diff --git a/nixos/modules/services/matrix/mautrix-meta.nix b/nixos/modules/services/matrix/mautrix-meta.nix
index a0576c79edb3..9fbd58b18d2a 100644
--- a/nixos/modules/services/matrix/mautrix-meta.nix
+++ b/nixos/modules/services/matrix/mautrix-meta.nix
@@ -18,6 +18,7 @@ let
   settingsFileUnsubstituted = cfg: settingsFormat.generate "mautrix-meta-config.yaml" cfg.settings;
 
   metaName = name: "mautrix-meta-${name}";
+  packageName = network: if network == "instagram" then "mautrix-instagram" else "mautrix-meta";
 
   enabledInstances = lib.filterAttrs (
     name: config: config.enable
@@ -200,8 +201,10 @@ in
                   '';
                   description = ''
                     {file}`config.yaml` configuration as a Nix attribute set.
-                    Configuration options should match those described in
-                    [example-config.yaml](https://github.com/mautrix/meta/blob/main/example-config.yaml).
+                    Configuration options should match those described in the example configuration.
+                    Get an example configuration by executing one of those commands
+                      - `mautrix-meta -c example.yaml --generate-example-config`
+                      - `mautrix-instagram -c example.yaml --generate-example-config`
 
                     Secret tokens should be specified using {option}`environmentFile`
                     instead
@@ -471,7 +474,7 @@ in
               cp '${settingsFile cfg}' '${settingsFile cfg}.tmp'
 
               echo "Generating registration file"
-              mautrix-meta \
+              ${lib.getExe' upperCfg.package (packageName cfg.settings.network.mode)} \
                 --generate-registration \
                 --config='${settingsFile cfg}.tmp' \
                 --registration='${cfg.registrationFile}'
@@ -568,7 +571,7 @@ in
               EnvironmentFile = cfg.environmentFile;
 
               ExecStart = lib.escapeShellArgs [
-                (lib.getExe upperCfg.package)
+                (lib.getExe' upperCfg.package (packageName cfg.settings.network.mode))
                 "--config=${settingsFile cfg}"
               ];
             };
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 2130427813f5..412426a217f0 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -214,7 +214,13 @@ in
       abi <abi/4.0>,
       include <tunables/global>
 
-      profile ${cfg.package}/bin/miniflux {
+      # Flag `attach_disconnected` is necessary
+      # because the PostgreSQL socket path appears
+      # as a "disconnected" path: `run/postgresql/.s.PGSQL.XXXX`,
+      # without the trailing slash, which AppArmor can't resolve.
+      # The flag prepends a `/`, which isn't recommended,
+      # but there aren't any alternative currently.
+      profile ${cfg.package}/bin/miniflux flags=(attach_disconnected) {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
@@ -222,6 +228,8 @@ in
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         ${cfg.package}/bin/miniflux r,
         /run/miniflux/** rw,
+        /run/postgresql/.s.PGSQL.* rw,
+        /run/credentials/** r,
         include if exists <local/bin.miniflux>
       }
     '';
diff --git a/nixos/tests/matrix/mautrix-meta-postgres.nix b/nixos/tests/matrix/mautrix-meta-postgres.nix
index b1ecf5da3cdd..bf28b889ecec 100644
--- a/nixos/tests/matrix/mautrix-meta-postgres.nix
+++ b/nixos/tests/matrix/mautrix-meta-postgres.nix
@@ -90,12 +90,21 @@ in
               as_token = "$AS_TOKEN";
               hs_token = "$HS_TOKEN";
 
-              database = {
-                type = "postgres";
-                uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
+              bot = {
+                username = botUserName;
+                avatar = "";
               };
+            };
 
-              bot.username = botUserName;
+            database = {
+              type = "postgres";
+              uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${userName}:server" = "user";
@@ -127,13 +136,14 @@ in
               import functools
               import asyncio
 
-              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
+              from nio import AsyncClient, RoomMessageText, RoomCreateResponse, RoomInviteResponse
 
 
-              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+              async def message_callback(matrix: AsyncClient, expected_msg: str, expected_sender: str, _r, e):
                   print("Received matrix text message: ", e)
-                  assert msg in e.body
-                  exit(0)  # Success!
+                  if getattr(e, "sender", "") == expected_sender and expected_msg in getattr(e, "body", ""):
+                      print("Success!")
+                      exit(0)  # Success!
 
