diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index fa09b61ddec0..c99fd3ddf162 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -106,6 +106,11 @@ let
           description = "Path of the device or swap file.";
         };
 
+        isDevice = mkOption {
+          default = lib.substring 0 5 config.device == "/dev/";
+          internal = true;
+        };
+
         label = mkOption {
           example = "swap";
           type = types.str;
@@ -329,6 +334,7 @@ in
                   )
                 } ${sw.device} ${sw.deviceName}
                 mkswap ${sw.realDevice}
+                ${lib.optionalString sw.isDevice "udevadm trigger ${sw.realDevice}"}
               ''}
             '';
             enableStrictShellChecks = true;
diff --git a/nixos/modules/services/editors/emacs.nix b/nixos/modules/services/editors/emacs.nix
index 2cf753484a80..c47577a6ce09 100644
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -80,6 +80,9 @@ in
       unitConfig = lib.optionalAttrs cfg.startWithGraphical {
         After = "graphical-session.target";
       };
+
+      # Long-lived session that ought to only be restarted manually
+      restartIfChanged = false;
     }
     // lib.optionalAttrs cfg.enable {
       wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index e6f62c4c729f..52a3214577e4 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontUnpack = true;
 
-  inherit libPath;
+  inherit libPath stageModules;
 
   autoPatchelfIgnoreMissingDeps = [
     "libssl.so.1.1"
@@ -260,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName} \
         ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
-        --run "${stageModules} $out/opt/${binaryName}/modules" \
+        --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
 
     ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
diff --git a/pkgs/by-name/ad/adw-bluetooth/package.nix b/pkgs/by-name/ad/adw-bluetooth/package.nix
index f0b700ee9c9b..2052e675c892 100644
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
     tag = version;
-    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
+    hash = "sha256-0rySzx03KeKeqtl0yrbnj/tVbpVPBAKDz+1qLQ5kZRc=";
   };
 
   daemon = buildGoModule {
diff --git a/pkgs/by-name/ap/apache-airflow/providers.nix b/pkgs/by-name/ap/apache-airflow/providers.nix
index db03b3269823..428e1394bb9a 100644
--- a/pkgs/by-name/ap/apache-airflow/providers.nix
+++ b/pkgs/by-name/ap/apache-airflow/providers.nix
@@ -6,16 +6,25 @@
       "airflow.providers.airbyte"
       "airflow.providers.airbyte.get_provider_info"
     ];
-    version = "5.3.3";
+    version = "5.5.1";
+  };
+
+  akeyless = {
+    deps = [ ];
+    imports = [
+      "airflow.providers.akeyless"
+      "airflow.providers.akeyless.get_provider_info"
+    ];
+    version = "0.2.0";
   };
 
   alibaba = {
-    deps = [ "oss2" ];
+    deps = [ "alibabacloud-tea-openapi" ];
     imports = [
       "airflow.providers.alibaba"
       "airflow.providers.alibaba.get_provider_info"
     ];
-    version = "3.3.5";
+    version = "3.3.9";
   };
 
   amazon = {
@@ -41,7 +50,7 @@
       "airflow.providers.amazon"
       "airflow.providers.amazon.get_provider_info"
     ];
-    version = "9.23.0";
+    version = "9.31.0";
   };
 
   apache_beam = {
@@ -63,7 +72,7 @@
       "airflow.providers.apache.cassandra"
       "airflow.providers.apache.cassandra.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   apache_drill = {
@@ -72,7 +81,7 @@
       "airflow.providers.apache.drill"
       "airflow.providers.apache.drill.get_provider_info"
     ];
-    version = "3.3.0";
+    version = "3.3.3";
   };
 
   apache_druid = {
@@ -81,7 +90,7 @@
       "airflow.providers.apache.druid"
       "airflow.providers.apache.druid.get_provider_info"
     ];
-    version = "4.5.0";
+    version = "4.5.2";
   };
 
   apache_flink = {
@@ -90,7 +99,7 @@
       "airflow.providers.apache.flink"
       "airflow.providers.apache.flink.get_provider_info"
     ];
-    version = "1.8.3";
+    version = "1.8.5";
   };
 
   apache_hdfs = {
@@ -103,7 +112,7 @@
       "airflow.providers.apache.hdfs"
       "airflow.providers.apache.hdfs.get_provider_info"
     ];
-    version = "4.11.3";
+    version = "4.12.1";
   };
 
   apache_hive = {
@@ -117,16 +126,16 @@
       "airflow.providers.apache.hive"
       "airflow.providers.apache.hive.get_provider_info"
     ];
-    version = "9.4.0";
+    version = "9.5.0";
   };
 
   apache_iceberg = {
-    deps = [ ];
+    deps = [ "pyiceberg" ];
     imports = [
       "airflow.providers.apache.iceberg"
       "airflow.providers.apache.iceberg.get_provider_info"
     ];
-    version = "2.0.0";
+    version = "2.0.3";
   };
 
   apache_impala = {
@@ -138,7 +147,7 @@
       "airflow.providers.apache.impala"
       "airflow.providers.apache.impala.get_provider_info"
     ];
-    version = "1.9.0";
+    version = "1.9.3";
   };
 
   apache_kafka = {
@@ -150,7 +159,7 @@
       "airflow.providers.apache.kafka"
       "airflow.providers.apache.kafka.get_provider_info"
     ];
-    version = "1.13.0";
+    version = "1.14.0";
   };
 
   apache_kylin = {
@@ -159,7 +168,7 @@
       "airflow.providers.apache.kylin"
       "airflow.providers.apache.kylin.get_provider_info"
     ];
-    version = "3.10.2";
+    version = "3.10.5";
   };
 
   apache_livy = {
@@ -168,7 +177,7 @@
       "airflow.providers.apache.livy"
       "airflow.providers.apache.livy.get_provider_info"
     ];
-    version = "4.5.3";
+    version = "4.5.7";
   };
 
   apache_pig = {
@@ -177,7 +186,7 @@
       "airflow.providers.apache.pig"
       "airflow.providers.apache.pig.get_provider_info"
     ];
-    version = "4.8.2";
+    version = "4.8.5";
   };
 
   apache_pinot = {
@@ -186,19 +195,21 @@
       "airflow.providers.apache.pinot"
       "airflow.providers.apache.pinot.get_provider_info"
     ];
-    version = "4.10.0";
+    version = "4.10.3";
   };
 
   apache_spark = {
     deps = [
       "grpcio-status"
       "pyspark"
+      "requests"
+      "tenacity"
     ];
     imports = [
       "airflow.providers.apache.spark"
       "airflow.providers.apache.spark.get_provider_info"
     ];
-    version = "5.6.0";
+    version = "6.2.0";
   };
 
   apache_tinkerpop = {
@@ -207,7 +218,7 @@
       "airflow.providers.apache.tinkerpop"
       "airflow.providers.apache.tinkerpop.get_provider_info"
     ];
-    version = "1.1.1";
+    version = "1.1.4";
   };
 
   apprise = {
@@ -216,7 +227,7 @@
       "airflow.providers.apprise"
       "airflow.providers.apprise.get_provider_info"
     ];
-    version = "2.3.1";
+    version = "2.3.4";
   };
 
   arangodb = {
@@ -225,7 +236,7 @@
       "airflow.providers.arangodb"
       "airflow.providers.arangodb.get_provider_info"
     ];
-    version = "2.9.2";
+    version = "2.9.5";
   };
 
   asana = {
@@ -234,7 +245,7 @@
       "airflow.providers.asana"
       "airflow.providers.asana.get_provider_info"
     ];
-    version = "2.11.1";
+    version = "2.11.4";
   };
 
   atlassian_jira = {
@@ -243,7 +254,7 @@
       "airflow.providers.atlassian.jira"
       "airflow.providers.atlassian.jira.get_provider_info"
     ];
-    version = "3.3.1";
+    version = "3.3.4";
   };
 
   celery = {
@@ -255,7 +266,16 @@
       "airflow.providers.celery"
       "airflow.providers.celery.get_provider_info"
     ];
-    version = "3.17.1";
+    version = "3.20.0";
+  };
+
+  clickhousedb = {
+    deps = [ "clickhouse-connect" ];
+    imports = [
+      "airflow.providers.clickhousedb"
+      "airflow.providers.clickhousedb.get_provider_info"
+    ];
+    version = "1.0.0";
   };
 
   cloudant = {
@@ -264,7 +284,7 @@
       "airflow.providers.cloudant"
       "airflow.providers.cloudant.get_provider_info"
     ];
-    version = "4.3.2";
+    version = "4.3.5";
   };
 
   cncf_kubernetes = {
@@ -280,7 +300,7 @@
       "airflow.providers.cncf.kubernetes"
       "airflow.providers.cncf.kubernetes.get_provider_info"
     ];
-    version = "10.14.0";
+    version = "10.18.1";
   };
 
   cohere = {
@@ -292,19 +312,27 @@
       "airflow.providers.cohere"
       "airflow.providers.cohere.get_provider_info"
     ];
-    version = "1.6.3";
+    version = "1.6.6";
   };
 
   common_ai = {
     deps = [
+      "fastavro"
+      "langchain"
+      "llama-index-core"
+      "llama-index-embeddings-openai"
+      "llama-index-llms-openai"
+      "pyarrow"
       "pydantic-ai-slim"
+      "pypdf"
+      "python-docx"
       "sqlglot"
     ];
     imports = [
       "airflow.providers.common.ai"
       "airflow.providers.common.ai.get_provider_info"
     ];
-    version = "0.0.1";
+    version = "0.5.0";
   };
 
   common_compat = {
@@ -313,7 +341,7 @@
       "airflow.providers.common.compat"
       "airflow.providers.common.compat.get_provider_info"
     ];
-    version = "1.14.1";
+    version = "1.15.0";
   };
 
