diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix
index 8ff62f0dbf28..18648d2e3451 100644
--- a/nixos/modules/services/matrix/matrix-authentication-service.nix
+++ b/nixos/modules/services/matrix/matrix-authentication-service.nix
@@ -11,16 +11,15 @@ let
     filter
     filterAttrs
     getExe
+    getExe'
     isAttrs
     isList
     mapAttrs
-    mkDefault
     mkEnableOption
     mkIf
     mkOption
     mkPackageOption
     optional
-    optionalAttrs
     types
     ;
 
@@ -45,6 +44,11 @@ let
     else
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
+
+  extraConfigFiles = lib.imap0 (
+    i: _: "$CREDENTIALS_DIRECTORY/config-${toString i}"
+  ) cfg.extraConfigFiles;
+  runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {
   meta.maintainers = with lib.maintainers; [
@@ -370,6 +374,23 @@ in
         such as the Matrix homeserver if it's running on the same host.
       '';
     };
+
+    credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = ''
+        Mapping of credential name to  source file-path. Exposed to the unit via LoadCredential and
+        readable inside the service at `''${CREDENTIALS_DIRECTORY}/<name>`.
+
+        For example:
+
+        ```
+        services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared";
+        services.matrix-authentication-service.settings.matrix.secret_file =
+          "\''${CREDENTIALS_DIRECTORY}/synapse-secret";
+        ```
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -390,13 +411,20 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         DynamicUser = true;
-        ExecStartPre = ''
-          ${getExe cfg.package} config check \
-            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
+        LoadCredential =
+          (lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles)
+          ++ (lib.mapAttrsToList (name: path: "${name}:${path}") cfg.credentials);
+        ExecStartPre = pkgs.writeShellScript "mas-prepare" ''
+          ${getExe' pkgs.gettext "envsubst"} \
+            '$CREDENTIALS_DIRECTORY' \
+            < ${configFile} \
+            > /run/matrix-authentication-service/config.yaml
+          ${getExe cfg.package} config check --config ${runtimeConfig} \
+            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
         '';
         ExecStart = ''
-          ${getExe cfg.package} server \
-            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
+          ${getExe cfg.package} server --config ${runtimeConfig} \
+            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
         '';
         Restart = "on-failure";
         RestartSec = "1s";
@@ -438,6 +466,7 @@ in
         # Working and state directories
         StateDirectory = "matrix-authentication-service";
         StateDirectoryMode = "0700";
+        RuntimeDirectory = "matrix-authentication-service";
         WorkingDirectory = "/var/lib/matrix-authentication-service";
       };
     };
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 771fc92c02a4..eb344d92377a 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1691,9 +1691,7 @@ in
       )
     );
 
-    environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
-      source = configFile;
-    };
+    environment.etc."nginx/nginx.conf".source = configFile;
 
     security.acme.certs =
       let
diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix
index 2e93652b495e..9194b1fc56cd 100644
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@@ -237,13 +237,14 @@ in
               {
                 id = masULID;
                 client_id = oidcClientID;
-                client_secret = oidcClientSecret;
+                client_secret_file = "\${CREDENTIALS_DIRECTORY}/oidc_client_secret";
                 issuer = "https://${dexDomain}:5556";
                 scope = "openid email profile";
                 token_endpoint_auth_method = "client_secret_post";
               }
             ];
           };
+          credentials.oidc_client_secret = "${pkgs.writeText "oidc-client-secret" oidcClientSecret}";
         };
         services.postgresql.authentication = pkgs.lib.mkOverride 10 ''
           local all all trust
diff --git a/pkgs/by-name/an/anyk/package.nix b/pkgs/by-name/an/anyk/package.nix
index 962e55cc5dea..b9b453d61c03 100644
--- a/pkgs/by-name/an/anyk/package.nix
+++ b/pkgs/by-name/an/anyk/package.nix
@@ -36,7 +36,7 @@ let
 
     src = lib.sources.sourceFilesBySuffices ./. [ "pom.xml" ];
 
-    mvnHash = "sha256-4keHPzS8pbIIwODmBUMofJt27n5WqYh+IGqE6d9od7k=";
+    mvnHash = "sha256-6pezqcTIPR5NYFQUmLZ5Y3TOd+XRcB/eRmNSAEoBmls=";
 
     installPhase = ''
       mkdir -p $out/share/java
diff --git a/pkgs/by-name/au/autopush-rs/package.nix b/pkgs/by-name/au/autopush-rs/package.nix
index 08c946b5d6a4..0ab3b4fe426e 100644
--- a/pkgs/by-name/au/autopush-rs/package.nix
+++ b/pkgs/by-name/au/autopush-rs/package.nix
@@ -47,7 +47,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "autopush";
-  version = "1.81.3";
+  version = "1.82.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -61,10 +61,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "mozilla-services";
     repo = "autopush-rs";
     tag = finalAttrs.version;
-    hash = "sha256-DP02mcEMoQoJqi5rw5eSuep0i7zeJ0LLYsakikt9hho=";
+    hash = "sha256-wOnuYh18q2XDAcCUBGsidAMvOi10s4njVKDLhtNJEoU=";
   };
 
-  cargoHash = "sha256-LqmuUtFF30TO6iw7LPFB7yJGrzrhh7R0OKCWMhe/OjU=";
+  cargoHash = "sha256-FiMEDc2wxQPkM50cNKzP8yo90HGMakn6JUl/xheaciQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cl/clickhouse/lts.nix b/pkgs/by-name/cl/clickhouse/lts.nix
index b2f2710aec4b..297d75ea3bd9 100644
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.15.4-lts";
-  rev = "3c767441a1ed9b5828b94806d87a25501d1f7364";
-  hash = "sha256-7vhnUjmZtHm2v8a7w2gBxgFz153kbbUi94oy04vheLo=";
+  version = "26.3.17.4-lts";
+  rev = "00f5ad7bc29d8bb65e1f7eb24208da15db3cf642";
+  hash = "sha256-RJSqcsn3ZOL145RTUs4QujPm6DHjDSYiL9jI1C1YCVE=";
   lts = true;
 }
diff --git a/pkgs/by-name/co/cockpit-zfs/package.nix b/pkgs/by-name/co/cockpit-zfs/package.nix
index 58e5fc00e1c8..99de320d99f9 100644
--- a/pkgs/by-name/co/cockpit-zfs/package.nix
+++ b/pkgs/by-name/co/cockpit-zfs/package.nix
@@ -15,7 +15,7 @@
   mbuffer,
   msmtp,
   nix-update-script,
-  nodejs,
+  nodejs_22,
   openssh,
   samba,
   shadow,
@@ -27,6 +27,22 @@
   yarn-berry,
   zfs,
 }:
+let
+  # Pin to Node <24.15.0: Yarn Berry's PnP linker breaks `require.cache` on
+  # newer Node, which crashes tailwindcss mid-build (and ESLint, per
+  # yarnpkg/berry#7106). See NixOS/nixpkgs#530137.
+  #
+  # `nodejs` is rebound here (rather than touched at every call site below)
+  # so the rest of this file is unaffected.
+  #
+  # yarn-berry's own `yarn` binary gets patchShebang'd against whatever
+  # `nodejs` *it* was built with, so overriding nativeBuildInputs alone does
+  # nothing - we have to rebuild yarn-berry itself against nodejs_22, for
+  # both the host and build-platform (cross-compilation) variants.
+  nodejs = nodejs_22;
+  yarnBerry = yarn-berry.override { inherit nodejs; };
+  yarnBerryForBuild = buildPackages.yarn-berry.override { nodejs = buildPackages.nodejs_22; };
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-zfs";
@@ -49,17 +65,17 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
 
   # Use buildPackages for cross-compilation support
-  offlineCache = buildPackages.yarn-berry.fetchYarnBerryDeps {
+  offlineCache = yarnBerryForBuild.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
     hash = "sha256-Tdxe5bXN9psSrnUXL1f+1nh4WPzuvOI7j0I+VPU2/1s=";
   };
 
   nativeBuildInputs = [
     makeWrapper
-    nodejs
+    nodejs_22
     jq
-    yarn-berry
-    buildPackages.yarn-berry.yarnBerryConfigHook
+    yarnBerry
+    yarnBerryForBuild.yarnBerryConfigHook
   ];
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
@@ -76,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     lsscsi
     mbuffer
     msmtp
-    nodejs
+    nodejs_22
     openssh
     samba
     shadow
diff --git a/pkgs/by-name/co/commafeed/package.nix b/pkgs/by-name/co/commafeed/package.nix
index 6284a4ca3c5b..47746936bdf2 100644
--- a/pkgs/by-name/co/commafeed/package.nix
+++ b/pkgs/by-name/co/commafeed/package.nix
@@ -54,7 +54,7 @@ maven.buildMavenPackage {
 
   pname = "commafeed";
 
-  mvnHash = "sha256-jAU1zaTftMuB1WgOeFzU1i+fFHAw6JYxTGw2mY8VlQw=";
+  mvnHash = "sha256-P3pmU/ou/gErk91ANjD4QuBTldBPKHYtGJREJQVgde8=";
   mvnJdk = jdk25;
 
   mvnParameters = lib.escapeShellArgs [
diff --git a/pkgs/by-name/cr/credspy/package.nix b/pkgs/by-name/cr/credspy/package.nix
new file mode 100644
index 000000000000..f964103921ab
--- /dev/null
+++ b/pkgs/by-name/cr/credspy/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "credspy";
+  version = "1.0.0-unstable-2026-06-22";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "RedByte1337";
+    repo = "CredSpy";
+    # https://github.com/RedByte1337/CredSpy/issues/2
+    rev = "0fa54595fd6e5d1f903d8d248a7e9f3203e7ec09";
+    hash = "sha256-PHSLke90obZw2cwY7zqp1DNnG26Hf+ixHunMwQHoU3o=";
+  };
+
+  build-system = with python3Packages; [ hatchling ];
+
+  dependencies = with python3Packages; [ requests ];
+
+  pythonImportsCheck = [ "credspy" ];
+
+  # Project has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Entra ID user enumeration and auth method discovery";
+    homepage = "https://github.com/RedByte1337/CredSpy";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "credspy";
+  };
+})
diff --git a/pkgs/by-name/cr/cryptomator-cli/package.nix b/pkgs/by-name/cr/cryptomator-cli/package.nix
index b98ee6ba9bed..381bc7520644 100644
--- a/pkgs/by-name/cr/cryptomator-cli/package.nix
+++ b/pkgs/by-name/cr/cryptomator-cli/package.nix
@@ -27,7 +27,7 @@ maven.buildMavenPackage rec {
 
   mvnJdk = jdk;
   mvnParameters = "-Dmaven.test.skip=true";
-  mvnHash = "sha256-54DT4C+WzyUBPxayA9YnB9I/Igd19iZygByUh5of51I=";
+  mvnHash = "sha256-oMfgWQ6mID1me0OP+BIwGJShCV5r/ahHlcAJ+S1KRBA=";
 
   env = {
     APP_VERSION = version;
diff --git a/pkgs/by-name/de/dependency-track/package.nix b/pkgs/by-name/de/dependency-track/package.nix
index 378f54cbb2dc..e15bbc02d63e 100644
--- a/pkgs/by-name/de/dependency-track/package.nix
+++ b/pkgs/by-name/de/dependency-track/package.nix
@@ -84,7 +84,7 @@ maven.buildMavenPackage rec {
   '';
 
   mvnJdk = jre_headless;
-  mvnHash = "sha256-4N4KuJBF/RFZwpp3dIgXntxSEfKHyfvrShKQoUqY5bE=";
+  mvnHash = "sha256-eZuwBt+emThf4mxVaphFgBWNqP64Cs9WIKW+GPvHll4=";
   manualMvnArtifacts = [
     "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1"
     # added to saticfy protobuf compiler plugin dependency resolving
diff --git a/pkgs/by-name/di/digital/package.nix b/pkgs/by-name/di/digital/package.nix
index 676cb42771f0..229ec189f7c4 100644
--- a/pkgs/by-name/di/digital/package.nix
+++ b/pkgs/by-name/di/digital/package.nix
@@ -52,7 +52,7 @@ maven.buildMavenPackage rec {
   };
 
   inherit mvnParameters;
-  mvnHash = "sha256-wm/axWJucoW9P98dKqHI4bjrUnmBTfosCOdJg9VBJ+4=";
+  mvnHash = "sha256-qFJvpxK6PDmMfeL5fKVHUzK2NRLcQhQ3PJbwv2hYZqY=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/dn/dnsproxy/package.nix b/pkgs/by-name/dn/dnsproxy/package.nix
index d2fc76c85422..c6cdb6d87806 100644
--- a/pkgs/by-name/dn/dnsproxy/package.nix
+++ b/pkgs/by-name/dn/dnsproxy/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnsproxy";
-  version = "0.81.4";
+  version = "0.82.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KHun1/Da6wfOuMc9D8AJrgZg5PwuXAY6IVajSHa3rRE=";
+    hash = "sha256-d/PZrfH8jR4kcBX5Ze/06vDcDTlKWxHZ2gvi7eJF2j8=";
   };
 
-  vendorHash = "sha256-dcT9miAerC7c9LsC8FoR61xFXLZjxm7LZlTRalB4oSU=";
+  vendorHash = "sha256-QsNhCfqhqPv01xM/ojO3K4ktyTrUgdR79cQICtP2y1g=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/do/doctoc/package.nix b/pkgs/by-name/do/doctoc/package.nix
index 1f7bde794ff3..b1e918aeec28 100644
--- a/pkgs/by-name/do/doctoc/package.nix
+++ b/pkgs/by-name/do/doctoc/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "doctoc";
-  version = "2.2.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "thlorenz";
     repo = "doctoc";
     rev = "v${version}";
-    hash = "sha256-LYVxW8bZ4M87CmBvPyp4y0IeL9UFawwAKnUWHEWB5Gs=";
+    hash = "sha256-EmTZLy/eHtJ0Wi8EFP2lHdFKBut/8/aghRKZr1WHcNk=";
   };
 
