diff --git a/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix b/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
index 1faf3bf64c02..a9d023b6c491 100644
--- a/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
+++ b/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
@@ -38,15 +38,16 @@
             postInstall
             ;
 
-          installPhase = ''
-            runHook preInstall
+          installPhase =
+            attrs.installPhase or ''
+              runHook preInstall
 
-            target=$out/${rtpPath}/${path}
-            mkdir -p $out/${rtpPath}
-            ${lib.optionalString (!(attrs.dontUnpack or false)) "cp -r . $target"}
+              target=$out/${rtpPath}/${path}
+              mkdir -p $out/${rtpPath}
+              ${lib.optionalString (!(attrs.dontUnpack or false)) "cp -r . $target"}
 
-            runHook postInstall
-          '';
+              runHook postInstall
+            '';
 
           meta = {
             platforms = lib.platforms.all;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 47944ed054a2..abbeeecb1dac 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-STiMgzJWnWfUz2Y+O/6QfTxZ3hClHOa+guJer33dEDg="
   },
   "hashicorp_random": {
-    "hash": "sha256-Y5p9/H3g85AYr/FVWO6zLaeHIGo7iGvMV6eHTGO0ehI=",
+    "hash": "sha256-wfRgzuV4UbP1lonqRcCreCqVje1YBt8lwoysMGH2yYg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/random",
     "owner": "hashicorp",
     "repo": "terraform-provider-random",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
+    "vendorHash": "sha256-J6zLLrX7/kKrkf00W2hDUYKpNmbrRzrziqb6aFRcO38="
   },
   "hashicorp_tfe": {
     "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
@@ -914,13 +914,13 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-C5zx1uf5VKZN/CBbcFe+GOYpso2L/ocztEBsDEL53mA=",
+    "hash": "sha256-3RCE2KCWgS8j30Ggh0HfX0D9ZPpgiTtgIk7+YmzYSfc=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.9.17",
+    "rev": "2026.9.24",
     "spdx": "0BSD",
-    "vendorHash": "sha256-wQPGzn9g0HUvelcQb7Ai29Zcoif6hNGOAK3sdzINPCU="
+    "vendorHash": "sha256-b2YIkwpeYCGsENzXSAPD7nhvmZ1Phxfcm3S5xsiC2t0="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 2c82feb8a489..28f3c39a3573 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -429,6 +429,46 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     ./fix-unpack-collabora.patch
+
+    # Add missing climits includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/6ebc3c540f2aa13363e3dcb32a44bfa2c7f66a9f.patch";
+      hash = "sha256-5GCosJryorH1P1Z2Zjey7oEC3seLHN5kH/ar4U7E74E=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0084c2b22ce26084df5a379135ba8ac174585ac0.patch";
+      hash = "sha256-zssmbzfaZX2sBdHbzm+aIC8ncidp3eupQoUloeGdPcQ=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/19c32b44fead600118377417012b111a4f238766.patch";
+      hash = "sha256-jO7oFEfoL7V1dj67vwDAEp2BwjQvfva4zV8sVAAc+2g=";
+    })
+
+    # Add missing limits.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/a6325b777b7bb9e1c760a4f1a02d48ba0889a7b1.patch";
+      hash = "sha256-QECBAdJ+4Q8c2kbdadNxzgDEebLvPy9cvRb34O7m5bA=";
+    })
+
+    # Add missing cstdint includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/47cabcb187dfbccb36ee02513998fbfcee509d5e.patch";
+      hash = "sha256-q883AMTtLzXwbwNRytCk6qiFA1snzba4JUsr7IaUEvI=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0fede06b020fa0327877f4a8722290d48a742a2c.patch";
+      hash = "sha256-8w89mtZuFvpZU0GVZoWPZVBM+UlgnbTYxoDJ8Ss64Bo=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/aa9a194a99cec1dbcee9226b703fdcf9b62962d7.patch";
+      hash = "sha256-Eztv186ke97u0ucdd3jQmJaxtrxnsiWWE/qVOBc2uGc=";
+    })
+
+    # Add missing stdint.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/d0265596672d78ad6f3980ff6fb900535aefd11f.patch";
+      hash = "sha256-tp7MW+8ExivGKKWjLy60lxWNf2hXF+jCD0pajo+YbVo=";
+    })
   ]
   ++ lib.optionals (lib.versionAtLeast version "26.8" && lib.versionOlder version "26.8.999") [
     ./26.8-add-dir-prereq.patch
diff --git a/pkgs/by-name/_1/_1password-cli/update.sh b/pkgs/by-name/_1/_1password-cli/update.sh
index bd476383eb15..b5e7905cf6c8 100755
--- a/pkgs/by-name/_1/_1password-cli/update.sh
+++ b/pkgs/by-name/_1/_1password-cli/update.sh
@@ -6,7 +6,7 @@ set -eu
 ROOT="$(dirname "$(readlink -f "$0")")"
 NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find default.nix in $ROOT"
+  echo "ERROR: cannot find package.nix in $ROOT"
   exit 1
 fi
 
