diff --git a/lib/modules.nix b/lib/modules.nix
index 2e5228d232cb..d79382fdcd67 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -722,10 +722,9 @@ let
       # a module will resolve strictly the attributes used as argument but
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
-      context = name: ''while evaluating the module argument `${name}' in "${key}":'';
       extraArgs = mapAttrs (
         name: _:
-        addErrorContext (context name) (
+        addErrorContext ''while evaluating the module argument `${name}' in "${key}":'' (
           args.${name} or (addErrorContext
             "noting that argument `${name}` is not externally provided, so querying `_module.args` instead, requiring `config`"
             config._module.args.${name}
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index bd553409cff6..248f45584e9b 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -386,14 +386,12 @@ in
       moduleParams = lib.mkOption {
         type = lib.types.attrsOf (lib.types.attrsOf lib.types.raw);
         default = { };
-        example = ''
-          {
-            nvidia = {
-              NVreg_UsePageAttributeTable = 1;
-              NVreg_RegistryDwords = "EnableBrightnessControl=1"
-            };
-          }
-        '';
+        example = {
+          nvidia = {
+            NVreg_UsePageAttributeTable = 1;
+            NVreg_RegistryDwords = "EnableBrightnessControl=1";
+          };
+        };
         description = "Additional parameters to pass to the NVIDIA kernel module.";
       };
     };
diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 82e356d419d4..a47829280346 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -189,11 +189,6 @@ in
         wivrn = {
           description = "WiVRn XR runtime service";
           environment = recursiveUpdate {
-            # Default options
-            # https://gitlab.freedesktop.org/monado/monado/-/blob/598080453545c6bf313829e5780ffb7dde9b79dc/src/xrt/targets/service/monado.in.service#L12
-            XRT_COMPOSITOR_LOG = "debug";
-            XRT_PRINT_OPTIONS = "on";
-            IPC_EXIT_ON_DISCONNECT = "off";
             PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
           } cfg.monadoEnvironment;
           # WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,
diff --git a/pkgs/applications/emulators/libretro/cores/fceumm.nix b/pkgs/applications/emulators/libretro/cores/fceumm.nix
index 071ebeeeb398..e3ac9a9e5de9 100644
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-07-28";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "b5e3566515c27dc66c9c20572171673126532e06";
-    hash = "sha256-MnI7SItJcFw8RmpF9BsV3d160azLG7rFmOoZ2DKnyR4=";
+    rev = "236ccdfc911e84c60fea6b9d0699c2d440a8de14";
+    hash = "sha256-BCue1mINcrIjc+45T/JpTyxhW669pUl5HgzoMPbaDj8=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index 0c2631576863..2e07729a8b65 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-08-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "2d7131c5efa606f649d36e1685a8ca47c24f31b3";
-    hash = "sha256-tu/FTJDP+auXCDQ5DUbSLrRyCRdlD3dhPv2/PeBqeAc=";
+    rev = "b7e79b3641eb2e322c5ba29903352e115887e83c";
+    hash = "sha256-aitbT6hRrLd202u1FXMmJvzIwE8E6My3cA2wKEavlO8=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/nxengine.nix b/pkgs/applications/emulators/libretro/cores/nxengine.nix
index d35837fca6fd..8c983c65afac 100644
--- a/pkgs/applications/emulators/libretro/cores/nxengine.nix
+++ b/pkgs/applications/emulators/libretro/cores/nxengine.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nxengine";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nxengine-libretro";
-    rev = "a1c45fd4d045333f4ea523e556469b545be82b0a";
-    hash = "sha256-v7mUr4GeNc/bOe4gQvtPns4/uLA+r7UFGavDdtBNj6E=";
+    rev = "fd1c0686f8b4c0aea9b5addbc077e3ad7da23bb7";
+    hash = "sha256-auignLadG47leMeN6XqIVzs1KEJ+LwLpHO/8ZC+46po=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1efbb2d49223..d37ccfcc6ef6 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1256,13 +1256,13 @@
     "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-zfEZyJyD/yH1lnH1tawrX/FzKhcP4bhZKl2jreQjqR4=",
+    "hash": "sha256-CgsA+mw+8EXbDMO7t897B2Xa19o2naW2gu6qDSKrAeA=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.240.0",
+    "rev": "v1.241.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gAYHmSFGNEAm/LhouWlQtLFra2ZSsacR/PjrSQxTfR0="
+    "vendorHash": "sha256-o7DX6kQgt5+qNbZO3o8TfE8H/wT/8V5kZIuyT9z7+J0="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",
@@ -1274,13 +1274,13 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic_sumologic": {
-    "hash": "sha256-GzVXWyFQ9k6a8o7faKpAcRGj8M4NQxVLY8iw1iGFM1w=",
+    "hash": "sha256-Ql3Bc9C83IpINqkTtiZAK5kV0DvnsgpSXg5EKLjyXBs=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.3.0",
+    "rev": "v3.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
+    "vendorHash": "sha256-h3hQfJsyvq6yv/sQAjA+9kPHHrejaF+NyBHFdchLHoA="
   },
   "sysdiglabs_sysdig": {
     "hash": "sha256-MfwzmTzikzZAg0U7W5Dmjww6Oadnr4Oq+uIQSZaRHEo=",
diff --git a/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix b/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
new file mode 100644
index 000000000000..b68d3ac8fa08
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  cmake,
+  fetchFromGitLab,
+  stdenv,
+  libzint,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zxing-cpp";
+  # Version taken from CMakeLists.txt - likely not actively updated
+  version = "1.4.0-unstable-2026-08-08";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.linphone.org";
+    group = "BC";
+    owner = "public/external";
+    repo = "zxing-cpp";
+    rev = "722123ad0cadee0e4c313f80eac5162a9f8d7d73";
+    sha256 = "sha256-GhrrIk2Kph6H5qs0g01b98F1Xzh/6vCS3+p+q0mhqcQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libzint
+  ];
+
+  cmakeFlags = [
+    "-DZXING_BLACKBOX_TESTS=OFF"
+    "-DZXING_DEPENDENCIES=LOCAL"
+    "-DZXING_EXAMPLES=OFF"
+    "-DZXING_USE_BUNDLED_ZINT=OFF"
+  ];
+
+  # The BC fork's zxing.pc.in joins @CMAKE_INSTALL_LIBDIR@/INCLUDEDIR@ onto a
+  # hardcoded "/" prefix, and never includes GNUInstallDirs, causing us to run into
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '# PC file generation.' 'include (GNUInstallDirs)'
+    substituteInPlace zxing.pc.in \
+      --replace-fail 'libdir=''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@' 'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' 'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+  '';
+
+  meta = {
+    homepage = "https://gitlab.linphone.org/BC/public/external/zxing-cpp";
+    description = "BelledonneCommunications' fork of zxing-cpp";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ naxdy ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 814437cdac2a..96d1cc091726 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -8,8 +8,8 @@ makeScopeWithSplicing' {
   extra = self: {
     mkLinphoneDerivation = self.mk-linphone-derivation;
 
-    linphoneSdkVersion = "5.4.85";
-    linphoneSdkHash = "sha256-mdJDCuCaZlcQ92P6oMgH/8iWgm8hGz8gTVUilC+yaSU=";
+    linphoneSdkVersion = "5.5.13";
+    linphoneSdkHash = "sha256-RsSMLO7wZ7azWF7/KcERkd5et73w0kUZpwsqj9QxZgc=";
   };
   f =
     self:
diff --git a/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
index 41c7c5239a35..0a3c4b5a33a4 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
@@ -11,7 +11,7 @@
   python3,
   sqlite,
   xercesc,
-  zxing-cpp,
+  bc-zxing-cpp,
   mkLinphoneDerivation,
 }:
 mkLinphoneDerivation {
@@ -39,7 +39,7 @@ mkLinphoneDerivation {
     libxml2
     sqlite
     xercesc
-    zxing-cpp
+    bc-zxing-cpp
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
index 5f3d4de66b5a..3099c238c81c 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
@@ -3,6 +3,7 @@
   bc-soci,
   bctoolbox,
   belcard,
+  cacert,
   belle-sip,
   belr,
   boost,
@@ -40,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linphone-desktop";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.linphone.org";
@@ -48,13 +49,17 @@ stdenv.mkDerivation (finalAttrs: {
     group = "BC";
     repo = "linphone-desktop";
     tag = finalAttrs.version;
-    hash = "sha256-jCnovCFdPJExD0+ZLhU9np1R5uN+mPlSPi/Nb1aOD0U=";
+    hash = "sha256-JtNYeMu174afzuWSVIuLyI5M16iC5XGr2qTcTsixRg8=";
   };
 
   patches = [
     ./do-not-override-install-prefix.patch
     ./do-not-manually-compute-sdk-version.patch
     ./always-install-desktop-files.patch
+    ./use-absolute-resource-paths.patch
+    # Linphone creates a broken desktop file.
+    # See: https://github.com/NixOS/nixpkgs/issues/551204
+    ./no-user-desktop-file.patch
 
     # .mkv recordings are broken in NixOS and other distros (see
     # https://github.com/NixOS/nixpkgs/issues/219551), and simply changing the
@@ -79,8 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
     minizip-ng
     qt6Packages.qtbase
     qt6Packages.qtnetworkauth
+    qt6Packages.qtkeychain
     zxing-cpp
     boost
+    cacert
 
     python3Packages.pystache
     python3Packages.six
@@ -103,9 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
 
-    # Requires EQt5Keychain
-    "-DENABLE_QT_KEYCHAIN=OFF"
-
     "-DCMAKE_INSTALL_BINDIR=bin"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_LIBDIR=lib"
@@ -114,7 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DLINPHONEAPP_INSTALL_PREFIX=${placeholder "out"}"
     "-DLINPHONE_QML_DIR=${placeholder "out"}/${qt6Packages.qtbase.qtQmlPrefix}/ui"
     "-DLINPHONESDK_VERSION=${linphoneSdkVersion}"
-    "-DENABLE_APP_PACKAGE_ROOTCA=OFF"
 
     # normally set by the custom find modules, which we have disabled
     "-DLibLinphone_TARGET=liblinphone"
@@ -155,6 +158,12 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${mediastreamer2}/lib/mediastreamer/plugins/* $out/lib/mediastreamer/plugins/
     ln -s ${grammars} $out/share/belr/grammars
 
+    # linphone looks for the TLS root CA bundle at `<dataResourcesDir>/rootca.pem`
+    # (with `<dataResourcesDir>` made absolute by `use-absolute-resource-paths.patch`).
+    # Provide nixpkgs' cacert bundle there instead of shipping the stale one
+    # bundled with linphone-sdk.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/share/linphone/rootca.pem
+
     mkdir -p $out/share/sounds/linphone/
     ln -s ${liblinphone}/share/sounds/linphone/rings $out/share/sounds/linphone/rings
 
