diff --git a/doc/doc-support/lib-function-docs.nix b/doc/doc-support/lib-function-docs.nix
index bb81b50fddef..855cd6d0e3da 100644
--- a/doc/doc-support/lib-function-docs.nix
+++ b/doc/doc-support/lib-function-docs.nix
@@ -1,151 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
 # To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
 {
-  lib,
   stdenvNoCC,
   nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "fetchers";
-      description = "functions which can be reused across fetchers";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivations, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
 }:
-
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
   src = ../../lib;
 
-  nativeBuildInputs = [
-    nixdoc
-    nix
-  ];
+  nativeBuildInputs = [ nixdoc ];
+
+  buildPhase = ''
+    mkdir -p src
+    cp -r ${../../lib} src/lib
+
+    mkdir -p $out
+    nixdoc --manifest ${../function-catalog.json} --root src --output $out/lib-functions.json
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    cd ..
-
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      --store $(mktemp -d) \
-      > locations.json
-
-    function docgen {
-      name=$1
-      baseName=$2
-      description=$3
-      # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
-      else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
-      fi
-      echo "$out/$name.md" >> "$out/index.md"
-    }
-
-    mkdir -p "$out"
-
-    cat > "$out/index.md" << 'EOF'
-    ```{=include=} sections auto-id-prefix=auto-generated
-    EOF
-
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
-
-    echo '```' >> "$out/index.md"
-
     runHook postInstall
   '';
 }
diff --git a/doc/doc-support/lib-function-locations.nix b/doc/doc-support/lib-function-locations.nix
deleted file mode 100644
index 64a320f3f0cc..000000000000
--- a/doc/doc-support/lib-function-locations.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  nixpkgsPath,
-  revision,
-  libsetsJSON,
-}:
-let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
-
-  libDefPos =
-    prefix: set:
-    builtins.concatMap (
-      name:
-      [
-        {
-          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
-          location = builtins.unsafeGetAttrPos name set;
-        }
-      ]
-      ++ lib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
-        libDefPos (prefix ++ [ name ]) set.${name}
-      )
-    ) (builtins.attrNames set);
-
-  libset =
-    toplib:
-    map (subsetname: {
-      subsetname = subsetname;
-      functions = libDefPos [ ] toplib.${subsetname};
-    }) (map (x: x.name) libsets);
-
-  flattenedLibSubset =
-    { subsetname, functions }:
-    map (fn: {
-      name = "lib.${subsetname}.${fn.name}";
-      value = fn.location;
-    }) functions;
-
-  locatedlibsets = libs: map flattenedLibSubset (libset libs);
-  removeFilenamePrefix =
-    prefix: filename:
-    let
-      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
-      filenameLen = builtins.stringLength filename;
-      substr = builtins.substring prefixLen filenameLen filename;
-    in
-    substr;
-
-  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);
-
-  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));
-
-  fnLocationRelative =
-    { name, value }:
-    {
-      inherit name;
-      value = value // {
-        file = removeNixpkgs value.file;
-      };
-    };
-
-  relativeLocs = (map fnLocationRelative liblocations);
-  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
-
-  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
-  jsonLocs = builtins.listToAttrs (
-    map (
-      { name, value }:
-      {
-        name = sanitizeId name;
-        value =
-          let
-            text = "${value.file}:${toString value.line}";
-            target = "${urlPrefix}/${value.file}#L${toString value.line}";
-          in
-          "[${text}](${target}) in `<nixpkgs>`";
-      }
-    ) relativeLocs
-  );
-
-in
-jsonLocs
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index 0c9c5c6b8807..5533a4ca38c9 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
-      cat ./functions/library.md.in ${lib-docs}/index.md > ./functions/library.md
+      cp ${lib-docs}/lib-functions.json ./lib-functions.json
 
       substitute ./manual.md.in ./manual.md \
         --replace-fail '@MANUAL_VERSION@' '${lib.version}'
@@ -147,7 +147,7 @@ stdenvNoCC.mkDerivation (
     '';
 
     passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
+      lib-docs = callPackage ./lib-function-docs.nix { };
 
       epub = callPackage ./epub.nix { };
 
diff --git a/doc/function-catalog.json b/doc/function-catalog.json
new file mode 100644
index 000000000000..c8e419a285cd
--- /dev/null
+++ b/doc/function-catalog.json
@@ -0,0 +1,124 @@
+{
+  "version": 1,
+  "groups": [
+    { "id": "asserts", "description": "assertion functions" },
+    { "id": "attrsets", "description": "attribute set functions" },
+    { "id": "strings", "description": "string manipulation functions" },
+    { "id": "versions", "description": "version string functions" },
+    { "id": "trivial", "description": "miscellaneous functions" },
+    { "id": "fixedPoints", "description": "explicit recursion functions" },
+    { "id": "lists", "description": "list manipulation functions" },
+    { "id": "debug", "description": "debugging functions" },
+    { "id": "options", "description": "NixOS / nixpkgs option handling" },
+    { "id": "path", "description": "path functions" },
+    {
+      "id": "fetchers",
+      "description": "functions which can be reused across fetchers"
+    },
+    { "id": "filesystem", "description": "filesystem functions" },
+    { "id": "fileset" },
+    { "id": "sources", "description": "source filtering functions" },
+    { "id": "cli", "description": "command-line serialization functions" },
+    {
+      "id": "generators",
+      "description": "functions that create file formats from nix data structures"
+    },
+    {
+      "id": "gvariant",
+      "description": "GVariant formatted string serialization functions"
+    },
+    {
+      "id": "customisation",
+      "description": "Functions to customise (derivation-related) functions, derivations, or attribute sets"
+    },
+    { "id": "meta", "description": "functions for derivation metadata" },
+    {
+      "id": "derivations",
+      "description": "miscellaneous derivation-specific functions"
+    }
+  ],
+  "sources": [
+    { "path": "lib.trivial", "file": "lib/trivial.nix", "groups": ["trivial"] },
+    {
+      "path": "lib.fixedPoints",
+      "file": "lib/fixed-points.nix",
+      "groups": ["fixedPoints"]
+    },
+    {
+      "path": "lib.attrsets",
+      "file": "lib/attrsets.nix",
+      "groups": ["attrsets"]
+    },
+    { "path": "lib.lists", "file": "lib/lists.nix", "groups": ["lists"] },
+    { "path": "lib.strings", "file": "lib/strings.nix", "groups": ["strings"] },
+    {
+      "path": "lib.customisation",
+      "file": "lib/customisation.nix",
+      "groups": ["customisation"]
+    },
+    {
+      "path": "lib.derivations",
+      "file": "lib/derivations.nix",
+      "groups": ["derivations"]
+    },
+    { "path": "lib.meta", "file": "lib/meta.nix", "groups": ["meta"] },
+    {
+      "path": "lib.versions",
+      "file": "lib/versions.nix",
+      "groups": ["versions"]
+    },
+    { "path": "lib.cli", "file": "lib/cli.nix", "groups": ["cli"] },
+    {
+      "path": "lib.gvariant",
+      "file": "lib/gvariant.nix",
+      "groups": ["gvariant"]
+    },
+    {
+      "path": "lib.generators",
+      "file": "lib/generators.nix",
+      "groups": ["generators"]
+    },
+    { "path": "lib.asserts", "file": "lib/asserts.nix", "groups": ["asserts"] },
+    { "path": "lib.debug", "file": "lib/debug.nix", "groups": ["debug"] },
+    {
+      "path": "lib.fetchers",
+      "file": "lib/fetchers.nix",
+      "groups": ["fetchers"]
+    },
+    { "path": "lib.path", "file": "lib/path/default.nix", "groups": ["path"] },
+    {
+      "path": "lib.filesystem",
+      "file": "lib/filesystem.nix",
+      "groups": ["filesystem"]
+    },
+    {
+      "path": "lib.fileset",
+      "file": "lib/fileset/default.nix",
+      "groups": ["fileset"]
+    },
+    {
+      "path": "lib.sources",
+      "file": "lib/sources.nix",
+      "groups": ["sources"],
+      "mode": "deep",
+      "include": [
+        "pathIsGitRepo",
+        "commitIdFromGitRepo",
+        "cleanSource",
+        "cleanSourceWith",
+        "cleanSourceFilter",
+        "pathHasContext",
+        "canCleanSource",
+        "urlToName",
+        "shortRev",
+        "revOrTag",
+        "repoRevToName",
+        "sourceByRegex",
+        "sourceFilesBySuffices",
+        "sourceByGlobs",
+        "trace"
+      ]
+    },
+    { "path": "lib.options", "file": "lib/options.nix", "groups": ["options"] }
+  ]
+}
diff --git a/doc/functions/library.md.in b/doc/functions/library.md
similarity index 64%
rename from doc/functions/library.md.in
rename to doc/functions/library.md
index e17de86feb8a..c2f32e059794 100644
--- a/doc/functions/library.md.in
+++ b/doc/functions/library.md
@@ -1,5 +1,3 @@
 # Nixpkgs Library Functions {#sec-functions-library}
 
 Nixpkgs provides a standard library at `pkgs.lib`, or through `import <nixpkgs/lib>`.
-
-<!-- nixdoc-generated documentation must be appended here during build! -->
diff --git a/doc/nav.json b/doc/nav.json
index 791cb3eb4b1e..cc361e87593f 100644
--- a/doc/nav.json
+++ b/doc/nav.json
@@ -628,9 +628,12 @@
           "file": "functions.md"
         },
         {
-          "id-prefix": "auto-generated",
           "file": "functions/library.md"
         },
+        {
+          "collection": "lib-functions.json",
+          "type": "nixdoc"
+        },
         {
           "file": "functions/generators.section.md"
         },
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 1d18a96fb1cd..f24ca2c358f4 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -78,11 +78,6 @@ in
                 config.hardware.printers.ensurePrinters. Specifying a symblic
                 name here that does not match any of those printers is
                 considered a hard error.
-
-                ::: {.warning}
-                Print jobs to this class will quietly fail if there are no
-                printers in this class. CUPS reports them as pending
-                :::
               '';
             };
             classes = mkOption {
@@ -267,7 +262,14 @@ in
           '';
         }
       )
-    ];
+    ]
+    ++ map (class: {
+      assertion = cfg.ensureClasses.${class}.printers != [ ] || cfg.ensureClasses.${class}.classes != [ ];
+      message = ''
+        At least one of the lists `config.hardware.printers.ensureClasses.${class}.printers`
+        and `config.hardware.printers.ensureClasses.${class}.classes` has to be non-empty.
+      '';
+    }) (builtins.attrNames cfg.ensureClasses);
 
     systemd.services.cups = {
       postStart =
@@ -333,17 +335,6 @@ in
             d = cfg.ensureDefaultPrinter;
           })}
 
-          #### CLASS DEFINITIONS ####
-          lpadmin -p _tmp -v file:/dev/null
-          ${lib.concatMapStringsSep "\n" (
-            className:
-            lpadmin {
-              p = "_tmp";
-              c = className;
-            }
-          ) classNames}
-          lpadmin -x _tmp
-
           #### ADDING PRINTERS TO CLASSES ####
           ${lib.concatMapStringsSep "\n" (
             className:
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b412a85e56a0..4d665eb6d08b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -573,6 +573,7 @@ in
   documize = runTest ./documize.nix;
   docuseal-psql = runTest ./docuseal-postgres.nix;
   docuseal-sqlite = runTest ./docuseal-sqlite.nix;
+  docuum = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docuum.nix;
   doh-proxy-rust = runTest ./doh-proxy-rust.nix;
   dokuwiki = runTest ./dokuwiki.nix;
   dolibarr = runTest ./dolibarr.nix;
diff --git a/nixos/tests/docuum.nix b/nixos/tests/docuum.nix
new file mode 100644
index 000000000000..562bb9967701
--- /dev/null
+++ b/nixos/tests/docuum.nix
@@ -0,0 +1,58 @@
+{ pkgs, lib, ... }:
+{
+  name = "docuum";
+  meta.maintainers = [ lib.maintainers.h7x4 ];
+
+  containers.machine = {
+    virtualisation.docker.enable = true;
+
+    services.docuum = {
+      enable = true;
+      threshold = "5 MB";
+      keep = [ "^keep-me:" ];
+    };
+  };
+
+  testScript =
+    let
+      # Each image is 2 MB, so the third non-exempt image should be evicted.
