diff --git a/ci/OWNERS b/ci/OWNERS
index 3ea1acac95ac..7f43fd9ccfa3 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -466,3 +466,6 @@ pkgs/development/beam-modules/          @NixOS/beam
 pkgs/development/interpreters/erlang/   @NixOS/beam
 pkgs/development/interpreters/elixir/   @NixOS/beam
 pkgs/development/interpreters/lfe/      @NixOS/beam
+
+# OctoDNS
+pkgs/tools/networking/octodns/ @anthonyroussel
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 58654a49e008..82fd289e075c 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -416,6 +416,11 @@ rec {
           family = "x86";
         };
       }
+      {
+        cpu = {
+          family = "loongarch";
+        };
+      }
     ];
 
     isElf = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9279d4713240..d24a98d724f0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13387,6 +13387,12 @@
     githubId = 168301;
     name = "Victor Engmark";
   };
+  L0L1P0P = {
+    name = "Behrad Badeli";
+    email = "behradbadeli@gmail.com";
+    github = "L0L1P0P1";
+    githubId = 73695812;
+  };
   l1npengtul = {
     email = "l1npengtul@l1npengtul.lol";
     github = "l1npengtul";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 186644f6317e..7ccce16b410d 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -934,6 +934,12 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
+  octodns = {
+    members = [ anthonyroussel ];
+    scope = "Maintain the ecosystem around OctoDNS";
+    shortName = "OctoDNS";
+  };
+
   openstack = {
     members = [
       SuperSandro2000
diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix
index 0b780174068d..66e1e1266881 100644
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -509,8 +509,9 @@ in
               sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
           fi
 
-          # purge cache
-          rm "${cfg.dataDir}"/bootstrap/cache/*.php || true
+          # pruge and rebuild caches
+          ${lib.getExe artisan} optimize:clear
+          ${lib.getExe artisan} optimize
 
           # migrate db
           ${lib.getExe artisan} migrate --force
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 573eed048030..fe3e5e28cef3 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -446,8 +446,11 @@ let
         ./patches/cross-compile.patch
         # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
         ./patches/no-build-timestamps.patch
+      ]
+      ++ lib.optionals (!chromiumVersionAtLeast "136") [
         # Fix build with Pipewire 1.4
         # Submitted upstream: https://webrtc-review.googlesource.com/c/src/+/380500
+        # Got merged, started shipping with M136+.
         ./patches/webrtc-pipewire-1.4.patch
       ]
       ++ lib.optionals (packageName == "chromium") [
@@ -487,7 +490,12 @@ let
         # allowing us to use our rustc and our clang.
         ./patches/chromium-129-rust.patch
       ]
-      ++ lib.optionals (!ungoogled) [
+      ++ lib.optionals (!ungoogled && !chromiumVersionAtLeast "136") [
+        # Note: We since use LLVM v19.1+ on unstable *and* release-24.11 for all version and as such
+        # no longer need this patch. We opt to arbitrarily limit it to versions prior to M136 just
+        # because that's when this revert stopped applying cleanly and defer fully dropping it for
+        # the next cleanup to bundle rebuilding all of chromium and electron.
+        #
         # Our rustc.llvmPackages is too old for std::hardware_destructive_interference_size
         # and std::hardware_constructive_interference_size.
         # So let's revert the change for now and hope that our rustc.llvmPackages and
@@ -534,11 +542,48 @@ let
           decode = "base64 -d";
           hash = "sha256-xMqGdu5Q8BGF/OIRdmMzPrrrMGDOSY2xElFfhRsJlDU=";
         })
+      ]
+      ++ lib.optionals (!isElectron && !chromiumVersionAtLeast "136") [
+        # Backport "Only call format_message when needed" to fix print() crashing with is_cfi = true.
+        # We build electron is_cfi = false and as such electron is not affected by this.
+        # Started shipping with M136+.
