed to the ollaya server process.
+        See <https://ollaya.dev/docs/cli#ollaya-serve> for available variables.
+      '';
+    };
+
+    loadModels = lib.mkOption {
+      type = types.listOf types.str;
+      apply = builtins.filter (model: model != "");
+      default = [ ];
+      example = [ "winnow:e4b" ];
+      description = ''
+        Models to download after the ollaya service starts. This creates a
+        separate `ollaya-model-loader.service`.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for ollaya. This adds
+        `services.ollaya.port` to `networking.firewall.allowedTCPPorts`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = lib.mkIf staticUser {
+      users.${cfg.user} = {
+        inherit (cfg) home;
+        isSystemUser = true;
+        group = cfg.group;
+      };
+      groups.${cfg.group} = { };
+    };
+
+    systemd.services.ollaya = {
+      description = "Server for local decision models";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = cfg.settings // {
+        HOME = cfg.home;
+        OLLAYA_MODELS = cfg.modelsDir;
+        OLLAYA_HOST = "${cfg.host}:${toString cfg.port}";
+      };
+      serviceConfig =
+        lib.optionalAttrs staticUser {
+          User = cfg.user;
+          Group = cfg.group;
+        }
+        // {
+          Type = "exec";
+          DynamicUser = true;
+          ExecStart = "${ollaya} serve";
+          WorkingDirectory = cfg.home;
+          StateDirectory = [ "ollaya" ];
+          ReadWritePaths = [
+            cfg.home
+            cfg.modelsDir
+          ];
+
+          CapabilityBoundingSet = [ "" ];
+          DeviceAllow = [
+            "char-nvidiactl"
+            "char-nvidia-caps"
+            "char-nvidia-frontend"
+            "char-nvidia-uvm"
+            "char-drm"
+            "char-fb"
+            "char-kfd"
+            "/dev/dxg"
+          ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = false;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "all";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          SupplementaryGroups = [ "render" ];
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service @resources"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+    };
+
+    systemd.services.ollaya-model-loader = lib.mkIf (cfg.loadModels != [ ]) {
+      description = "Download ollaya models in the background";
+      wantedBy = [
+        "multi-user.target"
+        "ollaya.service"
+      ];
+      wants = [ "network-online.target" ];
+      after = [
+        "ollaya.service"
+        "network-online.target"
+      ];
+      bindsTo = [ "ollaya.service" ];
+      environment = config.systemd.services.ollaya.environment;
+      serviceConfig = {
+        Type = "exec";
+        DynamicUser = true;
+        Restart = "on-failure";
+        RestartSec = "1s";
+        RestartMaxDelaySec = "2h";
+        RestartSteps = "10";
+      };
+      script =
+        let
+          nproc = lib.getExe' pkgs.coreutils "nproc";
+          xargs = lib.getExe' pkgs.findutils "xargs";
+        in
+        ''
+          printf "%s\0" ${lib.escapeShellArgs cfg.loadModels} | '${xargs}' -0 -r -n 1 -P "$('${nproc}')" '${ollaya}' pull
+        '';
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ happysalada ];
+}
diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix
index 3537dab80f13..f20664b3c292 100644
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@@ -29,6 +29,9 @@
 
     boot.initrd.systemd.tpm2.pcrphases.enable =
       lib.mkEnableOption "systemd initrd boot phase measurements";
+
+    boot.initrd.systemd.tpm2.pcrosseparator.enable =
+      lib.mkEnableOption "systemd initrd boot phase OS userspace separator";
   };
 
   # TODO: pcrextend, pcrfs, pcrmachine
@@ -102,5 +105,17 @@
         boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
       }
     )
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrosseparator.enable) {
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-pcrosseparator.service"
+        ];
+        boot.initrd.systemd.services.systemd-pcrosseparator.wantedBy = [ "initrd.target" ];
+        boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
+      }
+    )
   ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index dd6c90ee9648..a446bad2b517 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1377,6 +1377,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ollama-vulkan = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-vulkan.nix;
+  ollaya = runTest ./ollaya.nix;
   omada = runTestOn [ "x86_64-linux" ] ./omada.nix;
   ombi = runTest ./ombi.nix;
   omnom = runTest ./omnom;
diff --git a/nixos/tests/autobrr.nix b/nixos/tests/autobrr.nix
index 96f62b892dbd..326be69da816 100644
--- a/nixos/tests/autobrr.nix
+++ b/nixos/tests/autobrr.nix
@@ -4,28 +4,17 @@
   name = "autobrr";
   meta.maintainers = with lib.maintainers; [ av-gal ];
 
-  nodes.machine =
-    { pkgs, ... }:
-    let
-      # We create this secret in the Nix store (making it readable by everyone).
-      # DO NOT DO THIS OUTSIDE OF TESTS!!
-      testSecretFile = pkgs.writeText "session_secret" "not-secret";
-    in
-    {
+  nodes.machine = {
+    services.autobrr.enable = true;
+
+    # Use port other than default to test if settings options work.
+    specialisation.settingsPort.configuration = {
       services.autobrr = {
         enable = true;
-        secretFile = testSecretFile;
-      };
-
-      # Use port other than default to test if settings options work.
-      specialisation.settingsPort.configuration = {
-        services.autobrr = {
-          enable = true;
-          secretFile = testSecretFile;
-          settings.port = 7777;
-        };
+        settings.port = 7777;
       };
     };
+  };
 
   testScript =
     { nodes, ... }:
diff --git a/nixos/tests/ollaya.nix b/nixos/tests/ollaya.nix
new file mode 100644
index 000000000000..762c53af2f8e
--- /dev/null
+++ b/nixos/tests/ollaya.nix
@@ -0,0 +1,44 @@
+{ lib, ... }:
+
+let
+  port = 11435;
+  apiKey = "ollaya-test-key";
+in
+{
+  name = "ollaya";
+  meta.maintainers = with lib.maintainers; [ happysalada ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.ollaya = {
+        enable = true;
+        inherit port;
+        settings.OLLAYA_API_KEY = apiKey;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("ollaya.service")
+    machine.wait_for_open_port(${toString port})
+
+    # `GET /` is the liveness endpoint and the only one that takes no API key.
+    assert "Ollaya is running" in machine.succeed(
+        "curl --fail http://127.0.0.1:${toString port}/"
+    )
+
+    # `services.ollaya.settings` reaches the server: the API refuses a request
+    # without the key, and answers the model list with it.
+    status = machine.succeed(
+        "curl -so /dev/null -w '%{http_code}' http://127.0.0.1:${toString port}/api/tags"
+    )
+    assert status == "401", status
+
+    tags = machine.succeed(
+        "curl --fail -H 'Authorization: Bearer ${apiKey}' http://127.0.0.1:${toString port}/api/tags"
+    )
+    assert json.loads(tags)["models"] == [], tags
+  '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/astral-sh.ty/default.nix b/pkgs/applications/editors/vscode/extensions/astral-sh.ty/default.nix
new file mode 100644
index 000000000000..ab40c8f20c75
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/astral-sh.ty/default.nix
@@ -0,0 +1,59 @@
+{
+  stdenvNoCC,
+  lib,
+  vscode-utils,
+  ty,
+  vscode-extension-update-script,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-A9cFMhVMC+duJmRIbWcVWExZdAtDi7bj95cphL8FQ1g=";
+        };
+        "aarch64-linux" = {
+          arch = "linux-arm64";
+          hash = "sha256-//xadLpMq3b/vIfK93Gd3yCwAvpSRqJ7NdvpFtRgDRE=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-pGW+TEc69V50dmDdgbqBeFSrzRjfIVxp9NUX+CGQ84g=";
+        };
+      };
+    in
+    {
+      name = "ty";
+      publisher = "astral-sh";
+      version = "2026.76.0";
+    }
+    // sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+  postInstall = ''
+    test -x "$out/$installPrefix/bundled/libs/bin/ty" || {
+      echo "Replacing the bundled ty binary failed, because 'bundled/libs/bin/ty' is missing."
+      echo "Update the package to the match the new path/behavior."
+      exit 1
+    }
+    ln -sf ${lib.getExe ty} "$out/$installPrefix/bundled/libs/bin/ty"
+  '';
+
+  passthru.updateScript = vscode-extension-update-script { };
+
+  meta = {
+    license = lib.licenses.mit;
+    changelog = "https://marketplace.visualstudio.com/items/astral-sh.ty/changelog";
+    description = "Visual Studio Code extension with support for the ty type checker and language server";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=astral-sh.ty";
+    homepage = "https://github.com/astral-sh/ty-vscode";
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-linux"
+    ];
+    maintainers = [ lib.maintainers.thegu5 ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix b/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
index 6cdc5686b560..a039457d6552 100644
--- a/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "calva";
     publisher = "betterthantomorrow";
-    version = "2.0.597";
-    hash = "sha256-/vUTCigRl1iH9IWa7DzBbeKjrR3dvQKhw15+UEdLwa0=";
+    version = "2.0.599";
+    hash = "sha256-gfI4l/G3Yr6uk0ZCsJKPM+/Dp09xWv6k8GvUj8tEPYs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix b/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
index 19bd34c82ad7..0a9e16f16363 100644
--- a/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-sZ9dwKsCNHIQQDnHRLF7U/sq3tt3MECDjpEwO4emn6I=";
+          hash = "sha256-rcF2hINVWsnGkOoGz/pCbUngaK9p/Wan03qSTnxB/Xs=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-sUjRLPUM8gc1ddBajfd+C0HQsY87mzQ+/BcXxOS6a0I=";
+          hash = "sha256-j7pv4MICFzqfFCI+dmgB7xtnMRIXkgRYyEBzIZaJwNI=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-ifxVrJmXZPdOvfS0Dnl/ns/qtP1UP4RbZhLWs10AweU=";
+          hash = "sha256-ef52k2aBnFnTdrUWyw5n4tIaMHXaOpWTW+3DWIai1+o=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.82.0";
+      version = "2026.84.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 560836c1053b..ad7779da2c67 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -408,6 +408,8 @@ let
         };
       };
 
+      astral-sh.ty = callPackage ./astral-sh.ty { };
+
       astro-build.astro-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "astro-vscode";
@@ -513,8 +515,8 @@ let
         mktplcRef = {
           publisher = "banacorn";
           name = "agda-mode";
-          version = "0.10.2";
-          hash = "sha256-XpVhFFxmvoIHh64abRVQ+hrdauJBwg+doJGNoweH2hU=";
+          version = "0.10.3";
+          hash = "sha256-z1s4edXz1Wx29v/iSyxyEae5dygYuMsfawkGBMBeb94=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -1362,8 +1364,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.29.10";
-          hash = "sha256-t1FbUeFw5WMKyb/qwVJBpILB8z4wtWH/BOnMVEDg0pU=";
+          version = "2.29.12";
+          hash = "sha256-ZTrwgdbnyqBn4CIfH3+6vTvE1AXKgNHmm7bPExakXL8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1792,8 +1794,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.44.6";
-          hash = "sha256-9OAQIXdFqV3pLFmixB2ES8Ti/qK3uPk6yMRs9Y+w4aI=";
+          version = "0.46.0";
+          hash = "sha256-DUPUUSZX1lfC604BIaRKKlci0Eh0u2xyyLFclVjFacI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -5014,8 +5016,8 @@ let
         mktplcRef = {
           name = "errorlens";
           publisher = "usernamehw";
-          version = "3.28.0";
-          hash = "sha256-7eu7y9IR1uxSFZ0IplDieFt3iWbcmdwf1lAcXq+S4C8=";
+          version = "3.29.0";
+          hash = "sha256-kK9Axp2tMUGZ/04VtL5hzg35zvnRIjHpnmCJt9OhHQ8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix b/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
index 27974e7a23fc..023488b7fe94 100644
--- a/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "magic-racket";
     publisher = "evzen-wybitul";
-    version = "0.8.0";
-    hash = "sha256-yWmJFLXktsJDEDwHO8ZCXQBTw8j5bOv6TXEOO/V8mZs=";
+    version = "0.9.0";
+    hash = "sha256-EpSSSYoVnXHgJKoqSuMf/fTnGxAVqmc+RfXE5/HZ/C0=";
   };
   nativeBuildInputs = [
     jq
diff --git a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
index 3aca1228e115..bb4d706c6dbb 100644
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-Uym2S4NN78yUDQdg1qFednfYT5K6AkQfBOmDp3fFGoc=";
+          hash = "sha256-TCgYmw0uZ5NEoiIvNLCNrY7wXfich7sYmfoZEAyaeFU=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-tB6Z/rXYYLo/SsPLQiaQZ6KUJZhh+aiYaBMpJz0wbtk=";
+          hash = "sha256-LfkfByHLUB1KZ7BH49dSlP+84AqLf+19RdTt7BJZgBE=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-IicI0BbpGBDw+tGFlbefXA1iSPQZNLj/n0nv6zEGkHA=";
+          hash = "sha256-iHKlTHZ4wdHhrTqpPjLl/Fm5nYDEjPo0J+g0IAxJS58=";
         };
       };
     in
     {
       publisher = "kilocode";
       name = "Kilo-Code";
-      version = "7.6.2";
+      version = "7.7.9";
     }
     // sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system ${stdenv.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
index 06045df7d7be..100a9518d624 100644
--- a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.17.1";
-    hash = "sha256-yoUFxyu4rgJVbSLU4BMdR4rF53DHQHw5qGFwqRw0X7I=";
+    version = "1.18.0";
+    hash = "sha256-ML44PSVZoW9aRyFVFd7IsRX2T9XQiqt0Tel9SutqErA=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
index 49aa69db8d0f..e226a6cfca1e 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
@@ -18,15 +18,15 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-FTS8cK9ovmxGLnywOGTIP7oUOHZ4RLE5t7lfhltdmIc=";
+        hash = "sha256-NnINb4ywaINKqNagJK6XampTqhBb3ztT/crNe0YV0fg=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-EV3745OXbwrRmc8P5e13DZbomyJGcYQUF07WflRWU1Q=";
+        hash = "sha256-ejzWiDT7Ie3rWkfXHUEyIJGh7Tn/vwXAHRz7q7gwjD8=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-KCIkjBmYZPiuFmQ3/aDycARYIHPyDTmMkoGcuG5DQX8=";
+        hash = "sha256-LXAtSvfxEGxt7YHMl8S9imDIb6/Mfi7BsTamwnx9sGE=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -50,7 +50,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.140.8";
+    version = "2.160.4";
     inherit (extInfo) hash arch;
   };
 