-  npmDepsHash = "sha256-TbAnFpiN/v6xjQQznL/B180f0W48HPRqW21cO9XZhYA=";
+  npmDepsHash = "sha256-rY9acsWMcR6cf9k0/rSoBvhuk96Yj8Yt8uhsC8dyQZU=";
 
   postInstall = ''
     find $out/lib/node_modules -xtype l -delete
diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix
index fdc8cc848793..b95a0c00b191 100644
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "drupal";
-  version = "11.3.13";
+  version = "11.4.0";
 
   src = fetchFromGitLab {
     domain = "git.drupalcode.org";
     owner = "project";
     repo = "drupal";
     tag = finalAttrs.version;
-    hash = "sha256-t60EbgN3r9KmSyZcvLtUy+H4eRizqFyI3bLFHH1/ciY=";
+    hash = "sha256-om+WoR+uIGhHjttWpavBx3PJ4HUft4Hjtrr4F3csBsI=";
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-DaKWrdFNHppZm4a8wexfwapSPDhlNL45ftVQ+YSY18s=";
+  vendorHash = "sha256-9MQ6C0gslubUlDeUSI5Tv4jO9SbxPzciOjry0KB7plI=";
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/ex/exificient/package.nix b/pkgs/by-name/ex/exificient/package.nix
index f64ee15654ad..a5d60537678b 100644
--- a/pkgs/by-name/ex/exificient/package.nix
+++ b/pkgs/by-name/ex/exificient/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-XrlZQf2BamYw8u1S2qQ6jV9mgyCEjBxKqPZCXMJzXmc=";
   };
 
-  mvnHash = "sha256-/72Pi8WbKhPXu7Zb9r30znY1FHJc7FM42f7uQJqJnWo=";
+  mvnHash = "sha256-8q8voXYxOhWcb3U2Nqg/LRhSru94puhymQa7Z9FR0+g=";
 
   mvnParameters = "package assembly:single -Dmaven.test.skip=true";
 
diff --git a/pkgs/by-name/fi/filius/package.nix b/pkgs/by-name/fi/filius/package.nix
index 3bf63e93e17c..ea23e6eaf3bc 100644
--- a/pkgs/by-name/fi/filius/package.nix
+++ b/pkgs/by-name/fi/filius/package.nix
@@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-sIcYjbWONg8Cq+dHpoBYj07cyHV7oX06Xh1zK0CHn64=";
   };
 
-  mvnHash = "sha256-/gA49V1Kjh4zJTzDCzFNwZF30ERwPk2lG6lw/jxM2Qo=";
+  mvnHash = "sha256-41NirfgR9EhHLRT3V6P5KrakYKZ6dJTlXZu6rgCAK3I=";
   mvnParameters = "-Plinux";
 
   # tests want to create an X11 window which isn't often feasible
diff --git a/pkgs/by-name/fo/fop/package.nix b/pkgs/by-name/fo/fop/package.nix
index 34db373d0130..6f0767a25302 100644
--- a/pkgs/by-name/fo/fop/package.nix
+++ b/pkgs/by-name/fo/fop/package.nix
@@ -18,7 +18,7 @@ maven.buildMavenPackage (finalAttrs: {
 
   patches = [ ./fix-maven-plugin-versions.patch ];
 
-  mvnHash = "sha256-EaOIAy0+YPrF+yGsFKKqcA4bt90bq1Z86V57P9rMatE=";
+  mvnHash = "sha256-KfIcc1MWGs7vZHPjfNgy3NBCAyTMtyvRTZfcN4LQVv8=";
 
   buildOffline = true;
   doCheck = false;
diff --git a/pkgs/by-name/go/gol/package.nix b/pkgs/by-name/go/gol/package.nix
index b8d1225f438e..2fb848e64b87 100644
--- a/pkgs/by-name/go/gol/package.nix
+++ b/pkgs/by-name/go/gol/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-AnPm5Mooww9kAMWLnM36z8DVRGfIIEiqUE65tgNuKm8=";
   };
 
-  mvnHash = "sha256-YD28YX0RKuxOEWuK12ToOnFFrUPqA9xZ+EmsCt1fDPI=";
+  mvnHash = "sha256-kLSMLt0TMMuyWLU65Y+4CpEn5PIm/+nLg1+oBR5w3pI=";
   mvnParameters = "compile assembly:single -Dmaven.test.skip=true";
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/gr/graphhopper/version.toml b/pkgs/by-name/gr/graphhopper/version.toml
index 64b95b5ab207..ad1a26b8902e 100644
--- a/pkgs/by-name/gr/graphhopper/version.toml
+++ b/pkgs/by-name/gr/graphhopper/version.toml
@@ -5,4 +5,4 @@ mapsBundle = "0.0.0-f171bcf55e447bf494348dd274cd377b73c951f6"
 [hash]
 src = "sha256-tK8zEX2szcU77ydHW+ak/GTjKKC6C5xlG0Uum7a/76I="
 mapsBundle = "sha256-ehwWBIuYBwXu7W7uHYYuGl0lS4s6Tm5c4BfKPkY+w0A="
-mvnDeps = "sha256-0B38C37QbkOhxd5e4SHfMg9SqcUZkuIf1g1S9SnCu7U="
+mvnDeps = "sha256-bP019enDiHdKVtXvFXvBmsg9CtDTXA1t3VVjX3Xf8M0="
diff --git a/pkgs/by-name/h2/h2/package.nix b/pkgs/by-name/h2/h2/package.nix
index 32684fe191d6..e213425d32cc 100644
--- a/pkgs/by-name/h2/h2/package.nix
+++ b/pkgs/by-name/h2/h2/package.nix
@@ -24,7 +24,7 @@ maven.buildMavenPackage (finalAttrs: {
   };
 
   mvnParameters = "-f h2/pom.xml";
-  mvnHash = "sha256-ue1X0fswi3C9uqJ/cVCf/qd2XStMve1k1qA+IsREOGk=";
+  mvnHash = "sha256-j4Uso/bl4UhQbJc7Wre0btgC+9RKvuCHkn9euQFuTxk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/ha/hacksguard/package.nix b/pkgs/by-name/ha/hacksguard/package.nix
new file mode 100644
index 000000000000..72f93cb69085
--- /dev/null
+++ b/pkgs/by-name/ha/hacksguard/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hacksguard";
+  version = "0.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Rhacknarok";
+    repo = "hacksguard";
+    tag = finalAttrs.version;
+    hash = "sha256-kS8VF1zD4VV9rSLz4euvNwtOUFWLeW2isAjgjw/iay0=";
+  };
+
+  cargoHash = "sha256-7Wt2cFKwWT82P2uxOy/lGEWZcCUSu0BNr9JdgRLwBnw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Multi-threaded TUI malware analysis tool";
+    homepage = "https://github.com/Rhacknarok/hacksguard";
+    changelog = "https://github.com/Rhacknarok/hacksguard/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "hacksguard";
+  };
+})
diff --git a/pkgs/by-name/im/immich-kiosk/package.nix b/pkgs/by-name/im/immich-kiosk/package.nix
index 4ef4132a37af..113ce904c923 100644
--- a/pkgs/by-name/im/immich-kiosk/package.nix
+++ b/pkgs/by-name/im/immich-kiosk/package.nix
@@ -3,68 +3,61 @@
   buildGoModule,
   fetchFromGitHub,
   nodejs,
-  pnpm_9,
-  fetchPnpmDeps,
-  pnpmConfigHook,
+  fetchNpmDeps,
+  npmHooks,
+  go-task,
 }:
+
 buildGoModule rec {
   pname = "immich-kiosk";
-  version = "0.31.0";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "damongolding";
     repo = "immich-kiosk";
     tag = "v${version}";
-    hash = "sha256-PHdHhhVy0RWMFzR4ZEyWLOiRYHROadLiPIdqkUZMTow=";
+    hash = "sha256-kdTEvH8MqL3oXe0QZlPTVpeByLpqAdNfPGfu5f2G6g0=";
   };
 
-  # Delete vendor directory to regenerate it consistently across platforms
   postPatch = ''
+    # Delete vendor directory to regenerate it consistently across platforms
     rm -rf vendor
+    # immich-kiosk bumps go at a faster cadence than nixpkgs
+    sed 's/^go 1\.26\.\d+$/go 1.26/' go.mod
   '';
-  vendorHash = "sha256-3M3fXwCkljfY8wjXf+PdcbqnkyPKaDCJWt9/nRA/+Dc=";
+  vendorHash = "sha256-y6Xl00G+mkhRKVGwMS0WCXZhQqqGGX5qY8PhMxtw7z8=";
   proxyVendor = true;
 
-  pnpmDeps = fetchPnpmDeps {
-    inherit
-      pname
-      version
-      src
-      ;
-    pnpm = pnpm_9;
+  npmDeps = fetchNpmDeps {
+    inherit src;
     sourceRoot = "${src.name}/frontend";
-    hash = "sha256-8iKug4zsX3u0vS68osKRW6iOP+A3OdjI3yxNPIJaQqM=";
-    fetcherVersion = 3;
+    hash = "sha256-lNON0/lxix2aczC0+m7Er5Te1+4fsSoLkk6Z2pYzQYQ=";
   };
-
   # Frontend is in a subdirectory
-  pnpmRoot = "frontend";
+  npmRoot = "frontend";
 
   nativeBuildInputs = [
     nodejs
-    pnpmConfigHook
-    pnpm_9
+    go-task
+    npmHooks.npmConfigHook
   ];
 
   # Generate templ templates during vendor hash calculation
-  # Don't run pnpm in this phase - filter out pnpmConfigHook
+  # Don't run npm in this phase - filter out npmConfigHook
   overrideModAttrs = oldAttrs: {
-    nativeBuildInputs = builtins.filter (drv: drv != pnpmConfigHook) (
+    nativeBuildInputs = builtins.filter (drv: drv != npmHooks.npmConfigHook) (
       oldAttrs.nativeBuildInputs or [ ]
     );
     preBuild = ''
-      go run github.com/a-h/templ/cmd/templ generate
+      go tool templ generate
     '';
   };
 
   # Generate templ templates and build frontend assets before Go build
   # Frontend assets are embedded into the binary via go:embed
   preBuild = ''
-    go run github.com/a-h/templ/cmd/templ generate
-
-    pushd frontend
-    pnpm build
-    popd
+    go tool templ generate
+    task frontend
   '';
 
   ldflags = [
diff --git a/pkgs/by-name/ir/iredis/package.nix b/pkgs/by-name/ir/iredis/package.nix
index a8fbb956c9ef..bef043b7dcbd 100644
--- a/pkgs/by-name/ir/iredis/package.nix
+++ b/pkgs/by-name/ir/iredis/package.nix
@@ -1,34 +1,34 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "iredis";
-  version = "1.15.2";
+  version = "1.16.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "laixintao";
     repo = "iredis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g/gQb9QOyfa7kyHCUZf/kLZRO5IE8389BUCYz8Sqr8o=";
+    hash = "sha256-m8XDNzHgMWBgcN3AyFlb8K/UNXbGhH4toKBiX5Q4/QY=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'packaging = "^23.0"' 'packaging = "*"' \
-      --replace-fail 'wcwidth = "0.1.9"' 'wcwidth = "*"' \
-      --replace-fail 'redis = "^5.0.0"' 'redis = "*"'
-  '';
+  pythonRelaxDeps = [
+    "packaging"
+    "redis"
+  ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     click
     configobj
     mistune
@@ -37,10 +37,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     pygments
     python-dateutil
     redis
-    wcwidth
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     freezegun
     pexpect
     pytestCheckHook
@@ -65,6 +64,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonImportsCheck = [ "iredis" ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   meta = {
     description = "Terminal Client for Redis with AutoCompletion and Syntax Highlighting";
     changelog = "https://github.com/laixintao/iredis/blob/${finalAttrs.src.tag}/CHANGELOG.md";
diff --git a/pkgs/by-name/ja/java-language-server/package.nix b/pkgs/by-name/ja/java-language-server/package.nix
index 234270d9cb12..7ab88894f51f 100644
--- a/pkgs/by-name/ja/java-language-server/package.nix
+++ b/pkgs/by-name/ja/java-language-server/package.nix
@@ -32,7 +32,7 @@ maven.buildMavenPackage {
 
   mvnFetchExtraArgs.dontConfigure = true;
   mvnJdk = jdk_headless;
-  mvnHash = "sha256-2uthmSjFQ43N5lgV11DsxuGce+ZptZsmRLTgjDo0M2w=";
+  mvnHash = "sha256-xxTR+2E+4nIkGwxCk0B+f0//rLdlqO/nwRaArxt3u8U=";
 
   nativeBuildInputs = [
     jdk_headless
diff --git a/pkgs/by-name/jc/jchempaint/package.nix b/pkgs/by-name/jc/jchempaint/package.nix
index f3cc48097538..2edc4ec773c2 100644
--- a/pkgs/by-name/jc/jchempaint/package.nix
+++ b/pkgs/by-name/jc/jchempaint/package.nix
@@ -22,7 +22,7 @@ maven.buildMavenPackage {
     hash = "sha256-pcHX6PdnD/jkLxAMSV/Ts8VVrK9xy2NWiMVVJ7jTrQc=";
   };
 
-  mvnHash = "sha256-VpYSTN5u9IhCakak48HhbwnT3FhMpPKlwRZztiNGEIw=";
+  mvnHash = "sha256-L5Gru4b8lMiDWapzaK9VXoKqRkJnXc1uKUn5Vjmnrqc=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/jm/jmc2obj/package.nix b/pkgs/by-name/jm/jmc2obj/package.nix
index efc0114dc310..a1c24a6599ab 100644
--- a/pkgs/by-name/jm/jmc2obj/package.nix
+++ b/pkgs/by-name/jm/jmc2obj/package.nix
@@ -18,7 +18,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-3+vH1pGJ6I4oobb2vk+J5GrOQrSLNoCuBIC9OsWYCj0=";
   };
 
-  mvnHash = "sha256-ZU/5RGujCdmlBuxtHDaBpF/54e8W/Kca+2jtTudMXWo=";
+  mvnHash = "sha256-y+K6FR0USh4LUyv/w5n3pRVILtMRKg64+3D7yfE1IP8=";
 
   mvnParameters = "-Dmaven.gitcommitid.skip=true";
 
diff --git a/pkgs/by-name/jn/jnr-posix/package.nix b/pkgs/by-name/jn/jnr-posix/package.nix
index d8f78c6a3481..2c102a529296 100644
--- a/pkgs/by-name/jn/jnr-posix/package.nix
+++ b/pkgs/by-name/jn/jnr-posix/package.nix
@@ -45,7 +45,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-gOw0KUFyZEMONwLwlHSiV+ZZ7JQhjZwg708Q1IciUfo=";
+    outputHash = "sha256-Mtu67CcNY5uThfaa7CQr9cHHpjX+EMFktuSZOlLwyFg=";
 
     doCheck = false;
   };
diff --git a/pkgs/by-name/jo/jol/package.nix b/pkgs/by-name/jo/jol/package.nix
index 66aaec985d5e..36115f7b878c 100644
--- a/pkgs/by-name/jo/jol/package.nix
+++ b/pkgs/by-name/jo/jol/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage (finalAttrs: {
     hash = "sha256-ZJFuY2QYB8eUS3y3VRMGGwklCS93HHVkNe/dhyIx0SY=";
   };
 
