diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index ed324e5b3dbe..2efe46c9dfc3 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.0.5";
+  version = "26.1.3";
 
   src =
     let
@@ -32,10 +32,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-urgvGZNM7V5zmts+3Zv7nDtyBuyyAHjc9HDUP2CXx50=";
-        aarch64-linux = "sha256-Ye6NH8tBmSbDS3sJjTzvc9C+qyU3DA0HL0csFUzD1pc=";
-        x86_64-darwin = "sha256-iMyHZUNHzSpc2DrKSsduMx13hUY1SdHQTANR3Yj256A=";
-        aarch64-darwin = "sha256-F60zrgx2cS6HCmSznUapSgmuIxLI1Ma8WHrmawDzEUk=";
+        x86_64-linux = "sha256-cPRmReV6F+pCkrbF7d1m+bQjOaJCCFndNSThMWPGrsY=";
+        aarch64-linux = "sha256-bT1bCKzeiAMJbPa6I6fqQq7OrbkKhgDYAUEKuURHP5g=";
+        x86_64-darwin = "sha256-cT4r0QbA0mhO+fStnU7ORgvSPjNiyz3a0asins0kYaE=";
+        aarch64-darwin = "sha256-NYX651gUpEDh2O720ZKl7fUTYLFKpTJzyC/YnN4Vnys=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/fa/factorio/versions.json b/pkgs/by-name/fa/factorio/versions.json
index 2e0208d73e3c..f2b6cbf32025 100644
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@@ -3,99 +3,99 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.76.tar.xz"
+          "factorio_linux_2.1.8.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.76.tar.xz",
+        "name": "factorio_alpha_x64-2.1.8.tar.xz",
         "needsAuth": true,
-        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
+        "sha256": "307016173b824ddfa1a1be4067526273f3aafe6dc8a9c49aff7b2250c466b0b0",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/alpha/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.76.tar.xz"
+          "factorio_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.76.tar.xz",
+        "name": "factorio_alpha_x64-2.0.77.tar.xz",
         "needsAuth": true,
-        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
+        "sha256": "2e7c26d999c140335abb82c5e642cdd4c98db559633562d7ad9844aff4f273ff",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/alpha/linux64",
+        "version": "2.0.77"
       }
     },
     "demo": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.76.tar.xz"
+          "factorio-demo_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_demo_x64-2.0.76.tar.xz",
+        "name": "factorio_demo_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
+        "sha256": "f2fc889de1924b551cf52ca2ce2c73251f9c20ee2ae38cc8e973415baffef2a1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/demo/linux64",
+        "version": "2.0.77"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.76.tar.xz"
+          "factorio-demo_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_demo_x64-2.0.76.tar.xz",
+        "name": "factorio_demo_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
+        "sha256": "f2fc889de1924b551cf52ca2ce2c73251f9c20ee2ae38cc8e973415baffef2a1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/demo/linux64",
+        "version": "2.0.77"
       }
     },
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.76.tar.xz"
+          "factorio-space-age_linux_2.1.8.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.76.tar.xz",
+        "name": "factorio_expansion_x64-2.1.8.tar.xz",
         "needsAuth": true,
-        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
+        "sha256": "92ec753d96eab63fc60f45ac45259a9427268f74bab0c15b63263f10aae0e786",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/expansion/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.76.tar.xz"
+          "factorio-space-age_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.76.tar.xz",
+        "name": "factorio_expansion_x64-2.0.77.tar.xz",
         "needsAuth": true,
-        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
+        "sha256": "068cd4778459569cb46e8a8acde1c404969ad533d7e479789af9fce0d29f10a4",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/expansion/linux64",
+        "version": "2.0.77"
       }
     },
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.76.tar.xz",
-          "factorio_headless_x64_2.0.76.tar.xz"
+          "factorio-headless_linux_2.1.8.tar.xz",
+          "factorio_headless_x64_2.1.8.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.76.tar.xz",
+        "name": "factorio_headless_x64-2.1.8.tar.xz",
         "needsAuth": false,
-        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
+        "sha256": "16b122cd5f48118cd44bcaf1d27fd933aea60b9902bbd426fd26359440759f12",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/headless/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.76.tar.xz",
-          "factorio_headless_x64_2.0.76.tar.xz"
+          "factorio-headless_linux_2.0.77.tar.xz",
+          "factorio_headless_x64_2.0.77.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.76.tar.xz",
+        "name": "factorio_headless_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
+        "sha256": "c4efc11529f74d37c96933e291e0db73fd9f5aa4738913d9301b24680b3e947f",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/headless/linux64",
+        "version": "2.0.77"
       }
     }
   }
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index faf1f96f7f10..2e2f70d0065d 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -181,10 +181,24 @@ let
     inherit pname meta passthru;
     version = "150.0.7871.186";
 
-    src = fetchurl {
-      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
-    };
+    src =
+      let
+        debArch =
+          {
+            aarch64-linux = "arm64";
+            x86_64-linux = "amd64";
+          }
+          .${stdenvNoCC.hostPlatform.system};
+      in
+      fetchurl {
+        url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
+        hash =
+          {
+            amd64 = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
+            arm64 = "sha256-AllqLQfbFu7EJCK5Xeo3TuItGMnOqunpMBKY4OJnj7M=";
+          }
+          .${debArch};
+      };
 
     # With strictDeps on, some shebangs were not being patched correctly
     # ie, $out/share/google/chrome/google-chrome
@@ -338,7 +352,10 @@ let
       iedame
       mdaniels5757
     ];
-    platforms = lib.platforms.darwin ++ [ "x86_64-linux" ];
+    platforms = lib.platforms.darwin ++ [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "google-chrome-stable";
   };
diff --git a/pkgs/by-name/go/google-chrome/update.sh b/pkgs/by-name/go/google-chrome/update.sh
index 7889ac11eaf5..32a897e05161 100755
--- a/pkgs/by-name/go/google-chrome/update.sh
+++ b/pkgs/by-name/go/google-chrome/update.sh
@@ -27,8 +27,10 @@ update_linux() {
     local version_info
     local version
     local current_version
+    local arch
+    local download_url
     local new_hash
-    local new_sri_hash
+    local -A new_hashes
 
     read -ra version_info <<< "$(get_version_info "linux" "linux = stdenvNoCC.mkDerivation" "});")"
     version="${version_info[0]}"
@@ -39,14 +41,18 @@ update_linux() {
         return 0
     fi
 