+        # https://github.com/NixOS/nixpkgs/issues/401326
+        # https://gitlab.archlinux.org/archlinux/packaging/packages/chromium/-/issues/13
+        # https://skia-review.googlesource.com/c/skia/+/961356
+        (fetchpatch {
+          name = "only-call-format_message-when-needed.patch";
+          url = "https://skia.googlesource.com/skia/+/71685eda67178fa374d473ec1431fc459c83bb21^!?format=TEXT";
+          decode = "base64 -d";
+          stripLen = 1;
+          extraPrefix = "third_party/skia/";
+          hash = "sha256-aMqDjt/0cowqSm5DqcD3+zX+mtjydk396LD+B5F/3cs=";
+        })
+      ]
+      ++ lib.optionals (chromiumVersionAtLeast "136") [
+        # Modify the nodejs version check added in https://chromium-review.googlesource.com/c/chromium/src/+/6334038
+        # to look for the minimal version, not the exact version (major.minor.patch). The linked CL makes a case for
+        # preventing compilations of chromium with versions below their intended version, not about running the very
+        # exact version or even running a newer version.
+        ./patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
       ];
 
     postPatch =
-      lib.optionalString (!isElectron) ''
-        ln -s ${./files/gclient_args.gni} build/config/gclient_args.gni
+      lib.optionalString (!isElectron)
+        # TODO: reuse mkGnFlags for this
+        (
+          if (chromiumVersionAtLeast "136") then
+            ''
+              cp ${./files/gclient_args.gni} build/config/gclient_args.gni
+              chmod u+w build/config/gclient_args.gni
+              echo 'checkout_mutter = false' >> build/config/gclient_args.gni
+              echo 'checkout_glic_e2e_tests = false' >> build/config/gclient_args.gni
+            ''
+          else
+            ''
+              ln -s ${./files/gclient_args.gni} build/config/gclient_args.gni
+            ''
+        )
+      + lib.optionalString (!isElectron) ''
 
         echo 'LASTCHANGE=${upstream-info.DEPS."src".rev}-refs/tags/${version}@{#0}' > build/util/LASTCHANGE
         echo "$SOURCE_DATE_EPOCH" > build/util/LASTCHANGE.committime
@@ -751,6 +796,10 @@ let
             use_qt = false;
           }
       )
+      // lib.optionalAttrs (chromiumVersionAtLeast "136") {
+        # LLVM < v21 does not support --warning-suppression-mappings yet:
+        clang_warning_suppression_file = "";
+      }
       // {
         # To fix the build as we don't provide libffi_pic.a
         # (ld.lld: error: unable to find library -l:libffi_pic.a):
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 0a7e8b0152a9..fc01fbc6f983 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,27 +1,27 @@
 {
   "chromium": {
-    "version": "135.0.7049.114",
+    "version": "136.0.7103.59",
     "chromedriver": {
-      "version": "135.0.7049.115",
-      "hash_darwin": "sha256-fEqjiSP6p//NY8HCi409sftXlK6CVvzsw2oZbSgTgJ4=",
-      "hash_darwin_aarch64": "sha256-K1jH+yxYio8yyxZ7M15QhOQ9fu2VhjeaevS8zM5D8Lk="
+      "version": "136.0.7103.49",
+      "hash_darwin": "sha256-n9gOEQmMBzeoSj8Mxum2UnKe6yrmUjMKLXRD2ty8upw=",
+      "hash_darwin_aarch64": "sha256-q3iz4fAUcXyoDP4fS5vDAuEIZWftwJhlfkwDUhR57Cc="
     },
     "deps": {
       "depot_tools": {
-        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
-        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
+        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
+        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
       },
       "gn": {
-        "rev": "4a8016dc391553fa1644c0740cc04eaac844121e",