diff --git a/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
index df4d6f6868ec..6335b7b83eb9 100644
--- a/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "oxc";
     name = "oxc-vscode";
-    version = "1.61.0";
-    hash = "sha256-b+X57zVNIz2T/A4zmpd9Bc2x99gxbnUL9Yls1VVgUxc=";
+    version = "1.62.0";
+    hash = "sha256-ETz3fvkxZDLR9S0coibdKB0tU6JO66pXn+1AdUo9yKA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index c92653a5eefc..28d5209e503d 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-gdyO/zg0NS8Md0o8WG96/0SrMw+VdJnRge6Io16l30Q=";
+      hash = "sha256-yDOQ1WYX9yt5nQkzTIRfSmDAQvPbusgkz9OS26nrTgY=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-MLj1xREDTZCrWVsTZGifSUNFKKMLGDtF3xV9kIR3umQ=";
+      hash = "sha256-TR8pA3F36t3SHVnLwAMUSBl5/G5EOd2rEO7MCzjopCg=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-4fy778ogxyuN6irrAO9ZTHAMH9Va/QjF4PoHEZCBdFY=";
+      hash = "sha256-K3bPccJzf0KRKOjuGp0OkAPyltr4yNk8amZkWI7WIig=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.5.5";
+    version = "1.5.8";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix b/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix
index 971de48c2314..e5b8b7bb5dec 100644
--- a/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix
@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ufo5260987423";
     name = "magic-scheme";
-    version = "0.0.6";
-    hash = "sha256-ibEdsw/ulr+cagB90uALDbSsQV18dPULANCdnjPvhuI=";
+    version = "0.0.16";
+    hash = "sha256-ru7/AkbJi7Ogt/VZ6n2nDesvctv0UcyliEUKVWLp1/Q=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
index c0da6463f045..222c71a4af00 100644
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@@ -13,22 +13,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-is7nNav1inG96NoND/XcVQhltT2sbvHa7qkb+wMGAC0=";
+          hash = "sha256-41D15WSCK67DK1ArIOgbApndYYq6X0Br1cDajjkhHsE=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-hsuV25YRGatyfK7QEZkdxgc4hyyC6JEfzF2ilRd8hYI=";
+          hash = "sha256-gWBEMWsootSivCnPI0q0VqMvw3vaQUS+AYTrGd9mV20=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-hHrr3ni0dcSSBqbs+XRP6P9xiyWcMqDYUi1z0+WnJNk=";
+          hash = "sha256-Qs3+dRfHs3iZ+mS1uj6o4vPrMF66NgH/8Xmpyo6vTeE=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.35.1";
+      version = "0.35.4";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 0933f6921764..a5cdba78de1a 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -22,6 +22,7 @@
   alsa-lib,
   libpulseaudio,
   libcanberra-gtk3,
+  libdbusmenu-gtk3,
   libglvnd,
   libnotify,
   opensc,
@@ -113,6 +114,7 @@ let
             libva
             libgbm
             libnotify
+            libdbusmenu-gtk3
             libxscrnsaver
             cups
             pciutils
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8da609db205c..2a07f87093fe 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -544,11 +544,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-Xxg6/5co7/GPEgSQMnvaOJDhwUfKfPljpVJhNfhFgu8=",
+    "hash": "sha256-ra+A4JDlxfqZBuVT7GLHIUmB03yyNUS5N4TPbhAlKZo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v5.6.0",
+    "rev": "v5.7.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1256,13 +1256,13 @@
     "vendorHash": "sha256-XpXZqb6j6WdTFowdwNf3e8i9lg69tavzb2H65LyQJvE="
   },
   "splunk-terraform_signalfx": {
-    "hash": "sha256-KoPLEVzR/MtMTrufqvxrOuVsfjCUXQ9UMbqjosAy2oc=",
+    "hash": "sha256-TjJQdzxB7X7RbiBJnaCvAGJTtDwfeOxc7lApl7jjrA8=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.34.0",
+    "rev": "v9.35.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
+    "vendorHash": "sha256-jEqN6WvPXKxk9UHKZrzXo1+L6tHVV1Wb+E0O22LfMl0="
   },
   "spotinst_spotinst": {
     "hash": "sha256-Am9SpejteynDdFm2lcENxuYwADZIveNe4oFNoy/xh2E=",
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index a5a3a240e75f..b19fabc00c9e 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -100,8 +100,8 @@ rec {
   thunderbird-153 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "153.3.1esr";
-    sha512 = "791b4bd4d3e27d3ffe3bf832c54028f12322b11a2a37174d2ef33cb8b30186da546edec11600bb32fc4e737ed75872853984f3307e012c8885467fbe7ad70a54";
+    version = "153.4.0esr";
+    sha512 = "93c43a75010b2edd36c58d054cd2e15a879b9e62e21f419bd8c7f97b8f7f6f29e8aed9d445ab9ccebdc1825dbf0f5e82e6e316c5f817f877d64266a2f2dbf9ec";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-153";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
index db946836d538..dbc76cd68137 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "obs-teleport";
-  version = "0.7.7";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "fzwoch";
     repo = "obs-teleport";
     rev = version;
-    sha256 = "sha256-jwoD9qz7JDOIwPY6vammtQY9Igftu9UkI7PgsyJgQZ0=";
+    sha256 = "sha256-tGVtTVk20LqTi/dzgZUeXxTAWFh0YGho8Ch4CIfCVyM=";
   };
 
-  vendorHash = "sha256-5uxZr2jpzRKupDC9+H9+efiHZKTBbkyv5mQKWV+6uEo=";
+  vendorHash = "sha256-scc/ycMZyYhGrt9lpxVwKIGVpF8TNCtld86qHbewGEU=";
 
   buildInputs = [
     libjpeg
diff --git a/pkgs/by-name/as/astyle/package.nix b/pkgs/by-name/as/astyle/package.nix
index dbd26c3d3c81..0596b9013fa7 100644
--- a/pkgs/by-name/as/astyle/package.nix
+++ b/pkgs/by-name/as/astyle/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astyle";
-  version = "3.6.18";
+  version = "3.6.19";
 
   src = fetchurl {
     url = "mirror://sourceforge/astyle/astyle-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-1PxDPP6syVLeKVlhvIrp6rci4IWAuqbB6Oezmnovu0g=";
+    hash = "sha256-rl703fH4goi8yPbVMmZwf4CoH8xt7PTaX+XI5CCgqxw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index 408fc6f02273..d0539329fe7c 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   stdenvNoCC,
   nix-update-script,
@@ -15,12 +15,12 @@
 
 let
   pname = "autobrr";
-  version = "1.84.0";
+  version = "1.87.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-LogNcJO4Zasi0tareJzlNv/xPgN65e8HkdUZOC279PE=";
+    hash = "sha256-u0gcSgexI8Rw9Fsh6xcb0dDmCxbghAyXVIyUG6jtq9g=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
@@ -44,7 +44,7 @@ let
         ;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = "sha256-wTbdQ3Stp4Wp0a89Bb+2uwCo78xuAi8JMpjPk501wXw=";
+      hash = "sha256-GBe6c0sjj/gaLOrtGVmcjaQ5c7E9mhYvbLhRSViv7s8=";
     };
 
     postBuild = ''
@@ -56,14 +56,14 @@ let
     '';
   };
 in
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   inherit
     pname
     version
     src
     ;
 
-  vendorHash = "sha256-mf6luYjIelHYf0TtidY/S5wplIIUqUpadt8DvPq9154=";
+  vendorHash = "sha256-Mo+XAYe1bNVO89dDBoMsBnxcxhEgu/EdwqrA5RUjSrw=";
 
   preBuild = ''
     cp -r ${finalAttrs.passthru.autobrr-web}/* web/dist
diff --git a/pkgs/by-name/ba/babashka-unwrapped/package.nix b/pkgs/by-name/ba/babashka-unwrapped/package.nix
index 5b127dce018d..767735e1746e 100644
--- a/pkgs/by-name/ba/babashka-unwrapped/package.nix
+++ b/pkgs/by-name/ba/babashka-unwrapped/package.nix
@@ -10,11 +10,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "babashka-unwrapped";
-  version = "1.13.223";
+  version = "1.13.225";
 
   src = fetchurl {
     url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-DaDYD5pCV05/UwRre5xRxc2dAZJqkc1snKzEOTmM+Rs=";
+    sha256 = "sha256-jK10RKvEdP6R72Xqs3DdmbUtmCJG984iABIq5ikGiPk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix
index 4905f7e5dc59..a4fe4b3ad65a 100644
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-shear";
-  version = "1.13.4";
+  version = "1.14.0";
 
   src = fetchCrate {
     pname = "cargo-shear";
     version = finalAttrs.version;
-    hash = "sha256-bTTNiDWkbyjxFo59Hkeah23lQEGiuH5Xrm6z7SUNtoQ=";
+    hash = "sha256-4WZXton9oyI+c4mYtXwvT7HI5pxqv8lGmd9S2YwnOWM=";
   };
 
-  cargoHash = "sha256-Mhxrcc9ErTYIV+yuIROuMdhbxrFdZZ2yAAXK0WRWcRI=";
+  cargoHash = "sha256-I2VDiE+FtBKZHvU9TgS06CVO3ukQ2KGZMgZoHSZLCKQ=";
 
   env = {
     # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
diff --git a/pkgs/by-name/cf/cfr/package.nix b/pkgs/by-name/cf/cfr/package.nix
index 348c8f7a5949..589a73fa062f 100644
--- a/pkgs/by-name/cf/cfr/package.nix
+++ b/pkgs/by-name/cf/cfr/package.nix
@@ -1,39 +1,54 @@
 {
   lib,
-  stdenv,
+  fetchFromGitHub,
+  jre_headless,
   makeWrapper,
-  fetchurl,
-  jre,
+  maven,
+  jdk11,
 }:
-
-stdenv.mkDerivation (finalAttrs: {
+maven.buildMavenPackage (finalAttrs: {
   pname = "cfr";
   version = "0.152";
 
-  src = fetchurl {
-    url = "https://www.benf.org/other/cfr/cfr_${finalAttrs.version}.jar";
-    sha256 = "sha256-9obo897Td9e8h9IWqQ6elRLfQVbnWwbGVaFmSK6HZbI=";
+  src = fetchFromGitHub {
+    owner = "leibnitz27";
+    repo = "cfr";
+    tag = finalAttrs.version;
+    hash = "sha256-bT/qlMD2aNhW9i4DEYymSbfKqtE/m1m6h5UkbFIyj4E=";
   };
 
+  # Otherwise fails, because the .git folder is stripped
+  mvnParameters = "-Dmaven.gitcommitid.skip=true";
+
+  mvnJdk = jdk11;
+
+  mvnHash = "sha256-JvmOCMmZJIeIaYkGvhwRPGK/Q1LCHSVJFRF7WIBJFDg=";
+
   nativeBuildInputs = [ makeWrapper ];
 
-  buildCommand = ''
-    jar=$out/share/java/cfr_${finalAttrs.version}.jar
-    install -Dm444 $src $jar
-    makeWrapper ${jre}/bin/java $out/bin/cfr --add-flags "-jar $jar"
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/cfr
+    install -Dm644 target/cfr-${finalAttrs.version}.jar $out/share/cfr
+
+    makeWrapper ${lib.getExe jre_headless} $out/bin/cfr \
+      --add-flags "-jar $out/share/cfr/cfr-${finalAttrs.version}.jar"
+
+    runHook postInstall
   '';
 
   meta = {
     description = "Another java decompiler";
-    mainProgram = "cfr";
     longDescription = ''
       CFR will decompile modern Java features - Java 8 lambdas (pre and post
       Java beta 103 changes), Java 7 String switches etc, but is written
       entirely in Java 6.
     '';
-    homepage = "http://www.benf.org/other/cfr/";
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    homepage = "https://github.com/leibnitz27/cfr";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ letgamer ];
+    mainProgram = "cfr";
   };
 })
diff --git a/pkgs/by-name/cl/cliproxyapi/package.nix b/pkgs/by-name/cl/cliproxyapi/package.nix
index 9f77e1d22ca6..ddcdaf55c3d9 100644
--- a/pkgs/by-name/cl/cliproxyapi/package.nix
+++ b/pkgs/by-name/cl/cliproxyapi/package.nix
@@ -11,13 +11,13 @@ buildGoModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "cliproxyapi";
-  version = "8.0.4";
+  version = "8.0.8";
 
   src = fetchFromGitHub {
     owner = "router-for-me";
     repo = "CLIProxyAPI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CQ4kjO8XaGdVGFkO9MvbPMO9PrO3sTKCN706mbzOj9g=";
+    hash = "sha256-FfkxVBzw3BCVUku4+U6ICC9fgmTOV7DAKUr54Ln90HM=";
   };
 
   vendorHash = "sha256-r3yWkdMcM40G9jV7MxW/qNv3E9WrHavFilW24quEf+8=";
diff --git a/pkgs/by-name/co/codechecker/package.nix b/pkgs/by-name/co/codechecker/package.nix
index 0f2fb94eab3d..f4c5a44d4d8b 100644
--- a/pkgs/by-name/co/codechecker/package.nix
+++ b/pkgs/by-name/co/codechecker/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchPypi,
   makeWrapper,
-  python3Packages,
+  python313Packages,
   libclang,
   clang-tools,
   cppcheck,
@@ -14,7 +14,9 @@
   withGcc ? false,
   withInfer ? false,
 }:
-python3Packages.buildPythonApplication (finalAttrs: {
+# Starting the codechecker server currently breaks with Python 3.14
+# https://github.com/Ericsson/codechecker/issues/4773
+python313Packages.buildPythonApplication (finalAttrs: {
   pname = "codechecker";
   version = "6.28.0";
   pyproject = true;
@@ -26,11 +28,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-wxV+/hzsk7RrzWTXNz5HyweYdFFI1upNS508QRPCefo=";
   };
 