 
               async def run(homeserver: str):
@@ -151,9 +161,9 @@ in
                   assert isinstance(response, RoomInviteResponse)
 
                   callback = functools.partial(
-                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                      message_callback, matrix, "Hello, I'm a Instagram bridge bot.", "@${botUserName}:${homeserverDomain}"
                   )
-                  matrix.add_event_callback(callback, RoomMessageNotice)
+                  matrix.add_event_callback(callback, RoomMessageText)
 
                   print("Waiting for matrix message...")
                   await matrix.sync_forever(timeout=30000)
@@ -171,11 +181,10 @@ in
     def extract_token(data):
         stdout = data[1]
         stdout = stdout.strip()
-        line = stdout.split('\n')[-1]
-        return line.split(':')[-1].strip("\" '\n")
+        return stdout.split(':')[-1].strip("\" '\n")
 
     def get_token_from(token, file):
-        data = server.execute(f"cat {file} | grep {token}")
+        data = server.execute(f"grep -E '^\\s*{token}:' {file}")
         return extract_token(data)
 
     def get_as_token_from(file):
diff --git a/nixos/tests/matrix/mautrix-meta-sqlite.nix b/nixos/tests/matrix/mautrix-meta-sqlite.nix
index d4692dec718e..085910eeb19b 100644
--- a/nixos/tests/matrix/mautrix-meta-sqlite.nix
+++ b/nixos/tests/matrix/mautrix-meta-sqlite.nix
@@ -4,7 +4,7 @@ let
   homeserverUrl = "http://server:8008";
   username = "alice";
   instagramBotUsername = "instagrambot";
-  facebookBotUsername = "facebookbot";
+  metaBotUsername = "metabot";
 in
 {
   name = "mautrix-meta-sqlite";
@@ -60,7 +60,16 @@ in
             appservice = {
               port = 8009;
 
-              bot.username = facebookBotUsername;
+              bot = {
+                username = metaBotUsername;
+                avatar = "";
+              };
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${username}:server" = "user";
@@ -79,7 +88,16 @@ in
             appservice = {
               port = 8010;
 
-              bot.username = instagramBotUsername;
+              bot = {
+                username = instagramBotUsername;
+                avatar = "";
+              };
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${username}:server" = "user";
@@ -136,16 +154,17 @@ in
               import functools
               import asyncio
 
-              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
+              from nio import AsyncClient, RoomMessageText, RoomCreateResponse, RoomInviteResponse
 
 
-              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+              async def message_callback(matrix: AsyncClient, expected_msg: str, expected_sender: str, _r, e):
                   print("Received matrix text message: ", e)
-                  assert msg in e.body
-                  exit(0)  # Success!
+                  if getattr(e, "sender", "") == expected_sender and expected_msg in getattr(e, "body", ""):
+                      print("Success!")
+                      exit(0)  # Success!
 
 
-              async def run(username: str, bot_username: str, homeserver: str):
+              async def run(username: str, bot_username: str, homeserver: str, expected_msg: str):
                   matrix = AsyncClient(homeserver, f"@{username}:${homeserverDomain}")
 
                   response = await matrix.login("foobar")
@@ -161,16 +180,16 @@ in
                   assert isinstance(response, RoomInviteResponse)
 
                   callback = functools.partial(
-                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                      message_callback, matrix, expected_msg, f"@{bot_username}:${homeserverDomain}"
                   )
-                  matrix.add_event_callback(callback, RoomMessageNotice)
+                  matrix.add_event_callback(callback, RoomMessageText)
 
                   print("Waiting for matrix message...")
                   await matrix.sync_forever(timeout=30000)
 
 
               if __name__ == "__main__":
-                  asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3]))
+                  asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]))
             ''
           )
         ];
@@ -181,11 +200,10 @@ in
     def extract_token(data):
         stdout = data[1]
         stdout = stdout.strip()
-        line = stdout.split('\n')[-1]
-        return line.split(':')[-1].strip("\" '\n")
+        return stdout.split(':')[-1].strip("\" '\n")
 
     def get_token_from(token, file):
-        data = server.execute(f"cat {file} | grep {token}")
+        data = server.execute(f"grep -E '^\\s*{token}:' {file}")
         return extract_token(data)
 