-  mvnHash = "sha256-yQfiHlAZZgINGAYVlK5JflWX3d8Axtv1Ke89S7x86G4=";
+  mvnHash = "sha256-VXYY7XWRuSjju9mgQ6cvHlJwOK2BklE9j/uj0yczjcI=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/jo/joularjx/package.nix b/pkgs/by-name/jo/joularjx/package.nix
index 4233f4b861bc..240b0b6756b5 100644
--- a/pkgs/by-name/jo/joularjx/package.nix
+++ b/pkgs/by-name/jo/joularjx/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-hr8a3Qr1LdFfGBLVJVkm6hhCW7knG4VpXj7nCtcptuU=";
   };
 
-  mvnHash = "sha256-3y39873pxlQD7d02sbVtZ2I/zcQtPZ30XrA2qY84EzA=";
+  mvnHash = "sha256-XXqpajmHCjDxMZvYnW7EiCsPIuWF8tsE7RmI/gt3iZQ=";
 
   mvnParameters = "-DskipTests -Dmaven.javadoc.skip=true";
 
diff --git a/pkgs/by-name/js/jsign/package.nix b/pkgs/by-name/js/jsign/package.nix
index 2106244bd447..2dfbd3b1a734 100644
--- a/pkgs/by-name/js/jsign/package.nix
+++ b/pkgs/by-name/js/jsign/package.nix
@@ -18,16 +18,16 @@ maven.buildMavenPackage rec {
   pname = "jsign";
   # For build from non-release, increment version by one and add -SNAPSHOT
   # e.g. 7.3-SNAPSHOT
-  version = "7.3";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "ebourg";
     repo = "jsign";
     tag = version;
-    hash = "sha256-FlVTKM1swdNP3kht8MELgUAHPv+FBpwt23WNl/moGjI=";
+    hash = "sha256-r19w9k6Iuk6AQGC3l2yu6Ocn740BtE7DjtFLXUdhdw8=";
   };
 
-  mvnHash = "sha256-N91gwM3vsDZQM/BptF5RgRQ/A8g56NOJ6bc2SkxLnBs=";
+  mvnHash = "sha256-zxlwb2id8yAw/yxTjD6jyAkPJx9IazrPQYGacQGLEK8=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/ko/kotlin-interactive-shell/package.nix b/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
index 710a2d962e02..835493eb94a6 100644
--- a/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
+++ b/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage (finalAttrs: {
     hash = "sha256-3DTyo7rPswpEVzFkcprT6FD+ITGJ+qCXFKXEGoCK+oE=";
   };
 
-  mvnHash = "sha256-UHtvBVw35QBwgCD+nSduR0924ANAOfwrr/a4qPEYsrM=";
+  mvnHash = "sha256-qGxpeb+8hP0ljbI0+aHnuO5efzXvVQWo8VFYMuRzYck=";
   mvnParameters = "compile";
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/le/lemminx/package.nix b/pkgs/by-name/le/lemminx/package.nix
index 8371961d9431..bd5729688e18 100644
--- a/pkgs/by-name/le/lemminx/package.nix
+++ b/pkgs/by-name/le/lemminx/package.nix
@@ -48,7 +48,7 @@ maven.buildMavenPackage rec {
   };
 
   mvnJdk = jdk_headless;
-  mvnHash = "sha256-0KnaXr5Mmwm0pV4o5bAX0MWKl6f/cvlO6cyV9UcgXeo=";
+  mvnHash = "sha256-IJBmztfNco5UF0BwfeU5QHwvr50bXsrZFOSIPoGBijA=";
 
   # Disable gitcommitid plugin which needs a .git folder which we don't have.
   # Disable failing tests which either need internet access or are flaky.
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 4ccf3c299e9e..6a545c1b71f1 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "152.0.2-1";
+  version = "152.0.4-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-Tq2bj75oZXSH2YHXShjRRs4Aqxo86BuwONXu+IsdCuA=";
-        aarch64-linux = "sha256-xk3o5FODm5ge2I8JzgwXTpgu/SI6VcROIJ7005ew2PY=";
+        x86_64-linux = "sha256-4vmsv93ENtteE18uGJF2ZEhaRA3nGJg//WYYdBREIig=";
+        aarch64-linux = "sha256-Q1vT/9qOs2AiMRsLcofF7F2Y+5QJJloI/QSVZwA9gC8=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };
diff --git a/pkgs/by-name/ma/mariadb-connector-java/package.nix b/pkgs/by-name/ma/mariadb-connector-java/package.nix
index c354e2578df9..bb69fb838287 100644
--- a/pkgs/by-name/ma/mariadb-connector-java/package.nix
+++ b/pkgs/by-name/ma/mariadb-connector-java/package.nix
@@ -16,7 +16,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-ScdrBSJKbVyD/omPrxiZvuaa5uOo2d3SqX/ozalMWHk=";
   };
 
-  mvnHash = "sha256-pQYLMsxNVdby4WkO/dznIqqeu2dTtiBjrpJ/A3MuJ5Y=";
+  mvnHash = "sha256-CiUXHrabVX+ragocKbd4erIWr7J4kuWYcKYCDycpIrs=";
 
   doCheck = false; # Requires networking
 
diff --git a/pkgs/by-name/ma/maven/package.nix b/pkgs/by-name/ma/maven/package.nix
index fbdaaa80885f..43c4799a1254 100644
--- a/pkgs/by-name/ma/maven/package.nix
+++ b/pkgs/by-name/ma/maven/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "maven";
-  version = "3.9.12";
+  version = "3.9.16";
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-3/${finalAttrs.version}/binaries/apache-maven-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha256-+iyZSHKSlsI6/Rj9AakPYs3aCaRhkbVKi8N2TC7ugS4=";
+    hash = "sha256-gP/KIq7Z6LlxOiMvM5T9gdfyAyLfde/bKwR9vT46I7s=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/me/megabasterd/package.nix b/pkgs/by-name/me/megabasterd/package.nix
index ab56f5528fbe..7c1e2b8d6ce4 100644
--- a/pkgs/by-name/me/megabasterd/package.nix
+++ b/pkgs/by-name/me/megabasterd/package.nix
@@ -19,7 +19,7 @@ maven.buildMavenPackage {
     hash = "sha256-6PKBzQA3lBa9/7J8bymGmnW3OPsRV4GgZ7dc7H6fOuE=";
   };
 
-  mvnHash = "sha256-DVfPmW0ep6y/GxnwNKXxo68W5idcTkoNqUEKm7ouTEY=";
+  mvnHash = "sha256-JZ8INISDHPVhxylKwQc2DybPqxfwcGpkWxDhq8Fpqt8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 30d62e16dfb9..f8ef9d7880df 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.6.13";
+  version = "2026.7.0";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/HE/2bHUz1gPpyLZnKZO5ZqT5oxOn+SZ0J4vyj67Ohs=";
+    hash = "sha256-F/hxgkqLk36906uhr56W+4Evwc8WLbYWw8pibGsq3EY=";
   };
 
-  cargoHash = "sha256-p7PCqwS0bI7kXvGYZm4bWpYhz1kkqILDCPGlEq32Cqo=";
+  cargoHash = "sha256-W88dlxvDEwN6C1j1WMtL/KodWQZ9UnI1VJc3xp1Lnqw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mm/mmj2/package.nix b/pkgs/by-name/mm/mmj2/package.nix
index c9d760c6757b..84c06933408d 100644
--- a/pkgs/by-name/mm/mmj2/package.nix
+++ b/pkgs/by-name/mm/mmj2/package.nix
@@ -25,7 +25,7 @@ maven.buildMavenPackage {
     hash = "sha256-WYBrLY04+bJGzjRMs8LgHnI6lMRhQKyz15DIoLeiE2s=";
   };
 
-  mvnHash = "sha256-fu/q6CTvSllrfgnKNX6aIuPO65H/q0IPCHFuWmOFOvM=";
+  mvnHash = "sha256-MTI393L/t9AXYbE9hvkIQ28WzYmjt9B22XbFSlLQQUk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/mo/mo-viewer/package.nix b/pkgs/by-name/mo/mo-viewer/package.nix
index f4891b308b43..2f50164949f6 100644
--- a/pkgs/by-name/mo/mo-viewer/package.nix
+++ b/pkgs/by-name/mo/mo-viewer/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mo-viewer";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "mo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/dUAz55hsDYV+1rgNN52rdO798SCRyIyHXrL/ZGTwmY=";
+    hash = "sha256-DbcktOAdcg/v5q3gYgxMvSHVtwXODz9xHoPqiiWBaP4=";
   };
 
   frontend = stdenvNoCC.mkDerivation (finalFrontendAttrs: {
diff --git a/pkgs/by-name/mu/mustang-cli/package.nix b/pkgs/by-name/mu/mustang-cli/package.nix
index 200649af7879..4809ea3bf584 100644
--- a/pkgs/by-name/mu/mustang-cli/package.nix
+++ b/pkgs/by-name/mu/mustang-cli/package.nix
@@ -32,7 +32,7 @@ maven.buildMavenPackage (finalAttrs: {
   strictDeps = true;
   __structuredAttrs = true;
 
-  mvnHash = "sha256-ekSgGKY3OMFAEM3bNByBXrU3tpbDcbJ0fmCTRz7NIkA=";
+  mvnHash = "sha256-JjhKHcnLO6OZ6VAI7fFpvS90TK6yOVhX0wk4vrnbFFo=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index 6946f3b06cc0..6551ac34e6ce 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -44,7 +44,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-A6Q6UoeyuOZP4FD4Y6oVOCu1a2bbIe+3xVHQIuOg0qk=";
   };
 
-  mvnHash = "sha256-mZ/mOF9k5URheNNxmrKkCiklP26zeTGKhDGxqRiDBuk=";
+  mvnHash = "sha256-mPNyJ4zijwQg8l0G+2cJPkwAVRFVbpCRfyFkA5ONBIE=";
 
   mvnFetchExtraArgs.preBuild = ''
     mvn -nsu "${timestampParameter}" --projects org.nzbhydra:github-release-plugin "-Dmaven.repo.local=$out/.m2" clean install
diff --git a/pkgs/by-name/op/open-pdf-sign/package.nix b/pkgs/by-name/op/open-pdf-sign/package.nix
index fd6bca29f5b8..e5831145a8e2 100644
--- a/pkgs/by-name/op/open-pdf-sign/package.nix
+++ b/pkgs/by-name/op/open-pdf-sign/package.nix
@@ -26,7 +26,7 @@ maven.buildMavenPackage rec {
     sed -i '/dirtyQualifier/d' ./pom.xml
   '';
 
-  mvnHash = "sha256-oEAvqgH4/vfywPHUfbrIpOIdbeqt+K4H+Pebx5EQqMA=";
+  mvnHash = "sha256-2+6OU1CysNfGnESvAUbqK9RvRDlgIiWGuGC9sHza39c=";
 
   # Disable test requires the network, we also set the version
   mvnParameters = lib.escapeShellArgs [
diff --git a/pkgs/by-name/op/openapi-generator-cli/package.nix b/pkgs/by-name/op/openapi-generator-cli/package.nix
index 817dfca67bce..a60cffc52fa1 100644
--- a/pkgs/by-name/op/openapi-generator-cli/package.nix
+++ b/pkgs/by-name/op/openapi-generator-cli/package.nix
@@ -52,7 +52,7 @@ let
       })
     ];
 
-    mvnHash = "sha256-iWVWVEiwvCwc0ayVjH9joiDchyyNUOhEZjJTMH9CCEE=";
+    mvnHash = "sha256-oJnXNHAYZxWi9YDHw+RR1HWf7hlTKoZmnDIHxXNpp1M=";
     mvnParameters = "-Duser.home=$TMPDIR";
     doCheck = false;
 
diff --git a/pkgs/by-name/op/opendataloader-pdf/package.nix b/pkgs/by-name/op/opendataloader-pdf/package.nix
index b161091a17b9..c86e9b293ab2 100644
--- a/pkgs/by-name/op/opendataloader-pdf/package.nix
+++ b/pkgs/by-name/op/opendataloader-pdf/package.nix
@@ -22,7 +22,7 @@ maven.buildMavenPackage (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/java";
 
-  mvnHash = "sha256-LK673DYibhntPsHXvCM676ZzsE7tYIWPlQ2LFoCVvpc=";
+  mvnHash = "sha256-TWp/vlxqlK+8zqDzQySBKpLRUpLCG7Oa1C/1dIlwmsw=";
   mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openrefine/package.nix b/pkgs/by-name/op/openrefine/package.nix
index 01aa8f922da5..95aefee4eb93 100644
--- a/pkgs/by-name/op/openrefine/package.nix
+++ b/pkgs/by-name/op/openrefine/package.nix
@@ -56,7 +56,7 @@ maven.buildMavenPackage {
 
   mvnJdk = jdk;
   mvnParameters = "-pl !packaging";
-  mvnHash = "sha256-SV5nfyUeyRul/YfZZXor8O37ARdCtKkrHCLzQrmr96s=";
+  mvnHash = "sha256-95lyc+pimtSM6v8S58bLG16/TotbHGa4EhHDzfxwPAk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/op/opensplat/package.nix b/pkgs/by-name/op/opensplat/package.nix
index a4c417c9be8e..acc14b72588c 100644
--- a/pkgs/by-name/op/opensplat/package.nix
+++ b/pkgs/by-name/op/opensplat/package.nix
@@ -20,20 +20,22 @@
   fetchpatch2,
 }:
 let
-  version = "1.1.4";
   torch = python3.pkgs.torch.override { inherit cudaSupport rocmSupport; };
   # Using a normal stdenv with cuda torch gives
   # ld: /nix/store/k1l7y96gv0nc685cg7i3g43i4icmddzk-python3.11-torch-2.2.1-lib/lib/libc10.so: undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32'
   stdenv' = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-stdenv'.mkDerivation {
+stdenv'.mkDerivation (finalAttrs: {
   pname = "opensplat";
-  inherit version;
+  version = "1.1.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "pierotofy";
     repo = "OpenSplat";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-u2UmD0O3sUWELYb4CjQE19i4HUjLMcaWqOinQH0PPTM=";
   };
 
@@ -44,24 +46,34 @@ stdenv'.mkDerivation {
     })
   ];
 