-    local download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_amd64.deb"
-    new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
-    new_sri_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
+    for arch in amd64 arm64; do
+        download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_${arch}.deb"
+        new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
+        new_hashes["$arch"]="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
+    done
 
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
-    sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
 
-    echo "[Nix] Linux google-chrome: $current_version -> $version with hash $new_hash"
+    for arch in amd64 arm64; do
+        sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|^\([[:space:]]*\)${arch} = \".*\";|\1${arch} = \"${new_hashes[$arch]}\";|" "$DEFAULT_NIX"
+        echo "[Nix] Linux ${arch} google-chrome: $current_version -> $version with hash ${new_hashes[$arch]}"
+    done
 }
 
 update_darwin() {
diff --git a/pkgs/by-name/ko/komikku/package.nix b/pkgs/by-name/ko/komikku/package.nix
index c91f828342e0..2685d72f106b 100644
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@@ -24,14 +24,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "komikku";
-  version = "50.9.0";
+  version = "50.10.0";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "valos";
     repo = "Komikku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fjAls3/ikNrQ1AgwUe9hFoQ48zv7UbGCUNB4dlmYM28=";
+    hash = "sha256-OhQR6hXpQhM0O7pgfTdVn8CY3OAHhH+U1X91G/j8kqk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ku/kubelogin-oidc/package.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
index a89df667a57a..f88a06c08424 100644
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubelogin";
-  version = "1.36.2";
+  version = "1.36.3";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VzUnjqa3XnKSqcwd2jVwbQwGmyO5+YBwPIIxN0wj81A=";
+    hash = "sha256-VgsUQcFUbtZSZuar7K/ErJRsJZ0GvyIEixGGhF+hLnY=";
   };
 
   subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-/30B7krXl0HYm+nUqGtbhNb4L8utdorjZNGkfMCYs3k=";
+  vendorHash = "sha256-29D31EKO2Y6TXj607Tf3O5dGBHyrMyXoC5tWEKqvbbA=";
 
   # test all packages
   preCheck = ''
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index bcc4927bcbc6..3365f017db84 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "152.0.6-1",
+  "packageVersion": "153.0-3",
   "source": {
-    "rev": "152.0.6-1",
-    "hash": "sha256-O5s1t/ZZVYL/9ik4zyi/kKAQEbSERO6vD1NJzEUmnU4="
+    "rev": "153.0-3",
+    "hash": "sha256-kRa+IOicrS2xWO2k3m52qBmmazGSj3Ybuke6UQwQJgg="
   },
   "firefox": {
-    "version": "152.0.6",
-    "hash": "sha512-xNh3g31wB/thHDjUnZtt07xMXJypALVOci4UDOfs0JJPabXO3H+MH+YC5+/h1xWbAZ3ieZnikjXNYxghuxPmsA=="
+    "version": "153.0",
+    "hash": "sha512-oa9YZuHJpzKBgSPy8EG/1Zk9CT6W3XQ7WDMS+xHSs51CnfdQ+ewi3tZLWKIJux7KvHqvcwV9emTHNJ5NoEPWbQ=="
   }
 }
diff --git a/pkgs/by-name/mi/miniflux/package.nix b/pkgs/by-name/mi/miniflux/package.nix
index 1986a4057ccc..21a93c022960 100644
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@@ -9,16 +9,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "miniflux";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = finalAttrs.version;
-    hash = "sha256-gfudc11dJKzRtsT2gEazzgGFoUVaZNqgzdIATuGH29U=";
+    hash = "sha256-zJ8ir6t3J65RTNi7XtTsbuG3VQId3xvEhLP6Cgn0+xg=";
   };
 
-  vendorHash = "sha256-JjZfZJyml6/ANilLNAKaounUJ35TWhj/wVWWiGEhxps=";
+  vendorHash = "sha256-+5vpLTpShQegLzFzAl7H86i71G+PXP66w9mIr440+oA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/os/osu-lazer-bin/package.nix b/pkgs/by-name/os/osu-lazer-bin/package.nix
index f2751bd4e951..47b570c36aac 100644
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@@ -10,13 +10,13 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2026.711.0";
+  version = "2026.726.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.app.Apple.Silicon.zip";
-        hash = "sha256-XwfNO38dDaUmu/3AEgRwV0VW6JrAUCxWD6Wt0Ew23Eo=";
+        hash = "sha256-LwikashfaYrKB2LqQ0YleOqu0ikykxrSgZE68aRaV9s=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
@@ -26,7 +26,7 @@ let
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.AppImage";
-        hash = "sha256-KyA5UCvb9epk7jRtdG5wl0LzKc6/D2rkw5EJQxIaihw=";
+        hash = "sha256-PTAoYJVD3/0DewBlJgP3WShRUQC2JFvJKancRv07KaA=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/os/osu-lazer/deps.json b/pkgs/by-name/os/osu-lazer/deps.json
index b928eda21f38..aa8771bb8d8a 100644
--- a/pkgs/by-name/os/osu-lazer/deps.json
+++ b/pkgs/by-name/os/osu-lazer/deps.json
@@ -616,8 +616,8 @@
   },
   {
     "pname": "ppy.osu.Framework",
-    "version": "2026.629.0",
-    "hash": "sha256-fb2rmHin/5kCQ4klLvWXHZLnLg4RkrDFn024YIm13R0="
+    "version": "2026.724.0",
+    "hash": "sha256-4ZHcI6DdxrppWRGmPeI00MpWyEEZvoZzL4pDfBlT3GY="
   },
   {
     "pname": "ppy.osu.Framework.NativeLibs",
diff --git a/pkgs/by-name/os/osu-lazer/package.nix b/pkgs/by-name/os/osu-lazer/package.nix
index ee2a50bb9d74..69801980d3ba 100644
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@@ -22,13 +22,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2026.711.0";
+  version = "2026.726.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = "${version}-lazer";
-    hash = "sha256-hdrbbPl7ClNx73bsjoN5u4bEmvl/sdcjgFnZ/uxYbOk=";
+    hash = "sha256-5LA4BLbKqlUYEAQY+8LRvZkzOnTZ/UVqaALZzT/Ybxo=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/by-name/si/signal-desktop/dont-assert-unicode-17-emoji.patch b/pkgs/by-name/si/signal-desktop/dont-assert-unicode-17-emoji.patch
deleted file mode 100644
index a39494ca8271..000000000000
--- a/pkgs/by-name/si/signal-desktop/dont-assert-unicode-17-emoji.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/scripts/generate-emoji-data.mjs b/scripts/generate-emoji-data.mjs
-index 85fd8d484..23ca0bb72 100644
---- a/scripts/generate-emoji-data.mjs
-+++ b/scripts/generate-emoji-data.mjs
-@@ -207,7 +207,6 @@ for (const emojiSrc of SRC_EMOJIS_SORTED) {
-   }
- 
-   const emoji = encodeUnified(emojiSrc.unified);
--  assert(isEmoji(emoji), 'Unexpected invalid emoji');
- 
-   if (isDeprecated(emoji)) {
-     continue; // drop deprecated emoji
diff --git a/pkgs/by-name/si/signal-desktop/libsignal-node.nix b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
index c540ad1bfb83..b37ef4709c4a 100644
--- a/pkgs/by-name/si/signal-desktop/libsignal-node.nix
+++ b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
@@ -15,23 +15,23 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-node";
-  version = "0.95.0";
+  version = "0.96.3";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-stxakRw9CJQetkBcF2BfQh1EvEGurccP5/QLNLyEJz0=";
+    hash = "sha256-FOppsfocUvUfWa6AfBPOxAnntGJkzTbnPwqMzzbHnWQ=";
   };
 