     def get_as_token_from(file):
@@ -216,8 +234,8 @@ in
         client.succeed("register_user ${username} ${homeserverUrl} >&2")
 
     with subtest("ensure messages can be exchanged"):
-        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
-        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${metaBotUsername} ${homeserverUrl} \"Hello, I'm a Facebook Messenger bridge bot.\" >&2")
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} \"Hello, I'm a Instagram bridge bot.\" >&2")
 
     with subtest("ensure as_token and hs_token stays same after restart"):
         generated_as_token_facebook = get_as_token_from(config_yaml)
@@ -252,7 +270,7 @@ in
         assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the registration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
 
     with subtest("ensure messages can be exchanged after restart"):
-        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
-        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} \"Hello, I'm a Instagram bridge bot.\" >&2")
+        client.succeed("do_test ${username} ${metaBotUsername} ${homeserverUrl} \"Hello, I'm a Facebook Messenger bridge bot.\" >&2")
   '';
 }
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index 3bdf4480e7e2..549dd4966439 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -29,6 +29,7 @@ in
     default =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -38,6 +39,7 @@ in
     withoutSudo =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -48,6 +50,7 @@ in
     customized =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           config = {
@@ -82,6 +85,7 @@ in
     externalDb =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           createDatabaseLocally = false;
@@ -105,6 +109,7 @@ in
       machine.succeed(
           f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
       )
+      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     default.start()
     withoutSudo.start()
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
index 919ed99f4b5d..25bd5295f68c 100644
--- a/nixos/tests/opencloud.nix
+++ b/nixos/tests/opencloud.nix
@@ -21,12 +21,14 @@ let
         from selenium.webdriver.common.by import By
         from selenium.webdriver import Firefox
         from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.firefox.service import Service
         from selenium.webdriver.support.ui import WebDriverWait
         from selenium.webdriver.support import expected_conditions as EC
 
         options = Options()
         options.add_argument('--headless')
-        driver = Firefox(options=options)
+        service = Service(executable_path="${lib.getExe pkgs.geckodriver}")
+        driver = Firefox(options=options, service=service)
 
         host = sys.argv[1]
         user = sys.argv[2]
@@ -71,6 +73,7 @@ in
       environment = {
         ADMIN_PASSWORD = adminPassword;
         IDM_CREATE_DEMO_USERS = "true";
+        IDM_LDAPS_ADDR = "127.0.0.1:9235";
         IDM_LDAPS_CERT = "${certs.${domain}.cert}";
         IDM_LDAPS_KEY = "${certs.${domain}.key}";
         OC_INSECURE = "false";
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index f78ba2306d10..8935ef5e314f 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "154.0b9";
+  version = "154.0b10";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a374ecaf21678f0cca685eed7a09763b3f14ac3d4415c27227a4e06f050042df5e31ade4188d3ab7191102b811b1161638336b41d9de82b9527d39049fe0d3d2";
+    sha512 = "ddbe3ff45217a16df9eecfac52fcb12425accae76457e7054b20bd085f5b22908940a20448f213c3dc62d1276bb1c81f38194432336ba97459b2c17393ebd3cd";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index 1314ad2eb9d8..d9918265f160 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "154.0b9";
+  version = "154.0b10";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "83d15ab019fd49076f21574770c27e04d431b5b230d4bb3246a2c9190e26ae3f626bdb8241905bc91b87803586f312e4f6cfd7ce7908e5766fb1aa6a0669cff6";
+    sha512 = "e2275579e4769a0690010d8fbba528a0e347d86f0dc981d1702b3e627d9c73f3fd7399d3e618c514bf6a3c0059fa3aa5a29f9cdec802e52955a03b1122ca8d39";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 1211101245e7..5a7e936addda 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -14,7 +14,7 @@
   librusty_v8 ? callPackage ./librusty_v8.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
   },
-  livekit-libwebrtc,
+  lld,
   makeBinaryWrapper,
   nix-update-script,
   pkg-config,
@@ -25,39 +25,40 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.133.0";
+  version = "0.146.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-RTxhhZjZ/64N60pmbNVzLwcSBomn67pPDpOjkL6RPUw=";
+    hash = "sha256-/kTIOX/klxm1nq2bJsBqS8f1jZZp2ilaTeULQFPJgDk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-J4wvPn4lSTSsJrTG56vkhJe2F2b+fUvJLEd+qKQ9LUg=";
+  cargoHash = "sha256-N9jbH/cgAyu2QxneSnpkdaF0MgV3ZtDmN9q6rr9u+hE=";
 