-  postPatch = lib.optionalString rocmSupport ''
-        # ROCm CMake targets must be available before find_package(Torch)
-        # because Torch's Caffe2Targets.cmake references them in torch_hip_library
-        substituteInPlace CMakeLists.txt \
-          --replace-fail "find_package(Torch REQUIRED)" \
-            "find_package(hip REQUIRED)
-    find_package(hiprtc REQUIRED)
-    find_package(hipblas REQUIRED)
-    find_package(hipfft REQUIRED)
-    find_package(hiprand REQUIRED)
-    find_package(hipsparse REQUIRED)
-    find_package(hipsolver REQUIRED)
-    find_package(hipblaslt REQUIRED)
-    find_package(rocblas REQUIRED)
-    find_package(rocsolver REQUIRED)
-    find_package(miopen REQUIRED)
-    find_package(Torch REQUIRED)"
-  '';
+  postPatch = lib.optionalString rocmSupport (
+    # Recent PyTorch HIP builds no longer hipify the caching allocator namespace:
+    # the symbol stays c10::cuda::CUDACachingAllocator instead of c10::hip::HIPCachingAllocator.
+    ''
+      substituteInPlace model.cpp \
+        --replace-fail \
+          "c10::hip::HIPCachingAllocator::emptyCache();" \
+          "c10::cuda::CUDACachingAllocator::emptyCache();"
+    ''
+    # ROCm CMake targets must be available before find_package(Torch)
+    # because Torch's Caffe2Targets.cmake references them in torch_hip_library
+    + ''
+          substituteInPlace CMakeLists.txt \
+            --replace-fail "find_package(Torch REQUIRED)" \
+              "find_package(hip REQUIRED)
+      find_package(hiprtc REQUIRED)
+      find_package(hipblas REQUIRED)
+      find_package(hipfft REQUIRED)
+      find_package(hiprand REQUIRED)
+      find_package(hipsparse REQUIRED)
+      find_package(hipsolver REQUIRED)
+      find_package(hipblaslt REQUIRED)
+      find_package(rocblas REQUIRED)
+      find_package(rocsolver REQUIRED)
+      find_package(miopen REQUIRED)
+      find_package(Torch REQUIRED)"
+    ''
+  );
 
   nativeBuildInputs = [
     cmake
@@ -107,7 +119,11 @@ stdenv'.mkDerivation {
       NIX_LDFLAGS = "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"; # fixes -lcuda not found
     }
     // lib.optionalAttrs rocmSupport {
-      HIPFLAGS = "-I${lib.getInclude rocmPackages.rocthrust}/include -I${lib.getInclude rocmPackages.rocprim}/include";
+      PYTORCH_ROCM_ARCH = torch.gpuTargetString;
+      HIPFLAGS = toString [
+        "-I${lib.getInclude rocmPackages.rocprim}/include"
+        "-I${lib.getInclude rocmPackages.rocthrust}/include"
+      ];
     };
 
   cmakeFlags = [
@@ -139,4 +155,4 @@ stdenv'.mkDerivation {
     ];
     platforms = lib.platforms.linux ++ lib.optionals (!cudaSupport) lib.platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/op/opentofu-mcp-server/package.nix b/pkgs/by-name/op/opentofu-mcp-server/package.nix
index 0c7412035ff9..3d1b3463daeb 100644
--- a/pkgs/by-name/op/opentofu-mcp-server/package.nix
+++ b/pkgs/by-name/op/opentofu-mcp-server/package.nix
@@ -4,15 +4,15 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   nodejs,
-  nix-update-script,
-  pnpm_8,
+  pnpm_10,
   pnpmConfigHook,
   makeWrapper,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opentofu-mcp-server";
-  version = "1.0.0";
+  version = "1.0.0-unstable-2026-06-09";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -20,20 +20,20 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "opentofu";
     repo = "opentofu-mcp-server";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-qgjAnoduzAjvxgbgG8QW53CMF3/bW0NQhDbVv3ebntw=";
+    rev = "59ee379fff12389a25e75dc26768f8602e505a91";
+    hash = "sha256-pPeqlJ/M7ylD7bniVbw/HqsFkZywHISmzpqsQG0VhoU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    fetcherVersion = 3;
-    pnpm = pnpm_8;
-    hash = "sha256-8U+yGjUtgpASLU5LewUMRFT0uxz45trw27+HH/h+sdA=";
+    fetcherVersion = 4;
+    pnpm = pnpm_10;
+    hash = "sha256-N9+sbSsae1wOmHkOQ1+Km97w7T+BLuZKdskWZs8c4kw=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_8
+    pnpm_10
     pnpmConfigHook
     makeWrapper
   ];
@@ -54,12 +54,14 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "OpenTofu MCP server for accessing the OpenTofu Registry";
     homepage = "https://github.com/opentofu/opentofu-mcp-server";
-    changelog = "https://github.com/opentofu/opentofu-mcp-server/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/opentofu/opentofu-mcp-server/commits/main";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ eana ];
     mainProgram = "opentofu-mcp-server";
diff --git a/pkgs/by-name/po/polyglot/package.nix b/pkgs/by-name/po/polyglot/package.nix
index a5ac46703c0a..f80f7cbbd8bf 100644
--- a/pkgs/by-name/po/polyglot/package.nix
+++ b/pkgs/by-name/po/polyglot/package.nix
@@ -33,10 +33,16 @@ maven.buildMavenPackage rec {
 
   mvnHash =
     {
-      aarch64-linux = "sha256-Tlz2I6xE8g3GqKz9N7VXRO0ObE1XOv6IfTrKZmVlscY=";
-      x86_64-linux = "sha256-nQScNCkA+eaeL3tcLCec1qIoYO6ct28FLxGp/Cm4nn4=";
+      aarch64-linux = "sha256-o5dFk1pghCOaaxAto7e5kXn2mrVEGAtb9kTwQQN2N8o=";
+      x86_64-linux = "sha256-KYgeVBhqBjP6dqwpSzoqH8dfsL4WpJcSiHEMfgk0CNE=";
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  mvnFetchExtraArgs.env = {
+    inherit (env) SOURCE_DATE_EPOCH;
+  };
+
+  # fix for "date 1980-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z"
+  env.SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z
 
   mvnParameters = "-DskipTests";
 
diff --git a/pkgs/by-name/pr/pretender/package.nix b/pkgs/by-name/pr/pretender/package.nix
index fe54814c3220..dcca12594a65 100644
--- a/pkgs/by-name/pr/pretender/package.nix
+++ b/pkgs/by-name/pr/pretender/package.nix
@@ -6,26 +6,26 @@
 
 buildGoModule (finalAttrs: {
   pname = "pretender";
-  version = "1.3.2";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "RedTeamPentesting";
     repo = "pretender";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c8uXN7UMj6UZPVt2aNSg6mRex8w+u7J5I7TAB7MzEWg=";
+    hash = "sha256-NwGjW0WvMuoG4NxBL3ygGbZF5b8dLXJPbYMadLodR8s=";
   };
 
-  vendorHash = "sha256-UzKprzkxqG7FOPWcFQGuZtn+gHMeMy4jqCLUSdyO2l0=";
+  vendorHash = "sha256-pzyattaJQIzEgCheYBx6qJ95br6ApEk9RfBfAqrPkjI=";
 
   # Tests require network access
   doCheck = false;
 
   meta = {
     description = "Tool for handling machine-in-the-middle tasks";
-    mainProgram = "pretender";
     homepage = "https://github.com/RedTeamPentesting/pretender";
-    changelog = "https://github.com/RedTeamPentesting/pretender/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/RedTeamPentesting/pretender/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pretender";
   };
 })
diff --git a/pkgs/by-name/pr/pretix-banktool/package.nix b/pkgs/by-name/pr/pretix-banktool/package.nix
index 00634df8a597..f962b749a55b 100644
--- a/pkgs/by-name/pr/pretix-banktool/package.nix
+++ b/pkgs/by-name/pr/pretix-banktool/package.nix
@@ -4,14 +4,7 @@
   fetchFromGitHub,
 }:
 
-let
-  pythonPackages = python3Packages.overrideScope (
-    self: super: {
-      fints = self.fints_4;
-    }
-  );
-in
-pythonPackages.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pretix-banktool";
   version = "1.1.0";
   pyproject = true;
@@ -23,15 +16,17 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     hash = "sha256-x6P+WqrOak5/gmMEmBkHrx6kPsbSOAXbKRbndFG3IJU=";
   };
 
-  build-system = with pythonPackages; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = with pythonPackages; [
+  dependencies = with python3Packages; [
     click
     fints
     requests
     mt-940
   ];
 
+  pythonRelaxDeps = [ "fints" ];
+
   doCheck = false; # no tests
 
   pythonImportsCheck = [ "pretix_banktool" ];
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/elm-srcs.nix b/pkgs/by-name/pr/prometheus-alertmanager/elm-srcs.nix
new file mode 100644
index 000000000000..0d89c018d66f
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-srcs.nix
@@ -0,0 +1,82 @@
+{
+
+  "NoRedInk/elm-json-decode-pipeline" = {
+    sha256 = "0y25xn0yx1q2xlg1yx1i0hg4xq1yxx6yfa99g272z8162si75hnl";
+    version = "1.0.0";
+  };
+
+  "elm/browser" = {
+    sha256 = "1apmvyax93nvmagwj00y16zx10kfv640cxpi64xgqbgy7d2wphy4";
+    version = "1.0.0";
+  };
+
+  "elm/core" = {
+    sha256 = "10kr86h4v5h4p0586q406a5wbl8xvr1jyrf6097zp2wb8sv21ylw";
+    version = "1.0.0";
+  };
+
+  "elm/html" = {
+    sha256 = "1n3gpzmpqqdsldys4ipgyl1zacn0kbpc3g4v3hdpiyfjlgh8bf3k";
+    version = "1.0.0";
+  };
+
+  "elm/http" = {
+    sha256 = "1igmm89ialzrjib1j8xagkxalq1x2gj4l0hfxcd66mpwmvg7psl8";
+    version = "1.0.0";
+  };
+
+  "elm/json" = {
+    sha256 = "1g0hafkqf2q633r7ir9wxpb1lnlzskhpsyi0h5bkzj0gl072zfnb";
+    version = "1.0.0";
+  };
+
+  "elm/parser" = {
+    sha256 = "0a3cxrvbm7mwg9ykynhp7vjid58zsw03r63qxipxp3z09qks7512";
+    version = "1.1.0";
+  };
+
+  "elm/regex" = {
+    sha256 = "0lijsp50w7n1n57mjg6clpn9phly8vvs07h0qh2rqcs0f1jqvsa2";
+    version = "1.0.0";
+  };
+
+  "elm/time" = {
+    sha256 = "0vch7i86vn0x8b850w1p69vplll1bnbkp8s383z7pinyg94cm2z1";
+    version = "1.0.0";
+  };
+
+  "elm/url" = {
+    sha256 = "0av8x5syid40sgpl5vd7pry2rq0q4pga28b4yykn9gd9v12rs3l4";
+    version = "1.0.0";
+  };
+
+  "justinmimbs/time-extra" = {
+    sha256 = "0s5r0w5dfyrwpkgx594p3z39zrvz2gnxfzb6qlddwfibiaj2nfz9";
+    version = "1.1.0";
+  };
+
+  "rtfeldman/elm-iso8601-date-strings" = {
+    sha256 = "1n4zhm00m37fgy4vb6cayplm4yz6k78ijbmqajrqfnbsyc26p8wr";
+    version = "1.1.2";
+  };
+
+  "elm/random" = {
+    sha256 = "138n2455wdjwa657w6sjq18wx2r0k60ibpc4frhbqr50sncxrfdl";
+    version = "1.0.0";
+  };
+
+  "elm/virtual-dom" = {
+    sha256 = "0hm8g92h7z39km325dlnhk8n00nlyjkqp3r3jppr37k2k13md6aq";
+    version = "1.0.0";
+  };
+
+  "justinmimbs/date" = {
+    sha256 = "0gl31dsbzryc29749wwi4jfnidsyicbplawmc8ar1vbxaa39ld0v";
+    version = "3.2.0";
+  };
+
+  "elm-explorations/test" = {
+    sha256 = "0rpynrm9irgzyynd1bws0xspww5lnwv7w7998750jb8kcrw39h0n";
+    version = "1.0.0";
+  };
+}
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
new file mode 100644
index 000000000000..8beaa9c5f34e
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
@@ -0,0 +1,40 @@
+{
+  buildNpmPackage,
+  elmPackages,
+  prometheus-alertmanager,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "alertmanager-elm-ui";
+  inherit (prometheus-alertmanager) src version meta;
+
+  sourceRoot = "${finalAttrs.src.name}/ui/app";
+
+  postPatch = ''
+    # don't download elm from github
+    sed -i '/"elm":/d' package.json
+  '';
+
+  postConfigure = (
+    elmPackages.fetchElmDeps {
+      # elm2nix convert > elm-srcs.nix
+      elmPackages = import ./elm-srcs.nix;
+      elmVersion = elmPackages.elm.version;
+      # elm2nix snapshot > registry.dat
+      registryDat = ./registry.dat;
+    }
+  );
+
+  npmDepsHash = "sha256-2flvNJXsOhE0k10Eu8kWo3p3aAABFB/f3yeYNrIztpw=";
+
+  nativeBuildInputs = [
+    elmPackages.elm
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+    cp -r dist/* $out/
+    runHook postInstall
+  '';
+})
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/package.nix b/pkgs/by-name/pr/prometheus-alertmanager/package.nix
index f3e355a782c3..143ddd20f9c1 100644
--- a/pkgs/by-name/pr/prometheus-alertmanager/package.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/package.nix
@@ -2,24 +2,37 @@
   lib,
   go,
   buildGoModule,
+  callPackage,
   fetchFromGitHub,
   installShellFiles,
   nixosTests,
   versionCheckHook,
+  common-updater-scripts,
+  curlMinimal,
+  elm2nix,
+  nix-update,
+  nixfmt,
+  writeShellApplication,
 }:
 
+let
+  elmUi = callPackage ./elm-ui.nix { };
+in
 buildGoModule (finalAttrs: {
   pname = "alertmanager";
-  version = "0.31.1";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "alertmanager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HkM2bpZ0vM/Uoj9cFEAKi56Cj5ixcx65dH1pJNkK6WQ=";
+    hash = "sha256-VXhu50KERPb4FDdcNDMftBqZVk2ipIphhejAE1wMSOk=";
   };
 
-  vendorHash = "sha256-X8BiQ9OSXj56mbjmb0AFaSsAWGwDhhMV/RztklxHYa4=";
+  postPatch = ''
+    cp -r ${elmUi}/. ui/app/dist
+  '';
+  vendorHash = "sha256-t5jQtccln3dfcHlnEOnLQHfjzfU9kY9Y7q+r4AigvBE=";
 
   subPackages = [
     "cmd/alertmanager"
@@ -48,7 +61,34 @@ buildGoModule (finalAttrs: {
     installShellCompletion amtool.zsh
   '';
 