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
new file mode 100644
index 000000000000..5971a5e306c9
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
@@ -0,0 +1,19 @@
+diff --git a/Linphone/core/App.cpp b/Linphone/core/App.cpp
+index 315632d..78eba8b 100644
+--- a/Linphone/core/App.cpp
++++ b/Linphone/core/App.cpp
+@@ -1567,14 +1567,7 @@ QString App::getApplicationPath() const {
+ }
+ 
+ void App::exportDesktopFile() {
+-	QDir dir(ApplicationsDirectory);
+-	if (!dir.exists() && !dir.mkpath(ApplicationsDirectory)) {
+-		qWarning() << QStringLiteral("Unable to build applications dir path: `%1`.").arg(ApplicationsDirectory);
+-		return;
+-	}
+-
+ 	const QString confPath(ApplicationsDirectory + EXECUTABLE_NAME ".desktop");
+-	if (generateDesktopFile(confPath, true, false)) generateDesktopFile(confPath, false, false);
+ }
+ 
+ bool App::generateDesktopFile(const QString &confPath, bool remove, bool openInBackground) {
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
new file mode 100644
index 000000000000..2a617fbb6028
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
@@ -0,0 +1,38 @@
+diff --git a/Linphone/core/path/Paths.cpp b/Linphone/core/path/Paths.cpp
+index 33449dc..734ba51 100644
+--- a/Linphone/core/path/Paths.cpp
++++ b/Linphone/core/path/Paths.cpp
+@@ -115,7 +115,6 @@ static inline QDir getAppPackageDir() {
+ }
+ 
+ static inline QString getAppPackageDataDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ #ifdef __APPLE__
+ 	if (!dir.cd("Resources")) {
+@@ -127,22 +126,17 @@ static inline QString getAppPackageDataDirPath() {
+ 		dir.mkdir("share");
+ 		dir.cd("share");
+ 	}
+-	lInfo() << executableDir.absolutePath() << " VS " << dir.absolutePath()
+-	        << " == " << executableDir.relativeFilePath(dir.absolutePath());
+-	return executableDir.relativeFilePath(dir.absolutePath());
++	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackageMsPluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ 	dir.cd(MSPLUGINS_DIR);
+-	return executableDir.relativeFilePath(dir.absolutePath());
++	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackagePluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+-	QDir packageDir = getAppPackageDir();
+-	return executableDir.relativeFilePath(packageDir.absolutePath() + Constants::PathPlugins);
++	return getAppPackageDir().absolutePath() + Constants::PathPlugins;
+ }
+ 
+ static inline QString getAppBinDirPath() {
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index cc897aaa19f7..bcef2bedde09 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -119,13 +119,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "2ship2harkinian";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "HarbourMasters";
     repo = "2ship2harkinian";
     tag = finalAttrs.version;
-    hash = "sha256-lx5+i/S+deWB6iYTTrUOffQfB6qnUvDZrU80NWyqb2Y=";
+    hash = "sha256-+8c6AolEjM7VDhlNTnMRoQMLze4DssARlHl33nJ1zM8=";
     fetchSubmodules = true;
     deepClone = true;
     postFetch = ''
diff --git a/pkgs/by-name/am/amazon-ssm-agent/package.nix b/pkgs/by-name/am/amazon-ssm-agent/package.nix
index c75468bbd184..d72198e8c88e 100644
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@@ -43,13 +43,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "amazon-ssm-agent";
-  version = "3.3.5068.0";
+  version = "3.3.5226.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     tag = finalAttrs.version;
-    hash = "sha256-gZDYspw/SnE2lMCjfQbkdWldsc5vi9dGMQ4KX643j3g=";
+    hash = "sha256-iFk5wlcw6wnc3AjCdhFXxyNrCTdAWQNIYDFis2yTIlY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ap/aptakube/package.nix b/pkgs/by-name/ap/aptakube/package.nix
index 792507ac2a29..ce7e6ca3c029 100644
--- a/pkgs/by-name/ap/aptakube/package.nix
+++ b/pkgs/by-name/ap/aptakube/package.nix
@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation (
     sources = {
       aarch64-darwin = {
         name = "Aptakube_${finalAttrs.version}_universal.dmg";
-        hash = "sha256-JWDwsvqZnEQc6Ne+aC2WbdMaEO20f8AEK7SlC3lEzUk=";
+        hash = "sha256-SgkLQ4dHEja58EDTHs6qi7CGw6mT3tKPNQxS2LKDHn0=";
       };
       x86_64-linux = {
         name = "aptakube_${finalAttrs.version}_amd64.deb";
-        hash = "sha256-JooC/fwy1zaIU2UAmDooejEbBmCChVrJ2rTsn0M8WaI=";
+        hash = "sha256-I0QkI/utkEck3WiDt9NtN5zwqfPX2GJCx4PUzLnCE58=";
       };
     };
 
@@ -42,7 +42,7 @@ stdenvNoCC.mkDerivation (
   in
   {
     pname = "aptakube";
-    version = "1.18.8";
+    version = "1.19.3";
 
     __structuredAttrs = true;
     strictDeps = true;
diff --git a/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch b/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
new file mode 100644
index 000000000000..ea2add6f675d
--- /dev/null
+++ b/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
@@ -0,0 +1,19 @@
+diff --git a/borkdude/deps.clj b/borkdude/deps.clj
+index 281ead5..ab8dd7a 100755
+--- a/borkdude/deps.clj
++++ b/borkdude/deps.clj
+@@ -773,6 +773,14 @@ public class ClojureToolsDownloader {
+   Otherwise, use `DEPS_CLJ_TOOLS_DIR`"
+   []
+   (or
++   ;; The default (wrapped) babashka derivation sets `NIX_DEPS_CLJ_TOOLS_DIR` to a nix-store path.
++   ;; We use this custom variable here instead of the upstream `DEPS_CLJ_TOOLS_DIR` so that we don't
++   ;; affect subprocesses spawned by babashka which may themselves use `deps.clj`. Furthermore, we
++   ;; don't use the custom variable when `DEPS_CLJ_TOOLS_VERSION` is set because `deps.clj` would
++   ;; then try to store the desired tools version in the nix-store path which would of course fail
++   ;; because it's read-only (see https://github.com/NixOS/nixpkgs/issues/431312).
++   (when-not (*getenv-fn* "DEPS_CLJ_TOOLS_VERSION")
++     (*getenv-fn* "NIX_DEPS_CLJ_TOOLS_DIR"))
+     ;; legacy name
+    (*getenv-fn* "CLOJURE_TOOLS_DIR")
+    (*getenv-fn* "DEPS_CLJ_TOOLS_DIR")
diff --git a/pkgs/by-name/ba/babashka-unwrapped/package.nix b/pkgs/by-name/ba/babashka-unwrapped/package.nix
index cf4e9c77f06f..f7f2d70642af 100644
--- a/pkgs/by-name/ba/babashka-unwrapped/package.nix
+++ b/pkgs/by-name/ba/babashka-unwrapped/package.nix
@@ -4,6 +4,8 @@
   fetchurl,
   writeScript,
   installShellFiles,
+  unzip,
+  zip,
 }:
 
 buildGraalvmNativeImage (finalAttrs: {
@@ -15,7 +17,24 @@ buildGraalvmNativeImage (finalAttrs: {
     sha256 = "sha256-cVcfEt7OVKHG3I9ZSEk6mU5ULKAXJYsEEBD2D4SUZxc=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    unzip
+    zip
+  ];
+
+  dontUnpack = false;
+  unpackCmd = "unzip -d babashka $curSrc";
+
+  patches = [
+    ./default-tools-dir.patch
+  ];
+
+  preBuild = ''
+    zip -r ../babashka.jar .
+    cd ..
+    src=babashka.jar
+  '';
 
   extraNativeImageBuildArgs = [
     "-H:+ReportExceptionStackTraces"
diff --git a/pkgs/by-name/ba/babashka/package.nix b/pkgs/by-name/ba/babashka/package.nix
index 64e5a1694f03..4954e9d20e70 100644
--- a/pkgs/by-name/ba/babashka/package.nix
+++ b/pkgs/by-name/ba/babashka/package.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     makeWrapper "${babashka-unwrapped}/bin/bb" "$out/bin/bb" \
       --inherit-argv0 \
-      --set-default DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
+      --set NIX_DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
       --set-default JAVA_HOME ${jdkBabashka}
 
     installShellCompletion --cmd bb --bash ${babashka-unwrapped}/share/bash-completion/completions/bb.bash
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index f8ac2e9b512d..a89b95864abd 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -119,12 +119,12 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-V2+Oc7GT31JvWccffzUaingEs8CtSFaazgQ+YdZUB7M=";
+    hash = "sha256-LXdJZDJoO9/yjkxn6qT42jv0YRpiwCiIWWGKubs3VLI=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ca/cargo-zigbuild/package.nix b/pkgs/by-name/ca/cargo-zigbuild/package.nix
index e8327d1ba95f..afaf16c272a6 100644
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
-  version = "0.23.0";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-zigbuild";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y73aPGsrSAZVxNJ1r1lS9uXmfpAwthq6NW4urKS8ab0=";
+    hash = "sha256-Woa8lcx9D5U2NyxHqLE9nIkgtvLc35lo+H+Cp+NOHKg=";
   };
 
-  cargoHash = "sha256-dt2s18B9RVwEBlun5cegoqfW1KYXFqjdScdc/Q2aDlI=";
+  cargoHash = "sha256-Q/Hf9fHxA/3EhnbWapyMak4nyZt/5HTL8osE7Nit6g0=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/cr/crossmacro/package.nix b/pkgs/by-name/cr/crossmacro/package.nix
index bf9deb781197..efaadbb500d8 100644
--- a/pkgs/by-name/cr/crossmacro/package.nix
+++ b/pkgs/by-name/cr/crossmacro/package.nix
@@ -4,6 +4,8 @@
   dotnetCorePackages,
   fetchFromGitHub,
   installShellFiles,
+  clang,
+  autoPatchelfHook,
   nix-update-script,
   fontconfig,
   freetype,
@@ -23,33 +25,43 @@
   icu,
   openssl,
   zlib,
+  pipewire,
 }:
 
 buildDotnetModule rec {
   pname = "crossmacro";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "alper-han";
     repo = "CrossMacro";
     tag = "v${version}";
-    hash = "sha256-lMXp7ItwpZ14ATRKuR7Q8/FhfMNQ+YCgHL13oj6iBNs=";
+    hash = "sha256-2L25A2OO2Ju6n1QlblNBtKva1PfbidFz/QESjLBVuSU=";
   };
 
   projectFile = "src/CrossMacro.UI.Linux/CrossMacro.UI.Linux.csproj";
   nugetDeps = ./deps.json;
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
-  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+  dotnet-runtime = null;
 
   executables = [ "CrossMacro.UI" ];
   buildType = "Release";
+  selfContainedBuild = true;
 
   dotnetFlags = [
-    "-p:SelfContained=false"
+    "-p:PublishAot=true"
+    "-p:PublishReadyToRun=false"
+    "-p:OptimizationPreference=Speed"
+    "-p:StripSymbols=true"
+    "-p:IlcTrimMetadata=true"
+    "-p:DebugType=None"
+    "-p:DebugSymbols=false"
     "-p:Version=${version}"
   ];
 
+  buildInputs = runtimeDeps;
+
   runtimeDeps = [
     zlib
     icu
@@ -69,14 +81,21 @@ buildDotnetModule rec {
     libglvnd
     wayland
     libxkbcommon
+    pipewire
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    clang
+    autoPatchelfHook
+  ];
 
   postInstall = ''
     installManPage docs/man/crossmacro.1
 
     install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
+    substituteInPlace $out/share/applications/crossmacro.desktop \
+      --replace-fail "Exec=crossmacro" "Exec=$out/lib/crossmacro/CrossMacro.UI"
 
     for size in 16 32 48 64 128 256 512; do
       install -Dm644 src/CrossMacro.UI/Assets/icons/''${size}x''${size}/apps/crossmacro.png \
@@ -85,9 +104,28 @@ buildDotnetModule rec {
 
     install -Dm644 scripts/assets/io.github.alper-han.CrossMacro.metainfo.xml \
       $out/share/metainfo/io.github.alper-han.CrossMacro.metainfo.xml
+  '';
 