-  cargoHash = "sha256-bbOsE6vcFQpplzXAupcvp2oEoIFT3nk8Ug9QWbCe2yc=";
+  cargoHash = "sha256-wsXlCpNwO+E6rVNaD2R51Mi0sZUv2lhllGxDxzyptYA=";
 
   npmRoot = "node";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-npm-deps";
     inherit (finalAttrs) version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-lCLM0qI11Ce9w2NNgXHalxa8Ks628nvTjZhy26PvNbM=";
+    hash = "sha256-p8udihRlXMTnG4BT60D2VlI7D/O3eHV/zCS7ucpeuO4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 003cf64b05bf..2919500af678 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -4,6 +4,7 @@
   lib,
   nodejs_24,
   pnpm_10,
+  pnpm_11,
   node-gyp,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -32,22 +33,25 @@ assert lib.warnIf (commandLineArgs != "")
   true;
 let
   nodejs = nodejs_24;
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
   electron = electron_42;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
-  signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
+  signal-sqlcipher = callPackage ./signal-sqlcipher.nix {
+    pnpm = pnpm_10;
+    inherit nodejs;
+  };
 
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
 
-  version = "8.15.0";
+  version = "8.18.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-SiOgNUll6J+EZNlmM6yhXakOc5qFCFRE/GczhaH57Vo=";
+    hash = "sha256-fynCFGmch3UecT5esNfVVlf0+xDrCdCBGw2HMMqBzWw=";
     # Emoji font files will be added in `postFetch` if `withAppleEmojis` is enabled. They
     # are fetched separately below.
     postFetch = ''
@@ -63,16 +67,28 @@ let
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
     pname = "signal-desktop-sticker-creator";
-    inherit version;
-    src = src + "/sticker-creator";
+    inherit src version;
+
+    pnpmRoot = "sticker-creator";
+    pnpmWorkspaces = [ "signal-art-creator" ];
 
     pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname src version;
+      inherit (finalAttrs)
+        pname
+        src
+        version
+        postPatch
+        pnpmWorkspaces
+        ;
       inherit pnpm;
       fetcherVersion = 4;
-      hash = "sha256-WmDSa4PrASaqs8X68LYaPBeE+i+Jh3FfWF30SseN74Y=";
+      hash = "sha256-bWNs5W2NPk55Sm7UqwWvXU7bY+AXzevU3o2ji23HxtU=";
     };
 
+    postPatch = ''
+      rm sticker-creator/pnpm-lock.yaml
+    '';
+
     strictDeps = true;
     nativeBuildInputs = [
       nodejs
@@ -83,7 +99,7 @@ let
 
     installPhase = ''
       runHook preInstall
-      cp -r dist $out
+      cp -r sticker-creator/dist $out
       runHook postInstall
     '';
   });
@@ -113,9 +129,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./force-90-days-expiration.patch
-
-    # Drop once https://github.com/NixOS/nixpkgs/pull/520553 and https://github.com/NixOS/nixpkgs/pull/525241 land.
-    ./dont-assert-unicode-17-emoji.patch
   ]
   ++ lib.optional (!withAppleEmojis) (
     # Signal ships the Apple emoji set without a licence and upstream
@@ -149,6 +162,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace config/production.json \
       --replace-fail '"updatesEnabled": true' '"updatesEnabled": false'
 
+    # pnpm 11 verifies node_modules before every `pnpm run`, which fails
+    # after nixpkgs swaps in the prebuilt native modules below.
+    substituteInPlace pnpm-workspace.yaml \
+      --replace-fail "verifyDepsBeforeRun: prompt" "verifyDepsBeforeRun: false"
+
     # Nix builds do not need upstream release hooks (notarization and
     # language-pack postprocessing), and they expect a different macOS
     # app layout than nixpkgs' Electron provides.
@@ -172,13 +190,13 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-/z+P9mb7Cm3FzzMpV6Da6THcHd73JgPuuB0Gx8KwKcc=";
+    hash = "sha256-bWNs5W2NPk55Sm7UqwWvXU7bY+AXzevU3o2ji23HxtU=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1781737260;
+    SOURCE_DATE_EPOCH = 1783606680;
   };
 
   preBuild = ''
@@ -233,6 +251,14 @@ stdenv.mkDerivation (finalAttrs: {
     popd
     test -f node_modules/fs-xattr/build/Release/xattr.node
 
