diff --git a/ci/OWNERS b/ci/OWNERS
index 36a7b20d3d90..56f9691533b6 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -268,7 +268,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses.nix @alyssais @emilazy @jopejoe1
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
@@ -376,6 +376,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
+## nvim-treesitter
+/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @figsoda
+/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @figsoda
 
 # VsCode Extensions
 /pkgs/applications/editors/vscode/extensions
diff --git a/lib/default.nix b/lib/default.nix
index 15949d1cdf36..751738a98965 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -73,7 +73,7 @@ let
       types = callLibs ./types.nix;
 
       # constants
-      licenses = callLibs ./licenses.nix;
+      licenses = callLibs ./licenses;
       sourceTypes = callLibs ./source-types.nix;
       systems = callLibs ./systems;
 
diff --git a/lib/licenses/default.nix b/lib/licenses/default.nix
new file mode 100644
index 000000000000..7e260e98833f
--- /dev/null
+++ b/lib/licenses/default.nix
@@ -0,0 +1,7 @@
+{ lib }:
+let
+  licenses = import ./licenses.nix { inherit lib; };
+  operators = import ./operators.nix;
+  helpers = import ./helpers.nix { inherit lib; };
+in
+licenses // operators // helpers
diff --git a/lib/licenses/helpers.nix b/lib/licenses/helpers.nix
new file mode 100644
index 000000000000..b234515284f8
--- /dev/null
+++ b/lib/licenses/helpers.nix
@@ -0,0 +1,152 @@
+{ lib }:
+rec {
+  /**
+    Evaluate a license expression for a given predicate.
+
+    # Example
+
+    ```nix
+    evaluateProperty (x: x.free) true (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
+    ```
+    # Type
+
+    ```
+    evaluateProperty :: Function -> Bool -> AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [predicate] checks for each license included in the license expression
+    - [permissive] whether to apply checks permissive or reciprocal
+    - [license] license expression to check
+  */
+  evaluateProperty =
+    predicate: permissive: license:
+    let
+      OR = if permissive then lib.any else lib.all;
+      AND = if permissive then lib.all else lib.any;
+    in
+    if license.licenseType == "simple" then
+      predicate license
+    else if license.licenseType == "compound" then
+      if license.operator == "OR" then
+        OR (x: evaluateProperty predicate permissive x) license.licenses
+      else if license.operator == "AND" then
+        AND (x: evaluateProperty predicate permissive x) license.licenses
+      else
+        throw "Unknown license operator"
+    else if license.licenseType == "exception" then
+      AND (x: evaluateProperty predicate permissive x) [
+        license.license
+        license.exception
+      ]
+    else if license.licenseType == "plus" then
+      evaluateProperty predicate permissive license.license
+    else
+      throw "Unknown license type or legacy license";
+
+  /**
+    Check whether a license expression is free.
+
+    # Example
+
+    ```nix
+    isFree (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    isFree :: AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [license] License expression to check if free
+  */
+  isFree = evaluateProperty (x: x.free) true;
+
+  /**
+    Check whether a license expression is redistributable.
+
+    # Example
+
+    ```nix
+    isRedistributable (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    isRedistributable :: AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [license] License expression to check if redistributable
+  */
+  isRedistributable = evaluateProperty (x: x.redistributable) true;
+
+  /**
+    Check whether any of the given licenses is required in the license expression.
+
+    # Example
+
+    ```nix
+    containsLicenses [ lib.licenses.asl20 ] (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    containsLicenses :: List -> AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [licenses] List of licenses to look
+    - [license] License expression to check
+  */
+  containsLicenses = licenses: evaluateProperty (x: lib.lists.elem x licenses) false;
+
+  /**
+    Convert a license expression to an SPDX license expression string.
+
+    # Example
+
+    ```nix
+    toSPDX (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
+    => "NCSA AND (Apache-2.0 WITH LLVM-exception)"
+    ```
+
+    # Type
+
+    ```
+    toSPDX :: AttrSet -> String
+    ```
+
+    # Arguments
+
+    - [license] License expression which to convert to spdx expression
+  */
+  toSPDX =
+    license:
+    let
+      mkBracket =
+        x:
+        if x.licenseType == "compound" || x.licenseType == "exception" then "(${toSPDX x})" else toSPDX x;
+    in
+    if license.licenseType == "simple" then
+      license.spdxId or "LicenseRef-nixos-${license.shortName}"
+    else if license.licenseType == "compound" then
+      lib.concatMapStringsSep " ${license.operator} " (x: mkBracket x) license.licenses
+    else if license.licenseType == "exception" then
+      "${mkBracket license.license} ${license.operator} ${mkBracket license.exception}"
+    else if license.licenseType == "plus" then
+      "${mkBracket license.license}${license.operator}"
+    else
+      throw "Unknown license type";
+}
diff --git a/lib/licenses.nix b/lib/licenses/licenses.nix
similarity index 99%
rename from lib/licenses.nix
rename to lib/licenses/licenses.nix
index 416891232e84..56f29b690495 100644
--- a/lib/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -21,6 +21,7 @@ let
         deprecated
         redistributable
         ;
+      licenseType = "simple";
     }
     // optionalAttrs (attrs ? spdxId) {
       inherit spdxId;
diff --git a/lib/licenses/operators.nix b/lib/licenses/operators.nix
new file mode 100644
index 000000000000..db7cc25d37c6
--- /dev/null
+++ b/lib/licenses/operators.nix
@@ -0,0 +1,110 @@
+{
+  /**
+    This should be used when there is a choice of which license expression to use.
+    This is a disjunctive binary "OR" operator.
+
+    # Example
+
+    ```nix
+    OR [ lib.licenses.mit lib.licenses.asl20 ]
+    => { licenseType = "compound"; operator = "OR"; licenses = [ lib.licenses.mit lib.licenses.asl20 ] };
+    ```
+
+    # Type
+
+    ```
+    OR :: List -> AttrSet
+    ```
+
+    # Arguments
+
+    - [licenses] Possible licenses to choose from
+  */
+  OR = licenses: {
+    licenseType = "compound";
+    operator = "OR";
+    inherit licenses;
+  };
+
+  /**
+     Create a compound licenses where the user needs to follow both licenses,
+     eqivialent of spdx `and` modifier.
+
+    # Example
+
+    ```nix
+    AND [ lib.licenses.mit lib.licenses.asl20 ]
+    => { licenseType = "compound"; operator = "AND"; licenses = [ lib.licenses.mit lib.licenses.asl20 ] };
+    ```
+
+    # Type
+
+    ```
+    AND :: List -> AttrSet
+    ```
+
+    # Arguments
+
+    - [licenses] Licenses required to use
+  */
+  AND = licenses: {
+    licenseType = "compound";
+    operator = "AND";
+    inherit licenses;
+  };
+
+  /**
+     Create a licenses exception where a license has a license exception,
+     eqivialent of spdx `with` modifier.
+
+    # Example
+
+    ```nix
+    WITH lib.licenses.lgpl21Only lib.licenses.ocamlLgplLinkingException
+    => { licenseType = "exception"; operator = "WITH"; license = lib.licenses.lgpl21Only; exception = lib.licenses.ocamlLgplLinkingException; };
+    ```
+
+    # Type
+
+    ```
+    WITH :: AttrSet -> AttrSet -> AttrSet
+    ```
+
+    # Arguments
+
+    - [license] License to which the exception applies
+    - [exception] Exception to apply
+  */
+  WITH = license: exception: {
+    licenseType = "exception";
+    operator = "WITH";
+    inherit license exception;
+  };
+
+  /**
+     Create a licenses which can be upgraded to any later version of itself,
+     eqivialent of spdx `+` modifier
+
+    # Example
+
+    ```nix
+    PLUS lib.licenses.eupl11
+    => { licenseType = "plus"; operator = "+"; license = lib.licenses.eupl11; };
+    ```
+
+    # Type
+
+    ```
+    PLUS :: AttrSet -> AttrSet
+    ```
+
+    # Arguments
+
+    - [license] License to wich apply an exception
+  */
+  PLUS = license: {
+    licenseType = "plus";
+    operator = "+";
+    inherit license;
+  };
+}
diff --git a/lib/modules.nix b/lib/modules.nix
index 419fc750e8d9..e369d98a6426 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -589,6 +589,8 @@ let
     in
     modulesPath: initialModules: args: {
       modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
+      # Intentionally not shared with `modules` above: this allows `collected`
+      # to be garbage collected after `filterModules` returns.
       graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
     };
 
@@ -783,7 +785,7 @@ let
     prefix: modules: configs:
     let
       # an attrset 'name' => list of submodules that declare ‘name’.
-      declsByName = zipAttrsWith (n: v: v) (
+      declsByName = zipAttrs (
         map (
           module:
           let
@@ -838,7 +840,7 @@ let
         ) checkedConfigs
       );
       # extract the definitions for each loc
-      rawDefinitionsByName = zipAttrsWith (n: v: v) (
+      rawDefinitionsByName = zipAttrs (
         map (
           module:
           mapAttrs (n: value: {
@@ -1439,7 +1441,7 @@ let
         def: if def.value._type or "" == "override" then def // { value = def.value.content; } else def;
     in
     {
-      values = concatMap (def: if getPrio def == highestPrio then [ (strip def) ] else [ ]) defs;
+      values = map strip (filter (def: getPrio def == highestPrio) defs);
       inherit highestPrio;
     };
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index da0979756720..916994152754 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -5012,4 +5012,103 @@ runTests {
   testReplaceElemAtOutOfRange = testingThrow (lib.replaceElemAt [ 1 2 3 ] 5 "a");
 
   testReplaceElemAtNegative = testingThrow (lib.replaceElemAt [ 1 2 3 ] (-1) "a");
+
+  testIsFree = {
+    expr = lib.licenses.isFree (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testIsUnfree = {
+    expr = lib.licenses.isFree (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [ lib.licenses.unfree ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
+
+  testIsRedistributable = {
+    expr = lib.licenses.isRedistributable (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testIsUnredistributable = {
+    expr = lib.licenses.isRedistributable (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [ lib.licenses.unfree ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
+
+  testContainsLicenses = {
+    expr = lib.licenses.containsLicenses [ lib.licenses.mit ] (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testToSPDX = {
+    expr = lib.licenses.toSPDX (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = "MIT AND (LicenseRef-nixos-free OR LicenseRef-nixos-unfree) AND (Apache-2.0 WITH LLVM-exception) AND EUPL-1.1+";
+  };
+
+  testEvaluateProperty = {
+    expr = lib.licenses.evaluateProperty (x: x.deprecated) true (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 787280f1b699..7b645f72ba32 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26754,6 +26754,12 @@
     githubId = 156964;
     name = "Thomas Boerger";
   };
+  tbutter = {
+    email = "tbutter@gmail.com";
+    github = "tbutter";
+    githubId = 1336537;
+    name = "Thomas Butter";
+  };
   tc-kaluza = {
     github = "tc-kaluza";
     githubId = 101565936;
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 9a6ca6fa9635..c58832daac19 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -256,8 +256,8 @@ in
         upload_max_filesize = ${cfg.maxAttachmentSize}
       '';
       settings = lib.mapAttrs (name: lib.mkDefault) {
-        "listen.owner" = "nginx";
-        "listen.group" = "nginx";
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
         "listen.mode" = "0660";
         "pm" = "dynamic";
         "pm.max_children" = 75;
diff --git a/nixos/modules/services/web-apps/baikal.nix b/nixos/modules/services/web-apps/baikal.nix
index 1c3f89c510d2..568f250df0df 100644
--- a/nixos/modules/services/web-apps/baikal.nix
+++ b/nixos/modules/services/web-apps/baikal.nix
@@ -57,8 +57,8 @@ in
           "BAIKAL_PATH_SPECIFIC" = "/var/lib/baikal/specific/";
         };
         settings = lib.mapAttrs (name: lib.mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;
diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index 8106cc06fd2b..a6860a0902b3 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -44,7 +44,7 @@ in
         "pm" = "dynamic";
         "php_admin_value[error_log]" = "stderr";
         "php_admin_flag[log_errors]" = true;
-        "listen.owner" = "nginx";
+        "listen.owner" = config.services.nginx.user;
         "catch_workers_output" = true;
         "pm.max_children" = "32";
         "pm.start_servers" = "2";
@@ -52,6 +52,20 @@ in
         "pm.max_spare_servers" = "4";
         "pm.max_requests" = "500";
       };
+      defaultText = lib.literalExpression ''
+        {
+          "pm" = "dynamic";
+          "php_admin_value[error_log]" = "stderr";
+          "php_admin_flag[log_errors]" = true;
+          "listen.owner" = config.services.nginx.user;
+          "catch_workers_output" = true;
+          "pm.max_children" = "32";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "2";
+          "pm.max_spare_servers" = "4";
+          "pm.max_requests" = "500";
+        }
+      '';
 
       description = ''
         Options for grocy's PHPFPM pool.
diff --git a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
index 597d4951a0db..b7d9dd3dbfe1 100644
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@@ -200,8 +200,8 @@ in
           date.timezone = "${cfg.timezone}"
         '';
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;
diff --git a/nixos/modules/services/web-apps/kanboard.nix b/nixos/modules/services/web-apps/kanboard.nix
index 4f541a712853..8318282ecdd2 100644
--- a/nixos/modules/services/web-apps/kanboard.nix
+++ b/nixos/modules/services/web-apps/kanboard.nix
@@ -123,7 +123,7 @@ in
           "pm" = "dynamic";
           "php_admin_value[error_log]" = "stderr";
           "php_admin_flag[log_errors]" = true;
-          "listen.owner" = "nginx";
+          "listen.owner" = config.services.nginx.user;
           "catch_workers_output" = true;
           "pm.max_children" = "32";
           "pm.start_servers" = "2";
diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index f4aa61a4c910..6c1d4a0f46e5 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -37,7 +37,8 @@ in
 
       user = mkOption {
         type = types.str;
-        default = "nginx";
+        default = config.services.nginx.user;
+        defaultText = lib.literalExpression "config.services.nginx.user";
         description = ''
           User account under which both the service and the web-application run.
         '';
@@ -122,10 +123,10 @@ in
   config = mkIf cfg.enable {
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
-        user = "nginx";
+        user = config.services.nginx.user;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 607b99537f30..eb33661a8637 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -594,8 +594,8 @@ in
         inherit (cfg) user;
         inherit phpPackage;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 767da3a67b16..f6093eb7e14a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -152,6 +152,7 @@ in
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
+    skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
         {
diff --git a/nixos/tests/nixos-test-driver/skip-typecheck.nix b/nixos/tests/nixos-test-driver/skip-typecheck.nix
new file mode 100644
index 000000000000..b36e4a819693
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/skip-typecheck.nix
@@ -0,0 +1,21 @@
+/**
+  nixosTests.simple, but with skipTypeCheck.
+  This catches regressions in the wiring, e.g.
+  https://github.com/NixOS/nixpkgs/pull/511225
+*/
+{
+  name = "skip-typecheck";
+  meta = {
+    maintainers = [ ];
+  };
+
+  skipTypeCheck = true;
+
+  nodes.machine = { };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 147c1e249183..661e8d968a0c 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -121,6 +121,7 @@ buildVscode {
       jefflabonte
       wetrustinprize
       oenu
+      yuannan
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/at/atftp/package.nix b/pkgs/by-name/at/atftp/package.nix
index ad83c6487259..6204948caa8a 100644
--- a/pkgs/by-name/at/atftp/package.nix
+++ b/pkgs/by-name/at/atftp/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atftp";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/atftp/atftp-${finalAttrs.version}.tar.gz";
-    hash = "sha256-3yqgicdnD56rQOVZjl0stqWC3FGCkm6lC01pDk438xY=";
+    hash = "sha256-lsvb0vFmFcicnbNr6bMG3hdtmhwD3LjLd3Ylv+BovCs=";
   };
 
   # fix test script
diff --git a/pkgs/by-name/av/avfs/package.nix b/pkgs/by-name/av/avfs/package.nix
index 26aa23980605..0a01dd6b4f6d 100644
--- a/pkgs/by-name/av/avfs/package.nix
+++ b/pkgs/by-name/av/avfs/package.nix
@@ -5,14 +5,15 @@
   pkg-config,
   fuse,
   xz,
+  zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "avfs";
-  version = "1.2.0";
+  version = "1.3.0";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${finalAttrs.version}/avfs-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-olqOxDwe4XJiThpMec5mobkwhBzbVFtyXx7GS8q+iJw=";
+    sha256 = "sha256-B81p1MDH7QgOgP8EDZgChkBa04pEP9xS3Dle/vEcRLE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -20,19 +21,20 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     fuse
     xz
+    zlib
   ];
 
   configureFlags = [
     "--enable-library"
     "--enable-fuse"
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin "--with-system-zlib";
 
   meta = {
     homepage = "https://avf.sourceforge.net/";
     description = "Virtual filesystem that allows browsing of compressed files";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Only;
-    # The last successful Darwin Hydra build was in 2024
-    broken = stdenv.hostPlatform.isDarwin;
+    maintainers = with lib.maintainers; [ tbutter ];
   };
 })
diff --git a/pkgs/by-name/az/azahar/package.nix b/pkgs/by-name/az/azahar/package.nix
index cfb78f9d8cbe..7fb9055926b8 100644
--- a/pkgs/by-name/az/azahar/package.nix
+++ b/pkgs/by-name/az/azahar/package.nix
@@ -61,7 +61,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2125.0.1";
+  version = "2125.1";
 
   src = fetchFromGitHub {
     owner = "azahar-emu";
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
       echo "${finalAttrs.version}" > "$out/GIT-TAG"
       git -C "$out" rev-parse HEAD > "$out/GIT-COMMIT"
     '';
-    hash = "sha256-KzM2FWJPxZtkpwvK4DSdfNuxE8yy1OVaioVegQbBSWk=";
+    hash = "sha256-F5v52axQ4+vH6ZqEEuuMtV5PVahWmnS3PixZHqywhtM=";
   };
 
   strictDeps = true;
@@ -138,14 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     (darwinMinVersionHook "13.4")
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "cmake-Add-option-to-use-system-oaknut.patch";
-      url = "https://github.com/azahar-emu/azahar/commit/6201256e15ee4d4fc053933545abf50fc46be178.patch";
-      hash = "sha256-03eIubAJ65W9clI9iaLcLNAAMbkX4E507nYNV8DVwZc=";
-    })
-  ];
-
   postPatch = ''
     # We already know the submodules are present
     substituteInPlace CMakeLists.txt \
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index ef7912e2e08e..79e393d7f5a4 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.89.132";
+  version = "1.89.137";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-mYY8eyMWcwx6RuMNP5ucf6xd1NXfYO4nqXEkiTUtX0o=";
+      hash = "sha256-JeYoRM6ClQ7iqu+wvwaTUmdDuIS+2AXoTIU+VxAbgRg=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-/SmzRSgmXM567D1YQdD/IfDaIe3RPLtgJMYvcOCwvZo=";
+      hash = "sha256-BFbx/Ex4HdaFpfY2AKc3yAaMp6PiYwC/kmEIF0WdcwU=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-3f29ehqJNQjYJ+vh15ZI2UJEB1VdBfLL3VWv8CRasCw=";
+      hash = "sha256-Ffc9se0j9ULZsZQktWzrUgBiLyC5QR1jAPg6IcHoOTI=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-KIod2FbWck1OUATr/vKK+vgwIih3Lha48MAdt5qNIAk=";
+      hash = "sha256-SOOf35CONFydjSK47xgQLHxX7weQFPl2Fh33H5qeqXo=";
     };
   };
 
diff --git a/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch b/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
index c45b65e80f6e..9a5c365285df 100644
--- a/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
+++ b/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
@@ -27,12 +27,12 @@ index ab8d111..d7165e2 100644
          message(STATUS "Building solvers with cadical")
  
          download_project(PROJ cadical
--            URL https://github.com/arminbiere/cadical/archive/rel-2.0.0.tar.gz
+-            URL https://github.com/arminbiere/cadical/archive/rel-3.0.0.tar.gz
 +            SOURCE_DIR @srccadical@
-             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-2.0.0-patch
+             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-3.0.0-patch
              COMMAND cmake -E copy ${CBMC_SOURCE_DIR}/scripts/cadical_CMakeLists.txt CMakeLists.txt
              COMMAND ./configure
--            URL_MD5 9fc2a66196b86adceb822a583318cc35
+-            URL_HASH SHA256=282b1c9422fde8631cb721b86450ae94df4e8de0545c17a69a301aaa4bf92fcf
          )
  
          add_subdirectory(${cadical_SOURCE_DIR} ${cadical_BINARY_DIR})
@@ -40,11 +40,11 @@ index ab8d111..d7165e2 100644
          message(STATUS "Building with IPASIR solver linking against: CaDiCaL")
  
          download_project(PROJ cadical
--            URL https://github.com/arminbiere/cadical/archive/rel-2.0.0.tar.gz
+-            URL https://github.com/arminbiere/cadical/archive/rel-3.0.0.tar.gz
 +            SOURCE_DIR @srccadical@
-             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-2.0.0-patch
+             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-3.0.0-patch
              COMMAND ./configure
--            URL_MD5 9fc2a66196b86adceb822a583318cc35
+-            URL_HASH SHA256=282b1c9422fde8631cb721b86450ae94df4e8de0545c17a69a301aaa4bf92fcf
          )
  
          message(STATUS "Building CaDiCaL")
diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index 6ae48f70a8cc..ee3d677c0063 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-PT6AYiwkplCeyMREZnGZA0BKl4ZESRC02/9ibKg7mYU=";
+    hash = "sha256-SMJBnzoyTwcwJa9L2X1iX2W4Z/Mwoirf8EXfoyG0dRI=";
   };
 
   srcglucose = fetchFromGitHub {
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   srccadical =
     (cadical.override {
-      version = "2.0.0";
+      version = "3.0.0";
     }).src;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix
index 7ff42949d6d0..be6ac75dc161 100644
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -12,24 +12,26 @@
   nodejs_20,
   nodejs-slim_20,
   remarshal_0_17,
+  nix-update-script,
   settings ? { },
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "3.1.1-unstable-2025-09-12";
+  version = "3.3.0";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
-    rev = "e70ade555fdccf4e723a90f8a2d46fcf83645c4f";
-    hash = "sha256-edsGHc6Hi306aq+TA2g5FL/ZYNfExbcgHS5PWF9O0+0=";
+    tag = finalAttrs.version;
+    hash = "sha256-Xc6zwnR0J+0DuTKNW3eHyJRvUgJgEeL3jA26wzNTMN0=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-r36w3Cz/V7E/xPYYpvfQsdk2QXfCVDYE9OxiFNyKP2s=";
+    hash = "sha256-EMns5J8rM4qOfrACoX6lttOXh/RUtZjaKtd+BpsS6Xs=";
   };
 