-    mkdir -p $out/bin
-    ln -sf $out/bin/CrossMacro.UI $out/bin/crossmacro
+  postFixup = ''
+    # Align wrapper and ELF paths so KWin's strict /proc/<pid>/exe check grants Wayland permissions.
+    # Move the real ELF binary to .CrossMacro.UI-wrapped
+    mv $out/lib/crossmacro/CrossMacro.UI \
+       $out/lib/crossmacro/.CrossMacro.UI-wrapped
+
+    # Move the buildDotnetModule wrapper from bin/ into lib/ so
+    # its path matches what KWin resolves after unwrapping.
+    mv $out/bin/CrossMacro.UI $out/lib/crossmacro/CrossMacro.UI
+
+    # Update the wrapper's exec target to the renamed binary
+    substituteInPlace $out/lib/crossmacro/CrossMacro.UI \
+      --replace-fail \
+        "\"$out/lib/crossmacro/CrossMacro.UI\"" \
+        "\"$out/lib/crossmacro/.CrossMacro.UI-wrapped\""
+
+    # Point bin/ entries at the lib/ wrapper
+    rm -f $out/bin/crossmacro
+    ln -s $out/lib/crossmacro/CrossMacro.UI $out/bin/CrossMacro.UI
+    ln -s $out/bin/CrossMacro.UI $out/bin/crossmacro
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ct/ctx7/package.nix b/pkgs/by-name/ct/ctx7/package.nix
index 86afcd891849..aade8b81c023 100644
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.8";
+  version = "0.5.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-ocO8tXxooMIOWuCTpSgORRg4hjMs0o0uoBxEkaNKCu8=";
+    hash = "sha256-QBVy3KkZLuSe7sDu/im1upxLwkEG8kg3Ef8Qo761Qc4=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-F3c2/y3fgtPiUQOsg3hFdAp9b85AFs2mCTO1Eoa0i5E=";
+    hash = "sha256-1ZrQ+GMGgBNyycp/Xp2/meGwxaWTh+c53qgaEy30dl8=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 5c85cf498f10..cb6d6ffe5c46 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -1,24 +1,24 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
   versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.46.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "DNSControl";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pckjHak61FyPV6YikUwvIAVP2NeLMUtGqn0utXaly4w=";
+    hash = "sha256-axFNUudghfk0H9U33igg60rTZd1L3leeMtIq8PWojfs=";
   };
 
-  vendorHash = "sha256-MhF/ZUPj3slDD9Pn3j4Gy0WT3iGHlF7o7sMjo6DS+y8=";
+  vendorHash = "sha256-j7OjDUDHmH2RdipzuqH5hJUUKuVe5Ij2IX1zeI/Ldm4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/du/dusklight/package.nix b/pkgs/by-name/du/dusklight/package.nix
index 7b02a5045432..8d3088368eb9 100644
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -52,7 +52,7 @@ let
       };
       aarch64-linux = {
         url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-aarch64.tar.gz";
-        hash = "sha256-C9pMaUOkSknwQfIw45+WIFve+noTiqud+RiQ0/kV4fA=";
+        hash = "sha256-EiNj16S0sIOWzOByiecsl2bZScBA5MOK348sqyxDchc=";
       };
     }
     .${stdenv.hostPlatform.system}
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 0ecd436e621c..094111c60555 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  electron_41,
+  electron_43,
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -15,28 +15,25 @@
   makeDesktopItem,
   nix-update-script,
   webVersion ? false,
+  nixosTests,
 }:
 let
+  electron = electron_43;
+
+  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
+  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+in
+buildNpmPackage (finalAttrs: {
   pname = "feishin";
   version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
   };
 
-  electron = electron_41;
-
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
-in
-buildNpmPackage {
-  inherit pname version;
-
-  inherit src;
-
   __structuredAttrs = true;
 
   npmConfigHook = pnpmConfigHook;
@@ -44,9 +41,9 @@ buildNpmPackage {
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit pnpm;
+    inherit (finalAttrs)
       pname
-      pnpm
       version
       src
       ;
@@ -145,12 +142,19 @@ buildNpmPackage {
     })
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+
+    # add a tests
+    tests = {
+      inherit (nixosTests.feishin) caddy nginx;
+    };
+  };
 
   meta = {
     description = "Full-featured Jellyfin, Navidrome, and OpenSubsonic Compatible Music Player";
     homepage = "https://github.com/jeffvli/feishin";
-    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${version}";
+    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${finalAttrs.version}";
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
@@ -161,4 +165,4 @@ buildNpmPackage {
     ];
   }
   // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
-}
+})
diff --git a/pkgs/by-name/gl/glpaper/package.nix b/pkgs/by-name/gl/glpaper/package.nix
index 7bb9373346c5..428df6b30021 100644
--- a/pkgs/by-name/gl/glpaper/package.nix
+++ b/pkgs/by-name/gl/glpaper/package.nix
@@ -12,14 +12,17 @@
 
 stdenv.mkDerivation {
   pname = "glpaper";
-  version = "unstable-2024-08-07";
+  version = "0-unstable-2024-08-07";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromSourcehut {
     owner = "~scoopta";
     repo = "glpaper";
     vc = "hg";
     rev = "af9827d20bfe1956dd88fb2202b38ed0de705305";
-    sha256 = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
+    hash = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
   };
 
   # nop() is used as a typed Wayland callback stub, which GCC 15 rejects as an error.
diff --git a/pkgs/by-name/go/go-mockery/package.nix b/pkgs/by-name/go/go-mockery/package.nix
index b772637d43e6..7a579be39ef4 100644
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-mockery";
-  version = "3.7.2";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lPyoWjLaRhE4SpVahJd8T3LsCyfdFMIsuxmWODRoLL0=";
+    hash = "sha256-2KhyuS6k8EyPnEVunAIamGJgePmvDVJqSyN0UlAFyvQ=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-izMi4MqbfKX1PmNMWyCwBOWqiPZfth/ZSzsuEcTN6Pg=";
+  vendorHash = "sha256-ockGzV+nj/O6iRcscmhfx220TqJ8LACER/pOPqs21tY=";
 
   ldflags = [
     "-s"
@@ -28,7 +28,14 @@ buildGoModule (finalAttrs: {
     "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/internal/logging.SemVer=v${finalAttrs.version}"
   ];
 
-  env.CGO_ENABLED = 0;
+  env = {
+    CGO_ENABLED = 0;
+
+    # go.work pulls ./tools into the workspace, which raises mockery's own
+    # dependencies to the tools build list. Build and test against go.mod
+    # alone, matching what upstream's Taskfile does.
+    GOWORK = "off";
+  };
 
   subPackages = [ "." ];
 
@@ -45,12 +52,25 @@ buildGoModule (finalAttrs: {
   prePatch = ''
     # remove test.ci's dependency on lint since we don't need it and
     # it tries to use remote golangci-lint
+    #
     # remove test.ci's git-state check, which runs `git diff --exit-code`;
     # the source has no .git directory, so the check cannot work here
+    #
+    # use gotestsum from nativeCheckInputs rather than building it from the
+    # tools module, which would need network access
     substituteInPlace Taskfile.yml \
       --replace-fail "deps: [lint]" "" \
       --replace-fail "      - task: git-state" "" \
-      --replace-fail "go run gotest.tools/gotestsum" "gotestsum"
+      --replace-fail "    deps: [tools.gotestsum]" "" \
+      --replace-fail "./tools/gotestsum{{exeExt}}" "gotestsum"
+
+    # the e2e scripts reach go-task through the workspace, which GOWORK=off
+    # rules out; use go-task from nativeCheckInputs instead
+    substituteInPlace \
+      e2e/test_mockery_generation.sh \
+      e2e/test_infinite_mocking.sh \
+      e2e/test_missing_interface/run.sh \
+      --replace-fail "go run github.com/go-task/task/v3/cmd/task" "task"
 
     # patch scripts used in e2e testing
     patchShebangs e2e
diff --git a/pkgs/by-name/go/gogup/package.nix b/pkgs/by-name/go/gogup/package.nix
index f5527f225da4..dc350416c490 100644
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogup";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kit/xnnkhY7N98QK4KSPW3K+mKTfttv5sHW5By4nd68=";
+    hash = "sha256-3GOdORigV+5pqFySnlsL/ZOUqAIFQicfDCzeOCFa+A0=";
   };
 
   vendorHash = "sha256-qYMUIy9yvWAedA2fL0KKoysaHHoKFJnzl58pInXpa60=";
diff --git a/pkgs/by-name/gr/graphify/package.nix b/pkgs/by-name/gr/graphify/package.nix
index 5cfe4c272b01..8e44e286cbf1 100644
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
   __structuredAttrs = true;
   pname = "graphify";
-  version = "0.9.42";
+  version = "0.9.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     tag = "v${version}";
-    hash = "sha256-QXdjA+xSgh6I+A2snvlaigHG2FQJWoFWIYQJfCmshGQ=";
+    hash = "sha256-gcQ8isXZQu/VQkK74vAaOKnbNdsxiez+TSZdRUxEMiA=";
   };
 
   build-system = [
@@ -77,6 +77,9 @@ python3Packages.buildPythonApplication rec {
     chinese = [
       jieba
     ];
+    commonlisp = [
+      tree-sitter-grammars.tree-sitter-commonlisp
+    ];
     leiden = [
       graspologic
     ];
diff --git a/pkgs/by-name/gu/guile-xcb/package.nix b/pkgs/by-name/gu/guile-xcb/package.nix
index 26f83441f1b9..a64596300840 100644
--- a/pkgs/by-name/gu/guile-xcb/package.nix
+++ b/pkgs/by-name/gu/guile-xcb/package.nix
@@ -10,7 +10,10 @@
 
 stdenv.mkDerivation {
   pname = "guile-xcb";
-  version = "unstable-2017-05-29";
+  version = "1.3-unstable-2017-05-28";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "mwitmer";
@@ -21,11 +24,12 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoreconfHook
+    guile_2_2
     pkg-config
+    texinfo
   ];
   buildInputs = [
     guile_2_2
-    texinfo
   ];
 
   configureFlags = [
diff --git a/pkgs/by-name/ho/hockeypuck/package.nix b/pkgs/by-name/ho/hockeypuck/package.nix
index 6b726bda99b4..96f52efedbe1 100644
--- a/pkgs/by-name/ho/hockeypuck/package.nix
+++ b/pkgs/by-name/ho/hockeypuck/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hockeypuck";
-  version = "2.3.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "hockeypuck";
     repo = "hockeypuck";
     rev = finalAttrs.version;
-    sha256 = "sha256-1AOvtAvx2OFxjJE5YhZwqdm9G8mWgS0hKPdTctU2MV4=";
+    sha256 = "sha256-EyXLOttABKMFKjXD/L1tXx7kvO2TEy2VZT8SIZJeLsI=";
   };
 
   modRoot = "src/hockeypuck/";
diff --git a/pkgs/by-name/i2/i2pd/package.nix b/pkgs/by-name/i2/i2pd/package.nix
index a99f43feac93..b58cfdb949b6 100644
--- a/pkgs/by-name/i2/i2pd/package.nix
+++ b/pkgs/by-name/i2/i2pd/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2pd";
-  version = "2.60.0";
+  version = "2.61.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = "i2pd";
     tag = finalAttrs.version;
-    hash = "sha256-oVC31GpygznXbmjQ3qv3XZ58jZ9l6ibBoueuBM5Hk0M=";
+    hash = "sha256-dfCeY64TGRoTMNvKZk5jrhyRc8b8K03KM7YV5w/pbUM=";
   };
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
diff --git a/pkgs/by-name/ja/jami/package.nix b/pkgs/by-name/ja/jami/package.nix
index 390117e2f64c..fb89a3267759 100644
--- a/pkgs/by-name/ja/jami/package.nix
+++ b/pkgs/by-name/ja/jami/package.nix
@@ -9,8 +9,6 @@
   ninja,
 
