diff --git a/ci/OWNERS b/ci/OWNERS
index 0007efeffa1b..5cfeef8f144f 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -99,16 +99,16 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /maintainers/scripts/doc @jtojnar @ryantm
 
 # Contributor documentation
-/CONTRIBUTING.md @infinisil
-/.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
-/lib/README.md @infinisil
-/doc/README.md @infinisil
-/nixos/README.md @infinisil
-/pkgs/README.md @infinisil
-/pkgs/by-name/README.md @infinisil
-/maintainers/README.md @infinisil
+/CONTRIBUTING.md
+/.github/PULL_REQUEST_TEMPLATE.md
+/doc/contributing/
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar
+/lib/README.md
+/doc/README.md
+/nixos/README.md
+/pkgs/README.md
+/pkgs/by-name/README.md
+/maintainers/README.md
 
 # User-facing development documentation
 /doc/development.md @infinisil
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index eeccc42478b0..66fc8e7915b3 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -21,7 +21,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`.
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
@@ -105,3 +104,4 @@
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
+
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 26d7e7fa77b5..76bf3a20c3a3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4203,6 +4203,13 @@
     githubId = 18356186;
     name = "Gabriela Moreira";
   };
+  buggymcbugfix = {
+    email = "nix@vilem.net";
+    github = "buggymcbugfix";
+    matrix = "@buggymcbugfix:matrix.org";
+    githubId = 17603372;
+    name = "Vilem Liepelt";
+  };
   bugworm = {
     email = "bugworm@zoho.com";
     github = "bugworm";
@@ -9881,6 +9888,12 @@
     githubId = 3217744;
     name = "Peter Ferenczy";
   };
+  ghastrum = {
+    name = "Dennis Malmin";
+    email = "dennis.malmin@tuta.com";
+    github = "Ghastrum";
+    githubId = 276720856;
+  };
   ghostbuster91 = {
     name = "Kasper Kondzielski";
     email = "kghost0@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 976aef73b635..9f24254da7fa 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -64,6 +64,8 @@
 
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
+- The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
+
 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
   This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
   This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 393871ba3525..76c1100f5e12 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1062,12 +1062,16 @@ class QemuMachine(BaseMachine):
             assert self.shell
 
             tic = time.time()
-            # TODO: do we want to bail after a set number of attempts?
-            while not shell_ready(timeout_secs=30):
+
+            for _ in range(10):
+                if shell_ready(timeout_secs=30):
+                    break
                 self.log("Guest root shell did not produce any data yet...")
                 self.log(
                     "  To debug, enter the VM and run 'systemctl status backdoor.service'."
                 )
+            else:
+                raise RuntimeError("Shell did not start in time")
 
             while True:
                 chunk = self.shell.recv(1024)
@@ -1629,7 +1633,7 @@ class NspawnMachine(BaseMachine):
         # NOTE If the test calls switch-to-configuration (with a differently configured specialization)
         # this will use the /etc/profile of the new specialisation while `QemuMachine` nodes
         # will continue to use the original /etc/profile.
-        command = f"set -eo pipefail; source /etc/profile; set -u; {command}"
+        command = f"set -eo pipefail; USER=root HOME=/root source /etc/profile; set -u; {command}"
 
         cp = subprocess.run(
             [
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 570b854d8e28..86d65faf21ad 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -135,8 +135,13 @@ let
       );
       udevRules = map (
         interface:
-        # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
-        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"''
+        lib.concatStringsSep ", " [
+          ''SUBSYSTEM=="net"''
+          ''ACTION=="add"''
+          # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
+          ''ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}"''
+          ''NAME="${interface.name}"''
+        ]
       ) interfaces;
     in
     {
diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index df4165fbbec5..05f99aff70f4 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -74,7 +74,9 @@ in
           }
           (
             ''
+              set +e
               mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+              set -e
               if [[ -z "$mmap_rnd_bits_max" ]]; then
                 echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid."
                 exit 1
@@ -83,7 +85,9 @@ in
             ''
             # HAVE_ARCH_MMAP_RND_COMPAT_BITS is not defined on 32-bit architectures or LoongArch64
             + lib.optionalString (with pkgs.stdenv.hostPlatform; (!is32bit && !isLoongArch64)) ''
+              set +e
               mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+              set -e
               if [[ -z "$mmap_rnd_compat_bits_max" ]]; then
                 echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid."
                 exit 1
diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix
index 5776c8ede413..c014f00da605 100644
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@@ -187,6 +187,7 @@ in
 
     environment.pathsToLink = [
       "/bin"
+      "/etc/xdg"
       "/etc/gtk-2.0"
       "/etc/gtk-3.0"
       "/lib" # FIXME: remove and update debug-info.nix
diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix
index a266b046de1a..46c90ae1793a 100644
--- a/nixos/modules/config/xdg/autostart.nix
+++ b/nixos/modules/config/xdg/autostart.nix
@@ -22,6 +22,8 @@
   };
 
   config = {
+    # FIXME this does not actually work because "/etc/xdg" is linked
+    # unconditionally in `nixos/modules/config/system-path.nix`
     environment.pathsToLink = lib.mkIf config.xdg.autostart.install [
       "/etc/xdg/autostart"
     ];
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9e3d2f772b48..507eeb3a9ff0 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -387,6 +387,7 @@
   ./programs/zsh/zsh-syntax-highlighting.nix
   ./programs/zsh/zsh.nix
   ./rename.nix
+  ./security/account-utils.nix
   ./security/acme
   ./security/agnos.nix
   ./security/apparmor.nix
diff --git a/nixos/modules/profiles/bashless.nix b/nixos/modules/profiles/bashless.nix
index 501563b97b3d..20f2f7256f07 100644
--- a/nixos/modules/profiles/bashless.nix
+++ b/nixos/modules/profiles/bashless.nix
@@ -15,8 +15,6 @@
   environment.corePackages = lib.mkForce [ ];
   # Contains bash completions
   nix.enable = lib.mkDefault false;
-  # The fuse{,3} package contains a runtime dependency on bash.
-  programs.fuse.enable = lib.mkDefault false;
   documentation.man.man-db.enable = lib.mkDefault false;
   # autovt depends on bash
   console.enable = lib.mkDefault false;
diff --git a/nixos/modules/programs/appimage.nix b/nixos/modules/programs/appimage.nix
index c0379557c97a..4662a6c3d8cc 100644
--- a/nixos/modules/programs/appimage.nix
+++ b/nixos/modules/programs/appimage.nix
@@ -43,6 +43,8 @@ in
       }
     );
     environment.systemPackages = [ cfg.package ];
+
+    programs.fuse.enable = true;
   };
 
   meta.maintainers = with lib.maintainers; [
diff --git a/nixos/modules/programs/fuse.nix b/nixos/modules/programs/fuse.nix
index e7e317d7ef9b..07026cbd33db 100644
--- a/nixos/modules/programs/fuse.nix
+++ b/nixos/modules/programs/fuse.nix
@@ -12,9 +12,7 @@ in
   meta.maintainers = [ ];
 
   options.programs.fuse = {
-    enable = lib.mkEnableOption "fuse" // {
-      default = true;
-    };
+    enable = lib.mkEnableOption "fuse";
 
     mountMax = lib.mkOption {
       # In the C code it's an "int" (i.e. signed and at least 16 bit), but
diff --git a/nixos/modules/security/account-utils.nix b/nixos/modules/security/account-utils.nix
new file mode 100644
index 000000000000..bd2bf08f55b2
--- /dev/null
+++ b/nixos/modules/security/account-utils.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.security.account-utils;
+in
+{
+  options.security.account-utils = {
+    enable = lib.mkEnableOption "the account-utils implementation of Unix user authentication and management";
+    package = lib.mkPackageOption pkgs "account-utils" { };
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.nonEmptyStr;
+      default = [ ];
+      example = [
+        "--debug"
+        "-v"
+      ];
+      description = ''
+        List of arguments to pass to the socket activated service executables.
+        ::: {.note}
+        This is passed to both pwupdd and pwaccessd, which support identical flags.
+        :::
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # use account-utils reimplementation of pam_unix
+    security.pam = {
+      pam_unixModulePath = "${cfg.package}/lib/security/pam_unix_ng.so";
+      enableLegacySettings = false;
+    };
+
+    systemd = {
+      packages = [ cfg.package ];
+      sockets.pwaccessd.wantedBy = [ "sockets.target" ];
+      sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating
+      sockets.newidmapd.wantedBy = [ "sockets.target" ];
+      services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+    };
+
+    environment.systemPackages = [ cfg.package ];
+
+    security.pam.services = {
+      pwupd-passwd = { };
+      pwupd-chsh = { };
+      pwupd-chfn = { };
+    };
+
+    # covered by account-utils via socket-activated service
+    security.wrappers = {
+      # shadow suid binaries are no longer necessary, but disabling the entire shadow module is too intrusive
+      newuidmap.enable = false;
+      newgidmap.enable = false;
+      chsh.enable = false;
+      passwd.enable = false;
+
+      unix_chkpwd.enable = false; # Not necessary when using pam_unix_ng.so
+    };
+  };
+}
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 586ae6fd9ede..7d924bff8ca1 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -1008,7 +1008,7 @@ let
               {
                 name = "unix";
                 control = "required";
-                modulePath = "${package}/lib/security/pam_unix.so";
+                modulePath = config.security.pam.pam_unixModulePath;
               }
               # pam_slurm_adopt must be the last module in the account stack.
               {
@@ -1217,11 +1217,11 @@ let
                       name = "unix-early";
                       enable = cfg.unixAuth;
                       control = "optional";
-                      modulePath = "${package}/lib/security/pam_unix.so";
+                      modulePath = config.security.pam.pam_unixModulePath;
                       settings = {
                         nullok = cfg.allowNullPassword;
                         inherit (cfg) nodelay;
-                        likeauth = true;
+                        likeauth = lib.mkIf config.security.pam.enableLegacySettings true;
                       };
                     }
                     {
@@ -1315,11 +1315,11 @@ let
                   name = "unix";
                   enable = cfg.unixAuth;
                   control = "sufficient";
-                  modulePath = "${package}/lib/security/pam_unix.so";
+                  modulePath = config.security.pam.pam_unixModulePath;
                   settings = {
                     nullok = cfg.allowNullPassword;
                     inherit (cfg) nodelay;
-                    likeauth = true;
+                    likeauth = lib.mkIf config.security.pam.enableLegacySettings true;
                     try_first_pass = true;
                   };
                 }
@@ -1404,10 +1404,10 @@ let
               {
                 name = "unix";
                 control = "sufficient";
-                modulePath = "${package}/lib/security/pam_unix.so";
+                modulePath = config.security.pam.pam_unixModulePath;
                 settings = {
                   nullok = true;
-                  yescrypt = true;
+                  yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
                 };
               }
               {
@@ -1493,7 +1493,7 @@ let
               {
                 name = "unix";
                 control = "required";
-                modulePath = "${package}/lib/security/pam_unix.so";
+                modulePath = config.security.pam.pam_unixModulePath;
               }
               {
                 name = "loginuid";
@@ -1860,6 +1860,14 @@ in
 
     security.pam.package = lib.mkPackageOption pkgs "pam" { };
 
+    security.pam.pam_unixModulePath = lib.mkOption {
+      type = lib.types.pathInStore;
+      default = "${package}/lib/security/pam_unix.so";
+      defaultText = "\${config.security.pam.package}/lib/security/pam_unix.so";
+      description = "The pam_unix module to use in all the default pam services.";
+      internal = true;
+    };
+
     security.pam.loginLimits = lib.mkOption {
       default = [ ];
       type = limitsType;
@@ -1904,6 +1912,19 @@ in
       '';
     };
 
+    security.pam.enableLegacySettings = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = ''
+        Alternative implementations of pam_unix may not support all legacy arguments.
+        This option will disable all known legacy settings.
+        ::: {.note}
+        Setting this option to false will omit arguments, such as `yescrypt`.
+        Doing so is only safe if the defaults used by pam_unix are sensible.
+        :::
+      '';
+    };
+
     security.pam.makeHomeDir.skelDirectory = lib.mkOption {
       type = lib.types.str;
       default = "/var/empty";
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index c31b6b7ebbf8..cfd7c8c76af3 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -662,11 +662,6 @@ in
                 ) | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
-              # Secure root@localhost for MySQL/Percona on first initialization
-              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
-                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
-              ''}
-
               ${lib.optionalString (cfg.initialScript != null) ''
                 # Execute initial script
                 # using toString to avoid copying the file to nix store if given as path instead of string,
@@ -674,6 +669,11 @@ in
                 cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
               rm ${cfg.dataDir}/mysql_init
           fi
 
diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index 3d367f01defe..14fdda18c235 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -124,16 +124,7 @@ in
       };
     };
 
-    systemd = {
-      packages = [ pkgs.cosmic-session ];
-      user.targets = {
-        # TODO: remove when upstream has XDG autostart support
-        cosmic-session = {
-          wants = [ "xdg-desktop-autostart.target" ];
-          before = [ "xdg-desktop-autostart.target" ];
-        };
-      };
-    };
+    systemd.packages = [ pkgs.cosmic-session ];
 
     fonts.packages = with pkgs; [
       fira
diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index 0813b1b6b84c..f6106d3e83fe 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -274,6 +274,7 @@ in
 
     services.power-profiles-daemon.enable = mkDefault true;
     services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
+    programs.fuse.enable = true;
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.libinput.enable = mkDefault true;
diff --git a/nixos/modules/services/desktops/flatpak.nix b/nixos/modules/services/desktops/flatpak.nix
index 5756738c9fda..e874cbac7a4f 100644
--- a/nixos/modules/services/desktops/flatpak.nix
+++ b/nixos/modules/services/desktops/flatpak.nix
@@ -40,6 +40,8 @@ in
       pkgs.fuse3
     ];
 
+    programs.fuse.enable = true;
+
     security.polkit.enable = true;
 
     fonts.fontDir.enable = true;
diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix
index 004810327798..cebfb0820229 100644
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@@ -40,6 +40,8 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
+    programs.fuse.enable = true;
+
     services.dbus.packages = [ cfg.package ];
 
     systemd.packages = [ cfg.package ];
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/bind.nix b/nixos/modules/services/monitoring/prometheus/exporters/bind.nix
index 3390374172c4..935ebff7e5bd 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/bind.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/bind.nix
@@ -17,7 +17,7 @@ in
       type = types.str;
       default = "http://localhost:8053/";
       description = ''
-        HTTP XML API address of an Bind server.
+        HTTP API address of a BIND server.
       '';
     };
     bindTimeout = mkOption {
@@ -29,13 +29,14 @@ in
     };
     bindVersion = mkOption {
       type = types.enum [
-        "xml.v2"
+        "json"
+        "xml"
         "xml.v3"
         "auto"
       ];
-      default = "auto";
+      default = "json";
       description = ''
-        BIND statistics version. Can be detected automatically.
+        BIND statistics version. Defaults to JSON.
       '';
     };
     bindGroups = mkOption {
diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
index 3c75423f3ffa..4e676b80a1aa 100644
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@@ -332,8 +332,9 @@ in
     boot.kernel.sysctl."net.core.rmem_max" = lib.mkDefault 7500000;
     boot.kernel.sysctl."net.core.wmem_max" = lib.mkDefault 7500000;
 