   common_io = {
@@ -322,7 +350,7 @@
       "airflow.providers.common.io"
       "airflow.providers.common.io.get_provider_info"
     ];
-    version = "1.7.1";
+    version = "1.7.3";
   };
 
   common_messaging = {
@@ -331,7 +359,7 @@
       "airflow.providers.common.messaging"
       "airflow.providers.common.messaging.get_provider_info"
     ];
-    version = "2.0.2";
+    version = "2.0.4";
   };
 
   common_sql = {
@@ -349,7 +377,7 @@
       "airflow.providers.common.sql"
       "airflow.providers.common.sql.get_provider_info"
     ];
-    version = "1.33.0";
+    version = "2.0.1";
   };
 
   databricks = {
@@ -368,7 +396,7 @@
       "airflow.providers.databricks"
       "airflow.providers.databricks.get_provider_info"
     ];
-    version = "7.11.0";
+    version = "7.16.1";
   };
 
   datadog = {
@@ -377,7 +405,7 @@
       "airflow.providers.datadog"
       "airflow.providers.datadog.get_provider_info"
     ];
-    version = "3.10.2";
+    version = "3.10.5";
   };
 
   dbt_cloud = {
@@ -390,7 +418,7 @@
       "airflow.providers.dbt.cloud"
       "airflow.providers.dbt.cloud.get_provider_info"
     ];
-    version = "4.7.0";
+    version = "4.9.2";
   };
 
   dingding = {
@@ -399,7 +427,7 @@
       "airflow.providers.dingding"
       "airflow.providers.dingding.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   discord = {
@@ -408,7 +436,7 @@
       "airflow.providers.discord"
       "airflow.providers.discord.get_provider_info"
     ];
-    version = "3.12.0";
+    version = "3.12.3";
   };
 
   docker = {
@@ -420,7 +448,7 @@
       "airflow.providers.docker"
       "airflow.providers.docker.get_provider_info"
     ];
-    version = "4.5.3";
+    version = "4.5.7";
   };
 
   edge3 = {
@@ -434,16 +462,19 @@
       "airflow.providers.edge3"
       "airflow.providers.edge3.get_provider_info"
     ];
-    version = "3.2.0";
+    version = "4.0.0";
   };
 
   elasticsearch = {
-    deps = [ "elasticsearch" ];
+    deps = [
+      "elasticsearch"
+      "polars"
+    ];
     imports = [
       "airflow.providers.elasticsearch"
       "airflow.providers.elasticsearch.get_provider_info"
     ];
-    version = "6.5.0";
+    version = "6.7.0";
   };
 
   exasol = {
@@ -455,11 +486,12 @@
       "airflow.providers.exasol"
       "airflow.providers.exasol.get_provider_info"
     ];
-    version = "4.10.0";
+    version = "4.10.3";
   };
 
   fab = {
     deps = [
+      "authlib"
       "blinker"
       "cachetools"
       "flask"
@@ -481,7 +513,7 @@
       "airflow.providers.fab"
       "airflow.providers.fab.get_provider_info"
     ];
-    version = "3.5.0";
+    version = "3.7.0";
   };
 
   facebook = {
@@ -490,7 +522,7 @@
       "airflow.providers.facebook"
       "airflow.providers.facebook.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   ftp = {
@@ -499,7 +531,7 @@
       "airflow.providers.ftp"
       "airflow.providers.ftp.get_provider_info"
     ];
-    version = "3.14.1";
+    version = "3.15.1";
   };
 
   git = {
@@ -508,7 +540,7 @@
       "airflow.providers.git"
       "airflow.providers.git.get_provider_info"
     ];
-    version = "0.2.4";
+    version = "0.4.0";
   };
 
   github = {
@@ -517,7 +549,7 @@
       "airflow.providers.github"
       "airflow.providers.github.get_provider_info"
     ];
-    version = "2.11.0";
+    version = "2.11.3";
   };
 
   google = {
@@ -563,6 +595,7 @@
       "plyvel"
       "proto-plus"
       "pyarrow"
+      "pydantic"
       "python-slugify"
       "ray"
       "tenacity"
@@ -572,7 +605,7 @@
       "airflow.providers.google"
       "airflow.providers.google.get_provider_info"
     ];
-    version = "21.0.0";
+    version = "22.2.0";
   };
 
   grpc = {
@@ -585,7 +618,7 @@
       "airflow.providers.grpc"
       "airflow.providers.grpc.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   hashicorp = {
@@ -597,13 +630,14 @@
       "airflow.providers.hashicorp"
       "airflow.providers.hashicorp.get_provider_info"
     ];
-    version = "4.5.0";
+    version = "4.7.1";
   };
 
   http = {
     deps = [
       "aiohttp"
       "asgiref"
+      "pydantic"
       "requests"
       "requests-toolbelt"
     ];
@@ -611,7 +645,16 @@
       "airflow.providers.http"
       "airflow.providers.http.get_provider_info"
     ];
-    version = "6.0.0";
+    version = "6.0.4";
+  };
+
+  ibm_mq = {
+    deps = [ "asgiref" ];
+    imports = [
+      "airflow.providers.ibm.mq"
+      "airflow.providers.ibm.mq.get_provider_info"
+    ];
+    version = "0.1.0";
   };
 
   imap = {
@@ -620,28 +663,29 @@
       "airflow.providers.imap"
       "airflow.providers.imap.get_provider_info"
     ];
-    version = "3.11.0";
+    version = "3.11.3";
   };
 
   influxdb = {
     deps = [
       "influxdb-client"
+      "influxdb3-python"
       "requests"
     ];
     imports = [
       "airflow.providers.influxdb"
       "airflow.providers.influxdb.get_provider_info"
     ];
-    version = "2.10.2";
+    version = "2.11.0";
   };
 
   informatica = {
-    deps = [ ];
+    deps = [ "sqlglot" ];
     imports = [
       "airflow.providers.informatica"
       "airflow.providers.informatica.get_provider_info"
     ];
-    version = "0.1.1";
+    version = "0.2.0";
   };
 
   jdbc = {
@@ -653,7 +697,7 @@
       "airflow.providers.jdbc"
       "airflow.providers.jdbc.get_provider_info"
     ];
-    version = "5.4.1";
+    version = "5.5.0";
   };
 
   jenkins = {
@@ -662,7 +706,7 @@
       "airflow.providers.jenkins"
       "airflow.providers.jenkins.get_provider_info"
     ];
-    version = "4.2.3";
+    version = "4.2.6";
   };
 
   keycloak = {
@@ -671,7 +715,7 @@
       "airflow.providers.keycloak"
       "airflow.providers.keycloak.get_provider_info"
     ];
-    version = "0.6.0";
+    version = "0.8.0";
   };
 
   microsoft_azure = {
@@ -709,7 +753,7 @@
       "airflow.providers.microsoft.azure"
       "airflow.providers.microsoft.azure.get_provider_info"
     ];
-    version = "13.0.1";
+    version = "13.5.0";
   };
 
   microsoft_mssql = {
@@ -721,7 +765,7 @@
       "airflow.providers.microsoft.mssql"
       "airflow.providers.microsoft.mssql.get_provider_info"
     ];
-    version = "4.5.0";
+    version = "4.7.0";
   };
 
   microsoft_psrp = {
@@ -730,7 +774,7 @@
       "airflow.providers.microsoft.psrp"
       "airflow.providers.microsoft.psrp.get_provider_info"
     ];
-    version = "3.2.3";
+    version = "3.2.6";
   };
 
   microsoft_winrm = {
@@ -739,7 +783,7 @@
       "airflow.providers.microsoft.winrm"
       "airflow.providers.microsoft.winrm.get_provider_info"
     ];
-    version = "3.14.0";
+    version = "3.14.3";
   };
 
   mongo = {
@@ -751,12 +795,13 @@
       "airflow.providers.mongo"
       "airflow.providers.mongo.get_provider_info"
     ];
-    version = "5.3.3";
+    version = "5.4.0";
   };
 
   mysql = {
     deps = [
       "aiomysql"
+      "mysql-connector-python"
       "mysqlclient"
       "pymysql"
     ];
@@ -764,7 +809,7 @@
       "airflow.providers.mysql"
       "airflow.providers.mysql.get_provider_info"
     ];
-    version = "6.5.0";
+    version = "6.6.1";
   };
 
   neo4j = {
@@ -773,7 +818,7 @@
       "airflow.providers.neo4j"
       "airflow.providers.neo4j.get_provider_info"
     ];
-    version = "3.11.3";
+    version = "3.11.6";
   };
 
   odbc = {
@@ -782,7 +827,7 @@
       "airflow.providers.odbc"
       "airflow.providers.odbc.get_provider_info"
     ];
-    version = "4.12.0";
+    version = "4.12.3";
   };
 
   openai = {
@@ -791,7 +836,7 @@
       "airflow.providers.openai"
       "airflow.providers.openai.get_provider_info"
     ];
-    version = "1.7.2";
+    version = "1.7.5";
   };
 
   openfaas = {
@@ -800,7 +845,7 @@
       "airflow.providers.openfaas"
       "airflow.providers.openfaas.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   openlineage = {
@@ -812,7 +857,7 @@
       "airflow.providers.openlineage"
       "airflow.providers.openlineage.get_provider_info"
     ];
-    version = "2.12.0";
+    version = "2.18.1";
   };
 
   opensearch = {
@@ -821,7 +866,7 @@
       "airflow.providers.opensearch"
       "airflow.providers.opensearch.get_provider_info"
     ];
-    version = "1.8.4";
+    version = "1.10.0";
   };
 