diff --git a/pkgs/by-name/au/audiobookshelf/client.nix b/pkgs/by-name/au/audiobookshelf/client.nix
index 92d4469d7231..b7f526624bff 100644
--- a/pkgs/by-name/au/audiobookshelf/client.nix
+++ b/pkgs/by-name/au/audiobookshelf/client.nix
@@ -11,7 +11,7 @@ buildNpmPackage {
 
   src = "${src}/client";
 
-  npmDepsHash = "sha256-l7vdcggcVs9LYQ7DLumUUh67lxZ5giVMrtwUU6prfwI=";
+  npmDepsHash = "sha256-Rvy/bULWyVkGthfpIGkTMO8Lv1miywwea7jLODfm54Y=";
 
   env = {
     # don't download the Cypress binary
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 541bc7c82941..aa50dfb8fbcc 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -29,16 +29,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "audiobookshelf";
-  version = "2.37.0";
+  version = "2.37.1";
 
   src = fetchFromGitHub {
     owner = "advplyr";
     repo = "audiobookshelf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zo9xByg1QMdqfy161rnmfJ0Mt5CJvKbZIMijj2kQpQM=";
+    hash = "sha256-rTn64PrGPSKwDbsQmzvdSRa7UQEV1f2xXaYGtcVfrpk=";
   };
 
-  npmDepsHash = "sha256-S9RGAc5ge+ULtRMbiY1ZOaxY5Ra2ltZdCHcGbkhUxzs=";
+  npmDepsHash = "sha256-xHjZ3E1DGeb5NueP67hEX3vHH0Qlk4LTeZkMEFBhGyE=";
 
   inherit nodejs;
 
diff --git a/pkgs/by-name/ca/castopod/update.sh b/pkgs/by-name/ca/castopod/update.sh
index 742788dc8ddf..343cf1579059 100755
--- a/pkgs/by-name/ca/castopod/update.sh
+++ b/pkgs/by-name/ca/castopod/update.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 nixpkgs="$(git rev-parse --show-toplevel)"
-castopod_nix="$nixpkgs/pkgs/applications/audio/castopod/default.nix"
+castopod_nix="$(dirname "$0")/package.nix"
 
 # https://www.meetup.com/api/guide/#p02-querying-section
 query='
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 9437961cb9c2..06284e99f7f5 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "1.17.0";
+  version = "1.18.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ buildGoModule (finalAttrs: {
     owner = "databricks";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HWk3vw0DT8Jsjv9fM8jcQdJUDwEjjZEAYn7EP3V/OSQ=";
+    hash = "sha256-I0w62sVpL27gtnir8mZtGs6PbsNH8nwWc5JyCXfnlqI=";
   };
 