-  passthru.tests = {
-    dashy = nixosTests.dashy;
+  passthru = {
+    tests.dashy = nixosTests.dashy;
+    updateScript = nix-update-script { };
   };
 
   # - If no settings are passed, use the default config provided by upstream
diff --git a/pkgs/by-name/db/dbvisualizer/package.nix b/pkgs/by-name/db/dbvisualizer/package.nix
index ffcfa1424829..c93af60e6840 100644
--- a/pkgs/by-name/db/dbvisualizer/package.nix
+++ b/pkgs/by-name/db/dbvisualizer/package.nix
@@ -8,12 +8,18 @@
   stdenv,
 }:
 
+# nixpkgs-update: no auto update
+# NOTE: Do not update to interim patch versions. The download URL will get shut
+# down after a while. Dbvisualizer discontinues download
+# URLs for all but the last patch version per minor version.
+# Example: v25.3.2 gets shut down after v25.3.3 gets released.
+
 let
   pname = "dbvisualizer";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "25.2.6";
+  version = "25.3.3";
 
   src =
     let
@@ -21,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "https://www.dbvis.com/product_download/dbvis-${finalAttrs.version}/media/dbvis_linux_${underscoreVersion}.tar.gz";
-      hash = "sha256-yiL0FFkSntwLy/oOkiDQKTvTOUrtbv/9kV+1nLZtMB0=";
+      hash = "sha256-rvS2NczwmT1+/JIfpLI518I0/2AaIJEQAOwmKUK2FQs=";
     };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deps-fnl/package.nix b/pkgs/by-name/de/deps-fnl/package.nix
index 3bb25de12b6a..82aeae7a2a6a 100644
--- a/pkgs/by-name/de/deps-fnl/package.nix
+++ b/pkgs/by-name/de/deps-fnl/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deps.fnl";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitLab {
     owner = "andreyorst";
     repo = "deps.fnl";
     tag = version;
-    hash = "sha256-gUqi0g7myWTbjILN4RQqbeeaSYcg0oVJYNO0Gv9XzNY=";
+    hash = "sha256-FrFeRbfK4sHd3pjiVDMrE8IpDKptZuwkTLMQ9hppVRY=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/do/docuseal/Gemfile b/pkgs/by-name/do/docuseal/Gemfile
index 1a44d72dd7dd..f1c15e33d37d 100644
--- a/pkgs/by-name/do/docuseal/Gemfile
+++ b/pkgs/by-name/do/docuseal/Gemfile
@@ -3,6 +3,7 @@
 source 'https://rubygems.org'
 
 
+gem 'addressable'
 gem 'arabic-letter-connector', require: false
 gem 'aws-sdk-s3', require: false
 gem 'aws-sdk-secretsmanager', require: false
@@ -27,12 +28,10 @@ gem 'oj'
 gem 'onnxruntime', require: false
 gem 'pagy'
 gem 'pg', require: false
-gem 'premailer-rails'
 gem 'pretender'
 gem 'puma', require: false
 gem 'rack'
 gem 'rails'
-gem 'rails_autolink'
 gem 'rails-i18n'
 gem 'rotp'
 gem 'rouge', require: false
@@ -43,7 +42,7 @@ gem 'shakapacker'
 gem 'sidekiq'
 gem 'sqlite3', require: false
 gem 'strip_attributes'
-gem 'trilogy', github: 'trilogy-libraries/trilogy', glob: 'contrib/ruby/*.gemspec', require: false
+gem 'trilogy', require: false
 gem 'turbo-rails'
 gem 'twitter_cldr', require: false
 gem 'tzinfo-data'
diff --git a/pkgs/by-name/do/docuseal/Gemfile.lock b/pkgs/by-name/do/docuseal/Gemfile.lock
index ac3adcc8fda0..a52dd3b0b983 100644
--- a/pkgs/by-name/do/docuseal/Gemfile.lock
+++ b/pkgs/by-name/do/docuseal/Gemfile.lock
@@ -1,39 +1,31 @@
-GIT
-  remote: https://github.com/trilogy-libraries/trilogy.git
-  revision: 3963d490459df7a2b5bedb42424c3285f25eab22
-  glob: contrib/ruby/*.gemspec
-  specs:
-    trilogy (2.10.0)
-      bigdecimal
-
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.16)
+    action_text-trix (2.1.18)
       railties
-    actioncable (8.1.2)
-      actionpack (= 8.1.2)
-      activesupport (= 8.1.2)
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.1.2)
-      actionpack (= 8.1.2)
-      activejob (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
-    actionmailer (8.1.2)
-      actionpack (= 8.1.2)
-      actionview (= 8.1.2)
-      activejob (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.1.2)
-      actionview (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -41,36 +33,36 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.1.2)
+    actiontext (8.1.3)
       action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.1.2)
-      activesupport (= 8.1.2)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.1.2)
-      activesupport (= 8.1.2)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.3.6)
-    activemodel (8.1.2)
-      activesupport (= 8.1.2)
-    activerecord (8.1.2)
-      activemodel (= 8.1.2)
-      activesupport (= 8.1.2)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
       timeout (>= 0.4.0)
-    activestorage (8.1.2)
-      actionpack (= 8.1.2)
-      activejob (= 8.1.2)
-      activerecord (= 8.1.2)
-      activesupport (= 8.1.2)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
       marcel (~> 1.0)
-    activesupport (8.1.2)
+    activesupport (8.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -83,16 +75,16 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    annotaterb (4.20.0)
+    annotaterb (4.22.0)
       activerecord (>= 6.0.0)
       activesupport (>= 6.0.0)
     arabic-letter-connector (0.1.1)
     ast (2.4.3)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1209.0)
-    aws-sdk-core (3.241.4)
+    aws-partitions (1.1233.0)
+    aws-sdk-core (3.244.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -100,15 +92,15 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.121.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-kms (1.123.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.212.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-s3 (1.218.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.128.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-secretsmanager (1.129.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
@@ -116,7 +108,7 @@ GEM
       cgi
       rexml
     base64 (0.3.0)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
     better_html (2.2.0)
       actionview (>= 7.0)
       activesupport (>= 7.0)
@@ -124,11 +116,11 @@ GEM
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    bigdecimal (4.0.1)
+    bigdecimal (4.1.0)
     bindex (0.8.1)
-    bootsnap (1.21.1)
+    bootsnap (1.23.0)
       msgpack (~> 1.2)
-    brakeman (7.1.2)
+    brakeman (8.0.4)
       racc
     builder (3.3.0)
     bullet (8.1.0)
@@ -158,8 +150,6 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
-    css_parser (1.21.1)
-      addressable
     csv (3.3.5)
     csv-safe (3.3.1)
       csv (~> 3.0)
@@ -171,16 +161,16 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     declarative (0.0.20)
-    devise (4.9.4)
+    devise (5.0.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 7.0)
       responders
       warden (~> 1.2.3)
-    devise-two-factor (6.3.1)
-      activesupport (>= 7.0, < 8.2)
-      devise (>= 4.0, < 5.0)
-      railties (>= 7.0, < 8.2)
+    devise-two-factor (6.4.0)
+      activesupport (>= 7.2, < 8.2)
+      devise (>= 4.0, < 6.0)
+      railties (>= 7.2, < 8.2)
       rotp (~> 6.0)
     diff-lcs (1.6.2)
     digest-crc (0.7.0)
@@ -189,7 +179,7 @@ GEM
     dotenv (3.2.0)
     drb (2.2.3)
     email_typo (0.2.3)
-    erb (6.0.1)
+    erb (6.0.2)
     erb_lint (0.9.0)
       activesupport
       better_html (>= 2.0.1)
@@ -203,7 +193,7 @@ GEM
     factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
       railties (>= 6.1.0)
-    faker (3.6.0)
+    faker (3.6.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.14.1)
       faraday-net_http (>= 2.0, < 3.5)
@@ -213,16 +203,16 @@ GEM
       faraday (>= 1, < 3)
     faraday-net_http (3.4.2)
       net-http (~> 0.5)
-    ferrum (0.17.1)
+    ferrum (0.17.2)
       addressable (~> 2.5)
       base64 (~> 0.2)
       concurrent-ruby (~> 1.1)
       webrick (~> 1.7)
       websocket-driver (~> 0.7)
-    ffi (1.17.3)
-    ffi (1.17.3-aarch64-linux-musl)
-    ffi (1.17.3-arm64-darwin)
-    ffi (1.17.3-x86_64-linux-musl)
+    ffi (1.17.4)
+    ffi (1.17.4-aarch64-linux-musl)
+    ffi (1.17.4-arm64-darwin)
+    ffi (1.17.4-x86_64-linux-musl)
     foreman (0.90.0)
       thor (~> 1.4)
     geom2d (0.4.1)
@@ -238,7 +228,7 @@ GEM
       retriable (~> 3.1)
     google-apis-iamcredentials_v1 (0.26.0)
       google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-storage_v1 (0.59.0)
+    google-apis-storage_v1 (0.61.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-cloud-core (1.8.0)
       google-cloud-env (>= 1.0, < 3.a)
@@ -246,8 +236,8 @@ GEM
     google-cloud-env (2.3.1)
       base64 (~> 0.2)
       faraday (>= 1.0, < 3.a)
-    google-cloud-errors (1.5.0)
-    google-cloud-storage (1.58.0)
+    google-cloud-errors (1.6.0)
+    google-cloud-storage (1.59.0)
       addressable (~> 2.8)
       digest-crc (~> 0.4)
       google-apis-core (>= 0.18, < 2)
@@ -257,7 +247,7 @@ GEM
       googleauth (~> 1.9)
       mini_mime (~> 1.0)
     google-logging-utils (0.2.0)
-    googleauth (1.16.1)
+    googleauth (1.16.2)
       faraday (>= 1.0, < 3.a)
       google-cloud-env (~> 2.2)
       google-logging-utils (~> 0.1)
@@ -266,24 +256,24 @@ GEM
       os (>= 0.9, < 2.0)
       signet (>= 0.16, < 2.a)
     hashdiff (1.2.1)
-    hexapdf (1.5.0)
+    hexapdf (1.6.0)
       cmdparse (~> 3.0, >= 3.0.3)
       geom2d (~> 0.4, >= 0.4.1)
       openssl (>= 2.2.1)
       strscan (>= 3.1.2)
-    htmlentities (4.4.2)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     image_processing (1.14.0)
       mini_magick (>= 4.9.5, < 6)
       ruby-vips (>= 2.0.17, < 3)
     io-console (0.8.2)
-    irb (1.16.0)
+    irb (1.17.0)
       pp (>= 0.6.0)
+      prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.18.1)
+    json (2.19.3)
     jwt (3.1.2)
       base64
     language_server-protocol (3.17.0.5)
@@ -305,7 +295,7 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -321,13 +311,14 @@ GEM
       logger
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (6.0.1)
+    minitest (6.0.3)
+      drb (~> 2.0)
       prism (~> 1.5)
     msgpack (1.8.0)
     multi_json (1.19.1)
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.6.2)
+    net-imap (0.6.3)
       date
       net-protocol
     net-pop (0.1.2)
@@ -337,17 +328,17 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.0)
+    nokogiri (1.19.2)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.0-aarch64-linux-musl)
+    nokogiri (1.19.2-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.19.0-arm64-darwin)
+    nokogiri (1.19.2-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.0-x86_64-linux-musl)
+    nokogiri (1.19.2-x86_64-linux-musl)
       racc (~> 1.4)
-    numo-narray-alt (0.9.13)
-    oj (3.16.13)
+    numo-narray-alt (0.10.3)
+    oj (3.16.16)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     onnxruntime (0.10.1)
@@ -358,16 +349,17 @@ GEM
       ffi
     onnxruntime (0.10.1-x86_64-linux)
       ffi
-    openssl (4.0.0)
+    openssl (4.0.1)
     orm_adapter (0.5.0)
     os (1.1.4)
     ostruct (0.6.3)
     package_json (0.2.0)
-    pagy (43.2.8)
+    pagy (43.4.4)
       json
+      uri
       yaml
-    parallel (1.27.0)
-    parser (3.3.10.1)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     pg (1.6.3)
@@ -376,18 +368,10 @@ GEM
     pg (1.6.3-x86_64-linux-musl)
     pp (0.6.3)
       prettyprint
-    premailer (1.27.0)
-      addressable
-      css_parser (>= 1.19.0)
-      htmlentities (>= 4.0.0)
-    premailer-rails (1.12.0)
-      actionmailer (>= 3)
-      net-smtp
-      premailer (~> 1.7, >= 1.7.9)
-    pretender (0.6.0)
-      actionpack (>= 7.1)
+    pretender (1.0.0)
+      actionpack (>= 7.2)
     prettyprint (0.2.0)
-    prism (1.8.0)
+    prism (1.9.0)
     pry (0.16.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -397,51 +381,47 @@ GEM
     psych (5.3.1)
       date
       stringio
-    public_suffix (7.0.2)
+    public_suffix (7.0.5)
     puma (7.2.0)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.4)
+    rack (3.2.6)
     rack-proxy (0.7.7)
       rack
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (8.1.2)
-      actioncable (= 8.1.2)
-      actionmailbox (= 8.1.2)
-      actionmailer (= 8.1.2)
-      actionpack (= 8.1.2)
-      actiontext (= 8.1.2)
-      actionview (= 8.1.2)
-      activejob (= 8.1.2)
-      activemodel (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       bundler (>= 1.15.0)
-      railties (= 8.1.2)
+      railties (= 8.1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails-i18n (8.1.0)
       i18n (>= 0.7, < 2)
       railties (>= 8.0.0, < 9)
-    rails_autolink (1.1.8)
-      actionview (> 3.1)
-      activesupport (> 3.1)
-      railties (> 3.1)
-    railties (8.1.2)
-      actionpack (= 8.1.2)
-      activesupport (= 8.1.2)
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -450,11 +430,11 @@ GEM
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.3.1)
-    rdoc (7.1.0)
+    rdoc (7.2.0)
       erb
       psych (>= 4.0.0)
       tsort
-    redis-client (0.26.4)
+    redis-client (0.28.0)
       connection_pool
     regexp_parser (2.11.3)
     reline (0.6.3)
@@ -468,7 +448,7 @@ GEM
     responders (3.2.0)
       actionpack (>= 7.0)
       railties (>= 7.0)
-    retriable (3.1.2)
+    retriable (3.4.1)
     rexml (3.4.4)
     rotp (6.3.0)
     rouge (4.7.0)
@@ -481,19 +461,19 @@ GEM
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.7)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-rails (8.0.2)
+    rspec-rails (8.0.4)
       actionpack (>= 7.2)
       activesupport (>= 7.2)
       railties (>= 7.2)
-      rspec-core (~> 3.13)
-      rspec-expectations (~> 3.13)
-      rspec-mocks (~> 3.13)
-      rspec-support (~> 3.13)
-    rspec-support (3.13.6)
-    rubocop (1.82.1)
+      rspec-core (>= 3.13.0, < 5.0.0)
+      rspec-expectations (>= 3.13.0, < 5.0.0)
+      rspec-mocks (>= 3.13.0, < 5.0.0)
+      rspec-support (>= 3.13.0, < 5.0.0)
+    rspec-support (3.13.7)
+    rubocop (1.86.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -501,10 +481,10 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.48.0, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.0)
+    rubocop-ast (1.49.1)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-performance (1.26.1)
@@ -529,14 +509,14 @@ GEM
       rubyzip (>= 3.2.2)
     rubyzip (3.2.2)
     securerandom (0.4.1)
-    semantic_range (3.1.0)
-    shakapacker (9.5.0)
+    semantic_range (3.1.1)
+    shakapacker (9.7.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)
       railties (>= 5.2)
       semantic_range (>= 2.3.0)
-    sidekiq (8.1.0)
+    sidekiq (8.1.2)
       connection_pool (>= 3.0.0)
       json (>= 2.16.0)
       logger (>= 1.7.0)
@@ -554,20 +534,22 @@ GEM
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
     smart_properties (1.17.0)
-    sqlite3 (2.9.0)
+    sqlite3 (2.9.2)
       mini_portile2 (~> 2.8.0)
-    sqlite3 (2.9.0-aarch64-linux-musl)
-    sqlite3 (2.9.0-arm64-darwin)
-    sqlite3 (2.9.0-x86_64-linux-musl)
+    sqlite3 (2.9.2-aarch64-linux-musl)
+    sqlite3 (2.9.2-arm64-darwin)
+    sqlite3 (2.9.2-x86_64-linux-musl)
     stringio (3.2.0)
     strip_attributes (2.0.1)
       activemodel (>= 3.0, < 9.0)
-    strscan (3.1.7)
+    strscan (3.1.8)
     thor (1.5.0)
-    timeout (0.6.0)
+    timeout (0.6.1)
     trailblazer-option (0.1.2)
+    trilogy (2.12.2)
+      bigdecimal
     tsort (0.2.0)
-    turbo-rails (2.0.21)
+    turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
     twitter_cldr (6.14.0)
@@ -577,7 +559,7 @@ GEM
       tzinfo
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2025.3)
+    tzinfo-data (1.2026.1)
       tzinfo (>= 1.0.0)
     uber (0.1.0)
     unicode-display_width (3.2.0)
@@ -588,12 +570,11 @@ GEM
     useragent (0.16.11)
     warden (1.2.9)
       rack (>= 2.0.9)
-    web-console (4.2.1)
-      actionview (>= 6.0.0)
-      activemodel (>= 6.0.0)
+    web-console (4.3.0)
+      actionview (>= 8.0.0)
       bindex (>= 0.4.0)
-      railties (>= 6.0.0)
-    webmock (3.26.1)
+      railties (>= 8.0.0)
+    webmock (3.26.2)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -605,7 +586,7 @@ GEM
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yaml (0.4.0)
-    zeitwerk (2.7.4)
+    zeitwerk (2.7.5)
 
