diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 177671d046e3a..4c899ccbbcb65 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -53,6 +53,10 @@
 
 - `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
 
+- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
+
+- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 109391639f535..0879bd0440696 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14958,6 +14958,11 @@
     githubId = 361496;
     name = "Nikola Knežević";
   };
+  koalalorenzo = {
+    name = "Lorenzo Setale";
+    github = "koalalorenzo";
+    githubId = 33528;
+  };
   koffydrop = {
     github = "koffydrop";
     githubId = 67888720;
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 27be44d30b25b..06582cf0d3056 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -65,6 +65,24 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
+  "module-services-lxmd": [
+    "index.html#module-services-lxmd"
+  ],
+  "module-services-lxmd-communication-backbone": [
+    "index.html#module-services-lxmd-communication-backbone"
+  ],
+  "module-services-lxmd-communication-rpc": [
+    "index.html#module-services-lxmd-communication-rpc"
+  ],
+  "module-services-lxmd-communication-with-rnsd": [
+    "index.html#module-services-lxmd-communication-with-rnsd"
+  ],
+  "module-services-lxmd-health-check": [
+    "index.html#module-services-lxmd-health-check"
+  ],
+  "module-services-lxmd-quickstart": [
+    "index.html#module-services-lxmd-quickstart"
+  ],
   "module-services-mautrix-discord": [
     "index.html#module-services-mautrix-discord"
   ],
@@ -104,6 +122,18 @@
   "module-services-onedrive": [
     "index.html#module-services-onedrive"
   ],
+  "module-services-rnsd": [
+    "index.html#module-services-rnsd"
+  ],
+  "module-services-rnsd-hardware-access": [
+    "index.html#module-services-rnsd-hardware-access"
+  ],
+  "module-services-rnsd-health-check": [
+    "index.html#module-services-rnsd-health-check"
+  ],
+  "module-services-rnsd-quickstart": [
+    "index.html#module-services-rnsd-quickstart"
+  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index d4b6c2ce9a164..6b0c27a66ed48 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -58,6 +58,10 @@
 
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
+- [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
+
+- [LXMD](https://github.com/markqvist/LXMF), a universal, distributed and secure messaging protocol for Reticulum. Available as [services.lxmd](#opt-services.lxmd.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index ffe037697d952..608fef57b8acc 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1289,6 +1289,7 @@
   ./services/networking/logmein-hamachi.nix
   ./services/networking/lokinet.nix
   ./services/networking/lxd-image-server.nix
+  ./services/networking/lxmd.nix
   ./services/networking/magic-wormhole-mailbox-server.nix
   ./services/networking/matterbridge.nix
   ./services/networking/meshtasticd.nix
@@ -1386,6 +1387,7 @@
   ./services/networking/redsocks.nix
   ./services/networking/reframe.nix
   ./services/networking/resilio.nix
+  ./services/networking/rnsd.nix
   ./services/networking/robustirc-bridge.nix
   ./services/networking/rosenpass.nix
   ./services/networking/routedns.nix
diff --git a/nixos/modules/services/networking/lxmd.md b/nixos/modules/services/networking/lxmd.md
new file mode 100644
index 0000000000000..08e038fbfdd69
--- /dev/null
+++ b/nixos/modules/services/networking/lxmd.md
@@ -0,0 +1,225 @@
+# LXMD {#module-services-lxmd}
+
+[LXMF](https://github.com/markqvist/lxmf) daemon (`lxmd`).
+
+This module runs `lxmd` as a systemd service with `DynamicUser = true` and
+`StateDirectory = "lxmd"` directives.
+
+## Quickstart {#module-services-lxmd-quickstart}
+
+A minimal setup:
+
+```nix
+{
+  services.lxmd.enable = true;
+}
+```
+
+With custom LXMD and RNSD settings:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      propagation-node = {
+        autopeer = true;
+      };
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          require_shared_instance = true;
+          is_shared_instance = true;
+          enable_transport = true;
+          instance_name = "default";
+          shared_instance_type = "unix";
+        };
+      };
+    };
+  };
+}
+```
+
+At startup, settings provided through
+[`services.lxmd.settings`](#opt-services.lxmd.settings),
+[`services.lxmd.identityFile`](#opt-services.lxmd.identityFile), and
+[`services.lxmd.rnsd.settings`](#opt-services.lxmd.rnsd.settings) are copied
+into the service state directory.
+
+## Health Check {#module-services-lxmd-health-check}
+
+You can optionally wait for `lxmd` to become responsive during startup using
+`lxmd --status`:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    healthCheck = {
+      enable = true;
+      intervalSeconds = 2;
+      timeoutSeconds = 120;
+    };
+  };
+}
+```
+
+When enabled, startup fails if `lxmd --status` does not succeed before
+[`services.lxmd.healthCheck.timeoutSeconds`](#opt-services.lxmd.healthCheck.timeoutSeconds).
+
+## Communicating With RNSD {#module-services-lxmd-communication-with-rnsd}
+
+Even though both services are hardened (via Systemd's `DynamicUser = true` and
+`StateDirectory = "lxmd"` directives), `lxmd` can still communicate with `rnsd`
+in several ways.
+
+### Option 1: Shared Instance Over Unix RPC {#module-services-lxmd-communication-rpc}
+
+Use a shared Reticulum instance exposed through a local Unix RPC socket:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    identityFile = "<path-to-rnsd-identity-file>";
+
+    settings = {
+      reticulum = {
+        enable_transport = true;
+        share_instance = true;
+        instance_name = "default";
+        shared_instance_type = "unix";
+      };
+      interfaces = {
+        auto = {
+          type = "AutoInterface";
+          enabled = true;
+        };
+      };
+    };
+  };
+
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      # LXMD settings, run `lxmd --exampleconfig` for details
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          require_shared_instance = true;
+          is_shared_instance = true;
+          enable_transport = true;
+          instance_name = "default";
+          shared_instance_type = "unix";
+        };
+      };
+    };
+  };
+}
+```
+
+In this model, `lxmd` points to an RNS configuration that joins the shared
+instance. Both RNS transport identity files in `rnsd` and `lxmd` must be the
+same. If you use different transport identity files, then set the same `rpc_key`
+in both `rnsd` configurations to allow them to communicate securely.
+
+It is also possible to use a shared instance over TCP, please refer to the
+[Reticulum documentation](https://reticulum.network/manual/) for details.
+
+### Option 2: Isolated Instances Connected Through BackboneInterface {#module-services-lxmd-communication-backbone}
+
+Reticulum applications (`rnsd`, `lxmd`, and others) can be isolated by running:
+
+- one primary `rnsd` service instance as a non-privileged service account,
+- one instance per application, each with its own user and configuration,
+- a `BackboneInterface` between each isolated application instance and the
+  primary instance.
+
+On the primary `rnsd` instance, the `BackboneInterface` is configured to accept
+connections from the isolated instances, as such:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    identityFile = "<path-to-rnsd-identity-file>";
+
+    settings = {
+      reticulum = {
+        # RNSD settings, run `rnsd --exampleconfig` for details
+      };
+      interfaces = {
+        root = {
+          type = "BackboneInterface";
+          enabled = true;
+          mode = "gateway";
+          discoverable = true;
+          listen_ip = "127.0.0.1";
+          listen_port = 4242;
+        };
+      };
+    };
+  };
+}
+```
+
+Then, on each isolated application instance, the `BackboneInterface` is
+configured to connect to the primary instance:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      # LXMD settings, run `lxmd --exampleconfig` for details
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          # RNSD settings, run `rnsd --exampleconfig` for details
+        };
+        interfaces = {
+          local = {
+            type = "BackboneInterface";
+            enabled = true;
+            target_host = "127.0.0.1";
+            target_port = 4242;
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+The primary `rnsd` instance serves system-local `BackboneInterface` links for
+applications and external interfaces for the wider network. Each isolated app
+uses its own RNS configuration directory (for example with
+`--rnsconfig <path>`), and that local instance connects to the root instance
+through `BackboneInterface`.
+
+Running multiple instances increases memory usage and adds one extra hop, but
+the performance impact is generally negligible.
diff --git a/nixos/modules/services/networking/lxmd.nix b/nixos/modules/services/networking/lxmd.nix
new file mode 100644
index 0000000000000..017bba146c208
--- /dev/null
+++ b/nixos/modules/services/networking/lxmd.nix
@@ -0,0 +1,150 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.lxmd;
+  settingsFormat = pkgs.formats.configobj { };
+in
+{
+  options = {
+    services.lxmd = {
+      enable = lib.mkEnableOption "Enable Reticulum Network Lightweight Extensible Message Format Daemon (lxmd)";
+
+      package = lib.mkPackageOption pkgs "lxmf" { };
+      packageBinaryName = lib.mkOption {
+        type = lib.types.str;
+        default = "lxmd";
+        description = "Name of the program to use. Useful in case of using an alternative implementation.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.nullOr settingsFormat.type;
+        default = null;
+        description = "Structured lxmd configuration. The generated file is copied to the state directory on service start. Use `lxmd --exampleconfig` to get an example config file.";
+      };
+
+      identityFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Path to lxmd identity file. This file will be copied to the state directory on service start.";
+      };
+
+      rnsd = {
+        settings = lib.mkOption {
+          type = lib.types.nullOr settingsFormat.type;
+          default = null;
+          description = "Structured rnsd configuration. The generated file is copied to the state directory on service start. Use `rnsd --exampleconfig` to get an example config file.";
+        };
+
+        identityFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "Path to rnsd identity file. This file will be copied to the state directory on service start.";
+        };
+
+        identities = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          default = { };
+          description = "Map of identity names to paths of identity files.";
+        };
+      };
+
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional groups for the lxmd service user.";
+      };
+
+      healthCheck = {
+        enable = lib.mkEnableOption "wait for lxmd to become healthy after startup";
+
+        intervalSeconds = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 2;
+          description = "Delay in seconds between each `lxmd --status` health check attempt.";
+        };
+
+        timeoutSeconds = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 120;
+          description = "Maximum time in seconds to wait for `lxmd --status` to succeed during startup.";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.lxmd = {
+      description = "Reticulum Network Lightweight Extensible Message Format Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = lib.optionals config.services.rnsd.enable [ "rnsd.service" ];
+      wants = lib.optionals config.services.rnsd.enable [ "rnsd.service" ];
+
+      preStart =
+        let
+          copySettings = lib.optionalString (cfg.settings != null) ''
+            install -Dm600 ${settingsFormat.generate "lxmd.conf" cfg.settings} "$STATE_DIRECTORY"/lxmd/config
+          '';
+          copyIdentity = lib.optionalString (cfg.identityFile != null) ''
+            install -Dm600 ${cfg.identityFile} "$STATE_DIRECTORY"/lxmd/identity
+          '';
+          copyRnsdSettings = lib.optionalString (cfg.rnsd.settings != null) ''
+            install -Dm600 ${settingsFormat.generate "rnsd.conf" cfg.rnsd.settings} "$STATE_DIRECTORY"/rnsd/config
+          '';
+          copyRnsdIdentity = lib.optionalString (cfg.rnsd.identityFile != null) ''
+            install -Dm600 ${cfg.rnsd.identityFile} "$STATE_DIRECTORY"/rnsd/storage/transport_identity
+          '';
+          copyRnsdIdentities = lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (name: file: ''
+              install -Dm600 ${file} "$STATE_DIRECTORY"/rnsd/storage/identities/${name}
+            '') cfg.rnsd.identities
+          );
+        in
+        copyRnsdSettings + copyRnsdIdentity + copySettings + copyIdentity + copyRnsdIdentities;
+
+      serviceConfig =
+        let
+          waitForHealthy = pkgs.writeShellApplication {
+            name = "lxmd-wait-for-health";
+            runtimeInputs = [ pkgs.lxmf ];
+            text = ''
+              deadline=$((SECONDS + ${toString cfg.healthCheck.timeoutSeconds}))
+
+              until lxmd --status --config "$STATE_DIRECTORY"/lxmd --rnsconfig "$STATE_DIRECTORY"/rnsd >/dev/null 2>&1; do
+                if [ "$SECONDS" -ge "$deadline" ]; then
+                  echo "lxmd did not become healthy before timeout (${toString cfg.healthCheck.timeoutSeconds}s)" >&2
+                  exit 1
+                fi
+
+                sleep ${toString cfg.healthCheck.intervalSeconds}
+              done
+            '';
+          };
+        in
+        {
+          DynamicUser = true;
+          StateDirectory = "lxmd";
+          SupplementaryGroups = cfg.extraGroups;
+          RuntimeDirectory = "lxmd";
+          CacheDirectory = "lxmd";
+          ProtectSystem = "strict";
+
+          ExecStart = ''
+            ${lib.getExe' cfg.package cfg.packageBinaryName} --config ''${STATE_DIRECTORY}/lxmd --rnsconfig ''${STATE_DIRECTORY}/rnsd
+          '';
+        }
+        // lib.optionalAttrs cfg.healthCheck.enable {
+          ExecStartPost = lib.getExe waitForHealthy;
+          TimeoutStartSec = cfg.healthCheck.timeoutSeconds + 5;
+        };
+    };
+  };
+
+  meta = {
+    doc = ./lxmd.md;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/nixos/modules/services/networking/rnsd.md b/nixos/modules/services/networking/rnsd.md
new file mode 100644
index 0000000000000..5c2e466c31647
--- /dev/null
+++ b/nixos/modules/services/networking/rnsd.md
@@ -0,0 +1,87 @@
+# RNSD {#module-services-rnsd}
+
+[Reticulum Network Stack](https://reticulum.network/) daemon (`rnsd`).
+
+This module manages `rnsd` as a systemd service and stores runtime state under
+`/var/lib/rnsd`.
+
+## Quickstart {#module-services-rnsd-quickstart}
+
+A minimal setup:
+
+```nix
+{
+  services.rnsd.enable = true;
+}
+```
+
+With custom settings and a persistent identity:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    identityFile = "<path-to-rnsd-identity-file>";
+
+    settings = {
+      reticulum = {
+        enable_transport = true;
+        share_instance = true;
+        instance_name = "default";
+        shared_instance_type = "unix";
+      };
+      interfaces = {
+        auto = {
+          type = "AutoInterface";
+          enabled = true;
+        };
+      };
+      openMulticastPorts = true;
+    };
+  };
+}
+```
+
+At startup, settings provided through
+[`services.rnsd.settings`](#opt-services.rnsd.settings) and
+[`services.rnsd.identityFile`](#opt-services.rnsd.identityFile)
+are copied into the service state directory with restrictive permissions.
+
+## Hardware Access {#module-services-rnsd-hardware-access}
+
+If `rnsd` must access serial devices (for example `/dev/ttyACM0`), add the
+service user to additional groups:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+    extraGroups = [ "dialout" ];
+  };
+}
+```
+
+See [`services.rnsd.extraGroups`](#opt-services.rnsd.extraGroups) for details.
+
+## Health Check {#module-services-rnsd-health-check}
+
+You can optionally wait for `rnsd` to become responsive during startup using
+`rnstatus`:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    healthCheck = {
+      enable = true;
+      intervalSeconds = 2;
+      timeoutSeconds = 120;
+    };
+  };
+}
+```
+
+When enabled, startup fails if `rnstatus` does not succeed before
+[`services.rnsd.healthCheck.timeoutSeconds`](#opt-services.rnsd.healthCheck.timeoutSeconds).
diff --git a/nixos/modules/services/networking/rnsd.nix b/nixos/modules/services/networking/rnsd.nix
new file mode 100644
index 0000000000000..113047e79c2ed
--- /dev/null
+++ b/nixos/modules/services/networking/rnsd.nix
@@ -0,0 +1,171 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.rnsd;
+  settingsFormat = pkgs.formats.configobj { };
+in
+{
+  options = {
+    services.rnsd = {
+      enable = lib.mkEnableOption "Enable Reticulum Network Stack Daemon (rnsd)";
+
+      package = lib.mkPackageOption pkgs "rns" { };
+      packageBinaryName = lib.mkOption {
+        type = lib.types.str;
+        default = "rnsd";
+        description = "Name of the program to use. Useful in case of using an alternative implementation.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.nullOr settingsFormat.type;
+        default = null;
+        description = "Structured rnsd configuration. The generated file is copied to the dataDir on service start. Use `rnsd --exampleconfig` to get an example config file.";
+      };
+
+      identityFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Path to rnsd identity file. This file will be copied to the dataDir on service start.";
+      };
+
+      identities = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        description = "Map of identity names to paths of identity files. Each identity file will be copied to $STATE_DIRECTORY/storage/identities/{name}.";
+      };
+
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional groups for the rnsd service user. E.g., add the `dialout` group to allow rnsd to access serial devices (e.g., `/dev/ttyACM0`).";
+      };
+
+      healthCheck = {
+        enable = lib.mkEnableOption "wait for rnsd to become healthy after startup";
+
+        intervalSeconds = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 2;
+          description = "Delay in seconds between each `rnstatus` health check attempt.";
+        };
+
+        timeoutSeconds = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 120;
+          description = "Maximum time in seconds to wait for `rnstatus` to succeed during startup.";
+        };
+      };
+
+      openMulticastPorts = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to open the UDP ports (27916, 42671) used for multicast peer discovery when the AutoInterface is enabled.
+        '';
+      };
+
+      enableUdevRules = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to install udev rules for automatically symlinking RNode devices (e.g., Heltec HT-n5262, RAK4631) to /dev/rnode.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.extraRules = lib.mkIf cfg.enableUdevRules (
+      let
+        devices = [
+          {
+            idVendor = "239a";
+            idProduct = "8071"; # Heltec HT-n5262
+          }
+          {
+            idVendor = "239a";
+            idProduct = "8029"; # RAK4631
+          }
+        ];
+
+        makeRule = dev: ''
+          SUBSYSTEM=="tty", ATTRS{idVendor}=="${dev.idVendor}", ATTRS{idProduct}=="${dev.idProduct}", SYMLINK+="rnode%n", MODE="0660", GROUP="dialout"
+        '';
+      in
+      builtins.concatStringsSep "\n" (map makeRule devices)
+    );
+
+    systemd.services.rnsd = {
+      description = "Reticulum Network Stack Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      preStart =
+        let
+          copySettings = lib.optionalString (cfg.settings != null) ''
+            install -Dm600 ${settingsFormat.generate "rnsd.conf" cfg.settings} "$STATE_DIRECTORY"/config
+          '';
+          copyIdentity = lib.optionalString (cfg.identityFile != null) ''
+            install -Dm600 ${cfg.identityFile} "$STATE_DIRECTORY"/storage/transport_identity
+          '';
+          copyIdentities = lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (name: file: ''
+              install -Dm600 ${file} "$STATE_DIRECTORY"/storage/identities/${name}
+            '') cfg.identities
+          );
+        in
+        copySettings + copyIdentity + copyIdentities;
+
+      serviceConfig =
+        let
+          waitForHealthy = pkgs.writeShellApplication {
+            name = "rnsd-wait-for-health";
+            runtimeInputs = [ pkgs.rns ];
+            text = ''
+              deadline=$((SECONDS + ${toString cfg.healthCheck.timeoutSeconds}))
+
+              until rnstatus --config "$STATE_DIRECTORY" >/dev/null 2>&1; do
+                if [ "$SECONDS" -ge "$deadline" ]; then
+                  echo "rnsd did not become healthy before timeout (${toString cfg.healthCheck.timeoutSeconds}s)" >&2
+                  exit 1
+                fi
+
+                sleep ${toString cfg.healthCheck.intervalSeconds}
+              done
+            '';
+          };
+        in
+        {
+          DynamicUser = true;
+          StateDirectory = "rnsd";
+          SupplementaryGroups = cfg.extraGroups;
+          RuntimeDirectory = "rnsd";
+          CacheDirectory = "rnsd";
+          ProtectSystem = "strict";
+
+          ExecStart = "${lib.getExe' cfg.package cfg.packageBinaryName} --config $STATE_DIRECTORY";
+        }
+        // lib.optionalAttrs cfg.healthCheck.enable {
+          ExecStartPost = lib.getExe waitForHealthy;
+          TimeoutStartSec = cfg.healthCheck.timeoutSeconds + 5;
+        };
+    };
+
+    networking.firewall = lib.mkIf cfg.openMulticastPorts {
+      extraCommands = lib.optionalString (!config.networking.nftables.enable) ''
+        ip46tables -A nixos-fw -p udp -m pkttype --pkt-type multicast -m multiport --dports 27916,42671 -j nixos-fw-accept
+      '';
+
+      extraInputRules = lib.optionalString config.networking.nftables.enable ''
+        meta l4proto udp pkttype multicast udp dport { 27916, 42671 } accept
+      '';
+    };
+  };
+
+  meta = {
+    doc = ./rnsd.md;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/nixos/modules/services/security/authelia.nix b/nixos/modules/services/security/authelia.nix
index d116424cc93bc..0632b7a21c9be 100644
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -76,7 +76,7 @@ let
 