-    programs.fuse = lib.mkIf (cfg.autoMount && cfg.settings.Mounts.FuseAllowOther) {
-      userAllowOther = true;
+    programs.fuse = {
+      enable = lib.mkIf cfg.autoMount true;
+      userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
     };
 
     users.users = lib.mkIf (cfg.user == "ipfs") {
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index b53365ff26cf..311bf9cc9aa1 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -124,6 +124,16 @@ let
   jobScripts = concatLists (
     mapAttrsToList (_: unit: unit.jobScripts or [ ]) (filterAttrs (_: v: v.enable) cfg.services)
   );
+  unitEnv = pkgs.buildEnv {
+    name = "initrd-unit-env";
+    paths = concatLists (
+      mapAttrsToList (_: unit: unit.path or [ ]) (filterAttrs (_: v: v.enable) cfg.services)
+    );
+    pathsToLink = [
+      "/bin"
+      "/sbin"
+    ];
+  };
 
   stage1Units = generateUnits {
     type = "initrd";
@@ -636,6 +646,7 @@ in
         "${pkgs.bashNonInteractive}/bin"
       ]
       ++ jobScripts
+      ++ [ unitEnv ]
       ++ map (c: removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents)
       ++ lib.optional (pkgs.stdenv.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
 
diff --git a/nixos/modules/tasks/filesystems/sshfs.nix b/nixos/modules/tasks/filesystems/sshfs.nix
index f070779ecc54..917ceea7b691 100644
--- a/nixos/modules/tasks/filesystems/sshfs.nix
+++ b/nixos/modules/tasks/filesystems/sshfs.nix
@@ -10,6 +10,8 @@
     lib.mkIf
       (config.boot.supportedFilesystems.sshfs or config.boot.supportedFilesystems."fuse.sshfs" or false)
       {
+        programs.fuse.enable = true;
+
         system.fsPackages = [ pkgs.sshfs ];
       };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a9412a693d82..80f16c0d0072 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -942,6 +942,7 @@ in
   localsend = runTest ./localsend.nix;
   locate = runTest ./locate.nix;
   login = runTest ./login.nix;
+  login-nosuid = runTest ./login-nosuid.nix;
   logkeys = runTest ./logkeys.nix;
   logrotate = runTest ./logrotate.nix;
   loki = runTest ./loki.nix;
diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix
index d0e5df5e40b5..763e1c1407fa 100644
--- a/nixos/tests/gocryptfs.nix
+++ b/nixos/tests/gocryptfs.nix
@@ -13,6 +13,8 @@
         pkgs.openssl
       ];
 
+      programs.fuse.enable = true;
+
       specialisation.fstab-test.configuration = {
         # This can't be fileSytems, as the qemu machinery doesn't honor it.
         virtualisation.fileSystems."/plain" = {
diff --git a/nixos/tests/login-nosuid.nix b/nixos/tests/login-nosuid.nix
new file mode 100644
index 000000000000..1f00c37d0886
--- /dev/null
+++ b/nixos/tests/login-nosuid.nix
@@ -0,0 +1,105 @@
+{
+  name = "login-nosuid";
+  meta = {
+    maintainers = [ ];
+  };
+
+  # node.pkgsReadOnly = false; # needed when overriding pam to debug mode
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      security.enableWrappers = false;
+      systemd.settings.Manager.NoNewPrivileges = true;
+      security.account-utils.enable = true;
+      users.mutableUsers = true;
+      security.account-utils.extraArgs = [
+        "-v"
+        "--debug"
+      ];
+      security.loginDefs.chfnRestrict = "f"; # allow allice to change name
+
+      environment.systemPackages = [
+        pkgs.which
+        pkgs.fish # environment.shells does not actually link fish to /run/current-system/sw/bin, causing chsh to fail unexpectedly
+      ];
+      environment.shells = [ pkgs.fish ];
+
+      # pam debug without giant rebuild
+      # system.replaceDependencies.replacements = [
+      #   {
+      #     oldDependency = pkgs.linux-pam;
+      #     newDependency = pkgs.linux-pam.override { debugMode = true; };
+      #   }
+      # ];
+    };
+
+  testScript = ''
+    machine.start(allow_reboot = True)
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("account-utils passwd has priority"):
+        passwd_path = machine.succeed("realpath $(which passwd)")
+        print(f"passwd path is: {passwd_path}")
+        assert "account-utils" in passwd_path
+
+    with subtest("create user"):
+        machine.succeed("useradd -m alice")
+        machine.succeed("(echo foobar; echo foobar) | passwd alice")
+
+    with subtest("Check whether switching VTs works"):
+        machine.fail("pgrep -f 'agetty.*tty2'")
+        machine.send_key("alt-f2")
+        machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+        machine.wait_for_unit("getty@tty2.service")
+        machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+
+    with subtest("Log in as alice on a virtual console"):
+        machine.wait_until_tty_matches("2", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("2", "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.sleep(1) # something is racy here, so lets just sleep a bit... Not great, but seems to work
+        machine.send_chars("foobar\n")
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.send_chars("touch done\n")
+        machine.wait_for_file("/home/alice/done")
+
+    with subtest("Systemd gives and removes device ownership as needed"):
+        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
+        machine.send_key("alt-f1")
+        machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
+        machine.fail("getfacl /dev/snd/timer | grep -q alice")
+        machine.succeed("chvt 2")
+        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
+
+    with subtest("User can change their login shell"):
+        machine.send_chars("clear\n") # remove previous password prompts
+        machine.send_chars("chsh -s /run/current-system/sw/bin/fish\n")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_fails("pgrep pwupdd")
+        login_shell = machine.succeed("getent passwd alice | cut -d: -f7").strip()
+        print(f"login shell of user alice: {login_shell}")
+        assert "/run/current-system/sw/bin/fish" == login_shell
+
+    with subtest("User can change their name"):
+        machine.send_chars("clear\n") # remove previous password prompts
+        machine.send_chars("chfn -f 'Alice in Wonderland'\n")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_fails("pgrep pwupdd")
+        full_name = machine.succeed("getent passwd alice | cut -d: -f5").strip()
+        print(f"full name of user alice: {full_name}")
+        assert "Alice in Wonderland" == full_name
+
+    with subtest("Virtual console logout"):
+        machine.send_chars("exit\n")
+        machine.wait_until_fails("pgrep -u alice bash")
+        machine.screenshot("getty")
+  '';
+}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index b1033987565a..990dc02a5ab8 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -111,7 +111,7 @@ let
           wait_for_unit("prometheus-bind-exporter.service")
           wait_for_open_port(9119)
           succeed(
-              "curl -sSf http://localhost:9119/metrics | grep 'bind_query_recursions_total 0'"
+              "curl -sSf http://localhost:9119/metrics | grep 'bind_up 1'"
           )
         '';
       };
diff --git a/nixos/tests/simple-container.nix b/nixos/tests/simple-container.nix
index 269853423651..5cd3478f3d40 100644
--- a/nixos/tests/simple-container.nix
+++ b/nixos/tests/simple-container.nix
@@ -1,11 +1,16 @@
 {
   name = "simple-container";
 
-  containers.machine = { };
+  containers = {
+    machine = { pkgs, ... }: {
+      users.users.root.packages = [ pkgs.hello ];
+    };
+    noprofile = { };
+  };
 
   testScript = ''
     start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.shutdown()
+    machine.succeed("hello")
+    noprofile.fail("hello")
   '';
 }
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 2dbc9386f8ae..b81d84086f2e 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -43,6 +43,19 @@ let
             server.serve_forever()
       '';
 
+  # Per-connection (Accept=yes) socket-activated service that requires the
+  # connection socket to be passed via socket activation and fails when started
+  # without one. It greets the client and stays alive for as long as the
+  # connection is held open.
+  acceptSocketTest = pkgs.writeShellScript "accept-socket-test.sh" ''
+    if [ "''${LISTEN_FDS:-0}" -lt 1 ]; then
+      echo "Expected exactly one socket, got 0" >&2
+      exit 4
+    fi
+    printf hello >&3
+    exec ${lib.getExe' pkgs.coreutils "cat"} <&3 >/dev/null
+  '';
+
 in
 {
   name = "switch-test";
@@ -508,6 +521,32 @@ in
             };
           };
 
+          accept-socket.configuration = {
+            systemd.sockets.accept-socket = {
+              wantedBy = [ "sockets.target" ];
+              listenStreams = [ "/run/accept-test.sock" ];
+              socketConfig = {
+                Accept = "yes";
+                SocketMode = "0777";
+              };
+            };
+            systemd.services."accept-socket@" = {
+              description = "A per-connection socket-activated service";
+              serviceConfig.ExecStart = acceptSocketTest;
+            };
+          };
+
+          accept-socket-service-modified.configuration = {
+            imports = [ accept-socket.configuration ];
+            systemd.services."accept-socket@".serviceConfig.X-Test = "test";
+          };
+
+          socket-activated-without-socket.configuration = {
+            imports = [ simple-socket.configuration ];
+            systemd.sockets.socket-activated.enable = false;
+            systemd.services.socket-activated.wantedBy = [ "multi-user.target" ];
+          };
+
           mount.configuration = {
             systemd.mounts = [
               {
@@ -1587,6 +1626,49 @@ in
           if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
               raise Exception("Socket was not properly activated after the service was restarted")
 
+          # A service transitioning to socket activation is not started directly,
+          # it's left for the newly started socket to activate on demand
+          switch_to_specialisation("${machine}", "socket-activated-without-socket")
+          machine.succeed("systemctl is-active socket-activated.service")
+          out = switch_to_specialisation("${machine}", "simple-socket-stop-if-changed")
+          assert_contains(out, "stopping the following units: socket-activated.service\n")
+          assert_lacks(out, "\nstarting the following units:")
+          assert_contains(out, "the following new units were started: socket-activated.socket\n")
+          machine.succeed("[ -S /run/test.sock ]")
+          if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
+              raise Exception("Socket was not properly activated after the transition")
+
+      with subtest("socket-activated services with Accept=yes"):
+          # Socket-activated services don't get started, just the socket
+          machine.fail("[ -S /run/accept-test.sock ]")
+          out = switch_to_specialisation("${machine}", "accept-socket")
+          assert_contains(out, "the following new units were started: accept-socket.socket\n")
+          machine.succeed("[ -S /run/accept-test.sock ]")
+
+          # Hold a connection open so a per-connection instance keeps running
+          machine.succeed("socat EXEC:'sleep infinity' UNIX-CONNECT:/run/accept-test.sock >&2 &")
+          instance = machine.wait_until_succeeds(
+              "systemctl list-units --no-legend --state=running 'accept-socket@*.service' "
+              + "| grep -m1 -o 'accept-socket@[^ ]*\\.service'"
+          ).strip()
+
+          # Changing the templated service must stop the running instance and
+          # restart the socket instead of (re)starting the per-connection
+          # instance, which cannot be started without a connection socket
+          out = switch_to_specialisation("${machine}", "accept-socket-service-modified")
+          assert_contains(out, "stopping the following units:")
+          assert_contains(out, instance)
+          assert_contains(out, "accept-socket.socket")
+          assert_contains(out, "\nstarting the following units: accept-socket.socket\n")
+          assert_lacks(out, "NOT restarting the following changed units:")
+          assert_lacks(out, "\nrestarting the following units:")
+          # The per-connection instance must not be (re)started
+          starting = out[out.index("\nstarting the following units:") :]
+          assert instance not in starting, f"instance {instance} should not be (re)started"
+          # Socket-activation of the unit still works
+          if machine.succeed("socat - UNIX-CONNECT:/run/accept-test.sock </dev/null") != "hello":
+              raise Exception("Socket was not properly activated after the service was changed")
+
       with subtest("mounts"):
           switch_to_specialisation("${machine}", "mount")
           out = machine.succeed("mount | grep 'on /testmount'")
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 01037d6d0d17..794db4af5815 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-TEEv8R6VXuOhcX2OgTKY7A8L2akisJLsx6I6bUdV3a0=";
+          hash = "sha256-/ns84fHAyTY7sSvhUNzq1XQYq2Xy303zs2BxJY8DBVA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-wis4QqTuCiRAVpoGp+Ds83lWPsNUUPmXbZcYiWuY2zg=";
+          hash = "sha256-U69X5lpeJaeNVL4WWzCUpI6IfbKSJXGpl30AYnx1fBQ=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-2njmUMYxFAaKzCdwM//S5D0fqVZhIKG0JzbT1ye4Sr4=";
+          hash = "sha256-DHE09NtGNOjB0HdBqTKRtDsZXpxb651kiVGhRwO1tBU=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-+cJhcXufpiNrpdL+HH3mW+rrzb7Si/4LGvoce1o0c/w=";
+          hash = "sha256-5YIZVBMsoF0bWP27sVEVHAaAiqvmoSUgdbc8wsqUCLA=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.186";
+      version = "2.1.187";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index e1536e274d85..cf56b95d8026 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "c0f2cf4319d6c77d577599906ca0a90627a3afc8";
-    hash = "sha256-ie0mP7IcvWsFX/k0UhJ6eMkdyDq69W8aCcjwkAoL5II=";
+    rev = "59ab660649d933f40cf281656ba949eb4c835d73";
+    hash = "sha256-Hwav4vHppInUUbiSch3J84P7HIYkQ+DM431fFdq1qEg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ac/account-utils/package.nix b/pkgs/by-name/ac/account-utils/package.nix
new file mode 100644
index 000000000000..c0df5e64109d
--- /dev/null
+++ b/pkgs/by-name/ac/account-utils/package.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  linux-pam,
+  systemdLibs,
+  libcap,
+  libxcrypt,
+  libeconf,
+  libselinux,
+  docbook-xsl-ns,
+  libxslt,
+  nixosTests,
+}:
+let
+  selinuxSupport = lib.meta.availableOn stdenv.hostPlatform libselinux;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "account-utils";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "thkukuk";
+    repo = "account-utils";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9l+y7FLb0IZXXp4RstlhNR6yA7b4b831obFuiVtO9+k=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    libxslt
+    docbook-xsl-ns
+  ];
+
+  buildInputs = [
+    linux-pam
+    systemdLibs
+    libxcrypt
+    libeconf
+    libcap
+  ]
+  ++ lib.optional selinuxSupport libselinux;
+
+  mesonFlags = [
+    (lib.mesonEnable "selinux" selinuxSupport)
+    (lib.mesonOption "c_args" "-ffat-lto-objects")
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) login-nosuid;
+  };
+
+  meta = {
+    description = "Services, utilities and PAM modules, which allow authentication and account management on systems with the NoNewPrivs flag set (no setuid/setgid binaries)";
+    homepage = "https://github.com/thkukuk/account-utils";
+    changelog = "https://github.com/thkukuk/account-utils/releases/tag/v${finalAttrs.version}";
+    license =
+      with lib.licenses;
+      AND [
+        gpl2Plus
+        lgpl21Plus
+        bsd2
+      ];
+    maintainers = with lib.maintainers; [ grimmauld ];
+    platforms = lib.platforms.linux;
+    # take precedence over shadow
+    priority = -1;
+  };
+})
diff --git a/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix b/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix
index ba4df31df4ea..f52781a1dbe2 100644
--- a/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix
@@ -9,13 +9,13 @@
 let
   alsa-ucm-conf-asahi = stdenvNoCC.mkDerivation (finalAttrs: {
     pname = "alsa-ucm-conf-asahi";
-    version = "8";
+    version = "9";
 