-  build-system = with python3Packages; [
+  build-system = with python313Packages; [
     setuptools
   ];
 
-  dependencies = with python3Packages; [
+  dependencies = with python313Packages; [
     alembic
     argcomplete
     authlib
@@ -51,7 +53,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   pythonRelaxDeps = true;
-  nativeBuildInputs = with python3Packages; [
+  nativeBuildInputs = with python313Packages; [
     makeWrapper
     pythonRelaxDepsHook
   ];
diff --git a/pkgs/by-name/co/containerd/package.nix b/pkgs/by-name/co/containerd/package.nix
index 59fd03ee39d4..6ad0e422168d 100644
--- a/pkgs/by-name/co/containerd/package.nix
+++ b/pkgs/by-name/co/containerd/package.nix
@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.4.0";
+  version = "2.4.1";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-Oj2issWNh6kH4C3hVjSliThDiIKHgVMXIiFgkvqvxm4=";
+    hash = "sha256-wp4cP3kYm1k9ZPj9B37dQx8//1Ept8aIfZseob9Nyv0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/du/dua/package.nix b/pkgs/by-name/du/dua/package.nix
index d2e09e88c2d1..5f21ca5c0e11 100644
--- a/pkgs/by-name/du/dua/package.nix
+++ b/pkgs/by-name/du/dua/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dua";
-  version = "2.45.0";
+  version = "2.45.1";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-++7lCGXeam6C1FhULNpaj1Z4sZSYiu9GRZzEruiE4ho=";
+    hash = "sha256-lY7sPncWvqltAR3+VtNfQEfExSGyGMMyu2e6M9MRwF0=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-yw12S2Lvk7h7CJB5Sq/tS5qEZG+Gyft8OwPSnP0/35c=";
+  cargoHash = "sha256-S9jfM8Bb75LGzS6TB5K0sZTuVSE7cfTh9ahEXV0qzdQ=";
 
   checkFlags = [
     # Skip interactive tests
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 5b1fa244b01f..9e13a5ccf792 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fabric-ai";
-  version = "1.4.478";
+  version = "1.4.497";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E4FCKDSUWyEhmDj8jNoqvMP2Q27zpyCt/ULMXOd1CiI=";
+    hash = "sha256-IkJu9PzAhCZZj97XPYwG8tZr6Hkg7nHixFEn5gUYoHU=";
   };
 
-  vendorHash = "sha256-dVJdsYxUNOcNwSR4UR58jK5tWv20OCVVkQ3wssqVW08=";
+  vendorHash = "sha256-Y/6RURwsm2V4ssKC74izxwLK/GyI+yrIHeXHTrjjrA8=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fe/feather/package.nix b/pkgs/by-name/fe/feather/package.nix
index b9470d2be3c7..bc5dec932782 100644
--- a/pkgs/by-name/fe/feather/package.nix
+++ b/pkgs/by-name/fe/feather/package.nix
@@ -1,9 +1,9 @@
 {
+  abseil-cpp,
   bc-ur,
-  boost186,
+  boost,
   cmake,
   fetchFromGitHub,
-  fetchpatch2,
   hidapi,
   lib,
   libsodium,
@@ -21,7 +21,9 @@
   unbound,
   zxing-cpp,
 }:
-
+let
+  protobuf' = protobuf.override { abseil-cpp = abseil-cpp.override { cxxStandard = "17"; }; };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feather";
   version = "2.9.1";
@@ -43,12 +45,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     bc-ur
-    boost186
+    boost
     hidapi
     libsodium
     libusb1
     openssl
-    protobuf
+    protobuf'
     qrencode
     unbound
     zxing-cpp
@@ -63,8 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]);
 
   cmakeFlags = [
-    "-DProtobuf_INCLUDE_DIR=${lib.getDev protobuf}/include"
-    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe protobuf}"
     "-DReadline_INCLUDE_DIR=${lib.getDev readline}/include/readline"
     "-DReadline_LIBRARY=${lib.getLib readline}/lib/libreadline.so"
     "-DReadline_ROOT_DIR=${lib.getDev readline}"
diff --git a/pkgs/by-name/fe/feishu-cli/package.nix b/pkgs/by-name/fe/feishu-cli/package.nix
index 8c764e9818bb..a696c8eca37c 100644
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "feishu-cli";
-  version = "1.40.0";
+  version = "1.41.0";
 
   src = fetchFromGitHub {
     owner = "riba2534";
     repo = "feishu-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xlhVGRgxxmkOZqG7bQk7vGJZ7lGpwIFj9DGs0fV+ax8=";
+    hash = "sha256-lsWe2uUsm2W42huUFxcZ8fI/65hI6LyKRSVRD9QKaAc=";
   };
 
   vendorHash = "sha256-cbhq0GfNHH2jq/P57twnvS+WjkHmNQDzScrcMup3CPc=";
diff --git a/pkgs/by-name/go/go-containerregistry/package.nix b/pkgs/by-name/go/go-containerregistry/package.nix
index 047a8f176220..813ea5138aa8 100644
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -15,13 +15,13 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "go-containerregistry";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-containerregistry";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-RA+LfxVI5vVspCQTlLSgFxxfp9JnGCFBQlY6A9DSkH4=";
+    sha256 = "sha256-OxywOhruteTqkCVhTvWuxMqx7HQfPoSZM+mEXVihUl4=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/go/go-ethereum/package.nix b/pkgs/by-name/go/go-ethereum/package.nix
index f3a004a8cc51..e7c42d4db9cc 100644
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -6,26 +6,23 @@
 }:
 
 let
-  # A list of binaries to put into separate outputs
-  bins = [
-    "geth"
-    "clef"
-  ];
+  # Place geth in a separate output from the other utilities in subPackages, to reduce closure size of the module.
+  bins = [ "geth" ];
 
 in
 buildGoModule (finalAttrs: {
   pname = "go-ethereum";
-  version = "1.17.3";
+  version = "1.17.7";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BLcpUbE2lkXkpzYWSIVaLNXlFTvSuXw9Vm0iTtrqOKQ=";
+    hash = "sha256-FaVO1p7eZsXQN1Ikq2CcgiugHkSyETGagZLw6hIF7to=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-AOdGqr738EgwbZhHHP3ctQYUilgyOc/tIJyaI0H3oeM=";
+  vendorHash = "sha256-AsKicppcvr7xZ2sZ1pvsu8inXBRM1W3lFMlWAvV/EL0=";
 
   doCheck = false;
 
@@ -43,7 +40,6 @@ buildGoModule (finalAttrs: {
     "cmd/abidump"
     "cmd/abigen"
     "cmd/blsync"
-    "cmd/clef"
     "cmd/devp2p"
     "cmd/era"
     "cmd/ethkey"
diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index 12f856c62265..1f145307c2aa 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.7.4";
+  version = "26.7.5";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-Rk9ofYspK2L68tam9S+P198rh7ojZCDBXDYgKx1cSoo=";
+    hash = "sha256-R0W9ehKjs/1DGF/ZwTb2Mo5ZBo4ceCQqcDM0J9+jBNU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lagrange/package.nix b/pkgs/by-name/la/lagrange/package.nix
index 7acf54903924..427372d64410 100644
--- a/pkgs/by-name/la/lagrange/package.nix
+++ b/pkgs/by-name/la/lagrange/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.21.1";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n/zM3+10Ns2RDhOIqzuanvotsCHfoC1CqLQug0xJF9E=";
+    hash = "sha256-SxAZrbtEc6mKGwNvpEqVXCpvtezvCs+l1AGH88TpPIY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/le/lemon-graph/fix_path_allocator.patch b/pkgs/by-name/le/lemon-graph/fix_path_allocator.patch
new file mode 100644
index 000000000000..fef88eae5d14
--- /dev/null
+++ b/pkgs/by-name/le/lemon-graph/fix_path_allocator.patch
@@ -0,0 +1,68 @@
+diff --git a/lemon/path.h b/lemon/path.h
+--- a/lemon/path.h
++++ b/lemon/path.h
+@@ -26,6 +26,7 @@
+ 
+ #include <vector>
+ #include <algorithm>
++#include <memory>
+ 
+ #include <lemon/error.h>
+ #include <lemon/core.h>
+@@ -448,7 +449,10 @@ namespace lemon {
+ 
+     Node *first, *last;
+ 
+-    std::allocator<Node> alloc;
++    typedef std::allocator<Node> Allocator;
++    typedef std::allocator_traits<Allocator> AllocatorTraits;
++
++    Allocator alloc;
+ 
+   public:
+ 
+@@ -582,7 +586,7 @@ namespace lemon {
+     void clear() {
+       while (first != 0) {
+         last = first->next;
+-        alloc.destroy(first);
++        AllocatorTraits::destroy(alloc, first);
+         alloc.deallocate(first, 1);
+         first = last;
+       }
+@@ -596,7 +600,7 @@ namespace lemon {
+     /// \brief Add a new arc before the current path
+     void addFront(const Arc& arc) {
+       Node *node = alloc.allocate(1);
+-      alloc.construct(node, Node());
++      AllocatorTraits::construct(alloc, node, Node());
+       node->prev = 0;
+       node->next = first;
+       node->arc = arc;
+@@ -617,7 +621,7 @@ namespace lemon {
+       } else {
+         last = 0;
+       }
+-      alloc.destroy(node);
++      AllocatorTraits::destroy(alloc, node);
+       alloc.deallocate(node, 1);
+     }
+ 
+@@ -629,7 +633,7 @@ namespace lemon {
+     /// \brief Add a new arc behind the current path.
+     void addBack(const Arc& arc) {
+       Node *node = alloc.allocate(1);
+-      alloc.construct(node, Node());
++      AllocatorTraits::construct(alloc, node, Node());
+       node->next = 0;
+       node->prev = last;
+       node->arc = arc;
+@@ -650,7 +654,7 @@ namespace lemon {
+       } else {
+         first = 0;
+       }
+-      alloc.destroy(node);
++      AllocatorTraits::destroy(alloc, node);
+       alloc.deallocate(node, 1);
+     }
+ 
diff --git a/pkgs/by-name/le/lemon-graph/package.nix b/pkgs/by-name/le/lemon-graph/package.nix
index 0490bbc5187e..58e08d50c58d 100644
--- a/pkgs/by-name/le/lemon-graph/package.nix
+++ b/pkgs/by-name/le/lemon-graph/package.nix
@@ -30,6 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # fix C++20 compatibility. vendored from https://github.com/The-OpenROAD-Project/lemon-graph/commit/f871b10396270cfd09ffddc4b6ead07722e9c232
     ./update_cxx20.patch
+
+    # fix C++20 compatibility of ListPath, submitted to OpenROAD's fork in https://github.com/The-OpenROAD-Project/lemon-graph/pull/5
+    ./fix_path_allocator.patch
   ];
 
   meta = {
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 53235dd11323..d227882fa54b 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "155.0.1-1";
+  version = "156.0.1-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-jbkbQ22263oWt8WBvsIsFGySwOZ6U2cXuguMrAUgbvE=";
-        aarch64-linux = "sha256-zjhFSpe4baNl7vXxRkCm7upHXJ/RIwuHg5cUV1GkYSA=";
+        x86_64-linux = "sha256-2D6GwlqhiHdz7i6+9lWWBHZ3XHL/w9/ffCeZzYoOpLc=";
+        aarch64-linux = "sha256-v+w2zgv+HtTii3ifufOcYtaGFOE3WD/dDkTuaZmmOPk=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };
diff --git a/pkgs/by-name/mi/mimic/package.nix b/pkgs/by-name/mi/mimic/package.nix
index 5b158b89ee77..943961ba334f 100644
--- a/pkgs/by-name/mi/mimic/package.nix
+++ b/pkgs/by-name/mi/mimic/package.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-Wno-error=free-nonheap-object"
     # Fix build w/ glibc-2.44
     "-Wno-error=discarded-qualifiers"
+    # Needed with GCC 16
+    "-Wno-error=unused-but-set-variable"
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ni/nixl/package.nix b/pkgs/by-name/ni/nixl/package.nix
index c750082f56ab..6f9c40c5350c 100644
--- a/pkgs/by-name/ni/nixl/package.nix
+++ b/pkgs/by-name/ni/nixl/package.nix
@@ -36,7 +36,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "nixl";
-  version = "1.4.1";
+  version = "1.5.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,7 +45,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ai-dynamo";
     repo = "nixl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8cvvCOyKLB62VhjlXup9a9yqvMiXanax2DRBkjEUBVI=";
+    hash = "sha256-ZsYchzywmsxcZGv44v0tk3d5JJjYrpkYzL59D5jMME0=";
   };
 
   postPatch =
@@ -58,15 +58,9 @@ effectiveStdenv.mkDerivation (finalAttrs: {
         --replace-fail 'm.ReaderLock()' 'm.lock_shared()' \
         --replace-fail 'm.ReaderUnlock()' 'm.unlock_shared()'
     ''
-    # Fix asio::io_context::post() removed in asio 1.36+
-    # Use the free function asio::post(io_context, handler) instead
-    + ''
-      substituteInPlace src/plugins/ucx/ucx_backend.cpp \
-        --replace-fail 'io_->post(' 'asio::post(*io_, '
-    ''
     # Fix GDS plugin: Nix uses lib/ not lib64/
     + ''
-      substituteInPlace src/plugins/cuda_gds/meson.build src/plugins/gds_mt/meson.build \
+      substituteInPlace src/plugins/cuda_gds/meson.build \
         --replace-fail "'/lib64'" "'/lib'"
     '';
 