-  # Match upstream's release build for the codex binary only.
+  __structuredAttrs = true;
+
+  # Match upstream's release build for the codex binary, plus its
+  # codex-code-mode-host runtime companion for out-of-process V8 execution.
   cargoBuildFlags = [
     "--package"
     "codex-cli"
+    "--package"
+    "codex-code-mode-host"
   ];
   cargoCheckFlags = [
     "--package"
     "codex-cli"
+    "--package"
+    "codex-code-mode-host"
   ];
 
   postPatch = ''
-    # webrtc-sys asks rustc to link libwebrtc statically by default,
-    # but nixpkgs provides libwebrtc as a shared library.
-    # use LK_CUSTOM_WEBRTC to point to the packaged library and adjust linking
-    # to use the shared library instead
-    substituteInPlace $cargoDepsCopy/*/webrtc-sys-*/build.rs \
-      --replace-fail "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dylib=webrtc"
     substituteInPlace Cargo.toml \
-      --replace-fail 'lto = "fat"' "" \
-      --replace-fail 'codegen-units = 1' ""
+      --replace-fail 'lto = "thin"' "" \
+      --replace-fail 'codegen-units = 4' ""
   '';
 
   nativeBuildInputs = [
@@ -83,7 +84,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # character-conversion warning-as-error disabled.
   env = {
     LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-    LK_CUSTOM_WEBRTC = lib.getDev livekit-libwebrtc;
     NIX_CFLAGS_COMPILE = toString (
       lib.optionals stdenv.cc.isGNU [
         "-Wno-error=stringop-overflow"
@@ -93,6 +93,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ]
     );
     RUSTY_V8_ARCHIVE = librusty_v8;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert
+    # ARM64 branch thunks for this binary, producing `b(l) ARM64 branch out of range`.
+    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' lld "ld64.lld"}";
   };
 
   # NOTE: part of the test suite requires access to networking, local shells,
diff --git a/pkgs/by-name/do/domination/package.nix b/pkgs/by-name/do/domination/package.nix
index 736ee6533a8a..c20b07542e65 100644
--- a/pkgs/by-name/do/domination/package.nix
+++ b/pkgs/by-name/do/domination/package.nix
@@ -30,7 +30,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "domination";
-  version = "1.3.4";
+  version = "1.3.5";
 
   # The .zip releases do not contain the build.xml file
   src = fetchsvn {
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
     # https://sourceforge.net/p/domination/code/HEAD/tree/Domination/ChangeLog.txt
     # Alternatively, look for revs like "changelog update",
     # "new version x.y.z info on website", or "website update for x.y.z".
-    rev = "2664";
-    hash = "sha256-bkaHpqJSc3UvwNT7LwuPUT8xN0g6QypfLSHlLmm8nX8=";
+    rev = "2778";
+    hash = "sha256-OsCpSL/0QgaaUAzoyPPrAlJixRlqsLJu2D8FkEuo0Ak=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eq/equibop/node-modules.nix b/pkgs/by-name/eq/equibop/node-modules.nix
index b1168f7e2073..d095089c7967 100644
--- a/pkgs/by-name/eq/equibop/node-modules.nix
+++ b/pkgs/by-name/eq/equibop/node-modules.nix
@@ -50,8 +50,8 @@ stdenvNoCC.mkDerivation {
 