   opsgenie = {
@@ -830,7 +875,7 @@
       "airflow.providers.opsgenie"
       "airflow.providers.opsgenie.get_provider_info"
     ];
-    version = "5.10.1";
+    version = "5.10.4";
   };
 
   oracle = {
@@ -842,7 +887,7 @@
       "airflow.providers.oracle"
       "airflow.providers.oracle.get_provider_info"
     ];
-    version = "4.5.1";
+    version = "4.6.1";
   };
 
   pagerduty = {
@@ -851,7 +896,7 @@
       "airflow.providers.pagerduty"
       "airflow.providers.pagerduty.get_provider_info"
     ];
-    version = "5.2.3";
+    version = "5.2.6";
   };
 
   papermill = {
@@ -865,7 +910,7 @@
       "airflow.providers.papermill"
       "airflow.providers.papermill.get_provider_info"
     ];
-    version = "3.12.1";
+    version = "3.13.1";
   };
 
   pgvector = {
@@ -874,7 +919,7 @@
       "airflow.providers.pgvector"
       "airflow.providers.pgvector.get_provider_info"
     ];
-    version = "1.7.0";
+    version = "1.7.2";
   };
 
   pinecone = {
@@ -883,7 +928,7 @@
       "airflow.providers.pinecone"
       "airflow.providers.pinecone.get_provider_info"
     ];
-    version = "2.4.2";
+    version = "2.4.5";
   };
 
   postgres = {
@@ -899,7 +944,7 @@
       "airflow.providers.postgres"
       "airflow.providers.postgres.get_provider_info"
     ];
-    version = "6.6.1";
+    version = "6.8.0";
   };
 
   presto = {
@@ -913,7 +958,7 @@
       "airflow.providers.presto"
       "airflow.providers.presto.get_provider_info"
     ];
-    version = "5.11.0";
+    version = "5.12.0";
   };
 
   qdrant = {
@@ -922,7 +967,7 @@
       "airflow.providers.qdrant"
       "airflow.providers.qdrant.get_provider_info"
     ];
-    version = "1.5.3";
+    version = "1.5.6";
   };
 
   redis = {
@@ -931,7 +976,7 @@
       "airflow.providers.redis"
       "airflow.providers.redis.get_provider_info"
     ];
-    version = "4.4.2";
+    version = "4.5.0";
   };
 
   salesforce = {
@@ -943,7 +988,7 @@
       "airflow.providers.salesforce"
       "airflow.providers.salesforce.get_provider_info"
     ];
-    version = "5.12.3";
+    version = "5.14.1";
   };
 
   samba = {
@@ -952,7 +997,7 @@
       "airflow.providers.samba"
       "airflow.providers.samba.get_provider_info"
     ];
-    version = "4.12.3";
+    version = "4.12.6";
   };
 
   segment = {
@@ -961,23 +1006,21 @@
       "airflow.providers.segment"
       "airflow.providers.segment.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.5";
   };
 
   sendgrid = {
-    deps = [
-      "sendgrid"
-      "werkzeug"
-    ];
+    deps = [ "sendgrid" ];
     imports = [
       "airflow.providers.sendgrid"
       "airflow.providers.sendgrid.get_provider_info"
     ];
-    version = "4.2.1";
+    version = "4.2.4";
   };
 
   sftp = {
     deps = [
+      "aiofiles"
       "asyncssh"
       "paramiko"
       "pysftp"
@@ -987,7 +1030,7 @@
       "airflow.providers.sftp"
       "airflow.providers.sftp.get_provider_info"
     ];
-    version = "5.7.1";
+    version = "5.8.2";
   };
 
   singularity = {
@@ -996,11 +1039,12 @@
       "airflow.providers.singularity"
       "airflow.providers.singularity.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.9.4";
   };
 
   slack = {
     deps = [
+      "aiohttp"
       "asgiref"
       "slack-sdk"
     ];
@@ -1008,7 +1052,7 @@
       "airflow.providers.slack"
       "airflow.providers.slack.get_provider_info"
     ];
-    version = "9.8.0";
+    version = "9.10.2";
   };
 
   smtp = {
@@ -1017,7 +1061,7 @@
       "airflow.providers.smtp"
       "airflow.providers.smtp.get_provider_info"
     ];
-    version = "2.4.3";
+    version = "3.0.1";
   };
 
   snowflake = {
@@ -1032,7 +1076,7 @@
       "airflow.providers.snowflake"
       "airflow.providers.snowflake.get_provider_info"
     ];
-    version = "6.11.0";
+    version = "6.14.0";
   };
 
   sqlite = {
@@ -1041,20 +1085,19 @@
       "airflow.providers.sqlite"
       "airflow.providers.sqlite.get_provider_info"
     ];
-    version = "4.3.0";
+    version = "4.3.3";
   };
 
   ssh = {
     deps = [
       "asyncssh"
       "paramiko"
-      "sshtunnel"
     ];
     imports = [
       "airflow.providers.ssh"
       "airflow.providers.ssh.get_provider_info"
     ];
-    version = "4.3.2";
+    version = "5.0.3";
   };
 
   standard = {
@@ -1063,7 +1106,7 @@
       "airflow.providers.standard"
       "airflow.providers.standard.get_provider_info"
     ];
-    version = "1.12.1";
+    version = "1.15.0";
   };
 
   tableau = {
@@ -1072,7 +1115,7 @@
       "airflow.providers.tableau"
       "airflow.providers.tableau.get_provider_info"
     ];
-    version = "5.3.3";
+    version = "5.5.0";
   };
 
   telegram = {
@@ -1081,7 +1124,7 @@
       "airflow.providers.telegram"
       "airflow.providers.telegram.get_provider_info"
     ];
-    version = "4.9.2";
+    version = "4.9.5";
   };
 
   teradata = {
@@ -1090,7 +1133,7 @@
       "airflow.providers.teradata"
       "airflow.providers.teradata.get_provider_info"
     ];
-    version = "3.5.0";
+    version = "3.6.0";
   };
 
   trino = {
@@ -1099,7 +1142,7 @@
       "airflow.providers.trino"
       "airflow.providers.trino.get_provider_info"
     ];
-    version = "6.5.0";
+    version = "6.6.0";
   };
 
   vertica = {
@@ -1111,7 +1154,16 @@
       "airflow.providers.vertica"
       "airflow.providers.vertica.get_provider_info"
     ];
-    version = "4.3.0";
+    version = "4.4.0";
+  };
+
+  vespa = {
+    deps = [ ];
+    imports = [
+      "airflow.providers.vespa"
+      "airflow.providers.vespa.get_provider_info"
+    ];
+    version = "0.1.1";
   };
 
   weaviate = {
@@ -1124,7 +1176,7 @@
       "airflow.providers.weaviate"
       "airflow.providers.weaviate.get_provider_info"
     ];
-    version = "3.3.1";
+    version = "3.3.5";
   };
 
   yandex = {
@@ -1133,7 +1185,7 @@
       "airflow.providers.yandex"
       "airflow.providers.yandex.get_provider_info"
     ];
-    version = "4.4.0";
+    version = "4.5.0";
   };
 
   ydb = {
@@ -1142,7 +1194,7 @@
       "airflow.providers.ydb"
       "airflow.providers.ydb.get_provider_info"
     ];
-    version = "2.5.0";
+    version = "2.5.3";
   };
 
   zendesk = {
@@ -1151,7 +1203,7 @@
       "airflow.providers.zendesk"
       "airflow.providers.zendesk.get_provider_info"
     ];
-    version = "4.11.1";
+    version = "4.12.0";
   };
 
 }
diff --git a/pkgs/by-name/ap/apache-airflow/python-package.nix b/pkgs/by-name/ap/apache-airflow/python-package.nix
index 5dba14a2e683..0a00fe496460 100644
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -36,6 +36,7 @@
   hatchling,
   httpx,
   importlib-metadata,
+  isoduration,
   itsdangerous,
   jinja2,
   jsonschema,
@@ -88,355 +89,355 @@
 
   enabledProviders,
 }:
-let
-  version = "3.2.2";
+buildPythonPackage (
+  finalAttrs:
+  let
+    inherit (finalAttrs) src version;
 
-  src = fetchFromGitHub {
-    owner = "apache";
-    repo = "airflow";
-    tag = version;
-    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
-  };
+    airflowUi = stdenv.mkDerivation (uiAttrs: {
+      pname = "airflow-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
 
-  pnpm = pnpm_10;
+      # vite build resolves "localhost" during the build, which the darwin
+      # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
 
-  airflowUi = stdenv.mkDerivation rec {
-    pname = "airflow-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
 
-    # vite build resolves "localhost" during the build, which the darwin
-    # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+      pnpmDeps = fetchPnpmDeps {
+        pname = "airflow-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = uiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-bKdZ4Y+enrXYuSpJ85eFHl2EM+QfZsMTGqQZ9yLfGEc=";
+      };
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/ui
+        cp -r dist $out/share/airflow/ui/
+      '';
+    });
+
+    airflowSimpleAuthUi = stdenv.mkDerivation (simpleUiAttrs: {
+      pname = "airflow-simple-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
+
+      pnpmDeps = fetchPnpmDeps {
+        pname = "simple-auth-manager-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = simpleUiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-Ye8jRs9jgsf3YUd3JPldEcTzQFmgS4cvkOVP6tuZw+8=";
+      };
+
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/simple-ui
+        cp -r dist $out/share/airflow/simple-ui/
+      '';
+    });
+
+    requiredProviders = [
+      "common_compat"
+      "common_io"
+      "common_sql"
+      "smtp"
+      "standard"
     ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "airflow-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
-    };
+    providers = import ./providers.nix;
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
+    buildProvider =
+      provider:
+      buildPythonPackage {
+        pname = "apache-airflow-providers-${provider}";
+        version = providers.${provider}.version;
+        pyproject = true;
 