-  passthru.tests = { inherit (nixosTests.prometheus) alertmanager; };
+  passthru = {
+    inherit elmUi;
+    tests = { inherit (nixosTests.prometheus) alertmanager; };
+    updateScript = lib.getExe (writeShellApplication {
+      name = "alertmanager-update";
+      runtimeInputs = [
+        curlMinimal
+        common-updater-scripts
+        elm2nix
+        nix-update
+        nixfmt
+      ];
+      text = ''
+        TAG=$(list-git-tags --url="https://github.com/${finalAttrs.src.owner}/${finalAttrs.src.repo}" | sort -V | tail -n1)
+
+        pushd pkgs/by-name/pr/prometheus-alertmanager
+        wcurl --output="elm.json" "https://raw.githubusercontent.com/prometheus/alertmanager/refs/tags/''${TAG}/ui/app/elm.json"
+        elm2nix convert > elm-srcs.nix
+        elm2nix snapshot > registry.dat
+        rm elm.json
+        nixfmt elm-srcs.nix
+        popd
+
+        nix-update prometheus-alertmanager --version "''${TAG#v}"
+        nix-update prometheus-alertmanager.elmUi
+      '';
+    });
+  };
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/registry.dat b/pkgs/by-name/pr/prometheus-alertmanager/registry.dat
new file mode 100644
index 000000000000..aa46dccf6814
Binary files /dev/null and b/pkgs/by-name/pr/prometheus-alertmanager/registry.dat differ
diff --git a/pkgs/by-name/re/revanity-go/package.nix b/pkgs/by-name/re/revanity-go/package.nix
new file mode 100644
index 000000000000..97b0a99ac505
--- /dev/null
+++ b/pkgs/by-name/re/revanity-go/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  libsodium,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "revanity-go";
+  version = "0-unstable-2026-03-30";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "revanity-go";
+    rev = "0689c73bdc95fe14957f67075891cc6653f3568c";
+    hash = "sha256-utf9YcVCdWj78oDGxRSvTXRRXnUPLMypk77yBdOI24c=";
+  };
+
+  vendorHash = null;
+
+  buildInputs = [
+    libsodium
+  ];
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Go implementation of Revanity, a Reticulum/LXMF vanity address generator";
+    homepage = "https://github.com/ratspeak/revanity-go";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "revanity-go";
+  };
+})
diff --git a/pkgs/by-name/ro/roadrunner/package.nix b/pkgs/by-name/ro/roadrunner/package.nix
index c5460e59b7b8..bd387347db8f 100644
--- a/pkgs/by-name/ro/roadrunner/package.nix
+++ b/pkgs/by-name/ro/roadrunner/package.nix
@@ -4,31 +4,37 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "roadrunner";
-  version = "2025.1.6";
+  version = "2025.1.14";
 
   src = fetchFromGitHub {
-    repo = "roadrunner";
     owner = "roadrunner-server";
+    repo = "roadrunner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qoPQxJbZ1BH9Gy06qmp9LGWF6YPJL0gRZX3+S5ej6XY=";
+    hash = "sha256-0Mfu/De28tWCygJ5/QJnOzxk88aajx4Oq/Xm0TOXR0M=";
   };
 
+  vendorHash = "sha256-KuATz7rVsDuGiyILvILaEpznI63sCHx0G+9D2vR+dx0=";
+  env.GOWORK = "off";
+
+  subPackages = [ "cmd/rr" ];
+
+  # Flags as provided by the build automation of the project:
+  # https://github.com/roadrunner-server/roadrunner/blob/3853ad693522e82d53d62950e5f1315402c910f2/.github/workflows/release.yml#L82
+  ldflags = [
+    "-s"
+    "-X=github.com/roadrunner-server/roadrunner/v${lib.versions.major finalAttrs.version}/internal/meta.version=${finalAttrs.version}"
+    "-X=github.com/roadrunner-server/roadrunner/v${lib.versions.major finalAttrs.version}/internal/meta.buildTime=1970-01-01T00:00:00Z"
+  ];
+
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  # Flags as provided by the build automation of the project:
-  # https://github.com/roadrunner-server/roadrunner/blob/fe572d0eceae8fd05225fbd99ba50a9eb10c4393/.github/workflows/release.yml#L89
-  ldflags = [
-    "-s"
-    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.version=${finalAttrs.version}"
-    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
-  ];
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd rr \
       --bash <($out/bin/rr completion bash) \
@@ -36,20 +42,10 @@ buildGoModule (finalAttrs: {
       --fish <($out/bin/rr completion fish)
   '';
 
-  postPatch = ''
-    substituteInPlace internal/rpc/client_test.go \
-      --replace "127.0.0.1:55555" "127.0.0.1:55554"
-
-    substituteInPlace internal/rpc/test/config_rpc_ok.yaml \
-      --replace "127.0.0.1:55555" "127.0.0.1:55554"
-
-    substituteInPlace internal/rpc/test/config_rpc_conn_err.yaml \
-      --replace "127.0.0.1:0" "127.0.0.1:55554"
-  '';
-
   __darwinAllowLocalNetworking = true;
 
-  vendorHash = "sha256-LSeQACVgBywJqHfRE2q6HxL1ADKZtrJP83U3Zd1oIDw=";
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   meta = {
     changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${finalAttrs.version}/CHANGELOG.md";
@@ -57,6 +53,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://roadrunner.dev";
     license = lib.licenses.mit;
     mainProgram = "rr";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ moraxyc ];
   };
 })
diff --git a/pkgs/by-name/ru/runelite/package.nix b/pkgs/by-name/ru/runelite/package.nix
index 0d4e0a721e8c..02927d26aa4b 100644
--- a/pkgs/by-name/ru/runelite/package.nix
+++ b/pkgs/by-name/ru/runelite/package.nix
@@ -23,7 +23,7 @@ maven.buildMavenPackage rec {
   };
 
   mvnJdk = jdk17;
-  mvnHash = "sha256-FpfHtGIfo84z6v9/nzc47+JeIM43MR9mWhVOPSi0xhM=";
+  mvnHash = "sha256-OI+m2xJZPnyPXM/HlAsaBJ/z/NCcRSP7+PW5CQOsPiY=";
 
   desktop = makeDesktopItem {
     name = "RuneLite";
diff --git a/pkgs/by-name/ru/rusthound-ce/package.nix b/pkgs/by-name/ru/rusthound-ce/package.nix
index 621b17356718..28deb53e3d6f 100644
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusthound-ce";
-  version = "2.4.9";
+  version = "2.4.91";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-FG63LZX62MiSquI56WnQc9oRdzvQAaf/wGPDjSmhvow=";
+    hash = "sha256-mOmTBj/NqWqsc3JfpD8vmafevWpaHTnwqM3wuKwxlxc=";
   };
 
-  cargoHash = "sha256-tN7sHqEC18NQs3PrLdY71JdbL31MBh2tuaBtTN/T9vE=";
+  cargoHash = "sha256-paMTih5b1RxmXUEjglnj4Hy6SRJE78m1FQP4lags6yo=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/rv/rvgl-launcher/package.nix b/pkgs/by-name/rv/rvgl-launcher/package.nix
new file mode 100644
index 000000000000..0df6a9d1fcdd
--- /dev/null
+++ b/pkgs/by-name/rv/rvgl-launcher/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitLab,
+  copyDesktopItems,
+  makeDesktopItem,
+  buildFHSEnv,
+}:
+
+let
+  unwrapped = python3Packages.buildPythonApplication (finalAttrs: {
+    pname = "rvgl-launcher-unwrapped";
+    version = "0.1.23.1030a4-rev1";
+    pyproject = true;
+
+    src = fetchFromGitLab {
+      owner = "re-volt";
+      repo = "rvgl-launcher";
+      tag = finalAttrs.version;
+      hash = "sha256-Xq8gFE8rWMwufvZL5ZaWXbQ/Ls6nPGgmU3PjzFeQOuM=";
+    };
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    build-system = with python3Packages; [ setuptools ];
+
+    dependencies = with python3Packages; [
+      wxpython
+      requests
+      appdirs
+      packaging
+    ];
+
+    postInstall = ''
+      install -Dm644 icons/icon.png $out/share/pixmaps/rvgl-launcher.png
+    '';
+
+    nativeBuildInputs = [ copyDesktopItems ];
+
+    desktopItems = [
+      (makeDesktopItem {
+        name = "rvgl-launcher";
+        desktopName = "RVGL Launcher";
+        icon = "rvgl-launcher";
+        exec = "rvgl-launcher";
+        comment = "Launcher and package manager for RVGL";
+        categories = [ "Game" ];
+      })
+    ];
+
+    meta = {
+      description = "Launcher and package manager for RVGL";
+      longDescription = "RVGL Launcher is a cross-platform installer, launcher and package manager for RVGL";
+      homepage = "https://re-volt.gitlab.io/rvgl-launcher";
+      downloadPage = "https://gitlab.com/re-volt/rvgl-launcher";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ andrewfield ];
+      mainProgram = "rvgl-launcher";
+      platforms = lib.platforms.linux;
+    };
+  });
+
+in
+(buildFHSEnv {
+  # The launcher works well with the unwrapped section but the game itself when launched seems to require an FHS environment.
+  pname = "rvgl-launcher";
+  inherit (unwrapped) version meta;
+
+  runScript = "rvgl-launcher";
+
+  targetPkgs =
+    pkgs: with pkgs; [
+      unwrapped
+
+      p7zip # Only needed by the actual game when launched, to manage the RVGL packages the game itself uses.
+
+      SDL2
+      SDL2_image
+      libvorbis
+      fluidsynth
+      gtk3
+    ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share/applications $out/share/pixmaps
+    ln -s ${unwrapped}/share/applications/rvgl-launcher.desktop $out/share/applications/rvgl-launcher.desktop
+    ln -s ${unwrapped}/share/pixmaps/rvgl-launcher.png $out/share/pixmaps/rvgl-launcher.png
+  '';
+
+  passthru = {
+    inherit unwrapped;
+  };
+}).overrideAttrs
+  (
+    finalAttrs: previousAttrs: {
+      strictDeps = true;
+      __structuredAttrs = true;
+    }
+  )
diff --git a/pkgs/by-name/sl/slipstream/package.nix b/pkgs/by-name/sl/slipstream/package.nix
index 86d17244d752..c41f97b7d8ec 100644
--- a/pkgs/by-name/sl/slipstream/package.nix
+++ b/pkgs/by-name/sl/slipstream/package.nix
@@ -20,7 +20,7 @@ maven.buildMavenPackage rec {
   };
 
   mvnJdk = jdk;
-  mvnHash = "sha256-woOSkF5TuzaJ84EndryMoXTMbbK/V/BShM1k+WB8D/c=";
+  mvnHash = "sha256-PRgzlXEa5PWf2jwpLYKLMxY6RECKvdsGWBPKVNz/bnc=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/sq/sqlline/package.nix b/pkgs/by-name/sq/sqlline/package.nix
index 440187d1f060..f07eb1e69832 100644
--- a/pkgs/by-name/sq/sqlline/package.nix
+++ b/pkgs/by-name/sq/sqlline/package.nix
@@ -18,7 +18,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-rUlGtMgTfhciQVif0KaUcuY28wh+PrHsKen8qODom24=";
   };
 
-  mvnHash = "sha256-9qDzc6TRn9Yv3/nTATZgP6J+PTZEZCN1et/3GrRb7X4=";
+  mvnHash = "sha256-rqVKHMG/MKyo9P8DiMm87/Gc4YFgkkawagOjBUlrESU=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ss/sshamble/package.nix b/pkgs/by-name/ss/sshamble/package.nix
new file mode 100644
index 000000000000..b42a2989fa20
--- /dev/null
+++ b/pkgs/by-name/ss/sshamble/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "sshamble";
+  version = "0.3.9";
+
+  src = fetchFromGitHub {
+    owner = "runZeroInc";
+    repo = "sshamble";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-304OXnCBBPyK7txmnvrkOCu4cfTSSiTpZZh6vOUSufc=";
+  };
+
+  vendorHash = "sha256-uVef5OvCYCZvVfWMh0JTYIN5cokqslvQvYoWHHxtd5g=";
+
+  # Disabled because tests rely on network requests
+  disabledTests = [
+    "TestCacheBasics"
+  ];
+  checkFlags = [
+    "-skip=${lib.concatStringsSep "|" finalAttrs.disabledTests}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    description = "SSH-protocol pentesting utility";
+    homepage = "https://github.com/runZeroInc/sshamble";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.YoshiRulz ];
+    mainProgram = "sshamble";
+  };
+})
diff --git a/pkgs/by-name/ta/tabula-java/package.nix b/pkgs/by-name/ta/tabula-java/package.nix
index 7bac5951d1d7..87c7f42e4c84 100644
--- a/pkgs/by-name/ta/tabula-java/package.nix
+++ b/pkgs/by-name/ta/tabula-java/package.nix
@@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-lg8/diyGhfkUU0w7PEOlxb1WNpJZVDDllxMMsTIU/Cw=";
   };
 
-  mvnHash = "sha256-CXJm9YlYsYViChFcH9e2P9pxK0q/tLWODOzZPXZ8hK0=";
+  mvnHash = "sha256-XMrAwOqQCt0vDUqFXodLhmujnrz2/FRSBYkAxDz9Z8c=";
   mvnParameters = "compile assembly:single -Dmaven.test.skip=true";
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/tr/trimmomatic/package.nix b/pkgs/by-name/tr/trimmomatic/package.nix
index 740282aa9ce9..f2a5ec560f8b 100644
--- a/pkgs/by-name/tr/trimmomatic/package.nix
+++ b/pkgs/by-name/tr/trimmomatic/package.nix
@@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-pLUjSVePN++G2XZrdKEdobgBO+UD0PZ9wlhSUlZ7na8=";
   };
 
-  mvnHash = "sha256-1XnVdud8nI2SuEPXnwEmbudM+QAeoSVTn0UZ8PKJH44=";
+  mvnHash = "sha256-J72B3qAVfRZ3lXpNyM1HYmBJQBkzj+J79fLIUJqyPTU=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/tu/tuxguitar/package.nix b/pkgs/by-name/tu/tuxguitar/package.nix
index d7f70aed6e93..896a6d701d68 100644
--- a/pkgs/by-name/tu/tuxguitar/package.nix
+++ b/pkgs/by-name/tu/tuxguitar/package.nix
@@ -60,9 +60,9 @@ let
   ];
   # FIXME: Makes hash stable across platforms and convert to a single hash.
   mvnHashByPlatform = {
-    "x86_64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
-    "aarch64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
-    "aarch64-darwin" = "sha256-lfO2YH+yKZWzh3MeQ7baESGmmW7zPdTLs8CjZ/FtLu0=";
+    "x86_64-linux" = "sha256-KYF7vSMXPgi6xvtgcSIIEOltK5RL4ynGQf1579Is5nM=";
+    "aarch64-linux" = "sha256-KYF7vSMXPgi6xvtgcSIIEOltK5RL4ynGQf1579Is5nM=";
+    "aarch64-darwin" = "sha256-uJXOACtuE4fKIb4a6C3Cy+MilI8OOdsuAgtJyklxHdw=";
   };
   wrapperArgs = [
     "\${gappsWrapperArgs[@]}"
diff --git a/pkgs/by-name/uc/ucx/package.nix b/pkgs/by-name/uc/ucx/package.nix
index 2ca0ff0ca69f..c7c6b109d12a 100644
--- a/pkgs/by-name/uc/ucx/package.nix
+++ b/pkgs/by-name/uc/ucx/package.nix
@@ -42,13 +42,13 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "ucx";
-  version = "1.20.1";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "openucx";
     repo = "ucx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CD8a7CoKAj5DuRa9C+Eef54qGcH3F0uNBXRlO0hneI4=";
+    hash = "sha256-jREdHE+DpT0OQ1pVEUgWnA9hTCP1IsGeATmDTT3YmcM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
index ed00d634041a..4503fb19f254 100644
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -47,12 +47,12 @@ let
   # to guarantee compatibility.
   prisma-engines' = prisma-engines_7.overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma-engines";
         tag = finalAttrs.version;
-        hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+        hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
       };
       cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
 