               # required
               jwtSecretFile = mkOption {
-                type = types.nullOr types.path;
+                type = types.nullOr types.externalPath;
                 default = null;
                 description = ''
                   Path to your JWT secret used during identity verificaton.
@@ -84,7 +84,7 @@ let
               };
 
               oidcIssuerPrivateKeyFile = mkOption {
-                type = types.nullOr types.path;
+                type = types.nullOr types.externalPath;
                 default = null;
                 description = ''
                   Path to your private key file used to encrypt OIDC JWTs.
@@ -92,7 +92,7 @@ let
               };
 
               oidcHmacSecretFile = mkOption {
-                type = types.nullOr types.path;
+                type = types.nullOr types.externalPath;
                 default = null;
                 description = ''
                   Path to your HMAC secret used to sign OIDC JWTs.
@@ -100,7 +100,7 @@ let
               };
 
               sessionSecretFile = mkOption {
-                type = types.nullOr types.path;
+                type = types.nullOr types.externalPath;
                 default = null;
                 description = ''
                   Path to your session secret. Only used when redis is used as session storage.
@@ -109,7 +109,7 @@ let
 
               # required
               storageEncryptionKeyFile = mkOption {
-                type = types.nullOr types.path;
+                type = types.nullOr types.externalPath;
                 default = null;
                 description = ''
                   Path to your storage encryption key.
@@ -211,7 +211,7 @@ let
                 };
 
                 file_path = mkOption {
-                  type = types.nullOr types.path;
+                  type = types.nullOr types.externalPath;
                   default = null;
                   example = "/var/log/authelia/authelia.log";
                   description = "File path where the logs will be written. If not set logs are written to stdout.";
@@ -470,8 +470,8 @@ in
               message = ''
                 Authelia requires a JWT Secret and a Storage Encryption Key to work.
                 Either set them like so:
-                services.authelia.${name}.secrets.jwtSecretFile = /my/path/to/jwtsecret;
-                services.authelia.${name}.secrets.storageEncryptionKeyFile = /my/path/to/encryptionkey;
+                services.authelia.${name}.secrets.jwtSecretFile = "/my/path/to/jwtsecret";
+                services.authelia.${name}.secrets.storageEncryptionKeyFile = "/my/path/to/encryptionkey";
                 Or set services.authelia.${name}.secrets.manual = true and provide them yourself via
                 environmentVariables or settingsFiles.
                 Do not include raw secrets in nix settings.
diff --git a/nixos/modules/services/torrent/qbittorrent.nix b/nixos/modules/services/torrent/qbittorrent.nix
index 8c17fafc74b5d..14ecbcf2d807f 100644
--- a/nixos/modules/services/torrent/qbittorrent.nix
+++ b/nixos/modules/services/torrent/qbittorrent.nix
@@ -75,8 +75,13 @@ in
 
     profileDir = mkOption {
       type = path;
-      default = "/var/lib/qBittorrent/";
-      description = "the path passed to qbittorrent via --profile.";
+      default = "/var/lib/qBittorrent";
+      description = ''
+        The path passed to qbittorrent via --profile.
+        Please note that the resulting systemd service will be run with some very strict security controls,
+        such as `ProtectHome=yes`, `PrivateUsers=true`, and `ProtectSystem=full` among others, so you cannot specify
+        a profileDir in your home directory. See [this bug report](https://github.com/NixOS/nixpkgs/issues/514206) for further info.
+      '';
     };
 
     openFirewall = mkEnableOption "opening both the webuiPort and torrentPort over TCP in the firewall";
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 9553090e8c85d..3722e98bec24e 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1752,6 +1752,8 @@ in
       rotate = 26;
       compress = true;
       delaycompress = true;
+      # Run postrotate script only once after rotation of all log files:
+      sharedscripts = true;
       postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
     };
   };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5d06b7326e94a..58f8a3fe71a43 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1504,6 +1504,7 @@ in
   };
   rkvm = handleTest ./rkvm { };
   rmfakecloud = runTest ./rmfakecloud.nix;
+  rnsd = runTest ./networking/rnsd.nix;
   robustirc-bridge = runTest ./robustirc-bridge.nix;
   rosenpass = runTest ./rosenpass.nix;
   roundcube = runTest ./roundcube.nix;
diff --git a/nixos/tests/networking/rnsd.nix b/nixos/tests/networking/rnsd.nix
new file mode 100644
index 0000000000000..a2931489221cc
--- /dev/null
+++ b/nixos/tests/networking/rnsd.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  ...
+}:
+let
+  mainPort = 4242;
+in
+{
+  name = "rnsd";
+  meta.maintainers = [ lib.maintainers.drupol ];
+
+  nodes.machine = {
+    services.rnsd = {
+      enable = true;
+      settings = {
+        reticulum = {
+          enable_transport = "Yes";
+          share_instance = "Yes";
+          instance_name = "default";
+          discover_interfaces = "No";
+          panic_on_interface_error = "No";
+        };
+        logging = {
+          loglevel = 5;
+        };
+        interfaces = {
+          test = {
+            type = "BackboneInterface";
+            enabled = "yes";
+            discoverable = "yes";
+            listen_ip = "0.0.0.0";
+            listen_port = mainPort;
+            discovery_name = "Apollo RNS";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("Test rnsd service"):
+      machine.wait_for_unit("rnsd.service")
+      machine.wait_for_open_port(${toString mainPort})
+  '';
+}
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 54872aa5774a9..cf455681a5427 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.5/android-studio-quail3-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.4.1"; # "Android Studio Quail 4 | 2026.1.4 Canary 1"
-    sha256Hash = "sha256-ynHUoMDsTNgKKRAU948k37ktAIlIm9A+md8KyVBTjl4=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.1/android-studio-quail4-canary1-linux.tar.gz";
+    version = "2026.1.4.2"; # "Android Studio Quail 4 | 2026.1.4 Canary 2"
+    sha256Hash = "sha256-+63P62l4E+q7V4n/M3R3jGOrod9OkTDic/FMA5L5pMk=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.2/android-studio-quail4-canary2-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
index 95b2b716ab6df..59ed7d50f97e5 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@@ -6648,7 +6648,7 @@
       version = "9.8.7";
       src = fetchurl {
         url = "https://elpa.gnu.org/packages/org-9.8.7.tar";
-        sha256 = "1y7sf3p9jqkfw8k6wddy2p9hfskiq4a5hkx8sq39dgb4sri6v03d";
+        sha256 = "1pxljdl67f3lajsafrwb46dc4wgy3kd6x3g4n2hkdab915xkqlnr";
       };
       packageRequires = [ ];
       meta = {
diff --git a/pkgs/applications/editors/jetbrains/builder/linux.nix b/pkgs/applications/editors/jetbrains/builder/linux.nix
index a95b82f38f05a..edaf0959e1fe6 100644
--- a/pkgs/applications/editors/jetbrains/builder/linux.nix
+++ b/pkgs/applications/editors/jetbrains/builder/linux.nix
@@ -86,6 +86,8 @@ lib.extendMkDerivation {
         fontconfig
         libGL
         libx11
+        # required for the bundled jcef-plugin
+        udev
       ];
 
       nativeBuildInputs = nativeBuildInputs ++ [
@@ -186,6 +188,10 @@ lib.extendMkDerivation {
         runHook postInstall
       '';
 
+      preFixup = ''
+        addAutoPatchelfSearchPath "${jdk.home}/lib"
+      '';
+
       preferLocalBuild = !(finalAttrs.meta.license.free or true);
 
       meta = meta // {
diff --git a/pkgs/applications/editors/jetbrains/ides/clion.nix b/pkgs/applications/editors/jetbrains/ides/clion.nix
index 547e4878df216..f9cd822bd3223 100644
--- a/pkgs/applications/editors/jetbrains/ides/clion.nix
+++ b/pkgs/applications/editors/jetbrains/ides/clion.nix
@@ -21,16 +21,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.tar.gz";
-      hash = "sha256-uOhFuDqVw3pxtqBvOQH+FpJTFrneaD/R0VcpJZRYD2o=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1.tar.gz";
+      hash = "sha256-3/SNgt6bpr0aIQWmTJnvkgftdZE0M5wcE/LDS1Hk4R0=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-IG2U2v9mTk+GCbB9jJVoX5hKju37+DfqRiMtxu8b8bo=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
-      hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-nkkJ80rc1bApEBMZT0ZjZQcnhkzAG3i1p9GhQUA4gT4=";
     };
   };
   # update-script-end: urls
@@ -44,8 +44,8 @@ in
   product = "CLion";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.59";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.321";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/datagrip.nix b/pkgs/applications/editors/jetbrains/ides/datagrip.nix
index 81c7b8d92a097..cb90ea6e0e123 100644
--- a/pkgs/applications/editors/jetbrains/ides/datagrip.nix
+++ b/pkgs/applications/editors/jetbrains/ides/datagrip.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.tar.gz";
-      hash = "sha256-XxwvXiaWAfK318BjbzKPLVDeMBlOr5BFuD2bqU8+12o=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1.tar.gz";
+      hash = "sha256-t3ZYBjpQR11jRTJX5LQx4q6j+Nro6wEi4y0DXsY5ZkU=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1-aarch64.tar.gz";
+      hash = "sha256-m3XfF56WjiWyJjWg0wN0mCJ3oeBfZvy01V566xGUm3U=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
-      hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1-aarch64.dmg";
+      hash = "sha256-1sMqgNPSAGTE3qjT3Dbp5MKJ6mCif1LHjyjnk4ixDUY=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ mkJetBrainsProduct {
   product = "DataGrip";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.24374.56";
+  version = "2026.2.1";
+  buildNumber = "262.8665.339";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/gateway.nix b/pkgs/applications/editors/jetbrains/ides/gateway.nix
index 28f722fed1686..975da1d53b711 100644
--- a/pkgs/applications/editors/jetbrains/ides/gateway.nix
+++ b/pkgs/applications/editors/jetbrains/ides/gateway.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.tar.gz";
-      hash = "sha256-HizogKH6goX1NdcI/Fj4YsCRzDWfFvQGYSaMM9wVDCA=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2.tar.gz";
+      hash = "sha256-FdjMPo4SyWAojyqKm+FFdt3f7NuEfSFvH8I2ctygxjE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2-aarch64.tar.gz";
+      hash = "sha256-bYLMkv7/aNFyZOBLFp0SBFA44YCzFjqArTWEpJO+jmo=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
-      hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2-aarch64.dmg";
+      hash = "sha256-FUus7mjiYWAiyIihEjhpEILYupLAFdjrA8xClovJU2o=";
     };
   };
   # update-script-end: urls
@@ -36,8 +36,8 @@ mkJetBrainsProduct {
   productShort = "Gateway";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.98";
+  version = "2026.2";
+  buildNumber = "262.8665.250";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/goland.nix b/pkgs/applications/editors/jetbrains/ides/goland.nix
index b19fd343d896b..685acc45b6ad5 100644
--- a/pkgs/applications/editors/jetbrains/ides/goland.nix
+++ b/pkgs/applications/editors/jetbrains/ides/goland.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.tar.gz";
-      hash = "sha256-pHSbmAZ+tSfa0wdtDp/3Ib/GNMP30OFNQlHWUfMwrW0=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.0.1.tar.gz";
+      hash = "sha256-nT/jmw0WFNwmtWR5be0KBUHJpM48phhYN7oUNOMCrok=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-t6vH7fxtysgprc1EHH3XiIdHD6oCMcY/a1hu5aiYMxE=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
-      hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-zrQAsOOR4OhAXnebwnRk3da4h4Gi0t8f+SIaEAiwM0Q=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.72";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.336";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/idea-oss.nix b/pkgs/applications/editors/jetbrains/ides/idea-oss.nix
index 3654469d56eaf..4eb704ac32041 100644
--- a/pkgs/applications/editors/jetbrains/ides/idea-oss.nix
+++ b/pkgs/applications/editors/jetbrains/ides/idea-oss.nix
@@ -70,5 +70,11 @@ mkJetBrainsProduct {
     ];
     license = lib.licenses.asl20;
     sourceProvenance = [ lib.sourceTypes.fromSource ];
+    knownVulnerabilities = [
+      ''
+        This version of IDEA has multiple known security vulnerabilities, see NIXPKGS-2026-2269: https://tracker.security.nixos.org/issues/NIXPKGS-2026-2269.
+        The package `jetbrains.idea-oss` is currently not receiving updates in nixpkgs, consider using `jetbrains.idea`.
+      ''
+    ];
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/ides/idea.nix b/pkgs/applications/editors/jetbrains/ides/idea.nix
index 3367506afa512..26c636b48eae9 100644
--- a/pkgs/applications/editors/jetbrains/ides/idea.nix
+++ b/pkgs/applications/editors/jetbrains/ides/idea.nix
@@ -15,16 +15,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.tar.gz";
-      hash = "sha256-MQTYXZUH/4ggZeP465UGQCtKgSkJLSaCZiu26cTwY/w=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1.tar.gz";
+      hash = "sha256-kU4x4xtOEoXVOM8/rlswCvCLz/NrwpisYgBQS74S8YA=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-HkRhBq1vh1iRjshmX+D9cT1iSRZk/NEz6YkTwWhKl0g=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
-      hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-vN2wVaM5V9H5Xnrjv9MIKT0PgSJQqrk5kWQWOqEYOZ8=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   productShort = "IDEA";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.65";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.337";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/mps.nix b/pkgs/applications/editors/jetbrains/ides/mps.nix
index 691bd0f94179b..f8f1ee9bbae40 100644
--- a/pkgs/applications/editors/jetbrains/ides/mps.nix
+++ b/pkgs/applications/editors/jetbrains/ides/mps.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
-      hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
+      url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1.tar.gz";
+      hash = "sha256-NbURKu1jTPoJQvV8FpMacBa+FehF7XfF6xZmIhFlb2A=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
-      hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
+      url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1.tar.gz";
+      hash = "sha256-NbURKu1jTPoJQvV8FpMacBa+FehF7XfF6xZmIhFlb2A=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg";
-      hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ=";
+      url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1-macos-aarch64.dmg";
+      hash = "sha256-5VtPS26/vCKa+mfDAQKgd9x5A+Cqv39Kz+2EKkgul+I=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ mkJetBrainsProduct {
   product = "MPS";
 
   # update-script-start: version
-  version = "2025.3";
-  buildNumber = "253.28294.432";
+  version = "2026.1";
+  buildNumber = "261.25134.779";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/phpstorm.nix b/pkgs/applications/editors/jetbrains/ides/phpstorm.nix
index b76837caa81b0..dbf0e2c9d2fd3 100644
--- a/pkgs/applications/editors/jetbrains/ides/phpstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/phpstorm.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.tar.gz";
-      hash = "sha256-SF25D7dDn7b6AzcXEDLKwhpjTnCqYz1fEmvND5dl8Is=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1.tar.gz";
+      hash = "sha256-SZr1Qd3ISuTsMuuoLFc0O79kvPMrSz26PmLeKvRJLbQ=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-W+59PmLs47hhAtjbM+4ARb1WQS1MmPiL/GuIoQ887mU=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
-      hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-fI60xJ94onmXAzJBy3+GUHnJH+/ukQTCuU2j3s1ZI5o=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ mkJetBrainsProduct {
   product = "PhpStorm";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.71";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.325";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
index d8ef51c64488a..68c8bd2b33571 100644
--- a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
@@ -63,6 +63,12 @@ in
     ];
     license = lib.licenses.asl20;
     sourceProvenance = [ lib.sourceTypes.fromSource ];
+    knownVulnerabilities = [
+      ''
+        This version of PyCharm has multiple known security vulnerabilities, see NIXPKGS-2026-2269: https://tracker.security.nixos.org/issues/NIXPKGS-2026-2269.
+        The package `jetbrains.pycharm-oss` is currently not receiving updates in nixpkgs, consider using `jetbrains.pycharm`.
+      ''
+    ];
   };
 }).overrideAttrs
   pyCharmCommonOverrides
diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm.nix b/pkgs/applications/editors/jetbrains/ides/pycharm.nix
index 452f736003733..ad64fe77c9608 100644
--- a/pkgs/applications/editors/jetbrains/ides/pycharm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm.nix
@@ -13,16 +13,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.tar.gz";
-      hash = "sha256-RIufgZhg/n+D1uEdcDyYRjTDfh8Jicyz4h0B1kTbVXs=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2.tar.gz";
+      hash = "sha256-rDb3wHQ0ZSFb+CJwebdycpRTOMSFwdprkk5WRoBGvVo=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.tar.gz";
+      hash = "sha256-O2PS9JDBTFQcmK/YUfIYBpo8iFzq7dm9sA5aByhc+AI=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
-      hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.dmg";
+      hash = "sha256-wiOQISfsvBnlpjeyzAPXUJfXOwYwrZ8nGoiRRvQ4YUY=";
     };
   };
   # update-script-end: urls
@@ -36,8 +36,8 @@ in
   product = "PyCharm";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.68";
+  version = "2026.2";
+  buildNumber = "262.8665.309";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/rider.nix b/pkgs/applications/editors/jetbrains/ides/rider.nix
index d787cbecf590c..e9a40eee64235 100644
--- a/pkgs/applications/editors/jetbrains/ides/rider.nix
+++ b/pkgs/applications/editors/jetbrains/ides/rider.nix
@@ -24,16 +24,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.tar.gz";
-      hash = "sha256-K+X2M4idv+oDqC/dkbzMTX3W3zx0b0e8ZTsxkP7rAfI=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.tar.gz";
+      hash = "sha256-7rvEnimFJJbLx/Y5nrR7VuipX8khxNrnwFzKay9tIqc=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.tar.gz";
+      hash = "sha256-fvdgV1Q8gLgYB/ihrpukJW9DqLupZ45JGKad7vovAIo=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
-      hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.dmg";
+      hash = "sha256-Y+hXTTMqHHGm5pJhQ8yepmZmAzkiF7ylOxroOa9BG6Q=";
     };
   };
   # update-script-end: urls
@@ -47,8 +47,8 @@ in
   product = "Rider";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.60";
+  version = "2026.2";
+  buildNumber = "262.8665.328";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix b/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix
index b99a31ccb0415..b6f47e68be3bc 100644
--- a/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix
+++ b/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.tar.gz";
-      hash = "sha256-0EhtU4XKWI9i7ij+m5uvxHSYnbQaYJy8Sa6S1OW4CFU=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.2.tar.gz";
+      hash = "sha256-k+T5QDCIcuqHWrjhoCGcym/Q9v4YBviacg9rnNFBIRM=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.2-aarch64.tar.gz";
+      hash = "sha256-2T6thTMYAlfb6yJKbpuIyVtj7Af/P3AjQAVl16H35nM=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
-      hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.2-aarch64.dmg";
+      hash = "sha256-rgskPMKLtgPpdSbbENJcE4g75VzqeWPLzxoXqzln67k=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ mkJetBrainsProduct {
   product = "RubyMine";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.67";
+  version = "2026.2";
+  buildNumber = "262.8665.308";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
index 6e4312187c318..2b70b83855224 100644
--- a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
+++ b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
@@ -18,16 +18,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.tar.gz";
-      hash = "sha256-8x/AP6uKSVJavwjA9tYT1IM1xVspOZZzwmcwpGloIcw=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.tar.gz";
+      hash = "sha256-xHg0d7wdlcXy3c/5STlWaeouV3rMBENRB1lLqZSulqE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.tar.gz";
+      hash = "sha256-WU+OeMZp9f8QkNbA2ZKYyYG5kt65KOvaA003SkskCow=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
-      hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.dmg";
+      hash = "sha256-/cdvXf0qYXxgIi+uh9O6I0KIAOV7Z7QQ+lV5Y2xUNy0=";
     };
   };
   # update-script-end: urls
@@ -41,8 +41,8 @@ in
   product = "RustRover";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.73";
+  version = "2026.2";
+  buildNumber = "262.8665.323";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/jetbrains/ides/webstorm.nix b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
index 6e28014f825b7..76cf60de76fe7 100644
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -12,16 +12,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.tar.gz";
-      hash = "sha256-BPuMTwZ3Xkk4SBRCdgZ8vCoEYjhTa3d8CFOqrGlcGg0=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1.tar.gz";
+      hash = "sha256-FEe4EDYWJwGt5hEdbf0A6g2+ZyIrX4ztzQYmZe5GZPg=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-pt1MwGNXHT1QlePbVdtkwtYpenKlf53DGDG24+PM9tc=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
-      hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-WtvL7DLrchsKlMPrsYeluxoPo/sXBaUw0WO1mlxtHkc=";
     };
   };
   # update-script-end: urls
@@ -35,8 +35,8 @@ mkJetBrainsProduct {
   product = "WebStorm";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.58";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.341";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0f12bdce61696..ce2121c35b341 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -446,12 +446,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-07-20";
+    version = "0-unstable-2026-07-22";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "e520902f405da5f5ad392d32babad5b5dd5ffa44";
-      hash = "sha256-zNXm/0W+Hv562zt6NxHnFuO2nBxjX5dlxS7pRB+KXQY=";
+      rev = "3d2c297f7152208daf4a382ea7123f9e4ebf9da1";
+      hash = "sha256-eQIwRl8mjrZ5/cGLYVxl8DUh6I4lwUTO18gARlARxyU=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1050,12 +1050,12 @@ final: prev: {
 