+    # @signalapp/windows-ucv is imported on all platforms, but its TypeScript
+    # output is normally produced by its preinstall script. pnpmConfigHook runs
+    # `pnpm install --ignore-scripts`, so build it explicitly.
+    pushd packages/windows-ucv
+    pnpm run build
+    popd
+    test -f node_modules/@signalapp/windows-ucv/dist/index.js
+
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
     cp -r ${sticker-creator} sticker-creator/dist
diff --git a/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch b/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
index 6cc74744b76c..2b3e50b13af0 100644
--- a/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
+++ b/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
@@ -1,13 +1,13 @@
 diff --git a/app/AssetService.main.ts b/app/AssetService.main.ts
-index 33b20b8d5..c122f8c67 100644
+index a4a21b5bb..3d5ab1eb0 100644
 --- a/app/AssetService.main.ts
 +++ b/app/AssetService.main.ts
-@@ -32,7 +32,6 @@ const LOCAL_ASSETS = new Set([
+@@ -34,7 +34,6 @@ const OPTIONAL_ASSETS = new Map<string, string>([]);
  
- // pathname to optional resource name
- const OPTIONAL_ASSETS = new Map([
--  ['optional-fonts/emoji-large.woff2', 'emoji-font.woff2'],
- ]);
+ if (!process.mas) {
+   LOCAL_ASSETS.add('fonts/emoji.woff2');
+-  OPTIONAL_ASSETS.set('optional-fonts/emoji-large.woff2', 'emoji-font.woff2');
+ }
  
  export class AssetService {
 diff --git a/app/protocol_filter.node.ts b/app/protocol_filter.node.ts
diff --git a/pkgs/by-name/si/signal-desktop/ringrtc.nix b/pkgs/by-name/si/signal-desktop/ringrtc.nix
index 04b0d64cd4a9..c981eb2b9a2d 100644
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.69.3";
+  version = "2.69.4";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ekSXEaAyVzd5957qoFakD33UYrUmvxZL19M6uflPR5U=";
+    hash = "sha256-z/9Y9rrlH4yziEVAXrCmkmP42hdDm3frGJnL1O/qOqg=";
   };
 
-  cargoHash = "sha256-oNHT2owg3Ob2z8JxdYnICRdogK+XaasVgbF5RYYBJas=";
+  cargoHash = "sha256-a6CEUVW1HXqgIp/S+4Ype83N3QtNCBrutiEepHNW5pY=";
 
   preConfigure = ''
     # Check for matching webrtc version
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index bdbf1db57ebd..d1b8824f2f2d 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -16,20 +16,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "3.3.5";
+  version = "3.3.9";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RzuyUx0WEG8j8HwV5cepVJIeqYzJpNemFNtB+9NETto=";
+    hash = "sha256-eddDeNK8UA6CW1qXZtgS8QpuXVjFO6tVwpFDyYDnX+U=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm; # may be different than top-level pnpm
     fetcherVersion = 4;
-    hash = "sha256-HK3AetwGqFq/dhxX+aWgUww6eLCeQEkZIVsmmnYqdmM=";
+    hash = "sha256-avvXNPfN5YVqwCOU2RX8dos3LTlre1t/4COKb4zHkh4=";
   };
 
   cargoRoot = "deps/extension";
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 6d6c8caffd8d..502f4e641716 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -38,7 +38,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-K8eQU/f5s6azGoOwN/0efmkP184t25aHBm5uZZNjIFg=";
   };
 
-  vendorHash = "sha256-mbxLXR2TBgiwyVGfLmMR5xWk+0f66mPDas95Wla70Lk=";
+  vendorHash = "sha256-Sd2iLJ7eDfDYdIRuW4xuiKgzhQWJWGAnz97FJWrVRlE=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/telegram-bot-api/package.nix b/pkgs/by-name/te/telegram-bot-api/package.nix
index 6a73b8af8e54..ad3d9f6fdc20 100644
--- a/pkgs/by-name/te/telegram-bot-api/package.nix
+++ b/pkgs/by-name/te/telegram-bot-api/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation {
   pname = "telegram-bot-api";
-  version = "10.1";
+  version = "10.2";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "telegram-bot-api";
     # https://github.com/tdlib/telegram-bot-api/issues/783
-    rev = "0a9e5696ba149c99bedf972f040d2e28776a8a4f";
-    hash = "sha256-F3TYYB5sI8nadiHUaxW5BOC1XMnEfsrZQX2dLJXA5Mg=";
+    rev = "adfd7f6a8e990272851777eeb3ae0def4216f161";
+    hash = "sha256-sICBisUDMirUOMN5ORQ2B9Wo8KC91hIn1sHyt2xClJ0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 23c6d7d8426b..d3e7b21d1641 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.39";
-      hash = "sha256-Kg2p8MPTQT46nTGw0rP3SMS4BOnuBMXL8zertaC9Wcs=";
+      version = "6.18.40";
+      hash = "sha256-UKEKNI11QpTXrDQmh+1JU75voHer10Aw0L8T+f7JhYQ=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.1.4";
-      hash = "sha256-jHYReidaX4aufcpTeWxr/Lu0+W9yHL7SpF7mgjDSyxY=";
+      version = "7.1.5";
+      hash = "sha256-zELqn/UieXjOBkTNTLi2OCkK4+rpD/IfJEDb7GTTJfk=";
     };
   };
 
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 43f6f752704f..e4e72f1d7741 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,8 +60,8 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.118";
-    hash = "sha256-L9Me+dqZKbh4mX9zHPJVNv6sV0FhwC2TmXJ0ccfEBrI=";
+    version = "9.0.120";
+    hash = "sha256-HevX6bz17tjIpyccn6r2mfSUGoOZLaxa2BSg52fOXiY=";
   };
 
   tomcat10 = common {
@@ -70,7 +70,7 @@ in
   };
 
   tomcat11 = common {
-    version = "11.0.22";
-    hash = "sha256-c9I5Iy8U394ieOjZMfdn7UVK7ZsBjk1wodQEwlebWZg=";
+    version = "11.0.24";
+    hash = "sha256-EO/tkL8zARSvZieeQ9zyEez897iOYYdXlUrIgylgDLo=";
   };
 }
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index fe58b505b210..2866bac3edee 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -57,20 +57,20 @@ let
 in
 {
   nextcloud32 = generic {
-    version = "32.0.12";
-    hash = "sha256-rxWPclccjhXim8E2wjqSEYjOHVZoVQAK2U+JuAqPGAw=";
+    version = "32.0.13";
+    hash = "sha256-7rAaOJp2z+RfweD2GhW1x0vkDNKciuT1TNa0J817nvA=";
     packages = nextcloud32Packages;
   };
 