@@ -66,23 +66,23 @@ let
   );
   prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma";
         tag = finalAttrs.version;
-        hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
+        hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
       };
       pnpmDeps = prevAttrs.pnpmDeps.override {
         inherit (finalAttrs) src version;
-        hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
+        hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
       };
     }
   );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umami";
-  version = "3.1.0";
+  version = "3.2.0";
 
   nativeBuildInputs = [
     makeWrapper
@@ -96,7 +96,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "umami-software";
     repo = "umami";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EH3ebwTbajcNasn25ets2w068ZmCQRYUY2XON39J5HA=";
+    hash = "sha256-0nfCcaST06cTg43Rz1rCV8GYYDjQLP+6TrVRJF2/Yuk=";
   };
 
   # Umami uses next/font/google, which tries to download from Google Fonts at build time.
@@ -116,11 +116,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-QNWmCsVFh8xpsO4ZPTaKGszwuRaxTrWLMVh/6VV5oIw=";
+    fetcherVersion = 4;
+    hash = "sha256-6ho5xoVdqZdihThL5q8+RhVPfaSwu1y3+p9d8DnfO3o=";
   };
 
-  env.CYPRESS_INSTALL_BINARY = "0";
   env.NODE_ENV = "production";
   env.NEXT_TELEMETRY_DISABLED = "1";
 
@@ -144,7 +143,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   checkPhase = ''
     runHook preCheck
 
-    pnpm test
+    # Tests fail if NODE_ENV=production
+    NODE_ENV=development pnpm test
 
     runHook postCheck
   '';
diff --git a/pkgs/by-name/um/umami/sources.json b/pkgs/by-name/um/umami/sources.json
index 30d51dfd4329..0680e40a0888 100644
--- a/pkgs/by-name/um/umami/sources.json
+++ b/pkgs/by-name/um/umami/sources.json
@@ -1,7 +1,7 @@
 {
   "geocities": {
-    "rev": "6a3ef689a4673ff2bf292548716e7cc6c5a2c903",
-    "date": "2026-04-16",
-    "hash": "sha256-GUUeFU1DKGL+NpzK1oJlsyB/VrFWe6Lj7U7yJXj8mNo="
+    "rev": "04017f13909e499135afea605a1e07427e845641",
+    "date": "2026-07-02",
+    "hash": "sha256-4IYGsxNGdzilI0mYXlwEo43auqNug307pYyPuilR3aw="
   }
 }
diff --git a/pkgs/by-name/va/vatprism/package.nix b/pkgs/by-name/va/vatprism/package.nix
index dc8156624e77..774f8707aeb8 100644
--- a/pkgs/by-name/va/vatprism/package.nix
+++ b/pkgs/by-name/va/vatprism/package.nix
@@ -71,9 +71,9 @@ maven.buildMavenPackage rec {
 
   mvnHash = # OpenJFX artifacts are platform dependent
     if (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) then
-      "sha256-gerjxTj8UQEVthMO3unWPEG7SPseMt5JPPureC/wUsw="
+      "sha256-GeSO6aFXeWLVOF9DVvFZ4FNv//NYhF68Nd6rxgeBO70="
     else
-      "sha256-LoOiLisqc99gIGClpVe8tq5/2prmyyOzLDkpmuSgwVo=";
+      "sha256-j7SaDQKGMcXGdOKzv8zBFHpsqqFZzZzITW7I/ZXs+dI=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/vu/vue-language-server/add-pkg-pr-new-integrities.patch b/pkgs/by-name/vu/vue-language-server/add-pkg-pr-new-integrities.patch
new file mode 100644
index 000000000000..eaae2e1f5f64
--- /dev/null
+++ b/pkgs/by-name/vu/vue-language-server/add-pkg-pr-new-integrities.patch
@@ -0,0 +1,32 @@
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -870 +870 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-GntAKmJ45uB5NUKeEw15qGpNmL9i81HmTv2OtqreAxT2uQb5Adurtx5VouR150tRhnkXoYUiVPzYGs++U+WLfg==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -877 +877 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-vbZgliMbBuVO1sYRhbczWWcQlwd8e+Wj6tGBh1PvRws6aJLu7nhMPb0LJU9wrW5EKFcjckGpwMtH3aOK/8padw==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -884 +884 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-sfc@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-e10xJOKE+jTmuoManPxtkRCUgu+IzpV67ZEcddzdE5+Va4gQuPTm4dzCYo0yEztyBH57AuhN8P3H1hC5SxyFuw==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-sfc@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -891 +891 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-ssr@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-FxLmgdj7z0ljbHiT+PR4PtX+XNA+Pfb1Ror+9AP01fmHKGFb9ZVKqx0vBq4a2TtZXcgn5740IHiD0lovufBlFA==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-ssr@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -898 +898 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/reactivity@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-U4sPiVx/HN+SU/3nRxSvebg7diEsDK1x+xnbCoNy1IwVpNuogxyRz/L9bOGBIB9vlMmgmxsntDBltZVzoelwcQ==, tarball: https://pkg.pr.new/vuejs/core/@vue/reactivity@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -902 +902 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-qKrCQUE2loNGO+zZ8S8TuSn2p0zaDTPZTom1RvaIVsriAYpd5AZdiy7b7PwT1OxdHK/OM3sZ1vvjysmQDUJLRg==, tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -906 +906 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-k6YZlI+NYcDvj98OEmEpNteTX1q9l1dL2KCUCwCDmyAw2Re9Yz1J4JFEEnLCMz0+YSKoXg12lGj9lYVsuS6osw==, tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -910 +910 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/server-renderer@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-yTJTHlRXU1qOXkQutMIF0w+s7zIfMACmiTrJQ4LZ50OAXKiWmt93nrSjXh6ePOP+KeRqvAOFBsZhlmnfxHHh/A==, tarball: https://pkg.pr.new/vuejs/core/@vue/server-renderer@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -919 +919 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/shared@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-HCZjsf5q9+i2SxsraMsFVQvoSzW3/K6CC9Myg1CZJxP2MH+n6RYGqvJSEnjBCO3tX+JxLSrm06aYhn5FIZhhEw==, tarball: https://pkg.pr.new/vuejs/core/@vue/shared@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -1660 +1660 @@
+-    resolution: {tarball: https://pkg.pr.new/vue@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
++    resolution: {integrity: sha512-lSY4wGk59hpvPBRJ1femqnUMekvvWGZsy4ggQBTJ8Z6fhDxO6U/w2l+M5vU93qsw2mcf9v+iuzLbEIc41y6B9w==, tarball: https://pkg.pr.new/vue@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
diff --git a/pkgs/by-name/vu/vue-language-server/package.nix b/pkgs/by-name/vu/vue-language-server/package.nix
index 78377e1228e1..1c085743e148 100644
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -4,30 +4,40 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10_34_0,
+  pnpm_11,
   nodejs,
   nix-update-script,
   makeBinaryWrapper,
 }:
 let
-  pnpm = pnpm_10_34_0;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";
-  version = "3.2.9";
+  version = "3.3.6";
 
   src = fetchFromGitHub {
     owner = "vuejs";
     repo = "language-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-q/5erEPVtXdpsyGnxuq+QySsZKibvKLvniDI1glIP0s=";
+    hash = "sha256-uiYhVVRiHyq+0S8czBY082vsqtCPqj29K9DjH0f+8u4=";
   };
 
+  patches = [ ./add-pkg-pr-new-integrities.patch ];
+
   pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
+    inherit (finalAttrs)
+      patches
+      pname
+      src
+      version
+      ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-qm2hDQbOoC04c47w8KSwkdigND6UrkRUGp7YfkRu4as=";
+    fetcherVersion = 4;
+    prePnpmInstall = ''
+      pnpm config set --location project --json trustPolicyExclude '["volar-service-pug@0.0.71"]'
+    '';
+    hash = "sha256-6xu+z7rrI+YfmpcL5ycwjjeSAfDkkhSgeKBZO34p9Dw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/yl/yle-dl/package.nix b/pkgs/by-name/yl/yle-dl/package.nix
index 77203ebaefeb..f563199dd56b 100644
--- a/pkgs/by-name/yl/yle-dl/package.nix
+++ b/pkgs/by-name/yl/yle-dl/package.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "20250730";
+  version = "20260624";
 