-    installPhase = ''
-      mkdir -p $out/share/airflow/ui
-      cp -r dist $out/share/airflow/ui/
-    '';
-  };
+        inherit src;
+        sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
 
-  airflowSimpleAuthUi = stdenv.mkDerivation rec {
-    pname = "airflow-simple-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+        buildInputs = [ flit-core ];
 
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+        dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
-    ];
+        pythonRemoveDeps = [
+          "apache-airflow"
+        ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "simple-auth-manager-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
-    };
+        pythonRelaxDeps = [
+          "flit-core"
+        ];
+      };
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
-
-    installPhase = ''
-      mkdir -p $out/share/airflow/simple-ui
-      cp -r dist $out/share/airflow/simple-ui/
-    '';
-  };
-
-  requiredProviders = [
-    "common_compat"
-    "common_io"
-    "common_sql"
-    "smtp"
-    "standard"
-  ];
-
-  providers = import ./providers.nix;
-
-  buildProvider =
-    provider:
-    buildPythonPackage {
-      pname = "apache-airflow-providers-${provider}";
-      version = providers.${provider}.version;
+    taskSdk = buildPythonPackage {
+      pname = "task-sdk";
+      inherit src version;
       pyproject = true;
 
-      inherit src;
-      sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
+      sourceRoot = "${src.name}/task-sdk";
 
-      buildInputs = [ flit-core ];
+      postPatch = ''
+        # resolve cyclic dependency
+        sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
 
-      dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
-      pythonRemoveDeps = [
-        "apache-airflow"
+        # task-sdk needs config.yml from core subpackage
+        mkdir -p src/airflow/config_templates
+        cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+      '';
+
+      build-system = [
+        hatchling
       ];
 
-      pythonRelaxDeps = [
-        "flit-core"
+      dependencies = [
+        asgiref
+        attrs
+        babel
+        colorlog
+        fsspec
+        greenback
+        httpx
+        isoduration
+        jinja2
+        jsonschema
+        methodtools
+        msgspec
+        opentelemetry-api
+        pendulum
+        psutil
+        pydantic
+        pygtrie
+        python-dateutil
+        requests
+        retryhttp
+        structlog
+        tenacity
+        types-requests
       ];
     };
 
-  airflowCore = buildPythonPackage {
-    pname = "apache-airflow-core";
-    inherit src version;
+    airflowCore = buildPythonPackage {
+      pname = "apache-airflow-core";
+      inherit src version;
+      pyproject = true;
+
+      sourceRoot = "${src.name}/airflow-core";
+
+      postPatch = ''
+        # remove cyclic dependency
+        sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
+
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+
+        # Copy built UI assets
+        cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
+        cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
+      '';
+
+      build-system = [
+        gitdb
+        gitpython
+        hatchling
+        packaging
+        smmap
+        tomli
+        trove-classifiers
+      ];
+
+      dependencies = [
+        a2wsgi
+        aiosqlite
+        alembic
+        argcomplete
+        asgiref
+        attrs
+        cachetools
+        cadwyn
+        colorlog
+        cron-descriptor
+        croniter
+        cryptography
+        deprecated
+        dill
+        fastapi
+        httpx
+        importlib-metadata
+        itsdangerous
+        jinja2
+        jsonschema
+        lazy-object-proxy
+        libcst
+        linkify-it-py
+        lockfile
+        methodtools
+        msgspec
+        natsort
+        opentelemetry-api
+        opentelemetry-exporter-otlp
+        packaging
+        pathspec
+        pendulum
+        pluggy
+        psutil
+        pydantic
+        pygments
+        pygtrie
+        pyjwt
+        python-daemon
+        python-dateutil
+        python-slugify
+        pyyaml
+        requests
+        rich
+        rich-argparse
+        rich-click
+        setproctitle
+        sqlalchemy
+        sqlalchemy-jsonfield
+        sqlalchemy-utils
+        starlette
+        structlog
+        svcs
+        tabulate
+        taskSdk
+        tenacity
+        termcolor
+        typing-extensions
+        universal-pathlib
+        uuid6
+        uvicorn
+      ]
+      ++ (map buildProvider requiredProviders);
+
+      pythonRelaxDeps = [ "starlette" ];
+    };
+  in
+  {
+    pname = "apache-airflow";
+    version = "3.3.0";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "apache";
+      repo = "airflow";
+      tag = finalAttrs.version;
+      hash = "sha256-1DRaJCJ488BKUOEFaFMGnZjS2yxBx4pwHvIP67juu54=";
+    };
+
     pyproject = true;
 
-    sourceRoot = "${src.name}/airflow-core";
-
     postPatch = ''
-      # remove cyclic dependency
-      sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
-
       # relax dependencies
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
       sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # Copy built UI assets
-      cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
-      cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
     '';
 
+    nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
     build-system = [
       gitdb
       gitpython
       hatchling
       packaging
+      pathspec
+      pluggy
       smmap
       tomli
       trove-classifiers
     ];
 
     dependencies = [
-      a2wsgi
-      aiosqlite
-      alembic
-      argcomplete
-      asgiref
-      attrs
-      cachetools
-      cadwyn
-      colorlog
-      cron-descriptor
-      croniter
-      cryptography
-      deprecated
-      dill
-      fastapi
-      httpx
-      importlib-metadata
-      itsdangerous
-      jinja2
-      jsonschema
-      lazy-object-proxy
-      libcst
-      linkify-it-py
-      lockfile
-      methodtools
-      msgspec
-      natsort
-      opentelemetry-api
-      opentelemetry-exporter-otlp
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      psutil
-      pydantic
-      pygments
-      pygtrie
-      pyjwt
-      python-daemon
-      python-dateutil
-      python-slugify
-      pyyaml
-      requests
-      rich
-      rich-argparse
-      rich-click
-      setproctitle
-      sqlalchemy
-      sqlalchemy-jsonfield
-      sqlalchemy-utils
-      starlette
-      structlog
-      svcs
-      tabulate
-      taskSdk
-      tenacity
-      termcolor
-      typing-extensions
-      universal-pathlib
-      uuid6
-      uvicorn
+      airflowCore # subpackage from airflow src
+      taskSdk # subpackage from airflow src
     ]
-    ++ (map buildProvider requiredProviders);
+    ++ (map buildProvider enabledProviders);
 
-    pythonRelaxDeps = [ "starlette" ];
-  };
-
-  taskSdk = buildPythonPackage {
-    pname = "task-sdk";
-    inherit src version;
-    pyproject = true;
-
-    sourceRoot = "${src.name}/task-sdk";
-
-    postPatch = ''
-      # resolve cyclic dependency
-      sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
-
-      # relax dependencies
-      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # task-sdk needs config.yml from core subpackage
-      mkdir -p src/airflow/config_templates
-      cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+    postInstall = ''
+      # Create a symlink to the airflow-core package
+      mkdir -p $out/bin
+      ln -s ${airflowCore}/bin/airflow $out/bin/airflow
     '';
 
-    build-system = [
-      hatchling
-    ];
+    installCheckPhase = ''
+      runHook preInstallCheck
 
-    dependencies = [
-      asgiref
-      attrs
-      babel
-      colorlog
-      fsspec
-      greenback
-      httpx
-      jinja2
-      jsonschema
-      methodtools
-      msgspec
-      pendulum
-      psutil
-      pydantic
-      pygtrie
-      python-dateutil
-      requests
-      retryhttp
-      structlog
-      tenacity
-      types-requests
-    ];
-  };
+      $out/bin/airflow version
+      $out/bin/airflow db reset -y
 
-in
-buildPythonPackage rec {
-  pname = "apache-airflow";
-  inherit src version;
-  pyproject = true;
+      runHook postInstallCheck
+    '';
 
-  postPatch = ''
-    # relax dependencies
-    sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-    sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-    sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-  '';
+    pythonImportsCheck = [
+      "airflow"
+    ]
+    ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
 
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+    passthru.updateScript = ./update.sh;
+    passthru.airflowUi = airflowUi;
+    passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
 
-  build-system = [
-    gitdb
-    gitpython
-    hatchling
-    packaging
-    pathspec
-    pluggy
-    smmap
-    tomli
-    trove-classifiers
-  ];
+    # Note on testing the web UI:
+    # You can (manually) test the web UI as follows:
+    #
+    #   nix shell .#apache-airflow
+    #   airflow version
+    #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
+    #   airflow standalone
+    #
+    # Then navigate to the localhost URL using the credentials printed, try
+    # triggering the 'example_bash_operator' DAG and see if it reports success.
 