 PLATFORMS
   aarch64-linux-musl
@@ -614,6 +595,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  addressable
   annotaterb
   arabic-letter-connector
   aws-sdk-s3
@@ -650,14 +632,12 @@ DEPENDENCIES
   onnxruntime
   pagy
   pg
-  premailer-rails
   pretender
   pry-rails
   puma
   rack
   rails
   rails-i18n
-  rails_autolink
   rotp
   rouge
   rqrcode
@@ -673,7 +653,7 @@ DEPENDENCIES
   simplecov
   sqlite3
   strip_attributes
-  trilogy!
+  trilogy
   turbo-rails
   twitter_cldr
   tzinfo-data
@@ -681,4 +661,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.6.9
+   2.7.2
diff --git a/pkgs/by-name/do/docuseal/gemset.nix b/pkgs/by-name/do/docuseal/gemset.nix
index 5d953be5684d..cd083904d9c0 100644
--- a/pkgs/by-name/do/docuseal/gemset.nix
+++ b/pkgs/by-name/do/docuseal/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12isf17cd4xyx5vg97nzxsi92703yh40fxyns6gl9f11331a4ign";
+      sha256 = "0hinzgbjfwgdjm3dz9mz218sy764gbacv0z2ic4ms57lpzw87nrz";
       type = "gem";
     };
-    version = "2.1.16";
+    version = "2.1.18";
   };
   actioncable = {
     dependencies = [
@@ -22,10 +22,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s8rp5zpcxqkpj610whkrnjhwk119f5xn7b9bkydx76a9k1yycfw";
+      sha256 = "1w40bbkjd0lds57bfr24hbj9qfkwj9v33x6457g24sjfwispzg75";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionmailbox = {
     dependencies = [
@@ -40,10 +40,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16w8h4awh3k1v6b2anix20qjdij5zby7am379y4mlp8fk2qjz2q5";
+      sha256 = "0ndf98dpzmz8xs6m253zpwnhyfrvxdkfyvssxps0vrx0x9sa8zfz";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionmailer = {
     dependencies = [
@@ -61,10 +61,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sbmj65nzqzjh9ji94p91mkpjlhf3jkcbzd7ia8gwfv51w3d5hgl";
+      sha256 = "13a4329lgrda8s9mqrfbaakvc90i6ak82rfpljmd0w5vj54747w3";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionpack = {
     dependencies = [
@@ -86,10 +86,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08w49zj1skvviyakjy2cazfklkgx2dsnfzxb9fmaznphl53l3myf";
+      sha256 = "18r93ii2ayw8n60qsx259dy8nwgbfxf3ndncla0xbia79np8r6dg";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actiontext = {
     dependencies = [
@@ -105,10 +105,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b9dilsjx9saqqz7dwj0fqfbacdyar5f4g4wfxqdj6cw5ai7vx8b";
+      sha256 = "1ln7mwflqf7nsgkj9lm1p7bmc6h8yqaa47q1cdj9xsp102f034fj";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionview = {
     dependencies = [
@@ -126,10 +126,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nrf7qn2p6r645427whfh071az6bv8728bf2rrr9n74ii0jmnic0";
+      sha256 = "0pgxl9p2q2zbwb6626yw7rgpbmv2bvxykq2w1h83inrygy6chiqk";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activejob = {
     dependencies = [
@@ -143,10 +143,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09gq0bivkb9qfmg69k1jqbsbs1vb2ps1jn1p6saqa0di2cvsp3ch";
+      sha256 = "1lz8bxb6pcf9yvxwyj6355aws3ylxi5rwc577ly4q858d9vb2jd1";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -157,10 +157,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gpkph1mq78yg1cl0vkc8js0gh3vjxjf9drqk0zyv2p63k0mh4z2";
+      sha256 = "06c23jww82grgvxw19g4bi9c957aj5hh24wzyyw4jdpg9jz5rh4h";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activerecord = {
     dependencies = [
@@ -175,10 +175,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0i6c9g3q0lx4bca5gvz0p8p6ibhwn176zzhih0hgll6cvz5f1yxc";
+      sha256 = "1avhmih54xqyj14zrv6ciw2ndpb11bmkwq0fcwm0mfk64ixvw0w0";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activestorage = {
     dependencies = [
@@ -192,10 +192,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xms9z8asdpqw5ybl6n4bk1iys4l7y0iyi2rdbifxjlr766a8qwa";
+      sha256 = "0k9q8sdlf576r8rp2hgdxy5lpr8f157bpq8mfsk52f8l169wwr05";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activesupport = {
     dependencies = [
@@ -220,10 +220,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bpxnr83z1x78h3jxvmga7vrmzmc8b4fic49h9jhzm6hriw2b148";
+      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -235,10 +235,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
       type = "gem";
     };
-    version = "2.8.8";
+    version = "2.9.0";
   };
   annotaterb = {
     dependencies = [
@@ -249,10 +249,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xwbz5zk37f7p3g6ypxzamisay06hidjmdsrvhxw4q0xin4jw6w7";
+      sha256 = "11h2lz0fyj1hh37x1lwvxr0svaisnkjs2g81hap84nwdykjl1z36";
       type = "gem";
     };
-    version = "4.20.0";
+    version = "4.22.0";
   };
   arabic-letter-connector = {
     groups = [ "default" ];
@@ -293,10 +293,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1099j8l3k40n7drhlxc4m7m32p79xy5zgy4jrcgf5ngxblq2w2n6";
+      sha256 = "1hhkcawvn8fr5ys7xy4bhk4glcqyyibwkd3y75cidc9d123393cj";
       type = "gem";
     };
-    version = "1.1209.0";
+    version = "1.1233.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -312,10 +312,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zg44q9bykznxdp4l130qkvmhx4n3hhalh3cgc781aafqalcnb54";
+      sha256 = "1shqk9frm15g1ygiy33krwj34jrphfjc6w63bglxwnqcic3qqi9y";
       type = "gem";
     };
-    version = "3.241.4";
+    version = "3.244.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -326,10 +326,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q015l5gm3f230jz9l6si9s3hlw7ra76q8biqvxlwxdmnk7w2qym";
+      sha256 = "080zh4g1lcjl0bz2l0gjm8vmpd60cvi0p658bh235ypqh9zg61fl";
       type = "gem";
     };
-    version = "1.121.0";
+    version = "1.123.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -341,10 +341,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06bw769knngyhgrfw8j8mbl637ms9z00a3l4g7f1hj4iwvpc93hy";
+      sha256 = "134qr73ri1j52y42xib0fpyscd5miwc37zx1ikxavwh747rsawjn";
       type = "gem";
     };
-    version = "1.212.0";
+    version = "1.218.0";
   };
   aws-sdk-secretsmanager = {
     dependencies = [
@@ -355,10 +355,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16ib5p04fk66qr2vfps0qr340ld5xb5dsypbdii9f40n6hfxwb6n";
+      sha256 = "0m69f1jghxlixd4b5wb2dsp38dly7nxm5si1klnajv89m23mqi00";
       type = "gem";
     };
-    version = "1.128.0";
+    version = "1.129.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -404,10 +404,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
       type = "gem";
     };
-    version = "3.1.21";
+    version = "3.1.22";
   };
   better_html = {
     dependencies = [
@@ -439,10 +439,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1bkcvp4aavdxh1pmgg65sypyjx5l0w5ffylfsk65di1xm9kpgh3d";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.0";
   };
   bindex = {
     groups = [
@@ -463,10 +463,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1i64vd32pacs1sspz4isgdyfg35gh4s7scrwc935i8rdfgzaqwwk";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
       type = "gem";
     };
-    version = "1.21.1";
+    version = "1.23.0";
   };
   brakeman = {
     dependencies = [ "racc" ];
@@ -474,10 +474,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kkds9q66jryhlyqzwhp4kh8hcb39i05v2r4f8xd3rx221vr413b";
+      sha256 = "0vyg9l6xivamb49r4kzkcw12r9x943kv79wsvwslhm1qjvx23ybv";
       type = "gem";
     };
-    version = "7.1.2";
+    version = "8.0.4";
   };
   builder = {
     groups = [
@@ -677,17 +677,6 @@
     };
     version = "1.0.6";
   };
-  css_parser = {
-    dependencies = [ "addressable" ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
-      type = "gem";
-    };
-    version = "1.21.1";
-  };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
@@ -776,10 +765,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1y57fpcvy1kjd4nb7zk7mvzq62wqcpfynrgblj558k3hbvz4404j";
+      sha256 = "0ilmy9wgy57nj3zgal4j4vqx15sc7if7yavvah8wwjnw3h2nbh64";
       type = "gem";
     };
-    version = "4.9.4";
+    version = "5.0.3";
   };
   devise-two-factor = {
     dependencies = [
@@ -792,10 +781,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mzrx8z03vrbfl13dz3kp33as50jd8ad7b39s4k4l3j9k522c2mc";
+      sha256 = "1d5day3h573faxsy24h9pbidjm04hs4ql8qxi1wdmrwsbcxs5qq9";
       type = "gem";
     };
-    version = "6.3.1";
+    version = "6.4.0";
   };
   diff-lcs = {
     groups = [
@@ -879,10 +868,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rcpq49pyaiclpjp3c3qjl25r95hqvin2q2dczaynaj7qncxvv18";
+      sha256 = "0ar4nmvk1sk7drjigqyh9nnps3mxg625b8chfk42557p8i6jdrlz";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   erb_lint = {
     dependencies = [
@@ -960,10 +949,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jj6via2mqccr8vngy10qkm60bc6py86cnf5ykzvn2cd3kwhps2c";
+      sha256 = "1pncl49j3sn6ka53dbf1sw8n0mqlnzh2afwi7ql2dd163lyd44y5";
       type = "gem";
     };
-    version = "3.6.0";
+    version = "3.6.1";
   };
   faraday = {
     dependencies = [
@@ -1017,20 +1006,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rybr2bd1da7n7m3c7m9jaxlalcz71s697ax7fhyb4y51w993mai";
+      sha256 = "1vp62wy85hr5fa0d29y3wh3zaj10sszj3pl19mps84dja2l4099c";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.17.2";
   };
   ffi = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k1xaqw2jk13q3ss7cnyvkp8fzp75dk4kazysrxgfd1rpgvkk7qf";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.3";
+    version = "1.17.4";
   };
   foreman = {
     dependencies = [ "thor" ];
@@ -1103,10 +1092,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f7mikkwfa3hzv4xpbkcr0766v2r34q6rdg5j8k3i3hw2fznw5xa";
+      sha256 = "1s42r7hmf2wl8l0wdc7z07qvmgbdilwjb58q7i9h2slfnncyac5k";
       type = "gem";
     };
-    version = "0.59.0";
+    version = "0.61.0";
   };
   google-cloud-core = {
     dependencies = [
@@ -1141,10 +1130,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jvv9w8s4dqc4ncfa6c6qpdypz2wj8dmgpjd44jq2qhhij5y4sxm";
+      sha256 = "18fh8xvflhhksibcn1v4gnrn6d3xs284ng1fsfwh9b86sxnlga0x";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.0";
   };
   google-cloud-storage = {
     dependencies = [
@@ -1161,10 +1150,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zfzix33r060ch1ms2g7m7zzjhgrp43d67fy3sg1dbvmkixc1v8v";
+      sha256 = "1fc6n7227l3b0b14c0gbfqjibn3zw1mivfvrnb66apbp3mkabjdq";
       type = "gem";
     };
-    version = "1.58.0";
+    version = "1.59.0";
   };
   google-logging-utils = {
     groups = [ "default" ];
@@ -1190,10 +1179,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "173h8r5dzhn4dvq2idx59jaybkhd02dr7333qshc3n2mkp76nxrn";
+      sha256 = "0f56614nd955cxwy98c2d1zk4zg263r1iafd90czg2p3w819a00m";
       type = "gem";
     };
-    version = "1.16.1";
+    version = "1.16.2";
   };
   hashdiff = {
     groups = [
@@ -1219,20 +1208,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f14iqfk5f9xiir82b50hpyc1ms1m7n5wpywbyvahnggjk41daq5";
+      sha256 = "10i5826zgvk04jsn6yg7w72s1l5xghrapm6anay4g8w8l32jzqvq";
       type = "gem";
     };
-    version = "1.5.0";
-  };
-  htmlentities = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hy5jvzd4wagk0k0yq7bjm6fa7ba7vjggzjfpri95jifkzvbvbxv";
-      type = "gem";
-    };
-    version = "4.4.2";
+    version = "1.6.0";
   };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
@@ -1280,6 +1259,7 @@
   irb = {
     dependencies = [
       "pp"
+      "prism"
       "rdoc"
       "reline"
     ];
@@ -1291,10 +1271,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01h8bdksg0cr8bw5dhlhr29ix33rp822jmshy6rdqz4lmk4mdgia";
+      sha256 = "1bishrxfn2anwlagw8rzly7i2yicjnr947f48nh638yqjgdlv30n";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.17.0";
   };
   jmespath = {
     groups = [ "default" ];
@@ -1315,10 +1295,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11prr7nrxh1y4rfsqa51gy4ixx63r18cz9mdnmk0938va1ajf4gy";
+      sha256 = "0il6qxkxqql7n7sgrws5bi5a36v51dswqcxb6j6gm8aj62shp6r8";
       type = "gem";
     };
-    version = "2.18.1";
+    version = "2.19.3";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -1450,10 +1430,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -1552,7 +1532,10 @@
     version = "2.8.9";
   };
   minitest = {
-    dependencies = [ "prism" ];
+    dependencies = [
+      "drb"
+      "prism"
+    ];
     groups = [
       "default"
       "development"
@@ -1561,10 +1544,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fslin1vyh60snwygx8jnaj4kwhk83f3m0v2j2b7bsg2917wfm3q";
+      sha256 = "048ls6kn009jkwj1rvka2b5vnwq73b0krjz740j6j03cwcfqmb48";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.3";
   };
   msgpack = {
     groups = [ "default" ];
@@ -1609,10 +1592,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1imc50a9ic3ynsl3k0japhmb0ggrgp2c186cfqbcclv892nsrjh8";
+      sha256 = "1bgjhb65r1bl52wdym6wpbb0r3j7va8s44grggp0jvarfvw7bawv";
       type = "gem";
     };
-    version = "0.6.2";
+    version = "0.6.3";
   };
   net-pop = {
     dependencies = [ "net-protocol" ];
@@ -1679,20 +1662,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15anyh2ir3kdji93kw770xxwm5rspn9rzx9b9zh1h9gnclcd4173";
+      sha256 = "0mhp90nf3g3yy5vgjnwd34czi6rbi0p7057vgngfmmdkknsxiz9q";
       type = "gem";
     };
-    version = "1.19.0";
+    version = "1.19.2";
   };
   numo-narray-alt = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q9vi03hrxgaq21w0g7babhn9drxpzf9flmvsck9j7rakakqcvnc";
+      sha256 = "1vh20lxy5gsdr4an994s0d4h1d5bfbhmlr63gw15n3ghcf31mc07";
       type = "gem";
     };
-    version = "0.9.13";
+    version = "0.10.3";
   };
   oj = {
     dependencies = [
@@ -1703,10 +1686,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00q33rm7lpfc319pf6him05ak76gfy7i04iiddrz317q7swbq55i";
+      sha256 = "0g817hjx1rh4zhvcpb9m6lr6l8yyq3n8vnjm9x1rc5wr51hv6d9n";
       type = "gem";
     };
-    version = "3.16.13";
+    version = "3.16.16";
   };
   onnxruntime = {
     dependencies = [ "ffi" ];
@@ -1724,10 +1707,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14gfk3j88gcfk2mzp4ingm7y1pq2nbnsgzkfvflwksfljgni2mqq";
+      sha256 = "0zazkk5q3p2ldd23ka04wypsz2g8gqwwainf3d58j0kvdc9p8yg2";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.0.1";
   };
   orm_adapter = {
     groups = [ "default" ];
@@ -1772,16 +1755,17 @@
   pagy = {
     dependencies = [
       "json"
+      "uri"
       "yaml"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qkmmx83pggimiryyjacgiq72qw98db84s5vc4rqk9x9yinkff1x";
+      sha256 = "1xmywpn5zj99708zhmxx2xf76fnwwffrxa3648igvaqai8r5f6ml";
       type = "gem";
     };
-    version = "43.2.8";
+    version = "43.4.4";
   };
   parallel = {
     groups = [
@@ -1792,10 +1776,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
       type = "gem";
     };
-    version = "1.27.0";
+    version = "1.28.0";
   };
   parser = {
     dependencies = [
@@ -1810,10 +1794,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1256ws3w3gnfqj7r3yz2i9y1y7k38fhjphxpybkyb4fds8jsgxh6";
+      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
       type = "gem";
     };
-    version = "3.3.10.1";
+    version = "3.3.11.1";
   };
   pg = {
     groups = [ "default" ];
@@ -1840,46 +1824,16 @@
     };
     version = "0.6.3";
   };
-  premailer = {
-    dependencies = [
-      "addressable"
-      "css_parser"
-      "htmlentities"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ryivdnij1990hcqqmq4s0x1vjvfl0awjc9b91f8af17v2639qhg";
-      type = "gem";
-    };
-    version = "1.27.0";
-  };
-  premailer-rails = {
-    dependencies = [
-      "actionmailer"
-      "net-smtp"
-      "premailer"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0004f73kgrglida336fqkgx906m6n05nnfc17mypzg5rc78iaf61";
-      type = "gem";
-    };
-    version = "1.12.0";
-  };
   pretender = {
     dependencies = [ "actionpack" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gd6zmdgb48n63459g09xvfk279l6lsa4xyhnlj59p6h5ps8slnl";
+      sha256 = "0a0n8imhm4m3y3ql8l4ncx3k8krlx5sz4wy4s99dp09jillg953x";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "1.0.0";
   };
   prettyprint = {
     groups = [
@@ -1904,10 +1858,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0m0jkk1y537xc2rw5fg7sid5fnd4a9mw2gphqmiflc2mxwb3lic4";
+      sha256 = "11ggfikcs1lv17nhmhqyyp6z8nq5pkfcj6a904047hljkxm0qlvv";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.0";
   };
   pry = {
     dependencies = [
@@ -1969,10 +1923,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mx84s7gn3xabb320hw8060v7amg6gmcyyhfzp0kawafiq60j54i";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
       type = "gem";
     };
-    version = "7.0.2";
+    version = "7.0.5";
   };
   puma = {
     dependencies = [ "nio4r" ];
@@ -2008,10 +1962,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xmnrk076sqymilydqgyzhkma3hgqhcv8xhy7ks479l2a3vvcx2x";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.6";
   };
   rack-proxy = {
     dependencies = [ "rack" ];
@@ -2037,10 +1991,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -2091,10 +2045,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15bxpa0acs5qc9ls4y1i21cp6wimkn5swn81kxmp1a6z4cdhcsah";
+      sha256 = "1lww7i686rm9s50d34hb596y2kfl46dida2kjy8gr64c6jjpn0bd";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   rails-dom-testing = {
     dependencies = [
@@ -2128,10 +2082,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0q55i6mpad20m2x1lg5pkqfpbmmapk0sjsrvr1sqgnj2hb5f5z1m";
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.7.0";
   };
   rails-i18n = {
     dependencies = [
@@ -2147,21 +2101,6 @@
     };
     version = "8.1.0";
   };
-  rails_autolink = {
-    dependencies = [
-      "actionview"
-      "activesupport"
-      "railties"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fpwkc20bi7aynfgp2bqhvb7x6vsdiai4prflcsr9sicbwp9vjzv";
-      type = "gem";
-    };
-    version = "1.1.8";
-  };
   railties = {
     dependencies = [
       "actionpack"
@@ -2181,10 +2120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mc0kz2vhld3gn5m91ddy98qfnrbk765aznh8vy6hxjgdgkyr28j";
+      sha256 = "08nyhsigcvjpj9i3r0s73yi8zm16sxmr2x7xgxlaq2jjrghb0gli";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   rainbow = {
     groups = [
@@ -2228,10 +2167,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qvky4s2fx5xbaz1brxanalqbcky3c7xbqd6dicpih860zgrjj29";
+      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   redis-client = {
     dependencies = [ "connection_pool" ];
@@ -2239,10 +2178,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "083i9ig39bc249mv24nsb2jlfwcdgmp9kbpy5ph569nsypphpmrs";
+      sha256 = "0jw2xjzz24dwn85y8v1jf1vzzpsnypsvs06f1qfa91w7rpwr5248";
       type = "gem";
     };
-    version = "0.26.4";
+    version = "0.28.0";
   };
   regexp_parser = {
     groups = [
@@ -2318,10 +2257,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q48hqws2dy1vws9schc0kmina40gy7sn5qsndpsfqdslh65snha";
+      sha256 = "1g634lvyriq8pk87fn0dnz2ib9mma98ks7y0b30j28a9gm5i2gzv";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "3.4.1";
   };
   rexml = {
     groups = [
@@ -2427,10 +2366,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
+      sha256 = "0iqxmw0knjiz5nf6pgr8ihs6cjzh89f0ppj3fqiz8cvms79x6sh8";
       type = "gem";
     };
-    version = "3.13.7";
+    version = "3.13.8";
   };
   rspec-rails = {
     dependencies = [
@@ -2449,10 +2388,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kis8dfxlvi6gdzrv9nsn3ckw0c2z7armhni917qs1jx7yjkjc8i";
+      sha256 = "1pr29snnnlgkqv80vbi4795l6rxq3l47x5rl7lyni4h8zj95c8q6";
       type = "gem";
     };
-    version = "8.0.2";
+    version = "8.0.4";
   };
   rspec-support = {
     groups = [
@@ -2463,10 +2402,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cmgz34hwj5s3jwxhyl8mszs24nci12ffbrmr5jb1si74iqf739f";
+      sha256 = "0z64h5rznm2zv21vjdjshz4v0h7bxvg02yc6g7yzxakj11byah06";
       type = "gem";
     };
-    version = "3.13.6";
+    version = "3.13.7";
   };
   rubocop = {
     dependencies = [
@@ -2488,10 +2427,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wz2np5ck54vpwcz18y9x7w80c308wza7gmfcykysq59ajkadw89";
+      sha256 = "11nicljvmns665vryhfdrpssnk5dn1mxdap7ynprpgkfw5piiwag";
       type = "gem";
     };
-    version = "1.82.1";
+    version = "1.86.0";
   };
   rubocop-ast = {
     dependencies = [
@@ -2506,10 +2445,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zbikzd6237fvlzjfxdlhwi2vbmavg1cc81y6cyr581365nnghs9";
+      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
       type = "gem";
     };
-    version = "1.49.0";
+    version = "1.49.1";
   };
   rubocop-performance = {
     dependencies = [
@@ -2637,10 +2576,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "189l1ajvpy8znkmbalrpc3fpg0b8gy1j3m4m5q282prf1zj1xh4z";
+      sha256 = "1af49rikvc0m4mf6asjyb601195hgvgx8ycmwwrvmizhdqck70sh";
       type = "gem";
     };
-    version = "3.1.0";
+    version = "3.1.1";
   };
   shakapacker = {
     dependencies = [
@@ -2654,10 +2593,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a1r7zf15bxjdwmavjl363fqgv9gpd6mpc41d0fn8lhc468r4n3b";
+      sha256 = "0kxji9yj8vga2qbgg8x1m3j74w8n21rqqz60f33q9kwzaabby9j1";
       type = "gem";
     };
-    version = "9.5.0";
+    version = "9.7.0";
   };
   sidekiq = {
     dependencies = [
@@ -2671,10 +2610,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1r6ik93p4dbjjdwa8w7qn4rgn9rn4y2xbswp3q9b3mz4x6p5xpkb";
+      sha256 = "1szw72f2k9vyyi81c9rv1rj91s849j6jxwvvsxsxdnmi5gr6c4ja";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "8.1.2";
   };
   signet = {
     dependencies = [
@@ -2758,10 +2697,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v19bypbf46ms3gvk47hi4smcf6pm0gc8daa786mapzc685w1sgc";
+      sha256 = "1cbkgb5s3qsfjgnp75habwxsi97711jg90yh52ihcssbf58430c6";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.9.2";
   };
   stringio = {
     groups = [
@@ -2793,10 +2732,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "131cnwbs375r349yzsdyw7a9djxjfmymn8kk96s51sm3jhmlcxjz";
+      sha256 = "17k75zrwf4ag9yl9wjjkcb90zrm4r5jigdzv3zr5jm9239hxpqma";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   thor = {
     groups = [
@@ -2820,10 +2759,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bz11pq7n1g51f50jqmgyf5b1v64p1pfqmy5l21y6vpr37b2lwkd";
+      sha256 = "1jxcji88mh6xsqz0mfzwnxczpg7cyniph7wpavnavfz7lxl77xbq";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.6.1";
   };
   trailblazer-option = {
     groups = [ "default" ];
@@ -2840,13 +2779,11 @@
     groups = [ "default" ];
     platforms = [ ];
     source = {
-      fetchSubmodules = false;
-      rev = "3963d490459df7a2b5bedb42424c3285f25eab22";
-      sha256 = "155ghsvf9kcsp6wpvhb15yzkhvq8k6lykip3f2npiasgyz10b3c5";
-      type = "git";
-      url = "https://github.com/trilogy-libraries/trilogy.git";
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0m5d1v0gsdh8m24bxc8hw7gypf9l56zkdy1lfaca7a9ix12n463m";
+      type = "gem";
     };
-    version = "2.10.0";
+    version = "2.12.2";
   };
   tsort = {
     groups = [
@@ -2871,10 +2808,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ivb45cpj3v9ky0nr34vwfa0x8i90ycbxmyr0wd8q7fikyi0w1q2";
+      sha256 = "0priz7ww23h2j9j5zicc4np3rr357n01xw8zymn0bzxg79rr03gf";
       type = "gem";
     };
-    version = "2.0.21";
+    version = "2.0.23";
   };
   twitter_cldr = {
     dependencies = [
@@ -2913,10 +2850,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qlm97fqcwhvfa7jg2gnq8la3mnk617b5bwsc460mi75wpqy4imm";
+      sha256 = "1z896q8kzig9x6g3bcp38apns05y36jhf4j7ml7wzqjsmqcnb8sf";
       type = "gem";
     };
-    version = "1.2025.3";
+    version = "1.2026.1";
   };
   uber = {
     groups = [ "default" ];
@@ -3013,7 +2950,6 @@
   web-console = {
     dependencies = [
       "actionview"
-      "activemodel"
       "bindex"
       "railties"
     ];
@@ -3021,10 +2957,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "087y4byl2s3fg0nfhix4s0r25cv1wk7d2j8n5324waza21xg7g77";
+      sha256 = "193ddancfznc34qp2bqz5mkv906v4aka6njv2lzhkhnz3hq72fz1";
       type = "gem";
     };
-    version = "4.2.1";
+    version = "4.3.0";
   };
   webmock = {
     dependencies = [
@@ -3036,10 +2972,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mqw7ca931zmqgad0fq4gw7z3gwb0pwx9cmd1b12ga4hgjsnysag";
+      sha256 = "142cbab47mjxmg8gc89d94sd3h7an9ligh38r9n88wb3xbr5cibp";
       type = "gem";
     };
-    version = "3.26.1";
+    version = "3.26.2";
   };
   webrick = {
     groups = [
@@ -3117,9 +3053,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12zcvhzfnlghzw03czy2ifdlyfpq0kcbqcmxqakfkbxxavrr1vrb";
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
 }
diff --git a/pkgs/by-name/do/docuseal/package.nix b/pkgs/by-name/do/docuseal/package.nix
index 9c8cdf964329..abb8db12fb46 100644
--- a/pkgs/by-name/do/docuseal/package.nix
+++ b/pkgs/by-name/do/docuseal/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "docuseal";
-  version = "2.3.4";
+  version = "2.4.4";
 