   src = fetchFromGitHub {
     owner = "aajanki";
     repo = "yle-dl";
     tag = "releases/${version}";
-    hash = "sha256-85Dj+r6heusvT3+y3SNYBBa5h/tje0G4XHmfJpCwkMY=";
+    hash = "sha256-7wI7GKMdj28ef6M8eqkeuLytliU0D3arE0IXk5uhVfg=";
   };
 in
 python3Packages.buildPythonApplication {
diff --git a/pkgs/development/python-modules/alphashape/default.nix b/pkgs/development/python-modules/alphashape/default.nix
new file mode 100644
index 000000000000..cd0c7843f15f
--- /dev/null
+++ b/pkgs/development/python-modules/alphashape/default.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  buildPythonPackage,
+  click,
+  click-log,
+  fetchFromGitHub,
+  geopandas,
+  networkx,
+  numpy,
+  pytestCheckHook,
+  rtree,
+  scipy,
+  setuptools,
+  shapely,
+  trimesh,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alphashape";
+  version = "1.3.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bellockk";
+    repo = "alphashape";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-T2wyU6fpiYRA1+9n//5EtOLhO1fzccQsie+gQj729Vs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    click-log
+    shapely
+    numpy
+    trimesh
+    networkx
+    rtree
+    scipy
+  ];
+
+  nativeCheckInputs = [
+    geopandas
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # TypeError
+    "test_given_a_four_point_polygon_with_no_alpha_return_input"
+    "test_given_a_point_return_a_point"
+  ];
+
+  pythonImportsCheck = [ "alphashape" ];
+
+  meta = with lib; {
+    description = "Toolbox for generating n-dimensional alpha shapes";
+    homepage = "https://github.com/bellockk/alphashape";
+    changelog = "https://github.com/bellockk/alphashape/releases/tag/${finalAttrs.src.tag}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 6360263fefa4..4b7965549b2d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.39";
+  version = "1.43.40";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-PzXmBl1uo+oNEuh1PFJ3BDqQiPRjL7vzF8DE9eBx5mM=";
+    hash = "sha256-5h8+Bf1ljDkoxwShyn+aAguxkCHJYcg5I5y3F7iv3JU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/crawl4ai/default.nix b/pkgs/development/python-modules/crawl4ai/default.nix
new file mode 100644
index 000000000000..42422ab60e3c
--- /dev/null
+++ b/pkgs/development/python-modules/crawl4ai/default.nix
@@ -0,0 +1,269 @@
+{
+  lib,
+  aiofiles,
+  aiohttp,
+  aiosqlite,
+  alphashape,
+  anyio,
+  beautifulsoup4,
+  brotli,
+  buildPythonPackage,
+  chardet,
+  click,
+  cssselect,
+  fake-useragent,
+  fetchFromGitHub,
+  h2,
+  httpx,
+  humanize,
+  lark,
+  litellm,
+  lxml,
+  nltk,
+  numpy,
+  patchright,
+  pillow,
+  playwright-stealth,
+  playwright,
+  psutil,
+  pydantic,
+  pyopenssl,
+  pypdf,
+  pytest-asyncio,
+  pytestCheckHook,
+  python-dotenv,
+  pyyaml,
+  rank-bm25,
+  requests,
+  rich,
+  scikit-learn,
+  selenium,
+  sentence-transformers,
+  setuptools,
+  shapely,
+  snowballstemmer,
+  tokenizers,
+  torch,
+  transformers,
+  unclecode-litellm,
+  writableTmpDirAsHomeHook,
+  xxhash,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "crawl4ai";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "unclecode";
+    repo = "crawl4ai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MHCnhp7itaJ6y++uUCnObBjiJ9Jw/aFBtd35WzDBz1A=";
+  };
+
+  pythonRelaxDeps = [
+    "lxml"
+    "snowballstemmer"
+  ];
+
+  pythonRemoveDeps = [ "patchright" ];
+
+  build-system = [
+    setuptools
+    writableTmpDirAsHomeHook
+  ];
+
+  dependencies = [
+    aiofiles
+    aiohttp
+    aiosqlite
+    alphashape
+    anyio
+    beautifulsoup4
+    brotli
+    chardet
+    click
+    cssselect
+    fake-useragent
+    httpx
+    humanize
+    lark
+    litellm
+    lxml
+    nltk
+    numpy
+    patchright
+    pillow
+    playwright
+    playwright-stealth
+    psutil
+    pydantic
+    pyopenssl
+    python-dotenv
+    pyyaml
+    rank-bm25
+    requests
+    rich
+    shapely
+    snowballstemmer
+    unclecode-litellm
+    xxhash
+  ];
+
+  optional-dependencies = {
+    all = [
+      nltk
+      pypdf
+      scikit-learn
+      selenium
+      sentence-transformers
+      tokenizers
+      torch
+      transformers
+    ];
+    cosine = [
+      nltk
+      sentence-transformers
+      torch
+      transformers
+    ];
+    pdf = [ pypdf ];
+    sync = [ selenium ];
+    torch = [
+      nltk
+      scikit-learn
+      torch
+    ];
+    transformer = [
+      sentence-transformers
+      tokenizers
+      transformers
+    ];
+  };
+
+  nativeCheckInputs = [
+    h2
+    pytest-asyncio
+    pytestCheckHook
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pytestFlags = [ "--continue-on-collection-errors" ];
+
+  disabledTestPaths = [
+    # sys.exit(1) that crashes pytest
+    "tests/test_cloud_bugs_batch.py"
+    # Require docker, browser, LLM API, network and parts
+    "deploy/docker/"
+    "docs/examples/"
+    "tests/adaptive/"
+    "tests/async/"
+    "tests/browser/"
+    "tests/cache_validation/test_end_to_end.py"
+    "tests/cache_validation/test_real_domains.py"
+    "tests/deep_crawling/test_deep_crawl_resume_integration.py"
+    "tests/docker/test_config_object.py"
+    "tests/docker/test_docker.py"
+    "tests/docker/test_filter_deep_crawl.py"
+    "tests/docker/test_hooks_client.py"
+    "tests/docker/test_hooks_comprehensive.py"
+    "tests/docker/test_hooks_utility.py"
+    "tests/docker/test_llm_params.py"
+    "tests/docker/test_rest_api_deep_crawl.py"
+    "tests/docker/test_server.py"
+    "tests/docker/test_server_requests.py"
+    "tests/docker/test_server_token.py"
+    "tests/general/test_async_crawler_strategy.py"
+    "tests/general/test_async_url_seeder_bm25.py"
+    "tests/general/test_async_webcrawler.py"
+    "tests/general/test_bff_scoring.py"
+    "tests/general/test_cache_context.py"
+    "tests/general/test_crawlers.py"
+    "tests/general/test_deep_crawl_filters.py"
+    "tests/general/test_download_file.py"
+    "tests/general/test_http_crawler_strategy.py"
+    "tests/general/test_llm_filter.py"
+    "tests/general/test_max_scroll.py"
+    "tests/general/test_mhtml.py"
+    "tests/general/test_schema_builder.py"
+    "tests/mcp/"
+    "tests/memory/test_docker_config_gen.py"
+    "tests/integration/test_domain_mapper_e2e.py"
+    "tests/general/test_network_console_capture.py"
+    "tests/general/test_robot_parser.py"
+    "tests/general/test_stream.py"
+    "tests/general/test_stream_dispatch.py"
+    "tests/proxy/"
+    "tests/regression/"
+    "tests/releases/"
+    "tests/test_arun_many.py"
+    "tests/test_cdp_changes.py"
+    "tests/test_cli_docs.py"
+    "tests/test_config_selection.py"
+    "tests/test_docker.py"
+    "tests/test_docker_api_with_llm_provider.py"
+    "tests/test_eval_security_adversarial.py"
+    "tests/test_issue_1594_mcp_sse.py"
+    "tests/test_issue_1611_llm_provider.py"
+    "tests/test_issue_1748_screenshot_scroll_delay.py"
+    "tests/test_issue_1750_screenshot_scan_full_page.py"
+    "tests/test_issue_1850_mcp_sse.py"
+    "tests/test_link_extractor.py"
+    "tests/test_llm_extraction_parallel_issue_1055.py"
+    "tests/test_llm_simple_url.py"
+    "tests/test_llmtxt.py"
+    "tests/test_main.py"
+    "tests/test_multi_config.py"
+    "tests/test_prefetch_integration.py"
+    "tests/test_prefetch_regression.py"
+    "tests/test_pr_1435_redirected_status_code.py"
+    "tests/test_pr_1463_device_scale_factor.py"
+    "tests/test_pyopenssl_update.py"
+    "tests/test_raw_html_browser.py"
+    "tests/test_raw_html_edge_cases.py"
+    "tests/test_raw_html_redirected_url.py"
+    "tests/test_scraping_strategy.py"
+    "tests/test_virtual_scroll.py"
+    "tests/test_web_crawler.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_client_is_built_once_and_reused"
+    "test_reused_client_extracts_from_multiple_urls"
+    "test_clones_share_one_client"
+    "test_reused_client_checks_multiple_urls"
+    "test_concurrent_host_scanning"
+    "test_domain_with_scheme"
+    "test_probe_without_crt"
+    "test_examples"
+    "test_missing_url"
+    "test_basic_crawl"
+    # Tests require LLM API
+    "test_map_query_uses_query_config"
+    "test_legacy_single_config_for_query"
+    # Assertions Errors
+    "allowed_types5"
+    "allowed_types16"
+    "test_empty_href"
+    "test_href_is_only_fragment"
+    "test_href_with_fragment"
+    "test_invalid_base_url_netloc"
+    "test_invalid_base_url_scheme"
+    # Test checks GitHub Actions version
+    "test_no_v4_or_v5_checkout_remaining"
+  ];
+
+  pythonImportsCheck = [ "crawl4ai" ];
+
+  meta = {
+    description = "LLM Friendly Web Crawler & Scraper";
+    homepage = "https://github.com/unclecode/crawl4ai";
+    changelog = "https://github.com/unclecode/crawl4ai/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/fake-http-header/default.nix b/pkgs/development/python-modules/fake-http-header/default.nix
new file mode 100644
index 000000000000..9f5e78110fe4
--- /dev/null
+++ b/pkgs/development/python-modules/fake-http-header/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "fake-http-header";
+  version = "0.3.5-unstable-2025-07-09";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MichaelTatarski";
+    repo = "fake-http-header";
+    # https://github.com/MichaelTatarski/fake-http-header/issues/4
+    rev = "0f110477d3ecae916e88608a123360227bfb6109";
+    hash = "sha256-CznvDjzUeA0THsiIhuzvEDb4gXsP8IujpSCjt857qSo=";
+  };
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "fake_http_header" ];
+
+  meta = with lib; {
+    description = "Generates random request fields for a http request header";
+    homepage = "https://github.com/MichaelTatarski/fake-http-header";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/fints/4.nix b/pkgs/development/python-modules/fints/4.nix
deleted file mode 100644
index 089e022842eb..000000000000
--- a/pkgs/development/python-modules/fints/4.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  setuptools,
-  fetchFromGitHub,
-  bleach,
-  mt-940,
-  pretix-banktool,
-  requests,
-  sepaxml,
-  pytestCheckHook,
-  pytest-mock,
-}:
-
-buildPythonPackage rec {
-  version = "4.2.4";
-  pname = "fints";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "raphaelm";
-    repo = "python-fints";
-    tag = "v${version}";
-    hash = "sha256-la5vpWBoZ7hZsAyjjCqHpFfOykDVosI/S9amox1dmzY=";
-  };
-
-  pythonRemoveDeps = [ "enum-tools" ];
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    bleach
-    mt-940
-    requests
-    sepaxml
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  pythonImportsCheck = [ "fints" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-mock
-  ];
-
-  meta = {
-    homepage = "https://github.com/raphaelm/python-fints/";
-    description = "Pure-python FinTS (formerly known as HBCI) implementation";
-    license = lib.licenses.lgpl3Only;
-    inherit (pretix-banktool.meta) maintainers;
-  };
-}
diff --git a/pkgs/development/python-modules/fints/default.nix b/pkgs/development/python-modules/fints/default.nix
index ff1fd5cd52a3..af03514a81bc 100644
--- a/pkgs/development/python-modules/fints/default.nix
+++ b/pkgs/development/python-modules/fints/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     hash = "sha256-ll2+PtcGQiY5nbQTKVetd2ecDBVSXgzWP4Vzzri1Trs=";
   };
 
+  pythonRelaxDeps = [ "lxml" ];
+
   pythonRemoveDeps = [ "enum-tools" ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index bca9633fb5b6..185bf0e6e0ce 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -30,14 +30,14 @@
 }:
 
 let
-  version = "7.3.0";
+  version = "7.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Labelbox";
     repo = "labelbox-python";
     tag = "v${version}";
-    hash = "sha256-3xsV7X5M6s1wXYrThFC2SdvWgXAt1Hlw4OGQB/bKCCY=";
+    hash = "sha256-l+2BSkfZIwu0d3hEB7jq3CzampRYkNA9jaJnMlode68=";
   };
 
   lbox-clients = buildPythonPackage {
@@ -133,7 +133,7 @@ buildPythonPackage rec {
   meta = {
     description = "Platform API for LabelBox";
     homepage = "https://github.com/Labelbox/labelbox-python";
-    changelog = "https://github.com/Labelbox/labelbox-python/releases/tag/v.${src.tag}";
+    changelog = "https://github.com/Labelbox/labelbox-python/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ rakesh4g ];
   };
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index ecba52744f60..febcb0e5ac92 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.39.0";
+  version = "5.45.0";
   pyproject = true;
 
   # Sources from Pypi exclude test fixtures
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     tag = "v${version}";
-    hash = "sha256-WYPKq+WSEnqQdqZ0R8cUm7QYgE6EYtQ/NXdBfV2d8dI=";
+    hash = "sha256-0FLF/LkU8SaR3itgMISbqOxmd4UZkGlTT3VDpmuv+QQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/livekit-protocol/default.nix b/pkgs/development/python-modules/livekit-protocol/default.nix
index 59a23bc78228..85517f6f9aa0 100644
--- a/pkgs/development/python-modules/livekit-protocol/default.nix
+++ b/pkgs/development/python-modules/livekit-protocol/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "livekit-protocol";
-  version = "1.1.2";
+  version = "1.1.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "python-sdks";
     tag = "protocol-v${version}";
-    hash = "sha256-/QXjIz3q5dF6Y1CkyCP+3hWoXMGs7+eUgtehBJBF7LY=";
+    hash = "sha256-XTBQi1ckwHw7bpd2jQWqwhDXO0iHQRirc2GjfDtYILA=";
   };
 
   pypaBuildFlags = [ "livekit-protocol" ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index a2761d3eb7ad..dcac6cd77478 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -311,8 +311,8 @@ in
       "sha256-CavBKgp+dEMR2poR+bG2PgZb+wX1zlNmuOyJsV3LfVM=";
 
   mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.43.33"
-      "sha256-tNZluhU3Ano5b9ZYs4Zyut3WJrKyJgkCFc0ceM/NtmQ=";
+    buildMypyBoto3Package "cognito-idp" "1.43.40"
+      "sha256-Md4qwl+XC5zbtQFp2zteE+gWPyGEUaK8EyNcAlEQyj0=";
 
   mypy-boto3-cognito-sync =
     buildMypyBoto3Package "cognito-sync" "1.43.0"
@@ -331,8 +331,8 @@ in
       "sha256-Y+cDD5dq7C8tiGW37YheNcHTMxFyYCX6P6JPSjN7ttA=";
 
   mypy-boto3-config =
-    buildMypyBoto3Package "config" "1.43.23"
-      "sha256-6FyB/VCGsMYDBFUu0VzWpge94lASfg6CVewhkmpxycQ=";
+    buildMypyBoto3Package "config" "1.43.40"
+      "sha256-fnCKbH54gAMo/XqzCFyHhZMnV431ldlDE5kbej+yzsU=";
 
   mypy-boto3-connect =
     buildMypyBoto3Package "connect" "1.43.39"
@@ -363,8 +363,8 @@ in
       "sha256-pi0hMLpgYGrNU0/infONBg2WmES6NV0tfPgTjuRtWXk=";
 
   mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.43.17"
-      "sha256-+/r5ocaFv/4ZF0PpJMSoGeZtiE3nkqaMLzG+sECyNss=";
+    buildMypyBoto3Package "customer-profiles" "1.43.40"
+      "sha256-3eL2AWChh+ct7DwLMNlnXyA95vovQ6QO9zlDGB1gII4=";
 
   mypy-boto3-databrew =
     buildMypyBoto3Package "databrew" "1.43.0"
@@ -886,8 +886,8 @@ in
       "sha256-8K0Xm6PMo+daS6xt4kBqaVvO2/LruFV7PVvugI7sNDU=";
 
   mypy-boto3-mediatailor =
-    buildMypyBoto3Package "mediatailor" "1.43.4"
-      "sha256-HZuUYGeTGlBaEbBrm31HRV1Xtaw8+nAQL1nBpiwRur4=";
+    buildMypyBoto3Package "mediatailor" "1.43.40"
+      "sha256-Khj9f1GD4q8Bjk5LsI2yJQvtKm910epVlJMz5WxgPpw=";
 
   mypy-boto3-medical-imaging =
     buildMypyBoto3Package "medical-imaging" "1.43.4"
@@ -990,8 +990,8 @@ in
       "sha256-0rAEnU+3VsESGKlu8OTnY//rzwRqvROhRFga+vnwd1k=";
 
   mypy-boto3-outposts =
-    buildMypyBoto3Package "outposts" "1.43.31"
-      "sha256-pCoCP49nPBy/qhPn4gYGiDdQSp4/4e6WlUCKv6q7uog=";
+    buildMypyBoto3Package "outposts" "1.43.40"
+      "sha256-f+z9dYLo4uhsRvaCUcR+dbYpEv7xmlfgvUR1+eM+NeU=";
 