-  vendorHash = "sha256-eDFlN1dql+ojOSyP7huhzzyaH9o1tvdjHD4WxP//NwA=";
+  vendorHash = "sha256-6b++JxHIU6Zhv4357nEH4VHnCOty9KOMbwM6gVHU2qE=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fl/fleet/package.nix b/pkgs/by-name/fl/fleet/package.nix
index e9eb12a5d4e3..3e94178e94c8 100644
--- a/pkgs/by-name/fl/fleet/package.nix
+++ b/pkgs/by-name/fl/fleet/package.nix
@@ -12,12 +12,12 @@
 }:
 let
   pname = "fleet";
-  version = "4.90.1";
+  version = "4.92.1";
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${version}";
-    hash = "sha256-yD1snjDI5AAnHmnbpAUhtRx7ayPyqn9Tqv84p5W3SV4=";
+    hash = "sha256-O6BXxILefLY8zAUGsiAGixcD35+mpm/631s6711A5RE=";
   };
 
   frontend = stdenvNoCC.mkDerivation {
@@ -32,7 +32,7 @@ let
 
     yarnOfflineCache = fetchYarnDeps {
       yarnLock = src + "/yarn.lock";
-      hash = "sha256-OVXnPUQOr8KQYNthE8RzPV9IoQH8pxXHqjgTy7ymW/k=";
+      hash = "sha256-ZhkCkaX6mzavOAfSyK81s6wVN59VvBkRVBfgIfw17vE=";
     };
 
     NODE_ENV = "production";
@@ -54,7 +54,7 @@ in
 buildGoModule (finalAttrs: {
   inherit pname version src;
 
-  vendorHash = "sha256-1IGhOxzrQAyZu9a4HUvdN0MV5x8WnWMcFQejwy5WF1c=";
+  vendorHash = "sha256-PdJ6oCLC5CNLAXCS5KSrCTxUNcSxYLrx4myZ1e1TR58=";
 
   subPackages = [
     "cmd/fleet"
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index bbcf968e2eaf..bcd0dfceb956 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -52,21 +52,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.49.0";
+  version = "0.49.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-C1roiJ+mAm8rEoG5VAQABYUq2FSFVuusNQ0PtLP0tPI=";
+    hash = "sha256-YVjTfJnsNEBjcHWQCq2nJBFPvLg7RqQcyWjgR4ijUqc=";
   };
 
   goModules =
     (buildGo126Module {
       pname = "kitty-go-modules";
       inherit src version;
-      vendorHash = "sha256-G+eaFOFMIIu2Qo5Mgr3ejwoYrYmNv3EIdEEraDPIdeY=";
+      vendorHash = "sha256-urQMf5lGYPgS65VjGw0pi/ZM6CETtGWfi/kvVDAkIoc=";
     }).goModules;
 
   buildInputs = [
diff --git a/pkgs/by-name/na/nanomq/package.nix b/pkgs/by-name/na/nanomq/package.nix
index a4db3b0a08b9..fcf14a8353c0 100644
--- a/pkgs/by-name/na/nanomq/package.nix
+++ b/pkgs/by-name/na/nanomq/package.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nanomq";
-  version = "0.24.11";
+  version = "0.25.6";
 
   src = fetchFromGitHub {
     owner = "nanomq";
     repo = "nanomq";
     tag = finalAttrs.version;
-    hash = "sha256-I2SLc/KbkBvqbbWuLr8ARmmg4DeE7ZbTqcM1tw8WhwQ=";
+    hash = "sha256-Ym57iLZFnmR7NErX8qE8I9ApNPC08Z437b3tWTeqcIw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/na/nanorc/package.nix b/pkgs/by-name/na/nanorc/package.nix
index f233503e1e0f..da0f65e197d3 100644
--- a/pkgs/by-name/na/nanorc/package.nix
+++ b/pkgs/by-name/na/nanorc/package.nix
@@ -47,8 +47,6 @@ stdenv.mkDerivation rec {
     oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"' | sed 's|\\.|-|g')"
     latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags git@github.com:${owner}/${repo} '*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3)"
     if [ "$oldVersion" != "$latestTag" ]; then
-      nixpkgs="$(git rev-parse --show-toplevel)"
-      default_nix="$nixpkgs/pkgs/applications/editors/nano/nanorc/default.nix"
       newTag=$(echo $latestTag | sed 's|\.|-|g')
       update-source-version ${pname} "$newTag" --version-key=version --print-changes
     else
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index fe12acece5f8..cfd96f7d6c12 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -11,6 +11,7 @@
   coreutils,
   curl,
   gawk,
+  nix,
   nix-prefetch-darcs,
   nix-prefetch-fossil,
   nix-prefetch-git,
@@ -21,7 +22,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.10.1";
+  version = "2.0.1";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -30,9 +31,18 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-cKYsuwUq2IVr50Tnc7qzMZANkldFAVDaXFWfgx7i8Ks=";
+    hash = "sha256-KECJUCvlQz6YpDpktlmLSMiBZPn4qZkA0Ye3aaHHi0Q=";
   };
 