diff --git a/pkgs/by-name/nm/nmapautomator/package.nix b/pkgs/by-name/nm/nmapautomator/package.nix
new file mode 100644
index 000000000000..ab8c6b18519f
--- /dev/null
+++ b/pkgs/by-name/nm/nmapautomator/package.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  dirb,
+  metasploit,
+  nix-update-script,
+  withFullDeps ? false,
+
+  # required dependencies
+  nmap,
+  coreutils,
+  gawk,
+  gnugrep,
+  gnused,
+  findutils,
+
+  # optional dependencies
+  smtp-user-enum,
+  dnsrecon,
+  bind,
+  sslscan,
+  nikto,
+  ffuf,
+  joomscan,
+  smbmap,
+  enum4linux,
+  wpscan,
+  samba,
+  openldap,
+  net-snmp,
+  snmpcheck,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "nmapautomator";
+  version = "0-unstable-2021-04-10";
+
+  src = fetchFromGitHub {
+    owner = "21y4d";
+    repo = "nmapAutomator";
+    rev = "c5e15de8429c78aa5923010145dfac0996aba9e1";
+    hash = "sha256-HwBvhFvGVY5q0C62XjNalQUaX7y24B1Vt8UqAIHp8/g=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  runtimeDeps = [
+    nmap
+    coreutils
+    gawk
+    gnugrep
+    gnused
+    findutils
+  ]
+  ++ lib.optionals withFullDeps [
+    smtp-user-enum
+    dnsrecon
+    bind.dnsutils
+    bind.host
+    sslscan
+    nikto
+    ffuf
+    joomscan
+    smbmap
+    enum4linux
+    wpscan
+    samba
+    openldap
+    net-snmp
+    snmpcheck
+  ];
+  # TODO: Package and add odat and droopescan
+
+  postPatch = ''
+    substituteInPlace nmapAutomator.sh \
+      --replace-fail '/usr/share/nmap/' '${nmap}/share/nmap/' \
+      --replace-fail '/usr/share/wordlists/dirb/' '${dirb}/share/dirb/wordlists/' \
+      --replace-fail '/usr/share/wordlists/metasploit/' '${metasploit.src}/data/wordlists/'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 555 nmapAutomator.sh $out/bin/nmapAutomator
+    wrapProgram $out/bin/nmapAutomator \
+      --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=master" ]; };
+
+  meta = {
+    description = "Nmap script to automate the process of enumeration & recon";
+    homepage = "https://github.com/21y4d/nmapAutomator";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ letgamer ];
+    mainProgram = "nmapAutomator";
+  };
+})
diff --git a/pkgs/by-name/ol/ollaya/package.nix b/pkgs/by-name/ol/ollaya/package.nix
index 15afe5bc07c6..9f6a5c915403 100644
--- a/pkgs/by-name/ol/ollaya/package.nix
+++ b/pkgs/by-name/ol/ollaya/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ollaya";
-  version = "0.7.5";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "ollaya-dev";
     repo = "ollaya";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T4uY31ONSPsHdTtE6u89UCKDGIVX/cdyWTt+kEB0/cM=";
+    hash = "sha256-DkT5MsneKE0n9AkKx+8D/QEGbaITTljzYImisG/yfwg=";
   };
 
-  cargoHash = "sha256-IFFDMauewq3JOerPOEZy9a/HCBvYT+VbKOLXl+TPqfU=";
+  cargoHash = "sha256-h6VNbUkMPOuzk4TH3MK1qAPIgqCh0CLTTVjo1qy9dD8=";
 
   buildInputs = [ onnxruntime ];
 
diff --git a/pkgs/by-name/op/openbgpd/package.nix b/pkgs/by-name/op/openbgpd/package.nix
index 37d71660ee1e..80e1cc52f619 100644
--- a/pkgs/by-name/op/openbgpd/package.nix
+++ b/pkgs/by-name/op/openbgpd/package.nix
@@ -9,11 +9,11 @@
 # that the entire compilation is more tested using clang from an upstream POV.
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "openbgpd";
-  version = "9.2";
+  version = "9.3";
 
   src = fetchurl {
     url = "mirror://openbsd/OpenBGPD/openbgpd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-TiGrX0eO/ImGQJZqkRXZtr5C+r4RTqYA3Jwiz04PA6o=";
+    hash = "sha256-tDwXLtw4D4cXHvHNE3tPzhy47sZQtUtk8YmhrlLSHHI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pi/pijul/package.nix b/pkgs/by-name/pi/pijul/package.nix
index af100842a29a..364bafd1d51f 100644
--- a/pkgs/by-name/pi/pijul/package.nix
+++ b/pkgs/by-name/pi/pijul/package.nix
@@ -9,6 +9,7 @@
   libsodium,
   openssl,
   xxhash,
+  nix-update-script,
   gitImportSupport ? true,
   libgit2 ? null,
 }:
@@ -17,14 +18,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "pijul";
-  version = "1.0.0-beta.23";
+  version = "1.0.0-beta.24";
 
   src = fetchCrate {
     inherit (finalAttrs) version pname;
-    hash = "sha256-+qbJniBWp+cOmrYyhEvGapPR5jV92s4oF1giujkx1mM=";
+    hash = "sha256-6rw9dizgwcIjsXd07H0rpb/AGd+9HBiMn5/XWhMutlc=";
   };
 
-  cargoHash = "sha256-RO9fN4jS3g+qfatjtlWI8Oko7X91PNyf723Ipkg4BX0=";
+  cargoHash = "sha256-pIeiMCcAa713Imsk+8FbOof03M+wyP85n/SAtKECKHc=";
 
   # Tests require a TTY, which the Nix sandbox does not provide.
   doCheck = false;
@@ -49,6 +50,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --zsh <($out/bin/pijul completion zsh)
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=unstable" ];
+  };
+
   meta = {
     description = "Distributed version control system";
     homepage = "https://pijul.org";
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index 27af539f8deb..afe903c242e2 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,11 +16,11 @@
 
 tcl.mkTclDerivation (finalAttrs: {
   pname = "remind";
-  version = "06.03.04";
+  version = "06.03.05";
 
   src = fetchzip {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${finalAttrs.version}.tar.gz";
-    hash = "sha256-EIcnNTzBUreqAZK8pEUkwU9l+J07d24pvzFlOJ84Q1o=";
+    hash = "sha256-4TESOZrPqa2LahojSy27qgIzkuS/tr8ElAS7nw/t5Fo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 1368e5416742..669d75ffaf6e 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "44.104.0";
+  version = "44.126.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-SoSrjApNDeCqKCmoP87jkV8FFsEkDlnXc7W/PKh+jqE=";
+    hash = "sha256-Y8iuorK3KClnOfMUybQYyYUqoYQSV5dn/dFJ6aQ44F0=";
   };
 
   postPatch = ''
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-ywwJgQEqIhxR/VFOd4bsUs7aQwMES5C8nzVx0uA965A=";
+    hash = "sha256-ty0lMoQOtfUWy1mXN9Vk0E59qaqQV4RrHEI2Lus9tnk=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/sa/salt/package.nix b/pkgs/by-name/sa/salt/package.nix
index df10c1a43282..946b1cef6896 100644
--- a/pkgs/by-name/sa/salt/package.nix
+++ b/pkgs/by-name/sa/salt/package.nix
@@ -11,12 +11,12 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "salt";
-  version = "3008.2";
+  version = "3008.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-RKHiBqlVv1eq/74/HftfRHbJRC1k86EDznrAqmi/qQc=";
+    hash = "sha256-S/qZXs3hSRkWvJ/Qq+vzjTnqyiTB6Z4pxQRrl7h1TzA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index 3f3ac2be4e4c..339b7a4a667a 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -49,7 +49,7 @@ in
 
 buildNpmPackage (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.8";
+  version = "1.26.9";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -58,7 +58,7 @@ buildNpmPackage (finalAttrs: {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-hAUc8T+xHRDwP0mj8wyd0+pNR5B5QEj4PXZVookxJeE=";
+    hash = "sha256-NhRe7PHdOiw4W5JH+T2dJiACQXknwGUv00Wq7zBERlU=";
   };
 
   npmDeps = null;
@@ -66,7 +66,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-VTeLrZz6nVfVmVJHMwkGTfVYl7Qs2ph3uHtOE8qoq/Q=";
+    hash = "sha256-MrVdpeNhx9NzyTK4srREy8miku/0OHJjr3jeACuXLE0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stremio-linux-shell/package.nix b/pkgs/by-name/st/stremio-linux-shell/package.nix
index 717779fa16ec..c278d0d01a8a 100644
--- a/pkgs/by-name/st/stremio-linux-shell/package.nix
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -6,6 +6,7 @@
   nix-update-script,
 
   # nativeBuildInputs
+  installShellFiles,
   pkg-config,
   wrapGAppsHook4,
 
@@ -26,7 +27,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stremio-linux-shell";
-  version = "1.2.0";
+  version = "1.2.1";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -35,10 +36,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Stremio";
     repo = "stremio-linux-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JFG+sUuK+l8Ik00vHPiXJwan0rmMBiY85DnvudYKCsw=";
+    hash = "sha256-lViVembyM9W/GY4v4RwBVBg5AKTG98K25L8FVjouWYs=";
   };
 
-  cargoHash = "sha256-FnQ2FN9NtL/YyRmLlyGQApjzV/4uS8OnnY8kbTWTGe8=";
+  cargoHash = "sha256-dnGE//4SUO5xwudMqdE98w/teirTj7Q6xLycWH05WJ8=";
 
   patches = [
     ./out-path.patch
@@ -50,6 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   nativeBuildInputs = [
+    installShellFiles
     pkg-config
     wrapGAppsHook4
   ];
@@ -74,6 +76,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     install -Dm755 data/stremio.sh $out/bin/stremio
     install -Dm644 LICENSE $out/share/licenses/stremio/LICENSE
 
+    installManPage data/stremio.1
+
     mv $out/bin/stremio-linux-shell $out/libexec/stremio/stremio
   '';
 
@@ -87,7 +91,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ addDriverRunpath.driverLink ]}" \
       --prefix PATH : "${lib.makeBinPath [ nodejs ]}" \
       --prefix ANV_DEBUG : "video-decode,video-encode" \
-      --prefix LC_NUMERIC : "C" \
       --prefix SERVER_PATH : "$out/libexec/stremio/server.js"
   '';
 
diff --git a/pkgs/by-name/su/subxt/package.nix b/pkgs/by-name/su/subxt/package.nix
index c465d02ff8b2..4dcfcd047f27 100644
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "subxt";
-  version = "0.51.0";
+  version = "0.51.1";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "subxt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1ErnM5UjD5PQIyGE6tUa1vQZmwAmdtUjmITBqSqAbRE=";
+    hash = "sha256-/bM/GhLVpaWemrm1gCDzsvg0jU4cKvH57PFXwLHbddg=";
   };
 
-  cargoHash = "sha256-Uar3JeKOX84y2EHzqG5JVx2rhaluMHA5FKdKK7wI4mg=";
+  cargoHash = "sha256-2CuEDDdnrs4zN/uvhRhbUvuVHgBJqIhl12hLBUXixgg=";
 
   # Only build the command line client
   cargoBuildFlags = [
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 99d77cfef518..080163e586b9 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -19,16 +19,16 @@ let
 in
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.22.0";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-FcAYtEX6SjXeJfxwCq9uSD2dOJt+WkBTQnP+SmSy5bY=";
+    hash = "sha256-m6Dvy+nVzwhjag89hrn6MOu1rRhVuFch/hYdKDBaP+w=";
   };
 
-  npmDepsHash = "sha256-t5Mz3X/VnMmEuy/dGJC17/Wk8WwLdmF0rVQ445T5YP4=";
+  npmDepsHash = "sha256-MHGi5Vs8N+BKAu8hJtJG8RQuIcMh59ucJt2XR1HBvkc=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/tether/package.nix b/pkgs/by-name/te/tether/package.nix
index 30c6f05e9bd6..ba9cfb415d13 100644
--- a/pkgs/by-name/te/tether/package.nix
+++ b/pkgs/by-name/te/tether/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tether";
-  version = "0.2.34";
+  version = "0.2.35";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "zackb";
     repo = "tether";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j75CGrGtoLYTJXsZ/dgBQU1x3Avq2SdJVNvBx9ycQ3w=";
+    hash = "sha256-s9bjjSGTuQ7xevAaSZ3y3/V/UQmhsFnqhEneLFCKSy4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 2036e1dd8ed0..1c3afe0851e3 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "topgrade";
-  version = "17.12.0";
+  version = "17.12.2";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7K/iuXx78ATBhOAHSHQjkHRuBxxPeF4fWcEYKHb9DQ8=";
+    hash = "sha256-O83PlfG0nb0kqWrEL7zZ8HDYnCcxpxGEYLZr8Rg56CU=";
   };
 