   # for daemon
-  autoreconfHook,
-  perl, # for pod2man
   alsa-lib,
   asio,
   dbus,
@@ -30,6 +28,7 @@
   openssl,
   restinio,
   secp256k1,
+  simdutf,
   speex,
   udev,
   webrtc-audio-processing_0_3,
@@ -64,21 +63,27 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20251124.0";
+  version = "20260811.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-IQA6V0Sl+xhuit9kySpsSAS/a0GOsiT+ysYET91/gmc=";
+    hash = "sha256-6MywBm2kT1VJmgHEGKifcrHxG08s53fqfPYSfsFxgFk=";
     fetchSubmodules = true;
   };
 
   patches = [
     (fetchpatch {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/0ecbaf3b101bbdd0d4a06b06f3ce1ff654abf0b5/fix-link.patch";
-      hash = "sha256-VsQbOPHyNFcRhpae+9UCaUJdHH8bMGf3ZIAW3RKiu6k=";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/20260717.0-2/zxing-cpp-3.patch";
+      hash = "sha256-fTGrsdeC3kN277DvSuKyR5fMZhtBmk1nsL2BbeHYjTY=";
+    })
+    (fetchpatch {
+      # Fix for Qt 6.11
+      url = "https://git.jami.net/savoirfairelinux/jami-client-qt/-/commit/b97eb85af48b36008a9d619077965d6284660031.patch";
+      hash = "sha256-2gY4cqWg5FY6Q6j6V/x3IMWN3AP8RThjZdxYI+ktLI4=";
+      revert = true;
     })
   ];
 
@@ -88,8 +93,8 @@ stdenv.mkDerivation rec {
     src = fetchFromGitHub {
       owner = "savoirfairelinux";
       repo = "pjproject";
-      rev = "93dc96918bb6ba74e1e1d00c40c80402e856f2ac";
-      hash = "sha256-wsbKa3TXqj+nQMtAaEAD0Zh248QdNMhKnIOnq08MPI0=";
+      rev = "3a92a7ee340dbc1f4730fcaf32acac9a54cacf1b";
+      hash = "sha256-luW1lZ+QrOXBVyaWjGCesSnI8tNDBLmAiqUtTjNmRN8=";
     };
 
     configureFlags = [
@@ -127,14 +132,14 @@ stdenv.mkDerivation rec {
 
   dhtnet = stdenv.mkDerivation {
     pname = "dhtnet";
-    version = "unstable-2025-11-10";
+    version = "unstable-2026-08-11";
 
     src = fetchFromGitLab {
       domain = "git.jami.net";
       owner = "savoirfairelinux";
       repo = "dhtnet";
-      rev = "03c6ce608daf906fc98b82f114b61ebfdeae5dc6";
-      hash = "sha256-VTciKJ1IYtQopdV/TpnuB3T2tipcQjjKDlh2cKGDtRQ=";
+      rev = "11f916f2cccba068a48d2fd6ed6f02407d95b7ce";
+      hash = "sha256-Ly3LvKqbvvA6FQTEwJKv1St+RvyaLIPQiY2MvPLvgaw=";
     };
 
     postPatch = ''
@@ -165,7 +170,8 @@ stdenv.mkDerivation rec {
     ];
 
     cmakeFlags = [
-      "-DBUILD_SHARED_LIBS=Off"
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DCMAKE_CXX_STANDARD=20"
       "-DBUILD_BENCHMARKS=Off"
       "-DBUILD_TOOLS=Off"
       "-DBUILD_TESTING=Off"
@@ -181,56 +187,11 @@ stdenv.mkDerivation rec {
     };
   };
 
-  daemon = stdenv.mkDerivation {
-    pname = "jami-daemon";
-    inherit src version meta;
-    sourceRoot = "${src.name}/daemon";
-
-    nativeBuildInputs = [
-      autoreconfHook
-      pkg-config
-      perl
-    ];
-
-    buildInputs = [
-      alsa-lib
-      asio
-      dbus
-      dhtnet
-      sdbus-cpp_2
-      fmt
-      ffmpeg_6
-      gmp
-      gnutls
-      llhttp
-      libjack2
-      jsoncpp
-      libarchive
-      libgit2
-      libnatpmp
-      libpulseaudio
-      libupnp
-      msgpack-cxx
-      opendht-jami
-      openssl
-      pjsip-jami
-      restinio
-      secp256k1
-      speex
-      udev
-      webrtc-audio-processing_0_3
-      yaml-cpp
-      zlib
-    ];
-
-    enableParallelBuilding = true;
-  };
-
   qwindowkit-src = fetchFromGitHub {
-    owner = "stdware";
+    owner = "atraczyk";
     repo = "qwindowkit";
-    rev = "0131d673092ab18afd69fac84f4a17ad2ba615f2";
-    hash = "sha256-jajgLOj0h/byt3+fSbCpV3VPUoHxijUsKw/0BOwbXTw=";
+    rev = "c5c7da2163dfcba144e09a905ee98f920d9d94e7";
+    hash = "sha256-G7vX1zPrs+rKCrXNNZ5Lt7agK3hag13c4s61h53ExPE=";
     fetchSubmodules = true;
   };
 
@@ -239,15 +200,10 @@ stdenv.mkDerivation rec {
     cp -R --no-preserve=mode,ownership ${qwindowkit-src} qwindowkit
     substituteInPlace CMakeLists.txt \
       --replace-fail 'add_subdirectory(3rdparty/zxing-cpp EXCLUDE_FROM_ALL)' 'find_package(ZXing)'
-    sed -i -e '/pkg_check_modules/i FIND_PACKAGE(PkgConfig REQUIRED)' src/libclient/CMakeLists.txt
   '';
 
   preConfigure = ''
     echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
-    # Currently the daemon is still built seperately but jami expects it in CMAKE_INSTALL_PREFIX
-    # This can be removed in future versions when JAMICORE_AS_SUBDIR is on
-    mkdir -p $out
-    ln -s ${daemon} $out/daemon
   '';
 
   dontWrapGApps = true;
@@ -264,13 +220,41 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    alsa-lib
+    asio
+    dbus
+    dhtnet
+    fmt
     ffmpeg_6
+    gmp
+    gnutls
     html-tidy
     hunspell
+    jsoncpp
+    llhttp
+    libjack2
+    libarchive
+    libgit2
+    libnatpmp
     libnotify
+    libpulseaudio
+    libupnp
     md4c
+    msgpack-cxx
     networkmanager
+    opendht-jami
+    openssl
+    pjsip-jami
     qrencode
+    restinio
+    sdbus-cpp_2
+    secp256k1
+    simdutf
+    speex
+    udev
+    webrtc-audio-processing_0_3
+    yaml-cpp
+    zlib
     zxing-cpp
   ]
   ++ (
@@ -280,6 +264,7 @@ stdenv.mkDerivation rec {
       qt5compat
       qtnetworkauth
       qtdeclarative
+      qthttpserver
       qtmultimedia
       qtpositioning
       qtsvg
@@ -289,11 +274,11 @@ stdenv.mkDerivation rec {
   );
 
   cmakeFlags = [
-    (lib.cmakeBool "JAMICORE_AS_SUBDIR" false)
     (lib.cmakeBool "DWITH_WEBENGINE" withWebengine)
-    "-DLIBJAMI_INCLUDE_DIRS=${daemon}/include/jami"
   ];
 
+  env.NIX_LDFLAGS = "-lz";
+
   qtWrapperArgs = [
     # With wayland the titlebar is not themed and the wmclass is wrong.
     "--set-default QT_QPA_PLATFORM xcb"
@@ -305,7 +290,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gitUpdater { rev-prefix = "stable/"; };
-    inherit daemon pjsip dhtnet;
+    inherit pjsip-jami dhtnet;
   };
 