+      imageSizeKb = 2 * 1024;
+
+      mkTestImage =
+        name:
+        pkgs.dockerTools.buildImage {
+          inherit name;
+          tag = "test";
+          copyToRoot = pkgs.runCommand "docuum-test-data-${name}" { } ''
+            mkdir -p $out
+            echo "${name}" > $out/name
+            dd if=/dev/zero of=$out/data bs=1024 count=${toString imageSizeKb}
+          '';
+        };
+
+      images = {
+        keepMe = mkTestImage "keep-me";
+        old = mkTestImage "old-image";
+        new = mkTestImage "new-image";
+      };
+    in
+    ''
+      start_all()
+
+      machine.wait_for_unit("docker.service")
+      machine.wait_for_unit("docuum.service")
+      machine.wait_until_succeeds("journalctl -u docuum --grep 'Listening for Docker events'")
+
+      machine.succeed(
+          "docker load < ${images.keepMe}",
+          "docker load < ${images.old}",
+          "docker load < ${images.new}",
+      )
+
+      machine.wait_until_fails("docker image inspect old-image:test")
+      machine.succeed(
+          "docker image inspect keep-me:test",
+          "docker image inspect new-image:test",
+      )
+    '';
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix
new file mode 100644
index 000000000000..6c42c59cb24f
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix
@@ -0,0 +1,10 @@
+{
+  traefik-crd = {
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-41.4.2+up41.4.0.tgz";
+    sha256 = "0dfvh65gilw4z3cyia8gq0hqgcp09cbdihq6g6n93af9lbpwysnf";
+  };
+  traefik = {
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-41.4.2+up41.4.0.tgz";
+    sha256 = "1379f54pci4y41szpnw016wr6kkawyyr6sfzijdsz3f8fryhp3xp";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json
new file mode 100644
index 000000000000..bd3e07168bd3
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json
@@ -0,0 +1,26 @@
+{
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "936f0ef6acaacb1950367308fbbe0388244df2ffc2a80cbd99e1f01ddde413e7"
+  },
+  "airgap-images-amd64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0b4ff0d6e233de54be4e16cb5aa298fd53ad88f66ad8ae31093b5ef4dcefcdd0"
+  },
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "b7d9f8e94a28d0f70b8b9d6782f3d3190fe94b0b19fca4554e41ad3dbdee1f3f"
+  },
+  "airgap-images-arm-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "be1628b6beb17937140171374beed94e550a9c3c8ea98eec23ae6f21ca8493f1"
+  },
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "d1b534c7b5b67e06fdea2231813b3adc596ba36d7a63699fec1eb23e3c0baf17"
+  },
+  "airgap-images-arm64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "b3bd28d3a20144927b25ebb1d255a16ce55bb050b9af5e63abd1bf91c0838fe5"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_37/versions.nix b/pkgs/applications/networking/cluster/k3s/1_37/versions.nix
new file mode 100644
index 000000000000..c75fcb9cceba
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/versions.nix
@@ -0,0 +1,21 @@
+{
+  k3sVersion = "1.37.0+k3s1";
+  k3sCommit = "bb7cf0657bafdfbb4349d1740810442d09c2248a";
+  k3sRepoSha256 = "0glzg974w7f0jdaljr9bxw36qv53chii25rjbrvlbzlyzjq19wws";
+  k3sVendorHash = "sha256-AObmRWcIyFDy1aTA66LLFYnnUQzpf6+Ts6HQRA3i26A=";
+  chartVersions = import ./chart-versions.nix;
+  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
+  k3sRootVersion = "0.15.2";
+  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.3.4-k3s1";
+  containerdSha256 = "18kci7drnlxkn4vk166jijavgwaml1vhlfqirhzljmb4g16ydrah";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
+  criCtlVersion = "1.37.0-k3s1";
+  flannelVersion = "v0.28.4";
+  flannelPluginVersion = "v1.9.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s5";
+  helmJobVersion = "v0.13.3-build20260727";
+}
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 9b8933ef3e99..ea201b770d30 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -15,4 +15,5 @@ in
   k3s_1_34 = forVersions ./1_34/versions.nix;
   k3s_1_35 = forVersions ./1_35/versions.nix;
   k3s_1_36 = forVersions ./1_36/versions.nix;
+  k3s_1_37 = forVersions ./1_37/versions.nix;
 }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 01f304b09b5b..e1bd78ab184a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -670,13 +670,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-0cDJS89LsTuE2MJoNCnG8Xy7pJYisOggKrqQlK4OeAw=",
+    "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.80.0",
+    "rev": "v0.81.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-O+UMVIed8JEwjaXGTewOY6Vk+MopCQSx+qyMvJW7bkI="
+    "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
     "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 37a37f7b7bd2..94fd3815e132 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -11,15 +11,13 @@
 }:
 
 let
-  python = python3.override {
-    self = python;
-    packageOverrides = final: prev: {
-      # The ast-serialize package, a dependency for mypy, depends on
-      # fetchCargoVendor and is part of the bootstrap chain for requests.
-      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+  python3Packages = python3.pkgs // {
+    # Break the requests -> charset-normalizer -> mypy -> ast-serialize ->
+    # fetchCargoVendor bootstrap cycle without overriding the whole Python scope.
+    requests = python3.pkgs.requests.override {
+      charset-normalizer = python3.pkgs.charset-normalizer.override { withMypyc = false; };
     };
   };
-  python3Packages = python.pkgs;
 
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [
diff --git a/pkgs/by-name/ci/civetweb/package.nix b/pkgs/by-name/ci/civetweb/package.nix
index 13c996fddcbf..92957e569bd2 100644
--- a/pkgs/by-name/ci/civetweb/package.nix
+++ b/pkgs/by-name/ci/civetweb/package.nix
@@ -4,6 +4,12 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  zlib,
+  versionCheckHook,
+
+  withZlib ? false,
+  withUnixSockets ? false,
+  withWebSockets ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,11 +38,18 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-I";
 
   nativeBuildInputs = [
     cmake
   ];
 
+  buildInputs = lib.optional withZlib zlib;
+
   # The existence of the "build" script causes `mkdir -p build` to fail:
   #   mkdir: cannot create directory 'build': File exists
   preConfigure = ''
@@ -60,12 +73,22 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Workaround CMake 4 compat
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
-  ];
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_WEBSOCKETS" withWebSockets)
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_ZLIB" withZlib)
+  ]
+
+  # Support for listening for HTTP requests on a Unix domain socket.
+  ++ lib.optional withUnixSockets "-DCMAKE_C_FLAGS=-DUSE_X_DOM_SOCKET";
+  # NOTE Once 1.17 is released, we can use a CMake flag:
+  # (lib.cmakeBool "CIVETWEB_ENABLE_X_DOM_SOCKET" withUnixSockets)
 
   meta = {
     description = "Embedded C/C++ web server";
     mainProgram = "civetweb";
     homepage = "https://github.com/civetweb/civetweb";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
   };
 })
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
index d6d61d9c1c14..c63ac2a2b4f2 100644
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -28,7 +29,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.nixos = nixosTests.docuum;
+  };
 
   meta = {
     description = "Least recently used (LRU) eviction of Docker images";
diff --git a/pkgs/by-name/du/dust/package.nix b/pkgs/by-name/du/dust/package.nix
index f1d80ab9e7e0..63fc5dddf7f8 100644
--- a/pkgs/by-name/du/dust/package.nix
+++ b/pkgs/by-name/du/dust/package.nix
@@ -12,13 +12,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tK7cAckvRmWcaDTd92+XccswKHLAr4r8IzYYzcZYu/g=";
+    hash = "sha256-BHlasERvwS/mr6EUfgItvrL/oozFta4/XwwI3hYyMGo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-KQPCRQLTmltoJTgbA3ri5U/w+JJb/J+iclK7Mcb4hfU=";
+  cargoHash = "sha256-oIR10K/vn9sexW+m9vOuGJDqXRk2gjB0WoPj71cT+eg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ex/exa-agent-skills/package.nix b/pkgs/by-name/ex/exa-agent-skills/package.nix
index 1effed515d47..4638ff04b437 100644
--- a/pkgs/by-name/ex/exa-agent-skills/package.nix
+++ b/pkgs/by-name/ex/exa-agent-skills/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "exa-agent-skills";
-  version = "2026.09.11-e7de871";
+  version = "2026.09.16-73cc4b0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "exa-labs";
     repo = "agent-skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v8iHcDvKe7Ls1P7V0izJneyo3vYyW4dSzgUdmWeAP7o=";
+    hash = "sha256-cQMUDaHTHgwMjq1P6pMdulhADNAO78S+9WuyA7kssrg=";
   };
 
   nativeBuildInputs = [ installAgentSkills ];
diff --git a/pkgs/by-name/gg/ggml/package.nix b/pkgs/by-name/gg/ggml/package.nix
index 6b3cbf69a58c..c4fe5307a53d 100644
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.23.0";
+  version = "0.24.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QArqnQ5//Ft9Knm1Caqz68t4ikNQnk+O+OZUTfZlVCk=";
+    hash = "sha256-wSI0GnSFoMyBKuzIrelURzaIaSIS/eIAwG4etmy9XUo=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
diff --git a/pkgs/by-name/ke/keeweb/package.nix b/pkgs/by-name/ke/keeweb/package.nix
deleted file mode 100644
index 81a5e2511523..000000000000
--- a/pkgs/by-name/ke/keeweb/package.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  lib,
-  libGL,
-  stdenv,
-  fetchurl,
-  undmg,
-  dpkg,
-  autoPatchelfHook,
-  wrapGAppsHook3,
-  alsa-lib,
-  at-spi2-atk,
-  gdk-pixbuf,
-  nss,
-  udev,
-  gnome-keyring,
-  libgbm,
-  gtk3,
-  libusb1,
-  libsecret,
-  libappindicator,
-  xdotool,
-  libx11,
-  libxcomposite,
-  libxext,
-  libxrandr,
-  libxscrnsaver,
-  libxtst,
-  libxshmfence,
-}:
-let
-  pname = "keeweb";
-  version = "1.18.7";
-
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.linux.x64.deb";
-      hash = "sha256-/U+vn5TLIU9/J6cRFjuAdyGzlwC04mp4L2X2ETp+ZSE=";
-    };
-    aarch64-darwin = fetchurl {
-      url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.mac.arm64.dmg";
-      hash = "sha256-bkhwsWYLkec16vMOfXUce7jfrmI9W2xHiZvU1asebK4=";
-    };
-  };
-  src =
-    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  libraries = [
-    alsa-lib
-    at-spi2-atk
-    gdk-pixbuf
-    libGL
-    nss
-    udev
-    libx11
-    libxcomposite
-    libxext
-    libxrandr
-    libxscrnsaver
-    libxtst
-    libxshmfence
-    gnome-keyring
-    libgbm
-    gtk3
-    libusb1
-    libsecret
-    libappindicator
-    xdotool
-  ];
-
-  meta = {
-    description = "Free cross-platform password manager compatible with KeePass";
-    mainProgram = "keeweb";
-    homepage = "https://keeweb.info/";
-    changelog = "https://github.com/keeweb/keeweb/blob/v${version}/release-notes.md";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sikmir ];
-    platforms = builtins.attrNames srcs;
-    knownVulnerabilities = [
-      "Uses Electron 12, EOL on November 16 2012. Has many known CVEs"
-    ];
-  };
-in
-if stdenv.hostPlatform.isDarwin then
-  stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    nativeBuildInputs = [ undmg ];
-
-    sourceRoot = ".";
-
-    installPhase = ''
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
-    '';
-  }
-else
-  stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    nativeBuildInputs = [
-      autoPatchelfHook
-      wrapGAppsHook3
-      dpkg
-    ];
-
-    buildInputs = libraries;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/bin
-      cp -r usr/share $out/share
-
-      runHook postInstall
-    '';
-
-    postFixup = ''
-      makeWrapper $out/share/keeweb-desktop/keeweb $out/bin/keeweb \
-        --argv0 "keeweb" \
-        --add-flags "$out/share/keeweb-desktop/resources/app.asar" \
-        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libraries}" \
-        ''${gappsWrapperArgs[@]}
-    '';
-  }
diff --git a/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix b/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
index 82d2dae72efd..db1b512dc0c7 100644
--- a/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-08-28";
+  version = "0-unstable-2026-09-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "a7985a9c4278ac352f8ca7bb4d3cc6b36e9e3e7d";
-    hash = "sha256-uG4bGYsl4ZisaO7ICg/QdLv6CfV5cB4T56MMpLuu9QQ=";
+    rev = "c2838c7dc4236fc2fe94e5dbd08b41486067918e";
+    hash = "sha256-sqic7mFeuhmW8fPB2WaEE1CJxSxB0pgFzoWX+DPirqM=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix
index 69a3fa5879e4..5c6bb38e10a9 100644
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-continuwuity";
-  version = "26.8.1";
+  version = "26.9.0";
 
   src = fetchFromGitea {
     domain = "forgejo.ellis.link";
     owner = "continuwuation";
     repo = "continuwuity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-slwfK5aEIFjIue01L4nVUHaLx/2j3nRKrmkNkfPPZXE=";
+    hash = "sha256-w/sFqEbvzNTbvR8eTeVT0qo/t0p/vlQUna1bPOqJs7E=";
   };
 
-  cargoHash = "sha256-s87vdh+5rMNIXDWt2dZZvqSY9dJzEHuvEhJLG1HvphY=";
+  cargoHash = "sha256-ubIQNgn/FM++WkmnfDOVUpxfBCElIYJxvNMipwXbmIc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 57fe460e8d54..2912d4f85ce4 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -29,14 +29,15 @@
   undmg,
   makeWrapper,
   libpulseaudio,
+  pipewire,
 }:
 let
   pname = "nextcloud-talk-desktop";
-  version = "2.2.3"; # Ensure both hashes (Linux and Darwin) are updated!