-  cargoHash = "sha256-mEH4+0Crhd12LyJeCFKcnciiEJ2mBllaGOUiqUrYKvw=";
+  cargoHash = "sha256-MCFkV7lnSLmNaurj3SkyQEfsuqEZ9ldHpV3Eh0TYHIk=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/va/vale/styles.nix b/pkgs/by-name/va/vale/styles.nix
index 62c14a920cb2..5e2d0966bf3b 100644
--- a/pkgs/by-name/va/vale/styles.nix
+++ b/pkgs/by-name/va/vale/styles.nix
@@ -142,12 +142,12 @@ in
 
   redhat = buildStyle rec {
     name = "RedHat";
-    version = "678";
+    version = "680";
     src = fetchFromGitHub {
       owner = "redhat-documentation";
       repo = "vale-at-red-hat";
       rev = "v${version}";
-      hash = "sha256-dz99EAuzlECsJEt62Ej7BEjDrRbgwztG7HONvPu6LEE=";
+      hash = "sha256-1n/hKmNRxSpKFNBSnXdtcgxzu4A+ZF4cIP+6qCVewYo=";
     };
     stylePath = ".vale/styles/RedHat";
     meta = {
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 0711fc9470f4..408f4f39dbc4 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -8,20 +8,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasm-tools";
-  version = "1.258.0";
+  version = "1.260.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zb7togDfA+XvaPJqYKaekP7bGrsJ7A0zA2opGw556bM=";
+    hash = "sha256-yn8YTJXhpdzxPKv8ZELosky1BHzPjSxXd+jcxkJ3MEU=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-EKLABuh+94F8x/igXt5pBJoetGH9MIetjZlPmTlPZvg=";
+  cargoHash = "sha256-IJtoerutDHew59XR4XHv2Vxfrbvj9wdd/DNx5yp4Vo8=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/zo/zookeeper/package.nix b/pkgs/by-name/zo/zookeeper/package.nix
index e90cd30c6dde..bfd9dff4cc9c 100644
--- a/pkgs/by-name/zo/zookeeper/package.nix
+++ b/pkgs/by-name/zo/zookeeper/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   jdk11_headless,
+  jdk17_headless,
   makeWrapper,
   nixosTests,
   bash,
@@ -11,7 +12,9 @@
 let
   # Latest supported LTS JDK for Zookeeper 3.9:
   # https://zookeeper.apache.org/doc/r3.9.5/zookeeperAdmin.html#sc_requiredSoftware
-  jre = jdk11_headless;
+  # JDK 11 has no riscv64 port.
+  jre =
+    if lib.meta.availableOn stdenv.hostPlatform jdk11_headless then jdk11_headless else jdk17_headless;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zookeeper";
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 681421ef68de..696b04885d58 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -33,14 +33,14 @@ let
   nodejs = nodejs_22;
 
   pname = "zotero";
-  version = "10.0.2";
+  version = "10.0.4";
 
   src = fetchFromGitHub {
     owner = "zotero";
     repo = "zotero";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-V0dYKFWr1ZjYNEWufslW/NqfjPZOb8W1pECz33PcCEQ=";
+    hash = "sha256-vevcTBWo4o2K7ibg+FOetx07EyH3k1V2I43UF2tQrRU=";
   };
 
   pdf-js = buildNpmPackage {
diff --git a/pkgs/by-name/zs/zsh-forgit/package.nix b/pkgs/by-name/zs/zsh-forgit/package.nix
index 4f83ab7ffbbb..4316ffa898eb 100644
--- a/pkgs/by-name/zs/zsh-forgit/package.nix
+++ b/pkgs/by-name/zs/zsh-forgit/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zsh-forgit";
-  version = "26.09.1";
+  version = "26.10.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     tag = finalAttrs.version;
-    hash = "sha256-02w+BGrRDEFWLtH6tniiTgs+FHmghiHn9FMxO+U4wrI=";
+    hash = "sha256-Kno14XqXwtG0zWVjrikoXf7eIXo3pj7YbSoQOYUcAI4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/interpreters/python/cpython/docs/3.14-html.nix b/pkgs/development/interpreters/python/cpython/docs/3.14-html.nix
index 3791213f40a1..9fd38c1dbb5f 100644
--- a/pkgs/development/interpreters/python/cpython/docs/3.14-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.14-html.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation {
   pname = "python314-docs-html";
-  version = "3.14.7";
+  version = "3.14.8";
 
   src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/3.14.7/python-3.14.7-docs-html.tar.bz2";
-    sha256 = "sha256-1IS3hOw1xXdsX/VfgfqYS1JRo4tTKyS7AOQxSL1z/+k=";
+    url = "https://www.python.org/ftp/python/doc/3.14.8/python-3.14.8-docs-html.tar.bz2";
+    sha256 = "sha256-+6/XHOClP7P9hMtWq2YOgTh6iGvT+tqJhkekN7lCxT0=";
   };
   installPhase = ''
     mkdir -p $out/share/doc/python314
diff --git a/pkgs/development/interpreters/python/cpython/docs/3.14-texinfo.nix b/pkgs/development/interpreters/python/cpython/docs/3.14-texinfo.nix
index 44c1e6087085..5650e9abf695 100644
--- a/pkgs/development/interpreters/python/cpython/docs/3.14-texinfo.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.14-texinfo.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation {
   pname = "python314-docs-texinfo";
-  version = "3.14.7";
+  version = "3.14.8";
 
   src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/3.14.7/python-3.14.7-docs-texinfo.tar.bz2";
-    sha256 = "sha256-FezukFw4rQTPbc8CUB1Afn3VgEDCvgaZAUGp+wv7AmI=";
+    url = "https://www.python.org/ftp/python/doc/3.14.8/python-3.14.8-docs-texinfo.tar.bz2";
+    sha256 = "sha256-xSzL8/kZRFhsaqpFDAtI5G6cGEuB8Q1tqeuUtVRiGPY=";
   };
   installPhase = ''
     mkdir -p $out/share/info
diff --git a/pkgs/development/interpreters/python/cpython/docs/3.14-text.nix b/pkgs/development/interpreters/python/cpython/docs/3.14-text.nix
index b5496fb67648..21b857a816d6 100644
--- a/pkgs/development/interpreters/python/cpython/docs/3.14-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.14-text.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation {
   pname = "python314-docs-text";
-  version = "3.14.7";
+  version = "3.14.8";
 
   src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/3.14.7/python-3.14.7-docs-text.tar.bz2";
-    sha256 = "sha256-CTat/lWLaXZ/50nMy/mddBxMG8CS13g6pGW2V0jRMoo=";
+    url = "https://www.python.org/ftp/python/doc/3.14.8/python-3.14.8-docs-text.tar.bz2";
+    sha256 = "sha256-gZe6uz50Mb/eCpy3lnNZb38jArG4P6B3taEtLsjRDr8=";
   };
   installPhase = ''
     mkdir -p $out/share/doc/python314
diff --git a/pkgs/development/ocaml-modules/bytesrw/default.nix b/pkgs/development/ocaml-modules/bytesrw/default.nix
index 7fedfe7b6ef4..a5dacbd885bf 100644
--- a/pkgs/development/ocaml-modules/bytesrw/default.nix
+++ b/pkgs/development/ocaml-modules/bytesrw/default.nix
@@ -21,13 +21,13 @@
 
 buildTopkgPackage rec {
   pname = "bytesrw";
-  version = "0.4.0";
+  version = "0.4.1";
 
   minimalOCamlVersion = "4.14.0";
 
   src = fetchzip {
     url = "https://erratique.ch/software/bytesrw/releases/bytesrw-${version}.tbz";
-    hash = "sha256-3ApJ0JSJulGUIA9FN/Q7gkRI5h/tC5g/l+w/J0lsLG8=";
+    hash = "sha256-gdtrLILtbKJCu9ENUG9BTNTAUg4/JA7YvHnIWACNwds=";
   };
 
   buildInputs =
diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
index 1d463ebf3f60..b7834b42f58c 100644
--- a/pkgs/development/python-modules/apache-tvm-ffi/default.nix
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-tvm-ffi";
-  version = "0.1.14-post0";
+  version = "0.1.14-post1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
     repo = "tvm-ffi";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-hIbVt5rPlCTT6BuIXlaEj8Ln6f27NlmtWqEWwx9AvnA=";
+    hash = "sha256-HoyzO0koOBH7ZVb29Mhxjx8NPHxRfOHccvjNR6AHmSg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/flash-attn-4/default.nix b/pkgs/development/python-modules/flash-attn-4/default.nix
index f6137d1ff134..04dd947968da 100644
--- a/pkgs/development/python-modules/flash-attn-4/default.nix
+++ b/pkgs/development/python-modules/flash-attn-4/default.nix
@@ -21,7 +21,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "flash-attn-4";
-  version = "4.0.0.beta31";
+  version = "4.0.0.beta33";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Dao-AILab";
     repo = "flash-attention";
     tag = "fa4-v${finalAttrs.version}";
-    hash = "sha256-VRkUNQwzAKbQlHeSqMflNvh1C6brdRqAaQZrKMDIihw=";
+    hash = "sha256-g70DsY9tTnq6qufEtpN+5GdRJeg6WOdQneWXUzOmgTc=";
   };
 
   # FA4 is a separate distribution shipped under flash_attn/cute/ with its own pyproject.toml.
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index 97298dbabd13..e5dfd4073369 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -24,6 +24,7 @@
   llguidance,
   opencv-python-headless,
   pydantic-settings,
+  pytest-xdist,
   pytestCheckHook,
   sentencepiece,
   soundfile,
@@ -38,14 +39,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mistral-common";
-  version = "1.11.7";
+  version = "1.12.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "mistralai";
     repo = "mistral-common";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yYJBWnHxv/0BLGvi2MjcQvRhNjR5F8tdAy2f7q9hEJg=";
+    hash = "sha256-XrSlPG7t1BJ+kcoMlZMwVRnKfNS656GlnatebgapRMY=";
   };
 
   build-system = [
@@ -111,6 +113,7 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     openai
     pycountry
+    pytest-xdist
     pytestCheckHook
     uvicorn
   ]
@@ -119,12 +122,15 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # AssertionError, Extra items in the right set
     "test_openai_chat_fields"
+
+    # AssertionError: assert 0.028677442591911916 < 0.005
+    "test_audio_base64"
   ];
 
   meta = {
     description = "Tools to help you work with Mistral models";
     homepage = "https://github.com/mistralai/mistral-common";
-    changelog = "https://github.com/mistralai/mistral-common/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/mistralai/mistral-common/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bgamari ];
   };
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index e540aeb2d5a5..544a494e48e8 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -139,9 +139,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.105"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
 dependencies = [
  "cfg-if",
  "wasm-bindgen",
@@ -216,7 +216,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.14.5"
+version = "0.14.6"
 dependencies = [
  "futures-task",
  "pyo3",
@@ -372,9 +372,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.16.1"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
 
 [[package]]
 name = "syn"
@@ -406,18 +406,18 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -432,9 +432,9 @@ checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.128"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -445,9 +445,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.128"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -455,9 +455,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.128"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -468,9 +468,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.128"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
 dependencies = [
  "unicode-ident",
 ]
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index ac740d286b3b..ab82b6f75bf4 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycrdt";
-  version = "0.14.5";
+  version = "0.14.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = finalAttrs.version;
-    hash = "sha256-72MFHt3lgN1OVakI2u1E6HQTv4N4KDWeX2EYk+ddSxQ=";
+    hash = "sha256-gO1QReYcrsCJLkCLPt0ihydPjAarJlYnISZG6NfMj6o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/torchcodec/default.nix b/pkgs/development/python-modules/torchcodec/default.nix
index 5bca23468383..cd8934ea9992 100644
--- a/pkgs/development/python-modules/torchcodec/default.nix
+++ b/pkgs/development/python-modules/torchcodec/default.nix
@@ -38,7 +38,7 @@ let
   # unconditionally FetchContent-downloads a prebuilt tarball from S3.
   # Point FetchContent at our own libavif instead, which it expects to find as `include/` and
   # `lib/libavif.so.16` under a single root.
-  # https://github.com/meta-pytorch/torchcodec/blob/v0.16.0/src/torchcodec/_core/fetch_avif_from_s3.cmake
+  # https://github.com/meta-pytorch/torchcodec/blob/v0.17.0/src/torchcodec/_core/fetch_avif_from_s3.cmake
   libavif-root = symlinkJoin {
     name = "libavif-root";
     paths = [
@@ -49,7 +49,7 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "torchcodec";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -57,7 +57,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     owner = "meta-pytorch";
     repo = "torchcodec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eXe86DQqXWePWn9UcMVLdJTaO0YQZIQaQ4o1ao/5dH8=";
+    hash = "sha256-IvxVtbH43RpJ4HZ8r/g6/+Ab5xBRk9uQUSIi1Af78O0=";
   };
 
   postPatch = ''
@@ -77,6 +77,11 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
       --replace-fail \
         'ffmpeg_cli = "ffmpeg"' \
         'ffmpeg_cli = "${lib.getExe ffmpeg-headless}"'
+
+    substituteInPlace test/test_decoders.py \
+      --replace-fail \
+        '"ffmpeg", "-' \
+        '"${lib.getExe ffmpeg-headless}", "-'
   '';
 
   nativeBuildInputs = [
@@ -151,6 +156,8 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     torchvision
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTestPaths = [
     # Shells out to `pip install` to set up a plugin package
     "test/plugin/test_plugins.py"
@@ -168,62 +175,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     # Fails in the sandbox:
     # Error in cpuinfo: failed to parse the list of possible processors in /sys/devices/system/cpu/possible
     "test_python_logger"
-
-    # AssertionError: index 0
-    "test_get_frames_played_at"
-
-    # AssertionError: Tensor-likes are not equal!
-    "test_against_cli"
-    "test_against_ref"
-    "test_color_conversion_library"
-    "test_color_conversion_library_with_dimension_order"
-    "test_compile"
-    "test_compile_seek_and_next"
-    "test_create_decoder"
-    "test_crop_transform"
-    "test_custom_frame_mappings_json_and_bytes"
-    "test_file_like_decoding"
-    "test_get_frame_at"
-    "test_get_frame_at_av1"
-    "test_get_frame_at_index"
-    "test_get_frame_at_pts"
-    "test_get_frame_played_at"
-    "test_get_frame_played_at_h265"
-    "test_get_frame_with_info_at_index"
-    "test_get_frames_at"
-    "test_get_frames_at_indices"
-    "test_get_frames_at_indices_negative_indices"
-    "test_get_frames_by_pts_in_range"
-    "test_get_frames_in_range"
-    "test_get_frames_in_range_slice_indices_syntax"
-    "test_get_frames_with_missing_num_frames_metadata"
-    "test_getitem_int"
-    "test_getitem_numpy_int"
-    "test_getitem_slice"
-    "test_iteration"
-    "test_seek_and_next"
-    "test_seek_mode_custom_frame_mappings"
-    "test_seek_to_negative_pts"
-    "test_throws_exception_at_eof"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    # RuntimeError: Invalid AVIO context holder
-    "test_1d_samples"
-    "test_against_cli"
-    "test_against_to_file"
-    "test_against_to_file"
-    "test_contiguit"
-    "test_crf_valid_value"
-    "test_encode_to_tensor_long_outpu"
-    "test_num_channels"
-    "test_round_trip"
-    "test_video_encoder_against_ffmpeg_cli"
-    "test_video_encoder_round_trip"
-
-    # RuntimeError: Requested next frame while there are no more frames left to decode
-    "test_next"
-    "test_throws_exception_at_eof"
-    "test_throws_exception_if_seek_too_far"
   ];
 
   meta = {
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
index f8ce7a5a2ef4..5558bde5b2f7 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "auto-entities";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "Lint-Free-Technology";
     repo = "lovelace-auto-entities";
     tag = "v${version}";
-    hash = "sha256-jShhP0dxx2FZqVE5SmQ5g5/p9jG9T2V85Ql0oAvT9hA=";
+    hash = "sha256-fTyDQ2imr339uAYOnGMxcIzb2I5x+31tKUQQt85xGYQ=";
   };
 