     src = fetchFromGitHub {
       owner = "AsahiLinux";
       repo = "alsa-ucm-conf-asahi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-FPrAzscc1ICSCQSqULaGLqG4UCq8GZU9XLV7TUSBBRM=";
+      hash = "sha256-F+NiEP4EKLUVV2oHSVY+fkXlzXcLyywNOolUy9DO8sI=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/ap/apm-cli/package.nix b/pkgs/by-name/ap/apm-cli/package.nix
index d04b256b65e9..4730ddb4720a 100644
--- a/pkgs/by-name/ap/apm-cli/package.nix
+++ b/pkgs/by-name/ap/apm-cli/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "apm-cli";
-  version = "0.18.0";
+  version = "0.21.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "microsoft";
     repo = "apm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mHu5r08y3OUTJjnl5Xvb23yhoJu9DupoZhkhL74K6UE=";
+    hash = "sha256-Wotyqsg/1nbjttMk+4wpGK76+kaL7j6oMH61NwsTuNc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/as/asahi-audio/package.nix b/pkgs/by-name/as/asahi-audio/package.nix
index edfe3364b1ba..c256a4221570 100644
--- a/pkgs/by-name/as/asahi-audio/package.nix
+++ b/pkgs/by-name/as/asahi-audio/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "asahi-audio";
-  version = "3.4";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "asahi-audio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7AuPkR/M1a4zB9+dJuOuv9uTp+kIqPlxVOXipsyGGz8=";
+    hash = "sha256-Tp+yL7SbzowYcCrfI7UU+5GeIJtyBMuE7KhcYmA1+hw=";
   };
 
   makeFlags = [
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 4196aae7a9ee..c539c185124a 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,13 +18,13 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.39.7";
+  version = "1.39.8";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-E4TR5deuPSf2YinrEzpP79Rq8zZHLJQUKiEsfUdMDOE=";
+    hash = "sha256-8S83CTd/td7USKxfCI0cXd2gPBMivi4QMRQwVgxhs6w=";
   };
 
   npmDepsHash = "sha256-humpJB+fv3+PITcPCz3uY2jNANb3P7sXy0lFP8Eg58I=";
diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index 2f12ebf30ea0..1da6cba11479 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -9,6 +9,7 @@
   libidn2,
   libtool,
   libxml2,
+  json_c,
   openssl,
   liburcu,
   libuv,
@@ -29,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.23";
+  version = "9.20.24";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XUR1rtP55QDvVUsrFNlyvbg9M94hSps76SkY6kaQg3E=";
+    hash = "sha256-mJ/vH8iOpZ0EzYb4VNylpGFqIKmWi83ePBo2aKs2vgg=";
   };
 
   outputs = [
@@ -59,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     libidn2
     libtool
     libxml2
+    json_c
     openssl
     liburcu
     libuv
diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix
index 0652939fdc29..0205b58df2db 100644
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2026.6.0";
+  version = "2026.6.1";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -60,23 +60,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        hash = "sha256-JPhh7LNiLZXLN5iycNobZ/uJQjOhKqqYSw9P78+/BKk=";
+        hash = "sha256-doeqXoS0B7AyzyhkLB9wUC6iuD0c2KIhAIEPeYaDC5E=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        hash = "sha256-uoqUDJ/bexqaRlf5Y692OGm91W1ErlS8Q8/l9MlsHwU=";
+        hash = "sha256-bQWhiSw9/gGyGoLEyz6BHaRPNLxuqouiobBMfB5ytYk=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        hash = "sha256-kL9s17Bnt8UYj3IiX2b7e3OWSsRLq5TSzdK6OdByD40=";
+        hash = "sha256-B+rhmnM2sVICVLDcYq2OEp402Wz6kywCRqeS95Vdzlw=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        hash = "sha256-p9D87uaDVu25SG4cclmzaq9oKaFDlIy8/XLx3rHuIQ4=";
+        hash = "sha256-Ofs9raAtx/duS8dXWfvjKGzhJr3j9+gkH8lP/VLfnkE=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        hash = "sha256-ppCSvk259NNlujl9olyRlmwRdNbLu/uRs+gq71S79B8=";
+        hash = "sha256-+rMiD/vFFIA8dR3quUnpr8uDNTdvnXyYjT8brgiOxBI=";
       };
     };
 
diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix
index 3c990477451a..3b8b4081ba7d 100644
--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.5001";
+  version = "0.4.5006";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
+    hash = "sha256-Jb2qAB6P5KlRu4L99fcK/v0/Fspr8IFaFXuYg+PBxhM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
+    hash = "sha256-YfwoUkTJJ2qANqwtSWKDGfFmahAtIDNyYFwCUE72oB0=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index a9a23a745d73..d92c820fce8a 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.186",
-  "commit": "6a56aff51d9e9faf62f26f2748501c2e32eec5e8",
-  "buildDate": "2026-06-22T16:51:01Z",
+  "version": "2.1.187",
+  "commit": "6a53320fad5541a68d79e4b6c53677df77b98e33",
+  "buildDate": "2026-06-23T17:07:42Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "463a79cc34a9787cff1b3361b4ec9e2dff928c18b077f41f0bb412e4cda78637",
-      "size": 216811232
+      "checksum": "a59a16ba4922adab7a145728f215d042184d349f5f7e72cddb7fc114250a4ce3",
+      "size": 215994048
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "9e17e23d451cbbc64cf4b9536c1d25efd86808512617c855091fa608f77c9899",
-      "size": 224349952
+      "checksum": "7f57b6935b4246d03cb7acee90dc22153083483a267da589c5c920dd04744c36",
+      "size": 224795776
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "817e5ff483568b78c49171be317b9b9190cade77248a5776e912789312961cb6",
-      "size": 231782112
+      "checksum": "b49be8a5e565bf2d45b50d2de62017b25462131acc9425d2fdb98b8f29c9dce2",
+      "size": 232240864
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "6a6d5d23486597c93138941c9b68caa0fbcd2dcedbf49e29a9c8d83e3a1cb329",
-      "size": 234436392
+      "checksum": "bb02fcb33626f8c599d10d8bee38585d4cf8d4225c3b497869dee7454e7bf361",
+      "size": 234874664
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "24906d06ab4cf312eb30a8d656a8d8c7fb22099ea8eb974e38ecfbc25d6631aa",
-      "size": 225161416
+      "checksum": "972fc2e0bc8104edb593ce7723d4414c0ed8e4df6d90ad26ae48097b1d910478",
+      "size": 225620168
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "d0cb255cfb03513f6099af40f045b5852a1d8a1b59d0f405d84d2a01da6c9598",
-      "size": 229420432
+      "checksum": "c5a783d13aac71d42324f2e9dcd395c266bd5774951faf0d94855c737024bee3",
+      "size": 229858704
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6a286f0795d6dd46187b86e9124f819af35319169901cd883b80a75c47469516",
-      "size": 225908896
+      "checksum": "24964d08c5100bac6071352e5837101b333de1c1afefd2b8b0e7a60db6c0ef5c",
+      "size": 226329760
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "245869d5e5242aabfde49b091628aa4b3e7546f2cac52e1d6feb221a820910bc",
-      "size": 220571808
+      "checksum": "04124c0ba09ece85a856de652e84386094c372f002ff767a94d4a43ecf776f96",
+      "size": 220992160
     }
   }
 }
diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix
index 3289a53dbc82..f146ec766583 100644
--- a/pkgs/by-name/cr/crowdsec/package.nix
+++ b/pkgs/by-name/cr/crowdsec/package.nix
@@ -3,26 +3,37 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  makeBinaryWrapper,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "crowdsec";
-  version = "1.7.7";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = "crowdsec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TG9YRKzht9OAnlDNxLNP8060v0klee6GY7vJCu6MugM=";
+    hash = "sha256-2t9nxuqWNDAUOZHtfNkZ4ZFKXvv8k5LuvKrGNjpdGXc=";
   };
 
-  vendorHash = "sha256-BjkTMBrQPv8uZzme02WFdobuYdbe1RvRkZ8RjHGubo8=";
+  vendorHash = "sha256-RDkttsV4PNOfjWPr4v+uIwdkmXYH83vkYFQQIO3CYGE=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
 
   subPackages = [
     "cmd/crowdsec"
     "cmd/crowdsec-cli"
+    "cmd/notification-dummy"
+    "cmd/notification-email"
+    "cmd/notification-file"
+    "cmd/notification-http"
+    "cmd/notification-sentinel"
+    "cmd/notification-slack"
+    "cmd/notification-splunk"
   ];
 
   ldflags = [
@@ -39,13 +50,12 @@ buildGoModule (finalAttrs: {
   postBuild = "mv $GOPATH/bin/{crowdsec-cli,cscli}";
 
   postInstall = ''
+    # so that `bin/crowdsec` is available for `cscli explain` for example
+    wrapProgram $out/bin/cscli --prefix PATH : $out/bin/
+
     mkdir -p $out/share/crowdsec
     cp -r ./config $out/share/crowdsec/
 
-    mkdir -p $out/lib/systemd/system
-    substitute ./config/crowdsec.service $out/lib/systemd/system/crowdsec.service \
-      --replace-fail /usr/local $out
-
     installShellCompletion --cmd cscli \
       --bash <($out/bin/cscli completion bash) \
       --fish <($out/bin/cscli completion fish) \
@@ -63,6 +73,7 @@ buildGoModule (finalAttrs: {
   '';
 
   meta = {
+    mainProgram = "crowdsec";
     homepage = "https://crowdsec.net/";
     changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${finalAttrs.version}";
     description = "Free, open-source and collaborative IPS";
@@ -80,6 +91,7 @@ buildGoModule (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       jk
+      tornax
     ];
   };
 })
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index 23a75a8bc7a7..6731cf7c7c12 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "1.2.6";
+  version = "1.3.0";
   executables = "csharpier";
 
-  nugetHash = "sha256-SaBHGaaeg/1c4okHN1Pn8caGZgfLJ/KsGRqgUiAqKlQ=";
+  nugetHash = "sha256-hwieEoQTcATyKZIZ7CQSWANPBv+pEShg6cDXU5EIexU=";
 
   meta = {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index dbcc517399ae..bd2dc45d2ed6 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -22,38 +22,38 @@
 
 let
   deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.52.0";
+    version = "2.53.0";
     src = fetchFromGitHub {
       owner = "chatmail";
       repo = "core";
       tag = "v${version}";
-      hash = "sha256-AQo27qnHPCK6q/3+Umk6ueqkOIVBA8n4q9S5iEZ7TkM=";
+      hash = "sha256-W2Yh5+6MaJ47GqJioGKge2J3RetGGTcl+0YxPPlSdDo=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "chatmail-core";
       inherit version src;
-      hash = "sha256-ni8iaVPHXWhxfiBvtVzGRyPcxkbV0HiqcQCHGmAqk7s=";
+      hash = "sha256-aoPc5XvjwwuA9aOTvIOpTm15wozC9glJGqn3vPqsJF4=";
     };
   };
   electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "2.52.0";
+  version = "2.53.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/FdGI6Dr9lz0+g/xSzHXbMdqWHf4TliHDXXiAQKKkOs=";
+    hash = "sha256-UJ6005PeQBiL9Inj/VRZjgxZtR278Ky2RcD5MywcGD8=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-0VvyZzWAdVGsuYb8CI36KqkqvjgRsTLJov1L44MxUHQ=";
+    hash = "sha256-t5OHx1GCaTIgGo9193Z3Kkl+jHCBIgtRypcUaO6By3I=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deltachat-tauri/package.nix b/pkgs/by-name/de/deltachat-tauri/package.nix
index f812683ceae5..26cb46756bca 100644
--- a/pkgs/by-name/de/deltachat-tauri/package.nix
+++ b/pkgs/by-name/de/deltachat-tauri/package.nix
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-euRUA4LTmAdb9466DAMqKgAPX3N4KNXCh1ED9cL42lA=";
+  cargoHash = "sha256-iGgsG5V0cFzoudVASGqLakpuy2h4oD979LHuBclj+3o=";
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $cargoDepsCopy/*/libappindicator-sys-*/src/lib.rs \
diff --git a/pkgs/by-name/fe/fetch/package.nix b/pkgs/by-name/fe/fetch/package.nix
new file mode 100644
index 000000000000..13e80e78d502
--- /dev/null
+++ b/pkgs/by-name/fe/fetch/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  # linux dependencies
+  makeWrapper,
+  fastfetch,
+  pciutils,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fetch";
+  version = "2.1.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "areofyl";
+    repo = "fetch";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9ixx7XJcY4ktcN/lUfjvFljvHIEO2ktOebeGgL0ulHg=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  nativeBuildInputs = [ makeWrapper ];
+  postInstall = ''
+    wrapProgram $out/bin/fetch \
+    --prefix PATH : ${
+      lib.makeBinPath [
+        fastfetch
+        pciutils
+      ]
+    }
+  '';
+
+  meta = {
+    description = "Animated 3D fetch tool that renders your distro logo as a spinning bas-relief";
+    homepage = "https://github.com/areofyl/fetch";
+    changelog = "https://github.com/areofyl/fetch/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ ghastrum ];
+    mainProgram = "fetch";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ge/gephgui-wry/package.nix b/pkgs/by-name/ge/gephgui-wry/package.nix
index e3c36a091bb6..41941020239b 100644
--- a/pkgs/by-name/ge/gephgui-wry/package.nix
+++ b/pkgs/by-name/ge/gephgui-wry/package.nix
@@ -59,13 +59,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gephgui-wry";
-  version = "5.7.1";
+  version = "5.7.2";
 
   src = fetchFromGitHub {
     owner = "geph-official";
     repo = "gephgui-pkg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PpkhIfA1jTqiY+4UwonrUk2wq+wL2Rhltfhp0LSURMg=";
+    hash = "sha256-uY2m4TXy4+efRC6WzGjB5Vushgj8zkCp0ctnCJAR+FE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gi/gickup/package.nix b/pkgs/by-name/gi/gickup/package.nix
index 1410b566346a..f68b4695e941 100644
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gickup";
-  version = "0.10.44";
+  version = "0.10.45";
 
   src = fetchFromGitHub {
     owner = "cooperspencer";
     repo = "gickup";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AbeV/0CngNgCaLUIwv/uy8VgpiKiOXWGSjnW+xrd7gk=";
+    hash = "sha256-oVvL5BZYZZCfkGK9ABcppbddKuzykZv1OtBvKElaStI=";
   };
 
-  vendorHash = "sha256-lCeUEReVh0Fg1gyyTvWq2CIdQLuGCN20u9TftiokI0I=";
+  vendorHash = "sha256-2SwjvITyo6z34MZ7gSbSQ1PeW0aO4MRi2DzYgqGcOvk=";
 
   ldflags = [ "-X main.version=${finalAttrs.version}" ];
 
diff --git a/pkgs/by-name/gi/git-pages-cli/package.nix b/pkgs/by-name/gi/git-pages-cli/package.nix
index a4fb358e4ea8..98760b019b25 100644
--- a/pkgs/by-name/gi/git-pages-cli/package.nix
+++ b/pkgs/by-name/gi/git-pages-cli/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-pages-cli";
-  version = "1.9.0";
+  version = "1.10.0";
 
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
     owner = "git-pages";
     repo = "git-pages-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-toqL/BUj3MDAqqD+94nLyw7QwU5jsUqThQVK0hJbU8Y=";
+    hash = "sha256-GIZ6kdCd8BIBEZxBw4Srwnbbl3PtpS2IRyA+Hx5PbAc=";
   };
 
   vendorHash = "sha256-SNLSkz38AgLfjpKaEYawBLdWznKWOz62bNzuaquk7Rs=";
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index c7c3a79c9e48..59073c6866b1 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BbkAt+pL3M/LBugaUgIV26ziUsMnWe+fOHKpmddE2Ng=";
+    hash = "sha256-/9z5WjJN6JTVZO0b0ScPmxegZVb2PhjvDl5BbPwDxSw=";
   };
 
   vendorHash = "sha256-CAl4yYAM/GQaLbUUNjgMN6A3Vqw4D+kpG9G2WXw6mRU=";
diff --git a/pkgs/by-name/gr/gram/package.nix b/pkgs/by-name/gr/gram/package.nix
index 6d6f84306f33..48a4664be6fd 100644
--- a/pkgs/by-name/gr/gram/package.nix
+++ b/pkgs/by-name/gr/gram/package.nix
@@ -31,7 +31,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gram";
-  version = "2.1.2";
+  version = "2.2.0";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "GramEditor";
     repo = "gram";
     tag = finalAttrs.version;
-    hash = "sha256-7FzAvC/JMMIFcuTGkL2Ju644UAIsneOMhiDUFnQske4=";
+    hash = "sha256-w0uZ2qAc3Tt6QVRAX97LWW9aOs02fG1SEYCDhpUhinE=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}'
   '';
 