   bundler = bundler.override { ruby = ruby_3_4; };
 
@@ -24,17 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "docusealco";
     repo = "docuseal";
     tag = finalAttrs.version;
-    hash = "sha256-JKV0xAtEbGETprC5zYEcmCVcUFrW4h/+lbYayzWefKs=";
+    hash = "sha256-GjWR0jxVRTs5KNbFDEcgCbG/HTJlJGYpbKf8+0YBSmk=";
     # https://github.com/docusealco/docuseal/issues/505#issuecomment-3153802333
     postFetch = "rm $out/db/schema.rb";
   };
 
-  patches = [
-    # Drop setxid calls in non-root mode (fails under strict seccomp).
-    # https://github.com/docusealco/docuseal/pull/593
-    ./only-switch-uid-when-root.patch
-  ];
-
   rubyEnv = bundlerEnv {
     name = "docuseal-gems";
     ruby = ruby_3_4;
@@ -52,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     offlineCache = fetchYarnDeps {
       inherit (finalAttrs) src;
-      hash = "sha256-AvdaSIXO31t15wWysTvFISqmKCAi1Q8CJgO0J2DqM6M=";
+      hash = "sha256-62nI/QUzlpI1VyZ6PWPz2kSp4S2GUIQDaf4jUwzyj24=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index 14c629fe5313..6b16dcfd94a2 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.1",
-  "rev": "7dbb2e646fea939a89f10a55aa98c474cbb0c098",
-  "hash": "sha256-FygBpfhvezvUbI969Dta+vZOPt6BnSW2d5gO4I4oB2A=",
-  "python_hash": "sha256-ZB+Zcxg5VjBzfTkQk7TxoP9pw+hvOXpB2qqnqqmjhxM="
+  "version": "1.5.2",
+  "rev": "8a5851971fae891f292c2714d86046ee018e9737",
+  "hash": "sha256-FWoVF7s/n28NN1HtnO0Cr3YyoIDgJcWBtBiO7vWiSOU=",
+  "python_hash": "sha256-B14dXW5pPnToiKbSD9ACzNksIhBG+ui1P9l67Qyke8o="
 }
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index 14f922dc3216..0920e715eb15 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.19.10";
+  version = "3.19.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G0Scv6XHjpxp5V0Ep+4itu+SmO/8jhR6LHvG/9scIPY=";
+    hash = "sha256-BSXIC85iRVtSx1TB8yB2EassXfnlEqDpTX17+c1VauQ=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/gf/gfan/package.nix b/pkgs/by-name/gf/gfan/package.nix
index 9c1d1864dc48..9ca8ed038811 100644
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@@ -35,7 +35,14 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  postPatch = lib.optionalString stdenv.cc.isClang ''
+  # This test assumes that our implementation of sort behaves identically to the
+  # one used during development, which is not necessarily the case; update the
+  # expected result to be sorted using our copy of sort.
+  postPatch = ''
+    sort testsuite/0008PolynomialSetUnion/output -o testsuite/0008PolynomialSetUnion/output
+    sort testsuite/0008PolynomialSetUnion/outputNew -o testsuite/0008PolynomialSetUnion/outputNew
+  ''
+  + lib.optionalString stdenv.cc.isClang ''
     substituteInPlace Makefile --replace "-fno-guess-branch-probability" ""
 
     for f in $(find -name "*.h" -or -name "*.cpp"); do
@@ -53,6 +60,15 @@ stdenv.mkDerivation (finalAttrs: {
     mpir
     cddlib
   ];
+  hardeningDisable = [ "libcxxhardeningfast" ];
+
+  doCheck = true;
+  # The test runner still exits successfully when there are failed tests, so check
+  # stdout to see if anything failed.
+  checkPhase = ''
+    make check | tee "$TMPDIR/test.log"
+    ! grep -q "Failed tests:" "$TMPDIR/test.log"
+  '';
 
   meta = {
     description = "Software package for computing Gröbner fans and tropical varieties";
diff --git a/pkgs/by-name/gf/gforth/package.nix b/pkgs/by-name/gf/gforth/package.nix
index 4ff19e15c911..bed387a3214a 100644
--- a/pkgs/by-name/gf/gforth/package.nix
+++ b/pkgs/by-name/gf/gforth/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  callPackage,
+  buildPackages,
   autoreconfHook,
   gitUpdater,
   texinfo,
@@ -11,8 +11,8 @@
 }:
 
 let
-  swig = callPackage ./swig.nix { };
-  bootForth = callPackage ./boot-forth.nix { };
+  swig = buildPackages.callPackage ./swig.nix { };
+  bootForth = buildPackages.callPackage ./boot-forth.nix { };
   lispDir = "${placeholder "out"}/share/emacs/site-lisp";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -32,9 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     writableTmpDirAsHomeHook
     autoreconfHook
     texinfo
-    bootForth
     swig
-  ];
+  ]
+  ++ (
+    if (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) then
+      [ buildPackages.gforth ]
+    else
+      [ bootForth ]
+  );
 
   buildInputs = [
     libffi
@@ -47,12 +52,41 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     "--build=x86_64-apple-darwin"
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    # Tries to run ./engine/gforth-ll
+    "--without-check"
+    # Use build-platform CC for helper programs that must run during build
+    "HOSTCC=${buildPackages.stdenv.cc}/bin/cc"
+    # Tell gforth's libcc where to find the cross compiler
+    "CROSS_PREFIX=${stdenv.hostPlatform.config}-"
+  ];
+
+  env = lib.optionalAttrs (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
+    # Tell gforth's libcc to prefix compiler commands with the cross-compilation target
+    CROSS_PREFIX = "${stdenv.hostPlatform.config}-";
+  };
+
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "DITCENGINE=${buildPackages.gforth}/bin/gforth-ditc"
+    "GFORTH=${buildPackages.gforth}/bin/gforth"
+    "ENGINE=${buildPackages.gforth}/bin/gforth" # for ./preforth
   ];
 
   preConfigure = ''
     mkdir -p ${lispDir}
   '';
 
+  postConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # Put the project-local (cross-aware) libtool first in PATH
+    mkdir -p .cross-bin
+    ln -sf "$PWD/libtool" .cross-bin/libtool
+    ln -sf "$PWD/libtool" ".cross-bin/${stdenv.hostPlatform.config}-libtool"
+    export PATH="$PWD/.cross-bin:$PATH"
+    # Remove 'check' from the default 'all' target (can't run cross binaries)
+    sed -i 's/^\(all:.*\) check/\1/' Makefile
+  '';
+
   passthru.updateScript = gitUpdater { };
 
   meta = {
diff --git a/pkgs/by-name/gi/gitea-mcp-server/package.nix b/pkgs/by-name/gi/gitea-mcp-server/package.nix
index 5a1d597045e6..832169f03f63 100644
--- a/pkgs/by-name/gi/gitea-mcp-server/package.nix
+++ b/pkgs/by-name/gi/gitea-mcp-server/package.nix
@@ -6,17 +6,17 @@
 
 buildGo126Module (finalAttrs: {
   pname = "gitea-mcp-server";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "gitea-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B7uB69YsQd8EeENrezFK7kFXha21XValjEAYRjeYreo=";
+    hash = "sha256-weJcl9Vp7mhPiaui7VGETs5t4trUDTegDoUR8gRTGIs=";
   };
 
-  vendorHash = "sha256-xfhvbTcniRnkv81MIEnoy36up8O2IZ1WUrhYJrhtZ3k=";
+  vendorHash = "sha256-35zVDzivvO3tSi1RYvXJoLvrlvnp3JCzwC5FqDEj91M=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/goperf/package.nix b/pkgs/by-name/go/goperf/package.nix
index 84626a929f00..0953b98791b9 100644
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "goperf";
-  version = "0-unstable-2026-03-11";
+  version = "0-unstable-2026-04-09";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "16a31bc5fbd0f58f2e8e2a496d8e035bdc4a2e06";
-    hash = "sha256-be0vWFJUXTPWKapd+rX3Stnzra9LUGNEw+4P+fWzjyk=";
+    rev = "8e83ce0f7b1c6c5d6eab4763f10b9322cbe4cecb";
+    hash = "sha256-JIR+ytMsZaiQ5w4vTmLG4JHg6tz3/sAs24C3m5//hy4=";
   };
 
-  vendorHash = "sha256-oBSd0D66BGfanCADtrpyIoUit8c+yHk8Nm6o2GmKoZg=";
+  vendorHash = "sha256-5WnH49NE1OUaTFuan3DZYhm0uJxIf7i5pgXK1PuqhA0=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 1192c1935d42..b1fbd152a13c 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -10,7 +10,7 @@
   copyDesktopItems,
   desktopToDarwinBundle,
   jdk,
-  jdk17,
+  jdk25,
   hmclJdk ? jdk.override {
     # Required by jar file
     enableJavaFX = true;
@@ -21,13 +21,14 @@
   },
   minecraftJdks ? [
     hmclJdk
-    jdk17
+    jdk25
   ],
   libxxf86vm,
   libxtst,
   libxrandr,
   libxext,
   libxcursor,
+  libxkbcommon,
   libx11,
   xrandr,
   glib,
@@ -152,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxxf86vm
     libxext
     libxcursor
+    libxkbcommon
     libxrandr
     libxtst
     libpulseaudio
@@ -192,7 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
         lib.makeBinPath (minecraftJdks ++ lib.optional stdenv.hostPlatform.isLinux xrandr)
       }" \
       --run 'cd $HOME' \
-      ${lib.optionalString stdenv.hostPlatform.isLinux ''--prefix JAVA_TOOL_OPTIONS " " "-Dorg.lwjgl.glfw.libname=${lib.getLib glfw3'}/lib/libglfw.so"''} \
       ''${gappsWrapperArgs[@]}
   '';
 
@@ -212,6 +213,15 @@ stdenv.mkDerivation (finalAttrs: {
       Hello Minecraft! Launcher (HMCL) is a free, open-source, and cross-platform Minecraft launcher.
       It provides comprehensive support for managing multiple game versions and mod loaders,
       including Forge, NeoForge, Fabric, Quilt, LiteLoader, and OptiFine.
+
+      Starting with Minecraft 26.1, Wayland support can be enabled
+      by adding the JDK arguments -DMC_DEBUG_ENABLED and
+      -DMC_DEBUG_PREFER_WAYLAND. If needed, configure them in
+      HMCL -> Advanced Settings -> JVM Options -> JVM Arguments.
+
+      Users who are still on an older version and want to use Wayland should
+      enable HMCL -> Advanced Settings -> Workaround -> Use System GLFW.
+      Otherwise, keep it disabled.
     '';
     maintainers = with lib.maintainers; [
       daru-san
diff --git a/pkgs/by-name/in/interstellar/emoji_builder.patch b/pkgs/by-name/in/interstellar/emoji_builder.patch
new file mode 100644
index 000000000000..e5645839f60c
--- /dev/null
+++ b/pkgs/by-name/in/interstellar/emoji_builder.patch
@@ -0,0 +1,82 @@
+--- a/lib/src/widgets/emoji_picker/emoji_builder.dart
++++ b/lib/src/widgets/emoji_picker/emoji_builder.dart
+@@ -1,7 +1,7 @@
+ import 'dart:convert';
++import 'dart:io';
+ 
+ import 'package:build/build.dart';
+-import 'package:http/http.dart' as http;
+ import 'package:interstellar/src/utils/trie.dart';
+ 
+ Builder emojiBuilder(BuilderOptions options) =>
+@@ -29,15 +29,9 @@
+   };
+ 
+   Future<String> _generateContent() async {
+-    final dataResponse = await http.get(
+-      Uri.parse('$_sourcePrefix/compact.raw.json'),
+-    );
+-    final dataJson = jsonDecode(dataResponse.body);
++    final dataJson = jsonDecode(await File('@compact.raw.json@').readAsString()) as List;
+ 
+-    final messagesResponse = await http.get(
+-      Uri.parse('$_sourcePrefix/messages.raw.json'),
+-    );
+-    final messagesJson = jsonDecode(messagesResponse.body);
++    final messagesJson = jsonDecode(await File('@messages.raw.json@').readAsString()) as Map<String, dynamic>;
+ 
+     final s = StringBuffer()
+       ..write('''
+@@ -53,8 +47,9 @@
+ 
+     final emojiGroups = <String>[];
+ 
+-    for (var i = 0; i < (messagesJson['groups'] as List).length; i++) {
+-      final group = messagesJson['groups'][i];
++    final groups = messagesJson['groups'] as List;
++    for (var i = 0; i < groups.length; i++) {
++      final group = groups[i] as Map<String, dynamic>;
+ 
+       assert(group['order'] == i, 'Emoji group order value should match index');
+ 
+@@ -61,4 +56,4 @@
+-      emojiGroups.add(group['message']);
++      emojiGroups.add(group['message'] as String);
+     }
+ 
+     s
+@@ -72,7 +67,8 @@
+ 
+     {
+       var i = 0;
+-      for (final emoji in dataJson) {
++      for (final emojiItem in dataJson) {
++        final emoji = emojiItem as Map<String, dynamic>;
+         if (emoji['group'] == null || emoji['order'] == null) continue;
+ 
+         assert(emoji['order'] == i + 1, 'Emoji order value should match index');
+@@ -84,9 +80,9 @@
+               : emoji['emoticon']),
+         ];
+ 
+-        trie.addChild(Trie.normalizeTerm(emoji['label']), {i});
++        trie.addChild(Trie.normalizeTerm(emoji['label'] as String), {i});
+         for (final tag in tags) {
+-          trie.addChild(Trie.normalizeTerm(tag), {i});
++          trie.addChild(Trie.normalizeTerm(tag as String), {i});
+         }
+ 
+         s
+@@ -93,9 +89,9 @@
+           ..write('const Emoji("')
+-          ..write(emoji['unicode'])
++          ..write(emoji['unicode'] as String)
+           ..write('","')
+-          ..write(emoji['label'])
++          ..write(emoji['label'] as String)
+           ..write('",')
+-          ..write(emoji['group'])
++          ..write(emoji['group'].toString())
+           ..write('),\n');
+ 
+         i++;
diff --git a/pkgs/by-name/in/interstellar/git-hashes.json b/pkgs/by-name/in/interstellar/git-hashes.json
index 2aa5054878ae..fa2ad4a29e94 100644
--- a/pkgs/by-name/in/interstellar/git-hashes.json
+++ b/pkgs/by-name/in/interstellar/git-hashes.json
@@ -1,3 +1,4 @@
 {
+  "flutter_web_auth_2": "sha256-x3SVeFIYS+UtyNKr4ohq4dvktCgS6nECGrb2vMg9aZc=",
   "webcrypto": "sha256-HX8CcCRbDlVMLMbKGnqKlrkMT9XITLbQE/2OW9zO72w="
 }
diff --git a/pkgs/by-name/in/interstellar/package.nix b/pkgs/by-name/in/interstellar/package.nix
index 1eb70a7f857a..fbdcd5bcd769 100644
--- a/pkgs/by-name/in/interstellar/package.nix
+++ b/pkgs/by-name/in/interstellar/package.nix
@@ -1,7 +1,8 @@
 {
   lib,
-  flutter338,
+  flutter341,
   fetchFromGitHub,
+  fetchurl,
   imagemagick,
   alsa-lib,
   libass,
@@ -13,25 +14,42 @@
   dart,
 }:
 
-let
+flutter341.buildFlutterApplication (finalAttrs: {
   pname = "interstellar";
-
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "interstellar-app";
     repo = "interstellar";
-    tag = "v${version}";
-    hash = "sha256-ZhZBy/KECz/Gs3RSuuXmTtI5pKPBMFQNG/kS8JvEaFc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WprvuIN7yS5yLR4eUF/M9yG25ZU1Sf1I1myujclF4oM=";
   };
-in
-flutter338.buildFlutterApplication {
-  inherit pname version src;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
   gitHashes = lib.importJSON ./git-hashes.json;
 