   mypy-boto3-panorama =
     buildMypyBoto3Package "panorama" "1.43.0"
diff --git a/pkgs/development/python-modules/patchright/default.nix b/pkgs/development/python-modules/patchright/default.nix
new file mode 100644
index 000000000000..f36176539867
--- /dev/null
+++ b/pkgs/development/python-modules/patchright/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  playwright,
+  setuptools,
+  toml,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "patchright";
+  version = "1.58.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Kaliiiiiiiiii-Vinyzu";
+    repo = "patchright-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-msV0CbVbTDSAB1BgxkUOpuzQDr8vMK2/wxJy1SSUU80=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    playwright
+    toml
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  # pythonImportsCheck disabled: module attempts filesystem writes at import time
+  pythonImportsCheck = [ ];
+
+  meta = {
+    description = "Undetected Python version of the Playwright testing and automation library";
+    homepage = "https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python";
+    changelog = "https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/pydeep2/default.nix b/pkgs/development/python-modules/pydeep2/default.nix
new file mode 100644
index 000000000000..cb0ff562013a
--- /dev/null
+++ b/pkgs/development/python-modules/pydeep2/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  setuptools,
+  ssdeep,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pydeep2";
+  version = "0.5.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JakubOnderka";
+    repo = "pydeep";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qeE+ckYIDOeXaDC3Rxh4LmS0oN+Tqvjwe2tGDDt7YgA=";
+  };
+
+  build-system = [ setuptools ];
+
+  buildInputs = [ ssdeep ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"/usr/local/include/"' '"${ssdeep}/include"' \
+      --replace-fail '"/usr/local/lib/"' '"${ssdeep}/lib"'
+  '';
+
+  pythonImportsCheck = [ "pydeep" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python bindings for ssdeep";
+    homepage = "https://github.com/JakubOnderka/pydeep";
+    changelog = "https://github.com/JakubOnderka/pydeep/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/pymisp/default.nix b/pkgs/development/python-modules/pymisp/default.nix
new file mode 100644
index 000000000000..076d8a210b2c
--- /dev/null
+++ b/pkgs/development/python-modules/pymisp/default.nix
@@ -0,0 +1,119 @@
+{
+  lib,
+  beautifulsoup4,
+  buildPythonPackage,
+  deprecated,
+  docutils,
+  extract-msg,
+  fetchFromGitHub,
+  lief,
+  myst-parser,
+  neo4j,
+  nix-update-script,
+  oletools,
+  poetry-core,
+  pure-magic-rs,
+  pydeep2,
+  pyfaup-rs,
+  pytestCheckHook,
+  python-dateutil,
+  reportlab,
+  requests,
+  rtfde,
+  sphinx-autodoc-typehints,
+  sphinx,
+  urllib3,
+  validators,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pymisp";
+  version = "2.5.34.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MISP";
+    repo = "PyMISP";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-68XJ6lqoNGnUneNIu0ZOKZhrumrt6CPLAt45UaZC5q0=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    deprecated
+    python-dateutil
+    requests
+  ];
+
+  optional-dependencies = {
+    brotli = [ urllib3 ];
+    docs = [
+      docutils
+      myst-parser
+      sphinx
+      sphinx-autodoc-typehints
+    ];
+    email = [
+      extract-msg
+      oletools
+      rtfde
+    ];
+    fileobjects = [
+      lief
+      pure-magic-rs
+      pydeep2
+    ];
+    neo4j = [ neo4j ];
+    openioc = [ beautifulsoup4 ];
+    pdfexport = [ reportlab ];
+    url = [ pyfaup-rs ];
+    virustotal = [ validators ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  disabledTestPaths = [
+    # Test requires network access
+    "tests/test_reportlab.py"
+  ];
+
+  disabledTests = [
+    # AttributeError
+    "test_analyst_data_object_object_attribute_alternative"
+    "test_analyst_data_on_object"
+    "test_analyst_data_on_object_alternative"
+    "test_analyst_data_on_object_attribute"
+    "test_bom_encoded"
+    "test_default_attributes"
+    "test_feed"
+    "test_git_vuln_finder"
+    "test_handling_of_various_email_types"
+    "test_mail_1"
+    "test_mail_1_headers_only"
+    "test_mail_multiple_to"
+    "test_mimeType"
+    "test_msg"
+    "test_obj_default_values"
+    "test_object_galaxy"
+    "test_object_tag"
+    "test_to_dict_json_format"
+  ];
+
+  pythonImportsCheck = [ "pymisp" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python library using the MISP Rest API";
+    homepage = "https://github.com/MISP/PyMISP";
+    changelog = "https://github.com/MISP/PyMISP/blob/${finalAttrs.src.rev}/CHANGELOG.txt";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/stix2-patterns/default.nix b/pkgs/development/python-modules/stix2-patterns/default.nix
index a4ce839ca0dc..b7bb98217eb9 100644
--- a/pkgs/development/python-modules/stix2-patterns/default.nix
+++ b/pkgs/development/python-modules/stix2-patterns/default.nix
@@ -5,26 +5,24 @@
   fetchFromGitHub,
   pytestCheckHook,
   setuptools,
-  six,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "stix2-patterns";
-  version = "2.0.0";
+  version = "2.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oasis-open";
     repo = "cti-pattern-validator";
-    tag = "v${version}";
-    hash = "sha256-lFgnvI5a7U7/Qj4Pqjr3mx4TNDnC2/Ru7tVG7VggR7Y=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ngRxUeT8ifFM4bpFRtS1ILtTz9lPXtyD8+0MYijWKoM=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     antlr4-python3-runtime
-    six
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -32,12 +30,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "stix2patterns" ];
 
   meta = {
-    broken = lib.versionAtLeast antlr4-python3-runtime.version "4.10";
     description = "Validate patterns used to express cyber observable content in STIX Indicators";
-    mainProgram = "validate-patterns";
     homepage = "https://github.com/oasis-open/cti-pattern-validator";
-    changelog = "https://github.com/oasis-open/cti-pattern-validator/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/oasis-open/cti-pattern-validator/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "validate-patterns";
   };
-}
+})
diff --git a/pkgs/development/python-modules/stix2-validator/default.nix b/pkgs/development/python-modules/stix2-validator/default.nix
index c80b02763c0b..b8415b2d2361 100644
--- a/pkgs/development/python-modules/stix2-validator/default.nix
+++ b/pkgs/development/python-modules/stix2-validator/default.nix
@@ -12,16 +12,16 @@
   stix2-patterns,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "stix2-validator";
-  version = "3.2.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oasis-open";
     repo = "cti-stix-validator";
-    tag = "v${version}";
-    hash = "sha256-OI1SXILyCRGl1ZsoyYDl+/RsBhTP24eqECtW3uazS2k=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-w9SlRspt5tRLdqqEr6UJ+cmq3KM08cN9BqMvdSYay0Y=";
   };
 
   build-system = [ setuptools ];
@@ -45,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Validator for STIX 2.0 JSON normative requirements and best practices";
     homepage = "https://github.com/oasis-open/cti-stix-validator/";
-    changelog = "https://github.com/oasis-open/cti-stix-validator/blob/${src.rev}/CHANGELOG";
+    changelog = "https://github.com/oasis-open/cti-stix-validator/blob/${finalAttrs.src.tag}/CHANGELOG";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/stix2/default.nix b/pkgs/development/python-modules/stix2/default.nix
index 566aa323c98d..8d8b68ab6b4a 100644
--- a/pkgs/development/python-modules/stix2/default.nix
+++ b/pkgs/development/python-modules/stix2/default.nix
@@ -14,16 +14,16 @@
   taxii2-client,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "stix2";
-  version = "3.0.1";
+  version = "3.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oasis-open";
     repo = "cti-python-stix2";
-    tag = "v${version}";
-    hash = "sha256-1bILZUZgPOWmFWRu4p/fmgi4QPEE1lFQH9mxoWd/saI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qm6VFufD9A4rSBHaDkqeYqOLRvE97SY0++o4ND0l3I0=";
   };
 
   build-system = [ setuptools ];
@@ -55,8 +55,8 @@ buildPythonPackage rec {
   meta = {
     description = "Produce and consume STIX 2 JSON content";
     homepage = "https://stix2.readthedocs.io/en/latest/";
-    changelog = "https://github.com/oasis-open/cti-python-stix2/blob/v${version}/CHANGELOG";
+    changelog = "https://github.com/oasis-open/cti-python-stix2/blob/${finalAttrs.src.tag}/CHANGELOG";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ PapayaJackal ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tf-playwright-stealth/default.nix b/pkgs/development/python-modules/tf-playwright-stealth/default.nix
new file mode 100644
index 000000000000..3da1803b3b0b
--- /dev/null
+++ b/pkgs/development/python-modules/tf-playwright-stealth/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fake-http-header,
+  fetchFromGitHub,
+  idna,
+  mockito,
+  playwright,
+  poetry-core,
+  pytestCheckHook,
+  urllib3,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "tf-playwright-stealth";
+  version = "1.2.2-unstable-2026-06-30";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tinyfish-io";
+    repo = "tf-playwright-stealth";
+    rev = "01b1b7a436edee4363a5d6f78f626a602550138b";
+    hash = "sha256-dUU0JqnEda0s6nVzJNmU1l536YZ05SI3DYhb7onuBwY=";
+  };
+
+  pythonRelaxDeps = [
+    "idna"
+    "urllib3"
+  ];
+
+  pythonRemoveDeps = [ "agentql" ];
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    fake-http-header
+    idna
+    playwright
+    urllib3
+  ];
+
+  nativeCheckInputs = [
+    mockito
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "playwright_stealth" ];
+
+  disabledTestPaths = [
+    # Requires agentql
+    "tests/e2e/"
+  ];
+
+  meta = with lib; {
+    description = "Module for using playwright stealthy";
+    homepage = "https://github.com/tinyfish-io/tf-playwright-stealth";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index a727d78159fe..a4c634349f47 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -23,8 +23,6 @@
   sentencepiece,
   soundfile,
   unidecode,
-  # linux-only:
-  fairseq,
 
   # passthru
   torchaudio,
@@ -114,9 +112,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     librosa
     requests
     soundfile
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fairseq
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/unclecode-litellm/default.nix b/pkgs/development/python-modules/unclecode-litellm/default.nix
new file mode 100644
index 000000000000..cdf3bb42eea9
--- /dev/null
+++ b/pkgs/development/python-modules/unclecode-litellm/default.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  click,
+  fastuuid,
+  fetchPypi,
+  httpx,
+  importlib-metadata,
+  jinja2,
+  jsonschema,
+  nix-update-script,
+  openai,
+  pydantic,
+  python-dotenv,
+  setuptools,
+  tiktoken,
+  tokenizers,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "unclecode-litellm";
+  version = "1.81.13";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "unclecode_litellm";
+    inherit (finalAttrs) version;
+    hash = "sha256-23DjTj6FnAoH8CywLqpkT4+ktOzF4vO+mli9fRw/7tw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    click
+    fastuuid
+    httpx
+    importlib-metadata
+    jinja2
+    jsonschema
+    openai
+    pydantic
+    python-dotenv
+    tiktoken
+    tokenizers
+  ];
+
+  # tests require access network
+  doCheck = false;
+
+  pythonImportsCheck = [ "litellm" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pre-compromise fork of litellm to interface with LLM API providers";
+    homepage = "https://pypi.org/project/unclecode-litellm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/valhallaapi/default.nix b/pkgs/development/python-modules/valhallaapi/default.nix
new file mode 100644
index 000000000000..0ac99d469f2a
--- /dev/null
+++ b/pkgs/development/python-modules/valhallaapi/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  configparser,
+  fetchFromGitHub,
+  nix-update-script,
+  packaging,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "valhallaapi";
+  version = "0.5.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "NextronSystems";
+    repo = "valhallaAPI";
+    tag = finalAttrs.version;
+    hash = "sha256-B4nF1t+d6J7XXu51NjbvIUercBn/pQaXWkWpX99ok/M=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    configparser
+    packaging
+    requests
+  ];
+
+  pythonImportsCheck = [ "valhallaAPI" ];
+
+  # Tests require network access
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Valhalla API Client";
+    homepage = "https://github.com/NextronSystems/valhallaAPI";
+    changelog = "https://github.com/NextronSystems/valhallaAPI/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix b/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix
index 4ed2ebf19e71..049267553c33 100644
--- a/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix
+++ b/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix
@@ -14,7 +14,7 @@ maven.buildMavenPackage (finalAttrs: {
     hash = "sha256-HMzRh/Q06Ik33mEkmh5U6qLiWk7ZCEstYq3Ll/pFhXM=";
   };
 
-  mvnHash = "sha256-Ek2qulMSHd1ZJfEloo6fIe+QMqub/Ftna/TzTt01ky8=";
+  mvnHash = "sha256-UrvPqh5zxhTQ6MJNJ7CSAA6dg5DX+Jdx6/wKr4/1brs=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 6a6b404bb7b1..6254f0646181 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -223,6 +223,7 @@ mapAliases {
   fenics = throw "fenics has been removed, use fenics-dolfinx instead"; # added 2025-08-07
   filebrowser_safe = throw "'filebrowser_safe' has been renamed to/replaced by 'filebrowser-safe'"; # Converted to throw 2025-10-29
   filesplit = throw "filesplit has been removed, since it is unmaintained"; # added 2025-08-20
+  fints_4 = throw "fints_4 has been removed, migrate to fints"; # added 2026-06-04
   flake8-future-import = throw "'flake8-future-import' has been removed as it was unmaintained upstream"; # Added 2026-03-22
   flask-security-too = throw "'flask-security-too' has been renamed to/replaced by 'flask-security'"; # Converted to throw 2025-10-29
   flask-silk = throw "flask-silk was removed, as it is unmaintained since 2018."; # added 2025-05-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c946d9a941fd..d65c34207b81 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -776,6 +776,8 @@ self: super: with self; {
 
   alphaessopenapi = callPackage ../development/python-modules/alphaessopenapi { };
 
+  alphashape = callPackage ../development/python-modules/alphashape { };
+
   altair = callPackage ../development/python-modules/altair { };
 
   altcha = callPackage ../development/python-modules/altcha { };
@@ -3408,6 +3410,8 @@ self: super: with self; {
 
   crate = callPackage ../development/python-modules/crate { };
 
+  crawl4ai = callPackage ../development/python-modules/crawl4ai { };
+
   crayons = callPackage ../development/python-modules/crayons { };
 
   crc = callPackage ../development/python-modules/crc { };
@@ -5514,6 +5518,8 @@ self: super: with self; {
     };
   };
 
+  fake-http-header = callPackage ../development/python-modules/fake-http-header { };
+
   fake-useragent = callPackage ../development/python-modules/fake-useragent { };
 
   faker = callPackage ../development/python-modules/faker { };
@@ -5731,8 +5737,6 @@ self: super: with self; {
 
   fints = callPackage ../development/python-modules/fints { };
 
-  fints_4 = callPackage ../development/python-modules/fints/4.nix { };
-
   finvizfinance = callPackage ../development/python-modules/finvizfinance { };
 
   fiona = callPackage ../development/python-modules/fiona { };
@@ -12578,6 +12582,8 @@ self: super: with self; {
 
   patchpy = callPackage ../development/python-modules/patchpy { };
 
+  patchright = callPackage ../development/python-modules/patchright { };
+
   path = callPackage ../development/python-modules/path { };
 
   path-and-address = callPackage ../development/python-modules/path-and-address { };
@@ -14072,6 +14078,8 @@ self: super: with self; {
 
   pydeconz = callPackage ../development/python-modules/pydeconz { };
 
+  pydeep2 = callPackage ../development/python-modules/pydeep2 { inherit (pkgs) ssdeep; };
+
   pydelijn = callPackage ../development/python-modules/pydelijn { };
 
   pydemumble = callPackage ../development/python-modules/pydemumble { };
@@ -14782,6 +14790,8 @@ self: super: with self; {
 
   pymilvus = callPackage ../development/python-modules/pymilvus { };
 
+  pymisp = callPackage ../development/python-modules/pymisp { };
+
   pymitsubishi = callPackage ../development/python-modules/pymitsubishi { };
 
   pymitv = callPackage ../development/python-modules/pymitv { };
@@ -19901,6 +19911,8 @@ self: super: with self; {
 
   tf-keras = callPackage ../development/python-modules/tf-keras { };
 
+  tf-playwright-stealth = callPackage ../development/python-modules/tf-playwright-stealth { };
+
   tf2onnx = callPackage ../development/python-modules/tf2onnx { };
 
   tflearn = callPackage ../development/python-modules/tflearn { };
@@ -21153,6 +21165,8 @@ self: super: with self; {
 
   uncertainties = callPackage ../development/python-modules/uncertainties { };
 
+  unclecode-litellm = callPackage ../development/python-modules/unclecode-litellm { };
+
   uncompresspy = callPackage ../development/python-modules/uncompresspy { };
 
   uncompyle6 = callPackage ../development/python-modules/uncompyle6 { };
@@ -21371,6 +21385,8 @@ self: super: with self; {
     callPackage ../development/python-modules/vacuum-map-parser-roborock
       { };
 
+  valhallaapi = callPackage ../development/python-modules/valhallaapi { };
+
   validate-email = callPackage ../development/python-modules/validate-email { };
 
   validator-collection = callPackage ../development/python-modules/validator-collection { };