   artio-nvim = buildVimPlugin {
     pname = "artio.nvim";
-    version = "0-unstable-2026-07-17";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "comfysage";
       repo = "artio.nvim";
-      rev = "19d71f8d9c721872e97aa0e5f094041c96f3feca";
-      hash = "sha256-X1QXSoowhgs+uhO1T9OtaSXhAryzLCzGfHNgCFiO3is=";
+      rev = "54b0625648bf3c89cdad9c1554903f09bddbf3a9";
+      hash = "sha256-Sz9uUO3AOxXTsIY2Pbb25Gx97Ino3mEUJx00mLej8QY=";
     };
     meta.homepage = "https://github.com/comfysage/artio.nvim/";
     meta.license = getLicenseFromSpdxId "EUPL-1.2";
@@ -1610,12 +1610,12 @@ final: prev: {
 
   base16-nvim = buildVimPlugin {
     pname = "base16-nvim";
-    version = "0-unstable-2026-07-15";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "base16-nvim";
-      rev = "fd128e380624c34f12a201690944bf657f861361";
-      hash = "sha256-W5tHY4U87eCAiOerNMAeqcbz1JlMZ6YGqSC0TBhI6t4=";
+      rev = "898823add4424b5e857ba094e6c50e1b1d9c7962";
+      hash = "sha256-nKhZ/yYrvIO7b3fl4BJRPXaHoe4KVFvyMgBZmSAPkuA=";
     };
     meta.homepage = "https://github.com/RRethy/base16-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -1638,12 +1638,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-07-19";
+    version = "0-unstable-2026-07-23";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "8d059b82367160cd530253afbbcd20dc4b34129f";
-      hash = "sha256-wW6UidkM6avqQVhPEgRtDXgxHsMdD+IM01A5ABebYT4=";
+      rev = "e2f24c072b75f504d60f016ea3c2e846cb48eefa";
+      hash = "sha256-mbUkJ9sluILsageKAbLKPyiGUCk6OWpl9WuekUx+qtE=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -3498,12 +3498,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-07-15";
+    version = "0.0.82-unstable-2026-07-22";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "d1689a4876305e5fc6691910c8ee6f1eb5da2219";
-      hash = "sha256-6AjcLD8gh3rG3uXj8LjdXr5pbzIKwtu+14ZcCVwXCuI=";
+      rev = "dfe51e942d0609888824484b277e46e3252cb5b0";
+      hash = "sha256-9DzWOCiAHUTkxzssPjeC4J0YsCwCn+oKstAl7m/iDX0=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = unfree;
@@ -5447,12 +5447,12 @@ final: prev: {
 
   easy-dotnet-nvim = buildVimPlugin {
     pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-07-09";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "GustavEikaas";
       repo = "easy-dotnet.nvim";
-      rev = "26b939e2e013ddfc137a8e6149cda1f0b62303ca";
-      hash = "sha256-M6uNfKiHviaJyItvvAdEplB+pdqF4N5DOwxG2oPYwpg=";
+      rev = "5823c50d0de015c01f591319f6e846506518165e";
+      hash = "sha256-vhQusWOcjiLrfpTFbIb06YrSHN/7/hFMeoZjBC3kvi8=";
     };
     meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5644,12 +5644,12 @@ final: prev: {
 
   embark-vim = buildVimPlugin {
     pname = "embark-vim";
-    version = "0-unstable-2025-10-07";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "embark-theme";
       repo = "vim";
-      rev = "7014644e25d5cebcb3e70a079804c44ec14d8e46";
-      hash = "sha256-wR9qoaLehfTVakMi2QYQqBMTi9Tc+I46H/wUlPShTmE=";
+      rev = "2331671b548abcade22b0197fde58e11744c99bb";
+      hash = "sha256-u4RPwdCihlAkMIHq1oJPIKpzVb4JNDKx2kU9FYBlnY0=";
     };
     meta.homepage = "https://github.com/embark-theme/vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6946,12 +6946,12 @@ final: prev: {
 
   gruber-darker-nvim = buildVimPlugin {
     pname = "gruber-darker.nvim";
-    version = "0-unstable-2026-01-07";
+    version = "0-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "blazkowolf";
       repo = "gruber-darker.nvim";
-      rev = "aba065c3a79b58cc3863d5c9db319255abd1258a";
-      hash = "sha256-4xB/MRTDccA5gTKe6DrN+bNfDx6fzjuIGOLdkuxg8c0=";
+      rev = "9b68f84bfd6c1278fef2143802ca40c60f2471c0";
+      hash = "sha256-ehnUjVSVG6Q9hn0vKYYD2Ux8SeXPTT+FI44GDkRSlgY=";
     };
     meta.homepage = "https://github.com/blazkowolf/gruber-darker.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11062,12 +11062,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-07-19";
+    version = "1.4.0-unstable-2026-07-22";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "1246df7a5d1811d84212f11edb43550cd8380ebd";
-      hash = "sha256-hlQf+xJ+/9OTqp5VtPsNE7QW6uVjWeUkqQ8r1u6MWkI=";
+      rev = "3990883eae127c6b8f6c1ed5cd9e261dd42baba0";
+      hash = "sha256-51lrBycPCXB08pfIj+VDkyh46VhcYqM3591jHcSOkrs=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11146,12 +11146,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-16";
+    version = "3.0.0-unstable-2026-07-22";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "f8674ec894315c02449b61c9de9a116c5aafeb90";
-      hash = "sha256-ETu9zy2In3M8/3fqYUfTRt0mKiocm3paJFjgQ82Yj3I=";
+      rev = "2043096b7ae81e8350ec8cceb3e7ab08dca1dcfe";
+      hash = "sha256-Hv1D71QN11v7kyJ/UVlh0/unGOaItXwY/mXIT1jHqaU=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12296,12 +12296,12 @@ final: prev: {
 
   nvchad-ui = buildVimPlugin {
     pname = "nvchad-ui";
-    version = "0-unstable-2026-07-19";
+    version = "0-unstable-2026-07-23";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "ui";
-      rev = "222c8cc1ad66076c05b7c9d0695781ebe3799d88";
-      hash = "sha256-SKSRwXi0KdJtWkmak1LLwXIUukwIhMxKHy9HIMnu0DQ=";
+      rev = "23b99ce715ace72372f28e34807fd1e19023da42";
+      hash = "sha256-z59cniQW25p+IiAbONyN6wX9B3pAOWA7m5iSOtp9KD0=";
     };
     meta.homepage = "https://github.com/nvchad/ui/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -13186,12 +13186,12 @@ final: prev: {
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2.10.0";
+    version = "2.11.0";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      tag = "v2.10.0";
-      hash = "sha256-RDhwY+C2ZHZPPRe1yvgJqonLcez77dVYvTIttVnFPis=";
+      tag = "v2.11.0";
+      hash = "sha256-d1vDEfiNSo9ccSPqTHEFqXVFCPhp/0ZozTzcyLiJrGg=";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -13774,12 +13774,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-07-19";
+    version = "0.10.0-unstable-2026-07-23";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "7248feaca45e4d944591497964bc19afa89ad1c6";
-      hash = "sha256-FQj0+qeaW9rLy3dUbGbUG4UYtnry7UBA1n9SM2qXLdk=";
+      rev = "a45a920ec04cda5624f6dea0ff6454c81c3ad2d5";
+      hash = "sha256-RGPWQUkI73EL9wMOqlYL5pGO6w6bwxXZcSc050979qE=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14236,12 +14236,12 @@ final: prev: {
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "0-unstable-2026-07-09";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "8476766529b7c0ee9b7da12b6dbce1b716bb62cd";
-      hash = "sha256-Ahxcp7UCoISeLOhZAkX966lyHk8jiSwWy9SAlUnzJo4=";
+      rev = "d05b852ad7eba6e34ffe38ee2db430f0fd6f6225";
+      hash = "sha256-JQHDqtTLbXHJtf0bJflY3mdXNmNhc1w2VHglGJc19Tk=";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14755,12 +14755,12 @@ final: prev: {
 
   parrot-nvim = buildVimPlugin {
     pname = "parrot.nvim";
-    version = "2.5.1-unstable-2026-05-20";
+    version = "2.6.0";
     src = fetchFromGitHub {
       owner = "frankroeder";
       repo = "parrot.nvim";
-      rev = "964675ca588efae2a50bef35b01729acc36cb3d5";
-      hash = "sha256-EPrisAicCUpUPl0q5h/uBBSpQuuzOlSCbQpu0ispwvU=";
+      tag = "v2.6.0";
+      hash = "sha256-U5Pq6lkQQlnj4BexhQUIBVGCcSQuCfxP1d6JLR1C4rQ=";
     };
     meta.homepage = "https://github.com/frankroeder/parrot.nvim/";
     meta.license = unfree;
@@ -15232,12 +15232,12 @@ final: prev: {
 
   pum-vim = buildVimPlugin {
     pname = "pum.vim";
-    version = "2.0-unstable-2026-05-24";
+    version = "2.0-unstable-2026-07-23";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "pum.vim";
-      rev = "f3c2436bd93f6d4818a91e480f991ccc3b20338e";
-      hash = "sha256-cfd3yckABLaG8CQtDwyUgivAH6rHxPSubqVvNJrzxdk=";
+      rev = "6191d6224f1e2f6b3cccbe0759809f811b954cb7";
+      hash = "sha256-E6rwTg2XLzkeBlUFwrGxtH6ZtpOWB/t9PYG4IIwV9dw=";
     };
     meta.homepage = "https://github.com/Shougo/pum.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15793,12 +15793,12 @@ final: prev: {
 
   roslyn-nvim = buildVimPlugin {
     pname = "roslyn.nvim";
-    version = "0-unstable-2026-07-10";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "seblyng";
       repo = "roslyn.nvim";
-      rev = "b4954e97e145bd8129b3bbe99809759f6ced2235";
-      hash = "sha256-AuJNxfvNYnqPvihxBn1vADdvwoDNInVbOLS0Pq5q9v8=";
+      rev = "2dcbbe81b48f8377df2281d9be4f2c84ccfff520";
+      hash = "sha256-sMQ8NeNZEfP0iv5JTL8Zfre0GqZaGYftvGB+92nDj3k=";
     };
     meta.homepage = "https://github.com/seblyng/roslyn.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16283,12 +16283,12 @@ final: prev: {
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2.1.0-unstable-2026-07-18";
+    version = "2.1.0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "de39b4d75695e2377401c7d05f896657637d244b";
-      hash = "sha256-Xqnre4RfIID/m8hXUpcMrsLssjfp/cbSpG24cory2BI=";
+      rev = "68861c68f1cf34dab4cdb22f094d4531cd26560a";
+      hash = "sha256-3rXK7ScKdtAonxkECx6iTYE+Ax5IGOfsXaOD5LWVVvc=";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -17982,12 +17982,12 @@ final: prev: {
 
   tinted-nvim = buildVimPlugin {
     pname = "tinted-nvim";
-    version = "1.0.0-unstable-2026-07-15";
+    version = "1.0.0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-nvim";
-      rev = "a229fe0efadb4d9bfa92cad16175bb4e93fa70d4";
-      hash = "sha256-a79rQSpPyCH/zbunrW9NxtsnwKVcQiwLzhW/1YNl3a4=";
+      rev = "167d4f4e9226df14fb9f397a5d5b434d6c4dccfc";
+      hash = "sha256-9KxImKf8q7Ho+MJXNCSktkWPEgRNy7m3gXULQeplBsI=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -17996,12 +17996,12 @@ final: prev: {
 
   tinted-vim = buildVimPlugin {
     pname = "tinted-vim";
-    version = "01-unstable-2026-07-15";
+    version = "01-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-vim";
-      rev = "1ee9f7bbb3e5928b84ab0bedaf04f6ad9dafdfb2";
-      hash = "sha256-fwFxfq0Kr/EPdx4r9qTjzvjxkQsNoAD9KvB6kP3NwlE=";
+      rev = "0c0be0f0a7b69e7294bb1ff8526bb592ae96e41c";
+      hash = "sha256-b/Rx3zT3THZNa09FEOXpUckM8fsVZ3h1ssLaJmKebZI=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-vim/";
     meta.license = unfree;
@@ -21094,12 +21094,12 @@ final: prev: {
 
   vim-gitgutter = buildVimPlugin {
     pname = "vim-gitgutter";
-    version = "0-unstable-2026-04-06";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "airblade";
       repo = "vim-gitgutter";
-      rev = "21c977e8597c468c7dc76001389b0b430d46a4b0";
-      hash = "sha256-TESn+hh9ceDxacWFIesi75kkorDkQNRec6ClMKI7tWs=";
+      rev = "90b75207bd9b55d8ac4af15f72b4e935462014d0";
+      hash = "sha256-zIJf8qhhIpe1y4AjOETsB5dZaTtIkDQSB4okFfXsp84=";
     };
     meta.homepage = "https://github.com/airblade/vim-gitgutter/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21220,12 +21220,12 @@ final: prev: {
 
   vim-grepper = buildVimPlugin {
     pname = "vim-grepper";
-    version = "1.4-unstable-2025-02-18";
+    version = "1.4-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "mhinz";
       repo = "vim-grepper";
-      rev = "acaaf32edaa11d82fb972d2af36b949ec3042928";
-      hash = "sha256-MLKikTcGuZIDvkUvCMQP46CeUOF17aT9hsBGTzBAQok=";
+      rev = "74284df0abf7c3f9d57e3416129dbeeba36dc86b";
+      hash = "sha256-Yug13sE8iX9NuTOENnir2L/R6dftpQ6tv2W0gA60xT4=";
     };
     meta.homepage = "https://github.com/mhinz/vim-grepper/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21276,12 +21276,12 @@ final: prev: {
 
   vim-habamax = buildVimPlugin {
     pname = "vim-habamax";
-    version = "0-unstable-2026-07-04";
+    version = "0-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "habamax";
       repo = "vim-habamax";
-      rev = "f6e3f8d68606e51deaeca591f2036b3e14fb120c";
-      hash = "sha256-nfo4OXAC3r99MEWO567kgQodPaqDTWEZFCVRthafNbU=";
+      rev = "b4775d7efd7060240104898d992cec0ada87ecc1";
+      hash = "sha256-3DRZ3BhsA3dPiwKet13ypcLjNg81HZd5I46Jq41tsdg=";
     };
     meta.homepage = "https://github.com/habamax/vim-habamax/";
     meta.license = unfree;
@@ -23336,12 +23336,12 @@ final: prev: {
 
   vim-ps1 = buildVimPlugin {
     pname = "vim-ps1";
-    version = "2.9-unstable-2024-03-06";
+    version = "2.9-unstable-2026-07-21";
     src = fetchFromGitHub {
       owner = "PProvost";
       repo = "vim-ps1";
-      rev = "839cec1550e09fc902c74103053e9e765051083d";
-      hash = "sha256-G9dLjdq48x50wdd0+WjPxpgMlp00QLM8i3w1tj3s8zI=";
+      rev = "8577ab0ba6bcbcda9d11ae40b2a09ddcb09aea42";
+      hash = "sha256-PBkE2Ds/h/I3ebQOghV6KjIXFMa5Lh/h1OKO8mmh6TI=";
     };
     meta.homepage = "https://github.com/PProvost/vim-ps1/";
     meta.license = unfree;
@@ -25028,12 +25028,12 @@ final: prev: {
 
   vim-xkbswitch = buildVimPlugin {
     pname = "vim-xkbswitch";
-    version = "0.20-unstable-2024-09-17";
+    version = "0.21";
     src = fetchFromGitHub {
       owner = "lyokha";
       repo = "vim-xkbswitch";
-      rev = "39914ff3aa3a5678285ba4b740524351d9f5ae18";
-      hash = "sha256-ADmotwtoRZcaJgzCg6YT3k29f7TpjHvPjy4ucfkJmOw=";
+      tag = "0.21";
+      hash = "sha256-gWFUGj/Mr7CgyexhmxV0gc6PHYPr86BKvf6pqqhf1cA=";
     };
     meta.homepage = "https://github.com/lyokha/vim-xkbswitch/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -25295,12 +25295,12 @@ final: prev: {
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2.17-unstable-2026-07-18";
+    version = "2.18";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "6368e31fdaf766ff908a2c06e9ee14fc66dec409";
-      hash = "sha256-/0DoAJ3Iv8eJlRqNodumYqllY+4c3zv+oY1EpbvC8ak=";
+      tag = "v2.18";
+      hash = "sha256-8AYWjXAzaHJtYs0YEGtKjI52lyyYlpZRhmVOev4Tzs4=";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -25911,12 +25911,12 @@ final: prev: {
 
   yanky-nvim = buildVimPlugin {
     pname = "yanky.nvim";
-    version = "2.0.0-unstable-2026-06-07";
+    version = "2.0.0-unstable-2026-07-22";
     src = fetchFromGitHub {
       owner = "gbprod";
       repo = "yanky.nvim";
-      rev = "020c22d0cfa60358569e49d1d7b91630f175aef0";
-      hash = "sha256-gdOwMMQP3AyP2dQU8QlEc8COfqdK8tzIcVmuQ3xOERM=";
+      rev = "dd6689fdda85f66cab7d9b1a1664625f3be0920d";
+      hash = "sha256-2uNKHtFfIokuZ8AcPP5LXuStxPzQGP2Jcq04DsYM9s4=";
     };
     meta.homepage = "https://github.com/gbprod/yanky.nvim/";
     meta.license = getLicenseFromSpdxId "WTFPL";
@@ -26122,12 +26122,12 @@ final: prev: {
 
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
-    version = "0.4.10";
+    version = "0.4.11";
     src = fetchFromGitHub {
       owner = "zk-org";
       repo = "zk-nvim";
-      tag = "v0.4.10";
-      hash = "sha256-/3M40vkIZ+O0FCk0K6bL8He6WapQ5s74RMxkoxhPM8A=";
+      tag = "v0.4.11";
+      hash = "sha256-klRgCkfH4x38ZBQLXsMRZE6+KgdaxQo7XfXZSXv/ajk=";
     };
     meta.homepage = "https://github.com/zk-org/zk-nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
index 83072b077e259..69f2f98704973 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-pylance";
     publisher = "MS-python";
-    version = "2026.2.1";
-    hash = "sha256-u1n4OqjBCAaRZe8Mu2vzYfZE6tpJQSQ3gSInJsNSSnQ=";
+    version = "2026.3.1";
+    hash = "sha256-Jl1fmAtc4wPV0cUE8nbIZdOr1Kk8pmHUq6ZCT6k0k64=";
   };
 
   buildInputs = [ pyright ];
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 2baf64ec3aa93..4a996b78f4686 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.0.8";
-    hash = "sha256-qSlz2wXQwpO1Wi9P40hVm+ACZ+VfCiV9LF3lnOkMoXA=";
+    version = "4.0.11";
+    hash = "sha256-uMPvpwpMOryh8lmL90wwI4GSOefX+hQioaEKNt0WmU8=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index c29133655ef50..eb7265b55a9c1 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-DWrKvjWpUYvyqgZCShqwBKw33MHW31cxb4ERV65O+uc=";
+      hash = "sha256-C+8B/YO1u3AIP1tv3Bil9ljh2UXfDfrmYPbZykhEdoM=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-iFHeZiTubXA/t2Gib9hP42d7yjq/WRyywp+l8VhGfmo=";
+      hash = "sha256-MKPAQhFgPjTzYzgiSXEUNXOBC1EcsstdAfRdxeCQ7c0=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-qe7K3PQIgZztIdOVx37LGXrzBmYui2o2CcmDK+5jaFM=";
+      hash = "sha256-FFYr9p5pg1C25fFc+swGrKvF0WVAIJhOMKCSY3fsJpA=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.1.7";
+    version = "1.2.4";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/by-name/ca/cargo-semver-checks/package.nix b/pkgs/by-name/ca/cargo-semver-checks/package.nix
index 35b316de3d5b0..5f0ed6d9cde3b 100644
--- a/pkgs/by-name/ca/cargo-semver-checks/package.nix
+++ b/pkgs/by-name/ca/cargo-semver-checks/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-semver-checks";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = "cargo-semver-checks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fF29YLYNL0gRD5ZcgBL19wO9DqLpXTQsxQkXlVw8U7A=";
+    hash = "sha256-dTfcpUVR3zDtNLTKG/Oj1dxVEzLuCYR3tFlCIapYJp8=";
   };
 