+  version = "2.2.4"; # Ensure both hashes (Linux and Darwin) are updated!
 
   hashes = {
-    linux = "sha256-6YoAlMGKPeSJoXd211cufdE/XgroojH3djwaSEwlBjs=";
-    darwin = "sha256-BpyVJXyCYC1qH4ecDobHBVLLTeVDx/MPWBsnXgrnKhE=";
+    linux = "sha256-veIuQqxLxhvJuezJ1dL0+ranMrf9p3YEJ2hFhzuZj0I=";
+    darwin = "sha256-YLD4adfWlRRndQMjSXxERK1aCjLUVq0YoV9bJyu+0BA=";
   };
 
   # Only x86_64-linux is supported with Darwin support being universal
@@ -113,6 +114,9 @@ let
 
       # Fixes input/output audio device selection
       libpulseaudio
+
+      # Electron dynamically loads PipeWire for Wayland screen sharing.
+      pipewire
     ];
 
     desktopItems = [
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index 9b8d419f2920..0f6d3dabf42b 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -11,7 +11,7 @@ from typing import Any, Callable, ClassVar, Generic, NamedTuple, cast, get_args
 
 from markdown_it.token import Token
 
-from . import md, options
+from . import md, nixdoc, options
 from .html import HTMLRenderer, UnresolvedXrefError
 from .manual_structure import (
     FragmentType,
@@ -637,7 +637,16 @@ class ConfigGroup:
     # id-prefix can only be set on a group, matching the legacy "includes" behavior
     id_prefix: str | None = None
 
-ConfigNode = ConfigLeaf | ConfigGroup
+# a collection expands to one page per group found in a generated data file.
+# 'nixdoc' renders a nixdoc manifest-mode export, other types may follow.
+COLLECTION_TYPES = ('nixdoc',)
+
+@dataclass
+class ConfigCollection:
+    collection: str
+    type: str
+
+ConfigNode = ConfigLeaf | ConfigGroup | ConfigCollection
 
 @dataclass
 class ConfigManifest:
@@ -720,12 +729,26 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         id_prefix = item.get('id-prefix')
         if id_prefix is not None and (not isinstance(id_prefix, str)):
             raise SrcError(src=src, description=f"{where}: 'id-prefix' must be a string when being set")
-        has_file, has_children = 'file' in item, 'children' in item
-        if has_file == has_children:
+        kinds = [k for k in ('file', 'children', 'collection') if k in item]
+        if len(kinds) != 1:
             raise SrcError(
                 src=src,
-                description=f"{where}: must have exactly one of 'file' or 'children'")
-        if has_file:
+                description=f"{where}: must have exactly one of 'file', 'children' or 'collection'")
+        if kinds[0] == 'collection':
+            if not isinstance(item['collection'], str):
+                raise SrcError(src=src, description=f"{where}: 'collection' must be a string")
+            typ = item.get('type')
+            if typ not in COLLECTION_TYPES:
+                raise SrcError(
+                    src=src,
+                    description=f"{where}: 'type' must be one of {list(COLLECTION_TYPES)}, got {typ!r}")
+            # a collection expands to many pages, so a single label or prefix cannot apply
+            if label is not None or id_prefix is not None:
+                raise SrcError(
+                    src=src,
+                    description=f"{where}: a collection accepts neither 'label' nor 'id-prefix'")
+            return ConfigCollection(collection=item['collection'], type=typ)
+        if kinds[0] == 'file':
             if not isinstance(item['file'], str):
                 raise SrcError(src=src, description=f"{where}: 'file' must be a string")
             return ConfigLeaf(file=item['file'], label=label, id_prefix=id_prefix)
@@ -750,13 +773,20 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         tokens[6:6] = [include]
 
     def _build_config_include(self, nodes: list[ConfigNode], config_file: Path, id_prefix: str | None = None) -> Token:
-        included = [self._build_config_item(node, config_file, id_prefix) for node in nodes]
+        included: list[tuple[list[Token], Path]] = []
+        for node in nodes:
+            included += self._build_config_item(node, config_file, id_prefix)
         token = Token('included_page', '', 0, map=[0, 1])
         token.meta['included'] = included
         token.meta['include-args'] = {}
         return token
 
-    def _build_config_item(self, node: ConfigNode, config_file: Path, id_prefix: str | None = None) -> tuple[list[Token], Path]:
+    # one node may expand to several pages, so this returns a list of fragments
+    def _build_config_item(self, node: ConfigNode, config_file: Path,
+                           id_prefix: str | None = None) -> list[tuple[list[Token], Path]]:
+        if isinstance(node, ConfigCollection):
+            return self._build_config_collection(node, config_file)
+
         if isinstance(node, ConfigLeaf):
             path = (config_file.parent / node.file).resolve()
             leaf_src = path.read_text()
@@ -772,7 +802,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
                 self._base_paths.pop()
             if node.label is not None:
                 fragment[1].meta['toc-label'] = node.label
-            return fragment, path
+            return [(fragment, path)]
 
         # TocEntry._collect_entries reads nav-label and nav-id.
         # it builds the sidebar group from them.
@@ -785,7 +815,25 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         if node.id is not None:
             group.meta['nav-id'] = node.id
 
-        return [group], config_file
+        return [([group], config_file)]
+
+    def _build_config_collection(self, node: ConfigCollection,
+                                 config_file: Path) -> list[tuple[list[Token], Path]]:
+        path = (config_file.parent / node.collection).resolve()
+        try:
+            assert node.type == 'nixdoc', f"unhandled collection type {node.type!r}"
+            sections = nixdoc.render_sections(json.loads(path.read_text()), self._revision)
+        except (OSError, json.JSONDecodeError, nixdoc.NixdocExportError) as e:
+            raise RuntimeError(f"processing {node.type} collection {path}") from e
+        # the export file is the only "location" we can report errors against
+        self._base_paths.append(path)
+        self._current_type.append('page')
+        try:
+            return [(self._parse(src, auto_id_prefix=f"auto-generated-{group_id}"), path)
+                    for group_id, src in sections]
+        finally:
+            self._current_type.pop()
+            self._base_paths.pop()
 
     def _parse(self, src: str, *, auto_id_prefix: None | str = None) -> list[Token]:
         tokens = super()._parse(src,auto_id_prefix=auto_id_prefix)
@@ -975,7 +1023,11 @@ def _build_cli_html(p: argparse.ArgumentParser) -> None:
     p.add_argument('--sidebar-depth', default=2, type=int)
     p.add_argument('--experimental-config', type=Path, help="""
 JSON file of the following form
-{ items: [ { file, label? } | { label, children: [...], id? } ], open: [ id, ... ] }
+{ items: [ { file, label? } | { label, children: [...], id? } | { collection, type } ],
+  open: [ id, ... ] }
+
+A collection reads a generated data file and expands to one page per group in it.
+'type' selects the renderer; only 'nixdoc' exists so far.
 
 Files added through this flag prepend '--infile'
 
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py
new file mode 100644
index 000000000000..063fb9d40b11
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py
@@ -0,0 +1,179 @@
+# Render a nixdoc export v1 collection
+#
+# Takes json of v1 export schema
+# https://github.com/nix-community/nixdoc/blob/554a2e2676548f58f85d76b69308447a4e60450d/src/export.rs#L101
+#
+# Returns a commonmark flavour that nixos-render-docs can process
+#
+
+import re
+from typing import Any, NamedTuple
+
+# html anchors only allow certain anchors
+_ANCHOR_HOSTILE = re.compile(r"[^A-Za-z0-9._-]")
+
+def _anchor_id(s: str) -> str:
+    return _ANCHOR_HOSTILE.sub("", s)
+
+_SCHEMA_VERSION = 1
+
+
+class NixdocExportError(Exception):
+    pass
+
+class Source(NamedTuple):
+    file: str
+    line: int
+
+
+class Group(NamedTuple):
+    id: str
+    description: str
+
+
+class Entry(NamedTuple):
+    id: str
+    attr_path: str
+    groups: list[str]
+    description: str
+    source: Source
+
+
+class Export(NamedTuple):
+    groups: list[Group]
+    entries: list[Entry]
+
+
+def _require(obj: dict[str, Any], key: str, ctx: str) -> Any:
+    try:
+        return obj[key]
+    except (KeyError, TypeError) as e:
+        raise NixdocExportError(f"{ctx}: missing required field {key!r}") from e
+
+
+def _parse_group(raw: dict[str, Any]) -> Group:
+    group_id = _require(raw, "id", "group")
+    return Group(id=group_id, description=(raw.get("description") or "").strip())
+
+
+def _parse_entry(raw: dict[str, Any]) -> Entry:
+    entry_id = _require(raw, "id", "entry")
+    ctx = f"entry {entry_id!r}"
+    source = _require(raw, "source", ctx)
+    return Entry(
+        id=entry_id,
+        attr_path=_require(raw, "attrPath", ctx),
+        groups=_require(raw, "groups", ctx),
+        description=_require(raw, "description", ctx),
+        source=Source(file=_require(source, "file", ctx), line=_require(source, "line", ctx)),
+    )
+
+
+def parse_export(data: dict[str, Any]) -> Export:
+    schema = data.get("schemaVersion") if isinstance(data, dict) else None
+    if schema != _SCHEMA_VERSION:
+        raise NixdocExportError(
+            f"unsupported nixdoc export schemaVersion {schema!r}; "
+            f"this renderer supports version {_SCHEMA_VERSION}"
+        )
+    return Export(
+        groups=[_parse_group(g) for g in _require(data, "groups", "export")],
+        entries=[_parse_entry(e) for e in _require(data, "entries", "export")],
+    )
+
+
+def _trim_leading_whitespace(line: str, max_count: int) -> str:
+    count = 0
+    i = 0
+    for ch in line:
+        if ch.isspace() and count < max_count:
+            count += 1
+            i += 1
+        else:
+            break
+    return line[i:]
+
+
+def _get_fence(line: str, allow_info: bool) -> tuple[int, str] | None:
+    if not line:
+        return None
+    first = line[0]
+    if first not in ('`', '~'):
+        return None
+    count = 1
+    for ch in line[1:]:
+        if ch == first:
+            count += 1
+        else:
+            if not allow_info and ch != '\n':
+                return None
+            return (count, first)
+    return (count, first)
+
+
+def _handle_heading(line: str, levels: int) -> str:
+    hashes = 0
+    for ch in line:
+        if ch == '#':
+            hashes += 1
+        else:
+            break
+    rest = line[hashes:]
+    new_hashes = min(hashes + levels, 6)
+    return f"{'#' * new_hashes}{rest}"
+
+
+def shift_headings(text: str, levels: int) -> str:
+    result: list[str] = []
+    curr_fence: tuple[int, str] | None = None
+    for raw_line in text.splitlines(keepends=True):
+        line = _trim_leading_whitespace(raw_line, 3)
+        if line.startswith("```") or line.startswith("~~~"):
+            if curr_fence is None:
+                curr_fence = _get_fence(line, True)
+            else:
+                end = _get_fence(line, False)
+                if end is not None:
+                    start_count, start_char = curr_fence
+                    end_count, end_char = end
+                    if start_char == end_char and start_count <= end_count:
+                        curr_fence = None
+
+        if curr_fence is None and line.startswith('#'):
+            result.append(_handle_heading(line, levels))
+        else:
+            result.append(raw_line)
+    return "".join(result)
+
+
+def _located_at(source: Source, revision: str) -> str:
+    url = f"https://github.com/NixOS/nixpkgs/blob/{revision}/{source.file}#L{source.line}"
+    return f"Located at [{source.file}:{source.line}]({url}) in `<nixpkgs>`."