   outputHash =
     {
-      x86_64-linux = "sha256-dLATw5Mb9grQnI/JTdlRdNP2JETELeqY8aXqb5dCXOA=";
-      aarch64-linux = "sha256-Zrk0aTHw7nrN6lKFa/ap7Hz1OJwnY4jtCLw2KWWqyJQ=";
+      x86_64-linux = "sha256-TKFL47b+Xh8ChlSyXdhRY+zmPAnkHJss2vNblBvOSmw=";
+      aarch64-linux = "sha256-S5JNtQvDLFrOT+XCSMqFltrTlcRAzWcbXbRZk4CEkrA=";
     }
     .${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 74a2ed33ed2d..19b7a58fbc35 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -6,7 +6,7 @@
   makeWrapper,
   makeDesktopItem,
   copyDesktopItems,
-  electron_41,
+  electron_43,
   python3Packages,
   pipewire,
   libpulseaudio,
@@ -18,17 +18,17 @@
   withMiddleClickScroll ? false,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "equibop";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "Equicord";
     repo = "Equibop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WqfxrVAJvD6Y6ZjkhbvibL6Bps7PL2lx3JBY94Yd6kk=";
+    hash = "sha256-foKgtyN1jr4+PHwJHTVXrYzWNVYtR1Sq8rLG4VEnujs=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail -baseline ""
   '';
 
-  node-modules = callPackage ./node-modules.nix { };
+  node-modules = callPackage ./node-modules.nix { equibop = finalAttrs.finalPackage; }; # helps when the parent package is overidden
 
   nativeBuildInputs = [
     bun
diff --git a/pkgs/by-name/fi/fittrackee/package.nix b/pkgs/by-name/fi/fittrackee/package.nix
index f261ac07eae6..de8b77f8f573 100644
--- a/pkgs/by-name/fi/fittrackee/package.nix
+++ b/pkgs/by-name/fi/fittrackee/package.nix
@@ -112,5 +112,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       tebriel
       traxys
     ];
+    knownVulnerabilities = [
+      # https://github.com/SamR1/FitTrackee/security/advisories/GHSA-rc38-72q6-pc7w
+      "GHSA-rc38-72q6-pc7w: JWT logout bypass in FitTrackee"
+    ];
   };
 })
diff --git a/pkgs/by-name/li/libvirt/package.nix b/pkgs/by-name/li/libvirt/package.nix
index 45bb395d06d0..2b2b50a61a7d 100644
--- a/pkgs/by-name/li/libvirt/package.nix
+++ b/pkgs/by-name/li/libvirt/package.nix
@@ -135,6 +135,26 @@ stdenv.mkDerivation rec {
   patches = [
     ./0001-meson-patch-in-an-install-prefix-for-building-on-nix.patch
 
+    # CVE-2026-15268
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/f74495c7a157618e3df6fa61079678084c4cc685.patch";
+      hash = "sha256-ZOC7ApQiowMyLC0iB51rwDe4dIDwRmpFHpdAdHnEjHY=";
+    })
+    # CVE-2026-18917
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f.patch";
+      hash = "sha256-EjNp97J2++Wn7MLFaC99HPsJYUj4Nid8Fuk8fGq3Cis=";
+    })
+    # CVE-2026-63622
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b.patch";
+      hash = "sha256-balBw0Rs2fSrnOeeiaqKRDnloXIWA1eITuciaZQ7zsk=";
+    })
+    # CVE-2026-63623
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825.patch";
+      hash = "sha256-3UCMOVOq//bKkKfRsn9NVq1j9rN3CZlBOsEeYQufleU=";
+    })
     # CVE-2026-61478
     (fetchpatch {
       url = "https://gitlab.com/libvirt/libvirt/-/commit/68da70aae766c6271b8d3b466374d3cc7d1a8afb.patch";
diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index 52eb60bc9c23..0dbbda460bde 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -6,14 +6,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.5";
+  version = "4.6.6";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-ZTqVCsiYEvEHACgtIfj1V7jlFXuFoxrfERvr/7bAgac=";
+    hash = "sha256-V/mhT11IJ60kT7Q1dP17XOEUIVGNuJoitseDBX1sbjI=";
     passthru = {
       inherit version;
       yarnHash = "sha256-VlOG91ZuO+1UXTbtwIrYUbqHjmSfPSfLhrf4TxCJqJ0=";
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index 437f5622a114..5a7ce245476b 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -18,7 +18,10 @@ buildGoModule rec {
   version = "26.05";
   tag = "v0.2605.0";
 