-  dependencies = [
-    airflowCore # subpackage from airflow src
-    taskSdk # subpackage from airflow src
-  ]
-  ++ (map buildProvider enabledProviders);
-
-  postInstall = ''
-    # Create a symlink to the airflow-core package
-    mkdir -p $out/bin
-    ln -s ${airflowCore}/bin/airflow $out/bin/airflow
-  '';
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/airflow version
-    $out/bin/airflow db reset -y
-
-    runHook postInstallCheck
-  '';
-
-  pythonImportsCheck = [
-    "airflow"
-  ]
-  ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
-
-  passthru.updateScript = ./update.sh;
-  passthru.airflowUi = airflowUi;
-  passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
-
-  # Note on testing the web UI:
-  # You can (manually) test the web UI as follows:
-  #
-  #   nix shell .#apache-airflow
-  #   airflow version
-  #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
-  #   airflow standalone
-  #
-  # Then navigate to the localhost URL using the credentials printed, try
-  # triggering the 'example_bash_operator' DAG and see if it reports success.
-
-  meta = {
-    description = "Platform to programmatically author, schedule and monitor workflows";
-    homepage = "https://airflow.apache.org/";
-    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      taranarmo
-    ];
-    mainProgram = "airflow";
-  };
-}
+    meta = {
+      description = "Platform to programmatically author, schedule and monitor workflows";
+      homepage = "https://airflow.apache.org/";
+      changelog = "https://airflow.apache.org/docs/apache-airflow/${finalAttrs.version}/release_notes.html";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        taranarmo
+      ];
+      mainProgram = "airflow";
+    };
+  }
+)
diff --git a/pkgs/by-name/ap/apache-airflow/update-providers.py b/pkgs/by-name/ap/apache-airflow/update-providers.py
index 53293d9e60fa..e956992b566b 100755
--- a/pkgs/by-name/ap/apache-airflow/update-providers.py
+++ b/pkgs/by-name/ap/apache-airflow/update-providers.py
@@ -27,6 +27,7 @@ PKG_PREFERENCES = {
     "protobuf": "protobuf",
     "pydantic": "pydantic",
     "requests_toolbelt": "requests-toolbelt",
+    "setuptools": "setuptools",
     "sqlalchemy": "sqlalchemy",
 }
 
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index a4781eeb6744..f42a60bd89b2 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.92.134";
+  version = "1.92.139";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-qo40t+PGl1RO2ajJ2Hev4G1FWvzTx7Ak5CVxjdxabLI=";
+      hash = "sha256-CkCpXgP4InjfjuhKqG66OjuZcqq7VLLK3/n+7fXpMj0=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-T3A/ejmLkIRYGWc8GXQmvIAZvQFwYEyhQJxssNDalhQ=";
+      hash = "sha256-UFQV8iBsa6HdUhGGngpi341o41yRoenkxbG2M90O62A=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-K1p5mAYfEDJNZFSmoOQV7kHNsA5RQuyUl3T2KVsNcbw=";
+      hash = "sha256-65qGzjXZfY5eTWbxTA9R3jN2F0CdkXnHXGVfw3spujo=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-IrhvRVFZGLoGSVNy10ppFL9rEy7MRTb/HIhzspDsrs8=";
+      hash = "sha256-XPKKB/X8w5Neuxeluc5OFZVN1thqZ0Cf/pFTP4GY2/o=";
     };
   };
 
diff --git a/pkgs/by-name/cl/cliamp/package.nix b/pkgs/by-name/cl/cliamp/package.nix
index 384f87b16223..bb7fda0ab5d2 100644
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -41,6 +41,11 @@ buildGoModule (finalAttrs: {
     alsa-lib
   ];
 
+  # macOS limits Unix socket paths to 104 bytes; use a shorter TMPDIR.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export TMPDIR="$(mktemp -d /tmp/cliamp-XXXXXX)"
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/cliamp \
       --prefix PATH : ${
@@ -60,6 +65,7 @@ buildGoModule (finalAttrs: {
     description = "Terminal Winamp - a retro terminal music player inspired by Winamp 2.x";
     homepage = "https://github.com/bjarneo/cliamp";
     license = lib.licenses.mit;
+    platforms = with lib.platforms; darwin ++ linux;
     maintainers = with lib.maintainers; [ supermarin ];
     mainProgram = "cliamp";
   };
diff --git a/pkgs/by-name/de/deadlock-mod-manager/package.nix b/pkgs/by-name/de/deadlock-mod-manager/package.nix
index ef4317966003..f7484213e01b 100644
--- a/pkgs/by-name/de/deadlock-mod-manager/package.nix
+++ b/pkgs/by-name/de/deadlock-mod-manager/package.nix
@@ -4,7 +4,7 @@
   rustPlatform,
   cargo-tauri,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   pkg-config,
@@ -27,26 +27,26 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deadlock-mod-manager";
-  version = "0.18.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "deadlock-mod-manager";
     repo = "deadlock-mod-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+64Y6BFwgQIQhmFzZXOeJ/IGFn+OXV58I/ZdARVFt4w=";
+    hash = "sha256-tSOSjapAlAd63Xkc+MNFVKn1k4+AtW3w3GhicRTV9Pg=";
   };
 
   cargoRoot = "apps/desktop";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-6ljyPdobcoBaYyarc7Iin5N24y1YXPafrYAk2xvBtvY=";
+  cargoHash = "sha256-x0lhn8nAV9xTgWbRAabJscATSCNpkKpzWvdnuZ4BEvw=";
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     cargo-tauri.hook
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
     pkg-config
     wrapGAppsHook3
   ];
@@ -76,10 +76,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       version
       src
       ;
-    pnpm = pnpm_9;
+    pnpm = pnpm_11;
     fetcherVersion = 3;
     sourceRoot = "source";
-    hash = "sha256-6lMTvlkIeM9kkbFhHzS9jJsHk2bVZWZs6GPgn+X3Rss=";
+    hash = "sha256-zl+ZrI21EnMBeMInKvEkUObiZ0OA5SJLJjnHwu/Dagc=";
   };
 
   patches = [
@@ -88,9 +88,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.VITE_API_URL = "https://api.deadlockmods.app";
 
-  # Skip tests that require network access
   checkFlags = [
+    # Requires network access
     "--skip=download_manager::downloader::tests::test_download_file"
+    # Asserts that set_steam_dir rejects a non-Steam directory, but steamlocate
+    # 2.1.0's SteamDir::from_dir only checks that the path is a directory
+    # (further validation is an upstream TODO), so this fails in any environment.
+    "--skip=mod_manager::steam_manager::tests::set_steam_dir_rejects_invalid_directory"
   ];
 
   preFixup = ''
diff --git a/pkgs/by-name/fa/fastmail-desktop/linux.nix b/pkgs/by-name/fa/fastmail-desktop/linux.nix
index 98f354809842..b973981b57f1 100644
--- a/pkgs/by-name/fa/fastmail-desktop/linux.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/linux.nix
@@ -66,9 +66,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   # remove musl-libc dependencies before the autoPatchelfHook
-  preFixup = ''
-    rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-x64,sharp-libvips-linuxmusl-x64}
-  '';
+  preFixup =
+    let
+      suffix =
+        {
+          aarch64-linux = "arm64";
+          x86_64-linux = "x64";
+        }
+        .${stdenvNoCC.targetPlatform.system};
+    in
+    ''
+      rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-${suffix},sharp-libvips-linuxmusl-${suffix}}
+    '';
 
   meta = meta // {
     mainProgram = "fastmail";
diff --git a/pkgs/by-name/fa/fastmail-desktop/package.nix b/pkgs/by-name/fa/fastmail-desktop/package.nix
index ae6f88fdd833..20ad3f4fa7ae 100644
--- a/pkgs/by-name/fa/fastmail-desktop/package.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/package.nix
@@ -26,6 +26,7 @@ callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
     ];
     platforms = [
       "aarch64-darwin"
+      "aarch64-linux"
       "x86_64-linux"
     ];
   };
diff --git a/pkgs/by-name/fa/fastmail-desktop/sources.nix b/pkgs/by-name/fa/fastmail-desktop/sources.nix
index 374f140afcaf..380636526ff8 100644
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,19 +1,26 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-03-23
+# Last updated: 2026-07-11
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.2.1";
+    version = "1.4.0";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.2.1-arm64-mac.zip";
-      hash = "sha512-bu6IeL8X8ogD1qSlAuApWTBTCYIk5QrjWrzjOv8fel+kqYfCIcDXP1DP1FdJwULe91zoZn4M/uDX8CoOPWa0cA==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.4.0-arm64-mac.zip";
+      hash = "sha512-QyZZu6pwFJ0SkVye0/OtvNTligl6qKsYbpJfdPeHojPj+OqVyV8bavz15Lest+v7ALJhACZ3x+2kBiWa0ZCSow==";
+    };
+  };
+  aarch64-linux = {
+    version = "1.4.0";
+    src = fetchurl {
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/arm64/com.fastmail.Fastmail-1.4.0-arm64.AppImage";
+      hash = "sha512-sw55AwedyijKTXWAAAaSi6sgGMGK0uF4nPtQRacp9VG5EwlC+0wedyO4ax2cWxhsVUSXnk9ngN4mkraSd07vag==";
     };
   };
   x86_64-linux = {
-    version = "1.2.1";
+    version = "1.4.0";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.2.1.AppImage";
-      hash = "sha512-xudOPNjOaumYxD7yZyjQnYhuiKqDO10cBwMdFJtVEOfHVia0jJMgdUTJx03otIBn9ijM3/1Qo6wsq1HF0A/zlQ==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.4.0.AppImage";
+      hash = "sha512-0hNTRFNAnnLPq19isnaoVlXNl6za4Z5o6yh9ovU564JBMyAjsDNHk8h+2zArSSpydaUky6tIgAUsOhhWrIRtcg==";
     };
   };
 }
diff --git a/pkgs/by-name/fa/fastmail-desktop/update.sh b/pkgs/by-name/fa/fastmail-desktop/update.sh
index c21c13c3fe7a..4c84120dfefa 100755
--- a/pkgs/by-name/fa/fastmail-desktop/update.sh
+++ b/pkgs/by-name/fa/fastmail-desktop/update.sh
@@ -6,15 +6,19 @@ set -euo pipefail
 cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"
 
 x86_64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/x64/latest-linux.yml")
+aarch64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/arm64/latest-linux-arm64.yml")
 aarch64_darwin_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/mac/arm64/latest-mac.yml")
 
 x86_64_linux_version=$(yq -r '.version' <<<"$x86_64_linux_info")
+aarch64_linux_version=$(yq -r '.version' <<<"$aarch64_linux_info")
 aarch64_darwin_version=$(yq -r '.version' <<<"$aarch64_darwin_info")
 