   meta = {
diff --git a/pkgs/by-name/je/jellystat/package.nix b/pkgs/by-name/je/jellystat/package.nix
new file mode 100644
index 000000000000..94a5321cd40c
--- /dev/null
+++ b/pkgs/by-name/je/jellystat/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  nodejs_22,
+}:
+buildNpmPackage (finalAttrs: {
+  pname = "jellystat";
+  version = "1.1.11";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "CyferShepard";
+    repo = "Jellystat";
+    tag = finalAttrs.version;
+    hash = "sha256-HuLSXhj90fPfxv5qyCVCY67w07WwTBGp220iG9dGZyk=";
+  };
+
+  patches = [
+    ./remove-hardcoded-path.patch
+  ];
+
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-yfcrBLbD11x3Siqv670jw8A3K11DrwnBj0VSC64JBP0=";
+
+  makeCacheWritable = true;
+
+  nodejs = nodejs_22;
+
+  npmPackFlags = [ "--ignore-scripts" ];
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
+
+  postPatch = ''
+    substituteInPlace backend/server.js \
+      --replace-fail "const PORT = 3000;" "const PORT = Number(process.env.JS_PORT || 3000);"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/jellystat $out/bin
+    cp -r . $out/share/jellystat/
+
+    makeWrapper ${nodejs_22}/bin/node $out/bin/jellystat \
+      --chdir $out/share/jellystat \
+      --add-flags $out/share/jellystat/backend/server.js
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Jellystat is a free and open source Statistics App for Jellyfin";
+    homepage = "https://github.com/CyferShepard/Jellystat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mistyttm ];
+    mainProgram = "jellystat";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch b/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
new file mode 100644
index 000000000000..08564c6e4d15
--- /dev/null
+++ b/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
@@ -0,0 +1,151 @@
+diff --git a/backend/classes/backup.js b/backend/classes/backup.js
+index 981b7d6..c6b4124 100644
+--- a/backend/classes/backup.js
++++ b/backend/classes/backup.js
+@@ -15,7 +15,9 @@ const postgresPassword = process.env.POSTGRES_PASSWORD;
+ const postgresIp = process.env.POSTGRES_IP;
+ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+-const backupfolder = "backup-data";
++const backupfolder = process.env.JS_BACKUP_DIR
++  ? path.resolve(process.env.JS_BACKUP_DIR)
++  : path.join(__dirname, "..", "backup-data");
+ 
+ function checkFolderWritePermission(folderPath) {
+   try {
+@@ -51,7 +53,7 @@ async function backup(refLog) {
+ 
+   try {
+     let now = dayjs();
+-    const backuppath = "./" + backupfolder;
++    const backuppath = backupfolder;
+ 
+     if (!fs.existsSync(backuppath)) {
+       fs.mkdirSync(backuppath);
+@@ -79,7 +81,7 @@ async function backup(refLog) {
+     }
+ 
+     // const backupPath = `../backup-data/backup_${now.format('YYYY-MM-DD HH-mm-ss')}.json`;
+-    const directoryPath = path.join(__dirname, "..", backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
++    const directoryPath = path.join(backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
+     refLog.logData.push({ color: "yellow", Message: "Begin Backup " + directoryPath });
+     const stream = fs.createWriteStream(directoryPath, { flags: "a" });
+     stream.on("error", async (error) => {
+@@ -105,7 +107,7 @@ async function backup(refLog) {
+ 
+     //Cleanup excess backups
+     let deleteCount = 0;
+-    const directoryPathDelete = path.join(__dirname, "..", backupfolder);
++    const directoryPathDelete = backupfolder;
+ 
+     const files = await new Promise((resolve, reject) => {
+       fs.readdir(directoryPathDelete, (err, files) => {
+@@ -132,7 +134,7 @@ async function backup(refLog) {
+     fileData = fileData.sort((a, b) => new Date(b.datecreated) - new Date(a.datecreated)).slice(5);
+ 
+     for (var oldBackup of fileData) {
+-      const oldBackupFile = path.join(__dirname, "..", backupfolder, oldBackup.name);
++      const oldBackupFile = path.join(backupfolder, oldBackup.name);
+ 
+       await new Promise((resolve, reject) => {
+         fs.unlink(oldBackupFile, (err) => {
+diff --git a/backend/classes/env.js b/backend/classes/env.js
+index afb76e7..5863934 100644
+--- a/backend/classes/env.js
++++ b/backend/classes/env.js
+@@ -16,7 +16,12 @@ async function writeEnvVariables() {
+   const envContent = `window.env = ${JSON.stringify(envVariables, null, 2)};`;
+ 
+   // Define the output file path
+-  const outputPath = path.join(__dirname, "..", "..", "dist", "env.js");
++  const envDir = process.env.JS_ENV_DIR ? path.resolve(process.env.JS_ENV_DIR) : path.join(__dirname, "..", "..", "dist");
++  const outputPath = path.join(envDir, "env.js");
++
++  if (process.env.JS_ENV_DIR) {
++    fs.mkdirSync(envDir, { recursive: true });
++  }
+ 
+   // Write the environment variables to the file
+   fs.writeFile(outputPath, envContent, "utf8", (err) => {
+diff --git a/backend/routes/backup.js b/backend/routes/backup.js
+index cfc3d3f..12d9b32 100644
+--- a/backend/routes/backup.js
++++ b/backend/routes/backup.js
+@@ -25,7 +25,9 @@ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+ const postgresSslRejectUnauthorized = process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === undefined ? true : process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "true";
+ 
+-const backupfolder = "backup-data";
++const backupfolder = process.env.JS_BACKUP_DIR
++  ? path.resolve(process.env.JS_BACKUP_DIR)
++  : path.join(__dirname, "..", "backup-data");
+ 
+ // Restore function
+ 
+@@ -187,7 +189,7 @@ router.get("/restore/:filename", async (req, res) => {
+     Logging.insertLog(uuid, triggertype.Manual, taskName.restore);
+ 
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
++    const filePath = path.join(backupfolder, filename);
+ 
+     await restore(filePath, refLog);
+     Logging.updateLog(uuid, refLog.logData, taskstate.SUCCESS);
+@@ -202,7 +204,7 @@ router.get("/restore/:filename", async (req, res) => {
+ 
+ router.get("/files", (req, res) => {
+   try {
+-    const directoryPath = path.join(__dirname, "..", backupfolder);
++    const directoryPath = backupfolder;
+     fs.readdir(directoryPath, (err, files) => {
+       if (err) {
+         res.status(500).send("Unable to read directory");
+@@ -229,7 +231,7 @@ router.get("/files", (req, res) => {
+ //download backup file
+ router.get("/files/:filename", (req, res) => {
+   const filename = sanitizeFilename(req.params.filename);
+-  const filePath = path.join(__dirname, "..", backupfolder, filename);
++  const filePath = path.join(backupfolder, filename);
+   res.download(filePath);
+ });
+ 
+@@ -237,7 +239,7 @@ router.get("/files/:filename", (req, res) => {
+ router.delete("/files/:filename", (req, res) => {
+   try {
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
++    const filePath = path.join(backupfolder, filename);
+ 
+     fs.unlink(filePath, (err) => {
+       if (err) {
+@@ -256,7 +258,7 @@ router.delete("/files/:filename", (req, res) => {
+ 
+ const storage = multer.diskStorage({
+   destination: function (req, file, cb) {
+-    cb(null, path.join(__dirname, "..", backupfolder)); // Set the destination folder for uploaded files
++    cb(null, backupfolder); // Set the destination folder for uploaded files
+   },
+   filename: function (req, file, cb) {
+     cb(null, file.originalname); // Set the file name
+diff --git a/backend/server.js b/backend/server.js
+index d70975d..1898ec6 100644
+--- a/backend/server.js
++++ b/backend/server.js
+@@ -106,6 +106,17 @@ const findFile = (dir, fileName) => {
+ 
+ const root = path.join(__dirname, "..", "dist");
+ 
++// When JS_ENV_DIR is set, env.js is written outside of `root` (e.g. because
++// `root` lives on a read-only filesystem), so serve it explicitly from
++// there instead of relying on the findFile() lookup below, which only
++// searches under `root`.
++if (process.env.JS_ENV_DIR) {
++  const envDir = path.resolve(process.env.JS_ENV_DIR);
++  app.get(/\/env\.js$/, (req, res) => {
++    res.sendFile(path.join(envDir, "env.js"));
++  });
++}
++
+ //hacky middleware to handle basename changes for UI
+ 
+ app.use((req, res, next) => {
\ No newline at end of file
diff --git a/pkgs/by-name/ld/ldap-manager/package.nix b/pkgs/by-name/ld/ldap-manager/package.nix
index 1965327841eb..fd0af39b2946 100644
--- a/pkgs/by-name/ld/ldap-manager/package.nix
+++ b/pkgs/by-name/ld/ldap-manager/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ldap-manager";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "netresearch";
     repo = "ldap-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rc3JsWy8tkEzQnLygC5Y6GlEjawjO8d1RB1qxOVo404=";
+    hash = "sha256-MqR4Dj/obMpUKGDMDwEi8kQMMFQXVBPjDBby5t7RfAk=";
   };
 
-  vendorHash = "sha256-Oc7pnVFHX8uKgMgf7TRrTuDf0zjEM7KpGIenQiCNeuE=";
+  vendorHash = "sha256-ZM2MjG3roOl4PFiBuo9F8cTTVWt1ZHuNmaZFvpH804c=";
 
   excludedPackages = [
     "internal/e2e"
diff --git a/pkgs/by-name/li/libmateweather/package.nix b/pkgs/by-name/li/libmateweather/package.nix
index 715c88951512..3fbcd6fd0faa 100644
--- a/pkgs/by-name/li/libmateweather/package.nix
+++ b/pkgs/by-name/li/libmateweather/package.nix
@@ -62,8 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-zoneinfo-dir=${tzdata}/share/zoneinfo"
   ];
 
-  preFixup = "rm -f $out/share/icons/mate/icon-theme.cache";
-
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index 1e412f8e48e2..e2d007f4275c 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.37";
+  version = "9.0.38";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RBYLcJdnf+n4Bq+mw8EyWjJGNr6lTOHMmduV8YXKLQs=";
+    hash = "sha256-Usln8w9OyACsYBDn85kTUmsombrkaRc3qRt2oKMs+0k=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/librechat/package.nix b/pkgs/by-name/li/librechat/package.nix
index 45b334359418..fc875724100e 100644
--- a/pkgs/by-name/li/librechat/package.nix
+++ b/pkgs/by-name/li/librechat/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_22,
   pkg-config,
   node-gyp,
   vips,
@@ -12,13 +11,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "librechat";
-  version = "0.8.6";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "danny-avila";
     repo = "LibreChat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cWgjsLN7NnJNJ1hYPo0h3lh+W4wi9qqttevNfNrYdXg=";
+    hash = "sha256-egnmkYpQS/AshMmXP5C8qhwA+7TPZYnu0ct552HFjGg=";
   };
 
   patches = [
@@ -35,10 +34,7 @@ buildNpmPackage (finalAttrs: {
   ];
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-Y+oC9eigwzL8jei5Hs4YOf32oFgULPmHrSDApxPKh+0=";
-
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+  npmDepsHash = "sha256-U2DzvfzKCmAYLFG0FbFcng5goj1mYCjTpJuQ36fVNuA=";
 
   nativeBuildInputs = [
     pkg-config
@@ -61,7 +57,12 @@ buildNpmPackage (finalAttrs: {
 
   # npmConfigHook only patches the root node_modules
   postConfigure = ''
-    patchShebangs client/node_modules
+    patchShebangs $(find "$PWD" -type d -name node_modules -prune ! -path "$PWD/node_modules" -print)
+  '';
+
+  preInstall = ''
+    # not sure why this is something npm pack tries to keep
+    rm -rf ./packages/data-schemas/node_modules/winston-transport/.nyc_output
   '';
 
   # For reasons beyond my understanding, the api and client directory disappears after the build finishes.
diff --git a/pkgs/by-name/lo/lobster/package.nix b/pkgs/by-name/lo/lobster/package.nix
index 5ad33aa42ec8..a9673fd3fd88 100644
--- a/pkgs/by-name/lo/lobster/package.nix
+++ b/pkgs/by-name/lo/lobster/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lobster";
-  version = "2026.4";
+  version = "2026.5";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "lobster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kqKOf0zrHyqRTs+57owHR5sORZgNIgGghtjUtSaFjZw=";
+    hash = "sha256-coUsn3sYTWO4UGqw5DIWFvnA5+TpkUukRx0Axg8Lfhc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 2729c3d90590..59d2a22641be 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.7.14";
+  version = "3.7.15";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-UmaMEDkLMU/V0Rddu4IATsH8LrmyV7KOQE1ac0rWHWld7tE1ZU9vp+/VTR68KFkxfTm0wNMxy4ilAP84GVA7pQ==";
+    hash = "sha512-F2rJpU7PLvknzkkYwlPSxLZAiuw8om7XT6cDMnw9IRODyHfWzBgTL5481GK6ySNV6sVZAlWVg4hf7XsPtdci/A==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ma/mango/package.nix b/pkgs/by-name/ma/mango/package.nix
index 682c062dedc5..80b12823024c 100644
--- a/pkgs/by-name/ma/mango/package.nix
+++ b/pkgs/by-name/ma/mango/package.nix
@@ -27,13 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
   strictDeps = true;
   pname = "mango";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "mangowm";
     repo = "mango";
     tag = finalAttrs.version;
-    hash = "sha256-0mX95LpyZuMMkEKS1qTiVrpDLeuCzO5hVJdmdpr7SY0=";
+    hash = "sha256-od6lK1KOquakP/GD17fGEm1ck5EMZa/s+jhmvGrRFzk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/mate-wayland-session/package.nix b/pkgs/by-name/ma/mate-wayland-session/package.nix
index 5ddeb27b4f66..5c0ec3a14007 100644
--- a/pkgs/by-name/ma/mate-wayland-session/package.nix
+++ b/pkgs/by-name/ma/mate-wayland-session/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mate-wayland-session";
-  version = "1.28.5";
+  version = "1.28.6";
 
   src = fetchFromGitHub {
     owner = "mate-desktop";
     repo = "mate-wayland-session";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YWuBAzsLrvnwGgXbcDzIZtQIscIl37Y3wIRCOKidtYo=";
+    hash = "sha256-jlUmA+a59VGXtPUftmA7DruZK53IQM+66RgeP1Jg3e8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/mathic/package.nix b/pkgs/by-name/ma/mathic/package.nix
index 9d90e17fa8f5..e7996a77720d 100644
--- a/pkgs/by-name/ma/mathic/package.nix
+++ b/pkgs/by-name/ma/mathic/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mathic";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "Macaulay2";
     repo = "mathic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0/ws95MTrNXt6BhqyWjsOGyXvh2tTd48/pT6kWwQPd4=";
+    hash = "sha256-O/5fNnKiHTX/VV7ztFofRlRQZuoTmag3BNok7qFyffQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ni/niks3/package.nix b/pkgs/by-name/ni/niks3/package.nix
index 2cd085f223fa..f854dda895a8 100644
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "niks3";
-  version = "1.8.0";
+  version = "1.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "niks3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-86afR/fMjLRLmBEMFA6ow6SRI9T5Qe83l0em/FciW2g=";
+    hash = "sha256-mfoin/yCAdHJpwKX0VHXknbUYvEm+F5XSgMQ4oLgP/g=";
   };
 
-  vendorHash = "sha256-qkB99S/9fmSk5G9uHyQF/z+joi9JACIJWaHMrIo4ziU=";
+  vendorHash = "sha256-lql+r9+hy7XX9/aSezwweKSU/MphxvIkaT0gHf59fsc=";
 
   subPackages = [
     "cmd/niks3"
diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index baaa58a7b41c..2c96a6f3a6fe 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -15,7 +15,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.71.0";
+  version = "0.74.0";
 