   nextcloud33 = generic {
-    version = "33.0.6";
-    hash = "sha256-eRghpVAplE3gQxnPyvysSujn71a0zR78JjG/MLedFt4=";
+    version = "33.0.7";
+    hash = "sha256-uuGoL8u/TWmZTS1Y1OgVFm+/T+1a06VRIfOM4H7emRM=";
     packages = nextcloud33Packages;
   };
 
   nextcloud34 = generic {
-    version = "34.0.1";
-    hash = "sha256-BOnDL8P+Ofa2qKGJFe9a/SgKVrSn90Thj1+i7/+8SmM=";
+    version = "34.0.2";
+    hash = "sha256-Qc4x3xLMgQkMPQf+DouQveYckrGK6A5NZIutQ9eZEQE=";
     packages = nextcloud34Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 9c3afac7e3b1..85e5d7cb67da 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
-    "version": "0.11.8",
+    "hash": "sha256-AX48RNDRiIkl4OZU58S/jtMWBPkZuOPTLajs0PVjm4A=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.9/cookbook-0.11.9.tar.gz",
+    "version": "0.11.9",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "drawio": {
-    "hash": "sha256-CPwTRdS9pHNzIeLYSqSbY9nVUGqBT3awr9IlKng0baI=",
-    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.1.2/drawio-v4.1.2.tar.gz",
-    "version": "4.1.2",
+    "hash": "sha256-0QhvtGe7WtySzBAIicSEyfgRlCjs8gZsmIosZ8pv7bg=",
+    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.1.4/drawio-v4.1.4.tar.gz",
+    "version": "4.1.4",
     "description": "Integrates the diagrams.net diagram editor with Nextcloud. Users can create and edit .drawio diagrams and .dwb whiteboards directly within the Nextcloud file manager.\n\n**Features:**\n\n- Create and edit diagrams and whiteboards from the Nextcloud \"+\" menu\n- Click any .drawio or .dwb file to open the editor inline\n- Autosave with optimistic conflict detection\n- Inline diagram previews in Text, Collectives, Talk, Notes, and Deck\n- Supports public share links (read-only and editable)\n- Offline mode for privacy-sensitive deployments\n- Configurable editor URL for self-hosted diagrams.net instances",
     "homepage": "https://github.com/arnowelzel/drawio-nextcloud",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "files_linkeditor": {
-    "hash": "sha256-WIOLA1J2aqMr5v3bZB3pRnF9bH1V0asGsMNTcetRsx8=",
-    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.25/files_linkeditor.tar.gz",
-    "version": "1.1.25",
+    "hash": "sha256-C0JWqDDnaG9eYOzaTGeEk6gIhOlXhc1A9dH0uFNo5uA=",
+    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.26/files_linkeditor.tar.gz",
+    "version": "1.1.26",
     "description": "### External web links in Nextcloud!\n* ✍️ **create and edit** .URL and .webloc links in the file view\n* 🌍 **open links** by clicking them and confirming you want to go to the external site\n* 📤 **works in public shares** so you can share links easily with others\n* 🔄 **sync your links** as .URL and .webloc are web links as created on most operating systems.\n\n_[View changelog](https://github.com/te-online/files_linkeditor/blob/main/CHANGELOG.md)_",
     "homepage": "https://github.com/te-online/files_linkeditor",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-vd6qwBAGUtm+Fbfc/Ei1mtmENX5Zvz5ZlW1MGggytJ0=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.4/forms-v5.3.4.tar.gz",
-    "version": "5.3.4",
+    "hash": "sha256-ismV8Hv6XrOF3ukbcewpOwZXo+nFFnS2tCdw0foUC8M=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.5/forms-v5.3.5.tar.gz",
+    "version": "5.3.5",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API_v3.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-r7x9WkBAYw2KJ6D2FcLqbKHTHpVUP/z2eLjy4QorL7k=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.8/mail-v5.10.8.tar.gz",
-    "version": "5.10.8",
+    "hash": "sha256-XZlufroUCP7zmatKi6/lnaJ88lLIZlxQJi/bCeZLHM8=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.9/mail-v5.10.9.tar.gz",
+    "version": "5.10.9",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -310,9 +310,9 @@
     ]
   },
   "phonetrack": {
-    "hash": "sha256-d6vPKCJ1Us0zQIFkIlSQ5cmEgO1zXGtdDniIjfqGh28=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.2.0/phonetrack-1.2.0.tar.gz",
-    "version": "1.2.0",
+    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
+    "version": "1.3.1",
     "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
     "homepage": "https://github.com/julien-nc/phonetrack",
     "licenses": [
@@ -380,9 +380,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-s/3SPckGmlTH+nS7VTqbDcBOgiLjW6RQsc6dwdg/zYE=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v9.1.1/richdocuments-v9.1.1.tar.gz",
-    "version": "9.1.1",
+    "hash": "sha256-A9+QNq9CSwfGkBDfSz4lJH2TY8pdvmOeTJS+Cd1urAc=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v9.2.0/richdocuments-v9.2.0.tar.gz",
+    "version": "9.2.0",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-/mnpEUfyhjGG31TKzFEfKUuzflPL+pGcf6PRbNnkaUE=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.3/release.tar.gz",
-    "version": "6.5.3",
+    "hash": "sha256-cLD6xYC3RJu2VmKjqsSA4YtFJZpORv1HpymFz0knkP8=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.4/release.tar.gz",
+    "version": "6.5.4",
     "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. Multiple claims (comma separated) also supported - groups will be merged.\nThe format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
@@ -400,9 +400,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-Px8WFUNSRRWMcR/keUhoss7sjOUfXB9IAKdFKPzuSqs=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.15/spreed-v22.0.15.tar.gz",
-    "version": "22.0.15",
+    "hash": "sha256-bYTR4bv0BoNB9syzXRuRYB2TXNqD7shTWrhAd2csVtU=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.16/spreed-v22.0.16.tar.gz",
+    "version": "22.0.16",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -430,9 +430,9 @@
     ]
   },
   "theming_customcss": {
-    "hash": "sha256-Fgu31s+K4MFUgvNe9mAVHi9C0iJnv40v1onUMk+lFZk=",
-    "url": "https://github.com/nextcloud/theming_customcss/releases/download/v1.20.0/theming_customcss.tar.gz",