+
+
+def render_group(group: Group, entries: list[Entry], revision: str) -> str:
+    parts = [f"# {group.id} {{#sec-functions-library-{_anchor_id(group.id)}}}\n"]
+    if group.description:
+        parts.append(shift_headings(group.description, 1) + "\n")
+
+    for entry in entries:
+        parts.append(f"## `{entry.attr_path}` {{#function-library-{_anchor_id(entry.id)}}}\n")
+        body = shift_headings(entry.description.strip(), 2)
+        if body:
+            parts.append(body + "\n")
+        parts.append(_located_at(entry.source, revision) + "\n")
+
+    return "\n".join(parts)
+
+
+def render_sections(data: dict[str, Any], revision: str) -> list[tuple[str, str]]:
+    export = parse_export(data)
+    by_group: dict[str, list[Entry]] = {group.id: [] for group in export.groups}
+    for entry in export.entries:
+        for group_id in entry.groups:
+            if group_id in by_group:
+                by_group[group_id].append(entry)
+    return [
+        (group.id, render_group(group, by_group[group.id], revision))
+        for group in export.groups
+    ]
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
index bc004fc13a4e..11cea023eb72 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
@@ -518,3 +518,115 @@ def test_config_id_prefix_fails(tmp_path: Path) -> None:
             {"asserts.md": _NIXDOC_SNIPPET1},
         )
     assert "heading does not have an id" in str(excinfo.value.__cause__)
+
+
+_NIXDOC_EXPORT = {
+    "schemaVersion": 1,
+    "groups": [
+        {"id": "asserts", "description": "assertion functions"},
+        {"id": "attrsets", "description": "attribute set functions"},
+    ],
+    "entries": [
+        {
+            "id": "lib.asserts.assertMsg",
+            "attrPath": "lib.asserts.assertMsg",
+            "description": "Throw if pred is false.\n\n# Inputs\n\n`pred`\n",
+            "groups": ["asserts"],
+            "source": {"file": "lib/asserts.nix", "line": 21},
+        },
+        {
+            "id": "lib.attrsets.mapAttrs-prime",
+            "attrPath": "lib.attrsets.mapAttrs'",
+            "description": "Maps over attrs.",
+            "groups": ["attrsets"],
+            "source": {"file": "lib/attrsets.nix", "line": 42},
+        },
+    ],
+}
+
+
+def _render_with_collection(tmp_path: Path, export: object, **kwargs: object) -> str:
+    return _render_with_config(
+        tmp_path,
+        {"items": [{"collection": "lib-functions.json", "type": "nixdoc"}]},
+        {"lib-functions.json": json.dumps(export)},
+        **kwargs,  # type: ignore[arg-type]
+    )
+
+
+def test_config_collection_renders_one_page_per_group(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    # groups become pages, so their headings sit at the level of a config leaf
+    assert '<h2 id="sec-functions-library-asserts" class="title"' in html
+    assert '<h2 id="sec-functions-library-attrsets" class="title"' in html
+    assert "assertion functions" in html
+    # entries nest below their group
+    assert '<h3 id="function-library-lib.asserts.assertMsg" class="title"' in html
+    assert '<h3 id="function-library-lib.attrsets.mapAttrs-prime" class="title"' in html
+    assert "lib.attrsets.mapAttrs&#x27;" in html
+
+
+def test_config_collection_keeps_group_order(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    ids = [id for id in _heading_ids(html) if id.startswith("sec-functions-library-")]
+    assert ids == ["sec-functions-library-asserts", "sec-functions-library-attrsets"]
+
+
+def test_config_collection_pages_are_sidebar_siblings(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert 'href="#sec-functions-library-asserts"' in html
+    assert 'href="#sec-functions-library-attrsets"' in html
+
+
+def test_config_collection_prefixes_generated_ids_per_group(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    # '# Inputs' in the doc comment has no authored anchor, so it gets one
+    generated = [id for id in _heading_ids(html) if id.startswith("auto-generated-")]
+    assert generated and all(id.startswith("auto-generated-asserts-") for id in generated)
+
+
+def test_config_collection_links_source_to_revision(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert 'href="https://github.com/NixOS/nixpkgs/blob/1.0.0/lib/asserts.nix#L21"' in html
+
+
+def test_config_collection_renders_before_manual(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert html.index("assertion functions") < html.index("Manual body.")
+
+
+def test_config_collection_rejects_unknown_type(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_config(
+            tmp_path,
+            {"items": [{"collection": "lib-functions.json", "type": "options"}]},
+            {"lib-functions.json": json.dumps(_NIXDOC_EXPORT)},
+        )
+    assert "'type' must be one of ['nixdoc']" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_rejects_label_and_id_prefix(tmp_path: Path) -> None:
+    for extra in ({"label": "Library"}, {"id-prefix": "auto-generated"}):
+        with pytest.raises(RuntimeError) as excinfo:
+            _render_with_config(
+                tmp_path,
+                {"items": [{"collection": "lib-functions.json", "type": "nixdoc"} | extra]},
+                {"lib-functions.json": json.dumps(_NIXDOC_EXPORT)},
+            )
+        assert "neither 'label' nor 'id-prefix'" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_excludes_file_and_children(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_config(
+            tmp_path,
+            {"items": [{"collection": "lib-functions.json", "type": "nixdoc", "file": "x.md"}]},
+            {"x.md": "# X {#x}\n\nB.\n"},
+        )
+    assert "exactly one of 'file', 'children' or 'collection'" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_rejects_unsupported_export(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_collection(tmp_path, _NIXDOC_EXPORT | {"schemaVersion": 2})
+    assert "nixdoc collection" in str(excinfo.value.__cause__)
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py
new file mode 100644
index 000000000000..a4f2f3fd7446
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py
@@ -0,0 +1,165 @@
+import pytest
+
+from nixos_render_docs import nixdoc
+
+
+def test_shift_headings_basic() -> None:
+    assert nixdoc.shift_headings("# H1", 2) == "### H1"
+    assert nixdoc.shift_headings("## H2", 2) == "#### H2"
+
+
+def test_shift_headings_caps_at_h6() -> None:
+    assert nixdoc.shift_headings("###### H6", 2) == "###### H6"
+    assert nixdoc.shift_headings("##### H5", 2) == "###### H5"
+
+
+def test_shift_headings_preserves_multiline_and_endings() -> None:
+    src = "# One\n\nbody\n\n## Two\n"
+    assert nixdoc.shift_headings(src, 2) == "### One\n\nbody\n\n#### Two\n"
+
+
+def test_shift_headings_ignores_fenced_nix_comments() -> None:
+    src = "# Real heading\n\n```nix\n# not a heading\nfoo = 1;\n```\n"
+    out = nixdoc.shift_headings(src, 2)
+    assert out == "### Real heading\n\n```nix\n# not a heading\nfoo = 1;\n```\n"
+
+
+def test_shift_headings_tilde_fence() -> None:
+    src = "~~~\n# fenced\n~~~\n# heading\n"
+    out = nixdoc.shift_headings(src, 2)
+    assert out == "~~~\n# fenced\n~~~\n### heading\n"
+
+
+def test_shift_headings_indented_heading_shifted() -> None:
+    # up to 3 leading spaces is still a heading
+    assert nixdoc.shift_headings("   # H1", 2) == "### H1"
+
+
+def test_shift_headings_four_space_indent_not_a_heading() -> None:
+    # 4+ spaces is an indented code block, not a heading
+    assert nixdoc.shift_headings("    # code", 2) == "    # code"
+
+
+_REVISION = "abc123revision"
+
+
+def _export() -> dict[str, object]:
+    return {
+        "schemaVersion": 1,
+        "groups": [
+            {"id": "strings", "description": "string manipulation functions"},
+            {
+                "id": "fileset",
+                "description": (
+                    "[]{#sec-anchor-compat}\n\n"
+                    "Intro prose for the file set library.\n\n"
+                    "# Overview {#sec-fileset-overview}\n\n"
+                    "Some overview text.\n"
+                ),
+            },
+        ],
+        "entries": [
+            {
+                "id": "lib.attrsets.mapAttrs-prime",
+                "attrPath": "lib.attrsets.mapAttrs'",
+                "description": "Maps over attrs.\n\n# Example\n\n```nix\n# a comment\nmapAttrs' f s\n```\n",
+                "groups": ["strings"],
+                "source": {"file": "lib/attrsets.nix", "line": 42, "column": 3},
+            },
+            {
+                "id": "lib.strings.optionalString",
+                "attrPath": "lib.strings.optionalString",
+                "description": "Return a string if a condition holds.",
+                "groups": ["strings"],
+                "source": {"file": "lib/strings.nix", "line": 238, "column": 3},
+            },
+            {
+                "id": "lib.fileset.toSource",
+                "attrPath": "lib.fileset.toSource",
+                "description": "Add files to the store.",
+                "groups": ["fileset"],
+                "source": {"file": "lib/fileset/default.nix", "line": 10, "column": 3},
+            },
+        ],
+    }
+
+
+def _sections() -> dict[str, str]:
+    return dict(nixdoc.render_sections(_export(), _REVISION))
+
+
+def test_one_section_per_group_in_declared_order() -> None:
+    sections = nixdoc.render_sections(_export(), _REVISION)
+    assert [group_id for group_id, _src in sections] == ["strings", "fileset"]
+
+
+def test_group_heading_carries_anchor() -> None:
+    assert _sections()["strings"].startswith(
+        "# strings {#sec-functions-library-strings}\n")
+
+
+def test_group_description_headings_are_shifted() -> None:
+    fileset = _sections()["fileset"]
+    # authored anchors survive, the authored '# Overview' becomes a subheading
+    assert "[]{#sec-anchor-compat}" in fileset
+    assert "## Overview {#sec-fileset-overview}" in fileset
+
+
+def test_entry_heading_carries_attr_path_and_anchor() -> None:
+    assert (
+        "## `lib.strings.optionalString` {#function-library-lib.strings.optionalString}"
+        in _sections()["strings"]
+    )
+
+
+def test_entry_anchor_drops_characters_an_anchor_cannot_hold() -> None:
+    # lib.trivial."or" is a real attribute. an unescaped quote would break the anchor
+    # syntax and leak the literal '{#...}' into the heading text.
+    export = _export()
+    export["entries"] = [{
+        "id": 'lib.trivial."or"',
+        "attrPath": 'lib.trivial."or"',
+        "description": "Boolean or.",
+        "groups": ["strings"],
+        "source": {"file": "lib/trivial.nix", "line": 212},
+    }]
+    section = dict(nixdoc.render_sections(export, _REVISION))["strings"]
+    assert '## `lib.trivial."or"` {#function-library-lib.trivial.or}' in section
+
+
+def test_entry_description_headings_are_shifted_below_entry() -> None:
+    # the entry heading is h2, so an authored '# Example' must land on h3
+    assert "### Example" in _sections()["strings"]
+
+
+def test_fenced_nix_comment_is_not_shifted() -> None:
+    assert "```nix\n# a comment\nmapAttrs' f s\n```" in _sections()["strings"]
+
+
+def test_entries_are_grouped_by_declared_group() -> None:
+    sections = _sections()
+    assert "lib.fileset.toSource" in sections["fileset"]
+    assert "lib.fileset.toSource" not in sections["strings"]
+
+
+def test_located_at_links_to_the_revision() -> None:
+    assert (
+        "Located at [lib/strings.nix:238]"
+        f"(https://github.com/NixOS/nixpkgs/blob/{_REVISION}/lib/strings.nix#L238)"
+        " in `<nixpkgs>`."