   __darwinAllowLocalNetworking = true; # required for tests
 
@@ -23,9 +23,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "nolabs-ai";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xrqd8Do1R2kCwTAmju2VmOLAf329eoOSslfa8i9ogJc=";
+    hash = "sha256-Njfs0kkoNj3VjLd6ziz5WAgI+HLMZ+djqxjbXabEdzg=";
   };
-  cargoHash = "sha256-bMGrLh3DEA3yJsyb62Xdt+SfhzFY5VXawai4V6xttpI=";
+  cargoHash = "sha256-+JLE0hBmsxqDnTwkFRVxphA6HdA/EgkWHIAJiExsxp4=";
 
   nativeBuildInputs = [
     pkg-config
@@ -46,11 +46,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "test_all_profiles_signal_mode_resolves"
       "test_restrict_execute_does_not_break_rename_into_new_subdir"
       # panic
-      "build_run_profile_patch_adds_override_deny_for_sensitive_file"
       "build_run_profile_patch_merges_read_and_write_to_allow_file"
       "prepare_profile_save_from_patch_updates_existing_user_profile"
-      "would_shadow_builtin_allows_update_of_existing_user_override"
-      "would_shadow_builtin_flags_known_builtin_names"
       "create_audit_state_creates_session_when_enabled"
 
       # audit_attestation
@@ -58,6 +55,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "audit_verify_reports_signed_attestation_with_pinned_public_key"
       "rollback_signed_session_verifies_from_audit_dir_bundle"
 
+      # audit_ledger
+      # needs /bin/pwd
+      "corrupt_audit_ledger_downgrades_only_a_clean_exit"
+      "corrupt_audit_ledger_is_reported_on_every_run_and_left_untouched"
+
+      # execution_strategy_run
+      # needs /usr/bin/env
+      "direct_workdir_overrides_untrusted_host_pwd"
+      "direct_workdir_sets_child_pwd_from_uncovered_launch_dir"
+      "supervised_workdir_overrides_untrusted_host_pwd"
+      "supervised_workdir_sets_child_pwd_from_uncovered_launch_dir"
+
       # nono-cli
       # wants a script `scripts/test-list-aliases.sh`, `git`, and `.git` history
       "alias_inventory_script_passes"
diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index d8fed2d39945..5c957f316778 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -114,7 +114,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     updateScript = nix-update-script { };
 
     withPlugins = plugins: callPackage ./with-plugins.nix { inherit plugins; };
-    tests.withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+    tests = {
+      withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+      pluginCompat = callPackage ./plugins/test-plugin-compat.nix { };
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/nu/nushell/plugins/bson/package.nix b/pkgs/by-name/nu/nushell/plugins/bson/package.nix
index 2b2b89d144e1..56cae445a7e7 100644
--- a/pkgs/by-name/nu/nushell/plugins/bson/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/bson/package.nix
@@ -3,11 +3,12 @@
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
-  llvmPackages,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_bson";
+  # NOTE: v26.1140.0 does not build: its Cargo.toml requires nu-plugin ^0.114.0
+  # while its Cargo.lock still pins 0.113.1.
   version = "26.1130.0";
 
   src = fetchFromGitHub {
@@ -19,19 +20,21 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-aGUlItPfrr3Uz/t1XEXBtGM285up3A5Wva1QMKwBrg0=";
 
-  nativeBuildInputs = [
-    llvmPackages.libclang
-  ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
-  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  passthru.updateScript = nix-update-script { };
 
-  passthru.update-script = nix-update-script { };
   meta = {
-    description = " Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
+    description = "Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
     homepage = "https://github.com/Kissaki/nu_plugin_bson";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ philocalyst ];
     mainProgram = "nu_plugin_bson";
     platforms = lib.platforms.unix ++ lib.platforms.windows;
+    # "Plugin `bson` is compiled for nushell version 0.113.0, which is not
+    # compatible with version 0.115.1".
+    # Upstream's main branch has already bumped to nu-plugin 0.115.0, so this
+    # should be unbroken by the next release.
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/nu/nushell/plugins/dbus/package.nix b/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
index d989b61def66..16acc15008d9 100644
--- a/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [ aftix ];
     platforms = lib.platforms.linux;
     # "Plugin `dbus` is compiled for nushell version 0.101.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
     broken = true;
   };
 })
diff --git a/pkgs/by-name/nu/nushell/plugins/default.nix b/pkgs/by-name/nu/nushell/plugins/default.nix
index 257486986b51..6ae93796e060 100644
--- a/pkgs/by-name/nu/nushell/plugins/default.nix
+++ b/pkgs/by-name/nu/nushell/plugins/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
+  config,
   callPackage,
   dbus,
 }:
 {
-  bson = callPackage ./bson/package.nix;
+  bson = callPackage ./bson/package.nix { };
   dbus = callPackage ./dbus/package.nix { inherit dbus; };
   desktop_notifications = callPackage ./desktop_notifications/package.nix { };
   formats = callPackage ./formats/package.nix { };
@@ -13,7 +15,9 @@
   net = callPackage ./net/package.nix { };
   polars = callPackage ./polars/package.nix { };
   query = callPackage ./query/package.nix { };
-  semver = callPackage ./semver/package.nix { };
   skim = callPackage ./skim/package.nix { };
   units = callPackage ./units/package.nix { };
 }
+// lib.optionalAttrs config.allowAliases {
+  semver = throw "nushellPlugins.semver is EOL as starting with 0.114.0, nushell natively supports semver values."; # Added 2026-08-27
+}
diff --git a/pkgs/by-name/nu/nushell/plugins/highlight/package.nix b/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
index 4717b939017b..8b946eb1b8d8 100644
--- a/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
@@ -34,5 +34,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/cptpiepmatz/nu-plugin-highlight";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `highlight` is compiled for nushell version 0.114.1, which is
+    # not compatible with version 0.115.1"
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/nu/nushell/plugins/net/package.nix b/pkgs/by-name/nu/nushell/plugins/net/package.nix
index 6e8314d80937..890c6c0057d2 100644
--- a/pkgs/by-name/nu/nushell/plugins/net/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/net/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [ happysalada ];
     mainProgram = "nu_plugin_net";
     # "Plugin `net` is compiled for nushell version 0.104.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
     broken = true;
   };
 })
diff --git a/pkgs/by-name/nu/nushell/plugins/semver/package.nix b/pkgs/by-name/nu/nushell/plugins/semver/package.nix
deleted file mode 100644
index dbddc5a9d324..000000000000
--- a/pkgs/by-name/nu/nushell/plugins/semver/package.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "nu_plugin_semver";
-  version = "0.11.17";
-
-  src = fetchFromGitHub {
-    owner = "abusch";
-    repo = "nu_plugin_semver";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GJ3B7dENuSEZSkHV42plt7tsGLZPqqXCO3c/0ILZQ1Y=";
-  };
-
-  cargoHash = "sha256-U3wwXtvnHfbxfH5awVJbSI4OaVd/c/TsQHzaUljw99o=";
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Nushell plugin to work with semver versions";
-    homepage = "https://github.com/abusch/nu_plugin_semver";
-    changelog = "https://github.com/abusch/nu_plugin_semver/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ koffydrop ];
-    mainProgram = "nu_plugin_semver";
-  };
-})
diff --git a/pkgs/by-name/nu/nushell/plugins/skim/package.nix b/pkgs/by-name/nu/nushell/plugins/skim/package.nix
index ac2910848e8d..e5756ef09f9f 100644
--- a/pkgs/by-name/nu/nushell/plugins/skim/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/skim/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_skim";
-  version = "0.29.1";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "idanarye";
     repo = "nu_plugin_skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ddnn5H2NjYuv+7v4JxT56pq5Kr7N8yv+NG5gYITf4qc=";
+    hash = "sha256-bZiNUQon4x82XQKINrDYTn6IgEZmLwhhFvmYMTBLOmA=";
   };
 
-  cargoHash = "sha256-ZYG8nIh/nQ3nRGkN3pnU6j7BMR5fOx/qOYppdZdfXe0=";
+  cargoHash = "sha256-s0VU8S/V/HJJ5DPLIFvUqhxu9391PJYY/tROUbfJnDQ=";
 
   nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix b/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
new file mode 100644
index 000000000000..0057ad4bfadb
--- /dev/null
+++ b/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  runCommand,
+  nushell,
+  nushellPlugins,
+}:
+let
+  # Nushell refuses to load a plugin that was not compiled against its own
+  # major/minor version, and nothing about building a plugin catches that: a
+  # stale plugin builds fine and only fails when nu tries to load it. So a
+  # nushell bump silently breaks every plugin not updated in lockstep. Load all
+  # of them here so that shows up in the build instead of on a user's machine.
+  # tryEval steps over the removal aliases, which throw when forced.
+  plugins = lib.filter (
+    p: lib.isDerivation p && lib.meta.availableOn stdenv.hostPlatform p && !(p.meta.broken or false)
+  ) (lib.filter (p: (builtins.tryEval p).success) (lib.attrValues nushellPlugins));
+
+  nuWithPlugins = nushell.withPlugins plugins;
+
+  # `plugin list` reports plugins by their registered name, which is the
+  # mainProgram without the `nu_plugin_` prefix.
+  expected = lib.sort (a: b: a < b) (
+    lib.map (p: lib.removePrefix "nu_plugin_" (baseNameOf (lib.getExe p))) plugins
+  );
+in
+runCommand "nushell-plugin-compat-test" { } ''
+  expected=${lib.escapeShellArg (lib.concatStringsSep "\n" expected)}
+
+  # nu exits non-zero when a plugin fails to load; keep going so the
+  # comparison below can report which one it was.
+  actual=$(env -u XDG_DATA_DIRS HOME=/homeless-shelter \
+    ${nuWithPlugins}/bin/nu --no-config-file -c 'plugin list | get name | sort | to text' 2>&1 || true)
+
+  if [ "$actual" != "$expected" ]; then
+    echo "FAIL: the set of loadable plugins does not match the set of non-broken plugins."
+    echo "A plugin that fails to load is compiled for a different nushell version;"
+    echo "either update it, or mark it broken in its package.nix."
+    echo "--- expected ---"
+    echo "$expected"
+    echo "--- actual ---"
+    echo "$actual"
+    exit 1
+  fi
+
+  touch $out
+''
diff --git a/pkgs/by-name/nu/nushell/plugins/units/package.nix b/pkgs/by-name/nu/nushell/plugins/units/package.nix
index 021ebe374490..5098814f5d78 100644
--- a/pkgs/by-name/nu/nushell/plugins/units/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/units/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_units";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "JosephTLyons";
     repo = "nu_plugin_units";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4donh0UlBbaEwgDxUECKTPWGLuAc9KUmrRty2Ob7ZMA=";
+    hash = "sha256-dPfEjK2Ws/cHfYdMwKbDL/gZp1ZMx6RRo7DWPcdrD7w=";
   };
 