-  npmDepsHash = "sha256-ZksTHT4IXU2raJAsUKlmyl5N7VgX193Os+J9pczq05Y=";
+  npmDepsHash = "sha256-6RA8Nr83buN+7CI2ZulgafrJhtVb3aX/WOyDMpER3yE=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index c8bad4311846..105aca716144 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -10,15 +10,25 @@
     ]
   },
   "calendar": {
-    "hash": "sha256-Z8d3puqXRAnp0ijCP8YPK+jmddN2UxtrGxJfLwNlc40=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.5.4/calendar-v6.5.4.tar.gz",
-    "version": "6.5.4",
+    "hash": "sha256-/WYw3uxWg2h4TFae8Bx9ntisyhq2gzzxKiv/WYSj+ns=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.6.1/calendar-v6.6.1.tar.gz",
+    "version": "6.6.1",
     "description": "A Calendar app for Nextcloud. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Like Contacts, Talk, Tasks, Deck and Circles\n* 🌐 **WebCal Support!** Want to see your favorite team's matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 **Search!** Find your events at ease\n* ☑️ **Tasks!** See tasks or Deck cards with a due date directly in the calendar\n* 🔈 **Talk rooms!** Create an associated Talk room when booking a meeting with just one click\n* 📆 **Appointment booking** Send people a link so they can book an appointment with you [using this app](https://apps.nextcloud.com/apps/appointments)\n* 📎 **Attachments!** Add, upload and view event attachments\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
       "agpl"
     ]
   },
+  "calendar_resource_management": {
+    "hash": "sha256-6LZTdj8PJ0T3kjH8S6i3s0pS8lxkg6CrSd0JZfCYfnA=",
+    "url": "https://github.com/nextcloud-releases/calendar_resource_management/releases/download/v0.12.2/calendar_resource_management-v0.12.2.tar.gz",
+    "version": "0.12.2",
+    "description": "Management for calendar resources and rooms",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "checksum": {
     "hash": "sha256-6qPZvsml3LBYuuDnMwHg4WssxyQjr6op3AKlsMBLCGk=",
     "url": "https://github.com/westberliner/checksum/releases/download/v2.1.2/checksum.tar.gz",
@@ -30,9 +40,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-fZMtdynP4XgrDR+jyjEQT7ujwT8dzu2x8YPcVLFAYuk=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v4.6.1/collectives-4.6.1.tar.gz",
-    "version": "4.6.1",
+    "hash": "sha256-au+EZ0UnOT7b/CkV1YAU5O9yv7J/PKYGt8H6+YWuCHk=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.7.1/collectives-4.7.1.tar.gz",
+    "version": "4.7.1",
     "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
     "homepage": "https://collectives.cloud/",
     "licenses": [
@@ -100,9 +110,9 @@
     ]
   },
   "end_to_end_encryption": {
-    "hash": "sha256-qfLYRPig+ZkvmHyVfjFRSafUEJrF1q/qU4XqbIf5xp4=",
-    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.2.4/end_to_end_encryption-v2.2.4.tar.gz",
-    "version": "2.2.4",
+    "hash": "sha256-lgSxKI9O64Gza2wLh0/Lc0GW6/pjfH38d44L5cBcmzQ=",
+    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.3.0/end_to_end_encryption-v2.3.0.tar.gz",
+    "version": "2.3.0",
     "description": "## **End-to-End Encryption**\n\n### For End Users\n\n**Protect your most sensitive files with strong encryption.**\n\nThe End-to-End Encryption app gives you complete control over your data privacy.\nWith this app, you can encrypt specific folders so that only you (and those you trust) can access their contents.\nYour files are encrypted on your device before they reach the server, ensuring that no one—not even the server administrator—can read them.\n\n**Benefits:**\n- 🔒 **True privacy**: Files are encrypted on your device and can only be decrypted by you\n- 📱 **Works across all platforms**: Fully supported on desktop, Android, iOS clients, and as you wish even in the browser\n- 🎯 **Selective encryption**: Choose which folders to encrypt\n- 🛡️ **Secure sharing**: Share encrypted files with other users or even secure public upload using the encrypted file drop\n\n---\n\n### For Administrators\n\n**Enterprise-ready end-to-end encryption infrastructure for your Nextcloud instance.**\n\nThis app provides all the necessary server-side APIs and infrastructure to enable End-to-End encryption (E2EE) for your users.\nIt ensures that encrypted data remains secure throughout its lifecycle on your server.\n\n**Technical highlights:**\n- 🔐 **Complete API suite**: Provides all client-side APIs needed for E2EE implementation\n- 🔒 **Secure FileDrop integration**: Enables secure file sharing with encryption\n- 🛡️ **Zero-knowledge architecture**: Server never has access to encryption keys\n- ⚙️ **Group restrictions**: Limit app usage to specific user groups if needed\n- 🔄 **Background job management**: Automatic rollback handling for failed operations\n\n### Setup\nThis application provides the server-side infrastructure for end-to-end encryption, but it requires client support to function.\nTo enable end-to-end encryption, users will need to install the corresponding client-side app on their devices (desktop, Android, iOS) or use the web client.\n\nUsing the web interface, after enabling it in the personal settings, allows you to encrypt files and folders directly in the browser,\nproviding a seamless experience without needing additional software. But also requires some kind of trust in the server as the code is delivered by the server and could be manipulated.\n\nOnce enable through clients or the web interface, you can create encrypted folders and upload or move files into them.\nThe clients and the web interface will handle the encryption and decryption processes automatically.\n\n⚠️ This comes with some limitations and caveats, as only normal file operations can be handled.\nMeaning that some apps in the web interface do not work with encrypted files.",
     "homepage": "https://github.com/nextcloud/end_to_end_encryption",
     "licenses": [
@@ -130,9 +140,9 @@
     ]
   },
   "files_mindmap": {
-    "hash": "sha256-v2IfK9vQ7GnanPS/haOt9adFBNoBvHaX6C/lpmMpJ1Y=",
-    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.2/files_mindmap-v0.1.2.tar.gz",
-    "version": "0.1.2",
+    "hash": "sha256-aZgQj8ljAnBkcZMc54VZXsNRknyQmxqhO2t1A3o3ll8=",
+    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.3/files_mindmap-v0.1.3.tar.gz",
+    "version": "0.1.3",
     "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the \"New\" button at the top of the web browser the mind map file entry appears. When clicked, a new mind map file opens in the browser and the file can be saved into the current Nextcloud folder.",
     "homepage": "https://github.com/nextcloud/files_mindmap",
     "licenses": [
@@ -230,9 +240,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-EtH7wjaYlYp6muuWHfKHHWLBQrDBTgsbrSt9FoLbH/s=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.0/mail-v5.12.0.tar.gz",
-    "version": "5.12.0",
+    "hash": "sha256-by814Ufc0o3d28oUYC5cLmn9FPymQ7qGev0ZKWazC/M=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.3/mail-v5.12.3.tar.gz",
+    "version": "5.12.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -290,9 +300,9 @@
     ]
   },
   "oidc": {
-    "hash": "sha256-zfdZSUwV8VZ5qq7rwN/G4cSfTbuutaK+yJ6g8556yOQ=",
-    "url": "https://github.com/H2CK/oidc/releases/download/2.3.1/oidc-2.3.1.tar.gz",
-    "version": "2.3.1",
+    "hash": "sha256-swSauaf5FwaYsHCfhQucwHi9Kun/kVMtNLlcEqYW+0c=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.4.1/oidc-2.4.1.tar.gz",
+    "version": "2.4.1",
     "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
     "homepage": "https://github.com/H2CK/oidc",
     "licenses": [
@@ -310,9 +320,9 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-QX2OJKoArx9pFoZBdeXXSc6K0UGzpUCZ6imZJSnBeQc=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.0/onlyoffice.tar.gz",
-    "version": "10.2.0",
+    "hash": "sha256-FEmYrwYQzNF+6NcCXi+AAUctoD9tq5D/OAOSR4JeOps=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.1/onlyoffice.tar.gz",
+    "version": "10.2.1",
     "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -320,9 +330,9 @@
     ]
   },
   "pantry": {
-    "hash": "sha256-jJKOGlbj6fzDpLMFH6JT3ePwddcC4tQMFlDfipb3iRk=",
-    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.32.0/pantry-v0.32.0.tar.gz",
-    "version": "0.32.0",
+    "hash": "sha256-eTPDYvX8/fnbRVeGq1/caGoFqYU9rqvwCiYA4drPVUw=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.34.0/pantry-v0.34.0.tar.gz",
+    "version": "0.34.0",
     "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Shopping mode** turns your lists into a store-by-store trip — pick the lists and the route, check items off as you walk, see which housemates are out shopping, and finish with a priced review that lands in your shopping history.\n- **Barcode scanning** prefills an item from a product's EAN or UPC. Scan with the camera or type the code in, and Pantry looks up the name, category and photo for you to review.\n- **Custom fields** attach your own information to checklist items — an expiry date, an aisle number, a size, a yes/no flag. Define a field once for the house or a single list; date fields can send a reminder before they come due.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile, watch and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619)) | Wear OS ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry)) | [Windows](https://pantry.casraf.dev/docs/getting-started/apps#desktop) | [Linux](https://pantry.casraf.dev/docs/getting-started/apps#desktop)\n\n**Website:** [pantry.casraf.dev](https://pantry.casraf.dev) | **Documentation:** [pantry.casraf.dev/docs](https://pantry.casraf.dev/docs)",
     "homepage": "https://pantry.casraf.dev",
     "licenses": [
@@ -350,9 +360,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
-    "version": "5.14.0",
+    "hash": "sha256-6QpXxs0CpcbMNhY/N8lCl6L/0kQ8y/AWSIHo/XsyT9k=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.15.0/previewgenerator-v5.15.0.tar.gz",
+    "version": "5.15.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -370,13 +380,13 @@
     ]
   },
   "quota_warning": {
-    "hash": "sha256-bX9f6Zu53lZfG8zpfEwRxvIFVxARs4y6NLNNAK3DhUI=",
-    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.24.0/quota_warning-v1.24.0.tar.gz",
-    "version": "1.24.0",
+    "hash": "sha256-0160Np2MXsyPEk0pEArLZHqTBEZI3jZUBKJ+qXMhFfc=",
+    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.25.0/quota_warning-v1.25.0.tar.gz",
+    "version": "1.25.0",
     "description": "This app sends notifications to users when they reached 85, 90 and 95% of their quota (checked once a day).\nIn addition an email can be sent to the users. The three percentages can be changed in the admin settings.\nIt is also possible to have a link in the email and the notification for upsell options.",
     "homepage": "https://github.com/nextcloud/quota_warning",
     "licenses": [
-      "agpl"
+      "AGPL-3.0-or-later"
     ]
   },
   "registration": {
@@ -390,9 +400,9 @@
     ]
   },
   "repod": {
-    "hash": "sha256-PIgadPKon95tkr+Rrnr2MJUQ6IxqKZHpltdxLLp9aUY=",
-    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.2/repod.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-RASx+wMprz5d/ck7oc7ulu03fTt6e2mj5LJRgwF2hCM=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.3/repod.tar.gz",
+    "version": "4.3.3",
     "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
     "homepage": "https://git.crystalyx.net/Xefir/repod",
     "licenses": [
@@ -400,9 +410,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-xNbX6tXW64yUgT2xitHYCIhO6TKkVp2kU1xlJ3nKiT8=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v10.3.1/richdocuments-v10.3.1.tar.gz",
-    "version": "10.3.1",
+    "hash": "sha256-+IX0tEDfLDq2Rw/02/fDcTGfLd5wn9aCpddfseEJkDA=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v10.3.2/richdocuments-v10.3.2.tar.gz",
+    "version": "10.3.2",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -490,9 +500,9 @@
     ]
   },
   "uppush": {
-    "hash": "sha256-SRRFA1nQk0OsCm+FEaEN32bDTNCbcKyM0ZOhy5yXUEc=",
-    "url": "https://codeberg.org/NextPush/uppush/archive/2.5.0.tar.gz",
-    "version": "2.5.0",
+    "hash": "sha256-aCvBQLJVkdy9ha0NPrJ3008hIyZJ7/dzA7iyjUr/Tes=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.6.1.tar.gz",
+    "version": "2.6.1",
     "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
     "homepage": "",
     "licenses": [
@@ -510,9 +520,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-Veazp5dELWpebb/CdPCHYKoVs+jvyC1sKVY1Zewa3/8=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.3.1/user_saml-v8.3.1.tar.gz",
-    "version": "8.3.1",
+    "hash": "sha256-XlLRU/w5cvfEJtBsybfYFZrFwyAbgx1OLnYyFNU4F5M=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.4.0/user_saml-v8.4.0.tar.gz",
+    "version": "8.4.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/34.json b/pkgs/servers/nextcloud/packages/34.json
index 40c0cd242a7f..2ba5d3938cb0 100644
--- a/pkgs/servers/nextcloud/packages/34.json
+++ b/pkgs/servers/nextcloud/packages/34.json
@@ -10,15 +10,25 @@
     ]
   },
   "calendar": {
-    "hash": "sha256-Z8d3puqXRAnp0ijCP8YPK+jmddN2UxtrGxJfLwNlc40=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.5.4/calendar-v6.5.4.tar.gz",
-    "version": "6.5.4",
+    "hash": "sha256-/WYw3uxWg2h4TFae8Bx9ntisyhq2gzzxKiv/WYSj+ns=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.6.1/calendar-v6.6.1.tar.gz",
+    "version": "6.6.1",