-        "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
+        "rev": "6e8e0d6d4a151ab2ed9b4a35366e630c55888444",
+        "hash": "sha256-vDKMt23RMDI+KX6CmjfeOhRv2haf/mDOuHpWKnlODcg="
       },
-      "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
+      "npmHash": "sha256-QRjk9X4rJW3ofizK33R4T1qym1riqcnpBhDF+FfNZLo="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "63fd8a7d9d09e41ba37b84386c85d5f249f848f7",
-        "hash": "sha256-U6OJHocA6vI36QCU8UITUsVlentm210CwdThCwlDw5E=",
+        "rev": "d4b493843f5f23217df99a83aa28747602841382",
+        "hash": "sha256-5SKNNEPYSAxQUWtcCq/LW7gxGjjEhuw0Uxo1ob+F7to=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -29,10 +29,15 @@
         "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
         "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU="
       },
+      "src/third_party/compiler-rt/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
+        "rev": "bc2b30185219a2defe3c8a3b45f95a11386a7f6f",
+        "hash": "sha256-bfDMglQaiExTFwaVBroia+6G+9AHEVy5cQGocaEVOgA="
+      },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "7f8b68f91ca8b192375f5e71cd81fb3ed9650ef3",
-        "hash": "sha256-1P+p5MPXm0WkeYgzIxG2SBKZVPWplUlEo7xYI//Y0uw="
+        "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
+        "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@@ -41,13 +46,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "62e217a12ee1133833d9890b2f7adde900e4efbd",
-        "hash": "sha256-FBMrvCCVwm0mmaQHDvKXljxxLwthpsFqhPE8yqBx5Aw="
+        "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
+        "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "a02de4d0d992b110c8b180fdec91258e7b60265f",
-        "hash": "sha256-LtxaimMmnman7BKLKpSR8rJtbEvHsmGVeHvzEukB4EY="
+        "rev": "97989c1bfa112c81f6499487fedc661dcf6d3b2e",
+        "hash": "sha256-9Ieaxe0PFIIP4RttODd8pTw/zVjQZGZtaYSybwnzTz0="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -66,8 +71,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "441c86221443f48e818335d51f84cf1880c35aa4",
-        "hash": "sha256-nMLn2wTAr+3U1VpqWWq93zJHrlT+f1Yky8ONKk0kWjg="
+        "rev": "929dd3e6d02aac1f46653d03b2a644e2873a3bbb",
+        "hash": "sha256-lY4P2f90/9JwCpxuBFjim7KygczM8zMDQVUaEYaQjnA="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -76,8 +81,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "25a56e315359eaebb2ff4213771016a4978a346d",
-        "hash": "sha256-ZkrAaNgCqG09CufQN35wFi09TVxvbf/U4jGNNMRLY0M="
+        "rev": "5077431b183c43f10890b865fc9f02a4dcf1dd85",
+        "hash": "sha256-CLvZTBvtTdOpC8eWUTWkb0ITJ5EViPmc6d5O8cTaKY8="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -91,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "079266db445215380befce453b1ab3bbdfeaf73d",
-        "hash": "sha256-Bcm9wxlLqp/ANg+cPvsuwAlaxVmef6g+12L5ZE4uCGA="
+        "rev": "ecc378cc61109732d174d6542c41fd523c331b13",
+        "hash": "sha256-+Cgf3OocFbD2rL4izA/0Z0qjWQiIUwiTW/z0cW0pGb0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -106,13 +111,13 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "ba86fb95004331f2cf571dd9adefe2458290ee11",
-        "hash": "sha256-wl/T/WxVNctM4m4VSFFqqtJ0xkEBiuILYywAylqa0Oo="
+        "rev": "b6bb4bab7b4a36bc95566e00cb8f01051089afc3",
+        "hash": "sha256-L2ewIW6C+PTftbbXf+nlWcFD0y4naBNg7FLXMMxiWac="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "2e328dd4eace9648adcc943cac6a1792b5dcdec5",
-        "hash": "sha256-mh4s57NonFQzWNaPiKfe9kW4Ow7XAN+hW6Xpvgjvb0w="