-  cargoHash = "sha256-feESY8ALSG3xa906HBc4pOKGerQ1jF7VUxzvUcsZbrY=";
+  cargoHash = "sha256-+lmDbawAIRllC7LzGJ9qPMtHXPd5aMoul47YOA7nfXA=";
 
   __structuredAttrs = true;
 
@@ -71,7 +71,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   dontUseCmakeConfigure = true;
 
   buildInputs = [
-    libgit2
+    (libgit2.override { withExperimentalSha256 = true; })
     openssl
     sqlite
     zlib
diff --git a/pkgs/by-name/gr/graphite/package.nix b/pkgs/by-name/gr/graphite/package.nix
index 62bd785d1db6..2cac2d0bb464 100644
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@@ -30,13 +30,13 @@
 }:
 
 let
-  version = "0-unstable-2026-06-15";
-  rev = "34e0fd77574c30749d00d775df87a7e9362e7ce8";
+  version = "0-unstable-2026-06-23";
+  rev = "ebbbb6bd1b0add39969717d18563808cc6306a63";
 
-  srcHash = "sha256-SyxteWavvyeRtKcGuJkOxojstJk1C2ndbNERuSM3Cng=";
+  srcHash = "sha256-8k30s/czdJ5uNHH75K4+XJo6Ncd1GA3NSlaa7yO4+mg=";
   shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
-  cargoHash = "sha256-KktJj1c/OrJazNk40NND8irmNd30nzpZOxdwaTAqjIs=";
-  npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig=";
+  cargoHash = "sha256-gpv4LZHEWKonQodW/uzdoAfkaxSRuCMKyX1SSit/gEQ=";
+  npmHash = "sha256-Rb0bLPk54QigNp7TkDkJJy/TEJXAhlXOCruckwvdXks=";
 
   brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";
   brandingHash = "sha256-wAA6fR+NSxlCAqgwWmpiIAnji9k/jsMXpR0Vt04Ntmk=";
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index 0f2b9ba3cf14..574ef0cdaa39 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "23.3.0";
+  version = "23.7.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aS+3XMz37TJTI56y0EecRCbrdkO1JIYm5KamC54tFyI=";
+    hash = "sha256-cRSvrmasKrk0xMnq7/bF0F6wWSKNcXDRm+p/JlciPGo=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 85bc288af43e..faa231744418 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-06-22";
+  version = "2.3.0-rolling-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "f12fb3cca02ba31e89c87bc90041fe800dbed3f2";
-    hash = "sha256-OJ/MF6A6lcxWKgcOntCVc0fkcnQ9FJx8Wn2Pewz0h84=";
+    rev = "66fcbfed806d7645577e4e78e4d536d38379764d";
+    hash = "sha256-RzQHDHihcD+ife1CBCGliytrkt8eYVdL8AHdaYp3CFQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch
similarity index 100%
rename from pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch
rename to pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch
diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch
new file mode 100644
index 000000000000..90cd81176d12
--- /dev/null
+++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch
@@ -0,0 +1,14 @@
+diff --git a/igc/IGC/common/LLVMWarningsPush.hpp b/igc/IGC/common/LLVMWarningsPush.hpp
+index 12874dfcc2..38acd80943 100644
+--- a/igc/IGC/common/LLVMWarningsPush.hpp
++++ b/igc/IGC/common/LLVMWarningsPush.hpp
+@@ -43,6 +43,9 @@
+ #if __GNUC__ > 8
+ #pragma GCC diagnostic ignored "-Winit-list-lifetime"
+ #endif
++#if __GNUC__ > 14
++#pragma GCC diagnostic ignored "-Wfree-nonheap-object"
++#endif
+ #endif
+ 
+ #if defined(_WIN32) || defined(_WIN64)
diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch
new file mode 100644
index 000000000000..d0b0964f5748
--- /dev/null
+++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch
@@ -0,0 +1,13 @@
+diff --git a/llvm-project/llvm/include/llvm/Support/Threading.h b/llvm-project/llvm/include/llvm/Support/Threading.h
+index ba6c531ab4..78aa5e7be5 100644
+--- a/llvm-project/llvm/include/llvm/Support/Threading.h
++++ b/llvm-project/llvm/include/llvm/Support/Threading.h
+@@ -18,7 +18,7 @@
+ #include "llvm/ADT/StringRef.h"
+ #include "llvm/Config/llvm-config.h" // for LLVM_ON_UNIX
+ #include "llvm/Support/Compiler.h"
+-#include <ciso646> // So we can check the C++ standard lib macros.
++#include <version> // So we can check the C++ standard lib macros.
+ #include <optional>
+ 
+ #if defined(_MSC_VER)
diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix b/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix
new file mode 100644
index 000000000000..859ca5c54f5e
--- /dev/null
+++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix
@@ -0,0 +1,156 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  git,
+  bison,
+  flex,
+  zlib,
+  intel-compute-runtime,
+  python3,
+  spirv-tools,
+  spirv-headers,
+}:
+
+let
+  llvmVersion = "16.0.6";
+in
+stdenv.mkDerivation rec {
+  pname = "intel-graphics-compiler";
+  version = "2.34.4";
+
+  # See the repository for expected versions:
+  # <https://github.com/intel/intel-graphics-compiler/blob/v2.16.0/documentation/build_ubuntu.md#revision-table>
+  srcs = [
+    (fetchFromGitHub {
+      name = "igc";
+      owner = "intel";
+      repo = "intel-graphics-compiler";
+      tag = "v${version}";
+      hash = "sha256-w20nrn3wo9Dvv3BILYBzuJTTLXqcWaRAF7SiPtryhwk=";
+    })
+    (fetchFromGitHub {
+      name = "llvm-project";
+      owner = "llvm";
+      repo = "llvm-project";
+      tag = "llvmorg-${llvmVersion}";
+      hash = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs=";
+    })
+    (fetchFromGitHub {
+      name = "vc-intrinsics";
+      owner = "intel";
+      repo = "vc-intrinsics";
+      tag = "v0.25.0";
+      hash = "sha256-ozc1w3V5RqWHwqNHuefZJMN8RAYxrJxH9bd1BEqxfiQ=";
+    })
+    (fetchFromGitHub {
+      name = "opencl-clang";
+      owner = "intel";
+      repo = "opencl-clang";
+      tag = "v16.0.11";
+      hash = "sha256-ema1jTNMHs3pUituVb1NPllc6cA8eYJHtDOjuEzIDWM=";
+    })
+    (fetchFromGitHub {
+      name = "llvm-spirv";
+      owner = "KhronosGroup";
+      repo = "SPIRV-LLVM-Translator";
+      tag = "v16.0.24";
+      hash = "sha256-aTcwfQt2WdOA44jfHdD7x7oxt8emSDexgZnI7MPVqvU=";
+    })
+  ];
+
+  patches = [
+    # Raise minimum CMake version to 3.5
+    # https://github.com/intel/intel-graphics-compiler/commit/4f0123a7d67fb716b647f0ba5c1ab550abf2f97d
+    # https://github.com/intel/intel-graphics-compiler/pull/364
+    ./bump-cmake.patch
+
+    # Fix for GCC 15 by adding a previously-implicit `#include <cstdint>` and
+    # replacing `<ciso646>` with `<version>` in the the llvm directory. Based
+    # on https://github.com/intel/intel-graphics-compiler/pull/383.
+    ./gcc15-llvm-header-fixes.patch
+
+    # Fix for GCC 15 by disabling `-Werror` for `-Wfree-nonheap-object`
+    # warnings within LLVM. This is in accordance with IGC disabling warnings
+    # that originate from within LLVM (see `IGC/common/LLVMWarningsPush.hpp`).
+    ./gcc15-allow-llvm-free-nonheap-object-warning.patch
+  ];
+
+  sourceRoot = ".";
+
+  cmakeDir = "../igc";
+
+  postUnpack = ''
+    chmod -R +w .
+    mv opencl-clang llvm-spirv llvm-project/llvm/projects/
+  '';
+
+  postPatch = ''
+    substituteInPlace igc/IGC/AdaptorOCL/igc-opencl.pc.in \
+      --replace-fail '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \
+      --replace-fail '/@CMAKE_INSTALL_LIBDIR@' "/lib"
+
+    chmod +x igc/IGC/Scripts/igc_create_linker_script.sh
+    patchShebangs --build igc/IGC/Scripts/igc_create_linker_script.sh
+
+    # The build system only applies patches when the sources are in a
+    # Git repository.
+    git -C llvm-project init
+    git -C llvm-project -c user.name=nixbld -c user.email= commit --allow-empty -m stub
+    substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
+      --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \
+                     'COMMAND patch -p1 --ignore-whitespace -i '
+
+    # match default LLVM version with our provided version to apply correct patches
+    substituteInPlace igc/external/llvm/llvm_preferred_version.cmake \
+      --replace-fail "16.0.6" "${llvmVersion}"
+  '';
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    git
+    ninja
+    (python3.withPackages (
+      ps: with ps; [
+        mako
+        pyyaml
+      ]
+    ))
+    zlib
+  ];
+
+  buildInputs = [
+    spirv-headers
+    spirv-tools
+  ];
+
+  strictDeps = true;
+
+  # testing is done via intel-compute-runtime
+  doCheck = false;
+
+  cmakeFlags = [
+    "-DIGC_OPTION__SPIRV_TOOLS_MODE=Prebuilds"
+    "-DIGC_OPTION__USE_PREINSTALLED_SPIRV_HEADERS=ON"
+    "-DSPIRV-Headers_INCLUDE_DIR=${spirv-headers}/include"
+    "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}"
+    "-Wno-dev"
+  ];
+
+  passthru.tests = {
+    inherit intel-compute-runtime;
+  };
+
+  meta = {
+    description = "LLVM-based compiler for OpenCL targeting Intel Gen graphics hardware";
+    homepage = "https://github.com/intel/intel-graphics-compiler";
+    changelog = "https://github.com/intel/intel-graphics-compiler/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ fleaz ];
+  };
+}
diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix b/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix
index 424f8fe55c47..b91c58a244d3 100644
--- a/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix
+++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix
@@ -1,11 +1,11 @@
 {
   lib,
+  callPackage,
   stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
   intel-gmmlib,
-  intel-graphics-compiler,
   level-zero,
   libva,
   gitUpdater,
@@ -13,6 +13,8 @@
 
 let
   inherit (lib) cmakeBool;
+  # intel-graphics-compiler >= 2.36 does no longer support 8th Gen
+  intel-graphics-compiler = callPackage ./intel-graphics-compiler.nix { };
 in
 stdenv.mkDerivation (finalAttrs: {
   # https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md
diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix
index 3c0a5c6c5eaf..99398395bf78 100644
--- a/pkgs/by-name/in/intel-graphics-compiler/package.nix
+++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix
@@ -11,15 +11,28 @@
   intel-compute-runtime,
   python3,
   spirv-tools,
-  spirv-headers,
 }:
 
 let
-  llvmVersion = "16.0.6";
+  llvmVersion = "17.0.6";
+
+  spirv-headers = stdenv.mkDerivation {
+    pname = "spirv-headers";
+    version = "1.4.341.0-unstable-2026-04-29";
+
+    src = fetchFromGitHub {
+      owner = "KhronosGroup";
+      repo = "SPIRV-Headers";
+      rev = "b8a32968473ce852a809b9de5f04f02a5a9dfa78";
+      hash = "sha256-k5lAF7TxJ+8cXDnx7lQxG/3IjSTzYcqBl5PYY2gv9E8=";
+    };
+
+    nativeBuildInputs = [ cmake ];
+  };
 in
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "2.34.4";
+  version = "2.36.3";
 
   # See the repository for expected versions:
   # <https://github.com/intel/intel-graphics-compiler/blob/v2.16.0/documentation/build_ubuntu.md#revision-table>
@@ -29,14 +42,14 @@ stdenv.mkDerivation rec {
       owner = "intel";
       repo = "intel-graphics-compiler";
       tag = "v${version}";
-      hash = "sha256-w20nrn3wo9Dvv3BILYBzuJTTLXqcWaRAF7SiPtryhwk=";
+      hash = "sha256-0GzZQECcngF9b5lZyeIKXeM6w64WzCYFtHOobQKN80o=";
     })
     (fetchFromGitHub {
       name = "llvm-project";
       owner = "llvm";
       repo = "llvm-project";
       tag = "llvmorg-${llvmVersion}";
-      hash = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs=";
+      hash = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
     })
     (fetchFromGitHub {
       name = "vc-intrinsics";
@@ -49,24 +62,19 @@ stdenv.mkDerivation rec {
       name = "opencl-clang";
       owner = "intel";
       repo = "opencl-clang";
-      tag = "v16.0.11";
-      hash = "sha256-ema1jTNMHs3pUituVb1NPllc6cA8eYJHtDOjuEzIDWM=";
+      tag = "v17.0.7";
+      hash = "sha256-7kQlH1Y4pnNvj/CS2qAVbYUl9FQWBuMew7i8CpORfKE=";
     })
     (fetchFromGitHub {
       name = "llvm-spirv";
       owner = "KhronosGroup";
       repo = "SPIRV-LLVM-Translator";
-      tag = "v16.0.24";
-      hash = "sha256-aTcwfQt2WdOA44jfHdD7x7oxt8emSDexgZnI7MPVqvU=";
+      tag = "v17.0.24";
+      hash = "sha256-s/dNWmT3KXdXK0CSVjqEfsY9r8ONAGMZ5KUy9FeqF0E=";
     })
   ];
 
   patches = [
-    # Raise minimum CMake version to 3.5
-    # https://github.com/intel/intel-graphics-compiler/commit/4f0123a7d67fb716b647f0ba5c1ab550abf2f97d
-    # https://github.com/intel/intel-graphics-compiler/pull/364
-    ./bump-cmake.patch
-
     # Fix for GCC 15 by adding a previously-implicit `#include <cstdint>` and
     # replacing `<ciso646>` with `<version>` in the the llvm directory. Based
     # on https://github.com/intel/intel-graphics-compiler/pull/383.
diff --git a/pkgs/by-name/it/itch/package.nix b/pkgs/by-name/it/itch/package.nix
index a35d83f41f23..8fd0def5db54 100644
--- a/pkgs/by-name/it/itch/package.nix
+++ b/pkgs/by-name/it/itch/package.nix
@@ -94,7 +94,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   meta = {
     description = "Best way to play itch.io games";
     homepage = "https://github.com/itchio/itch";
-    changelog = "https://github.com/itchio/itch/releases/tag/v${version}-canary";
+    changelog = "https://github.com/itchio/itch/releases/tag/v${version}";
     license = lib.licenses.mit;
     platforms = [ "x86_64-linux" ];
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index 79b99e8ae42d..78fb01480bab 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2066";
+  version = "0.24.2108";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hK7QfztI3kFJcOG9OTQ5/lOusFKnv8AyNfCaU9IhdKE=";
+    hash = "sha256-MWA5gTiNjkKIaHgUGVt2XV3QBPYGTf/dVqCnmdAaJ0U=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/ke/keifu/package.nix b/pkgs/by-name/ke/keifu/package.nix
index 691f403a235e..2dd1254741c9 100644
--- a/pkgs/by-name/ke/keifu/package.nix
+++ b/pkgs/by-name/ke/keifu/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "keifu";
-  version = "0.4.0";
+  version = "0.5.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "trasta298";
     repo = "keifu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-668ejr2pxjGfQ0/hhJSNBSZME2+hSGuNJmwmbLVqy0o=";
+    hash = "sha256-ndMWi//G9kwnoPf58YtICyytMv2t0e4h7cwBdfpaoVY=";
   };
 