     "description": "A Calendar app for Nextcloud. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Like Contacts, Talk, Tasks, Deck and Circles\n* 🌐 **WebCal Support!** Want to see your favorite team's matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 **Search!** Find your events at ease\n* ☑️ **Tasks!** See tasks or Deck cards with a due date directly in the calendar\n* 🔈 **Talk rooms!** Create an associated Talk room when booking a meeting with just one click\n* 📆 **Appointment booking** Send people a link so they can book an appointment with you [using this app](https://apps.nextcloud.com/apps/appointments)\n* 📎 **Attachments!** Add, upload and view event attachments\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
       "agpl"
     ]
   },
+  "calendar_resource_management": {
+    "hash": "sha256-6LZTdj8PJ0T3kjH8S6i3s0pS8lxkg6CrSd0JZfCYfnA=",
+    "url": "https://github.com/nextcloud-releases/calendar_resource_management/releases/download/v0.12.2/calendar_resource_management-v0.12.2.tar.gz",
+    "version": "0.12.2",
+    "description": "Management for calendar resources and rooms",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "checksum": {
     "hash": "sha256-6qPZvsml3LBYuuDnMwHg4WssxyQjr6op3AKlsMBLCGk=",
     "url": "https://github.com/westberliner/checksum/releases/download/v2.1.2/checksum.tar.gz",
@@ -30,9 +40,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-fZMtdynP4XgrDR+jyjEQT7ujwT8dzu2x8YPcVLFAYuk=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v4.6.1/collectives-4.6.1.tar.gz",
-    "version": "4.6.1",
+    "hash": "sha256-au+EZ0UnOT7b/CkV1YAU5O9yv7J/PKYGt8H6+YWuCHk=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.7.1/collectives-4.7.1.tar.gz",
+    "version": "4.7.1",
     "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
     "homepage": "https://collectives.cloud/",
     "licenses": [
@@ -100,9 +110,9 @@
     ]
   },
   "end_to_end_encryption": {
-    "hash": "sha256-qfLYRPig+ZkvmHyVfjFRSafUEJrF1q/qU4XqbIf5xp4=",
-    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.2.4/end_to_end_encryption-v2.2.4.tar.gz",
-    "version": "2.2.4",
+    "hash": "sha256-lgSxKI9O64Gza2wLh0/Lc0GW6/pjfH38d44L5cBcmzQ=",
+    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.3.0/end_to_end_encryption-v2.3.0.tar.gz",
+    "version": "2.3.0",
     "description": "## **End-to-End Encryption**\n\n### For End Users\n\n**Protect your most sensitive files with strong encryption.**\n\nThe End-to-End Encryption app gives you complete control over your data privacy.\nWith this app, you can encrypt specific folders so that only you (and those you trust) can access their contents.\nYour files are encrypted on your device before they reach the server, ensuring that no one—not even the server administrator—can read them.\n\n**Benefits:**\n- 🔒 **True privacy**: Files are encrypted on your device and can only be decrypted by you\n- 📱 **Works across all platforms**: Fully supported on desktop, Android, iOS clients, and as you wish even in the browser\n- 🎯 **Selective encryption**: Choose which folders to encrypt\n- 🛡️ **Secure sharing**: Share encrypted files with other users or even secure public upload using the encrypted file drop\n\n---\n\n### For Administrators\n\n**Enterprise-ready end-to-end encryption infrastructure for your Nextcloud instance.**\n\nThis app provides all the necessary server-side APIs and infrastructure to enable End-to-End encryption (E2EE) for your users.\nIt ensures that encrypted data remains secure throughout its lifecycle on your server.\n\n**Technical highlights:**\n- 🔐 **Complete API suite**: Provides all client-side APIs needed for E2EE implementation\n- 🔒 **Secure FileDrop integration**: Enables secure file sharing with encryption\n- 🛡️ **Zero-knowledge architecture**: Server never has access to encryption keys\n- ⚙️ **Group restrictions**: Limit app usage to specific user groups if needed\n- 🔄 **Background job management**: Automatic rollback handling for failed operations\n\n### Setup\nThis application provides the server-side infrastructure for end-to-end encryption, but it requires client support to function.\nTo enable end-to-end encryption, users will need to install the corresponding client-side app on their devices (desktop, Android, iOS) or use the web client.\n\nUsing the web interface, after enabling it in the personal settings, allows you to encrypt files and folders directly in the browser,\nproviding a seamless experience without needing additional software. But also requires some kind of trust in the server as the code is delivered by the server and could be manipulated.\n\nOnce enable through clients or the web interface, you can create encrypted folders and upload or move files into them.\nThe clients and the web interface will handle the encryption and decryption processes automatically.\n\n⚠️ This comes with some limitations and caveats, as only normal file operations can be handled.\nMeaning that some apps in the web interface do not work with encrypted files.",
     "homepage": "https://github.com/nextcloud/end_to_end_encryption",
     "licenses": [
@@ -130,9 +140,9 @@
     ]
   },
   "files_mindmap": {
-    "hash": "sha256-v2IfK9vQ7GnanPS/haOt9adFBNoBvHaX6C/lpmMpJ1Y=",
-    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.2/files_mindmap-v0.1.2.tar.gz",
-    "version": "0.1.2",
+    "hash": "sha256-aZgQj8ljAnBkcZMc54VZXsNRknyQmxqhO2t1A3o3ll8=",
+    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.3/files_mindmap-v0.1.3.tar.gz",
+    "version": "0.1.3",
     "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the \"New\" button at the top of the web browser the mind map file entry appears. When clicked, a new mind map file opens in the browser and the file can be saved into the current Nextcloud folder.",
     "homepage": "https://github.com/nextcloud/files_mindmap",
     "licenses": [
@@ -230,9 +240,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-EtH7wjaYlYp6muuWHfKHHWLBQrDBTgsbrSt9FoLbH/s=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.0/mail-v5.12.0.tar.gz",
-    "version": "5.12.0",
+    "hash": "sha256-by814Ufc0o3d28oUYC5cLmn9FPymQ7qGev0ZKWazC/M=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.3/mail-v5.12.3.tar.gz",
+    "version": "5.12.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -290,9 +300,9 @@
     ]
   },
   "oidc": {
-    "hash": "sha256-zfdZSUwV8VZ5qq7rwN/G4cSfTbuutaK+yJ6g8556yOQ=",
-    "url": "https://github.com/H2CK/oidc/releases/download/2.3.1/oidc-2.3.1.tar.gz",
-    "version": "2.3.1",
+    "hash": "sha256-swSauaf5FwaYsHCfhQucwHi9Kun/kVMtNLlcEqYW+0c=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.4.1/oidc-2.4.1.tar.gz",
+    "version": "2.4.1",
     "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
     "homepage": "https://github.com/H2CK/oidc",
     "licenses": [
@@ -310,9 +320,9 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-QX2OJKoArx9pFoZBdeXXSc6K0UGzpUCZ6imZJSnBeQc=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.0/onlyoffice.tar.gz",
-    "version": "10.2.0",
+    "hash": "sha256-FEmYrwYQzNF+6NcCXi+AAUctoD9tq5D/OAOSR4JeOps=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.1/onlyoffice.tar.gz",
+    "version": "10.2.1",
     "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -320,9 +330,9 @@
     ]
   },
   "pantry": {
-    "hash": "sha256-jJKOGlbj6fzDpLMFH6JT3ePwddcC4tQMFlDfipb3iRk=",
-    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.32.0/pantry-v0.32.0.tar.gz",
-    "version": "0.32.0",
+    "hash": "sha256-eTPDYvX8/fnbRVeGq1/caGoFqYU9rqvwCiYA4drPVUw=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.34.0/pantry-v0.34.0.tar.gz",
+    "version": "0.34.0",
     "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Shopping mode** turns your lists into a store-by-store trip — pick the lists and the route, check items off as you walk, see which housemates are out shopping, and finish with a priced review that lands in your shopping history.\n- **Barcode scanning** prefills an item from a product's EAN or UPC. Scan with the camera or type the code in, and Pantry looks up the name, category and photo for you to review.\n- **Custom fields** attach your own information to checklist items — an expiry date, an aisle number, a size, a yes/no flag. Define a field once for the house or a single list; date fields can send a reminder before they come due.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile, watch and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619)) | Wear OS ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry)) | [Windows](https://pantry.casraf.dev/docs/getting-started/apps#desktop) | [Linux](https://pantry.casraf.dev/docs/getting-started/apps#desktop)\n\n**Website:** [pantry.casraf.dev](https://pantry.casraf.dev) | **Documentation:** [pantry.casraf.dev/docs](https://pantry.casraf.dev/docs)",
     "homepage": "https://pantry.casraf.dev",
     "licenses": [
@@ -350,9 +360,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
-    "version": "5.14.0",
+    "hash": "sha256-6QpXxs0CpcbMNhY/N8lCl6L/0kQ8y/AWSIHo/XsyT9k=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.15.0/previewgenerator-v5.15.0.tar.gz",
+    "version": "5.15.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -370,13 +380,13 @@
     ]
   },
   "quota_warning": {
-    "hash": "sha256-bX9f6Zu53lZfG8zpfEwRxvIFVxARs4y6NLNNAK3DhUI=",
-    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.24.0/quota_warning-v1.24.0.tar.gz",
-    "version": "1.24.0",
+    "hash": "sha256-0160Np2MXsyPEk0pEArLZHqTBEZI3jZUBKJ+qXMhFfc=",
+    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.25.0/quota_warning-v1.25.0.tar.gz",
+    "version": "1.25.0",
     "description": "This app sends notifications to users when they reached 85, 90 and 95% of their quota (checked once a day).\nIn addition an email can be sent to the users. The three percentages can be changed in the admin settings.\nIt is also possible to have a link in the email and the notification for upsell options.",
     "homepage": "https://github.com/nextcloud/quota_warning",
     "licenses": [
-      "agpl"
+      "AGPL-3.0-or-later"
     ]
   },
   "registration": {
@@ -390,9 +400,9 @@
     ]
   },
   "repod": {
-    "hash": "sha256-PIgadPKon95tkr+Rrnr2MJUQ6IxqKZHpltdxLLp9aUY=",
-    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.2/repod.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-RASx+wMprz5d/ck7oc7ulu03fTt6e2mj5LJRgwF2hCM=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.3/repod.tar.gz",
+    "version": "4.3.3",
     "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
     "homepage": "https://git.crystalyx.net/Xefir/repod",
     "licenses": [
@@ -400,9 +410,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-xNVfGxpkoP6uxA7HoWYizy55eIF3Hl4FlRR7qEzJN0c=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v11.1.1/richdocuments-v11.1.1.tar.gz",
-    "version": "11.1.1",
+    "hash": "sha256-lnZqlM9BenFuR+2Jxv8kEcVJVMqpFq/N3cTZZo3/tVc=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v11.1.2/richdocuments-v11.1.2.tar.gz",
+    "version": "11.1.2",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -490,9 +500,9 @@
     ]
   },
   "uppush": {
-    "hash": "sha256-SRRFA1nQk0OsCm+FEaEN32bDTNCbcKyM0ZOhy5yXUEc=",
-    "url": "https://codeberg.org/NextPush/uppush/archive/2.5.0.tar.gz",
-    "version": "2.5.0",
+    "hash": "sha256-aCvBQLJVkdy9ha0NPrJ3008hIyZJ7/dzA7iyjUr/Tes=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.6.1.tar.gz",
+    "version": "2.6.1",
     "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
     "homepage": "",
     "licenses": [
@@ -510,9 +520,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-Veazp5dELWpebb/CdPCHYKoVs+jvyC1sKVY1Zewa3/8=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.3.1/user_saml-v8.3.1.tar.gz",
-    "version": "8.3.1",
+    "hash": "sha256-XlLRU/w5cvfEJtBsybfYFZrFwyAbgx1OLnYyFNU4F5M=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.4.0/user_saml-v8.4.0.tar.gz",
+    "version": "8.4.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/35.json b/pkgs/servers/nextcloud/packages/35.json
index 7fac5aad2822..0502e2c4d354 100644
--- a/pkgs/servers/nextcloud/packages/35.json
+++ b/pkgs/servers/nextcloud/packages/35.json
@@ -10,15 +10,25 @@
     ]
   },
   "calendar": {
-    "hash": "sha256-Z8d3puqXRAnp0ijCP8YPK+jmddN2UxtrGxJfLwNlc40=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.5.4/calendar-v6.5.4.tar.gz",
-    "version": "6.5.4",
+    "hash": "sha256-/WYw3uxWg2h4TFae8Bx9ntisyhq2gzzxKiv/WYSj+ns=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.6.1/calendar-v6.6.1.tar.gz",
+    "version": "6.6.1",
     "description": "A Calendar app for Nextcloud. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Like Contacts, Talk, Tasks, Deck and Circles\n* 🌐 **WebCal Support!** Want to see your favorite team's matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 **Search!** Find your events at ease\n* ☑️ **Tasks!** See tasks or Deck cards with a due date directly in the calendar\n* 🔈 **Talk rooms!** Create an associated Talk room when booking a meeting with just one click\n* 📆 **Appointment booking** Send people a link so they can book an appointment with you [using this app](https://apps.nextcloud.com/apps/appointments)\n* 📎 **Attachments!** Add, upload and view event attachments\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
       "agpl"