-  cargoHash = "sha256-VHxgPvlhasM3GnK1uMDA2vi0z3TxHWpCOlkWJhcV/F8=";
+  cargoHash = "sha256-VZxaEwQqHt8LKXp/SzOUAxT6e8jvCnS7OlyxTI1rg6c=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/cl/cljfmt/package.nix b/pkgs/by-name/cl/cljfmt/package.nix
index 801008c577dfd..e88fe77689831 100644
--- a/pkgs/by-name/cl/cljfmt/package.nix
+++ b/pkgs/by-name/cl/cljfmt/package.nix
@@ -8,11 +8,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "cljfmt";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchurl {
     url = "https://github.com/weavejester/cljfmt/releases/download/${finalAttrs.version}/cljfmt-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-6GTK/QH0z7Qox5JFGWu4hacGiLvBVmJQHvw0K2sMMAw=";
+    hash = "sha256-ywBX1WNMbDL9Nm8GBu3jDyfB8dAgMd8PfadX6Bdvmlk=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/ea/earthly/package.nix b/pkgs/by-name/ea/earthbuild/package.nix
similarity index 59%
rename from pkgs/by-name/ea/earthly/package.nix
rename to pkgs/by-name/ea/earthbuild/package.nix
index f941009299fc4..cc40c0ee1916e 100644
--- a/pkgs/by-name/ea/earthly/package.nix
+++ b/pkgs/by-name/ea/earthbuild/package.nix
@@ -4,21 +4,22 @@
   fetchFromGitHub,
   stdenv,
   testers,
-  earthly,
 }:
 
 buildGoModule (finalAttrs: {
-  pname = "earthly";
-  version = "0.8.16";
+  pname = "earthbuild";
+  version = "0.8.17";
 
   src = fetchFromGitHub {
-    owner = "earthly";
-    repo = "earthly";
+    owner = "EarthBuild";
+    repo = "earthbuild";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2+Ya5i6V2QDzHsYR+Ro14u0VWR3wrQJHZRXBatGC8BA=";
+    hash = "sha256-ATdNA9KjAXsxMiez3AF6TxK7OujNDABY8jB6hXeSNpc=";
   };
 
-  vendorHash = "sha256-kEgg7zrT69X4yrsGtLyvnrGQ7+sXaEzdqd4Fz7rpFyg=";
+  vendorHash = "sha256-49FWzLHEbgwWOXT1uPshdY5risFHInA541Mfhu7v08A=";
+
+  __structuredAttrs = true;
   subPackages = [
     "cmd/earthly"
     "cmd/debugger"
@@ -30,9 +31,8 @@ buildGoModule (finalAttrs: {
     "-s"
     "-w"
     "-X main.Version=v${finalAttrs.version}"
-    "-X main.DefaultBuildkitdImage=docker.io/earthly/buildkitd:v${finalAttrs.version}"
+    "-X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v${finalAttrs.version}"
     "-X main.GitSha=v${finalAttrs.version}"
-    "-X main.DefaultInstallationName=earthly"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     "-extldflags '-static'"
@@ -48,19 +48,22 @@ buildGoModule (finalAttrs: {
 
   postInstall = ''
     mv $out/bin/debugger $out/bin/earthly-debugger
+    ln -s $out/bin/earthly-debugger $out/bin/earth-debugger
+    ln -s $out/bin/earthly $out/bin/earth
   '';
 
   passthru = {
     tests.version = testers.testVersion {
-      package = earthly;
+      package = finalAttrs.finalPackage;
       version = "v${finalAttrs.version}";
     };
   };
 
   meta = {
     description = "Build automation for the container era";
-    homepage = "https://earthly.dev/";
-    changelog = "https://github.com/earthly/earthly/releases/tag/v${finalAttrs.version}";
+    mainProgram = "earth";
+    homepage = "https://earthbuild.dev/";
+    changelog = "https://github.com/EarthBuild/earthbuild/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
       zoedsoupe
diff --git a/pkgs/by-name/ed/edopro/update.py b/pkgs/by-name/ed/edopro/update.py
index f582fe6a9d89a..cbb572b72f720 100755
--- a/pkgs/by-name/ed/edopro/update.py
+++ b/pkgs/by-name/ed/edopro/update.py
@@ -1,20 +1,37 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python -p nix-prefetch-github python3Packages.githubkit
+#! nix-shell -i python -p nix-prefetch-github python3Packages.githubkit python3Packages.packaging
 import json
 import subprocess
 import sys
 
 from githubkit import GitHub, UnauthAuthStrategy
-from githubkit.versions.latest.models import (
-    Commit,
-    ContentSubmodule,
-    Tag,
-)
+from githubkit.versions.latest.models import Commit, ContentSubmodule, Tag
+from packaging.version import InvalidVersion, Version
 
 DEPS_PATH: str = "./pkgs/by-name/ed/edopro/deps.nix"
 
+
+def parse_tag(parsed_tag_data) -> Version | None:
+    # The GitHub REST API does not guarantee that tags are returned newest-first,
+    # and it also returns non-version tags such as "old-core" from 2015. Parse each
+    # tag as a version so we can drop the ones that aren't versions and sort the rest.
+    try:
+        return Version(parsed_tag_data.name)
+    except InvalidVersion:
+        return None
+
+
 with GitHub(UnauthAuthStrategy()) as github:
-    edopro: Tag = github.rest.repos.list_tags("edo9300", "edopro").parsed_data[0]
+    edopro_tags: list[Tag] = github.rest.repos.list_tags(
+        "edo9300", "edopro"
+    ).parsed_data
+    versioned_tags: list[Tag] = [
+        tag for tag in edopro_tags if parse_tag(tag) is not None
+    ]
+    if not versioned_tags:
+        print("Error: No valid version tags found.", file=sys.stderr)
+        exit(3)
+    edopro: Tag = max(versioned_tags, key=lambda tag: Version(tag.name))
 
     # This dep is not versioned in any way and is why we check below to see if this is a new version.
     irrlicht: Commit = github.rest.repos.list_commits(
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index 344d7db401f6d..b366fa8f131f9 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-desktop";
-  version = "1.12.23";
+  version = "1.12.24";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IdQZqwGk05APb38hEoin74/5FeRgjCLrdli+R6iaoUA=";
+    hash = "sha256-VSnhOPjlMuQRy5RsLN5IdRVyjmghTuAoRSffOFL6fns=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-WVQaq7kqlEdKodOkErUCeYLh0xnH1NTHzgNyjn1+1y0=";
+    hash = "sha256-dicE2mDba0mgu3iTbevowW6fRhqMytBQacQa4aSP47M=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix
index 45dd152435f03..8e01cf535582a 100644
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-web";
-  version = "1.12.23";
+  version = "1.12.24";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IdQZqwGk05APb38hEoin74/5FeRgjCLrdli+R6iaoUA=";
+    hash = "sha256-VSnhOPjlMuQRy5RsLN5IdRVyjmghTuAoRSffOFL6fns=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-WVQaq7kqlEdKodOkErUCeYLh0xnH1NTHzgNyjn1+1y0=";
+    hash = "sha256-dicE2mDba0mgu3iTbevowW6fRhqMytBQacQa4aSP47M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/fluffychat/package.nix b/pkgs/by-name/fl/fluffychat/package.nix
index 1d0a551811716..2ef9340259628 100644
--- a/pkgs/by-name/fl/fluffychat/package.nix
+++ b/pkgs/by-name/fl/fluffychat/package.nix
@@ -6,15 +6,13 @@
   imagemagick,
   libgbm,
   libdrm,
-  flutter341,
+  flutter344,
   pulseaudio,
   webkitgtk_4_1,
   copyDesktopItems,
   makeDesktopItem,
-
   callPackage,
-  vodozemac-wasm ? callPackage ./vodozemac-wasm.nix { flutter = flutter341; },
-
+  vodozemac-wasm ? callPackage ./vodozemac-wasm.nix { flutter = flutter344; },
   targetFlutterPlatform ? "linux",
 }:
 
@@ -24,36 +22,36 @@ let
     libdrm
   ];
   pubspecLock = lib.importJSON ./pubspec.lock.json;
-  libwebrtc = fetchzip {
-    url = "https://github.com/flutter-webrtc/flutter-webrtc/releases/download/v1.4.0/libwebrtc.zip";
-    sha256 = "sha256-OvqUF6RuytDorJE+C58EnIxPHfcphs8iPiPjt7SDrU0=";
-  };
+  libwebrtc_version = "m144.7559.09";
+  libwebrtc =
+    {
+      x86_64-linux = fetchzip {
+        url = "https://github.com/webrtc-sdk/libwebrtc/releases/download/libwebrtc.${libwebrtc_version}/libwebrtc-linux-x64-release.zip";
+        sha256 = "sha256-uzS07voCGM1zs663UalYpb8pWiYpkrKMxKt/wB4rcB4=";
+      };
+      aarch64-linux = fetchzip {
+        url = "https://github.com/webrtc-sdk/libwebrtc/releases/download/libwebrtc.${libwebrtc_version}/libwebrtc-linux-arm64-release.zip";
+        sha256 = "sha256-nMMU/HrCN4zSB4vO1O4TfJRBtK87OX+zYbxZRq8Q4Us=";
+      };
+    }
+    .${stdenv.hostPlatform.system};
 in
-flutter341.buildFlutterApplication (
+flutter344.buildFlutterApplication (
   rec {
     pname = "fluffychat-${targetFlutterPlatform}";
-    version = "2.6.0";
+    version = "2.8.0";
 
     src = fetchFromGitHub {
       owner = "krille-chan";
       repo = "fluffychat";
       tag = "v${version}";
-      hash = "sha256-iAHJjpDd2RNYPtEqyotFNvW/nybW1ozNtvMTT+wQVVY=";
+      hash = "sha256-+2srYuGNsCvxc89gq3zHgeCHrWTid7Oqtdno/Q/9hgk=";
     };
 
     inherit pubspecLock;
 
-    gitHashes = {
-      webcrypto = "sha256-yPhL0LoSIaJ9e9wrLtdPuTBRvXft1DQM9KR7WdNcj68=";
-    };
-
     inherit targetFlutterPlatform;
 
-    flutterBuildFlags = [
-      # Required since v2.4.0
-      "--enable-experiment=dot-shorthands"
-    ];
-
     meta = {
       description = "Chat with your friends (matrix client)";
       homepage = "https://fluffychat.im/";
@@ -63,6 +61,8 @@ flutter341.buildFlutterApplication (
         tebriel
         aleksana
       ];
+      # Refer to https://github.com/NixOS/nixpkgs/issues/545995
+      broken = stdenv.hostPlatform.isAarch64;
       badPlatforms = lib.platforms.darwin;
     }
     // lib.optionalAttrs (targetFlutterPlatform == "linux") {
@@ -79,6 +79,7 @@ flutter341.buildFlutterApplication (
     runtimeDependencies = [ pulseaudio ];
 
     env.NIX_LDFLAGS = "-rpath-link ${libwebrtcRpath}";
+    env.CXXFLAGS = "-include cstdint";
 
     desktopItems = [
       (makeDesktopItem {
@@ -105,8 +106,15 @@ flutter341.buildFlutterApplication (
           inherit (src) passthru;
 
           postPatch = ''
+            # Since we directly supply the binary distribution of libwebrtc instead of letting the builder download it we need to check that we still provide the correct version.
+            # nixpkgs forbids import from derivation, so we cannot simply read the contents to fetch the correct version
+            if ! grep -q "binary_version = libwebrtc.${libwebrtc_version}" third_party/libwebrtc_version.ini; then
+              echo -en "\nWrong libwebrtc version is in use!\n\t'libwebrtc.${libwebrtc_version}' was supplied, but cannot be found in 'third_party/libwebrtc_version.ini'.\nflutter_webrtc expects the following version:\n\t"
+              grep "binary_version" third_party/libwebrtc_version.ini; echo
+              false # triggers the build failure
+            fi
             substituteInPlace third_party/CMakeLists.txt \
-              --replace-fail "\''${CMAKE_CURRENT_LIST_DIR}/downloads/libwebrtc.zip" ${libwebrtc}
+              --replace-fail "\''${LIBWEBRTC_THIRD_PARTY_DIR}/downloads/\''${LIBWEBRTC_ASSET}.zip" ${libwebrtc}
               ln -s ${libwebrtc} third_party/libwebrtc
           '';
 
@@ -121,24 +129,18 @@ flutter341.buildFlutterApplication (
         };
     };
 
-    # Temporary fix for json deprecation error
-    # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
     postPatch = ''
       substituteInPlace linux/CMakeLists.txt \
         --replace-fail \
         "PRIVATE -Wall -Werror" \
-        "PRIVATE -Wall -Werror -Wno-deprecated"
+        "PRIVATE -Wall"
     '';
 
     postInstall = ''
-      FAV=$out/app/fluffychat-linux/data/flutter_assets/assets/favicon.png
       ICO=$out/share/icons
 
-      for size in 24 32 42 64 128 256 512; do
-        D=$ICO/hicolor/''${size}x''${size}/apps
-        mkdir -p $D
-        magick $FAV -resize ''${size}x''${size} $D/fluffychat.png
-      done
+      mkdir -p $ICO/hicolor/scalable/apps
+      cp $src/assets/logo/vector/logo_standalone.svg $ICO/hicolor/scalable/apps/fluffychat.png
 