+  outputs = [
+    "bin"
+    "data"
+    "doc"
+    "lib"
+    "man"
+    "out"
+  ];
+
   nativeBuildInputs = [
     makeBinaryWrapper
     removeReferencesTo
@@ -61,7 +71,9 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     (jsont.override {
       withBrr = false;
       withBytesrw = true;
+      withTypegist = false;
     })
+    ppx_blob
     kdl
     logs
     saturn
@@ -69,6 +81,10 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     xdg
   ];
 
+  nativeCheckInputs = [
+    nix
+  ];
+
   checkInputs = with ocamlPackages; [
     alcotest
     ppx_deriving_qcheck
@@ -84,15 +100,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
 
   doCheck = true;
 
-  outputs = [
-    "bin"
-    "data"
-    "doc"
-    "lib"
-    "man"
-    "out"
-  ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 91445e839aa6..dcf4e5b4170e 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reindeer";
-  version = "2026.09.14.00";
+  version = "2026.09.28.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hVW+raZLZiZqOS0Qa+z9S/PWEyNpi2O05SVrmJOxG4c=";
+    hash = "sha256-ruOXPHqLJfk/Y6EHssb4wF1iFHgVKPmjJ6ydtU2hE44=";
   };
 
-  cargoHash = "sha256-k4G7cZqtYLt0m0noIKhPl7B4rte5x8yMtcuWe1jFqsU=";
+  cargoHash = "sha256-WMzXFVdl80PREiRG1uP+dPBEr5So9eV/gg1g+AeGDLc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 7382d9803d14..451575d4bca3 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.102.4";
+  version = "1.102.5";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NzWuMhLCqewkH/vwyfRND8yEubRmUSXe/TYA2ldhFl8=";
+    hash = "sha256-gm5NN4IqR7epks8WjncQBsPYaPsH+ooXporzpuCEac0=";
   };
 
   vendorHash = "sha256-amKkUPszyhG4N5ZtrB01swBACYq76raSS+SQRneLmwc=";
diff --git a/pkgs/by-name/up/update-python-libraries/update-python-libraries.py b/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
index b8e1b81b437a..06baecf366ce 100755
--- a/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
+++ b/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
@@ -6,7 +6,7 @@ You can pass in multiple files or paths.
 
 You'll likely want to use
 ``
-  $ ./update-python-libraries ../../pkgs/development/python-modules/**/default.nix
+  $ ./update-python-libraries ../../development/python-modules/**/default.nix
 ``
 to update all non-pinned libraries in that folder.
 """
diff --git a/pkgs/by-name/ze/zeroclaw/package.nix b/pkgs/by-name/ze/zeroclaw/package.nix
index 5f650899d2d8..906ed02cd0b1 100644
--- a/pkgs/by-name/ze/zeroclaw/package.nix
+++ b/pkgs/by-name/ze/zeroclaw/package.nix
@@ -10,26 +10,27 @@
   sqlite,
   writableTmpDirAsHomeHook,
   gitMinimal,
+  jq,
   versionCheckHook,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeroclaw";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "zeroclaw-labs";
     repo = "zeroclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H1512vayE35bLxlFpWExT6u/z3rMKsrv6gs5un9IPaA=";
+    hash = "sha256-6WAF826aftGuZjSHM/upWYmmVVjMS+vS+Kg4NetvjJc=";
   };
 