-  subPackages = [ "cmd/mautrix-meta" ];
+  subPackages = [
+    "cmd/mautrix-meta"
+    "cmd/mautrix-instagram"
+  ];
 
   src = fetchFromGitHub {
     owner = "mautrix";
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index d45cf16afd54..1d7f65bda3e5 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -2,9 +2,10 @@
   stdenvNoCC,
   lib,
   opencloud,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   nodejs,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -16,35 +17,30 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
+    pnpm = pnpm_11;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-    fetcherVersion = 3;
-    hash = "sha256-E0bP15T2Ekj992Y1xFXL/4rko34AY+I5Lbn+blJhXYg=";
+    fetcherVersion = 4;
+    hash = "sha256-pQ01vBvC29B5oxDWtt7anI5QtFbvQFFBVamQtA2WTNo=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpmBuildHook
+    pnpm_11
   ];
 
-  buildPhase = ''
-    runHook preBuild
-
-    cd $pnpmRoot
-    pnpm build
-    mkdir -p assets/identifier/static
-    cp -v src/images/favicon.svg assets/identifier/static/favicon.svg
-    cp -v src/images/icon-lilac.svg assets/identifier/static/icon-lilac.svg
-
-    runHook postBuild
+  postBuild = ''
+    mkdir -p services/idp/assets/identifier/static
+    cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
+    cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
   '';
 
   installPhase = ''
     runHook preInstall
 
     mkdir $out
-    cp -r assets $out
+    cp -r services/idp/assets $out
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 9e18e43206c6..983299455638 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "7.0.0";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5bGsJcmrF01E0zXKxwRQpTZl/OinfW7da3nf3/T74hg=";
+    hash = "sha256-GAoDEXk7sBN7N0V/msi/fcJS72RqqlF6Qb5B9hArmvk=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 1a33c6925eb3..13e0d4a25879 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -3,33 +3,33 @@
   stdenvNoCC,
   fetchFromGitHub,
   nodejs,
-  pnpm_10,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "7.0.1";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kkNdP3IpWnfOv5GEhQqKJwnnRXCHyxMcI2RA6vK7NrA=";
+    hash = "sha256-BiOue8+zQ3+6RLiDbLMnxKEen2aav3bljji4d+0Hr5c=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
-    fetcherVersion = 3;
-    hash = "sha256-Md6KcP5BV9Pskqg+o9D3RD0WconqyiizAvXNMZ9htfw=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-gCsgnOEi9rvtwTZy8J/i63D92Gl2V9ZihxCJ+Y5hLUE=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_11
   ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/pd/pdfding/package.nix b/pkgs/by-name/pd/pdfding/package.nix
index c31c6ef1d0ec..c2b7ad980447 100644
--- a/pkgs/by-name/pd/pdfding/package.nix
+++ b/pkgs/by-name/pd/pdfding/package.nix
@@ -141,6 +141,7 @@ python.pkgs.buildPythonPackage (finalAttrs: {
     "huey"
     "nh3"
     "psycopg2-binary"
+    "pypdf"
     "pypdfium2"
   ];
 
diff --git a/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix b/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix
index 8eee84e785da..35418e89eae5 100644
--- a/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix
@@ -7,13 +7,13 @@
 buildGoModule (finalAttrs: {
   __structuredAttrs = true;
   pname = "prometheus-speedtest-exporter";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "podocarp";
     repo = "speedtest_exporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n9eunZRssS13mTOeFeZ/PpfSj430DKf3ZRS10hY4Ps8=";
+    hash = "sha256-xXTyxwECGlYv9bBco09zvlOpF4GcHeT3yZMNUQTPPoo=";
   };
 
   vendorHash = "sha256-HBg44D0CUc4HYCBwGrswnrqG5o5ltA6UT8L0oWetlIc=";
diff --git a/pkgs/by-name/ra/radicle-desktop/package.nix b/pkgs/by-name/ra/radicle-desktop/package.nix
index 25e83ab44e24..b10fed53e593 100644
--- a/pkgs/by-name/ra/radicle-desktop/package.nix
+++ b/pkgs/by-name/ra/radicle-desktop/package.nix
@@ -26,13 +26,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-desktop";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z4D5UCArafTzTQpDZNQRuqswh3ury";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-yT51MCHt00JEUbuC6rcXN3L4Vul3aBa8YCgpGVzM5rQ=";
+    hash = "sha256-L5QfFvswU/iPgObhh09/SAlMRy5w+Qs1kXDGpY31wjA=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -53,10 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-HsPz3S2TL7TJzDU7c7IWgT7kO+FkloMsAWc8g5ZKofw=";
+    hash = "sha256-4gRc/nNrOEi7PU+5bSsR22z3f55cINebSrlFQ1NGTfk=";
   };
 