       patchelf --add-rpath ${libwebrtcRpath} $out/app/fluffychat-linux/lib/libwebrtc.so
     '';
diff --git a/pkgs/by-name/fl/fluffychat/pubspec.lock.json b/pkgs/by-name/fl/fluffychat/pubspec.lock.json
index 7fd6b529283da..9f0c9cc14018f 100644
--- a/pkgs/by-name/fl/fluffychat/pubspec.lock.json
+++ b/pkgs/by-name/fl/fluffychat/pubspec.lock.json
@@ -10,6 +10,16 @@
       "source": "hosted",
       "version": "93.0.0"
     },
+    "analysis_server_plugin": {
+      "dependency": "transitive",
+      "description": {
+        "name": "analysis_server_plugin",
+        "sha256": "5f3920acbd5765764ec9ef6c5bbdd102015424281232ee4fb4f5431c87abb4eb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.3.7"
+    },
     "analyzer": {
       "dependency": "transitive",
       "description": {
@@ -74,11 +84,11 @@
       "dependency": "transitive",
       "description": {
         "name": "audio_session",
-        "sha256": "8f96a7fecbb718cb093070f868b4cdcb8a9b1053dce342ff8ab2fde10eb9afb7",
+        "sha256": "7217b229db57cc4dc577a8abb56b7429a5a212b978517a5be578704bfe5e568b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.2"
+      "version": "0.2.3"
     },
     "badges": {
       "dependency": "direct main",
@@ -144,11 +154,21 @@
       "dependency": "transitive",
       "description": {
         "name": "canonical_json",
-        "sha256": "d6be1dd66b420c6ac9f42e3693e09edf4ff6edfee26cb4c28c1c019fdb8c0c15",
+        "sha256": "618db0b1ea4238a3ef2f325908beee6269550d73b69dc5220456b75ce3cec072",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.1.3"
+    },
+    "change_case": {
+      "dependency": "transitive",
+      "description": {
+        "name": "change_case",
+        "sha256": "e41ef3df58521194ef8d7649928954805aeb08061917cf658322305e61568003",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.0"
     },
     "characters": {
       "dependency": "transitive",
@@ -184,11 +204,11 @@
       "dependency": "direct main",
       "description": {
         "name": "chewie",
-        "sha256": "53dadd2c5b6748742d7744072b38a417ad22691ca55715850300ee793dc7cb27",
+        "sha256": "5b8f00a9373252ddd2296d0d734b3b754380e6b4728ba848aff40e97fabad339",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.13.1"
+      "version": "1.14.1"
     },
     "cli_config": {
       "dependency": "transitive",
@@ -304,21 +324,21 @@
       "dependency": "transitive",
       "description": {
         "name": "cupertino_icons",
-        "sha256": "ba631d1c7f7bef6b729a622b7b752645a2d076dba9976925b8f25725a30e1ee6",
+        "sha256": "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.8"
+      "version": "1.0.9"
     },
     "dart_code_linter": {
       "dependency": "direct dev",
       "description": {
         "name": "dart_code_linter",
-        "sha256": "f0a63317198a495d04cccf98643fa6c2e8838805e370808b11b883a3efee0380",
+        "sha256": "44cce8527a2094201067b50aed97778930638cc43e8bb3cb0b40a90c36fb9c84",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.3"
+      "version": "4.1.6"
     },
     "dart_earcut": {
       "dependency": "transitive",
@@ -384,31 +404,31 @@
       "dependency": "transitive",
       "description": {
         "name": "desktop_webview_window",
-        "sha256": "57cf20d81689d5cbb1adfd0017e96b669398a669d927906073b0e42fc64111c0",
+        "sha256": "b6fdae2cbf9571879b1761c12f27facaf82e22d0bdc74d049907c2a09a432957",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.3"
+      "version": "0.3.0"
     },
     "device_info_plus": {
       "dependency": "direct main",
       "description": {
         "name": "device_info_plus",
-        "sha256": "b4fed1b2835da9d670d7bed7db79ae2a94b0f5ad6312268158a9b5479abbacdd",
+        "sha256": "0891702f96b2e465fe567b7ec448380e6b1c14f60af552a8536d9f583b6b8442",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.4.0"
+      "version": "13.2.0"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "device_info_plus_platform_interface",
-        "sha256": "e1ea89119e34903dca74b883d0dd78eb762814f97fb6c76f35e9ff74d261a18f",
+        "sha256": "04b173a92e2d9161dfead145667037c8d834db725ce2e7b942bfe18fd2f45a46",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.3"
+      "version": "8.1.0"
     },
     "dynamic_color": {
       "dependency": "direct main",
@@ -450,6 +470,16 @@
       "source": "hosted",
       "version": "2.2.0"
     },
+    "ffi_leak_tracker": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ffi_leak_tracker",
+        "sha256": "4093d4ef9ca06ffe2786e73bfb25e22aa92112b9bb4ec941f11e3e6b61489a97",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.2"
+    },
     "file": {
       "dependency": "transitive",
       "description": {
@@ -464,11 +494,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "f13a03000d942e476bc1ff0a736d2e9de711d2f89a95cd4c1d88f861c3348387",
+        "sha256": "fdc6a37f715d19f35b131decf1ce39242eeed5ddae18c0818c3eccb731ab76be",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.0.2"
+      "version": "12.0.0-beta.7"
     },
     "file_selector": {
       "dependency": "direct main",
@@ -484,11 +514,11 @@
       "dependency": "transitive",
       "description": {
         "name": "file_selector_android",
-        "sha256": "51e8fd0446de75e4b62c065b76db2210c704562d072339d333bd89c57a7f8a7c",
+        "sha256": "89243030ea4b3463fb402b44d5eeacc4ccb1c46a88870cb2a5080d693200c1ed",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.2+4"
+      "version": "0.5.2+6"
     },
     "file_selector_ios": {
       "dependency": "transitive",
@@ -582,6 +612,16 @@
       "source": "hosted",
       "version": "9.2.2"
     },
+    "flutter_launcher_icons": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "flutter_launcher_icons",
+        "sha256": "10f13781741a2e3972126fae08393d3c4e01fa4cd7473326b94b72cf594195e7",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.14.4"
+    },
     "flutter_linkify": {
       "dependency": "direct main",
       "description": {
@@ -606,41 +646,51 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_local_notifications",
-        "sha256": "0d9035862236fe38250fe1644d7ed3b8254e34a21b2c837c9f539fbb3bba5ef1",
+        "sha256": "a0d7141f14cabcee42967470a858dfc99dd6cfb70d3cab404bacfcafa9e84e70",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "21.0.0"
+      "version": "22.0.1"
     },
     "flutter_local_notifications_linux": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_local_notifications_linux",
-        "sha256": "e0f25e243c6c44c825bbbc6b2b2e76f7d9222362adcfe9fd780bf01923c840bd",
+        "sha256": "9ca97e63776f29ab1b955725c09999fc2c150523269db150c39274f2a43c5a8b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.0"
+      "version": "8.0.1"
     },
     "flutter_local_notifications_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_local_notifications_platform_interface",
-        "sha256": "e7db3d5b49c2b7ecc68deba4aaaa67a348f92ee0fef34c8e4b4459dbef0d7307",
+        "sha256": "ff0013eae795e8dc8fad4a8992a209e64d3ba2fbd8bf5e43c36bf448f95bd814",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "12.0.0"
+    },
+    "flutter_local_notifications_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "flutter_local_notifications_web",
+        "sha256": "516afaf97a2d1e67a036c6617321b00d205d72f7a67b6eccf936cd565f985878",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.0.0"
+      "version": "1.0.0"
     },
     "flutter_local_notifications_windows": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_local_notifications_windows",
-        "sha256": "3a2654ba104fbb52c618ebed9def24ef270228470718c43b3a6afcd5c81bef0c",
+        "sha256": "6f43bdd03b171b7a90f22647506fea33e2bb12294b7c7c7a3d690e960a382945",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.1.1"
     },
     "flutter_localizations": {
       "dependency": "direct main",
@@ -652,21 +702,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_map",
-        "sha256": "03b71c02806ff20c3718d108cbbb3638142ebafe368d8ce2dd22a33344bcb02b",
+        "sha256": "ce1debbb29cade61964334b2a19c7c76e5bb2ef7dacf126c6424ee44036232f8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.3.0"
-    },
-    "flutter_native_splash": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "flutter_native_splash",
-        "sha256": "4fb9f4113350d3a80841ce05ebf1976a36de622af7d19aca0ca9a9911c7ff002",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.4.7"
+      "version": "8.3.1"
     },
     "flutter_new_badger": {
       "dependency": "direct main",
@@ -682,11 +722,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "ee8068e0e1cd16c4a82714119918efdeed33b3ba7772c54b5d094ab53f9b7fd1",
+        "sha256": "38d1c268de9097ff59cf0e844ac38759fc78f76836d37edad06fa21e182055a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.33"
+      "version": "2.0.34"
     },
     "flutter_rust_bridge": {
       "dependency": "transitive",
@@ -702,31 +742,31 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_secure_storage",
-        "sha256": "6848263f9744072d0977347c383fb8b57d9780319a6bf5238b5a2866a029de62",
+        "sha256": "7686b1d6a29985dcbb808c59518226e603e3bfa7c0ddfd1a0d00e4cda77c868e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.2.0"
+      "version": "10.3.1"
     },
     "flutter_secure_storage_darwin": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_secure_storage_darwin",
-        "sha256": "67cd1ff671add31dc13e45194398187a04bb63804b37fa47866afae296d73fcb",
+        "sha256": "82329fa5cdf343773b1b6897dea959105a29f092454259edff92f9f6637e8149",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.1"
+      "version": "0.3.2"
     },
     "flutter_secure_storage_linux": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_secure_storage_linux",
-        "sha256": "2b5c76dce569ab752d55a1cee6a2242bcc11fdba927078fb88c503f150767cda",
+        "sha256": "a5f35ddab43cf5c8215d2feb4ce1957851f28c5c37e6f04335066a0602087bf5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.0.1"
     },
     "flutter_secure_storage_platform_interface": {
       "dependency": "transitive",
@@ -752,11 +792,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_secure_storage_windows",
-        "sha256": "3b7c8e068875dfd46719ff57c90d8c459c87f2302ed6b00ff006b3c9fcad1613",
+        "sha256": "471951813a97006d899db4948acc654a4f28c440083ea08178935ce20b173ec1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.2.2"
     },
     "flutter_shortcuts_new": {
       "dependency": "direct main",
@@ -788,11 +828,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_web_auth_2",
-        "sha256": "d354998934ddc338e69b999b2abaeb33c6fd09999d3a5f92ead1a6b49b49712e",
+        "sha256": "8f9303471dcd96670878c9b7c0c4e14c37595b2add67465f6a868f17a5872dfc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.2"
+      "version": "5.0.3"
     },
     "flutter_web_auth_2_platform_interface": {
       "dependency": "transitive",
@@ -814,11 +854,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_webrtc",
-        "sha256": "c7b0a67ca2c878575fc5c146d801cd874f58f5f1ef5fa6e8eb0c93d413beb948",
+        "sha256": "0f89dee7f4c35dab5611f351c3897a3bfe9f7057720cc7da209b52455af4316e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.1"
+      "version": "1.5.2"
     },
     "frontend_server_client": {
       "dependency": "transitive",
@@ -850,41 +890,41 @@
       "dependency": "direct main",
       "description": {
         "name": "geolocator",
-        "sha256": "79939537046c9025be47ec645f35c8090ecadb6fe98eba146a0d25e8c1357516",
+        "sha256": "e146a6d63776582651e97a79cbe459f8e1211b100101fadcd84db83361fa599f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.0.2"
+      "version": "14.0.3"
     },
     "geolocator_android": {
       "dependency": "transitive",
       "description": {
         "name": "geolocator_android",
-        "sha256": "179c3cb66dfa674fc9ccbf2be872a02658724d1c067634e2c427cf6df7df901a",
+        "sha256": "86ea1654e4f61ff51466848e91c116b422d6010ea269fda0fbe1af7e9e742ce1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.2"
+      "version": "5.0.3"
     },
     "geolocator_apple": {
       "dependency": "transitive",
       "description": {
         "name": "geolocator_apple",
-        "sha256": "dbdd8789d5aaf14cf69f74d4925ad1336b4433a6efdf2fce91e8955dc921bf22",
+        "sha256": "853803d6bb1713c094e935b4a5ae5f19c0308acf81da13fa9ff84fb4c70c0b73",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.13"
+      "version": "2.3.14"
     },
     "geolocator_linux": {
       "dependency": "transitive",
       "description": {
         "name": "geolocator_linux",
-        "sha256": "d64112a205931926f4363bb6bd48f14cb38e7326833041d170615586cd143797",
+        "sha256": "3da7420f11c3496511a5bd3c18fd67b88e5659f12e46b7ce00a788f6996e850a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.4"
+      "version": "0.2.6"
     },
     "geolocator_platform_interface": {
       "dependency": "transitive",
@@ -900,11 +940,11 @@
       "dependency": "transitive",
       "description": {
         "name": "geolocator_web",
-        "sha256": "b1ae9bdfd90f861fde8fd4f209c37b953d65e92823cb73c7dee1fa021b06f172",
+        "sha256": "19e485a0f8d6a88abcf9c53cba3a4105e14b7435ed8ac1c108c067b938fe8429",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.3"
+      "version": "4.1.4"
     },
     "geolocator_windows": {
       "dependency": "transitive",
@@ -930,11 +970,11 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "92d8cee7c57dff0a6c409c05597b460002434eccf7424a712283225b3962d03f",
+        "sha256": "5922b2861e2235a3504896f0d6fa07d84141b480cf52eecd2f42cd25585a9e8a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "17.2.3"
+      "version": "17.3.0"
     },
     "gsettings": {
       "dependency": "transitive",
@@ -970,11 +1010,11 @@
       "dependency": "transitive",
       "description": {
         "name": "hooks",
-        "sha256": "7a08a0d684cb3b8fb604b78455d5d352f502b68079f7b80b831c62220ab0a4f6",
+        "sha256": "025f060e86d2d4c3c47b56e33caf7f93bf9283340f26d23424ebcfccf34f621e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.1"
+      "version": "1.0.3"
     },
     "html": {
       "dependency": "direct main",
@@ -1040,21 +1080,21 @@
       "dependency": "direct main",
       "description": {
         "name": "image_picker",
-        "sha256": "91c025426c2881c551100bce834e201c835a170151545f58d17da5180ca7d9ac",
+        "sha256": "d8402284df184bc05f4a2210c6c23983b0720f4cd87cbd05c5390a78af602667",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.2"
+      "version": "1.2.3"
     },
     "image_picker_android": {
       "dependency": "transitive",
       "description": {
         "name": "image_picker_android",
-        "sha256": "518a16108529fc18657a3e6dde4a043dc465d16596d20ab2abd49a4cac2e703d",
+        "sha256": "d5b3e1774af29c9ab00103afb0d4614070f924d2e0057ac867ec98800114793f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.8.13+13"
+      "version": "0.8.13+17"
     },
     "image_picker_for_web": {
       "dependency": "transitive",
@@ -1142,6 +1182,26 @@
       "source": "hosted",
       "version": "1.0.5"
     },
+    "jni": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni",
+        "sha256": "c2230682d5bc2362c1c9e8d3c7f406d9cbba23ab3f2e203a025dd47e0fb2e68f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "jni_flutter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni_flutter",
+        "sha256": "8b59e590786050b1cd866677dddaf76b1ade5e7bc751abe04b86e84d379d3ba6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.1"
+    },
     "js": {
       "dependency": "transitive",
       "description": {
@@ -1156,21 +1216,21 @@
       "dependency": "transitive",
       "description": {
         "name": "json_annotation",
-        "sha256": "805fa86df56383000f640384b282ce0cb8431f1a7a2396de92fb66186d8c57df",
+        "sha256": "2a743920d81b7910627f68ee2c9ac1fc0bfee32b9fc3403587d7c6791ca12f80",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.10.0"
+      "version": "4.12.0"
     },
     "just_audio": {
       "dependency": "direct main",
       "description": {
         "name": "just_audio",
-        "sha256": "9694e4734f515f2a052493d1d7e0d6de219ee0427c7c29492e246ff32a219908",
+        "sha256": "e60aa97b233ddea025e13dfac59195207f528fa5e9e4a4a49a8c0766701e5fe6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.10.5"
+      "version": "0.10.6"
     },
     "just_audio_platform_interface": {
       "dependency": "transitive",
@@ -1196,11 +1256,11 @@
       "dependency": "direct main",
       "description": {
         "name": "latlong2",
-        "sha256": "98227922caf49e6056f91b6c56945ea1c7b166f28ffcd5fb8e72fc0b453cc8fe",
+        "sha256": "84b776b100a84a684a0aaa3fa4dc2c9b1931c658de533701ee4e09bfa991f8dc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.1"
+      "version": "0.10.1"
     },
     "leak_tracker": {
       "dependency": "transitive",
@@ -1262,25 +1322,65 @@
       "source": "hosted",
       "version": "6.1.0"
     },
-    "lists": {
+    "local_auth": {
+      "dependency": "direct main",
+      "description": {
+        "name": "local_auth",
+        "sha256": "ecf24edf2283c509ecd217e3595f6f71034b68888d28ad1dae6bfa0857b816ac",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
+    "local_auth_android": {
       "dependency": "transitive",
       "description": {
-        "name": "lists",
-        "sha256": "4ca5c19ae4350de036a7e996cdd1ee39c93ac0a2b840f4915459b7d0a7d4ab27",
+        "name": "local_auth_android",
+        "sha256": "fdb936d59ab945c7af297defd67bd1ed87b11b6db1bc16d01e94677a8f1c38ec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.1"
+      "version": "2.0.9"
+    },
+    "local_auth_darwin": {
+      "dependency": "transitive",
+      "description": {
+        "name": "local_auth_darwin",
+        "sha256": "a8c3d4e17454111f7fd31ff72a31222359f6059f7fe956c2dcfe0f88f49826d4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
+    },
+    "local_auth_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "local_auth_platform_interface",
+        "sha256": "f98b8e388588583d3f781f6806e4f4c9f9e189d898d27f0c249b93a1973dd122",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.0"
+    },
+    "local_auth_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "local_auth_windows",
+        "sha256": "be12c5b8ba5e64896983123655c5f67d2484ecfcc95e367952ad6e3bff94cb16",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
     },
     "logger": {
       "dependency": "transitive",
       "description": {
         "name": "logger",
-        "sha256": "a7967e31b703831a893bbc3c3dd11db08126fe5f369b5c648a36f821979f5be3",
+        "sha256": "25aee487596a6257655a1e091ec2ae66bc30e7af663592cc3a27e6591e05035c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.2"
+      "version": "2.7.0"
     },
     "logging": {
       "dependency": "transitive",
@@ -1296,11 +1396,11 @@
       "dependency": "transitive",
       "description": {
         "name": "markdown",
-        "sha256": "935e23e1ff3bc02d390bad4d4be001208ee92cc217cb5b5a6c19bc14aaa318c1",
+        "sha256": "ee85086ad7698b42522c6ad42fe195f1b9898e4d974a1af4576c1a3a176cada9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.3.0"
+      "version": "7.3.1"
     },
     "matcher": {
       "dependency": "transitive",
@@ -1326,31 +1426,31 @@
       "dependency": "direct main",
       "description": {
         "name": "matrix",
-        "sha256": "734eae63fa4b707999ee9165e0fc7e1205d1fcb37fef9727bb4f79cda460e1ab",
+        "sha256": "25ab47abd6a98c5c1affd1c735b83dcd01844f49c60483d679ffb9463f0a3f61",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.1.2"
+      "version": "8.1.0"
     },
     "meta": {
       "dependency": "transitive",
       "description": {
         "name": "meta",
-        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
+        "sha256": "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.17.0"
+      "version": "1.18.0"
     },
     "mgrs_dart": {
       "dependency": "transitive",
       "description": {
         "name": "mgrs_dart",
-        "sha256": "fb89ae62f05fa0bb90f70c31fc870bcbcfd516c843fb554452ab3396f78586f7",
+        "sha256": "385e7168ecc77eb545220223c49eef8ab249da7bf57f22781c40a04d23fb196f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.0"
+      "version": "3.0.0"
     },
     "mime": {
       "dependency": "direct main",
@@ -1376,11 +1476,21 @@
       "dependency": "transitive",
       "description": {
         "name": "native_toolchain_c",
-        "sha256": "89e83885ba09da5fdf2cdacc8002a712ca238c28b7f717910b34bcd27b0d03ac",
+        "sha256": "6ba77bb18063eebe9de401f5e6437e95e1438af0a87a3a39084fbd37c90df572",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.17.6"
+    },
+    "native_toolchain_cmake": {
+      "dependency": "transitive",
+      "description": {
+        "name": "native_toolchain_cmake",
+        "sha256": "cd4865568c57f03c7ab1f138cc5032c5f77825d27083d6f5a3e9bbb3e8014a87",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.17.4"
+      "version": "0.2.5"
     },
     "nested": {
       "dependency": "transitive",
@@ -1436,41 +1546,41 @@
       "dependency": "direct main",
       "description": {
         "name": "package_info_plus",
-        "sha256": "468c26b4254ab01979fa5e4a98cb343ea3631b9acee6f21028997419a80e1a20",
+        "sha256": "f5c435dc0e0d461e5b32471a870f769b6a1cc46930637efe24fbc535314e78ad",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.0.1"
+      "version": "10.2.0"
     },
     "package_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "package_info_plus_platform_interface",
-        "sha256": "202a487f08836a592a6bd4f901ac69b3a8f146af552bbd14407b6b41e1c3f086",
+        "sha256": "db762cb2f4f25ee60fb6359773861b0f199e00b90d237bd85a76a1e806b46ef4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.1"
+      "version": "4.1.0"
     },
     "pana": {
       "dependency": "transitive",
       "description": {
         "name": "pana",
-        "sha256": "d7bd85f18a14909f0baab69a13895dc4ff163be51c9884f73a506982adeac57d",
+        "sha256": "847ee5df6ac13fdc6c53d641095de1b25886c973d0b0f0469c73521ebe4602fa",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.23.10"
+      "version": "0.23.12"
     },
     "particles_network": {
       "dependency": "direct main",
       "description": {
         "name": "particles_network",
-        "sha256": "f35f4e2bbd6872c6cff1d13628853d2fb2df6cc83b88c4f4757afe70333f5c6a",
+        "sha256": "afa9c9c70d7f13dcb2a4059edde4b6baa3b9a69ab899712522cbbd68bbd59095",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.4"
+      "version": "1.9.5"
     },
     "pasteboard": {
       "dependency": "direct main",
@@ -1496,21 +1606,21 @@
       "dependency": "direct main",
       "description": {
         "name": "path_provider",
-        "sha256": "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd",
+        "sha256": "a7f4874f987173da295a61c181b8ee71dab59b332a486b391babf26a1b884825",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.1.6"
     },
     "path_provider_android": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "f2c65e21139ce2c3dad46922be8272bb5963516045659e71bb16e151c93b580e",
+        "sha256": "69cbd515a62b94d32a7944f086b2f82b4ac40a1d45bebfc00813a430ab2dabcd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.22"
+      "version": "2.3.1"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1596,11 +1706,11 @@
       "dependency": "transitive",
       "description": {
         "name": "posix",
-        "sha256": "6323a5b0fa688b6a010df4905a56b00181479e6d10534cecfecede2aa55add61",
+        "sha256": "185ef7606574f789b40f289c233efa52e96dead518aed988e040a10737febb07",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.3"
+      "version": "6.5.0"
     },
     "pretty_qr_code": {
       "dependency": "direct main",
@@ -1626,11 +1736,11 @@
       "dependency": "transitive",
       "description": {
         "name": "proj4dart",
-        "sha256": "c8a659ac9b6864aa47c171e78d41bbe6f5e1d7bd790a5814249e6b68bc44324e",
+        "sha256": "ddcedc1f7876e62717de43ab3491e2829bdad0b028261805f94aa080967e5859",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "3.0.0"
     },
     "provider": {
       "dependency": "direct main",
@@ -1696,11 +1806,11 @@
       "dependency": "direct main",
       "description": {
         "name": "qr_code_scanner_plus",
-        "sha256": "dae0596b2763c2fd0294f5cfddb1d3a21577ae4dc7fc1449eb5aafc957872f61",
+        "sha256": "20a1abc3d12e48ad1c58eb6f31cabed23cc29469c325e750d6e838613170c94b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.2.0"
     },
     "qr_image": {
       "dependency": "direct main",
@@ -1736,81 +1846,91 @@
       "dependency": "direct main",
       "description": {
         "name": "record",
-        "sha256": "10911465138fafacef459a780564e883e01bd48eabf87ab20543684884492870",
+        "sha256": "82539d1372e23cf51375fdfcba084f39912bcbf9a953b75d56596691f8f11c0f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.2.1"
+      "version": "7.1.1"
     },
     "record_android": {
       "dependency": "transitive",
       "description": {
         "name": "record_android",
-        "sha256": "eb1732e42d0d2a1895b8db86e4fc917287e6d8491b6ed59918aea8bed6c69de4",
+        "sha256": "28f1108626a190e249b01ffa9f639070e31e5157474b64a5ae380bf36aec9559",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.2"
+      "version": "2.1.2"
     },
     "record_ios": {
       "dependency": "transitive",
       "description": {
         "name": "record_ios",
-        "sha256": "c051fb48edd7a0e265daafb9108730dc827c27b551728a3fdfb3ef69efd89c73",
+        "sha256": "21d189f49a598af4697dac4cc9e48389ac0a1fb3e916622b5504a58d9b96313e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.1"
+      "version": "2.1.1"
     },
     "record_linux": {
       "dependency": "transitive",
       "description": {
         "name": "record_linux",
-        "sha256": "31181787bf7eccb0e298835836b69b3cd0a903863b75d70e937de3dec71cd8f3",
+        "sha256": "305526af0560866a0cc4219aa3726ef8541f819e14bd5f65b73ffdb7dc5911be",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.1"
+      "version": "2.1.0"
     },
     "record_macos": {
       "dependency": "transitive",
       "description": {
         "name": "record_macos",
-        "sha256": "cfe1b61435e27db418bf513dc36820d10c9f7eb1843786c2c9a52e07e2f4f627",
+        "sha256": "ced7495abf3d683e8a7dbe8fc96df8ea5722837a26f922b7cb7c5de11661bb46",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.2"
+      "version": "2.1.1"
     },
     "record_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "record_platform_interface",
-        "sha256": "8e56cbe06c6984137fb86132ff03459f29938d927496d9b2d0962e2d6345d488",
+        "sha256": "d94b37cadb8fe203e64b0e9893271c0b71b34f2550ee7fb0c6105d650e00c1f5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.6.0"
+      "version": "2.1.0"
+    },
+    "record_use": {
+      "dependency": "transitive",
+      "description": {
+        "name": "record_use",
+        "sha256": "2551bd8eecfe95d14ae75f6021ad0248be5c27f138c2ec12fcb52b500b3ba1ed",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.0"
     },
     "record_web": {
       "dependency": "transitive",
       "description": {
         "name": "record_web",
-        "sha256": "7e9846981c1f2d111d86f0ae3309071f5bba8b624d1c977316706f08fc31d16d",
+        "sha256": "7d75ed681b5bf40c3a9b51b6c105fe53705f752284d859d5f030ab5a2bfd49cf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.0"
+      "version": "2.1.1"
     },
     "record_windows": {
       "dependency": "transitive",
       "description": {
         "name": "record_windows",
-        "sha256": "223258060a1d25c62bae18282c16783f28581ec19401d17e56b5205b9f039d78",
+        "sha256": "39ca03e7ae4df5e2512bc3c92b0ef9a7b148d9295ae8ac92df6beb4daf939d94",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.7"
+      "version": "2.2.0"
     },
     "retry": {
       "dependency": "transitive",
@@ -1916,21 +2036,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "223873d106614442ea6f20db5a038685cc5b32a2fba81cdecaefbbae0523f7fa",
+        "sha256": "9eee8283462d91a7a1c8bdb67d08874abd75a2f8fae3bc0ca033035e375fb3d8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.0.2"
+      "version": "13.2.0"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "88023e53a13429bd65d8e85e11a9b484f49d4c190abbd96c7932b74d6927cc9a",
+        "sha256": "7f7ae28cf400d13f811e297ff37742dba83b79e0a6f5dce14eec0248274e6ce9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.0"
+      "version": "7.1.0"
     },
     "shared_preferences": {
       "dependency": "direct main",
@@ -1946,11 +2066,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "cbc40be9be1c5af4dab4d6e0de4d5d3729e6f3d65b89d21e1815d57705644a6f",
+        "sha256": "e8d4762b1e2e8578fc4d0fd548cebf24afd24f49719c08974df92834565e2c53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.20"
+      "version": "2.4.23"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -1976,11 +2096,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_platform_interface",
-        "sha256": "57cbf196c486bc2cf1f02b85784932c6094376284b3ad5779d1b1c6c6a816b80",
+        "sha256": "649dc798a33931919ea356c4305c2d1f81619ea6e92244070b520187b5140ef9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.1"
+      "version": "2.4.2"
     },
     "shared_preferences_web": {
       "dependency": "transitive",
@@ -2042,6 +2162,16 @@
       "source": "hosted",
       "version": "3.0.0"
     },
+    "simple_sparse_list": {
+      "dependency": "transitive",
+      "description": {
+        "name": "simple_sparse_list",
+        "sha256": "aa648fd240fa39b49dcd11c19c266990006006de6699a412de485695910fbc1f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.4"
+    },
     "sky_engine": {
       "dependency": "transitive",
       "description": "flutter",
@@ -2092,11 +2222,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sqflite_common",
-        "sha256": "6ef422a4525ecc601db6c0a2233ff448c731307906e92cabc9ba292afaae16a6",
+        "sha256": "1581ffbf7a0e333b380d6a30737d78516b826cb35beb7fb0bf8a3ea0c678b465",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.6"
+      "version": "2.5.8"
     },
     "sqflite_common_ffi": {
       "dependency": "direct main",
@@ -2192,11 +2322,11 @@
       "dependency": "transitive",
       "description": {
         "name": "synchronized",
-        "sha256": "c254ade258ec8282947a0acbbc90b9575b4f19673533ee46f2f6e9b3aeefd7c0",
+        "sha256": "63896c27e81b28f8cb4e69ead0d3e8f03f1d1e5fc531a3e579cabed6a2c7c9e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.4.0"
+      "version": "3.4.0+1"
     },
     "term_glyph": {
       "dependency": "transitive",
@@ -2212,31 +2342,31 @@
       "dependency": "transitive",
       "description": {
         "name": "test",
-        "sha256": "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7",
+        "sha256": "8d9ceddbab833f180fbefed08afa76d7c03513dfdba87ffcec2718b02bbcbf20",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.30.0"
+      "version": "1.31.0"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a",
+        "sha256": "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.10"
+      "version": "0.7.11"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51",
+        "sha256": "1991d4cfe85d5043241acac92962c3977c8d2f2add1ee73130c7b286417d1d34",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.16"
+      "version": "0.6.17"
     },
     "timezone": {
       "dependency": "transitive",
@@ -2248,16 +2378,6 @@
       "source": "hosted",
       "version": "0.11.0"
     },
-    "translations_cleaner": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "translations_cleaner",
-        "sha256": "c6e5051cb5d4fe4c5b2cc1ef83a6964f27063f9cf5b6166f445709bea8f81ad3",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.1.1"
-    },
     "typed_data": {
       "dependency": "transitive",
       "description": {
@@ -2272,11 +2392,11 @@
       "dependency": "transitive",
       "description": {
         "name": "unicode",
-        "sha256": "0f69e46593d65245774d4f17125c6084d2c20b4e473a983f6e21b7d7762218f1",
+        "sha256": "a6f7bcfc8ea1d5ce1f6c0b1c39117a9919f4953edd9fd7a64090a9796c499b57",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.1"
+      "version": "1.1.9"
     },
     "unifiedpush": {
       "dependency": "direct main",
@@ -2372,11 +2492,11 @@
       "dependency": "transitive",
       "description": {
         "name": "unorm_dart",
-        "sha256": "5b35bff83fce4d76467641438f9e867dc9bcfdb8c1694854f230579d68cd8f4b",
+        "sha256": "0c69186b03ca6addab0774bcc0f4f17b88d4ce78d9d4d8f0619e30a99ead58e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.3.2"
     },
     "url_launcher": {
       "dependency": "direct main",
@@ -2392,11 +2512,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "767344bf3063897b5cf0db830e94f904528e6dd50a6dfaf839f0abf509009611",
+        "sha256": "17bc677f0b301615530dd1d67e0a9828cafa2d0b6b6eae4cd3679b7eac4a273c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.28"
+      "version": "6.3.30"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
@@ -2442,11 +2562,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_web",
-        "sha256": "d0412fcf4c6b31ecfdb7762359b7206ffba3bbffd396c6d9f9c4616ece476c1f",
+        "sha256": "85c81589622fbc87c1c683aaea164d3604a7777495a79d91e39ffcdec39ddb34",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.4.3"
     },
     "url_launcher_windows": {
       "dependency": "transitive",
@@ -2462,11 +2582,11 @@
       "dependency": "transitive",
       "description": {
         "name": "uuid",
-        "sha256": "a11b666489b1954e01d992f3d601b1804a33937b5a8fe677bd26b8a9f96f96e8",
+        "sha256": "1fef9e8e11e2991bb773070d4656b7bd5d850967a2456cfc83cf47925ba79489",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.2"
+      "version": "4.5.3"
     },
     "vector_math": {
       "dependency": "transitive",
@@ -2492,41 +2612,41 @@
       "dependency": "direct main",
       "description": {
         "name": "video_player",
-        "sha256": "48a7bdaa38a3d50ec10c78627abdbfad863fdf6f0d6e08c7c3c040cfd80ae36f",
+        "sha256": "20ef311160e2ced020a62f38e4cc399a1bf289e722fc5fe37c9d7b18e44c9e8d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.11.1"
+      "version": "2.13.0"
     },
     "video_player_android": {
       "dependency": "transitive",
       "description": {
         "name": "video_player_android",
-        "sha256": "e726b33894526cf96a3eefe61af054b0c3e7d254443b3695b3c142dc277291be",
+        "sha256": "5121de08444d00363efdda630a69ad4d27a208a9f7586482d4909a44a1cdbc63",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.9.3"
+      "version": "2.11.0"
     },
     "video_player_avfoundation": {
       "dependency": "transitive",
       "description": {
         "name": "video_player_avfoundation",
-        "sha256": "f93b93a3baa12ca0ff7d00ca8bc60c1ecd96865568a01ff0c18a99853ee201a5",
+        "sha256": "c238f5f0a26845cd0bcc2956049b63065a4d3c40ddfc22c3414cd170bef7fff9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.9.3"
+      "version": "2.11.0"
     },
     "video_player_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "video_player_platform_interface",
-        "sha256": "57c5d73173f76d801129d0531c2774052c5a7c11ccb962f1830630decd9f24ec",
+        "sha256": "92c0fbabe20c788e71fd10d26cea998d0d253282e65d145aed0818731cf593ce",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.6.0"
+      "version": "6.9.0"
     },
     "video_player_web": {
       "dependency": "transitive",
@@ -2542,11 +2662,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
+        "sha256": "0016aef94fc66495ac78af5859181e3f3bf2026bd8eecc72b9565601e19ab360",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "15.0.2"
+      "version": "15.2.0"
     },
     "vodozemac": {
       "dependency": "transitive",
@@ -2562,21 +2682,21 @@
       "dependency": "direct main",
       "description": {
         "name": "wakelock_plus",
-        "sha256": "ddf3db70eaa10c37558ff817519b85d527dbd21034fd5d8e1c2e85f31588f1c1",
+        "sha256": "824c5bba0f800e86d32e57d3d1843c531f090005cc89d9a837933e6601093d53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.2"
+      "version": "1.6.1"
     },
     "wakelock_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "wakelock_plus_platform_interface",
-        "sha256": "24b84143787220a403491c2e5de0877fbbb87baf3f0b18a2a988973863db4b03",
+        "sha256": "b13f99e992e7ae6a152e16c5559d3c07ff445b13330192662494e614ca3e7d7b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.1"
     },
     "watcher": {
       "dependency": "transitive",
@@ -2619,15 +2739,14 @@
       "version": "3.0.3"
     },
     "webcrypto": {
-      "dependency": "direct overridden",
+      "dependency": "transitive",
       "description": {
-        "path": ".",
-        "ref": "master",
-        "resolved-ref": "dcc7ba78c9721de56a800fda9a9e2bc759b9cad3",
-        "url": "https://github.com/google/webcrypto.dart.git"
+        "name": "webcrypto",
+        "sha256": "9885ed99a846191542dd6ca820c83a098117df56be57453832233a3fef68f3f2",
+        "url": "https://pub.dev"
       },
-      "source": "git",
-      "version": "0.6.0"
+      "source": "hosted",
+      "version": "0.6.1"
     },
     "webdriver": {
       "dependency": "transitive",
@@ -2673,21 +2792,21 @@
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "d7cb55e04cd34096cd3a79b3330245f54cb96a370a1c27adb3c84b917de8b08e",
+        "sha256": "ba6f4bba816c8d7e3c1580e170f3786d216951cc6b94babc3b814c08d2cb2738",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.15.0"
+      "version": "6.3.0"
     },
     "win32_registry": {
       "dependency": "transitive",
       "description": {
         "name": "win32_registry",
-        "sha256": "6f1b564492d0147b330dd794fee8f512cec4977957f310f9951b5f9d83618dae",
+        "sha256": "73b1d78920a9d6e03f8b4e43e612b87bf3152a0e5c5e5150267762b7c4116904",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "3.0.3"
     },
     "window_manager": {
       "dependency": "transitive",
@@ -2748,10 +2867,20 @@
       },
       "source": "hosted",
       "version": "3.1.3"
+    },
+    "yaml_edit": {
+      "dependency": "transitive",
+      "description": {
+        "name": "yaml_edit",
+        "sha256": "07c9e63ba42519745182b88ca12264a7ba2484d8239958778dfe4d44fe760488",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.4"
     }
   },
   "sdks": {
-    "dart": ">=3.11.1 <4.0.0",
-    "flutter": ">=3.38.4"
+    "dart": ">=3.12.0 <4.0.0",
+    "flutter": ">=3.44.0"
   }
 }
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 4cf8e072e10b0..b98077c46fac7 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.24";
+  version = "3.16.25";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-+4jEQAUGKOFJkLUJHIz1hVx7kbt+wMhLcbboiz0PC/E=";
+    hash = "sha256-KPIUoHMzArqEVbhS8hrvzQUV906MydBPm5ZmV/CVS3A=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/gitea-mcp-server/package.nix b/pkgs/by-name/gi/gitea-mcp-server/package.nix
index 8a21b9f7fdbd8..b3f36b61bee93 100644
--- a/pkgs/by-name/gi/gitea-mcp-server/package.nix
+++ b/pkgs/by-name/gi/gitea-mcp-server/package.nix
@@ -6,17 +6,17 @@
 