-  cargoHash = "sha256-6YmpsKkf/Mox98fRdrwbwzFohgOicRfCxcAIGSwmT7g=";
+  cargoHash = "sha256-lNctnxVntxRZaS9XeII1sQZ2ZNKkSvd8n+bq5Fwd6QM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/la/lan-mouse/package.nix b/pkgs/by-name/la/lan-mouse/package.nix
index 97acca9f355b..0c086a58ef8a 100644
--- a/pkgs/by-name/la/lan-mouse/package.nix
+++ b/pkgs/by-name/la/lan-mouse/package.nix
@@ -14,24 +14,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lan-mouse";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "feschber";
     repo = "lan-mouse";
     rev = "v${version}";
-    hash = "sha256-ofiNgJbmf35pfRvZB3ZmMkCJuM7yYgNL+Dd5mZZqyNk=";
-  };
-
-  # lan-mouse uses `git` to determine the version at build time and
-  # has Cargo set the `GIT_DESCRIBE` environment variable. To improve
-  # build reproducibility, we define the variable based on the package
-  # version instead.
-  prePatch = ''
-    rm build.rs
-  '';
-  env = {
-    GIT_DESCRIBE = "${version}-nixpkgs";
+    hash = "sha256-6EqA9WfiukOymUT4FkNdMvzmFKByW0LLoI/9sv4TzBU=";
   };
 
   nativeBuildInputs = [
@@ -47,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     libxtst
   ];
 
-  cargoHash = "sha256-+UXRBYfbkb114mwDGj36oG5ZT3TQtcEzsbyZvtWTMxM=";
+  cargoHash = "sha256-Lxs0qWvNAv4KCeJ+cDBYBzwlbJfQJshcxPRdg9w0szc=";
 
   postInstall = ''
     install -Dm444 de.feschber.LanMouse.desktop -t $out/share/applications
diff --git a/pkgs/by-name/li/libeconf/package.nix b/pkgs/by-name/li/libeconf/package.nix
new file mode 100644
index 000000000000..4c0b848c0ae9
--- /dev/null
+++ b/pkgs/by-name/li/libeconf/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libeconf";
+  version = "0.8.3";
+
+  src = fetchFromGitHub {
+    owner = "openSUSE";
+    repo = "libeconf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZXZcXQdG3hXAMwwftrIWL5GbVdPXk+AyqdhGTnaKL1I=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Enhanced config file parser, which merges config files placed in several locations into one";
+    homepage = "https://github.com/openSUSE/libeconf";
+    changelog = "https://github.com/openSUSE/libeconf/blob/${finalAttrs.src.tag}/NEWS";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ grimmauld ];
+    mainProgram = "econftool";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix
index 568fa09201aa..c17240378a92 100644
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@@ -17,6 +17,7 @@
   gitstatus,
   llhttp,
   withGssapi ? false,
+  withExperimentalSha256 ? false,
   krb5,
 }:
 
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DUSE_HTTP_PARSER=llhttp"
     "-DUSE_SSH=ON"
     (lib.cmakeBool "USE_GSSAPI" withGssapi)
+    (lib.cmakeBool "EXPERIMENTAL_SHA256" withExperimentalSha256)
     "-DBUILD_SHARED_LIBS=${if staticBuild then "OFF" else "ON"}"
   ]
   ++ lib.optionals stdenv.hostPlatform.isWindows [
@@ -89,6 +91,13 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
+  postInstall = lib.optionalString withExperimentalSha256 ''
+    # Downstream Rust bindings (git2-rs / git2-sys) expect experimental headers
+    # to be located at 'git2/experimental.h', but upstream libgit2 installs them
+    # into 'git2-experimental/' when EXPERIMENTAL_SHA256 is enabled.
+    ln -s git2-experimental $dev/include/git2
+  '';
+
   passthru.tests = lib.mapAttrs (_: v: v.override { libgit2 = finalAttrs.finalPackage; }) {
     inherit libgit2-glib;
     inherit (python3Packages) pygit2;
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 618284f333df..4ccf3c299e9e 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "152.0-1";
+  version = "152.0.2-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-sIpyCpfo9igZ0PMd1Y7sdIoui88dC9DjlwjN5M5HLsQ=";
-        aarch64-linux = "sha256-H1HtyZPcE8RpJTuqTnCOMC5gb+s1Dp80OE66KCdRM4g=";
+        x86_64-linux = "sha256-Tq2bj75oZXSH2YHXShjRRs4Aqxo86BuwONXu+IsdCuA=";
+        aarch64-linux = "sha256-xk3o5FODm5ge2I8JzgwXTpgu/SI6VcROIJ7005ew2PY=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };
diff --git a/pkgs/by-name/ls/lsp-plugins/package.nix b/pkgs/by-name/ls/lsp-plugins/package.nix
index 8a056268bd01..07d99a9a034c 100644
--- a/pkgs/by-name/ls/lsp-plugins/package.nix
+++ b/pkgs/by-name/ls/lsp-plugins/package.nix
@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lsp-plugins";
-  version = "1.2.31";
+  version = "1.2.33";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JZCnxqzgujGcgUXvFCYea7OfMomkmJ1LscFPRwGxzeI=";
+    hash = "sha256-K2kiEFEYrIe9lCsP8+e/PIGAInsqtcTlDkjeuQrGib0=";
   };
 
   # By default, GStreamer plugins are installed right alongside GStreamer itself
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index e44720c7a41b..d241c440c42a 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -265,7 +265,7 @@ buildMattermost rec {
       buildPhase = ''
         runHook preBuild
 
-        for ws in platform/{types,client,components,shared} channels; do
+        for ws in platform/{types,client,shared,components} channels; do
           if [ -d "$ws" ]; then
             npm run build --workspace="$ws"
           fi
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 45685a9cfc8a..e0fd905a82d2 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
       # and make sure the version regex is up to date here.
       # Ensure you also check ../mattermost/package.nix for ESR releases.
       regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.7.0";
-      srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
-      vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
-      npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
+      version = "11.8.1";
+      srcHash = "sha256-9EIbTwnEeZQKg5uixkMp3sp/n+9I2N9W7hxsW5juF3M=";
+      vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
+      npmDepsHash = "sha256-9GRM0VXrh1eR16ocSGEV/F2eflOflzkhrhRRnm9uB6s=";
       autoUpdate = ./package.nix;
     };
   }
diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix
index e03046cbdc53..41c58989f376 100644
--- a/pkgs/by-name/md/md-tui/package.nix
+++ b/pkgs/by-name/md/md-tui/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "md-tui";
-  version = "0.10.1";
+  version = "0.10.2";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "henriklovhaug";
     repo = "md-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bFL84y0735L93x0nWkKAAmTDMdZzs5DDoxqbQhgXUMQ=";
+    hash = "sha256-VSOAeFY3TsdeOlKt3f9cbEsSNSwvhcYQl129oQMOTaM=";
   };
 
-  cargoHash = "sha256-xR9bWWDxerP2zGAb43ZWONLcsbmUn8KzMXwDEmrjioU=";
+  cargoHash = "sha256-l1VXrf19KB6zTrVmINyinz0YpGDDUH9B77CN6CMz/X8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/md/mdadm4/no-self-references.patch b/pkgs/by-name/md/mdadm4/no-self-references.patch
deleted file mode 100644
index 3b3dc4d84609..000000000000
--- a/pkgs/by-name/md/mdadm4/no-self-references.patch
+++ /dev/null
@@ -1,124 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 2a51d813..a31ac48a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -63,6 +63,9 @@ endif
- ifdef DEBIAN
- CPPFLAGS += -DDEBIAN
- endif
-+ifdef NIXOS
-+CPPFLAGS += -DNIXOS
-+endif
- ifdef DEFAULT_OLD_METADATA
-  CPPFLAGS += -DDEFAULT_OLD_METADATA
-  DEFAULT_METADATA=0.90
-@@ -129,6 +132,7 @@ endif
- INSTALL = /usr/bin/install
- DESTDIR =
- BINDIR  = /sbin
-+INSTALL_BINDIR = ${BINDIR}
- MANDIR  = /usr/share/man
- MAN4DIR = $(MANDIR)/man4
- MAN5DIR = $(MANDIR)/man5
-@@ -253,16 +257,16 @@ sha1.o : sha1.c sha1.h md5.h
- install : install-bin install-man install-udev
- 
- install-static : mdadm.static install-man
--	$(INSTALL) -D $(STRIP) -m 755 mdadm.static $(DESTDIR)$(BINDIR)/mdadm
-+	$(INSTALL) -D $(STRIP) -m 755 mdadm.static $(DESTDIR)$(INSTALL_BINDIR)/mdadm
- 
- install-tcc : mdadm.tcc install-man
--	$(INSTALL) -D $(STRIP) -m 755 mdadm.tcc $(DESTDIR)$(BINDIR)/mdadm
-+	$(INSTALL) -D $(STRIP) -m 755 mdadm.tcc $(DESTDIR)$(INSTALL_BINDIR)/mdadm
- 
- install-uclibc : mdadm.uclibc install-man
--	$(INSTALL) -D $(STRIP) -m 755 mdadm.uclibc $(DESTDIR)$(BINDIR)/mdadm
-+	$(INSTALL) -D $(STRIP) -m 755 mdadm.uclibc $(DESTDIR)$(INSTALL_BINDIR)/mdadm
- 
- install-klibc : mdadm.klibc install-man
--	$(INSTALL) -D $(STRIP) -m 755 mdadm.klibc $(DESTDIR)$(BINDIR)/mdadm
-+	$(INSTALL) -D $(STRIP) -m 755 mdadm.klibc $(DESTDIR)$(INSTALL_BINDIR)/mdadm
- 
- install-man: mdadm.8 md.4 mdadm.conf.5 mdmon.8
- 	$(INSTALL) -D -m 644 mdadm.8 $(DESTDIR)$(MAN8DIR)/mdadm.8
-@@ -305,7 +309,7 @@ install-bin: mdadm mdmon
- 	$(INSTALL) -D $(STRIP) -m 755 mdmon $(DESTDIR)$(BINDIR)/mdmon
- 
- uninstall:
--	rm -f $(DESTDIR)$(MAN8DIR)/mdadm.8 $(DESTDIR)$(MAN8DIR)/mdmon.8 $(DESTDIR)$(MAN4DIR)/md.4 $(DESTDIR)$(MAN5DIR)/mdadm.conf.5 $(DESTDIR)$(BINDIR)/mdadm
-+	rm -f $(DESTDIR)$(MAN8DIR)/mdadm.8 $(DESTDIR)$(MAN8DIR)/mdmon.8 $(DESTDIR)$(MAN4DIR)/md.4 $(DESTDIR)$(MAN5DIR)/mdadm.conf.5 $(DESTDIR)$(INSTALL_BINDIR)/mdadm
- 
- test: mdadm mdmon test_stripe swap_super raid6check
- 	@echo "Please run './test' as root"
-diff --git a/policy.c b/policy.c
-index eee9ef63..9f916e9d 100644
---- a/policy.c
-+++ b/policy.c
-@@ -817,12 +817,39 @@ char *find_rule(struct rule *rule, char *rule_type)
- #define UDEV_RULE_FORMAT \
- "ACTION==\"add\", SUBSYSTEM==\"block\", " \
- "ENV{DEVTYPE}==\"%s\", ENV{ID_PATH}==\"%s\", " \
--"RUN+=\"" BINDIR "/mdadm --incremental $env{DEVNAME}\"\n"
-+"RUN+=\"%s/mdadm --incremental $env{DEVNAME}\"\n"
- 
- #define UDEV_RULE_FORMAT_NOTYPE \
- "ACTION==\"add\", SUBSYSTEM==\"block\", " \
- "ENV{ID_PATH}==\"%s\", " \
--"RUN+=\"" BINDIR "/mdadm --incremental $env{DEVNAME}\"\n"
-+"RUN+=\"%s/mdadm --incremental $env{DEVNAME}\"\n"
-+
-+#ifdef NIXOS
-+const char *get_mdadm_bindir(void)
-+{
-+	static char *bindir = NULL;
-+	if (bindir != NULL) {
-+		return bindir;
-+	} else {
-+		int len;
-+		bindir = xmalloc(1025);
-+		len = readlink("/proc/self/exe", bindir, 1024);
-+		if (len > 0) {
-+			char *basename;
-+			if ((basename = strrchr(bindir, '/')) != NULL)
-+				*basename = '\0';
-+			else
-+				*(bindir + len) = '\0';
-+		} else {
-+			*bindir = '\0';
-+		}
-+		return bindir;
-+	}
-+}
-+#define SELF get_mdadm_bindir()
-+#else
-+#define SELF BINDIR
-+#endif
- 
- /* Write rule in the rule file. Use format from UDEV_RULE_FORMAT */
- int write_rule(struct rule *rule, int fd, int force_part)
-@@ -836,9 +863,9 @@ int write_rule(struct rule *rule, int fd, int force_part)
- 	if (force_part)
- 		typ = type_part;
- 	if (typ)
--		snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT, typ, pth);
-+		snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT, typ, pth, SELF);
- 	else
--		snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT_NOTYPE, pth);
-+		snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT_NOTYPE, pth, SELF);
- 	return write(fd, line, strlen(line)) == (int)strlen(line);
- }
- 
-diff --git a/util.c b/util.c
-index 3d05d074..e004a798 100644
---- a/util.c
-+++ b/util.c
-@@ -1913,7 +1913,9 @@ int start_mdmon(char *devnm)
- 	char pathbuf[1024];
- 	char *paths[4] = {
- 		pathbuf,
-+#ifndef NIXOS
- 		BINDIR "/mdmon",
-+#endif
- 		"./mdmon",
- 		NULL
- 	};
diff --git a/pkgs/by-name/md/mdadm4/package.nix b/pkgs/by-name/md/mdadm4/package.nix
index 2143acc494e5..a35b504f6234 100644
--- a/pkgs/by-name/md/mdadm4/package.nix
+++ b/pkgs/by-name/md/mdadm4/package.nix
@@ -15,27 +15,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mdadm";
-  version = "4.4";
+  version = "4.6";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
     tag = "mdadm-${finalAttrs.version}";
-    hash = "sha256-jGmc8fkJM0V9J7V7tQPXSF/WD0kzyEAloBAwaAFenS0=";
+    hash = "sha256-jFsVPJC4lcShkSwQCGjVdVkvk4q4weM7i5DzrLgpuSM=";
   };
 
   patches = [
-    ./no-self-references.patch
     ./fix-hardcoded-mapdir.patch
-    # Fixes build on musl
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/e58d2b17d3c40faffc0d426aab00184f28d9dafa/srcpkgs/mdadm/patches/musl.patch";
-      hash = "sha256-TIcQs+8RM5Q6Z8MHkI50kaJd7f9WdS/EVI16F7b2+SA=";
-    })
-    # Fixes build on musl 1.2.5+
-    (fetchurl {
-      url = "https://lore.kernel.org/linux-raid/20240220165158.3521874-1-raj.khem@gmail.com/raw";
-      hash = "sha256-JOZ8n7zi+nq236NPpB4e2gUy8I3l3DbcoLhpeL73f98=";
-    })
   ];
 