     ]
   },
+  "calendar_resource_management": {
+    "hash": "sha256-6LZTdj8PJ0T3kjH8S6i3s0pS8lxkg6CrSd0JZfCYfnA=",
+    "url": "https://github.com/nextcloud-releases/calendar_resource_management/releases/download/v0.12.2/calendar_resource_management-v0.12.2.tar.gz",
+    "version": "0.12.2",
+    "description": "Management for calendar resources and rooms",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "checksum": {
     "hash": "sha256-6qPZvsml3LBYuuDnMwHg4WssxyQjr6op3AKlsMBLCGk=",
     "url": "https://github.com/westberliner/checksum/releases/download/v2.1.2/checksum.tar.gz",
@@ -30,9 +40,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-fZMtdynP4XgrDR+jyjEQT7ujwT8dzu2x8YPcVLFAYuk=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v4.6.1/collectives-4.6.1.tar.gz",
-    "version": "4.6.1",
+    "hash": "sha256-au+EZ0UnOT7b/CkV1YAU5O9yv7J/PKYGt8H6+YWuCHk=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.7.1/collectives-4.7.1.tar.gz",
+    "version": "4.7.1",
     "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
     "homepage": "https://collectives.cloud/",
     "licenses": [
@@ -100,9 +110,9 @@
     ]
   },
   "end_to_end_encryption": {
-    "hash": "sha256-qfLYRPig+ZkvmHyVfjFRSafUEJrF1q/qU4XqbIf5xp4=",
-    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.2.4/end_to_end_encryption-v2.2.4.tar.gz",
-    "version": "2.2.4",
+    "hash": "sha256-lgSxKI9O64Gza2wLh0/Lc0GW6/pjfH38d44L5cBcmzQ=",
+    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.3.0/end_to_end_encryption-v2.3.0.tar.gz",
+    "version": "2.3.0",
     "description": "## **End-to-End Encryption**\n\n### For End Users\n\n**Protect your most sensitive files with strong encryption.**\n\nThe End-to-End Encryption app gives you complete control over your data privacy.\nWith this app, you can encrypt specific folders so that only you (and those you trust) can access their contents.\nYour files are encrypted on your device before they reach the server, ensuring that no one—not even the server administrator—can read them.\n\n**Benefits:**\n- 🔒 **True privacy**: Files are encrypted on your device and can only be decrypted by you\n- 📱 **Works across all platforms**: Fully supported on desktop, Android, iOS clients, and as you wish even in the browser\n- 🎯 **Selective encryption**: Choose which folders to encrypt\n- 🛡️ **Secure sharing**: Share encrypted files with other users or even secure public upload using the encrypted file drop\n\n---\n\n### For Administrators\n\n**Enterprise-ready end-to-end encryption infrastructure for your Nextcloud instance.**\n\nThis app provides all the necessary server-side APIs and infrastructure to enable End-to-End encryption (E2EE) for your users.\nIt ensures that encrypted data remains secure throughout its lifecycle on your server.\n\n**Technical highlights:**\n- 🔐 **Complete API suite**: Provides all client-side APIs needed for E2EE implementation\n- 🔒 **Secure FileDrop integration**: Enables secure file sharing with encryption\n- 🛡️ **Zero-knowledge architecture**: Server never has access to encryption keys\n- ⚙️ **Group restrictions**: Limit app usage to specific user groups if needed\n- 🔄 **Background job management**: Automatic rollback handling for failed operations\n\n### Setup\nThis application provides the server-side infrastructure for end-to-end encryption, but it requires client support to function.\nTo enable end-to-end encryption, users will need to install the corresponding client-side app on their devices (desktop, Android, iOS) or use the web client.\n\nUsing the web interface, after enabling it in the personal settings, allows you to encrypt files and folders directly in the browser,\nproviding a seamless experience without needing additional software. But also requires some kind of trust in the server as the code is delivered by the server and could be manipulated.\n\nOnce enable through clients or the web interface, you can create encrypted folders and upload or move files into them.\nThe clients and the web interface will handle the encryption and decryption processes automatically.\n\n⚠️ This comes with some limitations and caveats, as only normal file operations can be handled.\nMeaning that some apps in the web interface do not work with encrypted files.",
     "homepage": "https://github.com/nextcloud/end_to_end_encryption",
     "licenses": [
@@ -130,9 +140,9 @@
     ]
   },
   "files_mindmap": {
-    "hash": "sha256-v2IfK9vQ7GnanPS/haOt9adFBNoBvHaX6C/lpmMpJ1Y=",
-    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.2/files_mindmap-v0.1.2.tar.gz",
-    "version": "0.1.2",
+    "hash": "sha256-aZgQj8ljAnBkcZMc54VZXsNRknyQmxqhO2t1A3o3ll8=",
+    "url": "https://github.com/nextcloud-releases/files_mindmap/releases/download/v0.1.3/files_mindmap-v0.1.3.tar.gz",
+    "version": "0.1.3",
     "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the \"New\" button at the top of the web browser the mind map file entry appears. When clicked, a new mind map file opens in the browser and the file can be saved into the current Nextcloud folder.",
     "homepage": "https://github.com/nextcloud/files_mindmap",
     "licenses": [
@@ -230,9 +240,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-EtH7wjaYlYp6muuWHfKHHWLBQrDBTgsbrSt9FoLbH/s=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.0/mail-v5.12.0.tar.gz",
-    "version": "5.12.0",
+    "hash": "sha256-by814Ufc0o3d28oUYC5cLmn9FPymQ7qGev0ZKWazC/M=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.12.3/mail-v5.12.3.tar.gz",
+    "version": "5.12.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -280,9 +290,9 @@
     ]
   },
   "oidc": {
-    "hash": "sha256-zfdZSUwV8VZ5qq7rwN/G4cSfTbuutaK+yJ6g8556yOQ=",
-    "url": "https://github.com/H2CK/oidc/releases/download/2.3.1/oidc-2.3.1.tar.gz",
-    "version": "2.3.1",
+    "hash": "sha256-swSauaf5FwaYsHCfhQucwHi9Kun/kVMtNLlcEqYW+0c=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.4.1/oidc-2.4.1.tar.gz",
+    "version": "2.4.1",
     "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
     "homepage": "https://github.com/H2CK/oidc",
     "licenses": [
@@ -300,9 +310,9 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-QX2OJKoArx9pFoZBdeXXSc6K0UGzpUCZ6imZJSnBeQc=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.0/onlyoffice.tar.gz",
-    "version": "10.2.0",
+    "hash": "sha256-FEmYrwYQzNF+6NcCXi+AAUctoD9tq5D/OAOSR4JeOps=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.2.1/onlyoffice.tar.gz",
+    "version": "10.2.1",
     "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -310,9 +320,9 @@
     ]
   },
   "pantry": {
-    "hash": "sha256-jJKOGlbj6fzDpLMFH6JT3ePwddcC4tQMFlDfipb3iRk=",
-    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.32.0/pantry-v0.32.0.tar.gz",
-    "version": "0.32.0",
+    "hash": "sha256-eTPDYvX8/fnbRVeGq1/caGoFqYU9rqvwCiYA4drPVUw=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.34.0/pantry-v0.34.0.tar.gz",
+    "version": "0.34.0",
     "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Shopping mode** turns your lists into a store-by-store trip — pick the lists and the route, check items off as you walk, see which housemates are out shopping, and finish with a priced review that lands in your shopping history.\n- **Barcode scanning** prefills an item from a product's EAN or UPC. Scan with the camera or type the code in, and Pantry looks up the name, category and photo for you to review.\n- **Custom fields** attach your own information to checklist items — an expiry date, an aisle number, a size, a yes/no flag. Define a field once for the house or a single list; date fields can send a reminder before they come due.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile, watch and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619)) | Wear OS ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry)) | [Windows](https://pantry.casraf.dev/docs/getting-started/apps#desktop) | [Linux](https://pantry.casraf.dev/docs/getting-started/apps#desktop)\n\n**Website:** [pantry.casraf.dev](https://pantry.casraf.dev) | **Documentation:** [pantry.casraf.dev/docs](https://pantry.casraf.dev/docs)",
     "homepage": "https://pantry.casraf.dev",
     "licenses": [
@@ -339,6 +349,16 @@
       "agpl"
     ]
   },
+  "previewgenerator": {
+    "hash": "sha256-6QpXxs0CpcbMNhY/N8lCl6L/0kQ8y/AWSIHo/XsyT9k=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.15.0/previewgenerator-v5.15.0.tar.gz",
+    "version": "5.15.0",
+    "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
+    "homepage": "https://github.com/nextcloud/previewgenerator",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "qownnotesapi": {
     "hash": "sha256-6J2o1EBZq1XOBsKAQCBFArsXg07Bvt5h+uL1zp9ddlc=",
     "url": "https://github.com/pbek/qownnotesapi/releases/download/v26.8.0/qownnotesapi-nc.tar.gz",
@@ -349,6 +369,16 @@
       "agpl"
     ]
   },
+  "quota_warning": {
+    "hash": "sha256-0160Np2MXsyPEk0pEArLZHqTBEZI3jZUBKJ+qXMhFfc=",
+    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.25.0/quota_warning-v1.25.0.tar.gz",
+    "version": "1.25.0",
+    "description": "This app sends notifications to users when they reached 85, 90 and 95% of their quota (checked once a day).\nIn addition an email can be sent to the users. The three percentages can be changed in the admin settings.\nIt is also possible to have a link in the email and the notification for upsell options.",
+    "homepage": "https://github.com/nextcloud/quota_warning",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
   "registration": {
     "hash": "sha256-YDSq95WVm6WYwHNcqDWz+QwrvlhbqyCuf6RkD+mcAes=",
     "url": "https://github.com/nextcloud-releases/registration/releases/download/v3.1.0/registration-v3.1.0.tar.gz",
@@ -360,9 +390,9 @@
     ]
   },
   "repod": {
-    "hash": "sha256-PIgadPKon95tkr+Rrnr2MJUQ6IxqKZHpltdxLLp9aUY=",
-    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.2/repod.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-RASx+wMprz5d/ck7oc7ulu03fTt6e2mj5LJRgwF2hCM=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.3.3/repod.tar.gz",
+    "version": "4.3.3",
     "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
     "homepage": "https://git.crystalyx.net/Xefir/repod",
     "licenses": [
@@ -370,9 +400,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-OuP6U21EDgbzZKtmEzHcfWeNFCbM+PPRH/xwnt57hD4=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v12.0.0/richdocuments-v12.0.0.tar.gz",
-    "version": "12.0.0",
+    "hash": "sha256-BjmrDjQTFCp2M0ryDKiMugo1GhHJwH7/oPHrfwWUHyw=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v12.0.1/richdocuments-v12.0.1.tar.gz",
+    "version": "12.0.1",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -390,9 +420,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-evrABcdya5miGVFR6wSlylDCmT2j59QW124A8JTOe0U=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v25.0.0/spreed-v25.0.0.tar.gz",
-    "version": "25.0.0",
+    "hash": "sha256-R/kLtzpCWWI3ZjjRJR3RaCZmIyJl7EgizgYCfvB8b7k=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v25.0.2/spreed-v25.0.2.tar.gz",
+    "version": "25.0.2",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -449,6 +479,16 @@
       "agpl"
     ]
   },
+  "uppush": {
+    "hash": "sha256-aCvBQLJVkdy9ha0NPrJ3008hIyZJ7/dzA7iyjUr/Tes=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.6.1.tar.gz",
+    "version": "2.6.1",
+    "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
     "hash": "sha256-iHkgUEwvDg0FWr1mIl7ntm11b1D+Wjc5d51rLOEIYz8=",
     "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v8.11.0/user_oidc-v8.11.0.tar.gz",
@@ -460,9 +500,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-Veazp5dELWpebb/CdPCHYKoVs+jvyC1sKVY1Zewa3/8=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.3.1/user_saml-v8.3.1.tar.gz",
-    "version": "8.3.1",
+    "hash": "sha256-XlLRU/w5cvfEJtBsybfYFZrFwyAbgx1OLnYyFNU4F5M=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.4.0/user_saml-v8.4.0.tar.gz",
+    "version": "8.4.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index 2e13179282ea..41d222b8e4dc 100644
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -2,6 +2,7 @@
   "app_api" : "agpl3Plus"
 , "bookmarks": "agpl3Plus"
 , "calendar": "agpl3Plus"
+, "calendar_resource_management": "agpl3Only"
 , "checksum": "agpl3Plus"
 , "collectives": "agpl3Plus"
 , "contacts": "agpl3Plus"
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index 06e0a55b8af9..bd0b0a82e964 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -6,13 +6,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "26.09.1";
+  version = "26.10.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-02w+BGrRDEFWLtH6tniiTgs+FHmghiHn9FMxO+U4wrI=";
+    hash = "sha256-Kno14XqXwtG0zWVjrikoXf7eIXo3pj7YbSoQOYUcAI4=";
   };
 
   postInstall = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d625247bf874..a441717c2538 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7096,7 +7096,8 @@ with pkgs;
   cassandra_4 = callPackage ../servers/nosql/cassandra/4.nix {
     # Effective Cassandra 4.0.2 there is full Java 11 support
     #  -- https://cassandra.apache.org/doc/latest/cassandra/new/java11.html
-    jre = pkgs.jdk11_headless;
+    # JDK 11 has no riscv64 port.
+    jre = if stdenv.hostPlatform.isRiscV64 then pkgs.jdk17_headless else pkgs.jdk11_headless;
   };
   cassandra = cassandra_4;