-    "version": "1.20.0",
+    "hash": "sha256-gJcQJv0tD7lykS+26cLr5zlujJjajNqITWmTv0ki2T0=",
+    "url": "https://github.com/nextcloud-releases/theming_customcss/releases/download/v1.21.0/theming_customcss-v1.21.0.tar.gz",
+    "version": "1.21.0",
     "description": "This app allows admins to customize the appearance of their Nextcloud instance by adding their own CSS rules.\n\nThe rules can be added in the admin settings in the \"Theming\" section. This allows you to easily adjust the look and feel of your Nextcloud instance without having to modify any files on the server.",
     "homepage": "",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index fb38f293f2b8..c0d45aa065f3 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
-    "version": "0.11.8",
+    "hash": "sha256-AX48RNDRiIkl4OZU58S/jtMWBPkZuOPTLajs0PVjm4A=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.9/cookbook-0.11.9.tar.gz",
+    "version": "0.11.9",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "drawio": {
-    "hash": "sha256-nVcO2V0zo7VdL/o8c6IRbiIqFnGBH7NdqL/eefQ/ip0=",
-    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.3.0/drawio-v4.3.0.tar.gz",
-    "version": "4.3.0",
+    "hash": "sha256-VLG6dA0WwnImhNA+JtsS+NLVFxyD7UcxEdCu/zjNjtM=",
+    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.3.5/drawio-v4.3.5.tar.gz",
+    "version": "4.3.5",
     "description": "Integrates the diagrams.net diagram editor with Nextcloud. Users can create and edit .drawio diagrams and .dwb whiteboards directly within the Nextcloud file manager.\n\n**Features:**\n\n- Create and edit diagrams and whiteboards from the Nextcloud \"+\" menu\n- Click any .drawio or .dwb file to open the editor inline\n- Autosave with optimistic conflict detection\n- Inline diagram previews in Text, Collectives, Talk, Notes, and Deck\n- Supports public share links (read-only and editable)\n- Offline mode for privacy-sensitive deployments\n- Configurable editor URL for self-hosted diagrams.net instances",
     "homepage": "https://github.com/arnowelzel/drawio-nextcloud",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "files_linkeditor": {
-    "hash": "sha256-WIOLA1J2aqMr5v3bZB3pRnF9bH1V0asGsMNTcetRsx8=",
-    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.25/files_linkeditor.tar.gz",
-    "version": "1.1.25",
+    "hash": "sha256-C0JWqDDnaG9eYOzaTGeEk6gIhOlXhc1A9dH0uFNo5uA=",
+    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.26/files_linkeditor.tar.gz",
+    "version": "1.1.26",
     "description": "### External web links in Nextcloud!\n* ✍️ **create and edit** .URL and .webloc links in the file view\n* 🌍 **open links** by clicking them and confirming you want to go to the external site\n* 📤 **works in public shares** so you can share links easily with others\n* 🔄 **sync your links** as .URL and .webloc are web links as created on most operating systems.\n\n_[View changelog](https://github.com/te-online/files_linkeditor/blob/main/CHANGELOG.md)_",
     "homepage": "https://github.com/te-online/files_linkeditor",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-vd6qwBAGUtm+Fbfc/Ei1mtmENX5Zvz5ZlW1MGggytJ0=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.4/forms-v5.3.4.tar.gz",
-    "version": "5.3.4",
+    "hash": "sha256-ismV8Hv6XrOF3ukbcewpOwZXo+nFFnS2tCdw0foUC8M=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.5/forms-v5.3.5.tar.gz",
+    "version": "5.3.5",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API_v3.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-elHsIh1LD/5c1BT/+YLMSMLtMXdLacTPpU4SSORdjw0=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.10/groupfolders-v21.0.10.tar.gz",
-    "version": "21.0.10",
+    "hash": "sha256-rFboyIuU8HO5KImbbgYFRfa8YTOLS3SLXh4/cxCnSCE=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.12/groupfolders-v21.0.12.tar.gz",
+    "version": "21.0.12",
     "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-r7x9WkBAYw2KJ6D2FcLqbKHTHpVUP/z2eLjy4QorL7k=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.8/mail-v5.10.8.tar.gz",
-    "version": "5.10.8",
+    "hash": "sha256-XZlufroUCP7zmatKi6/lnaJ88lLIZlxQJi/bCeZLHM8=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.9/mail-v5.10.9.tar.gz",
+    "version": "5.10.9",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -310,9 +310,9 @@
     ]
   },
   "phonetrack": {
-    "hash": "sha256-d6vPKCJ1Us0zQIFkIlSQ5cmEgO1zXGtdDniIjfqGh28=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.2.0/phonetrack-1.2.0.tar.gz",
-    "version": "1.2.0",
+    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
+    "version": "1.3.1",
     "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
     "homepage": "https://github.com/julien-nc/phonetrack",
     "licenses": [
@@ -380,9 +380,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-MfqxhuPGUiKBP8a8yrzFWORaMxyOWRhkYPCPFDh2K/A=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v10.2.1/richdocuments-v10.2.1.tar.gz",
-    "version": "10.2.1",
+    "hash": "sha256-HAAbZuG6okWnNuqO6p+fD0bdnGv0wU3O73aHC6SEepE=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v10.3.0/richdocuments-v10.3.0.tar.gz",
+    "version": "10.3.0",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-/mnpEUfyhjGG31TKzFEfKUuzflPL+pGcf6PRbNnkaUE=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.3/release.tar.gz",
-    "version": "6.5.3",
+    "hash": "sha256-cLD6xYC3RJu2VmKjqsSA4YtFJZpORv1HpymFz0knkP8=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.4/release.tar.gz",
+    "version": "6.5.4",
     "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. Multiple claims (comma separated) also supported - groups will be merged.\nThe format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