 x86_64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/x64/$(yq -r '.path' <<<"$x86_64_linux_info")"
+aarch64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/arm64/$(yq -r '.path' <<<"$aarch64_linux_info")"
 aarch64_darwin_url="https://dl.fastmailcdn.com/desktop/production/mac/arm64/$(yq -r '.path' <<<"$aarch64_darwin_info")"
 
 x86_64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$x86_64_linux_info")")
+aarch64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_linux_info")")
 aarch64_darwin_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_darwin_info")")
 
 cat >sources.nix <<EOF
@@ -29,6 +33,13 @@ cat >sources.nix <<EOF
       hash = "$aarch64_darwin_hash";
     };
   };
+  aarch64-linux = {
+    version = "$aarch64_linux_version";
+    src = fetchurl {
+      url = "$aarch64_linux_url";
+      hash = "$aarch64_linux_hash";
+    };
+  };
   x86_64-linux = {
     version = "$x86_64_linux_version";
     src = fetchurl {
diff --git a/pkgs/by-name/gi/gittuf/package.nix b/pkgs/by-name/gi/gittuf/package.nix
index b963b8db8bb4..b20a034433b6 100644
--- a/pkgs/by-name/gi/gittuf/package.nix
+++ b/pkgs/by-name/gi/gittuf/package.nix
@@ -3,41 +3,56 @@
   fetchFromGitHub,
   buildGoModule,
   git,
+  gnupg,
+  less,
   openssh,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "gittuf";
-  version = "0.12.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "gittuf";
     repo = "gittuf";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-/PKbo8LPvU6ZTav9n82mrj2h6z6AyJ225mCH7EfazVU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VWbM7y9XCs/pANJtPa3MDbDhuEtVQ97X5Cyo6yY0Rd8=";
   };
 
-  vendorHash = "sha256-unj9PpRkfNHWQzeCmcjppMFGAlHNcP0/j9EiGvpRzRc=";
+  vendorHash = "sha256-VTfS0bLq7B037qmFABO5JDrV98zik5ycR4s6NZr3H4s=";
 
   ldflags = [ "-X github.com/gittuf/gittuf/internal/version.gitVersion=${finalAttrs.version}" ];
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeCheckInputs = [
     git
+    gnupg
+    less
     openssh
   ];
-  checkFlags = [
-    "-skip=TestLoadRepository"
-    "-skip=TestSSH"
-  ];
+  checkFlags = [ "-skip=TestLoadRepository|TestSSH" ];
 
-  postInstall = "rm $out/bin/cli"; # remove gendoc cli binary
+  postInstall = "rm $out/bin/cli $out/bin/sandbox"; # remove gendoc helper binaries
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    changelog = "https://github.com/gittuf/gittuf/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/gittuf/gittuf/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Security layer for Git repositories";
     homepage = "https://gittuf.dev";
     license = lib.licenses.asl20;
     mainProgram = "gittuf";
-    maintainers = with lib.maintainers; [ flandweber ];
+    maintainers = with lib.maintainers; [
+      flandweber
+      anish
+    ];
   };
 })
diff --git a/pkgs/by-name/la/lakefs/package.nix b/pkgs/by-name/la/lakefs/package.nix
index 1ad8c3fbc909..b275e4808f28 100644
--- a/pkgs/by-name/la/lakefs/package.nix
+++ b/pkgs/by-name/la/lakefs/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "lakefs";
-  version = "1.79.0";
+  version = "1.83.0";
 
   src = fetchFromGitHub {
     owner = "treeverse";
     repo = "lakeFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UL9JvrNvtHADI0POguLXMDNNvO1oKHXXwfr8tOyvFYc=";
+    hash = "sha256-5/2iI5/87x+VJ1MbYw7zPEDeTm1XVuLmSsI6KssRGRE=";
   };
 
   webui = buildNpmPackage {
@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
 
     nodejs = nodejs_22;
 
-    npmDepsHash = "sha256-Z9oOIKK6Hm/Bg3E37f4FqFFL1exMIf0KNEHQXIyox+Q=";
+    npmDepsHash = "sha256-AKCsxBW2ZBQB5fPkS1adAt8z6mHuC/zGMHhRW8pVyYs=";
 
     installPhase = ''
       runHook preInstall
@@ -41,7 +41,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/lakefs" ];
   proxyVendor = true;
-  vendorHash = "sha256-6XOJBDdAERD6mcneQ7UFqAPGq+pXroNlzQGNvycpVBc=";
+  vendorHash = "sha256-UNDIqP79CG2+M8HKkHT1l7X2/Dt6YDTQzADR5T7klUg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ol/olivetin/3k.nix b/pkgs/by-name/ol/olivetin/3k.nix
index 8979c680a5c7..6178db460409 100644
--- a/pkgs/by-name/ol/olivetin/3k.nix
+++ b/pkgs/by-name/ol/olivetin/3k.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "olivetin";
-  version = "3000.15.0";
+  version = "3000.17.0";
 
   src = fetchFromGitHub {
     owner = "OliveTin";
     repo = "OliveTin";
     tag = finalAttrs.version;
-    hash = "sha256-AztJqhSJV9hIsnhaYZoIMC8ZE17pUT37nRUdCZ6ZiCA=";
+    hash = "sha256-oLBXDd1grSFEbCvB4bK2XeVOZONSYro/6rvMJkG8eU0=";
   };
 
   modRoot = "service";
@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-v7aSikl1VSFZdNKnIucs7RdqFWoaVNIH9u27YG9Ei90=";
+    outputHash = "sha256-X602MebKdmdxZ9OEtQ150u+/Z1O9FEvcxRtOhMorqyw=";
   };
 
   webui = buildNpmPackage {
diff --git a/pkgs/by-name/op/opencolorio/package.nix b/pkgs/by-name/op/opencolorio/package.nix
index 64c6ef1defee..a18f3a0f3843 100644
--- a/pkgs/by-name/op/opencolorio/package.nix
+++ b/pkgs/by-name/op/opencolorio/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencolorio";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenColorIO";
     rev = "v${version}";
-    hash = "sha256-iI32dnGZdizLBOs7IQtmLUYMPWxadvWNeqZjy49AWb0=";
+    hash = "sha256-b4tdQ9VH9M7hAD5Uuxu4QKwwpaVwroj/Bvg+Zsy0M1M=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index 3a58dd89834a..1589b83333ee 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -12,18 +12,18 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "openlist-frontend";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList-Frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RLuAGjiYELy+roip2TtvUXGOw6Vk+GkczT1LSI0Vx+8=";
+    hash = "sha256-33W0JCAmt3pjhAAOxoaZS7zBbJJbl4i85fqyKzoibz8=";
   };
 
   i18n = fetchzip {
     url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-ZO/ozyRNqh2W4/acQmGHoEMpjpf2jph7Gn/kOlwVSFs=";
+    hash = "sha256-nnsnYXbH4Uq+sux11txanUs11MB2dHIT0vCLMIzYQdg=";
     stripRoot = false;
   };
 
@@ -41,7 +41,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = openlistPnpm;
     fetcherVersion = 4;
-    hash = "sha256-ujsCuQexnKPNwoJzaWmhu3+4xMkZ0jR04m2exG674dI=";
+    hash = "sha256-V+YhQsfUvd8WHxIYEjuihEjTZE75eFfziq2GwW1rPbg=";
   };
 
   npmConfigHook = pnpmConfigHook;
diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix
index 022bb7240bee..e98ef06ca68c 100644
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlist";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MxoF+hpzn/44knjVeaINo4/1T4ia7HG8mm+tbvJEsfQ=";
+    hash = "sha256-q7s6u/pQ+bvSbz19029uO9CzVc1KVoISpcStngVUffs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
   frontend = callPackage ./frontend.nix { };
 
   proxyVendor = true;
-  vendorHash = "sha256-ScPfry0PtSlABdyG+7egMAndG7D3iz1+ceAAhLQPtkM=";
+  vendorHash = "sha256-a4v2JP/+feit3uTqnACWgl77fWZU8yVE/0Hm7qxoI8E=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/op/openllm/package.nix b/pkgs/by-name/op/openllm/package.nix
index d197e40c8dd3..321e25db6daa 100644
--- a/pkgs/by-name/op/openllm/package.nix
+++ b/pkgs/by-name/op/openllm/package.nix
@@ -64,6 +64,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
     description = "Run any open-source LLMs, such as Llama 3.1, Gemma, as OpenAI compatible API endpoint in the cloud";
     homepage = "https://github.com/bentoml/OpenLLM";
     changelog = "https://github.com/bentoml/OpenLLM/releases/tag/${finalAttrs.src.tag}";
+    knownVulnerabilities = [
+      "CVE-2026-15035"
+    ];
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       happysalada
diff --git a/pkgs/by-name/pr/privatebin/package.nix b/pkgs/by-name/pr/privatebin/package.nix
index 58086830458d..9de52c4b9e4c 100644
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-OyTEi1D+B33e0Dqr/l/uTBcPTlC7AAqc2atnClYhyGo=";
+    hash = "sha256-om0l9psEus4+XZ+aXQ3DK5iWtQeCfCi2D6lNP+9FM6U=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 6f3da143226b..88c6090f1809 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -6,7 +6,7 @@
   replaceVars,
   pandoc,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   electron,
@@ -15,24 +15,22 @@
   copyDesktopItems,
   nix-update-script,
   xdg-utils,
+  darwin,
 }:
 
 let
+  inherit (stdenv.hostPlatform) isLinux isDarwin system;
+
+  pnpm = pnpm_10;
+
   platformIds = {
     "x86_64-linux" = "linux";
     "aarch64-linux" = "linux-arm64";
+    "x86_64-darwin" = "darwin";
+    "aarch64-darwin" = "darwin-arm64";
   };
 