+    ) in _sections()["strings"]
+
+
+def test_unsupported_schema_version_raises() -> None:
+    export = _export() | {"schemaVersion": 2}
+    with pytest.raises(nixdoc.NixdocExportError) as excinfo:
+        nixdoc.render_sections(export, _REVISION)
+    assert "schemaVersion 2" in str(excinfo.value)
+
+
+def test_missing_required_field_raises() -> None:
+    export = _export()
+    del export["entries"][0]["attrPath"]  # type: ignore[index]
+    with pytest.raises(nixdoc.NixdocExportError) as excinfo:
+        nixdoc.render_sections(export, _REVISION)
+    assert "missing required field 'attrPath'" in str(excinfo.value)
diff --git a/pkgs/by-name/po/porting-advisor-for-graviton/package.nix b/pkgs/by-name/po/porting-advisor-for-graviton/package.nix
new file mode 100644
index 000000000000..8d93548d55d2
--- /dev/null
+++ b/pkgs/by-name/po/porting-advisor-for-graviton/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  versionCheckHook,
+}:
+
+let
+  inherit (python3.pkgs)
+    buildPythonApplication
+    jinja2
+    packaging
+    progressbar33
+    xlsxwriter
+    ;
+in
+buildPythonApplication (finalAttrs: {
+  pname = "porting-advisor-for-graviton";
+  version = "1.1.1";
+  format = "other"; # Only has a requirements.txt
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "porting-advisor-for-graviton";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-73XZXy9hCRFGHGAxjThLE5mAptQZpr1G/t1v2Fx3Bpg=";
+  };
+
+  dependencies = [
+    jinja2
+    packaging
+    progressbar33
+    xlsxwriter
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp src/porting-advisor.py $out/bin/porting-advisor-graviton
+    chmod +x $out/bin/porting-advisor-graviton
+
+    # Install the advisor Python package
+    mkdir -p $out/${python3.sitePackages}
+    cp -r src/advisor $out/${python3.sitePackages}/
+
+    runHook postInstall
+  '';
+
+  # This automatically wraps Python programs with the right environment
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "AWS Porting Advisor for Graviton helps customers assess and prepare their applications for migration to AWS Graviton processors";
+    homepage = "https://github.com/aws/porting-advisor-for-graviton";
+    changelog = "https://github.com/aws/porting-advisor-for-graviton/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "porting-advisor-graviton";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index a4e253da3cb3..6cca7f70800b 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -1,39 +1,91 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
-  nodejs_22,
   fetchFromGitHub,
   nix-update-script,
-  jq,
   git,
   ripgrep,
   pkg-config,
   glib,
   libsecret,
+  versionCheckHook,
+  clang_20,
+  makeSetupHook,
+  writeText,
 }:
 
+let
+  # https://github.com/numtide/llm-agents.nix/blob/main/packages/darwinOpenptyHook/package.nix
+  darwinOpenptyHook =
+    let
+      header = writeText "darwin-openpty-shim.h" ''
+        #ifndef DARWIN_OPENPTY_SHIM_H
+        #define DARWIN_OPENPTY_SHIM_H
+        /*
+         * https://github.com/NixOS/nixpkgs/issues/457238
+         *
+         * macOS node-gyp builds sometimes see src/util.h from Node.js instead of
+         * the SDK's util.h. That header does not declare openpty(3)/forkpty(3),
+         * which causes node-pty (and other consumers) to fail to build. Including
+         * this shim restores the missing declarations without depending on the
+         * system header lookup.
+         */
+        #include <sys/types.h>
+        struct termios;
+        struct winsize;
+        #ifdef __cplusplus
+        extern "C" {
+        #endif
+        int openpty(int *, int *, char *, struct termios *, struct winsize *);
+        pid_t forkpty(int *, char *, struct termios *, struct winsize *);
+        #ifdef __cplusplus
+        }
+        #endif
+        #endif /* DARWIN_OPENPTY_SHIM_H */
+      '';
+      hookScript = writeText "darwin-openpty-hook.sh" ''
+        # shellcheck shell=bash
+        if [ -z "''${darwinOpenptyHookApplied-}" ]; then
+          export NIX_CFLAGS_COMPILE="''${NIX_CFLAGS_COMPILE-} -include ${header}"
+          darwinOpenptyHookApplied=1
+        fi
+      '';
+    in
+    makeSetupHook {
+      name = "darwin-openpty-hook";
+      meta = {
+        description = "Setup hook that injects openpty/forkpty prototypes on Darwin";
+        platforms = lib.platforms.darwin;
+      };
+      passthru = {
+        hideFromDocs = true;
+      };
+    } hookScript;
+in
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.16.0";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XWhQ5GlAGW0WAyiPwBULLz1yQps2IdjVkusQ0a88tCs=";
+    hash = "sha256-AWmZhul7/p1atYkLZd/pojGaO80gydGfx+mnSP9SHnY=";
   };
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-2vr8Yspm6CCVnO6Jf8B3wiL6X+Tp6hZZEPr+WC/Dcak=";
+  npmDepsHash = "sha256-tyLLtckMO/jFQHvdhHBWIE2Gx5vdHJBYHssVdq/abBU=";
 
-  # npm 11 incompatible with fetchNpmDeps
-  # https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+  makeCacheWritable = true;
 
   nativeBuildInputs = [
-    jq
     pkg-config
     git
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    clang_20 # Works around node-addon-api constant expression issue with clang 21+ (keytar)
+    darwinOpenptyHook
   ];
 
   buildInputs = [
@@ -42,48 +94,26 @@ buildNpmPackage (finalAttrs: {
     libsecret
   ];
 
-  postPatch = ''
-    # patches below remove node-pty and keytar dependencies which cause build fail on Darwin
-    # should be conditional on platform but since package-lock.json is patched it changes its hash
-    # though seems like these dependencies are not really required by the package
-    ${jq}/bin/jq '
-      del(.packages."node_modules/node-pty") |
-      del(.packages."node_modules/@lydell/node-pty") |
-      del(.packages."node_modules/@lydell/node-pty-darwin-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-darwin-x64") |
-      del(.packages."node_modules/@lydell/node-pty-linux-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-linux-x64") |
-      del(.packages."node_modules/@lydell/node-pty-win32-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-win32-x64") |
-      del(.packages."node_modules/keytar") |
-      walk(
-        if type == "object" and has("dependencies") then
-          .dependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        elif type == "object" and has("optionalDependencies") then
-          .optionalDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        else .
-        end
-      ) |
-      walk(
-        if type == "object" and has("peerDependencies") then
-          .peerDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        else .
-        end
-      )
-    ' package-lock.json > package-lock.json.tmp && mv package-lock.json.tmp package-lock.json
-  '';
-
   buildPhase = ''
     runHook preBuild
 
-    # Build several internal packages first (required by main bundle)
-    npm run build --workspace=@qwen-code/channel-base
-    npm run build --workspace=@qwen-code/channel-telegram
-    npm run build --workspace=@qwen-code/channel-weixin
-    npm run build --workspace=@qwen-code/channel-dingtalk
-    npm run build --workspace=@qwen-code/web-templates
+    # Increase Node.js heap size on Darwin to prevent OOM during
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export NODE_OPTIONS="--max-old-space-size=8192"
+    ''}
+
+    # npmConfigHook only patches the root node_modules. Workspaces with
+    # nested .bin (web-shell's vite) keep /usr/bin/env otherwise.
+    patchShebangs packages/*/node_modules
 
     npm run generate
+
+    # The CLI esbuild bundle resolves imports against workspace dist/ output.
+    # Use upstream's --cli-only build order so every workspace the bundle pulls
+    # in (core, channels, acp-bridge, sdk-typescript, ...) is built, without
+    # us having to track the dependency list by hand across releases.
+    node scripts/build.js --cli-only
+
     npm run bundle
 
     runHook postBuild
@@ -93,18 +123,32 @@ buildNpmPackage (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/qwen-code
+
     cp -r dist/* $out/share/qwen-code/
+
+    # The bundled dist/cli.js has no shebang; upstream ships a bin wrapper
+    # (scripts/cli-entry.js) that relaunches cli.js with node --expose-gc and
+    # reads package.json for the reported version. Install both next to cli.js.
+    cp scripts/cli-entry.js $out/share/qwen-code/cli-entry.js
+    cp package.json $out/share/qwen-code/package.json
+
     # Install production dependencies only
     npm prune --production
     cp -r node_modules $out/share/qwen-code/
+
     # Remove broken symlinks that cause issues in Nix environment
     find $out/share/qwen-code/node_modules -type l -delete || true
+
     patchShebangs $out/share/qwen-code
-    ln -s $out/share/qwen-code/cli.js $out/bin/qwen
+
+    ln -s $out/share/qwen-code/cli-entry.js $out/bin/qwen
 
     runHook postInstall
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index ee5db482ec2d..1107a148070b 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "radicle-explorer";
-  version = "0-unstable-2026-09-03";
+  version = "0-unstable-2026-09-14";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
-    rev = "fb11e4d9c2c758468b9dca5c615f2392fb011c6e";
-    hash = "sha256-X8YRmyK8VyhmRMnKEiIhbiNyQ/fy4U9FgcIARDz+MfI=";
+    rev = "f1ee718886061b90fac69c53000613eeccbab09f";
+    hash = "sha256-BeZ5xtJVkoSXYggiT/tmJPUcPQoQMQg2FkCkuQvHZC0=";
   };
 
-  npmDepsHash = "sha256-m+md3XIjn4SpZ3vp5STDFAKU3QSs0maFUm3Ll5DLghc=";
+  npmDepsHash = "sha256-Bwlrh4DivqWhxuHcbJGJtatsGRI0V8BwTT3RtqoJ7lU=";
 
   preBuild = ''
     if [[ $configFile ]]; then
diff --git a/pkgs/by-name/ru/rusthound-ce/package.nix b/pkgs/by-name/ru/rusthound-ce/package.nix
index d8db4231d6e7..8e747c46d392 100644
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusthound-ce";
-  version = "2.5.9";
+  version = "2.5.13";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-VJFgUKsmOD0pt2GABeSufWBaE+3zr0q5bv2h7f6opNg=";
+    hash = "sha256-YDW7tL37rKOm+PU98NhtimirVLla40dLx2VGOLfDVho=";
   };
 
-  cargoHash = "sha256-dHJawFfPnU80aocE1oHqdOzX48WgiIz+qknTq9Mt3Ks=";
+  cargoHash = "sha256-5z7VBRua+plcMOf1kY8MxYKPbmKlo4yVEz8WzX6oVWA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sr/src-cli/package.nix b/pkgs/by-name/sr/src-cli/package.nix
index 6799f0f663dc..dd1240523e25 100644
--- a/pkgs/by-name/sr/src-cli/package.nix
+++ b/pkgs/by-name/sr/src-cli/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "src-cli";
-  version = "7.6.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "src-cli";
     rev = version;
-    hash = "sha256-a6F4r5pVJvkQUyUpmqwjyQKfU3KAx9S61+0hnodqlHk=";
+    hash = "sha256-22UlYQxxtInPYgj4rsu07MvusjoW4BoqCW6fbgwQ9Lc=";
   };
 
   vendorHash = "sha256-+phJFHid2ytXeLrvGMGTXplDAcN9YEDhRrO9ax/d8R8=";
diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index 13da77cf7c21..41a7573ef6a0 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -19,14 +19,14 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.11.0";
+  version = "0.12.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-ghOUqC5U7L16k7mFxtgNeQssA/OU9MJ6fIK2G17QrhI=";
+    hash = "sha256-/Zi7/vh8hwniMxa+keYjW7KBeq3Xg2rqDlqyN2GOZN4=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-b9J6BnwnM/4I5xUkkUPTPzTVfDQ+Cfc7KqTLuZpFvu0=";
+    hash = "sha256-aLnQOXiQD9IL6ZiBi/ENF0aHud0kCyHZrnetkV+ZTFE=";
   };
 
   buildInputs = lib.optionals selinuxSupport [
diff --git a/pkgs/by-name/va/vastai/package.nix b/pkgs/by-name/va/vastai/package.nix
new file mode 100644
index 000000000000..5719427d8cc7
--- /dev/null
+++ b/pkgs/by-name/va/vastai/package.nix
@@ -0,0 +1,156 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  fetchpatch2,
+
+  # wrapper
+  openssh,
+  rsync,
+
+  # tests
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "vastai";
+  version = "1.5.6";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vast-ai";
+    repo = "vast-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ovxFLPBPHJi/DMauS0Yuk9HWfcS+K/gJTAwPf/MLdoA=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      # Upstream credential hardening: https://github.com/vast-ai/vast-cli/pull/505
+      url = "https://github.com/vast-ai/vast-cli/commit/0889fe32e5bf3228074436dd9688f6a1fdc649e8.patch";
+      hash = "sha256-g3Nje1M1SnXK3eJ26XE13+/Wdg0pv63AKU5wbgZacMM=";
+    })
+  ];
+
+  # distutils was removed from Python 3.12. Use setuptools' maintained copy.
+  # The borb 2.x Document class lives in the document submodule.
+  postPatch = ''
+    substituteInPlace vastai/serverless/server/lib/backend.py \
+      --replace-fail \
+        "from distutils.util import strtobool" \
+        "from setuptools._distutils.util import strtobool"
+
+    substituteInPlace vastai/pdf/vast_pdf.py \
+      --replace-fail \
+        "from borb.pdf.document import Document" \
+        "from borb.pdf.document.document import Document"
+  '';
+
+  build-system = with python3Packages; [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  pythonRelaxDeps = [
+    "cryptography"
+    "pillow"
+    "pycares"
+  ];
+  dependencies = with python3Packages; [
+    aiodns
+    aiohttp
+    anyio
+    argcomplete
+    borb_2
+    cryptography
+    curlify
+    pillow
+    psutil
+    pycares
+    pycryptodome
+    pyparsing
+    python-dateutil
+    requests
+    rich
+    setuptools
+    typing-extensions
+    urllib3
+    xdg
+  ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      openssh
+      rsync
+    ])
+    "--set-default"
+    "VASTAI_NO_UPDATE_CHECK"
+    "1"
+  ];
+
+  pythonImportsCheck = [
+    "vastai"
+    "vastai.cli.main"
+    "vastai.pdf.vast_pdf"
+    "vastai.serverless.remote.serve_deployment"
+    "vastai_sdk"
+  ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ]
+  ++ (with python3Packages; [
+    pyopenssl
+    pytest-asyncio
+    pytestCheckHook
+  ]);
+  versionCheckProgramArg = "--version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  enabledTestPaths = [ "tests" ];
+  disabledTestMarks = [
+    "integration"
+    "live"
+  ];
+  disabledTests = [
+    # These tests target a removed `compress` argument; 1.5.6 always creates
+    # gzip-compressed deployment archives.