 buildGo126Module (finalAttrs: {
   pname = "gitea-mcp-server";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "gitea-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vufclzgshz9/+7B4tO2xtz7pEfBX+xhKOngC7N6se6U=";
+    hash = "sha256-K3jEuFrGm4J1atMOtBIxSlzzi6NtrcxG0sIL0uzrUW8=";
   };
 
-  vendorHash = "sha256-35zVDzivvO3tSi1RYvXJoLvrlvnp3JCzwC5FqDEj91M=";
+  vendorHash = "sha256-BYHcV5WSklGqdeTN7S2AMtscJDCA/8n1gEOgLzr9Gmk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 01f8f222233ec..6f7021ae3974d 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGo125Module rec {
   pname = "gitlab-container-registry";
-  version = "4.40.2";
+  version = "4.39.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo125Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-k94uEM2VoOtdFRXWm6CDmeRt8LMXSNegRGes3ZKPg0I=";
+    hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
   };
 
-  vendorHash = "sha256-MD98JYwTo/t5/E7clIlUfjmv8t7nDPpVElbuYDRjMMc=";
+  vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
 
   excludedPackages = [
     "devvm/*"
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index faf1f96f7f104..2e2f70d0065de 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -181,10 +181,24 @@ let
     inherit pname meta passthru;
     version = "150.0.7871.186";
 
-    src = fetchurl {
-      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
-    };
+    src =
+      let
+        debArch =
+          {
+            aarch64-linux = "arm64";
+            x86_64-linux = "amd64";
+          }
+          .${stdenvNoCC.hostPlatform.system};
+      in
+      fetchurl {
+        url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
+        hash =
+          {
+            amd64 = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
+            arm64 = "sha256-AllqLQfbFu7EJCK5Xeo3TuItGMnOqunpMBKY4OJnj7M=";
+          }
+          .${debArch};
+      };
 
     # With strictDeps on, some shebangs were not being patched correctly
     # ie, $out/share/google/chrome/google-chrome
@@ -338,7 +352,10 @@ let
       iedame
       mdaniels5757
     ];
-    platforms = lib.platforms.darwin ++ [ "x86_64-linux" ];
+    platforms = lib.platforms.darwin ++ [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "google-chrome-stable";
   };
diff --git a/pkgs/by-name/go/google-chrome/update.sh b/pkgs/by-name/go/google-chrome/update.sh
index 7889ac11eaf58..32a897e05161c 100755
--- a/pkgs/by-name/go/google-chrome/update.sh
+++ b/pkgs/by-name/go/google-chrome/update.sh
@@ -27,8 +27,10 @@ update_linux() {
     local version_info
     local version
     local current_version
+    local arch
+    local download_url
     local new_hash
-    local new_sri_hash
+    local -A new_hashes
 
     read -ra version_info <<< "$(get_version_info "linux" "linux = stdenvNoCC.mkDerivation" "});")"
     version="${version_info[0]}"
@@ -39,14 +41,18 @@ update_linux() {
         return 0
     fi
 
-    local download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_amd64.deb"
-    new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
-    new_sri_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
+    for arch in amd64 arm64; do
+        download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_${arch}.deb"
+        new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
+        new_hashes["$arch"]="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
+    done
 
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
-    sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
 
-    echo "[Nix] Linux google-chrome: $current_version -> $version with hash $new_hash"
+    for arch in amd64 arm64; do
+        sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|^\([[:space:]]*\)${arch} = \".*\";|\1${arch} = \"${new_hashes[$arch]}\";|" "$DEFAULT_NIX"
+        echo "[Nix] Linux ${arch} google-chrome: $current_version -> $version with hash ${new_hashes[$arch]}"
+    done
 }
 
 update_darwin() {
diff --git a/pkgs/by-name/gr/graphene-hardened-malloc/package.nix b/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
index bffb4d7959a17..be0fece666ec9 100644
--- a/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
+++ b/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
@@ -2,6 +2,7 @@
   fetchFromGitHub,
   lib,
   makeWrapper,
+  nix-update-script,
   python3,
   runCommand,
   stdenv,
@@ -10,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphene-hardened-malloc";
-  version = "2025092700";
+  version = "14";
 
   src = fetchFromGitHub {
     owner = "GrapheneOS";
     repo = "hardened_malloc";
-    rev = finalAttrs.version;
-    hash = "sha256-t7PnBwpGh53+ZqTbnm8lYaNBtUgLev9kbvFlbfSCBrU=";
+    tag = finalAttrs.version;
+    hash = "sha256-QUGDJyTnD5MuBUMlc4PZOZSAfevVUB6QbncVyXIAgb8=";
   };
 
   nativeCheckInputs = [ python3 ];
@@ -48,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   passthru = {
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
     ld-preload-tests = stdenv.mkDerivation {
       name = "${finalAttrs.pname}-ld-preload-tests";
       inherit (finalAttrs) src;
@@ -104,7 +105,10 @@ stdenv.mkDerivation (finalAttrs: {
       corruption vulnerabilities yet aims to provide decent overall performance.
     '';
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ris ];
+    maintainers = with lib.maintainers; [
+      ris
+      baksa
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/gr/graphene-hardened-malloc/update.sh b/pkgs/by-name/gr/graphene-hardened-malloc/update.sh
deleted file mode 100755
index 67ca22cacb82c..0000000000000
--- a/pkgs/by-name/gr/graphene-hardened-malloc/update.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell --pure -i bash -p bash cacert curl common-updater-scripts
-# shellcheck shell=bash
-set -eu -o pipefail
-
-host="https://releases.grapheneos.org"
-read -ra metadata <<< "$(curl -s "$host/caiman-stable")"
-version=${metadata[0]}
-
-update-source-version graphene-hardened-malloc "$version"
diff --git a/pkgs/by-name/gt/gtk-gnutella/package.nix b/pkgs/by-name/gt/gtk-gnutella/package.nix
index c067a96fcbc10..47a64efc280d2 100644
--- a/pkgs/by-name/gt/gtk-gnutella/package.nix
+++ b/pkgs/by-name/gt/gtk-gnutella/package.nix
@@ -7,12 +7,10 @@
   gettext,
   pkg-config,
   glib,
-  gtk2,
   libxml2,
   libbfd,
   zlib,
   gnutls,
-  enableGui ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,16 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
     libbfd
     libxml2
     zlib
-  ]
-  ++ lib.optionals enableGui [
-    gtk2
   ];
 
   configureScript = "./build.sh";
   configureFlags = [
     "--configure-only"
-  ]
-  ++ lib.optionals (!enableGui) [
     "--topless"
   ];
 
diff --git a/pkgs/by-name/he/helmfile/package.nix b/pkgs/by-name/he/helmfile/package.nix
index c7549cfc5fca3..58ac8ea7137f7 100644
--- a/pkgs/by-name/he/helmfile/package.nix
+++ b/pkgs/by-name/he/helmfile/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "helmfile";
-  version = "1.6.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fSFx4N8wN+gNITf8Ebthb3I3aDzpPY7MaljOBC3BUBM=";
+    hash = "sha256-RfhOc/iraWHdccKE5rp7WR5s9HhLOmxtSe1SZXy2UMI=";
   };
 
-  vendorHash = "sha256-YGFLOlev/sX/LA9+9Y3+lsMLsLtMr7xm+uqUuV4xCaY=";
+  vendorHash = "sha256-Q+G4G27hwT+zravktjk+mU0VC3OlS9zqXwclwACG9B0=";
 
   proxyVendor = true; # darwin/linux hash mismatch
 
diff --git a/pkgs/by-name/js/json-tui/package.nix b/pkgs/by-name/js/json-tui/package.nix
index 6dcac51bbb47e..05cc08c6f76ca 100644
--- a/pkgs/by-name/js/json-tui/package.nix
+++ b/pkgs/by-name/js/json-tui/package.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
+  env.NIX_CFLAGS_COMPILE = "-fexceptions";
+
   cmakeFlags = [
     "-Wno-dev" # suppress cmake warning about deprecated usage
     (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
diff --git a/pkgs/by-name/ke/keycloak/all-plugins.nix b/pkgs/by-name/ke/keycloak/all-plugins.nix
index ca02212b69dc6..189e58456f67d 100644
--- a/pkgs/by-name/ke/keycloak/all-plugins.nix
+++ b/pkgs/by-name/ke/keycloak/all-plugins.nix
@@ -17,8 +17,6 @@
   keycloak-remember-me-authenticator = callPackage ./keycloak-remember-me-authenticator { };
   keycloak-restrict-client-auth = callPackage ./keycloak-restrict-client-auth { };
   keycloak-secrets-vault-provider = callPackage ./keycloak-secrets-vault-provider { };
-  scim-for-keycloak = callPackage ./scim-for-keycloak { };
-  scim-keycloak-user-storage-spi = callPackage ./scim-keycloak-user-storage-spi { };
 