-  platformId = platformIds.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}");
-
-  desktopEntry = makeDesktopItem {
-    name = "siyuan";
-    desktopName = "SiYuan";
-    comment = "Refactor your thinking";
-    icon = "siyuan";
-    exec = "siyuan %U";
-    categories = [ "Utility" ];
-  };
+  platformId = platformIds.${system} or (throw "Unsupported platform: ${system}");
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
@@ -69,9 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Set flags and tags as per upstream's Dockerfile
     ldflags = [
       "-s"
-      "-w"
-      "-X"
-      "github.com/siyuan-note/siyuan/kernel/util.Mode=prod"
+      "-X 'github.com/siyuan-note/siyuan/kernel/util.Mode=prod'"
     ];
     tags = [ "fts5" ];
   };
@@ -85,9 +81,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm
+  ]
+  ++ lib.optionals isLinux [
     makeWrapper
     copyDesktopItems
+  ]
+  ++ lib.optionals isDarwin [
+    darwin.autoSignDarwinBinariesHook
   ];
 
   pnpmDeps = fetchPnpmDeps {
@@ -98,9 +99,9 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       postPatch
       ;
-    pnpm = pnpm_9;
+    inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-GAbP9H+c+JXymH0/vpeYOJrkkFJGVyKcpJYFeyRLSKc=";
+    hash = "sha256-M2Fdie0XK2Pck/fP7Djxb7XNAQXpJO2i2kSJrDj1G0E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
@@ -114,6 +115,9 @@ stdenv.mkDerivation (finalAttrs: {
     # link kernel into the correct starting place so that electron-builder can copy it to it's final location
     mkdir kernel-${platformId}
     ln -s ${finalAttrs.kernel}/bin/kernel kernel-${platformId}/SiYuan-Kernel
+
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
   '';
 
   buildPhase = ''
@@ -121,19 +125,36 @@ stdenv.mkDerivation (finalAttrs: {
 
     pnpm build
 
-    npm exec electron-builder -- \
-        --dir \
-        --config electron-builder-${platformId}.yml \
-        -c.electronDist=${electron.dist} \
-        -c.electronVersion=${electron.version}
+    electronBuilderArgs=(
+      --dir
+      --config electron-builder-${platformId}.yml
+      -c.electronDist=electron-dist
+      -c.electronVersion=${electron.version}
+      -c.mac.identity=null
+    )
+
+    npm exec electron-builder -- "''${electronBuilderArgs[@]}"
 
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
+  ''
+  + lib.optionalString isDarwin ''
+    mkdir -p $out/Applications $out/bin
 
+    cp -R build/mac*/*.app $out/Applications/SiYuan.app
+
+    cat > $out/bin/siyuan << EOF
+    #!${stdenv.shell}
+    exec open -na "$out/Applications/SiYuan.app" --args "\$@"
+    EOF
+    chmod +x $out/bin/siyuan
+  ''
+  + lib.optionalString isLinux ''
     mkdir -p $out/share/siyuan
+
     cp -r build/*-unpacked/{locales,resources{,.pak}} $out/share/siyuan
 
     makeWrapper ${lib.getExe electron} $out/bin/siyuan \
@@ -145,20 +166,26 @@ stdenv.mkDerivation (finalAttrs: {
         --inherit-argv0
 
     install -Dm644 src/assets/icon.svg $out/share/icons/hicolor/scalable/apps/siyuan.svg
-
+  ''
+  + ''
     runHook postInstall
   '';
 
-  desktopItems = [ desktopEntry ];
+  desktopItems = lib.optional isLinux (makeDesktopItem {
+    name = "siyuan";
+    desktopName = "SiYuan";
+    comment = "Refactor your thinking";
+    icon = "siyuan";
+    exec = "siyuan %U";
+    categories = [ "Utility" ];
+  });
 
-  passthru = {
-    inherit (finalAttrs.kernel) goModules; # this tricks nix-update into also updating the kernel goModules FOD
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version-regex"
-        "^v(\\d+\\.\\d+\\.\\d+)$"
-      ];
-    };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v(\\d+\\.\\d+\\.\\d+)$"
+      "--subpackage=kernel"
+    ];
   };
 
   meta = {
diff --git a/pkgs/by-name/sp/space-station-14-launcher/package.nix b/pkgs/by-name/sp/space-station-14-launcher/package.nix
index 09262aa781c7..93efed21473b 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/package.nix
+++ b/pkgs/by-name/sp/space-station-14-launcher/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   config,
+  nix-update-script,
   buildDotnetModule,
   dotnetCorePackages,
   fetchFromGitHub,
@@ -39,7 +40,7 @@
 }:
 let
   pname = "space-station-14-launcher";
-  version = "0.39.0";
+  version = "0.39.1";
 in
 buildDotnetModule rec {
   inherit pname;
@@ -52,7 +53,7 @@ buildDotnetModule rec {
     owner = "space-wizards";
     repo = "SS14.Launcher";
     tag = "v${version}";
-    hash = "sha256-i5jcaB1wa+Toj6orpEQ9sK3EX1CLWadnhTEQDOU7QU4=";
+    hash = "sha256-u3tsPWAFMckWSHhiPqL50i9BMxR+VrLnpUSWGRRu9AA=";
     fetchSubmodules = true;
   };
 
@@ -133,6 +134,8 @@ buildDotnetModule rec {
     icoFileToHiColorTheme SS14.Launcher/Assets/icon.ico ${pname} $out
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Launcher for Space Station 14, a multiplayer game about paranoia and disaster";
     homepage = "https://spacestation14.io";
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index 656edd499d13..d496a193a4fc 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -6,7 +6,7 @@
   libredirect,
   buildGoModule,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   esbuild,
@@ -51,15 +51,15 @@ buildGoModule (finalAttrs: {
         src
         sourceRoot
         ;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-paCYfh7tjDuPm8JCpzhCNjL1ZsyQTNxofW8UNIKjqmE=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-i4ji/NjK6/hpqrma+DJ2x5kKq/YEN3Cy8mKQLy1M+dU=";
     };
 
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
     ];
 
     env.ESBUILD_BINARY_PATH = lib.getExe lockedEsbuild;
diff --git a/pkgs/by-name/ta/tandoor-recipes/common.nix b/pkgs/by-name/ta/tandoor-recipes/common.nix
index c66507a466d2..5e9c6b78eeea 100644
--- a/pkgs/by-name/ta/tandoor-recipes/common.nix
+++ b/pkgs/by-name/ta/tandoor-recipes/common.nix
@@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "2.6.9";
+  version = "2.6.13";
 
   src = fetchFromGitHub {
     owner = "TandoorRecipes";
     repo = "recipes";
     tag = version;
-    hash = "sha256-g151bUOpAp+7+K92kF+eK5SR2aCHPHdFc3UXqOO4aSw=";
+    hash = "sha256-7620qMp3Trg2be51CP0LKas/1egk3Rmo+aaMp0pe83k=";
   };
 
-  yarnHash = "sha256-Un5pHocZZrXajY3AGfqV1kjT9twE8B93rwoJMi4CILg=";
+  yarnHash = "sha256-EpmFGyuWZeqzdi8wPX7ABjfJKWP8r5qqpdfNKdOFiso=";
 
   meta = {
     homepage = "https://tandoor.dev/";
diff --git a/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch b/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch
index 444b19df821f..012912f491a0 100644
--- a/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch
+++ b/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch
@@ -9,6 +9,3 @@ index 2755dc99..4026b96e 100644
 -addopts = -n auto --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
 +addopts = -n @NIX_BUILD_CORES@ --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
  # addopts = -n auto --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
--asyncio_default_fixture_loop_scope = fixture
-\ No newline at end of file
-+asyncio_default_fixture_loop_scope = function
diff --git a/pkgs/by-name/ty/typst/build-universe-package.nix b/pkgs/by-name/ty/typst/build-universe-package.nix
index a7628f6412dd..af1e0cf4dbe3 100644
--- a/pkgs/by-name/ty/typst/build-universe-package.nix
+++ b/pkgs/by-name/ty/typst/build-universe-package.nix
@@ -45,6 +45,8 @@ lib.extendMkDerivation {
           RossSmyth
         ];
         license = lib.map (lib.flip lib.getAttr lib.licensesSpdx) license;
+        # Sending a bunch of trivial jobs to Hydra is not that great.
+        hydraPlatforms = [ ];
       }
       // lib.optionalAttrs (homepage != null) { inherit homepage; };
     };
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 710d39a63429..484d203349d1 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.145.0";
+  version = "1.146.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nKG2ei1Gn1mU5TtD5YLYUHaJrM4fSxm/uUdY4tIGeVE=";
+    hash = "sha256-EWRVbUeugyLsExP3NyPVLd7v2kwbRg5OjFg2WAY1FuM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index f1f08fc50e47..66f5ac76805c 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.0.4033.54";
+  version = "8.1.4087.48";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-i2FAMp3MFsnXTjQoF4Y/BuB6j+x3ugfsu0ePGI/h5Po=";
-        x86_64-linux = "sha256-a4ZLX/DpygZgPPjt4BQxTuRbFoPmNuRgdZFiI6UclQI=";
+        aarch64-linux = "sha256-T6mBi4FpHz2iGXeF91giTbuVp4KjFG1DUnPNpKEV06c=";
+        x86_64-linux = "sha256-/Bgh+Y6DHWe7al9vLsWWH1HM5JQGwv91KUxQ9TNkqjs=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 438a9eee0f86..e99c3efda3f9 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   buildNpmPackage,
+  darwin,
   nodejs_22,
   perl,
   python3,
@@ -28,14 +29,14 @@ let
   nodejs = nodejs_22;
 
   pname = "zotero";
-  version = "9.0.4";
+  version = "9.0.6";
 
   src = fetchFromGitHub {
     owner = "zotero";
     repo = "zotero";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-YMaDCYdCNJQ8zXfCkV5tb3RA3foXRlKo2TWv6pgk8VM=";
+    hash = "sha256-9Rku6iF7Sczqekw8ms8hluIc+B/5BE9zHlBqp7vGlY4=";
   };
 
   pdf-js = buildNpmPackage {
@@ -181,10 +182,11 @@ buildNpmPackage (finalAttrs: {
     rsync
     copyDesktopItems
   ]
-  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     makeBinaryWrapper
+    darwin.autoSignDarwinBinariesHook
   ]
-  ++ lib.optionals (!stdenv.targetPlatform.isDarwin) [
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     wrapGAppsHook3
   ];
 