   makeFlags = [
@@ -97,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/tree/CHANGELOG.md?h=${finalAttrs.src.tag}";
     description = "Programs for managing RAID arrays under Linux";
     homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/me/mealie/mealie-frontend.nix b/pkgs/by-name/me/mealie/mealie-frontend.nix
deleted file mode 100644
index b3359fb64271..000000000000
--- a/pkgs/by-name/me/mealie/mealie-frontend.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-src: version:
-{
-  lib,
-  fetchYarnDeps,
-  dart-sass,
-  nodejs,
-  fixup-yarn-lock,
-  stdenv,
-  yarn,
-  writableTmpDirAsHomeHook,
-}:
-stdenv.mkDerivation {
-  name = "mealie-frontend";
-  inherit version;
-  src = "${src}/frontend";
-
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${src}/frontend/yarn.lock";
-    hash = "sha256-F1dhdBHfT9N1Ejk7WLyz2BbKlTPfqqEDNi7ZTL3phWY=";
-  };
-
-  nativeBuildInputs = [
-    fixup-yarn-lock
-    nodejs
-    (yarn.override { inherit nodejs; })
-    writableTmpDirAsHomeHook
-    dart-sass
-  ];
-
-  configurePhase = ''
-    runHook preConfigure
-
-    sed -i 's+"@nuxt/fonts",+// NUXT FONTS DISABLED+g' nuxt.config.ts
-
-    yarn config --offline set yarn-offline-mirror "$yarnOfflineCache"
-    fixup-yarn-lock yarn.lock
-    yarn install --offline --frozen-lockfile --no-progress --non-interactive --ignore-scripts
-    patchShebangs node_modules
-
-    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    export NUXT_TELEMETRY_DISABLED=1
-    yarn --offline generate
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mv .output/public $out
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Frontend for Mealie";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [
-      litchipi
-      esch
-    ];
-  };
-}
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index 765822f5dfa9..ffcf70e2763f 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  pkgs,
-  callPackage,
   fetchFromGitHub,
   makeWrapper,
   nixosTests,
@@ -9,27 +7,99 @@
   nltk-data,
   writeShellScript,
   nix-update-script,
+
+  # frontend
+  fetchYarnDeps,
+  dart-sass,
+  nodejs,
+  fixup-yarn-lock,
+  stdenv,
+  yarn,
+  writableTmpDirAsHomeHook,
 }:
 
 let
-  version = "3.16.0";
+  version = "3.19.2";
   src = fetchFromGitHub {
     owner = "mealie-recipes";
     repo = "mealie";
     tag = "v${version}";
-    hash = "sha256-DUwLCe221MQb6AEYNxNDWXoaEdf9q/dNklOXJncnnJ4=";
+    hash = "sha256-OH48XiOoaIdVCl5tm22OaI5UKKlhj8b0uVsGlgsjx6I=";
   };
 
-  frontend = callPackage (import ./mealie-frontend.nix src version) { };
+  frontend = stdenv.mkDerivation {
+    name = "mealie-frontend";
+    inherit version;
+    src = "${src}/frontend";
+
+    __structuredAttrs = true;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${src}/frontend/yarn.lock";
+      hash = "sha256-q3dqJrzqEx0G3Q/EGhjVzBd6XTAn6cELfaqLJCD5kFs=";
+    };
+
+    nativeBuildInputs = [
+      fixup-yarn-lock
+      nodejs
+      (yarn.override { inherit nodejs; })
+      writableTmpDirAsHomeHook
+      dart-sass
+    ];
+
+    env = {
+      NUXT_TELEMETRY_DISABLED = 1;
+    };
+
+    configurePhase = ''
+      runHook preConfigure
+
+      sed -i 's+"@nuxt/fonts",+// NUXT FONTS DISABLED+g' nuxt.config.ts
+
+      yarn config --offline set yarn-offline-mirror "$yarnOfflineCache"
+      fixup-yarn-lock yarn.lock
+      yarn install --offline --frozen-lockfile --no-progress --non-interactive --ignore-scripts
+      patchShebangs node_modules
+
+      substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+        --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      yarn --offline generate
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mv .output/public $out
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Frontend for Mealie";
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [
+        litchipi
+        esch
+      ];
+    };
+  };
 
   python = python3;
   pythonpkgs = python.pkgs;
 in
-pythonpkgs.buildPythonApplication rec {
+pythonpkgs.buildPythonApplication (finalAttrs: {
   pname = "mealie";
   inherit version src;
   pyproject = true;
 
+  __structuredAttrs = true;
+
   build-system = with pythonpkgs; [ setuptools ];
 
   nativeBuildInputs = [ makeWrapper ];
@@ -112,11 +182,11 @@ pythonpkgs.buildPythonApplication rec {
       rm -f $out/bin/*
 
       makeWrapper ${start_script} $out/bin/mealie \
-        --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \
-        --set STATIC_FILES "${frontend}"
+        --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \
+        --set STATIC_FILES "${finalAttrs.passthru.frontend}"
 
       makeWrapper ${init_db} $out/libexec/init_db \
-        --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \
+        --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \
         --set OUT "$out"
     '';
 
@@ -136,7 +206,13 @@ pythonpkgs.buildPythonApplication rec {
   ];
 
   passthru = {
-    updateScript = nix-update-script { };
+    inherit frontend;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "-s"
+        "frontend"
+      ];
+    };
     tests = {
       inherit (nixosTests) mealie;
     };
@@ -160,4 +236,4 @@ pythonpkgs.buildPythonApplication rec {
     ];
     mainProgram = "mealie";
   };
-}
+})
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index 58f4552604a4..35bfec707916 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "misskey";
-  version = "2026.5.4";
+  version = "2026.6.0";
 
   src = fetchFromGitHub {
     owner = "misskey-dev";
     repo = "misskey";
     tag = finalAttrs.version;
-    hash = "sha256-ENq5V1lIFGKIr1xZccy1LFRYVqZVEhDzBhAbDNcG5sM=";
+    hash = "sha256-jq1HtLabix9qxaAjaCgUN3nsY438ruHgHgC3MuGeR2E=";
     fetchSubmodules = true;
   };
 
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-wEbYkfp+zfytOPBjEcyTHCaoohGRNRjG5oTUefI5BVw=";
+    hash = "sha256-GCkSASkgwUvlAlm8hiy4Yk/QMVerVGacxOh1AYouH0g=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index 129355bfb336..7f5b682121a5 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -112,10 +112,14 @@ stdenv.mkDerivation (finalAttrs: {
     connector-c = finalAttrs.finalPackage;
     server = finalAttrs.finalPackage;
     mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.mysql-secure-root-by-default =
-      nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
-    tests.mysql-root-can-be-kept-insecure =
-      nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    tests = {
+      mysql =
+        nixosTests.mysql."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-secure-root-by-default =
+        nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-root-can-be-kept-insecure =
+        nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/op/openafs/module.nix b/pkgs/by-name/op/openafs/module.nix
index 8c88b291b7bd..d9c455f5db41 100644
--- a/pkgs/by-name/op/openafs/module.nix
+++ b/pkgs/by-name/op/openafs/module.nix
@@ -28,68 +28,15 @@ stdenv.mkDerivation {
   inherit src;
 
   patches = [
-    # Linux: Use get_tree_nodev
+    # Linux: pagevec.h renamed to folio_batch.h
     (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/c02a8f451b48766aa163e729abe40d145751b2dc.patch";
-      hash = "sha256-9okSQLV4tW1wjoffQXPneZbu6tTRqrqVPbEOwZmaD+E=";
+      url = "https://github.com/openafs/openafs/commit/d47c438aec49e417066a7bef00bd82078014f5ea.patch";
+      hash = "sha256-LPURZovpl6KbigzP4mNjgHvPlXYKY5Pxh8sj9RT2W08=";
     })
-    # LINUX: Re-dirty folio on writepages recursion
+    # Linux: Add comment for d_alias configure test
     (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/11849e96820eca64d91742a8c521614e1e99d9fa.patch";
-      hash = "sha256-F2MOqEDaj4e0Xj1mvs7v61cutZY3cO22p9iIp2bLiRQ=";
-    })
-    # Linux: Introduce LINUX_WRITE_CACHE_PAGES_USES_FOLIOS
-    (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/63a3503240c06187fa87514e5ea421cece483422.patch";
-      hash = "sha256-ZWV8IZ8CeFQaEOamqKfkXuUccSxCRFNkZ7/kxKbEuis=";
-    })
-    # Linux: Avoid write_cache_pages() for ->writepages()
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16704/revisions/d465a07a98c2b0b2c23780571a8fe70c2584473a/patch";
-      decode = "base64 -d";
-      hash = "sha256-2FOf+o36gbTHm90RxtOI7iXcgb6rv9nh9rSjZzL5O7A=";
-    })
-    # LINUX: Log warning on recursive folio writeback
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16705/revisions/d66ca6372461840c6ecaaa46ec293640c8f22573/patch";
-      decode = "base64 -d";
-      hash = "sha256-A383wDMkwnGFatBDHUGV8FVqPMjzvhqUnIWrP2C+ym4=";
-    })
-    # Linux: Move afs_root()/afs_fill_super() in osi_vfsops
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16706/revisions/988c70859f1d402022e9342e28f0c5a954760a72/patch";
-      decode = "base64 -d";
-      hash = "sha256-JsZwGGa7dRT43RIUUY3hYCbbqPObd5bkDOHl9QK/MhE=";
-    })
-    # Linux: Use sockaddr_unsized for socket->ops->bind
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16707/revisions/e6069d6c35e848b5b388f4c47a2ecf0d72420198/patch";
-      decode = "base64 -d";
-      hash = "sha256-hTRaTqOc0njW/RIsNTrFZ5uWTrQq04Fuh/Sk7K2Q5e4=";
-    })
-    # Linux: Pass 3rd parameter to filemap_alloc_folio()
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16708/revisions/48d2184ec95418cada68b70919b0afd9888bb945/patch";
-      decode = "base64 -d";
-      hash = "sha256-CSGlXYkkLSHQoWK2xLpUYJDOUP/mlsxkTru2qdmbeQo=";
-    })
-    # Linux: implement aops->migrate_folio
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16709/revisions/2c51471aea08cc495a5d59fee6e651ba58c9d772/patch";
-      decode = "base64 -d";
-      hash = "sha256-TtcblVczSp8b1bfd0ajWjK2LffAkgYr2+KUL2nEe8hs=";
-    })
-    # Linux: Use set_default_d_op() to set dentry ops
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16729/revisions/6d0a2107fcab28fc4ba64d365133d171b75bd3dc/patch";
-      decode = "base64 -d";
-      hash = "sha256-OKxR5zzVKSXPzudPl5jc7koObisQMMqq/d9kfrMem/M=";
-    })
-    # Linux: Use __getname()/__putname() to alloc name
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16738/revisions/a1754489f382aabd087f14c325d13a36faa5bf5c/patch";
-      decode = "base64 -d";
-      hash = "sha256-JizLrwnujybCkcbDIltGfgVtCc5fL3ZxWvgVbI1kKto=";
+      url = "https://github.com/openafs/openafs/commit/fd157926f08d10afe981d85654395bbf083ea7a3.patch";
+      hash = "sha256-gJ+ylIEZwJcpTWc5hmIXS/QcxtICqjaEzZsl2QegjhY=";
     })
   ];
 
diff --git a/pkgs/by-name/op/openafs/srcs.nix b/pkgs/by-name/op/openafs/srcs.nix
index 596198b13cfc..28de72ebe14d 100644
--- a/pkgs/by-name/op/openafs/srcs.nix
+++ b/pkgs/by-name/op/openafs/srcs.nix
@@ -1,16 +1,16 @@
 { fetchurl }:
 rec {
-  version = "1.8.15";
+  version = "1.8.16";
   src = fetchurl {
     url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    hash = "sha256-MvEN0kG12LhG5CWrnL8nW1VroYgL9998RZzZ60kFg1U=";
+    hash = "sha256-7oEnaJdXy9lyOoU6EvrigcnenD6JSkvZAQf7b4UnBGk=";
   };
 
   srcs = [
     src
     (fetchurl {
       url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      hash = "sha256-kAGRw3T0VdJ/XMqqFjV0Z7gzKbWeyZWEsMsBJ+7ijsE=";
+      hash = "sha256-F9fyLe5Ofs6Ri4MXlO63wOZmhZuY8FAh2P/aoAX5wiQ=";
     })
   ];
 }
diff --git a/pkgs/by-name/op/openttd-jgrpp/package.nix b/pkgs/by-name/op/openttd-jgrpp/package.nix
index a362791747e5..310571619822 100644
--- a/pkgs/by-name/op/openttd-jgrpp/package.nix
+++ b/pkgs/by-name/op/openttd-jgrpp/package.nix
@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.72.3";
+  version = "0.72.4";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-W9RakMdyL4eJ/90+/vypzl4FwX7inlrdH9liXNYT3IA=";
+    hash = "sha256-qiTKoaCUdcm7dJKfxwTtYU8f5C8RYxj7XZL/TtOygtg=";
   };
   patches = [ ];
 
diff --git a/pkgs/by-name/pa/panache/package.nix b/pkgs/by-name/pa/panache/package.nix
index e50261ff6653..9cbc05d6eaf5 100644
--- a/pkgs/by-name/pa/panache/package.nix
+++ b/pkgs/by-name/pa/panache/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "panache";
-  version = "2.54.0";
+  version = "2.58.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "panache";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JyLIsCJc/kmVBMp+9PRmkx2P1jrtTmmHfbk7mMcHQQ0=";
+    hash = "sha256-QLW+3xkAYPFVAXM2VwhZm175CksDG9HL9rCEkH7knlU=";
   };
 
-  cargoHash = "sha256-LLEkdc6MstTfRGoTgtOncmRlSBXnNA2f1qFsR0O5XEM=";
+  cargoHash = "sha256-OXkkaXWFFOBsZEWL88UWy1dqpwZazk9i8ZAH/tprag4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pa/pangolin-cli/package.nix b/pkgs/by-name/pa/pangolin-cli/package.nix
index f558700c7a2e..3cee1faf7112 100644
--- a/pkgs/by-name/pa/pangolin-cli/package.nix
+++ b/pkgs/by-name/pa/pangolin-cli/package.nix
@@ -10,20 +10,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "pangolin-cli";
-  version = "0.8.3";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-y+B29E6wXUcMQsWLAcLYIpg0uuqjr+zfxf2WVt0oY9A=";
+    hash = "sha256-6TRO7tBrWH6EeMFEA6FrpvmlCkUcMtiZ5qr/LQjcLeY=";
   };
 
   ldflags = [
     "-X github.com/fosrl/cli/internal/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-r7Tbs05jRlIX1zLRMVqzvDth4+yaMUck2q6R3uPHAWs=";
+  vendorHash = "sha256-UmzzZDO2lz/HsrUlnV8Wa4GM8lYgoI0ggJlOvxrd79Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pe/perplexity-mcp/package.nix b/pkgs/by-name/pe/perplexity-mcp/package.nix
index 4784dfe39c19..e0516a6f023f 100644
--- a/pkgs/by-name/pe/perplexity-mcp/package.nix
+++ b/pkgs/by-name/pe/perplexity-mcp/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "perplexity-mcp";
-  version = "0-unstable-2026-04-14";
+  version = "0-unstable-2026-06-17";
 
   src = fetchFromGitHub {
     owner = "perplexityai";
     repo = "modelcontextprotocol";
-    rev = "dd5e0785520833ebc95d5e97c8fa68971dcae07b";
-    hash = "sha256-hMIPsUsI1e8bOdPQ9t6m4/vGv07NCuC8wnYLUKolNOo=";
+    rev = "7c8993499c808e5b3c11b8c16736687ecef0f457";
+    hash = "sha256-6uGJJ+xEVoUZYSPTMr4DSh6j4bq8nYSsUG5XDC9WKag=";
   };
 
   npmDepsHash = "sha256-UWxUjneYQeM9GlbIr/zW2TrZuPJ2QOTKwbXKNuVazFg=";
diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix
index 584908cb2aae..1754b9420be0 100644
--- a/pkgs/by-name/pl/plakar/package.nix
+++ b/pkgs/by-name/pl/plakar/package.nix
@@ -8,16 +8,19 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "plakar";
-  version = "1.0.6";
+  version = "1.1.3";
+
+  # to avoid having all the Test(Get|Set|Validate)Service.* tests fail on darwin
+  __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "PlakarKorp";
     repo = "plakar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X8m2dXMb+cxWBbKm0MhhY2pNSBTUONyHoPnGlDG9jOg=";
+    hash = "sha256-AQyE8VtTdkuevBVMLDfhN1h6/DirdhLgPu+76QfRUas=";
   };
 