-  cargoHash = "sha256-MjalDrjJTAHay9zcPhA8br2tOkkIzE4etL+yF5MKetY=";
+  cargoHash = "sha256-K3hzUmhEjCwhaSuC7MpZbIJGZEKoAzH+LsfK3krm5cU=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 
@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/JosephTLyons/nu_plugin_units";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `units` is compiled for nushell version 0.106.1, which is not
+    # compatible with version 0.115.1"
     broken = true;
   };
 })
diff --git a/pkgs/by-name/op/opendht/package.nix b/pkgs/by-name/op/opendht/package.nix
index f93feb89d649..e097b9834979 100644
--- a/pkgs/by-name/op/opendht/package.nix
+++ b/pkgs/by-name/op/opendht/package.nix
@@ -14,6 +14,7 @@
   restinio,
   llhttp,
   openssl,
+  simdutf,
   fmt,
   nix-update-script,
   enableProxyServerAndClient ? false,
@@ -22,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opendht";
-  version = "3.5.4";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mnnd6yATIk/TEuFG/M98d+pfeh42IKWBBYjkTP52xeM=";
+    hash = "sha256-LquXkbJUBgZfb7cc+Lc1lejO2NxFur83iI0QOuOg5bE=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     restinio
     llhttp
     openssl
+    simdutf
   ];
 
   cmakeFlags =
diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index 664a74686731..0c88f18200f2 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_42,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,17 +15,17 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
-  electron = electron_41;
+  electron = electron_42;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
+    hash = "sha256-V/JqrEkag6tVcq46wqLdheJqSAFmfeEVxueIgeuyToA=";
   };
 
   makeCacheWritable = true;
@@ -33,7 +33,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
+  npmDepsHash = "sha256-5CD/sK/DYfzIgnuvTi4OevtyNLEOTedmuStrg4ru14A=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/pg/pgschema/package.nix b/pkgs/by-name/pg/pgschema/package.nix
new file mode 100644
index 000000000000..397d3bb6a2c7
--- /dev/null
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  postgresql,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pgschema";
+  version = "1.12.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pgplex";
+    repo = "pgschema";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zfG87Uc5bx14zhYnuT3CF+sW5EEQLBRRMyBe57FBHJ4=";
+  };
+
+  # Adapted from $src/nix/pgschema.nix
+  proxyVendor = true;
+  vendorHash = "sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss=";
+
+  env.CGO_ENABLED = "0";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/pgplex/pgschema/cmd.GitCommit=${finalAttrs.src.rev}"
+    "-X"
+    "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--help"; # there is no -v/--version
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terraform-style, declarative Postgres schema migration";
+    homepage = "https://github.com/pgplex/pgschema";
+    changelog = "https://github.com/pgplex/pgschema/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.bengsparks ];
+    mainProgram = "pgschema";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/pi/picgo/package.nix b/pkgs/by-name/pi/picgo/package.nix
index 24bcc055a3e1..306d6c237634 100644
--- a/pkgs/by-name/pi/picgo/package.nix
+++ b/pkgs/by-name/pi/picgo/package.nix
@@ -6,7 +6,7 @@
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
-  electron_41,
+  electron_43,
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "picgo";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "Molunerfinn";
     repo = "PicGo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uxgrtuxcIlwCuz3X2hL0ZSpq8hMA4JxQD8ibNFw+35g=";
+    hash = "sha256-wT9CfPchNbD2CzSVA9kZAYsstpc2mvgqAl305rmrUdo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -48,6 +48,15 @@ stdenv.mkDerivation (finalAttrs: {
     NODE_ENV = "development";
   };
 
+  postPatch = ''
+    # Maximizing a hidden BrowserWindow makes it visible on Linux. Defer restoring
+    # the maximized state until the main window is explicitly shown.
+    # https://github.com/Molunerfinn/PicGo/blob/4676326eb88d087432989366d71e61e17a039e98/src/main/apis/app/window/windowList.ts#L83-L94
+    substituteInPlace src/main/apis/app/window/windowList.ts \
+      --replace-fail "      window.maximize()" \
+        "      window.once('show', () => window.maximize())"
+  '';
+
   buildPhase = ''
     runHook preBuild
 
@@ -57,12 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postBuild = ''
-    cp -r src/renderer/public/. dist_electron/renderer/
-
-    # Renderer assets are loaded from a file:// URL, so root-relative paths like
-    # /squareLogo.png resolve to the filesystem root. Copy the renderer public assets
-    # next to index.html and rewrite those references to relative paths.
-    # https://github.com/Molunerfinn/PicGo/blob/dev/src/renderer/components/independent-window/mini/picgo-mini-page.tsx
+    # Renderer assets are loaded from a file:// URL, so the mini window logo must
+    # use a path relative to its index.html.
     substituteInPlace dist_electron/renderer/assets/mini-*.js \
       --replace-fail '"/squareLogo.png"' '"./squareLogo.png"'
   '';
@@ -92,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     # ELECTRON_FORCE_IS_PACKAGED makes PicGo use its production resource path,
     # but with the nixpkgs Electron wrapper process.resourcesPath points to Electron
     # itself, so point PicGo at the installed public assets
-    makeWrapper ${lib.getExe electron_41} $out/bin/picgo \
+    makeWrapper ${lib.getExe electron_43} $out/bin/picgo \
       --add-flags "--class=picgo" \
       --add-flags "$out/lib/picgo/.launcher.cjs" \
       --set NODE_ENV production \
diff --git a/pkgs/by-name/pi/pitchfork/package.nix b/pkgs/by-name/pi/pitchfork/package.nix
new file mode 100644
index 000000000000..a85640f5ebbd
--- /dev/null
+++ b/pkgs/by-name/pi/pitchfork/package.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  nodejs,
+  pnpm_10,
+  pnpmConfigHook,
+  rustPlatform,
+  stdenv,
+}:
+
+let
+  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    webui = stdenv.mkDerivation {
+      pname = "${finalAttrs.pname}-webui";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      pnpmDeps = finalAttrs.pnpmDeps;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm
+        pnpmConfigHook
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pnpm build
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        cp -r dist/. $out/
+
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "pitchfork";
+    version = "2.23.0";
+
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "jdx";
+      repo = "pitchfork";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-P3N4YquQPJ+xr/M6foK9r2EDKjOsslRVMU3aIsJr04U=";
+    };
+
+    cargoHash = "sha256-jNf0dTsZgS8CWBrGu+o1d11Nil9OgsLykxNkGxTd9aY=";
+
+    cargoDeps = rustPlatform.fetchCargoVendor {
+      inherit (finalAttrs) pname src version;
+      hash = finalAttrs.cargoHash;
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      inherit pnpm;
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      fetcherVersion = 3;
+      hash = "sha256-zh0JlHe6NDpsuDKsGq5Eto8Rx7gGLc7ayxV/NIhm4EQ=";
+    };
+
+    preBuild = ''
+      mkdir -p ui/dist
+      cp -r ${webui}/. ui/dist/
+    '';
+
+    doCheck = false;
+
+    meta = {
+      homepage = "https://pitchfork.jdx.dev";
+      description = "Daemons with DX";
+      changelog = "https://github.com/jdx/pitchfork/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.mit;
+      mainProgram = "pitchfork";
+      maintainers = with lib.maintainers; [ esteve ];
+    };
+  }
+)
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 66f145378d8d..3d153462f2b9 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.49.4";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4hLhmQ2ks1g9eF+wKKLc8/6g07IHisgwYMBhGr4DjbE=";
+    hash = "sha256-vp1/yWDqx8fQp4NifjENr/x8e0TVSRlLYv7TshfwC2Y=";
   };
 
   vendorHash = "sha256-K6edyYLkVQwEZBAfRwgckUJI8dmo/ZxFRjEkExtyLxY=";
@@ -27,19 +27,8 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/resterm" ];
 
-  # Skip tests that require network access or socket binding
-  checkFlags = [
-    "-skip"
-    "^(${
-      lib.concatStringsSep "|" [
-        "TestServeMocksStartsAndStopsWithContext"
-        "TestServeMocksRequiresTLSPair"
-        "TestServeMocksValidatesJournalLimitsAsUsageErrors"
-        "TestMockControlCommandsResetClearAndVerify"
-        "TestCLIUpdaterCheckDev"
-      ]
-    })$"
-  ];
+  # for tests binding 127.0.0.1:0 on darwin
+  __darwinAllowLocalNetworking = true;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/re/retroshare/package.nix b/pkgs/by-name/re/retroshare/package.nix
index dc164b52c6f0..de45273237a2 100644
--- a/pkgs/by-name/re/retroshare/package.nix
+++ b/pkgs/by-name/re/retroshare/package.nix
@@ -107,6 +107,10 @@ stdenv.mkDerivation rec {
   postInstall = ''
     # BT DHT bootstrap
     cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
+
+    substituteInPlace $out/share/applications/retroshare.desktop \
+      --replace-fail "/usr/bin/retroshare" "retroshare" \
+      --replace-fail "/usr/share/pixmaps/retroshare.xpm" "retroshare"
   '';
 
   meta = {
diff --git a/pkgs/by-name/sk/skills/package.nix b/pkgs/by-name/sk/skills/package.nix
index d132ba001be7..776e5caec283 100644
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "skills";
-  version = "1.5.22";
+  version = "1.5.23";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F3KVn4OWpGKxKPzW8L/CnnLv8m51G7aflH65vv4SrtY=";
+    hash = "sha256-qD+gGPYjgbArf1Nz5rtlJVCS/2KNTuspag/B079l014=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 285a01c2df30..e4ec3d4879e1 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -1,7 +1,7 @@
 {
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_43,
   fetchFromGitHub,
   lib,
   makeDesktopItem,
@@ -15,12 +15,12 @@
   cargo,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
   nodejs = nodejs_22;
 in
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "18.19.0";
+  version = "18.20.1";
 
   inherit nodejs;
 
@@ -28,7 +28,7 @@ buildNpmPackage rec {
     owner = "super-productivity";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-tUK2vytQ/fBSw8drjBLh4HlrnQh/0tX9e9otYMhXYsA=";
+    hash = "sha256-7bDPG3OPXVDzIjxpQw3XLXnLNSfjdq0pIlSqZhYZSIs=";
   };
 
   # Use custom fetcher for deps because super-productivity uses multiple
@@ -74,7 +74,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-Je3pHgkBwt35sIvxQqnYX3F+uJQeBGc5kzCAL9czCYs=";
+      hash = "sha256-esVslmbko0mbANyR67b4a6YHO4sRniv5ZVISNk1u0Bg=";
     }
   );
 
diff --git a/pkgs/by-name/ta/tabularis/package.nix b/pkgs/by-name/ta/tabularis/package.nix
index 1cf457556900..f1842f98f7e2 100644
--- a/pkgs/by-name/ta/tabularis/package.nix
+++ b/pkgs/by-name/ta/tabularis/package.nix
@@ -19,14 +19,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tabularis";
-  version = "0.20.0";
+  version = "0.21.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "TabularisDB";
     repo = "tabularis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q03i0EhhRPOQYkb27MwIzcGH1uA4npcD3OJbTHQG0hw=";
+    hash = "sha256-81Y5sVeDJtzD1V8cj3KQhEkhreI7NaVhrHZlH9pO/T0=";
   };
 
   strictDeps = true;
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-7UMmX8dPAYtWM8dG150RKCTdpUpVqlUaEiqio7K7ZIg=";
+  cargoHash = "sha256-Rqjjsw+Pk2H2zoyIOuDlkBhkl8DJOgri5Ko95wcaoIM=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
diff --git a/pkgs/by-name/ta/tart/package.nix b/pkgs/by-name/ta/tart/package.nix
index e01a60ea1fe4..f43b6d263222 100644
--- a/pkgs/by-name/ta/tart/package.nix
+++ b/pkgs/by-name/ta/tart/package.nix
@@ -10,15 +10,15 @@
   enableSoftnet ? false,
   softnet,
   nix-update-script,
-  versionCheckHook,
+  testers,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.30.6";
+  version = "2.36.0";
 
   src = fetchurl {
-    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    hash = "sha256-wepqDaJp1oRjGqEVrXUM/JO5gfAKc12AUkZUbfwwdx0=";
+    url = "https://github.com/openai/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
+    hash = "sha256-xyqKuNeKZJih5CaIsaHsbFEs5GyjWjo74TDD3hRAx+g=";
   };
   sourceRoot = ".";
 