   # junixsocket provides Unix domain socket support for JDBC connections,
   # which is required for connecting to PostgreSQL via Unix socket.
@@ -45,4 +43,6 @@
 }
 // lib.optionalAttrs config.allowAliases {
   keycloak-metrics-spi = throw "keycloak.plugins.keycloak-metrics-spi has been removed in favor of Keycloak's native metrics."; # Added 2026-07-14
+  scim-for-keycloak = throw "keycloak.plugins.scim-for-keycloak has been removed as it is end-of-life upstream."; # Added 2026-07-14
+  scim-keycloak-user-storage-spi = throw "keycloak.plugins.scim-keycloak-user-storage-spi has been removed as it is unmaintained upstream."; # Added 2026-07-14
 }
diff --git a/pkgs/by-name/ke/keycloak/scim-for-keycloak/default.nix b/pkgs/by-name/ke/keycloak/scim-for-keycloak/default.nix
deleted file mode 100644
index 0e383a47f89f5..0000000000000
--- a/pkgs/by-name/ke/keycloak/scim-for-keycloak/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  maven,
-}:
-
-maven.buildMavenPackage rec {
-  pname = "scim-for-keycloak";
-  version = "kc-20-b1"; # When updating also update mvnHash
-
-  src = fetchFromGitHub {
-    owner = "Captain-P-Goldfish";
-    repo = "scim-for-keycloak";
-    tag = version;
-    hash = "sha256-kHjCVkcD8C0tIaMExDlyQmcWMhypisR1nyG93laB8WU=";
-  };
-
-  mvnHash = "sha256-cOuJSU57OuP+U7lI+pDD7g9HPIfZAoDPYLf+eO+XuF4=";
-
-  installPhase = ''
-    install -D "scim-for-keycloak-server/target/scim-for-keycloak-${version}.jar" "$out/scim-for-keycloak-${version}.jar"
-  '';
-
-  meta = {
-    homepage = "https://github.com/Captain-P-Goldfish/scim-for-keycloak";
-    description = "Third party module that extends Keycloak with SCIM functionality";
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-      binaryBytecode # dependencies
-    ];
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ mkg20001 ];
-  };
-}
diff --git a/pkgs/by-name/ke/keycloak/scim-keycloak-user-storage-spi/default.nix b/pkgs/by-name/ke/keycloak/scim-keycloak-user-storage-spi/default.nix
deleted file mode 100644
index 63ce83c627783..0000000000000
--- a/pkgs/by-name/ke/keycloak/scim-keycloak-user-storage-spi/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  maven,
-}:
-maven.buildMavenPackage rec {
-  pname = "scim-keycloak-user-storage-spi";
-  version = "kc25_0_4";
-
-  src = fetchFromGitHub {
-    owner = "justin-stephenson";
-    repo = "scim-keycloak-user-storage-spi";
-    tag = version;
-    hash = "sha256-xEnYblL5lxs1pebxGy4pXiZrMJT0KwIZqB4dztRyz/A=";
-  };
-
-  mvnHash = "sha256-UUJXHQRqshaMpr4g8m2hdBy/dpl/IImkY+KGnUF1jAs=";
-
-  installPhase = ''
-    install -D "target/scim-user-spi-0.0.1-SNAPSHOT.jar" "$out/scim-user-spi-0.0.1-SNAPSHOT.jar"
-  '';
-
-  meta = {
-    homepage = "https://github.com/justin-stephenson/scim-keycloak-user-storage-spi";
-    description = "Keycloak module that allows for user storage in an external SCIM 2.0 server";
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-    ];
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      s1341
-      anish
-    ];
-  };
-}
diff --git a/pkgs/by-name/ku/kubelogin-oidc/package.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
index a89df667a57a0..f88a06c08424f 100644
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubelogin";
-  version = "1.36.2";
+  version = "1.36.3";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VzUnjqa3XnKSqcwd2jVwbQwGmyO5+YBwPIIxN0wj81A=";
+    hash = "sha256-VgsUQcFUbtZSZuar7K/ErJRsJZ0GvyIEixGGhF+hLnY=";
   };
 
   subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-/30B7krXl0HYm+nUqGtbhNb4L8utdorjZNGkfMCYs3k=";
+  vendorHash = "sha256-29D31EKO2Y6TXj607Tf3O5dGBHyrMyXoC5tWEKqvbbA=";
 
   # test all packages
   preCheck = ''
diff --git a/pkgs/by-name/li/libargs/package.nix b/pkgs/by-name/li/libargs/package.nix
index 52132ecae765e..ddafc1b5b1a37 100644
--- a/pkgs/by-name/li/libargs/package.nix
+++ b/pkgs/by-name/li/libargs/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "args";
-  version = "6.4.9";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "Taywee";
     repo = "args";
     rev = finalAttrs.version;
-    sha256 = "sha256-+RzPVWFhA7tsiw04/i9OxqmoHVF5Whr9FC1isV8RrE0=";
+    sha256 = "sha256-S5FaAtPY/mXsQ8aYsluxwwYZ1CK20/DRew3ltRkm2z8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 1b5f6193612ac..78458d785ef0a 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.5.1";
+  version = "12.5.2";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aGdx+IynrVBtI3Z5Zic/e5aVNWQeAFsxXr8xjIV1MTM=";
+    hash = "sha256-F4B4EzbWkMVR/FMFYEtMPj10mfbOvFBL+gzaO3EiE8E=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 23d9e48f3ef4d..04a0371f9a2d7 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -80,7 +80,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "10063";
+  version = "10121";
 
   outputs = [
     "out"
@@ -91,7 +91,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-mkvRK5vn0qK6iE8kMyN9Zo/zaaaKTzp6WV9QfrKrHWc=";
+    hash = "sha256-9joXzqqWrNnVzgo5GrOIN6+hxIUS1Kdg4KfLQbNmjYo=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -124,7 +124,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ [ openssl ];
 
   npmRoot = "tools/ui";
-  npmDepsHash = "sha256-6s9skw1wzEfm9QKktTqea3J+oudQAsS6O2VnZEMXAdw=";
+  npmDepsHash = "sha256-B7uEynAG70a3xauBKc20RuFa9cnWaWzVBCh+LPLBnIM=";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 87326f81842d9..cb8c7160213bf 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -8,12 +8,12 @@
 }:
 let
   pname = "models-dev";
-  version = "sdk-v0.0.5-unstable-2026-07-17";
+  version = "sdk-v0.0.5-unstable-2026-07-26";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "d15aa5a09dc0226f0a292699e35f14243e61d65e";
-    hash = "sha256-S1WzSYs9of11Onw/hK+stSmakjJJhq1rs6mcW8m+xlc=";
+    rev = "c40d2ae92595fd40962923b100b93405e597b6b1";
+    hash = "sha256-ci4Flm9HETLm8Zgmwprtl8fAnUssgbGadjB6fEW6eo4=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index 78f8db23e5b78..bbb9bd22ed1cf 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-atlas-cli";
-  version = "1.56.0";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-H3swDfgKS/m0mfVe6LH2k+EKLdpSmF86w1jcb/d2tcs=";
+    hash = "sha256-4UsQCflxYB2jy7y6FejBNJfE1a66JwS44aqelrQBdsU=";
   };
 
-  vendorHash = "sha256-xBnwNBmJZNb19FM947iQubUPZpIwA2ZhuTBNXF6ki5U=";
+  vendorHash = "sha256-FgAnXdYUFRJNKT5c8yS3B9tY8XQmUO+pRAlfw//d6tE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/na/namecoind/package.nix b/pkgs/by-name/na/namecoind/package.nix
index 6e212b63afcd7..465d079b0984e 100644
--- a/pkgs/by-name/na/namecoind/package.nix
+++ b/pkgs/by-name/na/namecoind/package.nix
@@ -5,11 +5,12 @@
   python3,
   boost,
   libevent,
-  autoreconfHook,
   db4,
   miniupnpc,
   sqlite,
   pkg-config,
+  cmake,
+  ninja,
   util-linux,
   hexdump,
   zeromq,
@@ -20,18 +21,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "namecoind";
-  version = "28.0";
+  version = "31.0";
 
   src = fetchFromGitHub {
     owner = "namecoin";
     repo = "namecoin-core";
     tag = "nc${finalAttrs.version}";
-    hash = "sha256-r6rVgPrKz7nZ07oXw7KmVhGF4jVn6L+R9YHded+3E9k=";
+    fetchSubmodules = true;
+    hash = "sha256-jgkyLWJr7+wFTOazxkS8fJV4544dyIOAZf2zorL7KXY=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook
     pkg-config
+    cmake
+    ninja
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -42,37 +45,36 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     boost
     libevent
-    db4
     miniupnpc
     zeromq
     zlib
   ]
   ++ lib.optionals withWallet [ sqlite ]
-  # building with db48 (for legacy descriptor wallet support) is broken on Darwin
   ++ lib.optionals (withWallet && !stdenv.hostPlatform.isDarwin) [ db4 ];
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--with-boost-libdir=${boost.out}/lib"
-    "--disable-bench"
-    "--disable-gui-tests"
+  cmakeFlags = [
+    "-DBOOST_ROOT=${boost.out}"
+    "-DBUILD_BENCH=OFF"
+    "-DBUILD_TESTS=OFF"
+    "-DBUILD_GUI=OFF"
+    "-DENABLE_IPC=OFF"
   ]
   ++ lib.optionals (!withWallet) [
-    "--disable-wallet"
+    "-DENABLE_WALLET=OFF"
   ];
 
   nativeCheckInputs = [ python3 ];
 
   doCheck = true;
-
   checkFlags = [ "LC_ALL=en_US.UTF-8" ];
 
   meta = {
     description = "Decentralized open source information registration and transfer system based on the Bitcoin cryptocurrency";
     homepage = "https://namecoin.org";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.lukas-sgx ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 869a75a62a257..fbc2880c0a4b7 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.531";
+  version = "0.0.550";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HlCyUwGwc261p2e4DK8J0VEN5EIO1UpbnxQ5f6oxaSs=";
+    hash = "sha256-Ek6+s10KvZhPoHGBpw2k3ARBpwi1hbyChieyAxF1ac4=";
   };
 
-  vendorHash = "sha256-joxaA0x1Ldn82O5k+H9A1rsirBkfpOw+83E4GHCwKb8=";
+  vendorHash = "sha256-hOt0ItxXUcinp8+/XiHq18kRz2heVmHKpWhNP0i4a+Y=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/nu/nufmt/package.nix b/pkgs/by-name/nu/nufmt/package.nix
index ae3aa762b58c8..d45161a1060d3 100644
--- a/pkgs/by-name/nu/nufmt/package.nix
+++ b/pkgs/by-name/nu/nufmt/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "nufmt";
-  version = "0-unstable-2026-07-16";
+  version = "0-unstable-2026-07-23";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nufmt";
-    rev = "cae92f70d4f04aca062a9d1ce935dedaa71052f3";
-    hash = "sha256-MQ3M/8UmCPt93OLu5ZWkSqbQLZeHpR5QKnzPzu37slw=";
+    rev = "f4c2e3bfb9cfff0a430c513ad2198634412e22a1";
+    hash = "sha256-bElMaIou3kvYBCEwTAgdG8a7Ug2R7P6giwSHmdrtinI=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-MLfhuFjYv2Vi3BGJFzbmi+xhhm6M0a4oOe7wpHtfObc=";
 
-  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/cae92f70d4f04aca062a9d1ce935dedaa71052f3
+  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/f4c2e3bfb9cfff0a430c513ad2198634412e22a1
   postPatch = ''
     substituteInPlace tests/ground_truth.rs --replace-fail \
       '        let path = PathBuf::from(target_dir).join("debug").join(exe_name);' \
diff --git a/pkgs/by-name/ox/oxigraph/package.nix b/pkgs/by-name/ox/oxigraph/package.nix
index 0cb0150c7e867..a8ec59bb097a2 100644
--- a/pkgs/by-name/ox/oxigraph/package.nix
+++ b/pkgs/by-name/ox/oxigraph/package.nix
@@ -14,17 +14,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxigraph";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "oxigraph";
     repo = "oxigraph";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J4cx/fzdsgRXeWsP9Gt5q/0crWoc1OP8+xbuvQJTj34=";
+    hash = "sha256-I5NI1IoK+FPCmUUcLdyzBao7tuB8XIycPYQ6slYCtJc=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-BvL1rGJcU28TLkxJ3pKah6qfaa0SdUt143UgBYJrLsE=";
+  cargoHash = "sha256-QMbhtKoVa1fN6BQwAZfPelxCV5MCqodqpN7qHJs70KE=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/ph/phantun/package.nix b/pkgs/by-name/ph/phantun/package.nix
new file mode 100644
index 0000000000000..fe3e29a2c2a25
--- /dev/null
+++ b/pkgs/by-name/ph/phantun/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "phantun";
+  version = "0.8.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "dndx";
+    repo = "phantun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Syz2W0IYm9nzu2Ph09uJxeo/odznDC9aMe+TEMhWurc=";
+  };
+
+  cargoHash = "sha256-xvWk1OmF/oWc2Pw3rxkkRNZ63XSkSf41klzQz1+2O9I=";
+
+  postInstall = ''
+    mv "$out/bin/client" "$out/bin/phantun_client"
+    mv "$out/bin/server" "$out/bin/phantun_server"
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  postVersionCheck = ''
+    "$out/bin/phantun_server" --version | grep -F "${finalAttrs.version}"
+  '';
+
+  meta = {
+    description = "Lightweight and fast UDP to TCP obfuscator";
+    homepage = "https://github.com/dndx/phantun";
+    changelog = "https://github.com/dndx/phantun/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ peigongdsd ];
+    mainProgram = "phantun_client";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pr/prometheus-redis-exporter/package.nix b/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
index 3538051324020..ff4b88ed4bbd2 100644
--- a/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.87.0";
+  version = "1.88.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-c2+3pV81p8TxJQ3QUKFnwXKHlV9Gl8Ezghv8rH4dVGg=";
+    sha256 = "sha256-fazdTDgFyh86gXwr2DJ/ZROOamcIi2eN9QBln9JsRzE=";
   };
 
   vendorHash = "sha256-WvQx0UzORuDZPM0IDk2q4l6pfrecrUvzD3jP3vqV1Zo=";
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 65be7f8d2a9ec..c9a77ab236bb9 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.7.7";
+  version = "26.7.9";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3m/JErBDXQeCu1ShITPJtZkf/c0PL/RrKJshV/CXYls=";
+    hash = "sha256-KOUKM2Yj6iTQbCkXsfiBBs8lP8gyZ8oxwZniauS44zc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 187af33367f74..17fb1ce5ae8ca 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.43.0";
+  version = "0.44.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n5bkPPsrdM4fE5ltocTjlq+JwRgp39yib6S79fci4m4=";
+    hash = "sha256-Ev6w0Gi2y48DYi55GSciCoPgkUFaX44aH3UWGhs1OGk=";
   };
 
-  cargoHash = "sha256-XKUKdhxfnwUCOx9slqx4oUFa09HcosPLVh5Xkh87oSk=";
+  cargoHash = "sha256-x+6bZZh0s3YPgav7S/4VrYxZBWAlX1BmvCFJHLmIjGM=";
 
   # Rust 1.97's dead_code_pub_in_binary analysis exposes dead code in test builds.
-  # Fixed upstream on develop after 0.43.0:
+  # Fixed upstream on develop after 0.44.0:
   # https://github.com/rtk-ai/rtk/commit/73b8cb3069297374a3de58552b9fe4aa2cda3a41
   # TODO: Remove RUSTFLAGS when updating rtk to the next release.
   env.RUSTFLAGS = "--cap-lints warn";
diff --git a/pkgs/by-name/sc/schedctl/package.nix b/pkgs/by-name/sc/schedctl/package.nix
new file mode 100644
index 0000000000000..fb4587bc6d361
--- /dev/null
+++ b/pkgs/by-name/sc/schedctl/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  btrfs-progs,
+  gpgme,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "schedctl";
+  version = "1.2.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "schedkit";
+    repo = "schedctl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5LxD4420WCdHWcz7Yb0JV+ar4gSf/xsbkeHLPdLV1eY=";
+  };
+
+  vendorHash = "sha256-LMYJlvUmGejHk/AA/k2WwoI2Gtw3rNYgsklUcK+cB40=";
+  proxyVendor = true;
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    btrfs-progs
+    gpgme
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/schedkit/schedctl/releases/tag/v${finalAttrs.version}";
+    description = "OCI-packaged eBPF sched_ext plug and play schedulers for fun and profit";
+    homepage = "https://github.com/schedkit";
+    license = lib.licenses.asl20;
+    mainProgram = "schedctl";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      koalalorenzo
+    ];
+  };
+})
diff --git a/pkgs/by-name/st/stasis/package.nix b/pkgs/by-name/st/stasis/package.nix
index de4b9574c0345..9908c6b7dbb35 100644
--- a/pkgs/by-name/st/stasis/package.nix
+++ b/pkgs/by-name/st/stasis/package.nix
@@ -11,17 +11,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stasis";
-  version = "1.3.0";
+  version = "1.4.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "saltnpepper97";
     repo = "stasis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5p0r9ymR2YimorGEVFdjqYKaQTeqSY7dZleV3kghUIc=";
+    hash = "sha256-RwGmOa7wgmuT9WBBGkPCowho33oAy8UBqYb1cgpL2lI=";
   };
 
-  cargoHash = "sha256-pXu9TQ3LKzjvenHzFjPEhtEj0oEl7cplGBchBRHWAAo=";
+  cargoHash = "sha256-OHOC9tyvUqkyCpZ9nMYuXgtnZFogzIO2EtjDR4qrLDQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ta/talos-pilot/package.nix b/pkgs/by-name/ta/talos-pilot/package.nix
index 3103674cfde01..78a4106228963 100644
--- a/pkgs/by-name/ta/talos-pilot/package.nix
+++ b/pkgs/by-name/ta/talos-pilot/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "talos-pilot";
-  version = "0.1.9";
+  version = "0.1.11";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Handfish";
     repo = "talos-pilot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OZF74efMWQkZgSbOnzyygzt4pRADY1liWVpvnzWns8Y=";
+    hash = "sha256-d0LZAJufOv72T4lfukAKFEKiZOJNAibHQYXhuhFKbAU=";
   };
 