-  cargoHash = "sha256-zLj2ItDp8tbldBvFNxlrcoqcE0J5Ce19NDlV+lCu/BY=";
+  cargoHash = "sha256-Pycl0MMyxWtfcssoFhvDT4UQJuVVBDNzN536eBFlND4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/web";
-    hash = "sha256-SKltlDJm39ZzVaEt1bbnoiXy+wlbq+fC3bO4mW5V15o=";
+    hash = "sha256-0CsPPy5a/jTr8nImwvTwStTgHm9wZbFBwCZVHKPZCvE=";
   };
   npmRoot = "web";
 
@@ -62,16 +63,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     popd
   '';
 
+  # the release-workflow architecture tests shell out to scripts/release/*.sh
   nativeCheckInputs = [
     writableTmpDirAsHomeHook
     gitMinimal
+    jq
   ];
 
   # wiremock tests require socket binding, which is denied in the darwin sandbox
   checkFlags = [
-    "--skip=commands::update::tests::download_binary_preserves_missing_checksum_fallback"
-    "--skip=commands::update::tests::download_binary_rejects_checksum_mismatch_without_writing"
-    "--skip=commands::update::tests::download_binary_verifies_checksum_before_writing"
+    "--skip=commands::update::tests::download_release_preserves_missing_checksum_fallback"
+    "--skip=commands::update::tests::download_release_rejects_checksum_mismatch_without_writing"
+    "--skip=commands::update::tests::download_release_verifies_checksum_before_writing"
     "--skip=tests::exchange_pairing_code_posts_code_and_returns_token"
     "--skip=tests::fetch_pairing_code_reads_gateway_pair_code_response"
     "--skip=tests::gateway_addr_in_use_message_skips_occupied_restart_hint_port"
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 1fba67364174..8d88243cd30a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -445,8 +445,8 @@ in
   };
 
   openssl_3_6 = common {
-    version = "3.6.4";
-    hash = "sha256-m/+qGtHgezVMIb0zJOwC+hVXn0Wn0ElLPnS8RJtzM+8=";
+    version = "3.6.5";
+    hash = "sha256-ohV8KDDv3sN4iTmwDJsGODBtPwu7dtxIMu5QO7OX35g=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 7b33a4b6aaa3..e2fc700bc4f2 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.30.1";
+  version = "2.30.2";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-VkAkOpngiJ5Wzfk2goTfvXim66HID05UKkWmv3wryLA=";
+    hash = "sha256-fQi4Y78yXmebVLDGcJBMD8TgM7WWUlaFUZXoX4wI4dM=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -105,7 +105,7 @@ postgresqlBuildExtension (finalAttrs: {
       lib.versionOlder postgresql.version "16"
       ||
         # Check after next package update.
-        lib.warnIf (finalAttrs.version != "2.30.1") "Is postgresql19Packages.timescaledb still broken?" (
+        lib.warnIf (finalAttrs.version != "2.30.2") "Is postgresql19Packages.timescaledb still broken?" (
           lib.versionAtLeast postgresql.version "19"
         );
   };
diff --git a/pkgs/test/vim/default.nix b/pkgs/test/vim/default.nix
index 4b0c770f0a85..0aca91410695 100644
--- a/pkgs/test/vim/default.nix
+++ b/pkgs/test/vim/default.nix
@@ -73,4 +73,27 @@ lib.recurseIntoAttrs {
       ) == [ ];
     # testing is done during evaluation above so this derivation is irrelevant
     vim-full;
+
+  test_vim_plugin_install_phase =
+    let
+      plugin = vimUtils.buildVimPlugin {
+        pname = "vim-plugin-install-phase-test";
+        version = "0";
+        src = pkgs.runCommand "vim-plugin-install-phase-test-src" { } ''
+          mkdir -p $out/plugin $out/extra
+          touch $out/plugin/probe.vim $out/extra/unwanted
+        '';
+        installPhase = ''
+          runHook preInstall
+          mkdir -p $out
+          cp -r plugin $out/
+          runHook postInstall
+        '';
+      };
+    in
+    pkgs.runCommand "vim-plugin-install-phase-test" { } ''
+      test -f ${plugin}/plugin/probe.vim
+      test ! -e ${plugin}/extra
+      mkdir -p "$out"
+    '';
 }