+    "test_contains_config_json"
+    "test_module_becomes_deployment_py"
+    "test_package_becomes_deployment_dir"
+    "test_extra_files_absolute_dest_paths"
+    "test_extra_files_relative_dest_paths"
+    "test_compressed_tarball_is_valid"
+    "test_uncompressed_tarball_is_valid"
+    "test_tar_extract_module_deployment"
+    "test_tar_extract_package_deployment"
+    "test_tar_extract_absolute_extra_files"
+    "test_tar_extract_relative_extra_files"
+    "test_tar_extract_compressed"
+  ];
+
+  postCheck = ''
+    $out/bin/vastai --help >/dev/null
+    test -x $out/bin/serve-vast-deployment
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI and SDK for the Vast.ai GPU cloud service";
+    homepage = "https://vast.ai/";
+    changelog = "https://github.com/vast-ai/vast-cli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.samuela ];
+    mainProgram = "vastai";
+  };
+})
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index 6bfc64302fa4..9c07aa4261de 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -35,8 +35,6 @@ lib.makeScope pkgs.newScope (
         inherit (self) elm;
       };
 
-      elm-analyse = callPackage ./packages/elm-analyse { };
-
       elm-doc-preview = callPackage ./packages/elm-doc-preview { };
 
       elm-git-install = callPackage ./packages/elm-git-install { };
@@ -70,6 +68,7 @@ lib.makeScope pkgs.newScope (
       elm-wrap = callPackage ./packages/elm-wrap { };
     }
     // lib.optionalAttrs config.allowAliases {
+      elm-analyse = throw "elmPackages.elm-analyse has not be released since May 2019 so it has been removed."; # Added 2026-09-16
       create-elm-app = throw "'elmPackages.create-elm-app' has not had a release since December 2020, so it was removed."; # Added 2025-11-15
       elm-pages = throw "'elmPackages.elm-pages' has been removed, as it was broken in nixpkgs and was not maintained."; # Added 2025-11-15
     }
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/default.nix b/pkgs/development/compilers/elm/packages/elm-analyse/default.nix
deleted file mode 100644
index 6f8a5376b9bc..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-  elmPackages,
-}:
-
-buildNpmPackage (finalAttrs: {
-  pname = "elm-analyse";
-  version = "0.16.5";
-
-  src = fetchFromGitHub {
-    owner = "stil4m";
-    repo = "elm-analyse";
-    tag = finalAttrs.version;
-    hash = "sha256-GFHhHf+JOXGcm0CZEDGMuuTR3CXBdSkYDGRHZ63pE64=";
-  };
-
-  npmDepsHash = "sha256-B/PzGOaxdKSt82ax0izeadsMsz+I0v4wkye3zgNxMF8=";
-
-  npmFlags = [ "--ignore-scripts" ];
-
-  nativeBuildInputs = [
-    elmPackages.elm
-  ];
-
-  postConfigure =
-    (elmPackages.fetchElmDeps {
-      elmPackages = import ./elm-srcs.nix;
-      elmVersion = elmPackages.elm.version;
-      registryDat = ./registry.dat;
-    })
-    + ''
-      ln -sf ${lib.getExe elmPackages.elm} node_modules/.bin/elm
-    '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    make
-
-    runHook postBuild
-  '';
-
-  postInstall = ''
-    rm -rf $out/lib/node_modules/elm-analyse/node_modules/.bin/
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    description = "Analyse your Elm code, identify deficiencies and apply best practices";
-    homepage = "https://stil4m.github.io/elm-analyse/";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-    mainProgram = "elm-analyse";
-  };
-})
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix b/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix
deleted file mode 100644
index 2d7cbc52f144..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix
+++ /dev/null
@@ -1,152 +0,0 @@
-{
-
-  "alex-tan/elm-dialog" = {
-    sha256 = "13dfpzrdi69jaj0hj2cnwg3g6wafhszg0grjw4z3imd0b9avz1hk";
-    version = "1.0.0";
-  };
-
-  "elm-community/dict-extra" = {
-    sha256 = "05ll04wf03m8ic109dz2dbq6pah23m70c4wwyr35026dhmws35n0";
-    version = "2.4.0";
-  };
-
-  "elm-community/graph" = {
-    sha256 = "1rwsq2126q0rb4vmy95ajxfm3m063d6lw0p90d510nzcrbm9bxbc";
-    version = "6.0.0";
-  };
-
-  "elm-community/intdict" = {
-    sha256 = "09i1fk63gp6sr6kc6ccs8g0kxvqhw5czghi9cl8flizanrgcmva1";
-    version = "3.0.0";
-  };
-
-  "elm-community/list-extra" = {
-    sha256 = "06ddwrc0ai0pn5mw99a1d9xnihkliyvq0qvzn32z1l88msflrib7";
-    version = "8.2.2";
-  };
-
-  "elm-community/maybe-extra" = {
-    sha256 = "10jykkdmqpvhbcm50867a894272j4z6jc9r5jy35cz8jfi9j8xv9";
-    version = "5.0.0";
-  };
-
-  "elm-explorations/markdown" = {
-    sha256 = "0k3110ixa4wwf3vkkdplagwah9ypr965qxr1y147rnsc1xsxmr6y";
-    version = "1.0.0";
-  };
-
-  "elm/browser" = {
-    sha256 = "1zlmx672glg7fdgkvh5jm47y85pv7pdfr5mkhg6x7ar6k000vyka";
-    version = "1.0.1";
-  };
-
-  "elm/core" = {
-    sha256 = "1l0qdbczw91kzz8sx5d5zwz9x662bspy7p21dsr3f2rigxiix2as";
-    version = "1.0.2";
-  };
-
-  "elm/html" = {
-    sha256 = "1n3gpzmpqqdsldys4ipgyl1zacn0kbpc3g4v3hdpiyfjlgh8bf3k";
-    version = "1.0.0";
-  };
-
-  "elm/http" = {
-    sha256 = "1igmm89ialzrjib1j8xagkxalq1x2gj4l0hfxcd66mpwmvg7psl8";
-    version = "1.0.0";
-  };
-
-  "elm/json" = {
-    sha256 = "0kjwrz195z84kwywaxhhlnpl3p251qlbm5iz6byd6jky2crmyqyh";
-    version = "1.1.3";
-  };
-
-  "elm/parser" = {
-    sha256 = "0a3cxrvbm7mwg9ykynhp7vjid58zsw03r63qxipxp3z09qks7512";
-    version = "1.1.0";
-  };
-
-  "elm/project-metadata-utils" = {
-    sha256 = "1d4rd4grrnbdvj9gf00h7dr6hbkjzawgkzpizfrkp1z1pyr3mvq9";
-    version = "1.0.0";
-  };
-
-  "elm/regex" = {
-    sha256 = "0lijsp50w7n1n57mjg6clpn9phly8vvs07h0qh2rqcs0f1jqvsa2";
-    version = "1.0.0";
-  };
-
-  "elm/time" = {
-    sha256 = "0vch7i86vn0x8b850w1p69vplll1bnbkp8s383z7pinyg94cm2z1";
-    version = "1.0.0";
-  };
-
-  "elm/url" = {
-    sha256 = "0av8x5syid40sgpl5vd7pry2rq0q4pga28b4yykn9gd9v12rs3l4";
-    version = "1.0.0";
-  };
-
-  "krisajenkins/remotedata" = {
-    sha256 = "0sjrgpsy4aci0h6qndqx70cnfd065hlkh1rxk0lc93z22sdj4knl";
-    version = "5.0.0";
-  };
-
-  "rundis/elm-bootstrap" = {
-    sha256 = "155rqa2hh9h5s0ryqv4pn40vwl2klk3zg8b2xf48z5ky8fdrr31c";
-    version = "5.2.0";
-  };
-
-  "stil4m/elm-syntax" = {
-    sha256 = "182fz12a115j3wz3fkc209mq8rbbqmvl237pmrvygmvbxwv4ix37";
-    version = "7.1.1";
-  };
-
-  "avh4/elm-color" = {
-    sha256 = "0n16wnvp87x9az3m5qjrl6smsg7051m719xn5d244painx8xmpzq";
-    version = "1.0.0";
-  };
-
-  "avh4/elm-fifo" = {
-    sha256 = "1ka0iz2psr75h4qz7hh5z1prclah1nais9aaycaxapfd7inqmrrc";
-    version = "1.0.4";
-  };
-
-  "elm-community/json-extra" = {
-    sha256 = "0hwlhdlvd5xi866m9bpnabcg2qrgcvfj34p1x1mhx85ymr3gv9mv";
-    version = "4.2.0";
-  };
-
-  "elm/virtual-dom" = {
-    sha256 = "0q1v5gi4g336bzz1lgwpn5b1639lrn63d8y6k6pimcyismp2i1yg";
-    version = "1.0.2";
-  };
-
-  "etaque/elm-response" = {
-    sha256 = "0vydmczvlxkvbjsjpfwad5m77y3155dp8wx648xf1ya3vsy4m5kf";
-    version = "3.1.0";
-  };
-
-  "rtfeldman/elm-hex" = {
-    sha256 = "1y0aa16asvwdqmgbskh5iba6psp43lkcjjw9mgzj3gsrg33lp00d";
-    version = "1.0.0";
-  };
-
-  "rtfeldman/elm-iso8601-date-strings" = {
-    sha256 = "1fa5sslklldy0dq8bm0zdkb9ni50yxhb09xb6lgk00x55bmza9ik";
-    version = "1.1.3";
-  };
-
-  "stil4m/structured-writer" = {
-    sha256 = "0xr95m8k42vwyff91vfd4q59fhnmhywyj20nzxqhl7blk82hnwj0";
-    version = "1.0.2";
-  };
-
-  "elm-explorations/test" = {
-    sha256 = "1fsd7bajm7qa93r5pn3mdafqh3blpzya601jbs9l238p0hmvh576";
-    version = "1.2.2";
-  };
-
-  "elm/random" = {
-    sha256 = "138n2455wdjwa657w6sjq18wx2r0k60ibpc4frhbqr50sncxrfdl";
-    version = "1.0.0";
-  };
-}
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/registry.dat b/pkgs/development/compilers/elm/packages/elm-analyse/registry.dat
deleted file mode 100644
index ff41075cf05b..000000000000
Binary files a/pkgs/development/compilers/elm/packages/elm-analyse/registry.dat and /dev/null differ
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/update.sh b/pkgs/development/compilers/elm/packages/elm-analyse/update.sh
deleted file mode 100755
index 2bc827f3c5ca..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/update.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nix-update elm2nix nixfmt
-
-set -eu -o pipefail
-
-PACKAGE_DIR=$(realpath "$(dirname "$0")")
-
-# Update version, src and npm deps
-nix-update "$UPDATE_NIX_ATTR_PATH"
-
-# Update elm deps
-cp "$(nix-build -A "$UPDATE_NIX_ATTR_PATH".src)/elm.json" elm.json
-trap 'rm -rf elm.json registry.dat &> /dev/null' EXIT
-elm2nix convert >"$PACKAGE_DIR/elm-srcs.nix"
-nixfmt "$PACKAGE_DIR/elm-srcs.nix"
-elm2nix snapshot
-cp registry.dat "$PACKAGE_DIR/registry.dat"
diff --git a/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix b/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
index 5a25df2e6cf7..4952acad516d 100644
--- a/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
+++ b/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
@@ -3,6 +3,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   elmPackages,
+  fetchpatch,
 }:
 
 buildNpmPackage (finalAttrs: {
@@ -12,11 +13,13 @@ buildNpmPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "stoeffel";
     repo = "elm-verify-examples";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-HUmIrwmJyGvkCRHRiA069Aj25WBIGtJ7DJxwwF6OvWU=";
+    # Using more recent commit to fix elm 0.19.2 support
+    # tag = "v${finalAttrs.version}";
+    rev = "63b84eca9642f6d0de37d6e35e0d8bc6edca19c6";
+    hash = "sha256-tZ/XT/gZKu8iDmJPxYlLXCRCeOs7ZZiqWpYcyScfqVg=";
   };
 
-  npmDepsHash = "sha256-frNCo97GOwiClzQwRXHpqqjimJrmipsBebAshJqGZco=";
+  npmDepsHash = "sha256-Puz7AVXaUy/7wflTcqbrQhTwSeeiG3jkfXYJ7NXhXQ0=";
 
   nativeBuildInputs = [
     elmPackages.elm
diff --git a/pkgs/development/ocaml-modules/ocaml-version/default.nix b/pkgs/development/ocaml-modules/ocaml-version/default.nix
index 323894c0e9eb..25373a90c918 100644
--- a/pkgs/development/ocaml-modules/ocaml-version/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-version/default.nix
@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ocaml-version";
-  version = "4.1.2";
+  version = "4.1.4";
 
   src = fetchurl {
     url = "https://github.com/ocurrent/ocaml-version/releases/download/v${finalAttrs.version}/ocaml-version-${finalAttrs.version}.tbz";
-    hash = "sha256-+NqijIAmedHTU9/5ZfZojwr0vQZ0onS6lBWIrnBqPAc=";
+    hash = "sha256-Iiik1STIuLd1639h99JE64H/2sowC3jCnY/drKWkPbI=";
   };
 
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/spdx_licenses/default.nix b/pkgs/development/ocaml-modules/spdx_licenses/default.nix
index 82bf90aa0c88..c414856541b4 100644
--- a/pkgs/development/ocaml-modules/spdx_licenses/default.nix
+++ b/pkgs/development/ocaml-modules/spdx_licenses/default.nix
@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "spdx_licenses";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/kit-ty-kate/spdx_licenses/releases/download/v${finalAttrs.version}/spdx_licenses-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Q+z+B/2yHiiulK/FY75fd4+Lyt5fTcJgZwBWdzgy4EQ=";
+    hash = "sha256-ciUka6XWRg2bYqzXWOGsNc62J5OshtXNSDCqbPooGVA=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/borb/2.nix b/pkgs/development/python-modules/borb/2.nix
new file mode 100644
index 000000000000..01a6d8a218eb
--- /dev/null
+++ b/pkgs/development/python-modules/borb/2.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  cryptography,
+  fonttools,
+  lxml,
+  pillow,
+  python-barcode,
+  qrcode,
+  requests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "borb";
+  version = "2.1.25";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-gTolInuW9HHSkkS/PAens9821h1ivL7PRbFJRLgBHvQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    cryptography
+    fonttools
+    lxml
+    pillow
+    python-barcode
+    qrcode
+    requests
+  ];
+
+  # Tests are not included in the PyPI source distribution.