@@ -246,12 +248,12 @@ buildNpmPackage (finalAttrs: {
       # The correct firefox version can be found in zotero/app/config.sh at `GECKO_VERSION_LINUX`.
       mkdir -p app/xulrunner/
     ''
-    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
       cp -r "${firefox-esr-140-unwrapped}/Applications/Firefox ESR.app" app/xulrunner/Firefox.app
     ''
-    + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
-      cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.targetPlatform.parsed.kernel.name}-${
-        lib.replaceString "aarch64" "arm64" stdenv.targetPlatform.parsed.cpu.name
+    + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+      cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.hostPlatform.parsed.kernel.name}-${
+        lib.replaceString "aarch64" "arm64" stdenv.hostPlatform.parsed.cpu.name
       }"
     ''
     + ''
@@ -260,9 +262,7 @@ buildNpmPackage (finalAttrs: {
       build_dir=$(mktemp -d)
       ./app/scripts/prepare_build -s ./build -o "$build_dir" -c release
       ./app/build.sh -d "$build_dir" -c release -s \
-        ${
-          if stdenv.targetPlatform.isDarwin then "-p m" else "-p l -a ${zoteroArch stdenv.targetPlatform}"
-        }
+        ${if stdenv.hostPlatform.isDarwin then "-p m" else "-p l -a ${zoteroArch stdenv.hostPlatform}"}
 
       runHook postBuild
     '';
@@ -306,12 +306,12 @@ buildNpmPackage (finalAttrs: {
   installPhase = ''
     runHook preInstall
   ''
-  + lib.optionalString stdenv.targetPlatform.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Copy package contents
     mkdir -p $out/Applications
     cp -r app/staging/Zotero.app $out/Applications/
   ''
-  + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     # Copy package contents
     mkdir -p $out/lib/
     cp -r app/staging/*/. $out/lib/
@@ -330,7 +330,7 @@ buildNpmPackage (finalAttrs: {
     runHook postInstall
   '';
 
-  preFixup = lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+  preFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     gappsWrapperArgs+=(--suffix LD_LIBRARY_PATH : ${
       lib.makeLibraryPath [
         libGL
@@ -340,7 +340,7 @@ buildNpmPackage (finalAttrs: {
     })
   '';
 
-  postFixup = lib.optionalString stdenv.targetPlatform.isDarwin ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/bin
     makeWrapper $out/Applications/Zotero.app/Contents/MacOS/zotero $out/bin/zotero
   '';
diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix
index 99703c943757..07dab66f838d 100644
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -248,6 +248,14 @@ buildPythonPackage {
     description = "Build Production-Grade AI Applications";
     homepage = "https://github.com/bentoml/BentoML";
     changelog = "https://github.com/bentoml/BentoML/releases/tag/${src.tag}";
+    knownVulnerabilities = [
+      "CVE-2026-27905"
+      "CVE-2026-33744"
+      "CVE-2026-35043"
+      "CVE-2026-35044"
+      "CVE-2026-44345"
+      "CVE-2026-44346"
+    ];
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       happysalada
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 4720f405d2b8..e4b8edc8ff16 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -43,7 +43,6 @@
   python-dotenv,
   python-multipart,
   pyyaml,
-  requests,
   resend,
   restrictedpython,
   rich,
@@ -62,19 +61,19 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.83.14";
+  version = "1.86.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BerriAI";
     repo = "litellm";
-    tag = "v${version}-stable";
-    hash = "sha256-SZow0qof9DRlohWjT3J/NHtmhe96OLLcdHt55RQ7Zmw=";
+    tag = "v${version}";
+    hash = "sha256-uInjKBUduDAfXHg5dQj5/qqqMJhlDeTri1kULkz5unM=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "uv_build==0.10.7" "uv_build"
+      --replace-fail "uv_build==0.11.8" "uv_build"
   '';
 
   build-system = [ uv-build ];
@@ -90,7 +89,6 @@ buildPythonPackage rec {
     openai
     pydantic
     python-dotenv
-    requests
     tiktoken
     tokenizers
   ];
@@ -175,7 +173,7 @@ buildPythonPackage rec {
     updateScript = nix-update-script {
       extraArgs = [
         "--version-regex"
-        "v([0-9]+\\.[0-9]+\\.[0-9]+)-stable"
+        "v([0-9]+\\.[0-9]+\\.[0-9]+)"
       ];
     };
   };
diff --git a/pkgs/development/python-modules/plover/5.nix b/pkgs/development/python-modules/plover/5.nix
index 7676abeb0ee2..fe58e8120c8e 100644
--- a/pkgs/development/python-modules/plover/5.nix
+++ b/pkgs/development/python-modules/plover/5.nix
@@ -40,14 +40,14 @@ buildPythonPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "plover";
-  version = "5.3.0";
+  version = "5.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstenoproject";
     repo = "plover";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1NpZmUDq806geKANqswPYglHwInxum/c/Hxq7JhTpbc=";
+    hash = "sha256-qaEuzPVqh+e3qq778VdUaRufGzOx9HyUnygIbA0+6kw=";
   };
 
   # pythonRelaxDeps seemingly doesn't work here
diff --git a/pkgs/development/python-modules/protego/default.nix b/pkgs/development/python-modules/protego/default.nix
index 4da1b264cb29..ad27e0b8d3ce 100644
--- a/pkgs/development/python-modules/protego/default.nix
+++ b/pkgs/development/python-modules/protego/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "protego";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scrapy";
     repo = "protego";
     tag = finalAttrs.version;
-    hash = "sha256-Me+bSJnHHJH0ryPoSS7EN2Px5FNElCWQzvKrmWll4mQ=";
+    hash = "sha256-vAX7l0Xq2itQwBkNYobOWae1qHVVcD7M/o43GpIwEVo=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch b/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
new file mode 100644
index 000000000000..e10c13868423
--- /dev/null
+++ b/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
@@ -0,0 +1,26 @@
+From 98fd6e87243c6d5992429a9b90426af73dbcc3ff Mon Sep 17 00:00:00 2001
+From: Bart Oostveen <bart@bartoostveen.nl>
+Date: Fri, 10 Jul 2026 13:59:21 +0200
+Subject: [PATCH] fix: create new event loop if not exists
+
+---
+ lib/sqlalchemy/util/_concurrency_py3k.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/sqlalchemy/util/_concurrency_py3k.py b/lib/sqlalchemy/util/_concurrency_py3k.py
+index 1e4ffef..5aaf12c 100644
+--- a/lib/sqlalchemy/util/_concurrency_py3k.py
++++ b/lib/sqlalchemy/util/_concurrency_py3k.py
+@@ -190,6 +190,8 @@ def get_event_loop():
+         try:
+             return asyncio.get_running_loop()
+         except RuntimeError:
+-            return asyncio.get_event_loop_policy().get_event_loop()
++            loop = asyncio.new_event_loop()
++            asyncio.set_event_loop(loop)
++            return loop
+     else:
+         return asyncio.get_event_loop()
+-- 
+2.54.0
+
diff --git a/pkgs/development/python-modules/sqlalchemy/1_3.nix b/pkgs/development/python-modules/sqlalchemy/1_3.nix
index b57cd123a030..38670bc2b31c 100644
--- a/pkgs/development/python-modules/sqlalchemy/1_3.nix
+++ b/pkgs/development/python-modules/sqlalchemy/1_3.nix
@@ -37,6 +37,8 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-6qAjyqMVrugABHssAQuql3z1YHTAOSm5hARJuJXJJvo=";
   };
 
+  patches = [ ./1.3-0001-fix-create-new-event-loop-if-not-exists.patch ];
+
   postPatch = ''
     sed -i '/tag_build = dev/d' setup.cfg
   '';
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 06946cc2ef2a..4b6a7c7aeca6 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -605,9 +605,21 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
       "x86_64-darwin"
     ];
     knownVulnerabilities = [
+      "CVE-2026-25960"
       "CVE-2026-27893"
+      "CVE-2026-41523"
       "CVE-2026-44222"
       "CVE-2026-44223"
+      "CVE-2026-47155"
+      "CVE-2026-48746"
+      "CVE-2026-53923"
+      "CVE-2026-54232"
+      "CVE-2026-54233"
+      "CVE-2026-54234"
+      "CVE-2026-54235"
+      "CVE-2026-54236"
+      "CVE-2026-55514"
+      "CVE-2026-55574"
     ];
   };
 })
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4a6fee8d59fc..e80d473aa1a9 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -53,8 +53,8 @@ let
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.10.0";
-      hash = "sha256-YgtmBepPYvxWptCphzP0eQcdAyHgPkhrUix+mnRhdDE=";
+      version = "11.11.0";
+      hash = "sha256-he8u/yFqGukIBMAMjfv6ZoU1NkRlDRCQaok8Ba7c2IQ=";
     };
   };