-  vendorHash = "sha256-6MdwUJTu9QvqZ3iGEg39L5B5mce7JssFTF3ZmoTuH3M=";
+  vendorHash = "sha256-nueFE6Ka1dq4Rt+Qs9YJU9N+yYfEyA8jkVGC4vKLjSI=";
 
   buildInputs = [
     fuse
@@ -30,8 +33,8 @@ buildGo125Module (finalAttrs: {
   checkFlags =
     let
       skippedTests = [
-        # mount: fusermount: exec: "fusermount": executable file not found in $PATH
-        "TestExecuteCmdMountDefault"
+        # hangs even outside Nix, so probably an upstream issue:
+        "TestRebuildStateVersionMismatch"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         "TestBTreeScanMemory"
@@ -53,6 +56,7 @@ buildGo125Module (finalAttrs: {
     maintainers = with lib.maintainers; [
       heph2
       qbit
+      nadir-ishiguro
     ];
   };
 })
diff --git a/pkgs/by-name/pr/prometheus-bind-exporter/package.nix b/pkgs/by-name/pr/prometheus-bind-exporter/package.nix
index 1749028329e9..b135449f097b 100644
--- a/pkgs/by-name/pr/prometheus-bind-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-bind-exporter/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bind_exporter";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus-community";
     repo = "bind_exporter";
-    sha256 = "sha256-x/XGatlXCKo9cI92JzFItApsjuZAfZX+8IZRpy7PVUo=";
+    sha256 = "sha256-r1P+zy3iMgPmfvIBgycW8KS0gfNOxCT9YMmHdeY4uXA=";
   };
 
-  vendorHash = "sha256-f0ei/zotOj5ebURAOWUox/7J3jS2abQ5UgjninI9nRk=";
+  vendorHash = "sha256-/fPj5LOe3QdnVPdtYdaqtnGMJ7/SZ458mpvjwO8TxEI=";
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) bind; };
 
diff --git a/pkgs/by-name/qt/qtwebapp/package.nix b/pkgs/by-name/qt/qtwebapp/package.nix
index c2f04ff5df82..52b17e7c0403 100644
--- a/pkgs/by-name/qt/qtwebapp/package.nix
+++ b/pkgs/by-name/qt/qtwebapp/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   __structuredAttrs = true;
 
-  sourceRoot = "source/QtWebApp";
+  sourceRoot = "${finalAttrs.src.name}/QtWebApp";
 
   postPatch = ''
     cat >>QtWebApp.pro <<EOF
diff --git a/pkgs/by-name/rd/rdma-core/package.nix b/pkgs/by-name/rd/rdma-core/package.nix
index fa6d99f4039a..e1504a0a9bbe 100644
--- a/pkgs/by-name/rd/rdma-core/package.nix
+++ b/pkgs/by-name/rd/rdma-core/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchurl,
+  gitUpdater,
   cmake,
   pkg-config,
   docutils,
@@ -15,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "62.0";
+  version = "63.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1n33KH8HTyZ0jHtDanopxwABiLjAvt+V7lgaeabJs8s=";
+    hash = "sha256-YW6BJS6acj9S8wFXUhC1vrJSm9YowGGuwWEBzQRVyPM=";
   };
 
   strictDeps = true;
@@ -47,9 +49,20 @@ stdenv.mkDerivation (finalAttrs: {
     udev
   ];
 
+  patches = [
+    (fetchurl {
+      # remove when rdma-core 64.0 is released
+      # https://github.com/linux-rdma/rdma-core/pull/1737
+      name = "cmake-allow-overriding-sysusers.d-install-directory";
+      url = "https://github.com/linux-rdma/rdma-core/commit/8b186b5d932701e94bbced83d2f3899ee53f041a.patch?full_index=1";
+      hash = "sha256-Rjknu7mmJL2Sx+Ypq9SRXU4LUiHERs9j5/qMIZaiRTI=";
+    })
+  ];
+
   cmakeFlags = [
     "-DCMAKE_INSTALL_RUNDIR=/run"
     "-DCMAKE_INSTALL_SHAREDSTATEDIR=/var/lib"
+    "-DSYSUSERS_DIR=${placeholder "out"}/lib/sysusers.d"
   ];
 
   postPatch = ''
@@ -73,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = {
     description = "RDMA Core Userspace Libraries and Daemons";
     homepage = "https://github.com/linux-rdma/rdma-core";
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 99a522a647b2..8fa74c3e2fd6 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-06-08";
+  version = "0-unstable-2026-06-23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "ecd06775c379e4b45b3f4d9176782695ee479014";
-    hash = "sha256-hv+ulJEZdB38E9ljIeRa3LupouGGiBffjNWBidhNcoQ=";
+    rev = "ac3c1b8b0c030adadfcb266af39d7dc7379ceaf9";
+    hash = "sha256-9Xxb2/B6ctm3HQpDGmAbL+v+n5EjcWWe46KCSMlvujs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/repath-studio/package.nix b/pkgs/by-name/re/repath-studio/package.nix
index 202b6f94480f..281bb39d9fbd 100644
--- a/pkgs/by-name/re/repath-studio/package.nix
+++ b/pkgs/by-name/re/repath-studio/package.nix
@@ -21,13 +21,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "repath-studio";
-  version = "0.4.15";
+  version = "0.4.16";
 
   src = fetchFromGitHub {
     owner = "repath-studio";
     repo = "repath-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fnu7tZ8chvnDMuMw4QD1NuQgaFOBzHfzl2ePQ5iwnao=";
+    hash = "sha256-wqDsjr+ZQDRFINzr38i7ClgREEmAaKt+U/Ma63vAH1k=";
   };
 
   patches = [
@@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: {
 
   makeCacheWritable = true;
 
-  npmDepsHash = "sha256-0dSFEZ02D83yplqT3GV9TyUwJ3lDjxM47pGYwUXzatw=";
+  npmDepsHash = "sha256-IvKHLxX7rTB3AGDzNQIVNhfXs0C6TVATdVGUDHGrpOo=";
 
   nativeBuildInputs = [
     finalAttrs.passthru.clojureWithHome
diff --git a/pkgs/by-name/re/repath-studio/pin-clojure.patch b/pkgs/by-name/re/repath-studio/pin-clojure.patch
index 38e3f57a074b..95bbbc0f452f 100644
--- a/pkgs/by-name/re/repath-studio/pin-clojure.patch
+++ b/pkgs/by-name/re/repath-studio/pin-clojure.patch
@@ -1,5 +1,5 @@
 diff --git a/deps.edn b/deps.edn
-index 027cf5e..648c635 100644
+index 6abd18c..d2f8e14 100644
 --- a/deps.edn
 +++ b/deps.edn
 @@ -1,5 +1,6 @@
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 8aa8f51b8273..ca5d02475508 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.17";
+  version = "0.15.18";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-+UsKRBe+lp/LdsmK/W11wCt2RypEryA5eBPb01OKCJw=";
+    hash = "sha256-DH00tENXdCdNcGPXPGzZsU3RVYQ0VBe1QLvbgEg/G6k=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-y1sKf+KXya/K+WUiIE357U6DXh/d+AQgj0SQIi1gpUw=";
+  cargoHash = "sha256-RmK14NMPbhoRVLwIF5GXdGQg2AnMH20JGx7XF4HO+wY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 86a1e9121b4e..e64d55b6cef6 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -43,11 +43,13 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     "-extldflags=-static"
   ];
 
   env = {
-    CGO_ENABLED = 0;
+    CGO_ENABLED = if stdenv.hostPlatform.isDarwin then 1 else 0;
     GODEBUG = "http2client=0";
   };
 
@@ -93,6 +95,5 @@ buildGoModule (finalAttrs: {
       wozeparrot
     ];
     mainProgram = "weed";
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/st/starpls/package.nix b/pkgs/by-name/st/starpls/package.nix
index 0f115597fae8..ff3f456153a2 100644
--- a/pkgs/by-name/st/starpls/package.nix
+++ b/pkgs/by-name/st/starpls/package.nix
@@ -18,6 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-5xYfQRm7U7sEQiJEfjaLznoXUxHsxnLmIEA/OxTkjFg=";
 
+  # Only build the starpls language server, not the xtask build helper, which
+  # would otherwise leak into $out/bin.
+  cargoBuildFlags = [ "-p starpls" ];
+
   nativeBuildInputs = [
     protobuf
   ];
diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index 7dc357f4e479..998282b00828 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -11,24 +11,24 @@
   copyDesktopItems,
   pnpm_10,
   nodejs,
-  electron_38,
+  electron_42,
   zip,
   nix-update-script,
 }:
 let
-  electron = electron_38;
+  electron = electron_42;
   stdenv = stdenvNoCC;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "stoat-desktop";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "stoatchat";
     repo = "for-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-vMXnBniA0wyoK7Pe13h/yHtf8ky59ts4VQb9k7KuUCE=";
+    hash = "sha256-l4kxlPwohaxserVyNAb3Dp4f5XhnPUKeuRJwrOl9EWc=";
   };
 
   postPatch = ''
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
     pnpm = pnpm_10;
-    hash = "sha256-m0EuM8qTCFLxxO0RNze5WgMkuHZXeIi+U/Jiuv91eCg=";
+    hash = "sha256-bIDwEmt/8URBMx7XIQ1EP4SucwMuyGZE1hlQM0rxDnw=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
index 1bc5810d3fd3..db6009945e9c 100644
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
@@ -743,11 +743,6 @@ fn handle_modified_unit(
                 // This unit should be restarted instead of stopped and started.
                 units_to_restart.insert(unit.to_string(), ());
                 record_unit(&restart_list, unit);
-                // Remove from units to reload so we don't restart and reload
-                if units_to_reload.contains_key(unit) {
-                    units_to_reload.remove(unit);
-                    unrecord_unit(&reload_list, unit);
-                }
             } else {
                 // If this unit is socket-activated, then stop the socket unit(s) as well, and
                 // restart the socket(s) instead of the service.
@@ -769,10 +764,17 @@ fn handle_modified_unit(
                     };
 
                     if sockets.is_empty() {
-                        sockets.push(format!("{base_name}.socket"));
+                        // For a templated instance (`foo@bar.service`), `base_name`
+                        // includes the trailing `@`; the implicitly-associated socket
+                        // is `foo.socket`, so strip it.
+                        let socket_base = base_name.strip_suffix('@').unwrap_or(base_name);
+                        sockets.push(format!("{socket_base}.socket"));
                     }
 
                     for socket in &sockets {
+                        let socket_in_new_config =
+                            toplevel.join(scope.etc_dir()).join(socket).exists();
+
                         if active_cur.contains_key(socket) {
                             // We can now be sure this is a socket-activated unit
 
@@ -783,7 +785,7 @@ fn handle_modified_unit(
                             }
 
                             // Only restart sockets that actually exist in new configuration:
-                            if toplevel.join(scope.etc_dir()).join(socket).exists() {
+                            if socket_in_new_config {
                                 if use_restart_as_stop_and_start {
                                     units_to_restart.insert(socket.to_string(), ());
                                     record_unit(&restart_list, socket);
@@ -794,12 +796,9 @@ fn handle_modified_unit(
 
                                 socket_activated = true;
                             }
-
-                            // Remove from units to reload so we don't restart and reload
-                            if units_to_reload.contains_key(unit) {
-                                units_to_reload.remove(unit);
-                                unrecord_unit(&reload_list, unit);
-                            }
+                        } else if socket_in_new_config {
+                            // Transitioning to socket activation; let the socket start it.
+                            socket_activated = true;
                         }
                     }
                 }
@@ -828,11 +827,11 @@ fn handle_modified_unit(
                 } else {
                     units_to_stop.insert(unit.to_string(), ());
                 }
-                // Remove from units to reload so we don't restart and reload
-                if units_to_reload.contains_key(unit) {
-                    units_to_reload.remove(unit);
-                    unrecord_unit(&reload_list, unit);
-                }
+            }
+
+            // Remove from units to reload so we don't restart and reload
+            if units_to_reload.remove(unit).is_some() {
+                unrecord_unit(&reload_list, unit);
             }
         }
     }
diff --git a/pkgs/by-name/te/terminal-notifier/package.nix b/pkgs/by-name/te/terminal-notifier/package.nix
index 9cca1d289092..ecfea7c2fb1d 100644
--- a/pkgs/by-name/te/terminal-notifier/package.nix
+++ b/pkgs/by-name/te/terminal-notifier/package.nix
@@ -1,40 +1,60 @@
 {
-  stdenv,
-  runtimeShell,
+  apple-sdk,
+  fetchFromGitHub,
+  ibtool,
   lib,
-  fetchzip,
+  makeBinaryWrapper,
+  stdenv,
+  xcbuildHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "terminal-notifier";
-
   version = "2.0.0";
 
-  src = fetchzip {
-    url = "https://github.com/alloy/terminal-notifier/releases/download/${version}/terminal-notifier-${version}.zip";
-    sha256 = "0gi54v92hi1fkryxlz3k5s5d8h0s66cc57ds0vbm1m1qk3z4xhb0";
-    stripRoot = false;
+  src = fetchFromGitHub {
+    owner = "julienXX";
+    repo = "terminal-notifier";
+    tag = finalAttrs.version;
+    hash = "sha256-Hd9cI3R2nQK2deBb5CBYz4DTHAEcO4vzqtA5qZwa1Ao=";
   };
 