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "borb.pdf"
+    "borb.pdf.canvas.layout.table.fixed_column_width_table"
+  ];
+
+  meta = {
+    description = "Library for reading, creating and manipulating PDF files";
+    homepage = "https://borbpdf.com/";
+    changelog = "https://github.com/jorisschellekens/borb/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.samuela ];
+  };
+})
diff --git a/pkgs/development/python-modules/icalendar-compatibility/default.nix b/pkgs/development/python-modules/icalendar-compatibility/default.nix
index fdbfe2ad54a4..8db36d809ef2 100644
--- a/pkgs/development/python-modules/icalendar-compatibility/default.nix
+++ b/pkgs/development/python-modules/icalendar-compatibility/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "icalendar-compatibility";
-  version = "0.1.4";
+  version = "0.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "niccokunzmann";
     repo = "icalendar_compatibility";
     tag = "v${version}";
-    hash = "sha256-h9rpbltNEPMteicPJ6oC32NsZS8QXQphLbC0Qiu7j5Q=";
+    hash = "sha256-rHx4wuLKSBI3/3ShxtpyyuK+iWULpbzfDN8DCNUryHg=";
   };
 
   # hatch-vcs tries to read the current git commit hash
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index eef3bd1f0400..2f34adba6f95 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.5.2";
+  version = "1.7.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${finalAttrs.version}";
-    hash = "sha256-mk0Cx1rYO1sPbFJdpqVs+hCvLkV7u1WrHOIkTW5ewDE=";
+    hash = "sha256-2hswfwhRt+P+kF5n80zLLbjbC7wadgfgOCy+v0nLnLs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";
diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index 29a60272aa50..058ebc953b51 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -20,6 +20,7 @@
   langchain-anthropic,
 
   # tests
+  langchain-openai,
   langchain-tests,
   pytest-asyncio,
   pytest-cov-stub,
@@ -31,7 +32,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-aws";
-  version = "1.6.4";
+  version = "1.7.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -39,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${finalAttrs.version}";
-    hash = "sha256-7qg2cUjlFEo6ekK269Ew0wmmSx+1BwUdTJZCMPd2tBU=";
+    hash = "sha256-Lw23OAHSEqf7NAgzSzWqgsb8ZV7Ir1KR0lULIE7TYVU=";
   };
 
   postPatch = ''
@@ -72,6 +73,7 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     anthropic
     langchain
+    langchain-openai
     langchain-tests
     pytest-asyncio
     pytest-cov-stub
@@ -84,6 +86,11 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # Fails when langchain-core gets ahead of this package
     "test_serdes"
+    # Requires aws-bedrock-token-generator (not packaged)
+    "test_bedrock_api_key_provider"
+    "test_installed_provider_mints_token_when_called"
+    # botocore added new content block keys
+    "test__bedrock_content_block_keys_match_botocore"
   ];
 
   pythonImportsCheck = [ "langchain_aws" ];
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index a28455666371..eed448bf929a 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-core";
-  version = "1.5.4";
+  version = "1.6.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-core==${finalAttrs.version}";
-    hash = "sha256-5aH12hWxnYlRYIa3UT5Z8JycL5ipRNg9KS9h4H2uKA4=";
+    hash = "sha256-IOi1Yw1cYdsLogr/xrECYIlfDdHqZzCUz27ubK1QrSQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/core";
diff --git a/pkgs/development/python-modules/langchain-fireworks/default.nix b/pkgs/development/python-modules/langchain-fireworks/default.nix
index f597d65d9109..d25019a8950d 100644
--- a/pkgs/development/python-modules/langchain-fireworks/default.nix
+++ b/pkgs/development/python-modules/langchain-fireworks/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-fireworks";
-  version = "1.4.4";
+  version = "1.6.1";
   pyproject = true;
   __structuredAttrs = true;
   strictDeps = true;
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-fireworks==${finalAttrs.version}";
-    hash = "sha256-O63UohmChFeeQZH7G1iYDwNdvJapVEnHlkGHdGxIDjE=";
+    hash = "sha256-tJduBjY+JcG9bhZYsOi7+2TdR4DTi/ZCTIaNZ87R8JM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/fireworks";
diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index a837c7c55cf2..a2f001d06322 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-openai";
-  version = "1.4.1";
+  version = "1.6.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-openai==${finalAttrs.version}";
-    hash = "sha256-ELiQJQ8tuQX246ZOr/+iYj/vJRtIX5Cr5PIn4Ul0E8c=";
+    hash = "sha256-VCob54ZCetohK8ZvgAHPdExr2UPgD4vxGCXM0pKW3hQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/openai";
diff --git a/pkgs/development/python-modules/langchain-protocol/default.nix b/pkgs/development/python-modules/langchain-protocol/default.nix
index 9a028ecdd2bc..c952473f1b96 100644
--- a/pkgs/development/python-modules/langchain-protocol/default.nix
+++ b/pkgs/development/python-modules/langchain-protocol/default.nix
@@ -1,24 +1,32 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   hatchling,
   typing-extensions,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-protocol";
-  version = "0.0.18";
+  version = "0.0.19";
   pyproject = true;
   __structuredAttrs = true;
 
   # Not available vis Github yet; required by langchain-core
-  src = fetchPypi {
-    pname = "langchain_protocol";
-    inherit (finalAttrs) version;
-    hash = "sha256-7D4ReC8e0MnbOOWp7QGw56DT+6QG+qiu9llLc8VqY+Y=";
+  src = fetchFromGitHub {
+    owner = "langchain-ai";
+    repo = "agent-protocol";
+    tag = "langchain-protocol==${finalAttrs.version}";
+    hash = "sha256-RiTuadwE3IMhlsFzEZkVlIKMU8/c9uTTDWrXpptriGI=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/streaming/py";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling>=1.26,<1.30" "hatchling"
+  '';
+
   build-system = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/langchain-xai/default.nix b/pkgs/development/python-modules/langchain-xai/default.nix
index 905ad7dbf3cb..3e47005c8449 100644
--- a/pkgs/development/python-modules/langchain-xai/default.nix
+++ b/pkgs/development/python-modules/langchain-xai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-xai";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-xai==${finalAttrs.version}";
-    hash = "sha256-RUklm627HiwMcpKkm+0uWZgHp4iDtSsmEpLb9MxumqI=";
+    hash = "sha256-5eUyYr+xyEiHZgMKXW6jQhabVdSZTDT2e93Fy7RwUGM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/xai";
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index c9d9bae39985..0fe400edda28 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain";
-  version = "1.3.14";
+  version = "1.4.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -54,7 +54,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain==${finalAttrs.version}";
-    hash = "sha256-SmbqK8/AmUYfp+hUEnuwl18K+A/6csLxMUTv0oQHhEs=";
+    hash = "sha256-p4YqDRa37QC0diLMUPUX1J8Rc3q+DFxjPU+w8M0EJtY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langchain_v1";
@@ -128,9 +128,15 @@ buildPythonPackage (finalAttrs: {
     # AttributeError: 'ImportErrorProfileModel' object has no attribute 'profile'
     # https://github.com/langchain-ai/langchain/issues/36312
     "test_summarization_middleware_missing_profile"
+    # langchain.mcp requires fastmcp>=4 (nixpkgs has 3.x) and jsonschema
+    "test_import_all"
+    "test_import_all_using_dir"
   ];
 
   disabledTestPaths = [
+    # Requires fastmcp>=4 (nixpkgs has 3.x) and jsonschema
+    "tests/unit_tests/mcp"
+
     # Their configuration tests don't place nicely with nixpkgs
     "tests/unit_tests/test_pytest_config.py"
 
diff --git a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
index a55c9368db9b..46e36454f9ab 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-checkpoint-mongodb";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-checkpoint-mongodb/v${finalAttrs.version}";
-    hash = "sha256-AdTAyMHNzkuvNB7DsbWxAxNKNqSxdgYwIB5UHBAAxZc=";
+    hash = "sha256-0cL28QpwcvjOQmaH1lpZZpqcThGN2fZVryWEzrN9Mrc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-checkpoint-mongodb";
diff --git a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
index f6871fcefe6b..58dfc1f90254 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-checkpoint-postgres";
-  version = "3.1.0";
+  version = "3.1.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "checkpointpostgres==${finalAttrs.version}";
-    hash = "sha256-xSYJ9D86GuaJEgQYk+pkJ4O7HK6HXfAOGBv4f1CBY5g=";
+    hash = "sha256-7UJh+ObKOdU5QlGOlvF/8uHd+uOfiAjuGAkIVdEBLHQ=";
   };
 
   postgresqlTestSetupPost = ''
@@ -90,6 +90,11 @@ buildPythonPackage (finalAttrs: {
     "test_store_ttl"
   ];
 
+  disabledTestPaths = [
+    # Imports langgraph.checkpoint.conformance (not mature enough to package)
+    "tests/test_conformance_delta.py"
+  ];
+
   pythonImportsCheck = [ "langgraph.checkpoint.postgres" ];
 
   passthru = {
diff --git a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
index 48f64d24b0ca..c905520fb806 100644
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.32.3";
+  version = "0.34.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-k5ATRuxkds7dDZx3lxGJUL+vUgVFHe8/BaAZqoaaxd4=";
+    hash = "sha256-DgyDoLsWDpnSF8CBPLRtQtpQ5LazZrSozkrbRIOX4xo=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index ef2243288a6d..1504b27ee1f2 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-sdk";
-  version = "0.4.2";
+  version = "0.4.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "sdk==${finalAttrs.version}";
-    hash = "sha256-30BY7f8m3YiqEBhb3+TQYTW0N40xI9kTQbMTh4BwcyU=";
+    hash = "sha256-kKIk0vt+2HXpSqW0RVt3cqpdmdf5NOWtXlkSkrogNWs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/sdk-py";
diff --git a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
index fcae0393fe2a..6d5299896bd9 100644
--- a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-store-mongodb";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-store-mongodb/v${finalAttrs.version}";
-    hash = "sha256-uivrfCTUu7Pq/ncAGH6HUzgyOGRcOzsQ+SVN6wW33tQ=";
+    hash = "sha256-0cL28QpwcvjOQmaH1lpZZpqcThGN2fZVryWEzrN9Mrc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-store-mongodb";
@@ -46,8 +46,8 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = nix-update-script {
       extraArgs = [
-        "-vr"
-        "libs/langgraph-store-mongodb/v(.*)"
+        "--version-regex"
+        "libs/langgraph-store-mongodb/v(.+)"
       ];
     };
   };
diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index e6dd0c785eb9..949133e39f9f 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -41,7 +41,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "langgraph";
-  version = "1.2.10";
+  version = "1.2.11";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = finalAttrs.version;
-    hash = "sha256-2P/JsZYQyXIselQaJVuyWTdkRQN7K1TW7w28D7BecRk=";
+    hash = "sha256-5CUQh9KNYQ0HBIuREOP0MxZgn5Z1MxMuqB9Be4e6AJo=";
   };
 
   postgresqlTestSetupPost = ''
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index d38621e26cf3..af264722b262 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -8,11 +8,15 @@
   hatchling,
 
   # dependencies
-  httpx,
+  anyio,
+  distro,
+  httpx2,
   orjson,
   pydantic,
   requests,
   requests-toolbelt,
+  sniffio,
+  typing-extensions,
   uuid-utils,
   websockets,
   xxhash,
@@ -20,7 +24,7 @@
 
   # tests
   anthropic,
-  attrs,
+  cachetools,
   dataclasses-json,
   multipart,
   opentelemetry-sdk,
@@ -29,18 +33,19 @@
   pytest-socket,
   pytest-vcr,
   pytestCheckHook,
+  rich,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "langsmith";
-  version = "0.8.18";
+  version = "0.12.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YQ49pg0+RepwlEHtu8GDUpfnXQF3yFiz6ZeRcnHXSWU=";
+    hash = "sha256-e5+lttn90eBL4xkvxN9oH3aPp1wRBfy5Q0pS8LDCiq8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";