+        "rev": "d708a2602a5947ee068f784daa1594a673d47c4a",
+        "hash": "sha256-GaRtZmYqajLUpt7ToRfMLBlyMiJB5yT9BaaT9pHH7OM="
       },
       "src/third_party/content_analysis_sdk/src": {
         "url": "https://chromium.googlesource.com/external/github.com/chromium/content_analysis_sdk.git",
@@ -121,13 +126,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "7d4b789f55389dad1820d6caf6a650038dad06e2",
-        "hash": "sha256-O6WOm6qTSgRmDR+yY2wH6t+7ob+TtZIA5Gax1ysEZh0="
+        "rev": "8d956180934f16244bdb58b39175824775125e55",
+        "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "53dfda5e9d07d58b43cea66b8153c55dd751ff88",
-        "hash": "sha256-zXxJZz2C4eDJ8beHDXJe0UCNesDw5R0ogFcsdiF8VIc="
+        "rev": "1cffe7ec763900d104e4df62bc96d93f572157cb",
+        "hash": "sha256-VK+5saAJlZOluMAYKTKwNcnZALsCYkzgVfQHylt3584="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -136,8 +141,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "0a1143572d107c8b6980df092b84a79190ec1fbd",
-        "hash": "sha256-sUSQTOi0EuIHX9h27RXb5HnbcdfkG/U1K6EbBdjSto8="
+        "rev": "206b77577d15fc5798eb7ad52290388539b7146d",
+        "hash": "sha256-WXgiOlqtczrUkXp46Q/GTaYk0LDqebQSFbyWpD299Xw="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -156,8 +161,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "ce91fc1d085136f9c7ddca684d1764689d49b337",
-        "hash": "sha256-SsxohjLb+uoN5cMXU5DJDrtF1QVk8EWK/qvTLxCleUI="
+        "rev": "5fbd82847521cb2d584773facd56c2eb6a4df180",
+        "hash": "sha256-WTVOc2EVB/DJ4aDeB8XIF/ff6LSeEUMt2Xkvj5Hu4aU="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -171,34 +176,29 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "673e61fc215b178a90c0e67858bbf162c8158993",
-        "hash": "sha256-8Dl6Aol33o2FYID3oIw9grB0jY9VJnnnhmiNdyycTlU="
+        "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
+        "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "0dfd77492fdb0dcd06027c5842095e2e908adc90",
-        "hash": "sha256-jOTRgF2WxsX5P0LgUI9zdCc0+NcqSnO310aq15msThY="
+        "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
+        "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
-        "rev": "dcb3d2e87cebe20b6dda06d8b29abb9af27ca422",
-        "hash": "sha256-e8+rQhEU5+FfwjyEE1TM6emO0cUntuS4GN7y/BuC/U8="
+        "rev": "f5ee589bdaea60418f670fa176be15ccb9a34942",
+        "hash": "sha256-yQxm1GMMne80bLl1P7OAN3bJLz1qRNAvou2/5MKp2ig="
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "93e56257a5089dc49f1dfd1240c527f5fe1b237f",
-        "hash": "sha256-K5sOlXx72YmXlm7cc7jWf3lKmHcMdVHTwVueJo5CoHY="
+        "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
+        "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
         "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
         "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY="
       },
-      "src/third_party/chromium-variations": {
-        "url": "https://chromium.googlesource.com/chromium-variations.git",
-        "rev": "270a25f8795caf0a798ebf5a7d69284e3d830d19",
-        "hash": "sha256-ZkETD+Pka5vItN70nhlGQelycFAEnb1Qfv9k2aDXZSE="
-      },
       "src/third_party/cld_3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git",
         "rev": "b48dc46512566f5a2d41118c8c1116c4f96dc661",
@@ -216,8 +216,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "aaac07ee499895770c89163ce0920ef8bb41ed23",
-        "hash": "sha256-A86nAbKs7trVwwa1HFUNbV//6O1minvlHTpZR3vabrU="
+        "rev": "b73ae6ce38d5dd0b7fe46dbe0a4b5f4bab91c7ea",