-  cargoHash = "sha256-BTSmfMrxNwAdoPuYn4hbx9C9myE1wJh+1FXPG78IgeU=";
+  cargoHash = "sha256-DZM1YX3lzCvKGtrSxxeJkinR91HFWe5SpdqQ+oP1Hgc=";
 
   twemojiAssets = fetchFromGitHub {
     owner = "twitter";
diff --git a/pkgs/by-name/xw/xwayland-satellite/package.nix b/pkgs/by-name/xw/xwayland-satellite/package.nix
index 9c8ea3f12b3f..55440713e509 100644
--- a/pkgs/by-name/xw/xwayland-satellite/package.nix
+++ b/pkgs/by-name/xw/xwayland-satellite/package.nix
@@ -11,16 +11,15 @@
   xwayland,
   withSystemd ? true,
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xwayland-satellite";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Supreeeme";
     repo = "xwayland-satellite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BUE41HjLIGPjq3U8VXPjf8asH8GaMI7FYdgrIHKFMXA=";
+    hash = "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=";
   };
 
   postPatch = ''
@@ -28,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/local/bin' "$out/bin"
   '';
 
-  cargoHash = "sha256-16L6gsvze+m7XCJlOA1lsPNELE3D364ef2FTdkh0rVY=";
+  cargoHash = "sha256-Saa3SRsQuY6u6pfBGezaEExOt/ReblnrG7pAXjA6Dk8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index 13eb53bd54cb..9930dd0af21b 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.12";
+  version = "1.25.13";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-+Q3O5L0CP6N2N06gpabr5VNTeznEJv/YxolGm0VRmTI=";
+    hash = "sha256-HX4vcLHum5PH3478ynH1rcxqWXl6QzbC0QFxvUwXRhQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/go/1.27.nix b/pkgs/development/compilers/go/1.27.nix
index 3a553d29a1c5..b6a0efa1040e 100644
--- a/pkgs/development/compilers/go/1.27.nix
+++ b/pkgs/development/compilers/go/1.27.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.27rc2";
+  version = "1.27rc3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-hg/XowsoXuFqKuDsXURBy0fEiHKgowy2DK40iUf0iiU=";
+    hash = "sha256-6eIO3RcgCV+RCWluljpmBp0/bUjQDrk4jIiM4GYx31w=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 1d7b5fe795e0..b377eaf6d1f1 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -47,10 +47,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "15";
+        patch = "16";
         suffix = "";
       };
-      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
+      hash = "sha256-kbzev93iOaADrpNzin/OD5Iw/uXEvCuG9uboxvmKq+g=";
       inherit passthruFun;
     };
 
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "13";
+        patch = "14";
         suffix = "";
       };
-      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
+      hash = "sha256-XIRir1eQuvQ6MhoVWdvg2wbRvkMA+4X7U8QAYGaOVIo=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index 24c6076065e9..4c8cb142a090 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -12,9 +12,11 @@
   myst-parser,
 
   # optionals
+  arabic-reshaper,
   cryptography,
   fonttools,
   pillow,
+  python-bidi,
 
   # tests
   fpdf2,
@@ -24,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "6.14.2";
+  version = "6.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -33,7 +35,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-h7JuQTTUZ5tWoAhixjp+grDVA3JQ8PbHcMBzIyCMOJU=";
+    hash = "sha256-e39xclCnXlX4oagx4TnFCf99VKdJZeM2Kc3set1KXuo=";
   };
 
   outputs = [
@@ -55,10 +57,14 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = rec {
-    full = crypto ++ fonts ++ image;
+    full = crypto ++ fonts ++ image ++ rtl_text;
     crypto = [ cryptography ];
     fonts = [ fonttools ];
     image = [ pillow ];
+    rtl_text = [
+      arabic-reshaper
+      python-bidi
+    ];
   };
 