-  dontBuild = true;
+  nativeBuildInputs = [
+    ibtool
+    makeBinaryWrapper
+    xcbuildHook
+  ];
+
+  buildInputs = [
+    apple-sdk
+  ];
+
+  xcbuildFlags = [
+    "-target"
+    "terminal-notifier"
+    "-configuration"
+    "Release"
+  ];
 
   installPhase = ''
-    mkdir -p $out/Applications
-    mkdir -p $out/bin
-    cp -r terminal-notifier.app $out/Applications
-    cat >$out/bin/terminal-notifier <<EOF
-    #!${runtimeShell}
-    cd $out/Applications/terminal-notifier.app
-    exec ./Contents/MacOS/terminal-notifier "\$@"
-    EOF
-    chmod +x $out/bin/terminal-notifier
+    runHook preInstall
+
+    mkdir -p $out/{Applications,bin}
+    cp -r Products/Release/terminal-notifier.app $out/Applications/
+    makeWrapper \
+      $out/Applications/terminal-notifier.app/Contents/MacOS/terminal-notifier \
+      $out/bin/terminal-notifier \
+      --chdir $out/Applications/terminal-notifier.app
+
+    runHook postInstall
   '';
 
   meta = {
-    maintainers = [ ];
+    description = "Send macOS User Notifications from the command-line";
     homepage = "https://github.com/julienXX/terminal-notifier";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ amarshall ];
     platforms = lib.platforms.darwin;
     mainProgram = "terminal-notifier";
   };
-}
+})
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 41db756b4492..48a4dbae05f2 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.49";
+  version = "0.0.52";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-IKeoskueujGYFjhUd3V7iwKwZjFZqG3OYfe36S6J2aw=";
+    hash = "sha256-p9fTzQ4DYvnwrtLdpSTekBV4ZbR1KETR8dfsbp8CDpo=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-y1sKf+KXya/K+WUiIE357U6DXh/d+AQgj0SQIi1gpUw=";
+  cargoHash = "sha256-NUIdYOeyRsR/ZQueEXshYdWTnSeQiRjZRRi2ag8Dm48=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
diff --git a/pkgs/by-name/ur/urweb/package.nix b/pkgs/by-name/ur/urweb/package.nix
index 9b7274bb326a..445c01cec8f0 100644
--- a/pkgs/by-name/ur/urweb/package.nix
+++ b/pkgs/by-name/ur/urweb/package.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = [
+      lib.maintainers.buggymcbugfix
       lib.maintainers.thoughtpolice
       lib.maintainers.sheganinans
     ];
diff --git a/pkgs/by-name/wi/witr/package.nix b/pkgs/by-name/wi/witr/package.nix
index 6c8dd966efc7..e4a46cf2f4b2 100644
--- a/pkgs/by-name/wi/witr/package.nix
+++ b/pkgs/by-name/wi/witr/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "witr";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "pranshuparmar";
     repo = "witr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kNiBcLk+rxJno1ZHPxr28EI5T3tpJnFXgh8zIvEYy6M=";
+    hash = "sha256-xlVzDEYm/45jmEZKQQeEMSGk2ySjOdkkynRs9Q9qIiY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 4acddd306b5f..97b7596b937c 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -271,7 +271,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "USE_OPENMP" false) # openblas will refuse building with both USE_OPENMP=ON and USE_THREAD=OFF
   ];
 
-  doCheck = true;
+  # FIXME: this broke some time between a0374025a863d007d98e3297f6aa46cc3141c2f0 and 34268251cf5547d39063f2c5ea9a196246f7f3a6
+  # This just serves to unbreak stable
+  doCheck = stdenv.hostPlatform.system != "i686-linux";
 
   postInstall = ''
         # Provide headers in /include directly for compat with some consumers like flint
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index 11e53f052606..b2910394647b 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -19,13 +19,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "eliom";
-  version = "12.0.1";
+  version = "12.1.0";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "eliom";
     tag = finalAttrs.version;
-    hash = "sha256-Lja3Xe3FszzyILhpOXWTyA0ippaU6aW5CJ06WEKgbkA=";
+    hash = "sha256-VJHt64XheW+JPZ3pynlOvpTgXf5nE9HCB4K1bWUXmAs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/executorch/default.nix b/pkgs/development/python-modules/executorch/default.nix
index e4fe62894755..aa3ec5c2ea43 100644
--- a/pkgs/development/python-modules/executorch/default.nix
+++ b/pkgs/development/python-modules/executorch/default.nix
@@ -111,12 +111,15 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     # But the build script is sensitive to this env variable.
     # Fixes:
     #  Some binaries contain forbidden references to /build/. Check the error above!
-    CMAKE_ARGS = lib.concatStringsSep " " [
+    CMAKE_ARGS = toString [
       (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
 
       # For some cmake-tier reason, cmakeBool does not work here
       (lib.cmakeFeature "EXECUTORCH_BUILD_CUDA" (if cudaSupport then "ON" else "OFF"))
     ];
+  }
+  // lib.optionalAttrs cudaSupport {
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
   };
 
   build-system = [
@@ -140,6 +143,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   buildInputs = lib.optionals cudaSupport [
     cudaPackages.cuda_cudart
     cudaPackages.cuda_nvrtc
+    cudaPackages.libcurand
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/mne/default.nix b/pkgs/development/python-modules/mne/default.nix
index c1efad30c8fb..7a767a48fd63 100644
--- a/pkgs/development/python-modules/mne/default.nix
+++ b/pkgs/development/python-modules/mne/default.nix
@@ -32,6 +32,8 @@ buildPythonPackage rec {
   version = "1.12.1";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "mne-tools";
     repo = "mne-python";
@@ -99,11 +101,6 @@ buildPythonPackage rec {
     "test_sys_info_basic"
   ];
 
-  pytestFlag = [
-    # removes 700k lines from pytest log, remove this when scipy is at v1.17.0
-    "--disable-warnings"
-  ];
-
   disabledTestMarks = [
     "slowtest"
     "ultraslowtest"
diff --git a/pkgs/development/python-modules/skorch/default.nix b/pkgs/development/python-modules/skorch/default.nix
index 842ae617b8e0..b916413ab003 100644
--- a/pkgs/development/python-modules/skorch/default.nix
+++ b/pkgs/development/python-modules/skorch/default.nix
@@ -12,6 +12,7 @@
   tqdm,
   flaky,
   llvmPackages,
+  openssl,
   pandas,
   pytest-cov-stub,
   pytestCheckHook,
@@ -45,6 +46,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     flaky
+    openssl
     pytest-cov-stub
     pytestCheckHook
     safetensors
diff --git a/pkgs/development/python-modules/xmldiff/default.nix b/pkgs/development/python-modules/xmldiff/default.nix
index 2dd2eb288806..8e9d8f61c1fb 100644
--- a/pkgs/development/python-modules/xmldiff/default.nix
+++ b/pkgs/development/python-modules/xmldiff/default.nix
@@ -7,30 +7,22 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "xmldiff";
-  version = "2.7.0";
+  version = "3.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-wJELH4ADZt1+xikj5dBuiwahvZEgVpocJ/TyRGucaKI=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-OA7E0FzvM/W3Bs94mrzISNJ3MNZ+AtwLTxEH4Wzpqq0=";
   };
 
   build-system = [ setuptools ];
 
-  dependencies = [
-    lxml
-    setuptools
-  ];
+  dependencies = [ lxml ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  disabledTests = [
-    # lxml 6.0 compat issue
-    "test_api_diff_texts"
-  ];
-
   pythonImportsCheck = [ "xmldiff" ];
 
   meta = {
@@ -40,4 +32,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sfrijters ];
   };
-}
+})
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 98750c6c2ad2..e5f941af3770 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -146,14 +146,14 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ jq ];
-              value = toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
+            # NIX_ATTRS_JSON_FILE won't have `value` if it's null, but jq returns null for missing properties anyway
+            # jsonNull test keeps this in check
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              jq . "$valuePath" > $out
+              jq .value "$NIX_ATTRS_JSON_FILE" > $out
             ''
         ) { };
 
@@ -171,14 +171,16 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ remarshal_0_17 ];
-              value = toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              json2yaml "$valuePath" "$out"
+              json2yaml ${
+                # attributes with null values are omitted from the JSON with structured attrs
+                # yaml_1_1Null test keeps this in check
+                if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"''
+              } "$out"
             ''
         ) { };
 
@@ -196,14 +198,16 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ remarshal ];
-              value = toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              json2yaml "$valuePath" "$out"
+              json2yaml ${
+                # attributes with null values are omitted from the JSON with structured attrs
+                # yaml_1_2Null test keeps this in check
+                if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"''
+              } "$out"
             ''
         ) { };
 
@@ -958,8 +962,10 @@ optionalAttrs allowAliases aliases
                 python3
                 black
               ];
-              imports = toJSON (value._imports or [ ]);
-              value = toJSON (removeAttrs value [ "_imports" ]);
+              imports = value._imports or [ ];
+              # value must be an attrset, type would verify that,
+              # otherwise removeAttrs will fail.
+              value = removeAttrs value [ "_imports" ];
               pythonGen = pkgs.writeText "pythonGen" ''
                 import json
                 import os
@@ -982,26 +988,20 @@ optionalAttrs allowAliases aliases
                     else:
                         return repr(value)
 
-                with open(os.environ["importsPath"], "r") as f:
-                    imports = json.load(f)
-                    if imports is not None:
-                        for i in imports:
+                with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
+                    attrs = json.load(f)
+                    if attrs["imports"] is not None:
+                        for i in attrs["imports"]:
                             print(f"import {i}")
                         print()
 
-                with open(os.environ["valuePath"], "r") as f:
-                    for key, value in json.load(f).items():
+                    for key, value in attrs["value"].items():
                         print(f"{key} = {recursive_repr(value)}")
               '';
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              export importsPath="$TMPDIR/imports"
-              printf "%s" "$imports" > "$importsPath"
-              export valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              cat "$valuePath"
               python3 "$pythonGen" > $out
               black $out
             ''
@@ -1015,7 +1015,13 @@ optionalAttrs allowAliases aliases
     }:
     if format == "badgerfish" then
       {
-        type = serializableValueWith { typeName = "XML"; };
+        type =
+          attrsOf (serializableValueWith {
+            typeName = "XML";
+          })
+          // {
+            description = "XML value";
+          };
 
         generate =
           name: value:
@@ -1031,14 +1037,16 @@ optionalAttrs allowAliases aliases
                   python3Packages.xmltodict
                   libxml2Python
                 ];
-                value = toJSON value;
+                inherit value;
                 pythonGen = pkgs.writeText "pythonGen" ''
                   import json
                   import os
                   import xmltodict
 
-                  with open(os.environ["valuePath"], "r") as f:
-                      print(xmltodict.unparse(json.load(f), full_document=${
+                  with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
+                      value = json.load(f).get("value")
+                      assert type(value) is dict, "value must be an attrset"
+                      print(xmltodict.unparse(value, full_document=${
                         if withHeader then "True" else "False"
                       }, pretty=True, indent=" " * 2))
                 '';
@@ -1046,8 +1054,6 @@ optionalAttrs allowAliases aliases
                 __structuredAttrs = true;
               }
               ''
-                export valuePath="$TMPDIR/value"
-                printf "%s" "$value" > "$valuePath"
                 python3 "$pythonGen" > $out
                 xmllint $out > /dev/null
               ''
diff --git a/pkgs/pkgs-lib/formats/configobj/default.nix b/pkgs/pkgs-lib/formats/configobj/default.nix
index 8179c4412e5f..227d8e7aa990 100644
--- a/pkgs/pkgs-lib/formats/configobj/default.nix
+++ b/pkgs/pkgs-lib/formats/configobj/default.nix
@@ -3,10 +3,6 @@
   pkgs,
 }:
 let
-  inherit (lib)
-    toJSON
-    ;
-
   inherit (lib.types)
     serializableValueWith
     ;
@@ -25,12 +21,12 @@ in
               (pkgs.python3.withPackages (ps: [ ps.configobj ]))
             ];
 
-            valuesJSON = toJSON value;
+            inherit value;
             __structuredAttrs = true;
             strictDeps = true;
           }
           ''
-            printf "%s" "$valuesJSON" | python3 ${./generate.py} > "$out"
+            python3 ${./generate.py} > "$out"
           '';
     };
 }
diff --git a/pkgs/pkgs-lib/formats/configobj/generate.py b/pkgs/pkgs-lib/formats/configobj/generate.py
index 5863396c120d..e531e68a4fbb 100644
--- a/pkgs/pkgs-lib/formats/configobj/generate.py
+++ b/pkgs/pkgs-lib/formats/configobj/generate.py
@@ -1,7 +1,10 @@
 import json
+import os
 import sys
 from configobj import ConfigObj
 
 config = ConfigObj(interpolation=False, encoding="UTF8")
-config.update(json.load(sys.stdin))
+with open(os.environ["NIX_ATTRS_JSON_FILE"]) as f:
+    value = json.load(f).get("value")
+config.update(value)
 config.write(sys.stdout.buffer)
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index 1b10f1361038..b03b44c99150 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -142,6 +142,14 @@ runBuildTests {
     '';
   };
 
+  jsonNull = shouldPass {
+    format = formats.json { };
+    input = null;
+    expected = ''
+      null
+    '';
+  };
+
   yaml_1_1Atoms = shouldPass {
     format = formats.yaml_1_1 { };
     input = {
@@ -176,6 +184,15 @@ runBuildTests {
     '';
   };
 
+  yaml_1_1Null = shouldPass {
+    format = formats.yaml_1_1 { };
+    input = null;
+    expected = ''
+      null
+      ...
+    '';
+  };
+
   yaml_1_2Atoms = shouldPass {
     format = formats.yaml_1_2 { };
     input = {
@@ -210,6 +227,16 @@ runBuildTests {
     '';
   };
 
+  yaml_1_2Null = shouldPass {
+    format = formats.yaml_1_2 { };
+    input = null;
+    # nixfmt insists on removing indentation, so force it with ${"  "}
+    expected = ''
+
+      ${"  "}null
+    '';
+  };
+
   iniAtoms = shouldPass {
     format = formats.ini { };
     input = {
@@ -884,6 +911,14 @@ runBuildTests {
     '';
   };
 
+  cdnNull = shouldPass {
+    format = formats.cdn { };
+    input = null;
+    expected = ''
+      null: null
+    '';
+  };
+
   # This test is responsible for
   #   1. testing type coercions
   #   2. providing a more readable example test
@@ -994,6 +1029,14 @@ runBuildTests {
     '';
   };
 
+  luaNull = shouldPass {
+    format = formats.lua { };
+    input = null;
+    expected = ''
+      return nil
+    '';
+  };
+
   nixConfAtoms = shouldPass {
     format = formats.nixConf {
       package = pkgs.nix;
@@ -1019,6 +1062,15 @@ runBuildTests {
     '';
   };
 
+  nixConfNull = shouldFail {
+    format = formats.nixConf {
+      package = pkgs.nix;
+      version = pkgs.nix.version;
+      extraOptions = "ignore-try = false";
+    };
+    input = null;
+  };
+
   phpAtoms = shouldPass rec {
     format = formats.php { finalVariable = "config"; };
     input = {
@@ -1048,6 +1100,16 @@ runBuildTests {
     '';
   };
 
+  phpNull = shouldPass {
+    format = formats.php { finalVariable = "config"; };
+    input = null;
+    expected = ''
+      <?php
+      declare(strict_types=1);
+      $config = null;
+    '';
+  };
+
   pythonVars = shouldPass (
     let
       format = formats.pythonVars { };
@@ -1105,6 +1167,11 @@ runBuildTests {
     }
   );
 
+  pythonVarsNull = shouldFail {
+    format = formats.pythonVars { };
+    input = null;
+  };
+
   phpReturn = shouldPass {
     format = formats.php { };
     input = {
@@ -1150,6 +1217,11 @@ runBuildTests {
     '';
   };
 
+  xmlNull = shouldFail {
+    format = formats.xml { };
+    input = null;
+  };
+
   PlistGenerate = shouldPass {
     format = formats.plist { };
     input = {
@@ -1225,6 +1297,17 @@ runBuildTests {
       </plist>'';
   };
 
+  PlistNull = shouldPass {
+    format = formats.plist { };
+    input = null;
+    expected = ''
+      <?xml version="1.0" encoding="UTF-8"?>
+      <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+      <plist version="1.0">
+
+      </plist>'';
+  };
+
   hcl1Atoms = shouldPass {
     format = formats.hcl1 { };
     input = {