@@ -39,16 +39,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
   passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion {
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
+  };
 
   meta = {
     description = "macOS and Linux VMs on Apple Silicon to use in CI and other automations";
     homepage = "https://tart.run";
-    license = lib.licenses.fairsource09;
+    license = lib.licenses.fsl11Asl20;
     maintainers = with lib.maintainers; [
       emilytrau
       aduh95
diff --git a/pkgs/by-name/to/tomat/package.nix b/pkgs/by-name/to/tomat/package.nix
index 8e65b2a93ddb..60d2748e79cc 100644
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tomat";
-  version = "2.11.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "tomat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bHmVwtpDQCO8NS1dsilSsDBlMWotEZ3x1J/KD40vbVs=";
+    hash = "sha256-UJcUvTaFaR0I12T1MtMlXM/lFNEps8eOfaqR66OeNBI=";
   };
 
-  cargoHash = "sha256-wxVWYOMYVi8R1YpBp+KPirqubAPYA561R+maG1vgrl0=";
+  cargoHash = "sha256-b6b5fIjortiVhCgzU3Qn1w3ccsTZsuuyY6Me+ZuuUHk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index fb9cbade6c06..4fffcf5b083b 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.74";
+  version = "0.0.75";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-6obXsyfHHgPPON7rZj2cYtMdg20sv33LR05gey/w56A=";
+    hash = "sha256-hzEgbimysGMH+bQoKmTOWZl8DgaW/G1QUkI5T18UMp4=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-kwnSLBK4H/RPUY+Nb08quRe3q9Ke5Sgmdf588b2QfUs=";
+  cargoHash = "sha256-TSvfiHsXyn1MLUwfi+9ZxWH5AqKhkPPU297lL5nL7fI=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
diff --git a/pkgs/by-name/un/unifont/package.nix b/pkgs/by-name/un/unifont/package.nix
index 2e9659d02873..d46f715f1ef6 100644
--- a/pkgs/by-name/un/unifont/package.nix
+++ b/pkgs/by-name/un/unifont/package.nix
@@ -1,6 +1,8 @@
 {
   lib,
   stdenv,
+  bashNonInteractive,
+  buildPackages,
   fetchurl,
   perl,
   bdftopcf,
@@ -25,6 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     rm -r font/precompiled
     patchShebangs ./src
+    ${lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      substituteInPlace Makefile --replace-fail \
+        'bin/unigenwidth ' \
+        '$(BINDIR)/unigenwidth '
+      substituteInPlace font/Makefile --replace-fail \
+        '"BINDIR:../../../$(BINDIR)/"' \
+        '"BINDIR:$(BINDIR)/"'
+    ''}
   '';
 
   nativeBuildInputs = [
@@ -35,10 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    bashNonInteractive
     perlenv
   ];
 
-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "BINDIR=${buildPackages.unifont.bin}/bin"
+  ];
 
   buildFlags = [ "BUILDFONT=1" ];
 
@@ -64,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
       "$out"/share/fonts/opentype/unifont/*_sample.*
   '';
 
+  postFixup = ''
+    patchShebangs --host --update "$bin"
+  '';
+
   outputs = [
     "out"
     "bin"
diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index a4d9d31c98c9..81f5358e683c 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -27,11 +27,11 @@ assert waylandSupport -> libxkbcommon != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vintagestory";
-  version = "1.22.6";
+  version = "1.22.7";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${finalAttrs.version}.tar.gz";
-    hash = "sha256-xJPyaYklEq2BeUX9+7hNPI6WC6ibcQDS+sKeqKYSh3A=";
+    hash = "sha256-SDzGgnpQwIxcQczQJixvEiPBBOVMpxNcRmBSeNifXeE=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index e0cb0f17e2f0..b981a1edcdef 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -177,6 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   dontWrapQtApps = true;
+  separateDebugInfo = true;
 
   preFixup = lib.optionalString (!clientLibOnly) ''
     wrapProgram "$out/bin/wivrn-server" \
diff --git a/pkgs/by-name/yo/yopass/package.nix b/pkgs/by-name/yo/yopass/package.nix
new file mode 100644
index 000000000000..f6da068b784d
--- /dev/null
+++ b/pkgs/by-name/yo/yopass/package.nix
@@ -0,0 +1,57 @@
+{
+  buildGoModule,
+  callPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  lib,
+}:
+let
+  version = "14.9.0";
+  src = fetchFromGitHub {
+    owner = "jhaals";
+    repo = "yopass";
+    tag = version;
+    hash = "sha256-YZeSGcQcAsOmIwhhVpGN7bxlNGsWIJNAwUBxJM/7314=";
+  };
+
+  website = callPackage ./website.nix { inherit src version; };
+in
+buildGoModule (finalAttrs: {
+  inherit version src;
+  pname = "yopass";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-mR17QPGZNJ9Vx6y6mExvZDKReVxdUif8aQ6VMfKVgcM=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  subPackages = [
+    "cmd/yopass"
+    "cmd/yopass-server"
+  ];
+
+  checkFlags = [
+    # Disable tests that require network access
+    "-skip=TestSecretNotFoundError"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/yopass-server \
+      --add-flags "--asset-path ${website}"
+  '';
+
+  meta = {
+    description = "Secure sharing of secrets, passwords and files";
+    homepage = "https://github.com/jhaals/yopass";
+    changelog = "https://github.com/jhaals/yopass/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      ivarmedi
+      fraggerfox
+    ];
+    mainProgram = "yopass";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/yo/yopass/website.nix b/pkgs/by-name/yo/yopass/website.nix
new file mode 100644
index 000000000000..fc80fba3a76c
--- /dev/null
+++ b/pkgs/by-name/yo/yopass/website.nix
@@ -0,0 +1,35 @@
+{
+  fetchYarnDeps,
+  nodejs-slim,
+  src,
+  stdenv,
+  version,
+  yarnBuildHook,
+  yarnConfigHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "yopass-website";
+  inherit version;
+
+  src = src + "/website";
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-x3ouozoDreaeeqoh8osXOqEYphy6vTalLMjQt5vowkg=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs-slim
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mv dist $out
+
+    runHook postInstall
+  '';
+})
diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 6d5288b2d581..32dfdd411444 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -7,23 +7,23 @@
   ffmpeg-headless,
   yt-dlp,
   makeDesktopItem,
-  electron_41,
+  electron_43,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.22.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     tag = "v${version}";
-    hash = "sha256-zAHDBLQJa0FFX2esz7jVRnIY6aBwnoGp6Kr2jWDX+lg=";
+    hash = "sha256-chTaQ0nHTtdIhMo4GBSoQ6YbqDy8HNj190JNUt5nDiE=";
   };
 
-  npmDepsHash = "sha256-J/3m6HN2/gndtTrxf4rwhZtBAQUv1oQYbo8HeNLV8Xw=";
+  npmDepsHash = "sha256-Czs09QnQ7lnNjgysvSb7TFKz6t8ChvoT+1KzHFJ87SA=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 02772c62c66c..aa854f6ae18c 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -12,11 +12,11 @@ buildDunePackage (finalAttrs: {
   minimalOCamlVersion = "4.13";
 
   pname = "mirage-crypto";
-  version = "2.3.0";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${finalAttrs.version}/mirage-crypto-${finalAttrs.version}.tbz";
-    hash = "sha256-hA+/QTZgW0ofHdXAYRkyonT+O/l0ZMgqazqXMaaOII4=";
+    hash = "sha256-MyiGw2XGA1B3485namPaj3UAwVoWKLPAfhObDlUfH28=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/prefect/default.nix b/pkgs/development/python-modules/prefect/default.nix
index 464107d45118..f729604662a1 100644
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -92,7 +92,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "prefect";
-  version = "3.8.3";
+  version = "3.8.4";
   pyproject = true;
 
   # keeps list elements containing spaces intact, which disabledTests below needs
@@ -102,7 +102,7 @@ buildPythonPackage (finalAttrs: {
     owner = "PrefectHQ";
     repo = "prefect";
     tag = finalAttrs.version;
-    hash = "sha256-C20gFzsswVOVfJiz2UcDamUSSMbvm+KVIM115ZAzEyM=";
+    hash = "sha256-o5mYaGuYDBixac99T68niXKoDOENHGfExGhs3vDEONc=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 82a08cb36728..956e33771b40 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,43 +5,43 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.184",
-        "hash": "sha256:1facdyxlvcmfkiman0jzq6nvjs81h51arzmyl1pqam30bc47c2cn",
+        "version": "6.1.185",
+        "hash": "sha256:0x1639znr91szyahgj2ni7ymcm46dmm41ispfx4jdikx2fhxjr1q",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.217",
-        "hash": "sha256:1rd5ffv9j3d5g2iygapjgkmqpsqfq69xyig3jifmmr5x9wsgs873",
+        "version": "5.15.218",
+        "hash": "sha256:0dpjimmxs648j9gri7h3flfimb1647a8629pgsvyxsgk6k8ip063",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.266",
-        "hash": "sha256:1zisyafmky3s4byxh98gg8q4gw702gkcp2krf1q6z94hjfza63ll",
+        "version": "5.10.267",
+        "hash": "sha256:01migk31fib50zgqf8rqmm71cff8s93msvy20sy8mj22mi80fi2v",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.153",
-        "hash": "sha256:0mwmr68vz1a296gkizwywvrjr8i86wg3crk777p0sli3i437gg1r",
+        "version": "6.6.154",
+        "hash": "sha256:0d02xm0xglyhac9iyf01a01ab0kp0ghkar8qq6gj6l5h7pw01vpd",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.105",
-        "hash": "sha256:0ggni16ill7acfxsmwr96q2zfcia1v19sif32csv2acm24g80dpb",
+        "version": "6.12.106",
+        "hash": "sha256:11fpivj271143v8rdk4jifbpxxrd3saphq9za027d76rc5bmb4h3",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.46",
-        "hash": "sha256:186c850qncfvwqnvmllzkiqj6xfrh6h4nh65d4lwq0lbh29lpm7m",
+        "version": "6.18.47",
+        "hash": "sha256:0678vsivrr3qw2pdg2ch26a2kx365cm1gy3w21rm86k08gyvlgqv",
         "lts": true
     },
     "7.1": {
-        "version": "7.1.10",
-        "hash": "sha256:16crmblk96nwjzpbb22fpcj0r4ky63f1njvliv4vxwq2g9lz9lk7",
+        "version": "7.1.11",
+        "hash": "sha256:1z0s6pv34d5mk75jxj05s6hzy2x6vahc5dxxbkp5pirfiw6m8a9h",
         "lts": false
     },
     "7.2": {
-        "version": "7.2",
-        "hash": "sha256:1cq2jj1g06gav6xvbxfb1l5jlp43b52ffjvg08ckix8d9k8z7zpr",
+        "version": "7.2.1",
+        "hash": "sha256:1csp8m7a5ws9j35x7bc2cb8067illqx5v1cc0sz8zsi8ia60jn21",
         "lts": false
     }
 }
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index fa59c6984e6f..cb2edc9456b6 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.13.1";
+  version = "2.13.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-80Jq+26l+VKZX2fR5a/08hfpLA8RLCqFmZALK+U4SPQ=";
+    hash = "sha256-JFXxv46hUYPxdNjIgEn8pI3yV7z1CopIp9KfdDxkHU8=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
index 9314ed1798c0..9e850d97dc43 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "weather-radar-card";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "jpettitt";
     repo = "weather-radar-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4c7XMHfLx5tE6NFHfKn6s9pOktVJcaSulhz7s1FXgcQ=";
+    hash = "sha256-94fag6+i+9otVQRAllZA0dSyC0MGhv0Q6brEavWMs8k=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsFetcherVersion = 2;
   npmFlags = [ "--legacy-peer-deps" ];
-  npmDepsHash = "sha256-1ln1V9UzyN9KyaYkUfCJbeItSIcV3/Mqzc90CoNM3W4=";
+  npmDepsHash = "sha256-pYvnYYgmm4+2fOO/pLR+OtlKfBKf2Xws6Oz8mEOSNPM=";
 
   installPhase = ''
     runHook preInstall