   pythonImportsCheck = [ "pypdf" ];
diff --git a/pkgs/development/python-modules/whenever/default.nix b/pkgs/development/python-modules/whenever/default.nix
index b76997879701..7767a5601904 100644
--- a/pkgs/development/python-modules/whenever/default.nix
+++ b/pkgs/development/python-modules/whenever/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "whenever";
-  version = "0.10.4";
+  version = "0.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ariebovenberg";
     repo = "whenever";
     tag = version;
-    hash = "sha256-yDI5TAnEyVPNYXqsCEitFrQnk+Ed0CyRKcCykxFqeWU=";
+    hash = "sha256-axysocowBamYcNZ9IS58SefSltWC8mdO1Ovf65vMxTk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/servers/kanidm/1_11.nix b/pkgs/servers/kanidm/1_11.nix
index c06b30750207..f32d50c1d5b1 100644
--- a/pkgs/servers/kanidm/1_11.nix
+++ b/pkgs/servers/kanidm/1_11.nix
@@ -1,5 +1,5 @@
 import ./generic.nix {
-  version = "1.11.0";
-  hash = "sha256-3dcJxJx8UFebW6WMdVTH6kfsNBed+55JFwHWVhZulOU=";
-  cargoHash = "sha256-qOs/uSs3iaiTGsqydpNbZ6KSLNE+k+5bM7k3ijRzNT0=";
+  version = "1.11.1";
+  hash = "sha256-IQmXHl+Gx7QLuLUCmIh919o+ziCy2q2NvVabwQwhML0=";
+  cargoHash = "sha256-DSYynKWb9jjFp3u3c6z9dFXts8ydgEho7xoFlL6cPXs=";
 }
diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index 184d0a7b3b73..32855ec6c21a 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "14.23";
-  rev = "refs/tags/REL_14_23";
-  hash = "sha256-fjoboaUhrHFDqusmIXzSS5ZnIpSRHO9+qcqvkchl2dM=";
+  version = "14.24";
+  rev = "refs/tags/REL_14_24";
+  hash = "sha256-yfZJFXk10vJ4QEhbUXe1gtz8rBS2YOEcD3unEjSHzjk=";
   muslPatches = {
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/disable-test-collate.icu.utf8.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index 633131478a21..3db632cdaa2a 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "15.18";
-  rev = "refs/tags/REL_15_18";
-  hash = "sha256-tw1zzgLXx7Jr4bi8rMKRmTJzOSQFGvrP2nHr9FcVrjs=";
+  version = "15.19";
+  rev = "refs/tags/REL_15_19";
+  hash = "sha256-y5QarcJSMifu+ctjsQOdG/Njo9KvFvIgncBJBjCVG3Y=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql15/dont-use-locale-a-on-musl.patch?id=f424e934e6d076c4ae065ce45e734aa283eecb9c";
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index 22027d48d97c..2aceefec3074 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "16.14";
-  rev = "refs/tags/REL_16_14";
-  hash = "sha256-g2+OdB2dGIKBSFJ24Z3Yy7oRAFywNMSVDdWfnsaeJJQ=";
+  version = "16.15";
+  rev = "refs/tags/REL_16_15";
+  hash = "sha256-HHNROwOzfTatZif+hog/DZnDafV+mZ2Z9Jrq87XN0cY=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql16/dont-use-locale-a-on-musl.patch?id=08a24be262339fd093e641860680944c3590238e";
diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix
index c5298a23de81..20fc50661101 100644
--- a/pkgs/servers/sql/postgresql/17.nix
+++ b/pkgs/servers/sql/postgresql/17.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "17.10";
-  rev = "refs/tags/REL_17_10";
-  hash = "sha256-3ZAqlT3R8ywhNH13oqz2VUbSwpOJ2JaICbxZ29awaMw=";
+  version = "17.11";
+  rev = "refs/tags/REL_17_11";
+  hash = "sha256-pkVBg4Rxku3rEnNhPvVoAoab55vqrDqZfW1z+umealE=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/servers/sql/postgresql/18.nix b/pkgs/servers/sql/postgresql/18.nix
index 4d70b2474f27..0650fd2fb1b3 100644
--- a/pkgs/servers/sql/postgresql/18.nix
+++ b/pkgs/servers/sql/postgresql/18.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "18.4";
-  rev = "refs/tags/REL_18_4";
-  hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
+  version = "18.6";
+  rev = "refs/tags/REL_18_6";
+  hash = "sha256-ySffxlG7jlNyzx++BmIN+WuaQ9TMAJt/qER9wIjd6B8=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";