+  patches = [ ./emoji_builder.patch ];
+
+  postPatch = ''
+    substituteInPlace lib/src/widgets/emoji_picker/emoji_builder.dart \
+        --replace-fail "@compact.raw.json@" "${
+          fetchurl {
+            url = "https://raw.githubusercontent.com/milesj/emojibase/a5fc630a91ca42cddf3f4a66492965600fd3bce8/packages/data/en/compact.raw.json";
+            hash = "sha256-OivCYjiBEooRx3zni9jAr3lR0rzpoa3HX2l/a0UwDpE=";
+          }
+        }" \
+        --replace-fail "@messages.raw.json@" "${
+          fetchurl {
+            url = "https://raw.githubusercontent.com/milesj/emojibase/a5fc630a91ca42cddf3f4a66492965600fd3bce8/packages/data/en/messages.raw.json";
+            hash = "sha256-ZQWXZJ5jXxDNQHaOAsxApAt6oanvaEwZ6VXbDA0YeMs=";
+          }
+        }"
+    substituteInPlace lib/src/controller/database/database.dart \
+      --replace-fail "const Color.from(alpha: 1, red: 1, green: 1, blue: 1).value32bit" "0xFFFFFFFF" \
+      --replace-fail "const Color.from(alpha: 1, red: 0, green: 0, blue: 0).value32bit" "0xFF000000"
+  '';
+
   nativeBuildInputs = [ imagemagick ];
 
   buildInputs = [
@@ -54,14 +72,14 @@ flutter338.buildFlutterApplication {
   '';
 
   extraWrapProgramArgs = ''
-    --prefix LD_LIBRARY_PATH : $out/app/${pname}/lib
+    --prefix LD_LIBRARY_PATH : $out/app/${finalAttrs.pname}/lib
   '';
 
   passthru = {
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          inherit src;
+          inherit (finalAttrs) src;
           nativeBuildInputs = [ yq-go ];
         }
         ''
@@ -96,4 +114,4 @@ flutter338.buildFlutterApplication {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ JollyDevelopment ];
   };
-}
+})
diff --git a/pkgs/by-name/in/interstellar/pubspec.lock.json b/pkgs/by-name/in/interstellar/pubspec.lock.json
index d1914455de24..dd9676c3b25b 100644
--- a/pkgs/by-name/in/interstellar/pubspec.lock.json
+++ b/pkgs/by-name/in/interstellar/pubspec.lock.json
@@ -4,21 +4,31 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "f0bb5d1648339c8308cc0b9838d8456b3cfe5c91f9dc1a735b4d003269e5da9a",
+        "sha256": "5b7468c326d2f8a4f630056404ca0d291ade42918f4a3c6233618e724f39da8e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "88.0.0"
+      "version": "92.0.0"
     },
     "analyzer": {
       "dependency": "transitive",
       "description": {
         "name": "analyzer",
-        "sha256": "0b7b9c329d2879f8f05d6c05b32ee9ec025f39b077864bdb5ac9a7b63418a98f",
+        "sha256": "70e4b1ef8003c64793a9e268a551a82869a8a96f39deb73dea28084b0e8bf75e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.1"
+      "version": "9.0.0"
+    },
+    "ansicolor": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ansicolor",
+        "sha256": "50e982d500bc863e1d703448afdbf9e5a72eb48840a4f766fa361ffd6877055f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
     },
     "any_link_preview": {
       "dependency": "direct main",
@@ -60,15 +70,25 @@
       "source": "hosted",
       "version": "2.13.0"
     },
-    "blurhash_ffi": {
+    "auto_route": {
       "dependency": "direct main",
       "description": {
-        "name": "blurhash_ffi",
-        "sha256": "9811937f2e568aedb5630c9d901323c236414e3e882050fdf25bc42f7431d7bb",
+        "name": "auto_route",
+        "sha256": "e9acfeb3df33d188fce4ad0239ef4238f333b7aa4d95ec52af3c2b9360dcd969",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.7"
+      "version": "11.1.0"
+    },
+    "auto_route_generator": {
+      "dependency": "direct main",
+      "description": {
+        "name": "auto_route_generator",
+        "sha256": "04300eaf5821962aae8b5cd94f67013fd2fd326dc3be212d3ec1ae7470f09834",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.4.0"
     },
     "boolean_selector": {
       "dependency": "transitive",
@@ -81,14 +101,14 @@
       "version": "2.1.2"
     },
     "build": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "build",
-        "sha256": "5b887c55a0f734b433b3b2d89f9cd1f99eb636b17e268a5b4259258bc916504b",
+        "sha256": "275bf6bb2a00a9852c28d4e0b410da1d833a734d57d39d44f94bfc895a484ec3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "4.0.4"
     },
     "build_config": {
       "dependency": "transitive",
@@ -111,14 +131,14 @@
       "version": "4.0.4"
     },
     "build_runner": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "build_runner",
-        "sha256": "804c47c936df75e1911c19a4fb8c46fa8ff2b3099b9f2b2aa4726af3774f734b",
+        "sha256": "b4d854962a32fd9f8efc0b76f98214790b833af8b2e9b2df6bfc927c0415a072",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.8.0"
+      "version": "2.10.5"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -264,11 +284,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "c87dfe3d56f183ffe9106a18aebc6db431fc7c98c31a54b952a77f3d54a85697",
+        "sha256": "a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.2"
+      "version": "3.1.3"
     },
     "db_viewer": {
       "dependency": "transitive",
@@ -294,11 +314,11 @@
       "dependency": "direct main",
       "description": {
         "name": "drift",
-        "sha256": "540cf382a3bfa99b76e51514db5b0ebcd81ce3679b7c1c9cb9478ff3735e47a1",
+        "sha256": "5ea2f718558c0b31d4b8c36a3d8e5b7016f1265f46ceb5a5920e16117f0c0d6a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.28.2"
+      "version": "2.30.1"
     },
     "drift_db_viewer": {
       "dependency": "direct main",
@@ -311,14 +331,14 @@
       "version": "2.1.0"
     },
     "drift_dev": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "drift_dev",
-        "sha256": "4db0eeedc7e8bed117a9f22d867ab7a3a294300fed5c269aac90d0b3545967ca",
+        "sha256": "892dfb5d69d9e604bdcd102a9376de8b41768cf7be93fd26b63cfc4d8f91ad5f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.28.3"
+      "version": "2.30.1"
     },
     "drift_flutter": {
       "dependency": "direct main",
@@ -486,6 +506,16 @@
       "source": "sdk",
       "version": "0.0.0"
     },
+    "flutter_blurhash": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_blurhash",
+        "sha256": "e97b9aff13b9930bbaa74d0d899fec76e3f320aba3190322dcc5d32104e3d25d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.1"
+    },
     "flutter_colorpicker": {
       "dependency": "direct main",
       "description": {
@@ -497,7 +527,7 @@
       "version": "1.1.0"
     },
     "flutter_launcher_icons": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "flutter_launcher_icons",
         "sha256": "10f13781741a2e3972126fae08393d3c4e01fa4cd7473326b94b72cf594195e7",
@@ -506,16 +536,6 @@
       "source": "hosted",
       "version": "0.14.4"
     },
-    "flutter_lints": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "flutter_lints",
-        "sha256": "3105dc8492f6183fb076ccf1f351ac3d60564bff92e20bfc4af9cc1651f4e7e1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "6.0.0"
-    },
     "flutter_local_notifications": {
       "dependency": "direct main",
       "description": {
@@ -618,6 +638,27 @@
       "source": "sdk",
       "version": "0.0.0"
     },
+    "flutter_web_auth_2": {
+      "dependency": "direct main",
+      "description": {
+        "path": "flutter_web_auth_2",
+        "ref": "b1af971b79160979320a4865e238dcaacf69b624",
+        "resolved-ref": "b1af971b79160979320a4865e238dcaacf69b624",
+        "url": "https://github.com/interstellar-app/flutter_web_auth_2.git"
+      },
+      "source": "git",
+      "version": "5.0.1"
+    },
+    "flutter_web_auth_2_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "flutter_web_auth_2_platform_interface",
+        "sha256": "ba0fbba55bffb47242025f96852ad1ffba34bc451568f56ef36e613612baffab",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.0.0"
+    },
     "flutter_web_plugins": {
       "dependency": "transitive",
       "description": "flutter",
@@ -625,14 +666,14 @@
       "version": "0.0.0"
     },
     "freezed": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "freezed",
-        "sha256": "13065f10e135263a4f5a4391b79a8efc5fb8106f8dd555a9e49b750b45393d77",
+        "sha256": "03dd9b7423ff0e31b7e01b2204593e5e1ac5ee553b6ea9d8184dff4a26b9fb07",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.3"
+      "version": "3.2.4"
     },
     "freezed_annotation": {
       "dependency": "direct main",
@@ -674,6 +715,16 @@
       "source": "hosted",
       "version": "2.3.2"
     },
+    "hotreloader": {
+      "dependency": "transitive",
+      "description": {
+        "name": "hotreloader",
+        "sha256": "bc167a1163807b03bada490bfe2df25b0d744df359227880220a5cbd04e5734b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.3.0"
+    },
     "html": {
       "dependency": "transitive",
       "description": {
@@ -865,14 +916,14 @@
       "version": "4.9.0"
     },
     "json_serializable": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "json_serializable",
-        "sha256": "33a040668b31b320aafa4822b7b1e177e163fc3c1e835c6750319d4ab23aa6fe",
+        "sha256": "5b89c1e32ae3840bb20a1b3434e3a590173ad3cb605896fb0f60487ce2f8104e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.11.1"
+      "version": "6.11.4"
     },
     "leak_tracker": {
       "dependency": "transitive",
@@ -904,15 +955,15 @@
       "source": "hosted",
       "version": "3.0.2"
     },
-    "lints": {
+    "lean_builder": {
       "dependency": "transitive",
       "description": {
-        "name": "lints",
-        "sha256": "a5e2b223cb7c9c8efdc663ef484fdd95bb243bff242ef5b13e26883547fce9a0",
+        "name": "lean_builder",
+        "sha256": "4f3d70c34c52cc5034e8cc6f53d35aa3a32fb373b78fb4c29cf45cd1dcf06942",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.0"
+      "version": "0.1.5"
     },
     "logger": {
       "dependency": "direct main",
@@ -1514,21 +1565,21 @@
       "dependency": "transitive",
       "description": {
         "name": "source_gen",
-        "sha256": "ccf30b0c9fbcd79d8b6f5bfac23199fb354938436f62475e14aea0f29ee0f800",
+        "sha256": "1d562a3c1f713904ebbed50d2760217fd8a51ca170ac4b05b0db490699dbac17",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.2.0"
     },
     "source_helper": {
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "6a3c6cc82073a8797f8c4dc4572146114a39652851c157db37e964d9c7038723",
+        "sha256": "4a85e90b50694e652075cbe4575665539d253e6ec10e46e76b45368ab5e3caae",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.8"
+      "version": "1.3.10"
     },
     "source_span": {
       "dependency": "transitive",
@@ -1574,11 +1625,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sqlparser",
-        "sha256": "57090342af1ce32bb499aa641f4ecdd2d6231b9403cea537ac059e803cc20d67",
+        "sha256": "f52f5d5649dcc13ed198c4176ddef74bf6851c30f4f31603f1b37788695b93e2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.41.2"
+      "version": "0.43.0"
     },
     "stack_trace": {
       "dependency": "transitive",
@@ -1870,6 +1921,16 @@
       "source": "hosted",
       "version": "2.2.0"
     },
+    "very_good_analysis": {
+      "dependency": "direct main",
+      "description": {
+        "name": "very_good_analysis",
+        "sha256": "96245839dbcc45dfab1af5fa551603b5c7a282028a64746c19c547d21a7f1e3a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.0.0"
+    },
     "visibility_detector": {
       "dependency": "direct main",
       "description": {
@@ -1914,11 +1975,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
+        "sha256": "f52385d4f73589977c80797e60fe51014f7f2b957b5e9a62c3f6ada439889249",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.3"
+      "version": "1.2.0"
     },
     "web": {
       "dependency": "transitive",
@@ -2031,6 +2092,16 @@
       "source": "hosted",
       "version": "0.5.1"
     },
+    "window_to_front": {
+      "dependency": "transitive",
+      "description": {
+        "name": "window_to_front",
+        "sha256": "7aef379752b7190c10479e12b5fd7c0b9d92adc96817d9e96c59937929512aee",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.0.3"
+    },
     "xdg_directories": {
       "dependency": "transitive",
       "description": {
@@ -2051,6 +2122,16 @@
       "source": "hosted",
       "version": "6.6.1"
     },
+    "xxh3": {
+      "dependency": "transitive",
+      "description": {
+        "name": "xxh3",
+        "sha256": "399a0438f5d426785723c99da6b16e136f4953fb1e9db0bf270bd41dd4619916",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.0"
+    },
     "yaml": {
       "dependency": "transitive",
       "description": {
@@ -2074,6 +2155,6 @@
   },
   "sdks": {
     "dart": ">=3.9.0 <4.0.0",
-    "flutter": "3.38.5"
+    "flutter": "3.38.9"
   }
 }
diff --git a/pkgs/by-name/ls/lstk/package.nix b/pkgs/by-name/ls/lstk/package.nix
new file mode 100644
index 000000000000..9b5a4c84e820
--- /dev/null
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -0,0 +1,42 @@
+{
+  fetchFromGitHub,
+  buildGoModule,
+  lib,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "lstk";
+  version = "0.5.7";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "localstack";
+    repo = "lstk";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-HWkCDnbg/D2zX3rdvmFTdKrx03SO6FaiA/Pzj0f4hlA=";
+  };
+
+  vendorHash = "sha256-rEcVtSFnBQ+3bbU5pjbCXEJZo89+lL/1HJG9bCn8OSE=";
+
+  excludedPackages = "test/integration";
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line interface for LocalStack";
+    mainProgram = "lstk";
+    homepage = "https://github.com/localstack/lstk";
+    changelog = "https://github.com/localstack/lstk/releases/tag/v${finalAttrs.version}";
+    longDescription = ''
+      lstk is a command-line interface for LocalStack built in Go with a modern
+      terminal Ul, and native CLI experience for managing and interacting with
+      LocalStack deployments.
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ purcell ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/od/odamex/package.nix b/pkgs/by-name/od/odamex/package.nix
index e0e69caf7afd..b98c575dda8f 100644
--- a/pkgs/by-name/od/odamex/package.nix
+++ b/pkgs/by-name/od/odamex/package.nix
@@ -5,7 +5,7 @@
 
   cmake,
   copyDesktopItems,
-  deutex,
+  python3,
   makeDesktopItem,
   makeWrapper,
   pkg-config,
@@ -18,7 +18,7 @@
   cpptrace,
   curl,
   expat,
-  fltk,
+  fltk_1_4,
   libdwarf,
   libselinux,
   libsepol,
@@ -43,20 +43,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "odamex";
-  version = "12.1.0";
+  version = "12.2.0";
 
   src = fetchFromGitHub {
     owner = "odamex";
     repo = "odamex";
     tag = finalAttrs.version;
-    hash = "sha256-kLI1gdGH5NXJ8YI1tR0N5W6yvGZ+7302z0QLl2j+b0k=";
+    hash = "sha256-cRQtY4C0gjzheE4cG8aPjzAoPf/Hm05a6tidsbce7uM=";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
     cmake
     copyDesktopItems
-    deutex
+    python3
     makeWrapper
     pkg-config
   ]
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     cpptrace
     curl
     expat
-    fltk
+    fltk_1_4
     libdwarf
     libsysprof-capture
     pcre2
@@ -191,7 +191,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/odamex/odamex/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [ eljamm ];
     mainProgram = "odalaunch";
   };
diff --git a/pkgs/by-name/ok/okapi-ed/package.nix b/pkgs/by-name/ok/okapi-ed/package.nix
index 2c0b9fbdc1f5..9c34d48ebbb7 100644
--- a/pkgs/by-name/ok/okapi-ed/package.nix
+++ b/pkgs/by-name/ok/okapi-ed/package.nix
@@ -5,6 +5,7 @@
   ripgrep,
   rustPlatform,
   versionCheckHook,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
@@ -31,12 +32,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Find lines across files by regex and edit them all at once with your $EDITOR";
     homepage = "https://github.com/nk9/okapi";
+    changelog = "https://github.com/nk9/okapi/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     mainProgram = "okapi";
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ toelke ];
+    maintainers = with lib.maintainers; [
+      toelke
+      nadir-ishiguro
+    ];
   };
 })
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index a610262ce240..1a90cdcd1b46 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -7,6 +7,7 @@
   stdenv,
   addDriverRunpath,
   nix-update-script,
+  coreutils,
 
   cmake,
   gitMinimal,
@@ -94,7 +95,7 @@ let
 
   cudaToolkit = buildEnv {
     # ollama hardcodes the major version in the Makefile to support different variants.
-    # - https://github.com/ollama/ollama/blob/v0.20.6/CMakePresets.json#L21-L47
+    # - https://github.com/ollama/ollama/blob/v0.21.0/CMakePresets.json#L21-L47
     name = "cuda-merged-${cudaMajorVersion}";
     paths = map lib.getLib cudaLibs ++ [
       (lib.getOutput "static" cudaPackages.cuda_cudart)
@@ -140,13 +141,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.20.7";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a08TZMzoRg1YzqIU6l1Z8JOBh6VSK5lhfA8ggoMl/ss=";
+    hash = "sha256-DtrYopNtndQXq9Xjriw5Bqell9A8RHPOvgDF8BlKtdU=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
@@ -187,9 +188,17 @@ goBuild (finalAttrs: {
     ++ lib.optionals enableVulkan vulkanLibs;
 
   # replace inaccurate version number with actual release version
+  # and replace core utils tools from their FHS location to nix store
   postPatch = ''
     substituteInPlace version/version.go \
       --replace-fail 0.0.0 '${finalAttrs.version}'
+    substituteInPlace cmd/launch/openclaw_test.go \
+      --replace-fail '/bin/mkdir' '${coreutils}/bin/mkdir' \
+      --replace-fail '/bin/cat' '${coreutils}/bin/cat'
+    substituteInPlace cmd/launch/hermes_test.go \
+      --replace-fail '/bin/mkdir' '${coreutils}/bin/mkdir' \
+      --replace-fail '/bin/cat' '${coreutils}/bin/cat' \
+      --replace-fail '/bin/chmod' '${coreutils}/bin/chmod'
     rm -r app
   ''
   # disable tests that fail in sandbox due to Metal init failure
@@ -232,7 +241,7 @@ goBuild (finalAttrs: {
     '';
 
   # ollama looks for acceleration libs in ../lib/ollama/ (now also for CPU-only with arch specific optimizations)
-  # https://github.com/ollama/ollama/blob/v0.20.5/docs/development.md#library-detection
+  # https://github.com/ollama/ollama/blob/v0.21.0/docs/development.md#library-detection
   postInstall = ''
     mkdir -p $out/lib
     cp -r build/lib/ollama $out/lib/
@@ -263,8 +272,6 @@ goBuild (finalAttrs: {
       skippedTests = [
         "TestPushHandler/unauthorized_push" # Writes to $HOME, see https://github.com/ollama/ollama/pull/12307#pullrequestreview-3249128660
         "TestPiRun_InstallAndWebSearchLifecycle" # Requires network access to install npm packages
-        "TestOpenclawRun_ChannelSetupHappensBeforeGatewayRestart" # /bin/mkdir and /bin/cat are unavailable on NixOS
-        "TestOpenclawChannelSetupPreflight" # /bin/mkdir and /bin/cat are unavailable on NixOS
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/op/opencryptoki/package.nix b/pkgs/by-name/op/opencryptoki/package.nix
index fec8f764047c..6d4ca5a70087 100644
--- a/pkgs/by-name/op/opencryptoki/package.nix
+++ b/pkgs/by-name/op/opencryptoki/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencryptoki";
-  version = "3.25.0";
+  version = "3.26.0-unstable-2026-04-09";
 