@@ -400,9 +400,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-/katcYNLcsdnjHA+4ES+kdvhzuPNdDSv5Ann7X0+5xI=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.8/spreed-v23.0.8.tar.gz",
-    "version": "23.0.8",
+    "hash": "sha256-4wltvkDx1Dnt5ybKj850+dqr4jqkB0Jt3IU75dpirCA=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.9/spreed-v23.0.9.tar.gz",
+    "version": "23.0.9",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -410,9 +410,9 @@
     ]
   },
   "tables": {
-    "hash": "sha256-ZAvytGd4S5dMNLbWi2bURaBOZRGNk5F+vjqKmRfYSL0=",
-    "url": "https://github.com/nextcloud-releases/tables/releases/download/v2.2.0/tables-v2.2.0.tar.gz",
-    "version": "2.2.0",
+    "hash": "sha256-C4dCB4TV30L6KmD8oiMsblMibQEF5HbBVrRhCWuerEU=",
+    "url": "https://github.com/nextcloud-releases/tables/releases/download/v2.2.1/tables-v2.2.1.tar.gz",
+    "version": "2.2.1",
     "description": "Manage data the way you need it.\n\nWith this app you are able to create your own tables with individual columns. You can start with a template or from scratch and add your wanted columns.\nYou can choose from the following column types:\n- Text line or rich text\n- Link to urls or other nextcloud resources\n- Numbers\n- Progress bar\n- Stars rating\n- Yes/No tick\n- Date and/or time\n- (Multi) selection\n- Users, groups and teams\n\nShare your tables and views with users and groups within your cloud.\n\nHave a good time and manage whatever you want.",
     "homepage": "https://github.com/nextcloud/tables",
     "licenses": [
@@ -430,9 +430,9 @@
     ]
   },
   "theming_customcss": {
-    "hash": "sha256-Fgu31s+K4MFUgvNe9mAVHi9C0iJnv40v1onUMk+lFZk=",
-    "url": "https://github.com/nextcloud/theming_customcss/releases/download/v1.20.0/theming_customcss.tar.gz",
-    "version": "1.20.0",
+    "hash": "sha256-gJcQJv0tD7lykS+26cLr5zlujJjajNqITWmTv0ki2T0=",
+    "url": "https://github.com/nextcloud-releases/theming_customcss/releases/download/v1.21.0/theming_customcss-v1.21.0.tar.gz",
+    "version": "1.21.0",
     "description": "This app allows admins to customize the appearance of their Nextcloud instance by adding their own CSS rules.\n\nThe rules can be added in the admin settings in the \"Theming\" section. This allows you to easily adjust the look and feel of your Nextcloud instance without having to modify any files on the server.",
     "homepage": "",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/34.json b/pkgs/servers/nextcloud/packages/34.json
index cd8ae39f661c..73bdbf097e1c 100644
--- a/pkgs/servers/nextcloud/packages/34.json
+++ b/pkgs/servers/nextcloud/packages/34.json
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
-    "version": "0.11.8",
+    "hash": "sha256-AX48RNDRiIkl4OZU58S/jtMWBPkZuOPTLajs0PVjm4A=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.9/cookbook-0.11.9.tar.gz",
+    "version": "0.11.9",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -80,9 +80,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-xbXx5NDVnR/qFk+29yrWTfsZL/NTKfvLd1D0IGf9Ie4=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.18.2/deck-v1.18.2.tar.gz",
-    "version": "1.18.2",
+    "hash": "sha256-rMdFmPR+W47OIzwCinIpvDXhP4qlivep10c2jUSo5k0=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.18.3/deck-v1.18.3.tar.gz",
+    "version": "1.18.3",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "drawio": {
-    "hash": "sha256-nVcO2V0zo7VdL/o8c6IRbiIqFnGBH7NdqL/eefQ/ip0=",
-    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.3.0/drawio-v4.3.0.tar.gz",
-    "version": "4.3.0",
+    "hash": "sha256-VLG6dA0WwnImhNA+JtsS+NLVFxyD7UcxEdCu/zjNjtM=",
+    "url": "https://github.com/arnowelzel/drawio-nextcloud/releases/download/v4.3.5/drawio-v4.3.5.tar.gz",
+    "version": "4.3.5",
     "description": "Integrates the diagrams.net diagram editor with Nextcloud. Users can create and edit .drawio diagrams and .dwb whiteboards directly within the Nextcloud file manager.\n\n**Features:**\n\n- Create and edit diagrams and whiteboards from the Nextcloud \"+\" menu\n- Click any .drawio or .dwb file to open the editor inline\n- Autosave with optimistic conflict detection\n- Inline diagram previews in Text, Collectives, Talk, Notes, and Deck\n- Supports public share links (read-only and editable)\n- Offline mode for privacy-sensitive deployments\n- Configurable editor URL for self-hosted diagrams.net instances",
     "homepage": "https://github.com/arnowelzel/drawio-nextcloud",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "files_linkeditor": {
-    "hash": "sha256-WIOLA1J2aqMr5v3bZB3pRnF9bH1V0asGsMNTcetRsx8=",
-    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.25/files_linkeditor.tar.gz",
-    "version": "1.1.25",
+    "hash": "sha256-C0JWqDDnaG9eYOzaTGeEk6gIhOlXhc1A9dH0uFNo5uA=",
+    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.26/files_linkeditor.tar.gz",
+    "version": "1.1.26",
     "description": "### External web links in Nextcloud!\n* ✍️ **create and edit** .URL and .webloc links in the file view\n* 🌍 **open links** by clicking them and confirming you want to go to the external site\n* 📤 **works in public shares** so you can share links easily with others\n* 🔄 **sync your links** as .URL and .webloc are web links as created on most operating systems.\n\n_[View changelog](https://github.com/te-online/files_linkeditor/blob/main/CHANGELOG.md)_",
     "homepage": "https://github.com/te-online/files_linkeditor",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-vd6qwBAGUtm+Fbfc/Ei1mtmENX5Zvz5ZlW1MGggytJ0=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.4/forms-v5.3.4.tar.gz",
-    "version": "5.3.4",
+    "hash": "sha256-ismV8Hv6XrOF3ukbcewpOwZXo+nFFnS2tCdw0foUC8M=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.5/forms-v5.3.5.tar.gz",