@@ -50,11 +55,15 @@ buildPythonPackage (finalAttrs: {
   build-system = [ hatchling ];
 
   dependencies = [
-    httpx
+    anyio
+    distro
+    httpx2
     orjson
     pydantic
     requests
     requests-toolbelt
+    sniffio
+    typing-extensions
     uuid-utils
     websockets
     xxhash
@@ -63,7 +72,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     anthropic
-    attrs
+    cachetools
     dataclasses-json
     multipart
     opentelemetry-sdk
@@ -72,6 +81,7 @@ buildPythonPackage (finalAttrs: {
     pytest-socket
     pytest-vcr
     pytestCheckHook
+    rich
   ];
 
   # evaluation and external tests require OpenAPI key
@@ -106,6 +116,38 @@ buildPythonPackage (finalAttrs: {
 
     # strands-agents isn't packaged
     "tests/unit_tests/wrappers/test_strands_agents.py"
+
+    # require network access to external test servers
+    "tests/unit_tests/test_async_client.py::test_arequest_with_retries_retries_on_502"
+    "tests/unit_tests/test_async_client.py::test_async_create_feedback_retries_on_not_found"
+    "tests/unit_tests/test_async_client.py::test_create_feedback_retries_on_not_found"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncConnectionErrors"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncSandboxOperations"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncSnapshotTags"
+    "tests/unit_tests/sandbox/test_async_client.py::TestGenerateDownloadURL"
+    "tests/unit_tests/sandbox/test_async_client.py::TestService"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxContextManager"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxRead"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxRun"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxStatusFields"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxWrite"
+    "tests/unit_tests/sandbox/test_client.py::TestConnectionErrors"
+    "tests/unit_tests/sandbox/test_client.py::TestGenerateDownloadURL"
+    "tests/unit_tests/sandbox/test_client.py::TestRegistries"
+    "tests/unit_tests/sandbox/test_client.py::TestSandboxOperations"
+    "tests/unit_tests/sandbox/test_client.py::TestService"
+    "tests/unit_tests/sandbox/test_client.py::TestSnapshotOperations"
+    "tests/unit_tests/sandbox/test_client.py::TestStartStopOperations"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_expands_mount_config"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_forwards_composed_proxy_config"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_preserves_mount_config_and_proxy_config_separately"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxContextManager"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxRead"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxRun"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxStatusFields"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxWrite"
+    "tests/unit_tests/sandbox/test_transport.py::TestAsyncRetryTransport"
+    "tests/unit_tests/sandbox/test_transport.py::TestRetryTransport"
   ];
 
   pythonImportsCheck = [ "langsmith" ];
diff --git a/pkgs/development/python-modules/mosek/default.nix b/pkgs/development/python-modules/mosek/default.nix
new file mode 100644
index 000000000000..e8d2cb3c9887
--- /dev/null
+++ b/pkgs/development/python-modules/mosek/default.nix
@@ -0,0 +1,90 @@
+{
+  autoPatchelfHook,
+  buildPythonPackage,
+  fetchurl,
+  lib,
+  numpy,
+  onetbb,
+  python,
+  pythonOlder,
+  setuptools,
+  stdenv,
+}:
+
+buildPythonPackage (
+  finalAttrs:
+  let
+    mosek-major-minor = lib.versions.majorMinor finalAttrs.version;
+    python-major-version = python.sourceVersion.major;
+
+    mosek-libs = stdenv.mkDerivation {
+      pname = "mosek-libs";
+      inherit (finalAttrs) version src;
+      nativeBuildInputs = [
+        onetbb
+        autoPatchelfHook
+      ];
+
+      # Copy the vendor mosek library, which will optionally use a tbb that
+      # is located next to it. We should use our own packaged one, even though
+      # that is 2021.11.0 (libtbb.so.12.11) instead of the packaged 2021.12.0 (libtbb.so.12.12).
+      # The packaged tbb would need to be patchelfed to find libstdc++ and would lead
+      # with clashes with other code using the nix based tbb, used in rtech for example.
+      installPhase = ''
+        mkdir -p $out/lib
+        cp ${mosek-major-minor}/tools/platform/linux64x86/bin/libmosek64.so.${mosek-major-minor} $out/lib/
+        ln -snf ${onetbb}/lib/libtbb.so.12 $out/lib/libtbb.so.12
+      '';
+    };
+  in
+  {
+    pname = "mosek";
+    version = "11.2.2";
+    pyproject = true;
+    build-system = [ setuptools ];
+
+    # MOSEK ships pre-built C extensions; minimum supported Python is 3.9
+    disabled = pythonOlder "3.9";
+
+    src = fetchurl {
+      url = "https://download.mosek.com/stable/${finalAttrs.version}/mosektoolslinux64x86.tar.bz2";
+      sha256 = "sha256-DVSZ+8ggmK7EyiaHYCUjxQ/3mY5GcUlgXVRfReiBkiw=";
+    };
+
+    # Move the source we want to the root
+    prePatch = ''
+      mv ${mosek-major-minor}/tools/platform/linux64x86/python/${python-major-version}/* .
+    '';
+
+    # Disable part of setup.py that 'fixes' library paths based on installation
+    # location (which it gets wrong for a Nix build). Rely on autoPatchelfHook
+    # instead. Also disable installation of _mskpreload.py, which tries to preload
+    # dependent libraries and again gets the location wrong, and seems dangerous
+    # anyway.
+    postPatch = ''
+      sed -i -e 's/^\(\s*\)#\?\(self.execute(self.install_\(libs\|preloader\),\)/\1#\2/' setup.py
+    '';
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    propagatedBuildInputs = [
+      mosek-libs
+      numpy
+    ];
+
+    # No tests are supplied
+    doCheck = false;
+
+    pythonImportsCheck = [ "mosek" ];
+
+    meta = with lib; {
+      description = "Python interface for MOSEK - the package for large scale convex, conic and mixed-integer optimization.";
+      homepage = "https://www.mosek.com/";
+      changelog = "https://docs.mosek.com/${mosek-major-minor}/releasenotes/changes.html";
+      license = licenses.unfree;
+      maintainers = with maintainers; [ jherland ];
+    };
+  }
+)
diff --git a/pkgs/development/python-modules/rapidyaml/default.nix b/pkgs/development/python-modules/rapidyaml/default.nix
new file mode 100644
index 000000000000..1992b336ce7e
--- /dev/null
+++ b/pkgs/development/python-modules/rapidyaml/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  swig,
+  cmake-build-extension,
+  setuptools,
+  setuptools-git,
+  setuptools-scm,
+  deprecation,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rapidyaml";
+  version = "0.15.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "biojppm";
+    repo = "rapidyaml-python";
+    fetchSubmodules = true;
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lTLVcB6LJKY2gIg2l8/B/hrl0Cu2Ia5d/I1z6jyZ2KM=";
+  };
+
+  build-system = [
+    setuptools
+    cmake-build-extension
+    setuptools-scm
+    setuptools-git
+    swig
+  ];
+
+  postPatch = ''
+    # pyproject.toml lists "swig" as a Python build requirement (for PyPI installs),
+    # but in Nix swig is a system binary on PATH, not a Python package. Remove it so
+    # pypa/build's dependency check doesn't fail when using --no-isolation.
+    substituteInPlace pyproject.toml \
+      --replace-fail '"swig"' ""
+  '';
+
+  # cmake-build-extension drives the CMake configure step
+  dontUseCmakeConfigure = true;
+
+  dependencies = [ deprecation ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "ryml" ];
+
+  meta = {
+    description = "Parse and emit YAML, and do it fast. Python wrapper for the C++ library";
+    homepage = "https://github.com/biojppm/rapidyaml-python";
+    changelog = "https://github.com/biojppm/rapidyaml-python/blob/master/changelog/${finalAttrs.version}.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+})
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index bc70cc5d0ba4..0fd290070927 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -14,16 +14,16 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tesla-fleet-api";
-  version = "1.12.1";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
-    tag = "v${version}";
-    hash = "sha256-w/yEfAM2NRxg5yXXPxuudAY1qRSZDgRX+GirIgMi3gY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MMbn/qjy9B5qDF1w1ckT06vz9GeU1Gy+NitnHl7uPk4=";
   };
 
   build-system = [ setuptools ];
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for Tesla Fleet API and Teslemetry";
     homepage = "https://github.com/Teslemetry/python-tesla-fleet-api";
-    changelog = "https://github.com/Teslemetry/python-tesla-fleet-api/releases/tag/${src.tag}";
+    changelog = "https://github.com/Teslemetry/python-tesla-fleet-api/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/tools/package-management/nix-eval-jobs/default.nix b/pkgs/tools/package-management/nix-eval-jobs/default.nix
index 46c271efe841..06f532992b1d 100644
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@@ -11,15 +11,18 @@
   stdenv,
   nixComponents,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nix-eval-jobs";
-  version = "2.35.3";
+  version = "2.35.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nix-eval-jobs";
-    tag = "v${version}";
-    hash = "sha256-Ig1h/+qL5sj60fWiy44kQkXjapuff7vJXC9N0Ak8EkY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t1FbcjvTWQ1WO3hJNKN+viNXuz4BX9Pte5K4F+IJLDk=";
   };
 
   buildInputs = [
@@ -66,4 +69,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "nix-eval-jobs";
   };
-}
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 10043dd8b5d0..f6a1f7348b8b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1263,6 +1263,7 @@ mapAliases {
   kdesvn = throw "'kdesvn' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   keepkey-agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11
   keepkey_agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11
+  keeweb = throw "'keeweb' has been removed because it was using an EOL electron version"; # Added 2026-09-17
   keydb = throw "'keydb' has been removed as it was broken, vulnerable, and unmaintained upstream"; # Added 2025-11-08
   kgraphviewer = throw "'kgraphviewer' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   kgx = throw "'kgx' has been renamed to/replaced by 'gnome-console'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ae5bfb3a631b..e600458995d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8757,8 +8757,9 @@ with pkgs;
     k3s_1_34
     k3s_1_35
     k3s_1_36
+    k3s_1_37
     ;
-  k3s = k3s_1_35;
+  k3s = k3s_1_36;
 
   kotatogram-desktop =
     callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 87b309ac34b9..48124b9b9cce 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2620,6 +2620,8 @@ self: super: with self; {
 
   borb = callPackage ../development/python-modules/borb { };
 
+  borb_2 = callPackage ../development/python-modules/borb/2.nix { };
+
   bork = callPackage ../development/python-modules/bork { };
 
   bosch-alarm-mode2 = callPackage ../development/python-modules/bosch-alarm-mode2 { };
@@ -11205,6 +11207,8 @@ self: super: with self; {
 
   mortgage = callPackage ../development/python-modules/mortgage { };
 
+  mosek = callPackage ../development/python-modules/mosek { };
+
   motionblinds = callPackage ../development/python-modules/motionblinds { };
 
   motionblindsble = callPackage ../development/python-modules/motionblindsble { };
@@ -17768,6 +17772,8 @@ self: super: with self; {
 
   rapidocr-onnxruntime = callPackage ../development/python-modules/rapidocr-onnxruntime { };
 
+  rapidyaml = callPackage ../development/python-modules/rapidyaml { };
+
   rapt-ble = callPackage ../development/python-modules/rapt-ble { };
 
   rarfile = callPackage ../development/python-modules/rarfile { inherit (pkgs) libarchive unrar; };