   src = fetchFromGitHub {
     owner = "opencryptoki";
     repo = "opencryptoki";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-JIDy5LY2rJqMM1uWDWn6Q62kJ+7pYU4G7zptkbyvf9Q=";
+    rev = "ed378f463ef73364c89feb0fc923f4dc867332a3";
+    hash = "sha256-1DxlsjPoK3kIQkfguhOlzP2d7dneYRz/Qwp4cH30AhU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opentxl/factorial-test.nix b/pkgs/by-name/op/opentxl-unwrapped/factorial-test.nix
similarity index 100%
rename from pkgs/by-name/op/opentxl/factorial-test.nix
rename to pkgs/by-name/op/opentxl-unwrapped/factorial-test.nix
diff --git a/pkgs/by-name/op/opentxl/factorial.txl b/pkgs/by-name/op/opentxl-unwrapped/factorial.txl
similarity index 100%
rename from pkgs/by-name/op/opentxl/factorial.txl
rename to pkgs/by-name/op/opentxl-unwrapped/factorial.txl
diff --git a/pkgs/by-name/op/opentxl-unwrapped/fix-cross.patch b/pkgs/by-name/op/opentxl-unwrapped/fix-cross.patch
new file mode 100644
index 000000000000..3cc318cf134d
--- /dev/null
+++ b/pkgs/by-name/op/opentxl-unwrapped/fix-cross.patch
@@ -0,0 +1,166 @@
+diff --git a/Makefile b/Makefile
+index 1374808..2de353f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -13,9 +13,10 @@
+ # most optimizing C compilers to generate incorrect code for it, or at 
+ # the very least to slow it down severely, at higher levels of optimization.
+ 
+-CC = gcc -w -Wno-error=int-conversion 
+-CFLAGS = -c -O -fno-inline -I .
++CC = gcc
++CFLAGS = -w -Wno-error=int-conversion -c -O -fno-inline -I .
+ LD = gcc
++STRIP = strip
+ LDFLAGS =
+ LDLIBS = -lm
+ RLFLAGS = -r 
+@@ -52,12 +53,14 @@ else ifeq ($(OS), CYGWIN)
+ 
+ else ifeq ($(OS), MSYS)
+     MESSAGE = "Making TXL on Msys / MinGW using gcc and BSD signal handling"
++    CFLAGS := $(CFLAGS) -DWIN
+     LDFLAGS := $(LDFLAGS) -Wl,--stack,0x2000000
+     EXE = .exe
+     SIGTYPE = BSD
+ 
+ else ifeq ($(OS), MINGW64)
+     MESSAGE = "Making TXL on Msys / MinGW using gcc and BSD signal handling"
++    CFLAGS := $(CFLAGS) -DWIN
+     LDFLAGS := $(LDFLAGS) -Wl,--stack,0x2000000
+     EXE = .exe
+     SIGTYPE = BSD
+@@ -89,18 +92,18 @@ alltxls : thetxl thetxldb thetxlpf thetxlvm thetxlcvt thetxlapr
+ thetxl : bin objs objs/main.o objs/txl.o objs/xform.o objs/parse.o objs/loadstor.o ${OBJS} ${TLOBJS} 
+ 	${CC} ${LDFLAGS} -o bin/txl objs/main.o objs/txl.o objs/xform.o objs/parse.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip bin/txl${EXE}
++	$(STRIP) bin/txl${EXE}
+ 	cp scripts/unix/* bin/
+ 
+ thetxldb : bin objs objs/main.o objs/txl.o objs/xformdb.o objs/parse.o objs/loadstor.o ${OBJS} ${TLOBJS} 
+ 	${CC} ${LDFLAGS} -o bin/txldb objs/main.o objs/txl.o objs/xformdb.o objs/parse.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip bin/txldb${EXE}
++	$(STRIP) bin/txldb${EXE}
+ 
+ thetxlpf : lib objs objs/main.o objs/txl.o objs/xformpf.o objs/parsepf.o objs/loadstor.o ${OBJS} ${TLOBJS}
+ 	${CC} ${LDFLAGS} -o lib/txlpf.x objs/main.o objs/txl.o objs/xformpf.o objs/parsepf.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip lib/txlpf.x
++	$(STRIP) lib/txlpf.x
+ 
+ thetxlvm : lib objs objs/main.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/parsa.o ${COMMONOBJS} ${TLOBJS} 
+ 	${LD} ${RLFLAGS} -o lib/txlvm.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/parsa.o \
+@@ -109,11 +112,11 @@ thetxlvm : lib objs objs/main.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/par
+ 
+ thetxlcvt : lib objs objs/main.o objs/txlcvt.o
+ 	${CC} ${LDFLAGS} -o lib/txlcvt.x objs/main.o objs/txlcvt.o ${TLOBJS} ${LDLIBS}
+-	strip lib/txlcvt.x
++	$(STRIP) lib/txlcvt.x
+ 
+ thetxlapr : lib objs objs/main.o objs/txlapr.o
+ 	${CC} ${LDFLAGS} -o lib/txlapr.x objs/main.o objs/txlapr.o ${TLOBJS} ${LDLIBS}
+-	strip lib/txlapr.x
++	$(STRIP) lib/txlapr.x
+ 
+ objs/main.o : tpluslib/TL.h UNIX main.c 
+ 	${CC} $(CFLAGS) -D${SIGTYPE} main.c; mv main.o objs/main.o
+@@ -216,4 +219,3 @@ clean :
+ 	rm -f bin/txl* objs/*.o 
+ 	rm -rf opentxl opentxl-* opentxl*.tar.gz 
+ 	cd test; make clean; cd ..
+-
+diff --git a/scripts/unix/txl2c b/scripts/unix/txl2c
+index 7429daf..ebf56c5 100755
+--- a/scripts/unix/txl2c
++++ b/scripts/unix/txl2c
+@@ -19,15 +19,7 @@ then
+     exit 99
+ fi
+ 
+-# Localization
+-CC="gcc"
+-
+-case `uname -s` in
+-    CYGWIN*|MSYS*|MINGW64*)
+-        CC="$CC -Wl,--stack,0x20000000";;
+-    *)
+-	;;
+-esac
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
+ 
+ # Decode TXL program name and options
+ TXLPROG=""
+@@ -90,7 +82,7 @@ then
+ fi
+ 
+ # Convert TXLVM byte code to initialized C byte array
+-$TXLLIB/txlcvt.x $TXLNAME.ctxl
++$BUILD_TXLLIB/txlcvt.x $TXLNAME.ctxl
+ 
+ # Clean up
+ /bin/rm -f $TXLNAME.ctxl Txl/$TXLNAME.ctxl txl/$TXLNAME.ctxl 2> /dev/null
+diff --git a/scripts/unix/txlc b/scripts/unix/txlc
+index 4f49f49..201037e 100755
+--- a/scripts/unix/txlc
++++ b/scripts/unix/txlc
+@@ -20,9 +20,12 @@ then
+ fi
+ 
+ # Localization
+-CC="gcc"
++CC="${CC:-cc}"
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
++TARGET_TXLLIB="${TARGET_TXLLIB:-$TXLLIB}"
++OS="${OS:-$(uname -s)}"
+ 
+-case `uname -s` in
++case "$OS" in
+     CYGWIN*|MSYS*|MINGW64*)
+         CC="$CC -Wl,--stack,0x20000000";;
+     *)
+@@ -90,10 +93,10 @@ then
+ fi
+ 
+ # Convert TXLVM byte code to initialized C byte array
+-$TXLLIB/txlcvt.x $TXLNAME.ctxl
++$BUILD_TXLLIB/txlcvt.x $TXLNAME.ctxl
+ 
+ # Compile and link with TXLVM
+-$CC -O -w -o $TXLNAME.x $TXLLIB/txlmain.o $TXLLIB/txlvm.o  ${TXLNAME}_TXL.c -lm
++$CC -O -w -o $TXLNAME.x $TARGET_TXLLIB/txlmain.o $TARGET_TXLLIB/txlvm.o  ${TXLNAME}_TXL.c -lm
+ 
+ # Clean up
+ /bin/rm -f $TXLNAME.ctxl Txl/$TXLNAME.ctxl txl/$TXLNAME.ctxl ${TXLNAME}_TXL.* 2> /dev/null
+diff --git a/scripts/unix/txlp b/scripts/unix/txlp
+index e39af87..cbb53ac 100755
+--- a/scripts/unix/txlp
++++ b/scripts/unix/txlp
+@@ -19,6 +19,8 @@ then
+     exit 99
+ fi
+ 
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
++
+ # Decode TXL program name and options
+ TXLFILES=""
+ TXLOPTIONS=""
+@@ -43,7 +45,7 @@ done
+ # Run the TXL command, using txlpf
+ if [ "$1" != "" ]
+ then
+-if  ! $TXLLIB/txlpf.x $* > /dev/null 2> /tmp/txlp$$ 
++if  ! $BUILD_TXLLIB/txlpf.x $* > /dev/null 2> /tmp/txlp$$
+ then
+ 	echo "txlp:  TXL program failed" 2>&1
+ 	cat /tmp/txlp$$ 2>&1
+@@ -54,7 +56,7 @@ then
+ fi
+ 
+ # Analyze the results
+-$TXLLIB/txlapr.x $PROFOPTIONS
++$BUILD_TXLLIB/txlapr.x $PROFOPTIONS
+ 
+ # Clean up
+ /bin/rm -f /tmp/txlp$$
diff --git a/pkgs/by-name/op/opentxl-unwrapped/package.nix b/pkgs/by-name/op/opentxl-unwrapped/package.nix
new file mode 100644
index 000000000000..7524f904c7ca
--- /dev/null
+++ b/pkgs/by-name/op/opentxl-unwrapped/package.nix
@@ -0,0 +1,90 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  fetchurl,
+  nix-update-script,
+  runtimeShellPackage,
+}:
+let
+  osOption =
+    platform:
+    if platform.isDarwin then
+      "Darwin"
+    else if platform.isCygwin then
+      "CYGWIN"
+    else if platform.isWindows then
+      "MSYS"
+    else
+      "Linux";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "opentxl";
+  version = "11.3.7";
+  strictDeps = true;
+
+  # The code generation part of the upstream build system relies on an x86-only binary,
+  # so the generated code is fetched from the GitHub release instead
+  src = fetchurl {
+    url = "https://github.com/CordyJ/OpenTxl/releases/download/v${finalAttrs.version}/OpenTxl-${finalAttrs.version}-csrc.tar.gz";
+    hash = "sha256-qIvxQqo1yCVJImjUvNNinzhoywVgaq9s0E+Ab+QStc0=";
+  };
+
+  # Required for patchShebangs to find the right shell for runtime scripts.
+  # Optional check is to make sure that it is not added on platforms
+  # that can't run a POSIX shell (e.g. MinGW)
+  buildInputs = lib.optional (lib.meta.availableOn stdenv.hostPlatform runtimeShellPackage) runtimeShellPackage;
+
+  # Using -std=gnu89 to prevent errors that occur with default args
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-int-conversion";
+
+  patches = [
+    ./fix-cross.patch
+  ];
+
+  postPatch = ''
+    # Replace hardcoded FHS paths in various files
+    find . -type f -exec sed -i \
+      -e 's#/bin/mv#mv#g' \
+      -e 's#/bin/rm#rm#g' \
+      -e "s#/usr/local/bin#$out/bin#g" \
+      -e "s#/usr/local/lib/txl#$out/lib#g" \
+      {} +
+  '';
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
+    "EXE=${stdenv.hostPlatform.extensions.executable}"
+    "OS=${osOption stdenv.hostPlatform}"
+  ];
+
+  checkFlags = [ "-C test" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib}
+    cp bin/* $out/bin/
+    cp lib/* $out/lib/
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit osOption;
+    tests.factorial = callPackage ./factorial-test.nix { opentxl = finalAttrs.finalPackage; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Open-source compiler for the Txl language";
+    mainProgram = "txl";
+    homepage = "https://github.com/CordyJ/OpenTxl";
+    downloadPage = "https://github.com/CordyJ/OpenTxl/releases";
+    changelog = "https://github.com/CordyJ/OpenTxl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ MysteryBlokHed ];
+  };
+})
diff --git a/pkgs/by-name/op/opentxl/package.nix b/pkgs/by-name/op/opentxl/package.nix
index ae5d1c644e84..ab1b5896ba1c 100644
--- a/pkgs/by-name/op/opentxl/package.nix
+++ b/pkgs/by-name/op/opentxl/package.nix
@@ -1,68 +1,69 @@
 {
   lib,
   stdenv,
-  callPackage,
-  fetchurl,
-  nix-update-script,
+  makeWrapper,
+  opentxl-unwrapped,
+  targetPackages,
 }:
+let
+  inherit (targetPackages.stdenv.cc) targetPrefix;
+
+  crossCompiling = stdenv.hostPlatform != stdenv.targetPlatform;
+  targetOpentxl = if !crossCompiling then opentxl-unwrapped else targetPackages.opentxl-unwrapped;
+in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "opentxl";
-  version = "11.3.7";
+  pname = "${targetPrefix}opentxl-wrapper";
+  inherit (opentxl-unwrapped) version;
+  preferLocalBuild = true;
+  strictDeps = true;
 
-  # The code generation part of the upstream build system relies on an x86-only binary,
-  # so the generated code is fetched from the GitHub release instead
-  src = fetchurl {
-    url = "https://github.com/CordyJ/OpenTxl/releases/download/v${finalAttrs.version}/OpenTxl-${finalAttrs.version}-csrc.tar.gz";
-    hash = "sha256-qIvxQqo1yCVJImjUvNNinzhoywVgaq9s0E+Ab+QStc0=";
-  };
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
 
-  # Using -std=gnu89 to prevent errors that occur with default args
-  env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-int-conversion";
-
-  postPatch = ''
-    # Replace hardcoded FHS paths in various files
-    find . -type f -exec sed -i \
-      -e 's#/bin/mv#mv#g' \
-      -e 's#/bin/rm#rm#g' \
-      -e "s#/usr/local/bin#$out/bin#g" \
-      -e "s#/usr/local/lib/txl#$out/lib#g" \
-      {} +
-
-    # Replace hardcoded gcc references
-    substituteInPlace scripts/unix/{txlc,txl2c} \
-      --replace-fail gcc '${stdenv.cc}/bin/cc'
-  '';
-
-  preBuild = ''
-    makeFlagsArray+=(
-      CC="$CC"
-      LD="$CC"
-    )
-  '';
-
-  checkFlags = [ "-C test" ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/{bin,lib}
-    cp bin/* $out/bin/
-    cp lib/* $out/lib/
+    mkdir -p $out/bin
+
+    # Wrap compiler
+    makeWrapper ${opentxl-unwrapped}/bin/txlc \
+      $out/bin/${targetPrefix}txlc \
+      --set TXLLIB ${opentxl-unwrapped}/lib \
+      --set BUILD_TXLLIB ${opentxl-unwrapped}/lib \
+      --set TARGET_TXLLIB ${targetOpentxl}/lib \
+      --set CC ${targetPackages.stdenv.cc}/bin/${targetPrefix}cc \
+      --set OS ${opentxl-unwrapped.osOption stdenv.targetPlatform}
+    ${
+      # For convenience, if there is a target prefix, create a symlink named txlc
+      lib.optionalString (targetPrefix != "") ''
+        ln -s $out/bin/${targetPrefix}txlc $out/bin/txlc
+      ''
+    }
+
+    # Wrap other scripts
+    for name in txl2c txlp; do
+      makeWrapper "${opentxl-unwrapped}/bin/$name" \
+        "$out/bin/$name" \
+        --set-default TXLLIB ${opentxl-unwrapped}/lib
+    done
+
+    # Link to binaries that don't need wrapping
+    for name in txl txldb; do
+      ln -s "${opentxl-unwrapped}/bin/$name" "$out/bin/$name"
+    done
 
     runHook postInstall
   '';
 
-  passthru.tests.factorial = callPackage ./factorial-test.nix { opentxl = finalAttrs.finalPackage; };
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    unwrapped = opentxl-unwrapped;
+    inherit (opentxl-unwrapped.passthru) tests;
+  };
 
-  meta = {
-    description = "Open-source compiler for the Txl language";
-    mainProgram = "txl";
+  meta = opentxl-unwrapped.meta // {
     platforms = lib.platforms.unix;
-    homepage = "https://github.com/CordyJ/OpenTxl";
-    downloadPage = "https://github.com/CordyJ/OpenTxl/releases";
-    changelog = "https://github.com/CordyJ/OpenTxl/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ MysteryBlokHed ];
   };
 })
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 4d736bcf4541..e78d6658a9fd 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.26.2";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Addc59NlrD4GMEuir2BKoURDjMcqZYtAq4UPRCxNmCE=";
+    hash = "sha256-jJGL9oSThbFeO0c89LMFWVEzyrGeIWZDUKYVqOy2hMk=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
diff --git a/pkgs/by-name/rg/rgx/package.nix b/pkgs/by-name/rg/rgx/package.nix
index 367e9118bc04..2a4fbab3b418 100644
--- a/pkgs/by-name/rg/rgx/package.nix
+++ b/pkgs/by-name/rg/rgx/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rgx";
-  version = "0.10.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "brevity1swos";
     repo = "rgx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lZA8Tfyneg8cnBeCf0abgPr9232a1OGBfOJEBnU2l+s=";
+    hash = "sha256-JLFJGMwKQqkrVwck6gd79AzSVL0fRHJ8jo73+EEdYlA=";
   };
 
-  cargoHash = "sha256-DOIQaqoUkR1KpQURC89PRds0wJkroSYufbKz62rjSB4=";
+  cargoHash = "sha256-D609cDiJ+L/iGtC9dKwU5dgz4+X3//6qiFjWixBBqhg=";
 
   buildInputs = [ pcre2 ];
 
diff --git a/pkgs/by-name/ru/ruqola/package.nix b/pkgs/by-name/ru/ruqola/package.nix
index 01df74ca627e..542108baacc5 100644
--- a/pkgs/by-name/ru/ruqola/package.nix
+++ b/pkgs/by-name/ru/ruqola/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ruqola";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "ruqola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z/JyIXZKXdOc92Ebq1Jcnhx/6EL7rkcdnxN2BsQn5Cw=";
+    hash = "sha256-ndb20iKNaWwK5yR3mlDoBYEPj2QLHOlQVBejGKs/FMw=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qtbase
     qt6.qtmultimedia
     qt6.qtnetworkauth
+    qt6.qtspeech
     qt6.qtwebsockets
   ];
 
diff --git a/pkgs/by-name/sa/sampo/package.nix b/pkgs/by-name/sa/sampo/package.nix
index aaa697d14708..37e2834096c2 100644
--- a/pkgs/by-name/sa/sampo/package.nix
+++ b/pkgs/by-name/sa/sampo/package.nix
@@ -9,20 +9,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sampo";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchFromGitHub {
     owner = "bruits";
     repo = "sampo";
     tag = "sampo-v${finalAttrs.version}";
-    hash = "sha256-g/cl24IUTQ2Tqxfzfsx3yxCgsbiFOUWKy1JisUhQ3wg=";
+    hash = "sha256-P+CekuDM3u+iG2HmCNWxZoTCaKtAUMnrNre4zeGNPrQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-wd76EJeKrUH/h6Net3vwROw83sXjAPXX0N1ckYDMulc=";
+  cargoHash = "sha256-udMpH0LWNqPTORSb1/c686stgvti5shx/O9rcH7YZNs=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/se/seanime/package.nix b/pkgs/by-name/se/seanime/package.nix
index 0a20a6f5ba44..7f64469fe647 100644
--- a/pkgs/by-name/se/seanime/package.nix
+++ b/pkgs/by-name/se/seanime/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seanime";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "5rahim";
     repo = "seanime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ejXWQPUROIzu6RlUJIaKaiJfPb59kupQDhqWU83EqP4=";
+    hash = "sha256-R6WKRuU2kBvw9XD3iAZky1YNKWDv+W7YZAwpprYeWkw=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "seanime-web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/seanime-web";
-      hash = "sha256-fWlK2h0RQF9GnEogXW3bwM01RCCDVij/9S2sn2BA3S4=";
+      hash = "sha256-4ItF0+Bmc+75oeNHjQP4RsbcRWgeG9Wq/27wDiQ4KVM=";
     };
   };
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     rm -rf .github
   '';
 
-  vendorHash = "sha256-TN9shH4B7XVDIa541+7MHTNQs1IKPRJW1dn8tmES5jg=";
+  vendorHash = "sha256-9RCVIL+h5L20156BuD8GGbC98QUchB8JCWId8b/Sfy8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/se/semtools/package.nix b/pkgs/by-name/se/semtools/package.nix
index 01d6722dd0da..76b28a1696a0 100644
--- a/pkgs/by-name/se/semtools/package.nix
+++ b/pkgs/by-name/se/semtools/package.nix
@@ -1,32 +1,37 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
   openssl,
   pkg-config,
+  protobuf,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "semtools";
-  version = "1.2.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "semtools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wpOKEESM3uG9m/EqWnF2uXITbrwIhwe2MSA0FN7Fu+w=";
+    hash = "sha256-8vQJd1/EnskcMNN2cfXOQxHeLPh61dypL51KwCLps8Q=";
   };
 
-  cargoHash = "sha256-irLhwlNnB3G63WUGV2wo+LQGQgNHYzu/vb/RM/G6Fdc=";
+  cargoHash = "sha256-spllUpCze3ajNZtWVRr9GZLDj7HMi6UIraeEp9XgfK0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
 
-  checkFlags = lib.optionals (stdenv.hostPlatform.system == "x86_64-darwin") [
-    # https://github.com/run-llama/semtools/issues/17
-    "--skip=tests::test_search_result_context_calculation"
+  checkFlags = [
+    # Require network
+    "--skip=search::tests"
+    "--skip=workspace::tests::test_workspace_save_and_open"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index feb88419c6e3..8ed473dbd84b 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zVBsnVqm38mEROtRChiNh9bJ/e8BP09CSxVS1wHVYZQ=";
+    hash = "sha256-dfM8mlZrfq8tqxwVL+TLGT26wLOzVJmw561eicFx2VY=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-nbHBBRSoFOm8/NJ+8ZsOJbHcTZ+Le0RCAbF1AKaPIbs=";
+    vendorHash = "sha256-TixhAJwIHQwCrA2kdpAN2vK6UeSzLMGfX85j2KtlPfQ=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-TrdP871uy1Ie4MQiqC1/RaseU42FosOO7m4k+UVXGHc=";
+    hash = "sha256-jvTDT0Uze+E3hQ9wU3RqKQ7RI9+OLQlewGd+kSHuZ34=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 046c55b5c71c..4f593faa9c08 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "2.0.58";
+  version = "2.0.60";
 
   src = fetchFromGitHub {
     owner = "kvndrsslr";
     repo = "sketchybar-app-font";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q140vSaHkyddxUQut/r8LGuBvTel6kpcpZwqWRP0h8s=";
+    hash = "sha256-6fi3v+h3i5J1j4xDP1QUlGfrY8o9kiXtMCWmYZ9zgng=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/sl/slint-viewer/package.nix b/pkgs/by-name/sl/slint-viewer/package.nix
index 40fb1c66c1ff..88bab1a42643 100644
--- a/pkgs/by-name/sl/slint-viewer/package.nix
+++ b/pkgs/by-name/sl/slint-viewer/package.nix
@@ -2,29 +2,37 @@
   lib,
   rustPlatform,
   fetchCrate,
-  qt6,
+
+  fontconfig,
   libGL,
+  pkg-config,
+  qt6,
+
   nix-update-script,
   versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-viewer";
-  version = "1.14.1";
+  version = "1.16.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-7NxpnkMAQTBDfcDhdnneFNjB0oE82dDdpfq4vmMqECg=";
+    hash = "sha256-POkfEU4m54dEgaSSEHLqKozMXqMxqkUoLCevm6SY2IU=";
   };
 
-  cargoHash = "sha256-RNK3dzXdWRpugC7FwenUF/IsKbD3GxFRLqyLzBf2Wuw=";
+  cargoHash = "sha256-zjiII898Zpzdr19UHua3yuhRRHCn5yg/PHYpYODh7Pc=";
 
   buildInputs = [
     qt6.qtbase
     qt6.qtsvg
+    fontconfig
     libGL
   ];
 