+    "version": "5.3.5",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API_v3.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-TsxpVaJJtARyUwRu0h9ZpC1QYZ8Izikk8MgdEPXlUrw=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v22.0.3/groupfolders-v22.0.3.tar.gz",
-    "version": "22.0.3",
+    "hash": "sha256-yTcoP+JAq8SaLme7Aq8Usp4/p/oliQv6AL2cuqraeS8=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v22.0.5/groupfolders-v22.0.5.tar.gz",
+    "version": "22.0.5",
     "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-r7x9WkBAYw2KJ6D2FcLqbKHTHpVUP/z2eLjy4QorL7k=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.8/mail-v5.10.8.tar.gz",
-    "version": "5.10.8",
+    "hash": "sha256-XZlufroUCP7zmatKi6/lnaJ88lLIZlxQJi/bCeZLHM8=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.9/mail-v5.10.9.tar.gz",
+    "version": "5.10.9",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -300,9 +300,9 @@
     ]
   },
   "phonetrack": {
-    "hash": "sha256-d6vPKCJ1Us0zQIFkIlSQ5cmEgO1zXGtdDniIjfqGh28=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.2.0/phonetrack-1.2.0.tar.gz",
-    "version": "1.2.0",
+    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
+    "version": "1.3.1",
     "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
     "homepage": "https://github.com/julien-nc/phonetrack",
     "licenses": [
@@ -370,9 +370,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-GVK1v6DdskpMElqcKLEnmKY0oSY+iBNtMkSoZAjEyZY=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v11.0.1/richdocuments-v11.0.1.tar.gz",
-    "version": "11.0.1",
+    "hash": "sha256-ETUH7YCHCqHXz3pKs8bRGqnU0XiOqw+w4S9gz8oS2k8=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v11.1.0/richdocuments-v11.1.0.tar.gz",
+    "version": "11.1.0",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -380,9 +380,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-/mnpEUfyhjGG31TKzFEfKUuzflPL+pGcf6PRbNnkaUE=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.3/release.tar.gz",
-    "version": "6.5.3",
+    "hash": "sha256-cLD6xYC3RJu2VmKjqsSA4YtFJZpORv1HpymFz0knkP8=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.4/release.tar.gz",
+    "version": "6.5.4",
     "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. Multiple claims (comma separated) also supported - groups will be merged.\nThe format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-Mh59Quq8LORxUb2tZsKDxx+zz7HeSl+1lAFrnGf54Wc=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v24.0.2/spreed-v24.0.2.tar.gz",
-    "version": "24.0.2",
+    "hash": "sha256-YfObmXwsAAXOvTCNzjshQ9k1eLhvD0EQEM3bKtMdH5M=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v24.0.3/spreed-v24.0.3.tar.gz",
+    "version": "24.0.3",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -400,9 +400,9 @@
     ]
   },
   "tables": {
-    "hash": "sha256-ZAvytGd4S5dMNLbWi2bURaBOZRGNk5F+vjqKmRfYSL0=",
-    "url": "https://github.com/nextcloud-releases/tables/releases/download/v2.2.0/tables-v2.2.0.tar.gz",
-    "version": "2.2.0",
+    "hash": "sha256-C4dCB4TV30L6KmD8oiMsblMibQEF5HbBVrRhCWuerEU=",
+    "url": "https://github.com/nextcloud-releases/tables/releases/download/v2.2.1/tables-v2.2.1.tar.gz",
+    "version": "2.2.1",
     "description": "Manage data the way you need it.\n\nWith this app you are able to create your own tables with individual columns. You can start with a template or from scratch and add your wanted columns.\nYou can choose from the following column types:\n- Text line or rich text\n- Link to urls or other nextcloud resources\n- Numbers\n- Progress bar\n- Stars rating\n- Yes/No tick\n- Date and/or time\n- (Multi) selection\n- Users, groups and teams\n\nShare your tables and views with users and groups within your cloud.\n\nHave a good time and manage whatever you want.",
     "homepage": "https://github.com/nextcloud/tables",
     "licenses": [
@@ -419,6 +419,16 @@
       "agpl"
     ]
   },
+  "theming_customcss": {
+    "hash": "sha256-gJcQJv0tD7lykS+26cLr5zlujJjajNqITWmTv0ki2T0=",
+    "url": "https://github.com/nextcloud-releases/theming_customcss/releases/download/v1.21.0/theming_customcss-v1.21.0.tar.gz",
+    "version": "1.21.0",
+    "description": "This app allows admins to customize the appearance of their Nextcloud instance by adding their own CSS rules.\n\nThe rules can be added in the admin settings in the \"Theming\" section. This allows you to easily adjust the look and feel of your Nextcloud instance without having to modify any files on the server.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "twofactor_admin": {
     "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
     "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
diff --git a/shell.nix b/shell.nix
index 81ef55a637f3..e16b9caa950f 100644
--- a/shell.nix
+++ b/shell.nix
@@ -13,15 +13,10 @@
 #
 {
   system ? builtins.currentSystem,
-  nixpkgs ? null,
-}:
-let
-  version = builtins.readFile ./.version;
-
-  # On 26.05 we need a CI-pinned Nixpkgs revision that supports x86_64-darwin.
-  # TODO: remove after 26.05 support ends.
-  nixpkgs' =
-    if nixpkgs == null && system == "x86_64-darwin" && version == "26.05" then
+  nixpkgs ? (
+    # On 26.05 we need a CI-pinned Nixpkgs revision that supports x86_64-darwin.
+    # TODO: remove after 26.05 support ends.
+    if system == "x86_64-darwin" && (builtins.readFile ./.version) == "26.05" then
       let
         pinned = (builtins.fromJSON (builtins.readFile ./ci/pinned.json)).pins;
         warn = builtins.warn or (import ./lib).warn;
@@ -44,16 +39,11 @@ let
         sha256 = hash;
       }
     else
-      nixpkgs;
-
-  inherit
-    (import ./ci {
-      inherit system;
-      nixpkgs = nixpkgs';
-    })
-    pkgs
-    fmt
-    ;
+      null
+  ),
+}:
+let
+  inherit (import ./ci { inherit nixpkgs system; }) pkgs fmt;
 
   # For `nix-shell -A hello`
   curPkgs = removeAttrs (import ./. { inherit system; }) [