-  cargoHash = "sha256-loCYAgZhNtYs8aBbOJMLkS9i0XglOn6BrodLQROPMPQ=";
+  cargoHash = "sha256-Toa5e0euMwUpSMiMH0nJL3KW98voSlUBl3XgvbTvCFo=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/vi/vita3k/package.nix b/pkgs/by-name/vi/vita3k/package.nix
index 4d2ff7e43d41e..43711316c57b6 100644
--- a/pkgs/by-name/vi/vita3k/package.nix
+++ b/pkgs/by-name/vi/vita3k/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "vita3k";
-  version = "4064";
+  version = "4065";
 
   src = fetchurl {
     url = "https://github.com/Vita3K/Vita3K-builds/releases/download/${version}/Vita3K-x86_64.AppImage";
-    sha256 = "sha256-QUzu+7BqiJ8gWWugwyMyKyQ3bXzmAx/zSxJ2+AeVQB4=";
+    sha256 = "sha256-jgypzFZgQeBvtuEuw51ex6r7tOqTYaIJAE3JzDRMcWI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/wa/waypaper-engine/0001-fix-null-strings.patch b/pkgs/by-name/wa/waypaper-engine/0001-fix-null-strings.patch
new file mode 100644
index 0000000000000..e44aca4fa802a
--- /dev/null
+++ b/pkgs/by-name/wa/waypaper-engine/0001-fix-null-strings.patch
@@ -0,0 +1,22 @@
+From 838bedb814a20d0e0b3df98f6708610281560f48 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 7 Jun 2026 18:09:39 +0530
+Subject: [PATCH] fix null strings
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ src/hooks/useLiveWallpapers.ts | Bin 4054 -> 4056 bytes
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+
+diff --git a/src/hooks/useLiveWallpapers.ts b/src/hooks/useLiveWallpapers.ts
+index 4e5010833591915738e8aa8305956df107611187..f4b7a8e3f3494cd0698c7496cecc4a98b124e1de 100644
+GIT binary patch
+delta 23
+ccmca6e?xwQB|B4$!DcJ=HbxMAkVBLm0AH;K3;+NC
+
+delta 21
+ccmca1e@%XaB|9U-W^48~Mn;CshdD&q0ZhyV^#A|>
+
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/wa/waypaper-engine/0002-fix-awww-require-WAYLAND_DISPLAY.patch b/pkgs/by-name/wa/waypaper-engine/0002-fix-awww-require-WAYLAND_DISPLAY.patch
new file mode 100644
index 0000000000000..647bb83995724
--- /dev/null
+++ b/pkgs/by-name/wa/waypaper-engine/0002-fix-awww-require-WAYLAND_DISPLAY.patch
@@ -0,0 +1,25 @@
+From ca72f91c758570545667779dd27085be838c759c Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 7 Jun 2026 22:43:51 +0530
+Subject: [PATCH] fix(awww): require WAYLAND_DISPLAY
+
+---
+ daemon/internal/backend/awww/awww.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/daemon/internal/backend/awww/awww.go b/daemon/internal/backend/awww/awww.go
+index 943cbe0..e582a8b 100644
+--- a/daemon/internal/backend/awww/awww.go
++++ b/daemon/internal/backend/awww/awww.go
+@@ -75,7 +75,7 @@ func (a *Awww) Name() string { return "awww" }
+ 
+ func (a *Awww) IsAvailable() bool {
+ 	_, err := exec.LookPath(cliBinary)
+-	return err == nil
++	return err == nil && os.Getenv("WAYLAND_DISPLAY") != ""
+ }
+ 
+ func (a *Awww) Capabilities() backend.Capabilities {
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/wa/waypaper-engine/0003-fix-core-persist-active-backend-config-when-already.patch b/pkgs/by-name/wa/waypaper-engine/0003-fix-core-persist-active-backend-config-when-already.patch
new file mode 100644
index 0000000000000..580908fdbe658
--- /dev/null
+++ b/pkgs/by-name/wa/waypaper-engine/0003-fix-core-persist-active-backend-config-when-already.patch
@@ -0,0 +1,30 @@
+From ec7e69c096bd2dde94d35a46994737c3adce7723 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 7 Jun 2026 22:43:51 +0530
+Subject: [PATCH] fix(core): persist active backend config when already active
+
+---
+ daemon/internal/control/controller.go | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/daemon/internal/control/controller.go b/daemon/internal/control/controller.go
+index 0782c94..811c18b 100644
+--- a/daemon/internal/control/controller.go
++++ b/daemon/internal/control/controller.go
+@@ -189,6 +189,13 @@ func (c *Controller) UpdateBackendConfig(ctx context.Context, name string, raw j
+ 
+ func (c *Controller) ActivateBackend(ctx context.Context, name string) (ActivationResult, error) {
+ 	if cur := c.registry.Active(); cur != nil && cur.Name() == name {
++		if c.cfg.GetActiveBackendType() != name {
++			_ = c.cfg.SetActiveBackendType(name)
++			c.bus.Publish(events.Event{
++				Type: events.ConfigChanged,
++				Data: map[string]any{"sections": []string{"backend"}},
++			})
++		}
+ 		return ActivationResult{Backend: name, AlreadyActive: true}, nil
+ 	}
+ 	if err := backend.SwitchActiveBackend(ctx, c.registry, name, c.cfg, backend.SwitchOpts{
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/wa/waypaper-engine/package.nix b/pkgs/by-name/wa/waypaper-engine/package.nix
new file mode 100644
index 0000000000000..f016fa95f66e5
--- /dev/null
+++ b/pkgs/by-name/wa/waypaper-engine/package.nix
@@ -0,0 +1,142 @@
+{
+  fetchPnpmDeps,
+  lib,
+  nodejs,
+  pnpm_11,
+  pnpmConfigHook,
+  stdenv,
+  gitMinimal,
+  fetchFromGitHub,
+  electron,
+  makeWrapper,
+  buildGoModule,
+  wayland,
+  awww,
+  feh,
+}:
+let
+  pnpm = pnpm_11;
+
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "0bCdian";
+    repo = "Waypaper-Engine";
+    tag = "v${version}";
+    hash = "sha256-oee44RABW+0BcirsJbc5WnLVQeyAamXfxj4Q1x4B2JA=";
+  };
+
+  backend = buildGoModule (finalAttrs: {
+    pname = "waypaper-daemon";
+    inherit version src;
+
+    sourceRoot = "${finalAttrs.src.name}/daemon";
+
+    patches = [
+      ./0002-fix-awww-require-WAYLAND_DISPLAY.patch
+      ./0003-fix-core-persist-active-backend-config-when-already.patch
+    ];
+
+    patchFlags = [ "-p2" ];
+
+    buildInputs = [ wayland ];
+
+    proxyVendor = true;
+    vendorHash = "sha256-KGyaZhWU5UOPV73MitA5eycy3ugH+rwgNu09r3ALtIo=";
+
+    subPackages = [ "cmd/daemon" ];
+
+    ldflags = [
+      "-s"
+      "-X main.version=${version}"
+    ];
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "waypaper-engine";
+  inherit version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    nodejs
+    pnpmConfigHook
+    pnpm
+    makeWrapper
+    gitMinimal
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-m/TtZ1rUXyzSYfxDMuZGW8d0Rl6T7qU+v4kRHAa6PM0=";
+  };
+
+  patchPhase = ''
+    # binary patch unsupported by patch command, requires git apply
+    git apply ${./0001-fix-null-strings.patch}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    substituteInPlace globals/configReader.ts \
+      --replace-fail "process.resourcesPath" "\"$out/bin\""
+
+    pnpm exec vite build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+    mkdir -p $out/bin $out/share/applications $out/libexec/waypaper-engine/apps/desktop
+
+    cp -r node_modules $out/libexec/waypaper-engine
+    cp -r dist $out/libexec/waypaper-engine/apps/desktop
+    cp -r dist-electron $out/libexec/waypaper-engine/apps/desktop
+
+    for size in 16x16 32x32 64x64 128x128 256x256 512x512; do
+      mkdir -p "$out/share/icons/hicolor/$size/apps"
+      cp "build/icons/$size.png" "$out/share/icons/hicolor/$size/apps/waypaper-engine.png"
+    done
+
+    cp waypaper-engine.desktop $out/share/applications
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    makeWrapper ${electron}/bin/electron $out/bin/waypaper-engine \
+      --add-flags $out/libexec/waypaper-engine/apps/desktop/dist-electron/main.js
+
+    makeWrapper ${finalAttrs.passthru.backend}/bin/daemon $out/bin/waypaper-daemon \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          awww
+          feh
+        ]
+      }
+  '';
+
+  passthru = { inherit backend; };
+
+  meta = {
+    description = "Wallpaper setter GUI with playlist functionality for Wayland and X11";
+    longDescription = ''
+      Waypaper Engine is a wallpaper manager with playlist support, advanced filters, multiple backend support, and Wallhaven integration.
+    '';
+    homepage = "https://github.com/0bCdian/Waypaper-Engine";
+    license = lib.licenses.gpl3Plus;
+    changelog = "https://github.com/0bCdian/Waypaper-Engine/releases/tag/${finalAttrs.src.rev}";
+    maintainers = with lib.maintainers; [
+      zainkergaye
+      phanirithvij
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "waypaper-engine";
+  };
+})
diff --git a/pkgs/by-name/wi/wizer/package.nix b/pkgs/by-name/wi/wizer/package.nix
index b869472239736..649b85a78103f 100644
--- a/pkgs/by-name/wi/wizer/package.nix
+++ b/pkgs/by-name/wi/wizer/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wizer";
-  version = "10.0.0";
+  version = "11.0.3";
 
   # the crate does not contain files which are necessary for the tests
   # see https://github.com/bytecodealliance/wizer/commit/3a95e27ce42f1fdaef07b52988e4699eaa221e04
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage rec {
     owner = "bytecodealliance";
     repo = "wizer";
     tag = "v${version}";
-    hash = "sha256-Vo6oD0UXGm4QtA3S5Qsc/DDfyfj9gJj01nnXXHw/+bM=";
+    hash = "sha256-gGO09/aHkSN8Q7EcKc7FO761YOkliHt9t7iXP4EB1Fc=";
   };
 
-  cargoHash = "sha256-WocaIib0IXlAWGVyRygOmHl1LBkrahbcCIHffRMX+J0=";
+  cargoHash = "sha256-4pH8bCTYaydgVRw6+hRN3326VGlRRMH9/5GhdPsr5Ok=";
 
   cargoBuildFlags = [
     "--bin"
@@ -27,8 +27,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildFeatures = [
-    "env_logger"
-    "structopt"
+    "cli"
   ];
 
   # Setting $HOME to a temporary directory is necessary to prevent checks from failing, as
@@ -37,10 +36,6 @@ rustPlatform.buildRustPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  passthru.tests = {
-    version = testers.testVersion { package = wizer; };
-  };
-
   meta = {
     description = "WebAssembly pre-initializer";
     mainProgram = "wizer";
diff --git a/pkgs/by-name/wo/worktrunk/package.nix b/pkgs/by-name/wo/worktrunk/package.nix
index 8889b5fcfc519..bc96cf8a07dad 100644
--- a/pkgs/by-name/wo/worktrunk/package.nix
+++ b/pkgs/by-name/wo/worktrunk/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "worktrunk";
-  version = "0.66.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "max-sixty";
     repo = "worktrunk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GKXTEzCya5aOh02O3yoEdA4RS/GibiHZu+wXq7rrOV0=";
+    hash = "sha256-4mxWRNNrpM5Fo49Xm8ypzBS15Y8kPPFd1iPod1RwxjA=";
   };
 
-  cargoHash = "sha256-MjRi4WK+afrShCLXEp7pWhDiAyjKPbtqHjVIOtI3LVI=";
+  cargoHash = "sha256-ZEv3peP/mjDDWYw4LNuhIt8I806W/yfUKtEA7e3t7rA=";
 
   cargoBuildFlags = [ "--package=worktrunk" ];
 
diff --git a/pkgs/by-name/xm/xmodmap/package.nix b/pkgs/by-name/xm/xmodmap/package.nix
index eb6e40c439a60..9ecb77001d99e 100644
--- a/pkgs/by-name/xm/xmodmap/package.nix
+++ b/pkgs/by-name/xm/xmodmap/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmodmap";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchurl {
     url = "mirror://xorg/individual/app/xmodmap-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mi+BaPewvDgoKIR0A5Astr8XXhdlizYYnqyH7dqHfoE=";
+    hash = "sha256-/FS5tbvyrli6j51CvQUcQcdDg3dADELBfXSW0Z4bs84=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/za/zandronum/package.nix b/pkgs/by-name/za/zandronum/package.nix
index 91d4f57ab137d..4ee029e485766 100644
--- a/pkgs/by-name/za/zandronum/package.nix
+++ b/pkgs/by-name/za/zandronum/package.nix
@@ -17,7 +17,6 @@
   fluidsynth,
   fmodex,
   openssl,
-  gtk2,
   python3,
   game-music-emu,
   copyDesktopItems,
@@ -67,7 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     fmod
     fluidsynth
     libopus
-    gtk2
   ];
 
   nativeBuildInputs = [
@@ -93,6 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     "-DFORCE_INTERNAL_GME=OFF"
+    "-DNO_GTK=ON"
   ]
   ++ (if serverOnly then [ "-DSERVERONLY=ON" ] else [ "-DFMOD_LIBRARY=${fmod}/lib/libfmodex.so" ]);
 
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index 2c559d06ae870..217529e807626 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "2.0.10";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0F+FSQbW5lKHzODskdaxRwXwe3zdXwZr/d7Iw1R+IUE=";
+    hash = "sha256-9GSGMAI4Jhgd7hCTp2XkXPqrU0amYTN47p8LG1b2SDg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-BFaOd0yIcqFp9u4sg+SMCEdffz3eFQfRFSahXXeTk6A=";
+  cargoHash = "sha256-f/4kL1RxZ+IGFEzVbni1F4BEyydU5hpLphFssYWFvX0=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index d6ca5d564778f..785f5527b09e3 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -166,11 +166,15 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/js${lib.versions.major version} $out/bin/js
   '';
 
-  passthru.tests.run = callPackage ./test.nix {
-    spidermonkey = finalAttrs.finalPackage;
+  passthru = {
+    tests.run = callPackage ./test.nix {
+      spidermonkey = finalAttrs.finalPackage;
+    };
+    updateScript = lib.getExe (callPackage ./update.nix { version = lib.versions.major version; });
   };
 
   meta = {
+    changelog = "https://www.firefox.com/en-US/firefox/${version}/releasenotes/";
     description = "Mozilla's JavaScript engine written in C/C++";
     homepage = "https://spidermonkey.dev/";
     license = lib.licenses.mpl20;
diff --git a/pkgs/development/interpreters/spidermonkey/update.nix b/pkgs/development/interpreters/spidermonkey/update.nix
new file mode 100644
index 0000000000000..cdf315a0b8fbc
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/update.nix
@@ -0,0 +1,39 @@
+{
+  writeShellApplication,
+  common-updater-scripts,
+  xidel,
+  baseUrl ? "https://archive.mozilla.org/pub/firefox/releases/",
+  version ? "",
+}:
+writeShellApplication {
+  name = "update-spidermonkey_${version}";
+  runtimeInputs = [
+    common-updater-scripts
+    xidel
+  ];
+
+  text = ''
+    set -eux
+
+    HOME=$(mktemp -d)
+    GNUPGHOME=$(mktemp -d)
+    export GNUPGHOME
+
+    curl https://keys.openpgp.org/vks/v1/by-fingerprint/09BEED63F3462A2DFFAB3B875ECB6497C1A20256 | gpg --import -
+
+    version=$(xidel --trace -s "${baseUrl}" --extract "//a" | \
+     grep "^${version}[0-9.]*esr/$" | \
+     sed s/[/]$// | \
+     sort --version-sort | \
+     tail -n 1)
+
+    curl --silent --show-error -o "$HOME"/shasums "${baseUrl}$version/SHA512SUMS"
+    curl --silent --show-error -o "$HOME"/shasums.asc "${baseUrl}$version/SHA512SUMS.asc"
+    gpgv --keyring="$GNUPGHOME"/pubring.kbx "$HOME"/shasums.asc "$HOME"/shasums
+
+    hash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
+    sri_hash=$(nix hash convert --hash-algo sha512 --to sri "$hash")
+    update-source-version --file=pkgs/development/interpreters/spidermonkey/${version}.nix \
+      "spidermonkey_${version}" "''${version%esr}" "$sri_hash"
+  '';
+}
diff --git a/pkgs/development/python-modules/pydemumble/default.nix b/pkgs/development/python-modules/pydemumble/default.nix
index 411c4499151b6..5e1ff3cb24183 100644
--- a/pkgs/development/python-modules/pydemumble/default.nix
+++ b/pkgs/development/python-modules/pydemumble/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pydemumble";
-  version = "0.1.2";
+  version = "0.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = "pydemumble";
     tag = "v${version}";
-    hash = "sha256-c6jKnWsB8Do076eiMQXNo0JNCiLNh9iMohEnBAf+YW8=";
+    hash = "sha256-Po19NXY4I97Aj1SY1KqpspEqYpVGIsAirOo6iAjBrbk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index cdd3b72a89a0a..1e5ecc5fc7c44 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.4.1";
+  version = "1.4.2";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "rns";
     version = finalAttrs.version;
-    hash = "sha256-cJOr1BJfV0eWx5f0+J8iCT0svEMoH5QZOTYrLdB5NR4=";
+    hash = "sha256-J15DaYGcmfu9uLcKDU6z/JdncW/KY5/nIGhWg5+zhno=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/starlette-admin/default.nix b/pkgs/development/python-modules/starlette-admin/default.nix
index 4e943633c6c86..ca71b4500aa5f 100644
--- a/pkgs/development/python-modules/starlette-admin/default.nix
+++ b/pkgs/development/python-modules/starlette-admin/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "starlette-admin";
-  version = "0.17.0";
+  version = "0.17.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jowilf";
     repo = "starlette-admin";
     tag = version;
-    hash = "sha256-1hLBGFECucEv1pHDGtk5GXUKUmWWetA72dnn7ayHA4U=";
+    hash = "sha256-oywqivKpvGujk5VMAbNY7fg5evfec9rL+wUccPeCUoc=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ufomerge/default.nix b/pkgs/development/python-modules/ufomerge/default.nix
index c1b2b2df28763..a77ec5ee7bf0c 100644
--- a/pkgs/development/python-modules/ufomerge/default.nix
+++ b/pkgs/development/python-modules/ufomerge/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ufomerge";
-  version = "1.9.6";
+  version = "1.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufomerge";
     tag = "v${version}";
-    hash = "sha256-5nTxcZeBClui7ceeq6sIOaoK8x0L6sBWqmhXr0On4Eg=";
+    hash = "sha256-bA0tXopktnkrLTaRmqppqqQgC0nx8MxncO5oTuZeMQc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/whenever/default.nix b/pkgs/development/python-modules/whenever/default.nix
index 8fe1e8026b716..2d6056d1f890e 100644
--- a/pkgs/development/python-modules/whenever/default.nix
+++ b/pkgs/development/python-modules/whenever/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "whenever";
-  version = "0.10.2";
+  version = "0.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ariebovenberg";
     repo = "whenever";
     tag = version;
-    hash = "sha256-D3jNrxNTBbSheymnI72xAhdvvRzsbjIk+Gp82X7AkdU=";
+    hash = "sha256-CBNk69vS4BqavwatOoA312/6M3EnARIzL7C62KrIvXY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 7bb9cf8f80a73..5965512283cd2 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   fetchFromGitLab,
   fetchhg,
+  fetchpatch,
   runCommand,
   stdenv,
 
@@ -657,12 +658,29 @@ let
 
     rtmp = {
       name = "rtmp";
-      src = fetchFromGitHub {
-        name = "rtmp";
-        owner = "arut";
-        repo = "nginx-rtmp-module";
-        rev = "v1.2.2";
-        sha256 = "0y45bswk213yhkc2v1xca2rnsxrhx8v6azxz9pvi71vvxcggqv6h";
+      src = applyPatches {
+        src = fetchFromGitHub {
+          name = "rtmp";
+          owner = "arut";
+          repo = "nginx-rtmp-module";
+          rev = "v1.2.2";
+          sha256 = "0y45bswk213yhkc2v1xca2rnsxrhx8v6azxz9pvi71vvxcggqv6h";
+        };
+
+        patches = [
+          # GCC 16's improved unused variable analysis detects some unused
+          # variables which were fixed upstream but not released.
+          (fetchpatch {
+            name = "remove-unused-variables-ngx-rtmp-handler.patch";
+            url = "https://github.com/arut/nginx-rtmp-module/commit/6c7719d0ba32e00b563ec70bd43dad11960fa9c4.patch";
+            hash = "sha256-c2hSp4CamBYMwkU9EOUSnfXvCYVOIxm1WzMR/M7Ojcc=";
+          })
+          (fetchpatch {
+            name = "remove-unused-variables-ngx-rtmp-eval.patch";
+            url = "https://github.com/arut/nginx-rtmp-module/commit/c56fd73def3eb407155ecebc28af84ea83dc99e5.patch";
+            hash = "sha256-APXdEsRp3SSUKM9ud8tbZEPsfOe/055TRD7FFHE2k9w=";
+          })
+        ];
       };
 
       meta = {
diff --git a/pkgs/servers/sql/postgresql/19.nix b/pkgs/servers/sql/postgresql/19.nix
index 9ee9780fbfa55..f606db9806f78 100644
--- a/pkgs/servers/sql/postgresql/19.nix
+++ b/pkgs/servers/sql/postgresql/19.nix
@@ -1,7 +1,7 @@
 {
-  version = "19beta1";
-  rev = "refs/tags/REL_19_BETA1";
-  hash = "sha256-thvbttX8wwGLf5tMJRHl86Xv8OgINzahoqB/AzAdtMI=";
+  version = "19beta2";
+  rev = "refs/tags/REL_19_BETA2";
+  hash = "sha256-3bfWDt6+iXJG/Wy2i8R7B+H7fMbLsSSD3qzuOXTpmtc=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 97f23ba8426a5..9eabaeaa06f3a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -705,6 +705,7 @@ mapAliases {
   e17gtk = throw "'e17gtk' has been removed because it was archived upstream."; # Added 2026-01-15
   e-search = throw "'e-search' has been removed due to outdated KF5 dependencies"; # Added 2026-05-01
   eagle = throw "'eagle' has been removed because official support ends 2026-06-07. It depended on qt5 webengine, which was removed for its numerous security issues. For more details, see the autodesk announcement at https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Autodesk-EAGLE-Announcement-Next-steps-and-FAQ.html"; # Added 2026-04-26
+  earthly = warnAlias "'earthly' has been discontinued. It is replaced by a community fork 'earthbuild'" earthbuild; # Added 2025-11-19
   eask = throw "'eask' has been renamed to/replaced by 'eask-cli'"; # Converted to throw 2025-10-27
   easyloggingpp = throw "easyloggingpp has been removed, as it is deprecated upstream and does not build with CMake 4"; # Added 2025-09-17
   ebpf-verifier = warnAlias "'ebpf-verifier' has been renamed to 'prevail'" prevail; # Added 2026-04-01