-  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
 
   # There are no tests
   doCheck = false;
diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index ab4800a389fd..27270b54c86b 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -8,61 +8,40 @@
 
 {
   lib,
-  clangStdenv,
+  stdenv,
   fetchFromGitHub,
   rustPlatform,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
   fontconfig,
   harfbuzzFull,
   openssl,
-  pkg-config,
   icu,
-  fetchpatch2,
+
+  # passthru.tests
+  tectonic,
 }:
 
-let
-
-  buildRustPackage = rustPlatform.buildRustPackage.override {
-    # use clang to work around build failure with GCC 14
-    # see: https://github.com/tectonic-typesetting/tectonic/issues/1263
-    stdenv = clangStdenv;
-  };
-
-in
-
-buildRustPackage (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tectonic";
-  version = "0.15.0";
+  version = "0.16.9";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${finalAttrs.version}";
-    sha256 = "sha256-dZnUu0g86WJIIvwMgdmwb6oYqItxoYrGQTFNX7I61Bs=";
+    sha256 = "sha256-5yphhmrrfgFwQ952eWpToyGfIJVJfV6y5w0BgznSOe0=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      # https://github.com/tectonic-typesetting/tectonic/pull/1155
-      name = "1155-fix-endless-reruns-when-generating-bbl";
-      url = "https://github.com/tectonic-typesetting/tectonic/commit/fbb145cd079497b8c88197276f92cb89685b4d54.patch";
-      hash = "sha256-6FW5MFkOWnqzYX8Eg5DfmLaEhVWKYVZwodE4SGXHKV0=";
-    })
-    ./tectonic-0.15-fix-dangerous_implicit_autorefs.patch
+  cargoHash = "sha256-22Hy51zCzY2DRytcYHgwkI9+e/g52o1jy4eosvEm3KY=";
+
+  nativeBuildInputs = [
+    pkg-config
   ];
 
-  cargoPatches = [
-    (fetchpatch2 {
-      # cherry-picked from https://github.com/tectonic-typesetting/tectonic/pull/1202
-      name = "1202-fix-build-with-rust-1_80-and-icu-75";
-      url = "https://github.com/tectonic-typesetting/tectonic/compare/19654bf152d602995da970f6164713953cffc2e6...6b49ca8db40aaca29cb375ce75add3e575558375.patch?full_index=1";
-      hash = "sha256-CgQBCFvfYKKXELnR9fMDqmdq97n514CzGJ7EBGpghJc=";
-    })
-  ];
-
-  cargoHash = "sha256-OMa89riyopKMQf9E9Fr7Qs4hFfEfjnDFzaSWFtkYUXE=";
-
-  nativeBuildInputs = [ pkg-config ];
-
   buildFeatures = [ "external-harfbuzz" ];
 
   buildInputs = [
@@ -72,19 +51,68 @@ buildRustPackage (finalAttrs: {
     openssl
   ];
 
+  # By default, tectonic looks up the latest bundle by opening this URL:
+  #
+  #   https://relay.fullyjustified.net/default_bundle_v${FORMAT_VERSION}.tar
+  #
+  # Where FORMAT_VERSION is defined here:
+  #
+  #   https://github.com/tectonic-typesetting/tectonic/blob/master/crates/engine_xetex/xetex/xetex_bindings.h
+  #
+  # When we updated the package, this URL redirects to the following:
+  #
+  #   https://data1.fullyjustified.net/tlextras-2022.0r0.tar
+  #
+  # The environment variable set below, sets the URL that will be used during
+  # runtime by default. We chose to hard-code a URL to a specific version of
+  # the web bundle, so that upstream won't update the `default_bundle` without
+  # us noticing, and break compatibility with our biber-for-tectonic package.
+  #
+  # This is in principle the right thing to do, ever since the 0.16.0 release.
+  # As opposed to what we had with version 0.15.0, we choose to not hard-code a
+  # --web-bundle (or --bundle) argument in the wrapper of the
+  # `tectonic-wrapped` package, as it is not compatible with nextonic, and
+  # `tectonic -X` commands of versions 0.16.0+ -- These commands require the
+  # `--bundle` argument to appear after the subcommand.
+  #
+  # Lastly, we might in the future need to update the bundle URL below if
+  # upstream will upload a new bundle. However, upstream hasn't updated a new
+  # bundle for a long time, see:
+  #
+  #   https://github.com/tectonic-typesetting/tectonic/issues/1269
+  #
+  env.TECTONIC_BUNDLE_LOCKED = "https://data1.fullyjustified.net/tlextras-2022.0r0.tar";
+
   postInstall = ''
     # Makes it possible to automatically use the V2 CLI API
     ln -s $out/bin/tectonic $out/bin/nextonic
   ''
-  + lib.optionalString clangStdenv.hostPlatform.isLinux ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace dist/appimage/tectonic.desktop \
-      --replace Exec=tectonic Exec=$out/bin/tectonic
-    install -D dist/appimage/tectonic.desktop -t $out/share/applications/
-    install -D dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
+      --replace-fail Exec=tectonic Exec=$out/bin/tectonic
+    install -Dm644 dist/appimage/tectonic.desktop -t $out/share/applications/
+    install -Dm644 dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
   '';
 
+  checkFlags = [
+    # Test fails due to tectonic bundle missing and can't be downloaded in the
+    # sandbox
+    "--skip=tests::no_segfault_after_failed_compilation"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Test Panics only on Darwin, see:
+    # https://github.com/tectonic-typesetting/tectonic/issues/1352
+    "--skip=v2_watch_succeeds"
+  ];
   doCheck = true;
 
+  passthru = {
+    inherit (tectonic.passthru) tests;
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
   meta = {
     description = "Modernized, complete, self-contained TeX/LaTeX engine, powered by XeTeX and TeXLive";
     homepage = "https://tectonic-typesetting.github.io/";
diff --git a/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch b/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch
deleted file mode 100644
index 883c38486a71..000000000000
--- a/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/crates/engine_bibtex/src/xbuf.rs b/crates/engine_bibtex/src/xbuf.rs
-index 8f3949e7..c216eb4d 100644
---- a/crates/engine_bibtex/src/xbuf.rs
-+++ b/crates/engine_bibtex/src/xbuf.rs
-@@ -52,7 +52,7 @@ pub unsafe fn xrealloc_zeroed<T: SafelyZero>(
-     old: *mut [T],
-     new_len: usize,
- ) -> Option<&'static mut [T]> {
--    let old_len = (*old).len();
-+    let old_len = (&(*old)).len();
-     let new_size = new_len * mem::size_of::<T>();
-     // SAFETY: realloc can be called with any size, even 0, that will just deallocate and return null
-     let ptr = unsafe { xrealloc(old.cast(), new_size) }.cast::<T>();
diff --git a/pkgs/by-name/te/tectonic/package.nix b/pkgs/by-name/te/tectonic/package.nix
index 0f36036bfcfb..947bed1eeacf 100644
--- a/pkgs/by-name/te/tectonic/package.nix
+++ b/pkgs/by-name/te/tectonic/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   symlinkJoin,
-  tectonic,
   tectonic-unwrapped,
   biber-for-tectonic,
   makeBinaryWrapper,
@@ -19,13 +18,6 @@ symlinkJoin {
     unwrapped = tectonic-unwrapped;
     biber = biber-for-tectonic;
     tests = callPackage ./tests.nix { };
-
-    # The version locked tectonic web bundle, redirected from:
-    #   https://relay.fullyjustified.net/default_bundle_v33.tar
-    # To check for updates, see:
-    #   https://github.com/tectonic-typesetting/tectonic/blob/master/crates/bundles/src/lib.rs
-    # ... and look up `get_fallback_bundle_url`.
-    bundleUrl = "https://data1.fullyjustified.net/tlextras-2022.0r0.tar";
   };
 
   # Replace the unwrapped tectonic with the one wrapping it with biber
@@ -48,7 +40,6 @@ symlinkJoin {
   + ''
     makeWrapper ${lib.getBin tectonic-unwrapped}/bin/tectonic $out/bin/tectonic \
       --prefix PATH : "${lib.getBin biber-for-tectonic}/bin" \
-      --add-flags "--web-bundle ${tectonic.passthru.bundleUrl}" \
       --inherit-argv0 ## make sure binary name e.g. `nextonic` is passed along
     ln -s $out/bin/tectonic $out/bin/nextonic
   '';
diff --git a/pkgs/by-name/te/tectonic/tests.nix b/pkgs/by-name/te/tectonic/tests.nix
index 04c91a1235c3..cb95d18de6ff 100644
--- a/pkgs/by-name/te/tectonic/tests.nix
+++ b/pkgs/by-name/te/tectonic/tests.nix
@@ -94,7 +94,7 @@ lib.mapAttrs networkRequiringTestPkg {
 
   workspace = ''
     tectonic -X new
-    cat Tectonic.toml | grep "${tectonic.bundleUrl}"
+    cat Tectonic.toml | grep "${tectonic.unwrapped.TECTONIC_BUNDLE_LOCKED}"
   '';
 
   /**
diff --git a/pkgs/by-name/te/texpresso/package.nix b/pkgs/by-name/te/texpresso/package.nix
index ddda76c43b6d..894dc5ea9b51 100644
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -1,83 +1,84 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   makeWrapper,
-  writeScript,
+  pkg-config,
+  writeShellScriptBin,
+
+  # buildInputs
+  fontconfig,
+  freetype,
+  harfbuzz,
+  icu,
+  jbig2dec,
+  libjpeg,
   mupdf,
   SDL2,
-  re2c,
-  freetype,
-  jbig2dec,
-  harfbuzz,
-  openjpeg,
-  gumbo,
-  libjpeg,
-  callPackage,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texpresso";
-  version = "0.1";
+  version = "0.1-unstable-2026-04-02";
 
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-d+wNQIysn3hdTQnHN9MJbFOIhJQ0ml6PoeuwsryntTI=";
+    rev = "96f008c94ece067fac8e896d0ab1808c948a4dd3";
+    hash = "sha256-ew7n3Sp4uYLv5jijRW2rRM9s63TQCeFgKXmmBXdYjx4=";
   };
 
   postPatch = ''
     substituteInPlace Makefile \
       --replace-fail "CC=gcc" "CC=${stdenv.cc.targetPrefix}cc" \
       --replace-fail "LDCC=g++" "LDCC=${stdenv.cc.targetPrefix}c++"
+    substituteInPlace src/engine/Makefile \
+      --replace-fail "_CC?=gcc" "_CC?=${stdenv.cc.targetPrefix}cc" \
+      --replace-fail "_LD?=g++" "_LD?=${stdenv.cc.targetPrefix}c++" \
+      --replace-fail "_CXX?=g++" "_CXX?=${stdenv.cc.targetPrefix}c++"
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     makeWrapper
-    mupdf
-    SDL2
-    re2c
-    freetype
-    jbig2dec
-    harfbuzz
-    openjpeg
-    gumbo
-    libjpeg
+    pkg-config
+    # Especially for Darwin builds, we pretend we are Linux to avoid upstream's
+    # makefiles from using brew.
+    (writeShellScriptBin "uname" "echo Linux")
   ];
 
-  buildFlags = [ "texpresso" ];
+  buildInputs = [
+    fontconfig
+    freetype
+    harfbuzz
+    icu
+    jbig2dec
+    libjpeg
+    mupdf
+    SDL2
+  ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.hostPlatform.isDarwin [
+  buildFlags = [
+    "texpresso"
+    "texpresso-xetex"
+  ];
+
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=implicit-function-declaration"
-    ]
-  );
+    ];
+  };
 
   installPhase = ''
     runHook preInstall
-    install -Dm0755 -t "$out/bin/" "build/texpresso"
+    install -D -t "$out/bin/" "build/texpresso"
+    install -D -t "$out/bin/" "build/texpresso-xetex"
     runHook postInstall
   '';
 
-  # needs to have texpresso-tonic on its path
-  postInstall = ''
-    wrapProgram $out/bin/texpresso \
-      --prefix PATH : ${lib.makeBinPath [ finalAttrs.finalPackage.passthru.tectonic ]}
-  '';
-
-  passthru = {
-    tectonic = callPackage ./tectonic.nix { };
-    updateScript = writeScript "update-texpresso" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl jq nix-update
-
-      tectonic_version="$(curl -s "https://api.github.com/repos/let-def/texpresso/contents/tectonic" | jq -r '.sha')"
-      nix-update texpresso
-      nix-update --version=branch=$tectonic_version texpresso.tectonic
-    '';
-  };
-
   meta = {
     inherit (finalAttrs.src.meta) homepage;
     description = "Live rendering and error reporting for LaTeX";
diff --git a/pkgs/by-name/te/texpresso/tectonic.nix b/pkgs/by-name/te/texpresso/tectonic.nix
deleted file mode 100644
index fe04d15191d7..000000000000
--- a/pkgs/by-name/te/texpresso/tectonic.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  tectonic-unwrapped,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-tectonic-unwrapped.overrideAttrs (
-  finalAttrs: prevAttrs: {
-    pname = "texpresso-tonic";
-    version = "0.15.0-unstable-2024-04-19";
-    src = fetchFromGitHub {
-      owner = "let-def";
-      repo = "tectonic";
-      rev = "b38cb3b2529bba947d520ac29fbb7873409bd270";
-      hash = "sha256-ap7fEPHsASAphIQkjcvk1CC7egTdxaUh7IpSS5os4W8=";
-      fetchSubmodules = true;
-    };
-
-    cargoHash = "sha256-mqhbIv5r/5EDRDfP2BymXv9se2NCKxzRGqNqwqbD9A0=";
-    # rebuild cargoDeps by hand because `.overrideAttrs cargoHash`
-    # does not reconstruct cargoDeps (a known limitation):
-    cargoDeps = rustPlatform.fetchCargoVendor {
-      inherit (finalAttrs) src;
-      name = "${finalAttrs.pname}-${finalAttrs.version}";
-      hash = finalAttrs.cargoHash;
-      patches = finalAttrs.cargoPatches;
-    };
-    # binary has a different name, bundled tests won't work
-    doCheck = false;
-    postInstall = ''
-      ${prevAttrs.postInstall or ""}
-
-      # Remove the broken `nextonic` symlink
-      # It points to `tectonic`, which doesn't exist because the exe is
-      # renamed to texpresso-tonic
-      rm $out/bin/nextonic
-    '';
-    meta = prevAttrs.meta // {
-      mainProgram = "texpresso-tonic";
-    };
-  }
-)
diff --git a/pkgs/by-name/ty/typora/package.nix b/pkgs/by-name/ty/typora/package.nix
index ac2fb3873462..b86c2fc588ea 100644
--- a/pkgs/by-name/ty/typora/package.nix
+++ b/pkgs/by-name/ty/typora/package.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "typora";
-  version = "1.13.2";
+  version = "1.13.4";
 
   passthru = {
     sources = {
@@ -29,21 +29,21 @@ let
           "https://download.typora.io/linux/typora_${version}_amd64.deb"
           "https://downloads.typoraio.cn/linux/typora_${version}_amd64.deb"
         ];
-        hash = "sha256-oMb57//kg8TldZpWD0kaNYhveDe9MXHu9IMeuIvGcq4=";
+        hash = "sha256-aEgp0j6HGZePKwc21LvMpmXk7S5cgcUttpxl3fQw9ak=";
       };
       aarch64-linux = fetchurl {
         urls = [
           "https://download.typora.io/linux/typora_${version}_arm64.deb"
           "https://downloads.typoraio.cn/linux/typora_${version}_arm64.deb"
         ];
-        hash = "sha256-fa/jvmhQ/tx3JWCDwNxRW+WTXnLYD+WrJoGJmes0JKs=";
+        hash = "sha256-hvEsnkjbEhZVOIGKGh9RloUBicKpSMzzBGMFtc+3EAk=";
       };
       aarch64-darwin = fetchurl {
         urls = [
           "https://download.typora.io/mac/Typora-${version}.dmg"
           "https://downloads.typoraio.cn/mac/Typora-${version}.dmg"
         ];
-        hash = "sha256-3wPZAuU2EE62M0F3TQw6aX5cHdeUmJuASWnlbMVmgss=";
+        hash = "sha256-3IyOFTLDkd43Tij1B1Tw0epZ8HwMiNMJHQJAGHCcP84=";
       };
     };
     updateScript = ./update.sh;
diff --git a/pkgs/by-name/us/ustreamer/package.nix b/pkgs/by-name/us/ustreamer/package.nix
index cad1b45a1505..50c350b1ff47 100644
--- a/pkgs/by-name/us/ustreamer/package.nix
+++ b/pkgs/by-name/us/ustreamer/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ustreamer";
-  version = "6.40";
+  version = "6.55";
 
   src = fetchFromGitHub {
     owner = "pikvm";
     repo = "ustreamer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jKltFQsx8Q9+TMTOg1p6nljII72CLEg6VYe60/KojUY=";
+    hash = "sha256-xL35xlgKEpgiD3m6xoEs+CBmEx0Fpwo43EbzqCqDgvc=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index cda2eadfd9db..b8da03e924a4 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.11.5";
+  version = "5.11.6";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Al1rl6Ez36I3qE++1ZOvTgey9lfHp0SVzK6KJQSPBYc=";
+    hash = "sha256-iTBh6cH7is7UnbbXhn+z/Tnvq5//Jdt1OlPHNfICVUw=";
   };
 
-  vendorHash = "sha256-JctG+gkZtjlSX616Rv3rC7RU9YBNWp9LsD5Ut8qn1tY=";
+  vendorHash = "sha256-L98EShwiysMYXhI6aQut5bfMr76CwY1U06iOgG+jtCY=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 7f15172322a6..eeeaf2c02ea2 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -31,11 +31,13 @@
 
 let
   python = python3.override {
+    self = python;
     packageOverrides = _final: prev: {
-      django = prev.django_5;
+      django = prev.django_6;
+      pygobject = prev.pygobject3;
     };
   };
-  python3Packages = python3.pkgs;
+  python3Packages = python.pkgs;
 
   GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
     pango
@@ -48,7 +50,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "weblate";
-  version = "5.16.2";
+  version = "5.17";
   pyproject = true;
 
   outputs = [
@@ -60,7 +62,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "WeblateOrg";
     repo = "weblate";
     tag = "weblate-${finalAttrs.version}";
-    hash = "sha256-er3KtCAFtHh3UtM58Kni/PTBfXpWW/GOarRGJeAanL8=";
+    hash = "sha256-+czdS1cICvm8esXxJG9BjzPTJExajxvDoRVH7f+t6lY=";
   };
 
   postPatch = ''
@@ -92,15 +94,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     '';
 
   pythonRelaxDeps = [
+    "requests"
+    "pygobject"
     "certifi"
-    "crispy-bootstrap5"
-    "dateparser"
   ];
 
   dependencies =
     with python3Packages;
     [
-      aeidon
       ahocorasick-rs
       altcha
       (toPythonModule (borgbackup.override { python3 = python; }))
@@ -108,7 +109,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
       certifi
       charset-normalizer
       confusable-homoglyphs
-      crispy-bootstrap3
       crispy-bootstrap5
       cryptography
       cssselect
@@ -134,23 +134,20 @@ python3Packages.buildPythonApplication (finalAttrs: {
       drf-standardized-errors
       fedora-messaging
       filelock
-      fluent-syntax
       gitpython
       hiredis
       html2text
-      iniparse
       jsonschema
       lxml
       mistletoe
       nh3
       openpyxl
       packaging
-      phply
       pillow
       pyaskalono
       pycairo
       pygments
-      pygobject3
+      pygobject
       pyicumessageformat
       pyparsing
       python-dateutil
@@ -178,7 +175,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ++ celery.optional-dependencies.redis
     ++ drf-spectacular.optional-dependencies.sidecar
     ++ drf-standardized-errors.optional-dependencies.openapi
+    ++ translate-toolkit.optional-dependencies.chardet
+    ++ translate-toolkit.optional-dependencies.fluent
+    ++ translate-toolkit.optional-dependencies.ini
+    ++ translate-toolkit.optional-dependencies.markdown
     ++ translate-toolkit.optional-dependencies.toml
+    ++ translate-toolkit.optional-dependencies.php
+    ++ translate-toolkit.optional-dependencies.rc
+    ++ translate-toolkit.optional-dependencies.subtitles
+    ++ translate-toolkit.optional-dependencies.yaml
     ++ urllib3.optional-dependencies.brotli
     ++ urllib3.optional-dependencies.zstd;
 
@@ -197,12 +202,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ];
     ldap = [ django-auth-ldap ];
     # mercurial = [ mercurial ];
-    mysql = [ mysqlclient ];
     openai = [ openai ];
     postgres = [ psycopg ];
     saml = [ python3-saml ];
-    # saml2idp = [ djangosaml2idp ];
-    # wlhosted = [ wlhosted ];
+    # saml2idp = [ djangosaml2idp2 ];
+    sphinx = [ sphinx ];
+    # wllegal = [ wllegal ];
     wsgi = [ granian ];
     # zxcvbn = [ django-zxcvbn-password-validator ];
   };
@@ -243,7 +248,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       openssh
     ]
     ++ social-auth-core.optional-dependencies.saml
-    ++ (lib.concatLists (builtins.attrValues finalAttrs.passthru.optional-dependencies));
+    ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   env = {
     CI_DATABASE = "postgresql";
@@ -277,6 +282,38 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_ocr_backend"
   ];
 
+  disabledTestPaths = [
+    # Probably network access?
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_component_scopes"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_connection_error"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_invalid_response"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_project_scopes"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_site_wide_scope"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_translation_added"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_announcement"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_bulk_changes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_announcement"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_bulk_changes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_category_in_payload"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_component_scopes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_connection_error"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_invalid_response"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_project_scopes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_site_wide_scope"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_translation_added"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_webhook_signature"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_webhook_signature_prefix"
+
+    # Tries to resolve DNS
+    "weblate/api/tests.py::ProjectAPITest::test_install_machinery"
+
+    # djangosaml2idp2 is not packaged yet
+    "weblate/utils/tests/test_djangosaml2idp.py"
+
+    # Don't understand why
+    "weblate/trans/tests/test_alert.py::WebsiteAlertSettingTest::test_website_alerts_enabled"
+  ];
+
   passthru = {
     inherit python;
     # We need to expose this so weblate can work outside of calling its bin output
diff --git a/pkgs/by-name/x2/x2x/package.nix b/pkgs/by-name/x2/x2x/package.nix
index 51466f358818..6c276de0158c 100644
--- a/pkgs/by-name/x2/x2x/package.nix
+++ b/pkgs/by-name/x2/x2x/package.nix
@@ -12,19 +12,20 @@
 
 stdenv.mkDerivation {
   pname = "x2x";
-  version = "unstable-2023-04-30";
+  version = "1.30-unstable-2025-02-17";
 
   src = fetchFromGitHub {
     owner = "dottedmag";
     repo = "x2x";
-    rev = "53692798fa0e991e0dd67cdf8e8126158d543d08";
-    hash = "sha256-FUl2z/Yz9uZlUu79LHdsXZ6hAwSlqwFV35N+GYDNvlQ=";
+    rev = "08842516fa443a2cf799c6372f83466062f612c9";
+    hash = "sha256-0ZVpG4ZrygrFZ0mVmNLWWdyqM43LtQPGwvZZPC92zuY=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     libx11
     libxtst
diff --git a/pkgs/applications/graphics/zgv/add-include.patch b/pkgs/by-name/zg/zgv/add-include.patch
similarity index 100%
rename from pkgs/applications/graphics/zgv/add-include.patch
rename to pkgs/by-name/zg/zgv/add-include.patch
diff --git a/pkgs/applications/graphics/zgv/default.nix b/pkgs/by-name/zg/zgv/package.nix
similarity index 79%
rename from pkgs/applications/graphics/zgv/default.nix
rename to pkgs/by-name/zg/zgv/package.nix
index f0d662e0d4a7..bc55d389deb1 100644
--- a/pkgs/applications/graphics/zgv/default.nix
+++ b/pkgs/by-name/zg/zgv/package.nix
@@ -4,13 +4,20 @@
   fetchurl,
   fetchpatch,
   pkg-config,
-  SDL,
+  SDL_sixel,
   SDL_image,
   libjpeg,
   libpng,
   libtiff,
 }:
 
+let
+  # Enable terminal display. Note that it requires sixel graphics compatible
+  # terminals like mlterm or xterm -ti 340
+  SDL_image_sixel = SDL_image.override {
+    SDL = SDL_sixel;
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zgv";
   version = "5.9";
@@ -21,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    SDL
-    SDL_image
+    SDL_sixel
+    SDL_image_sixel
     libjpeg
     libpng
     libtiff
@@ -30,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
+  # gcc15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   makeFlags = [
     "BACKEND=SDL"
   ];
diff --git a/pkgs/applications/graphics/zgv/switch.patch b/pkgs/by-name/zg/zgv/switch.patch
similarity index 100%
rename from pkgs/applications/graphics/zgv/switch.patch
rename to pkgs/by-name/zg/zgv/switch.patch
diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
index 84fd098ff3fa..d8b636feac5d 100644
--- a/pkgs/development/compilers/llvm/common/common-let.nix
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -12,19 +12,19 @@ rec {
   llvm_meta = {
     license =
       with lib.licenses;
-      [ ncsa ]
-      ++
-        # Contributions after June 1st, 2024 are only licensed under asl20 and
-        # llvm-exception: https://github.com/llvm/llvm-project/pull/92394
-        lib.optionals (lib.versionAtLeast release_version "19") [
-          asl20
-          llvm-exception
-        ];
+      # Contributions after June 1st, 2024 are only licensed under asl20 and
+      # llvm-exception: https://github.com/llvm/llvm-project/pull/92394
+      if lib.versionAtLeast release_version "19" then
+        AND [
+          ncsa
+          (WITH asl20 llvm-exception)
+        ]
+      else
+        ncsa;
     teams = [
       lib.teams.llvm
       lib.teams.security-review
     ];
-
     # See llvm/cmake/config-ix.cmake.
     platforms =
       lib.platforms.aarch64
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index 9809da4aa0fb..ae7ca1448294 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -46,11 +46,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-6TUOMiJCg+lTEfIhNPNsmOPNHGZdF/riCmzJLtPP/hE=";
+    hash = "sha256-jBgyoT3azwcWhQafX639Hyh3op4aYoZSiSxlIRsfMyc=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/actron-neo-api/default.nix b/pkgs/development/python-modules/actron-neo-api/default.nix
index 2fced01e209c..7c82d159a8fd 100644
--- a/pkgs/development/python-modules/actron-neo-api/default.nix
+++ b/pkgs/development/python-modules/actron-neo-api/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "actron-neo-api";
-  version = "0.5.1";
+  version = "0.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kclif9";
     repo = "actronneoapi";
     tag = "v${version}";
-    hash = "sha256-TEKRQQbmcDjHuZOte4fqZqLkw4Eo8FUgoyui3Mg8CqA=";
+    hash = "sha256-XyX9o1fIyY5TZqLzK1a+KLkLDVEorw2illg+lHutLtc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/aioamazondevices/default.nix b/pkgs/development/python-modules/aioamazondevices/default.nix
index 6ad913beca89..5072a31cd6cb 100644
--- a/pkgs/development/python-modules/aioamazondevices/default.nix
+++ b/pkgs/development/python-modules/aioamazondevices/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aioamazondevices";
-  version = "13.4.2";
+  version = "13.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aioamazondevices";
     tag = "v${version}";
-    hash = "sha256-df5f6meoMvrvS1d0U9M1XRXYC6t4e0AEmxfHOGD58CM=";
+    hash = "sha256-AH5edWwVEMo/TpnVbcOEC/oYI4DOQ5nqFfoFKeoI3Ok=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/altcha/default.nix b/pkgs/development/python-modules/altcha/default.nix
index e8f05bd7c524..bb8b45651ccb 100644
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "altcha";
-  version = "1.0.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "altcha-org";
     repo = "altcha-lib-py";
-    tag = "v${version}";
-    hash = "sha256-N30luHhGFkd+XvVKhVnR6degEf0Nm/K/GEaqoEEuZMU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-k5vy6lalC3idiquXbDCwF+mObzja/QC3PRBGQJMZ6fA=";
   };
 
   build-system = [ setuptools ];
@@ -30,4 +30,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ erictapen ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index bb9aae785f0e..c6f6f4e7ff0e 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -194,6 +194,9 @@ buildPythonPackage (finalAttrs: {
     "test_regression_worker_startup_info"
     "test_check_privileges"
 
+    # FileNotFoundError: [Errno 2] No such file or directory: 'test.db'
+    "test_forget"
+
     # Flaky: Unclosed temporary file handle under heavy load (as in nixpkgs-review)
     "test_check_privileges_without_c_force_root_and_no_group_entry"
   ]
diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 64a110368d99..789f2f0dc140 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -27,11 +27,6 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-eUcve2KPcLjKKWU7AxQEZ0mokP185E43Xjm4b+4hQzA=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "==" ">="
-  '';
-
   build-system = [ setuptools ];
 
   buildInputs = [ django ];
@@ -49,6 +44,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeCheckInputs = [
+    pytest-django
     djangorestframework-simplejwt
     pytestCheckHook
     pytest-django
diff --git a/pkgs/development/python-modules/django-celery-beat/default.nix b/pkgs/development/python-modules/django-celery-beat/default.nix
index 4109ba3d3c8a..e274817a24bb 100644
--- a/pkgs/development/python-modules/django-celery-beat/default.nix
+++ b/pkgs/development/python-modules/django-celery-beat/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -20,18 +21,54 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "django-celery-beat";
-  version = "2.8.1";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "celery";
     repo = "django-celery-beat";
-    tag = "v${version}";
-    hash = "sha256-pakOpch5r2ug0UDSqEU34qr4Tz1/mkuFiHW+IOUuGcc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UGKMSXB+Hg865sAk5ePc/noO3eNTr7b3pp7tvNvn1T8=";
   };
 
+  # https://github.com/celery/django-celery-beat/pull/1009
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/dc11bdfa06858409da01f2d407bb68486870a559.patch";
+      hash = "sha256-aK8u2CfmNYFwE9CQvKjnwywVcw8MQfXvev7JYU9kz4E=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/ddcbe8bf2c970a82e87f50c0e9c232b0ae951a85.patch";
+      hash = "sha256-uw3l6CA0lnbF1HnNeSgZ91l1ujkB4V3831Yj+L4i+L0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/088355dc6531bfffc19272c9de55f4d18606634e.patch";
+      hash = "sha256-6pamaLcHbNUGJMw6nCWeY/C1O58choDbJ1j/4SqDPx4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/273e2f23edee26404a1691320a69dee280f9639b.patch";
+      hash = "sha256-8wZrDi9GDIF+w5ZZDssJGLG3UyE45xqld95nnG3SV0A=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/69f4a231f30df9ff028f8fc0f67cb115e5d53246.patch";
+      hash = "sha256-74p2XxB9ssWpVokY8XVUjkyyE4+/2lijDYZcZSu9ms0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/4b8246a44a69e79d7648a9f4658abd8b7937b2b8.patch";
+      hash = "sha256-c1ZJHgnxvOoEWAc9oRkcCLRG7sLLsSER/Dq0H8TIOYU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/17dd67625f99a0e6dbe7fb779f61f336e7af1730.patch";
+      hash = "sha256-w+MynocR80jUARgvuk5cUIdzmdAYGglvrNXph/8XdBE=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/03018882f088be83e1c78b4ca657b960b3080081.patch";
+      hash = "sha256-YE121p2aGqoj9mRFSQu+oi+8xaz0QE+CsJHdBB7xwUM=";
+    })
+  ];
+
   pythonRelaxDeps = [ "django" ];
 
   build-system = [ setuptools ];
@@ -56,18 +93,13 @@ buildPythonPackage rec {
     "t/unit/test_schedulers.py"
   ];
 
-  disabledTests = [
-    # AssertionError: 'At 02:00, only on Monday UTC' != 'At 02:00 AM, only on Monday UTC'
-    "test_long_name"
-  ];
-
   pythonImportsCheck = [ "django_celery_beat" ];
 
   meta = {
     description = "Celery Periodic Tasks backed by the Django ORM";
     homepage = "https://github.com/celery/django-celery-beat";
-    changelog = "https://github.com/celery/django-celery-beat/releases/tag/${src.tag}";
+    changelog = "https://github.com/celery/django-celery-beat/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ onny ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index 0a0b6c217452..172b5e128c0f 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lupa";
-  version = "2.7";
+  version = "2.8";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-c6ZM5dyM2Vt1ozDBUT5G4JjUD87tP+pRbAn2WV6t6Ik=";
+    hash = "sha256-2AImQbnsjs8sXsvp9H5acOC4fEta6SG5LLAqY44KzQg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
index 706868312c06..e9325dc9fa87 100644
--- a/pkgs/development/python-modules/nox/default.nix
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
 
   # build-system
   hatchling,
@@ -27,18 +26,16 @@
   virtualenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nox";
-  version = "2026.02.09";
+  version = "2026.04.10";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "wntrblm";
     repo = "nox";
-    tag = version;
-    hash = "sha256-RaB0q9gCoYqKAI8IzNh5qUd0SrzsPeOa3C6IGxpcbwE=";
+    tag = finalAttrs.version;
+    hash = "sha256-ArSA9I86hTKM+fkTdzOeheYVxpdjweMs2I0mUwR14sQ=";
   };
 
   build-system = [ hatchling ];
@@ -65,7 +62,7 @@ buildPythonPackage rec {
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   pythonImportsCheck = [ "nox" ];
 
@@ -86,11 +83,11 @@ buildPythonPackage rec {
   meta = {
     description = "Flexible test automation for Python";
     homepage = "https://nox.thea.codes/";
-    changelog = "https://github.com/wntrblm/nox/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/wntrblm/nox/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       doronbehar
       fab
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index c9d83bceb510..e9f0eff94a96 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plopp";
-  version = "26.3.1";
+  version = "26.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "plopp";
     tag = finalAttrs.version;
-    hash = "sha256-A8F2Gd0HmHRlusScFoFulsFaqaXA/HxmtT8ODdRLA+U=";
+    hash = "sha256-qjuhM0/qrGIZw00DOnaGODGHqzGn4r3gIAguJS5OPZ8=";
   };
 
   build-system = [
@@ -75,7 +75,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.14") [
-    # RuntimeError: There is no current event loop in thread 'MainThread'
+    # https://github.com/scipp/plopp/issues/508
     "test_move_cut"
     "test_value_cuts"
   ];
diff --git a/pkgs/development/python-modules/pydo/default.nix b/pkgs/development/python-modules/pydo/default.nix
index 24e51eb5e74d..41f5447d3a56 100644
--- a/pkgs/development/python-modules/pydo/default.nix
+++ b/pkgs/development/python-modules/pydo/default.nix
@@ -2,27 +2,33 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   azure-core,
   azure-identity,
   isodate,
   msrest,
+
+  # tests
   aioresponses,
   pytest-asyncio,
   pytestCheckHook,
   responses,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pydo";
-  version = "0.27.0";
+  version = "0.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "pydo";
-    tag = "v${version}";
-    hash = "sha256-2vJ/yOOJuil1oFWIYU2yV29RG/j92kpz0ubmJpyzS4U=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tLw34aQ9gmKSQ/cy3Rz3eKqaw/Kv4lgS1saMYMCHPxo=";
   };
 
   build-system = [ poetry-core ];
@@ -52,9 +58,9 @@ buildPythonPackage rec {
   meta = {
     description = "Official DigitalOcean Client based on the DO OpenAPIv3 specification";
     homepage = "https://github.com/digitalocean/pydo";
-    changelog = "https://github.com/digitalocean/pydo/releases/tag/v${version}";
+    changelog = "https://github.com/digitalocean/pydo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ethancedwards8 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index a297b802a9a1..526311fedecd 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tlds";
-  version = "2026021400";
+  version = "2026041800";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
     tag = finalAttrs.version;
-    hash = "sha256-IyIZCBlH918let5qa/fi/SYampE3E+yAVMG17nHF7mk=";
+    hash = "sha256-HMfAMYVNz/3lwCv5XTn7jSgFQgGX2uymTGxw8JcHeUU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/translate-toolkit/default.nix b/pkgs/development/python-modules/translate-toolkit/default.nix
index f88bfc6a603c..28e64d4cb293 100644
--- a/pkgs/development/python-modules/translate-toolkit/default.nix
+++ b/pkgs/development/python-modules/translate-toolkit/default.nix
@@ -9,25 +9,26 @@
   # dependencies
   lxml,
   unicode-segmentation-rs,
-  urllib3,
 
   # optional-dependencies
-  tomlkit,
-
-  # tests
-  aeidon,
   charset-normalizer,
-  cheroot,
   fluent-syntax,
-  gettext,
+  vobject,
   iniparse,
+  rapidfuzz,
   mistletoe,
   phply,
   pyparsing,
-  pytestCheckHook,
+  pyenchant,
+  aeidon,
+  tomlkit,
   ruamel-yaml,
-  syrupy,
-  vobject,
+
+  # tests
+  pytestCheckHook,
+  addBinToPathHook,
+  pytest-xdist,
+  gettext,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -47,36 +48,40 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     lxml
     unicode-segmentation-rs
-    urllib3
   ];
 
   optional-dependencies = {
+    chardet = [ charset-normalizer ];
+    fluent = [ fluent-syntax ];
+    ical = [ vobject ];
+    ini = [ iniparse ];
+    levenshtein = [ rapidfuzz ];
+    markdown = [ mistletoe ];
+    php = [ phply ];
+    rc = [ pyparsing ];
+    spellcheck = [ pyenchant ];
+    subtitles = [ aeidon ];
     toml = [ tomlkit ];
+    yaml = [ ruamel-yaml ];
   };
 
   nativeCheckInputs = [
-    aeidon
-    charset-normalizer
-    cheroot
-    fluent-syntax
-    gettext
-    iniparse
-    mistletoe
-    phply
-    pyparsing
     pytestCheckHook
-    ruamel-yaml
-    syrupy
-    tomlkit
-    vobject
-  ];
+    addBinToPathHook
+    pytest-xdist
+    gettext
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   disabledTests = [
     # Probably breaks because of nix sandbox
     "test_timezones"
+  ];
 
-    # Requires network
-    "test_xliff_conformance"
+  disabledTestPaths = [
+    # Require pytest-snapshot but there are no snapshots checked in
+    "tests/translate/tools/test_pocount.py"
+    "tests/translate/tools/test_junitmsgfmt.py"
   ];
 
   pythonImportsCheck = [ "translate" ];
diff --git a/pkgs/development/python-modules/utitools/default.nix b/pkgs/development/python-modules/utitools/default.nix
index 0a1b48894f28..f003e336e480 100644
--- a/pkgs/development/python-modules/utitools/default.nix
+++ b/pkgs/development/python-modules/utitools/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "utitools";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RhetTbull";
     repo = "utitools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oI+a+sc9+qi7aFP0dLINAQekib/9pZm10A5jhVIHWvo=";
+    hash = "sha256-mx9vcMCeDTJyWJKm0Ci9IEAPCNfx9NvPGC8cuNYnH1M=";
   };
 
   build-system = [ flit-core ];
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Utilities for working with Uniform Type Identifiers";
     homepage = "https://github.com/RhetTbull/utitools";
-    changelog = "https://github.com/RhetTbull/osxphotos/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/RhetTbull/utitools/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index e509560fddee..3cf941cdca06 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -1130,10 +1130,7 @@ in
   };
 
   trilogy = attrs: {
-    postInstall = ''
-      installPath=$(cat "$out/nix-support/gem-meta/install-path")
-      ln -s contrib/ruby/trilogy.gemspec "$installPath/trilogy.gemspec"
-    '';
+    buildInputs = [ openssl ];
   };
 
   typhoeus = attrs: {
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index fbf72005f92d..6c3a49c4957c 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -90,6 +90,8 @@ let
       && (
         if isList attrs.meta.license then
           any (l: elem l list) attrs.meta.license
+        else if attrs.meta.license ? "type" then
+          lib.licenses.containsLicenses list attrs.meta.license
         else
           elem attrs.meta.license list
       );
@@ -103,7 +105,9 @@ let
 
   isUnfree =
     licenses:
-    if isAttrs licenses then
+    if isAttrs licenses && licenses ? "type" then
+      !(lib.licenses.isFree licenses)
+    else if isAttrs licenses then
       !(licenses.free or true)
     # TODO: Returning false in the case of a string is a bug that should be fixed.
     # In a previous implementation of this function the function body
diff --git a/pkgs/tools/misc/coreboot-utils/default.nix b/pkgs/tools/misc/coreboot-utils/default.nix
index e1fa3c2b1b1d..0c0969c71f1e 100644
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@@ -110,6 +110,10 @@ let
       pname = "nvramtool";
       meta.description = "Read and write coreboot parameters and display information from the coreboot table in CMOS/NVRAM";
       meta.mainProgram = "nvramtool";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
     };
     superiotool = generic {
       pname = "superiotool";
diff --git a/pkgs/tools/networking/privoxy/default.nix b/pkgs/tools/networking/privoxy/default.nix
index 646eef378047..a0e3a713c9ac 100644
--- a/pkgs/tools/networking/privoxy/default.nix
+++ b/pkgs/tools/networking/privoxy/default.nix
@@ -6,7 +6,7 @@
   fetchurl,
   autoreconfHook,
   zlib,
-  pcre,
+  pcre2,
   w3m,
   man,
   openssl,
@@ -16,11 +16,11 @@
 stdenv.mkDerivation rec {
 
   pname = "privoxy";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/ijbswa/Sources/${version}%20%28stable%29/${pname}-${version}-stable-src.tar.gz";
-    sha256 = "sha256-wI4roASTBwF7+dimPdKg37lqoM3rNK4Ad3bmPrpiom8=";
+    sha256 = "sha256-I+RoblhIx0y2gMCcKBHwNXc57P5kH5xAcu5COZCSyXs=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     zlib
-    pcre
+    pcre2
     openssl
     brotli
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5ab7ce704d11..9c0554e852e4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10884,14 +10884,6 @@ with pkgs;
 
   zed-editor-fhs = zed-editor.fhs;
 
-  zgv = callPackage ../applications/graphics/zgv {
-    # Enable the below line for terminal display. Note
-    # that it requires sixel graphics compatible terminals like mlterm
-    # or xterm -ti 340
-    SDL = SDL_sixel;
-    SDL_image = SDL_image.override { SDL = SDL_sixel; };
-  };
-
   zynaddsubfx-fltk = zynaddsubfx.override {
     guiModule = "fltk";
   };