+        "hash": "sha256-JNLaK105qDk9DxTqCFyXFfYn46dF+nZIaF5urSVRa0U="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -226,23 +226,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "b8d797a61689892adb182c9bec457c9bd24b26d2",
-        "hash": "sha256-44bD1nG7CRrvBcd9NbU4yksn7Ly9WYsWETXat/L3f0I="
+        "rev": "62ab80355a8194e051bd1d93a5c09093c7645a32",
+        "hash": "sha256-pZi6GRu7OGL7jbN4FM2qDsLCsT6cM+RM0a7XtFZVSVE="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "bf8d1d3aaf469343576db89f81df26aeb16bd62b",
-        "hash": "sha256-XscXxoCUSVGsBCB8xymEsaLc4WgzZPXu6zkRbv8ZQZw="
+        "rev": "ce46be2573328fa7b0fd1d23c04b63389f298122",
+        "hash": "sha256-Q0kdJdEmh+wbO5oeTp98OHKh9luz8u6PDztGToldZjk="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
-        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
+        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
+        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "ad4e2fc82183b1463ac870818c28680bbc3de889",
-        "hash": "sha256-HS5O+r0GFe3Dfh+86JQlsEC+5Gcs1xmUkDyZ7qixqXw="
+        "rev": "e793e21a020b53a66ae13ef8673f80b8e8a73746",
+        "hash": "sha256-BHD/XVQquh9/cr+Kv43lKGFReHy4YbQIAJq5792+4Sw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -251,8 +251,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "4c38131a16803130b66266a912029504f2cf23cd",
-        "hash": "sha256-dOq8RJ/V8kulSMK0OUWzHruiwJSP3f/86ih5gk2MMWQ="
+        "rev": "464c1d097891a1462ab28bf8bb763c1683883892",
+        "hash": "sha256-OJyfUyiR8PFSaWltx6Ig0RCB+LxPxrPtc0GUfu2dKrk="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -296,8 +296,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "5d4e649f740c675426fbe4cdaffc53ee2a4cb954",
-        "hash": "sha256-DxLHuzIvw7WIKKMCRBz4ne97j9DufoohXQZV6yZ5zfY="
+        "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
+        "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -316,18 +316,18 @@
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "bf387a71d7def4b48bf24c8e09d412dfb9962746",
-        "hash": "sha256-OcGUJxKEjeiYJgknpyb/KvDu76GMaddxWO0Lj7l9Eu8="
+        "rev": "c542d619a8959415beda5a76fe89ffa2f83df886",
+        "hash": "sha256-sMqSHYs3lvuHXEov1K9xWRd8tUPG00QBJl6an0zrxwA="
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "0999e4cf816b42c770d07916698bce943b873048",
-        "hash": "sha256-IQ+n+kHdEq8Q8/qaPGMvgD7cPN3zzaY8dbiokq6r/Vs="
+        "rev": "f61f28792a00c9bdcb3489fec81d8fd0ca1cbaba",
+        "hash": "sha256-XMLW/m+Qx+RVgo1DeYggBLjUYg/M+2eHwgjVWrA/Erw="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
-        "rev": "3cc43119a29158bcde39d288a8def4b8ec49baf8",
-        "hash": "sha256-7w5wMcmPcKLS91buxyRdcgaQjbKGFdmrKClvYVO3iko="
+        "rev": "69015643b3f68dbd438c010439c59adc52cac808",
+        "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU="
       },
       "src/third_party/emoji-segmenter/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git",
@@ -346,8 +346,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "24a9e940d481f992ba852599c78bb2217362847b",
-        "hash": "sha256-oLknxClUh7l72ZAx7sxNDM6dUhMT0vUE2IdDjRLDKtk="
+        "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
+        "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -376,8 +376,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "a32ca113e3b050693e4bb379525dfae519ebd0d9",
-        "hash": "sha256-eoV+g/QVzcI7PqDmAic5Ra9K/ba4IV1wXE4RFecuMuk="
+        "rev": "c31f0c0e6df5725c6b03124b579c9cf815fd10f4",
+        "hash": "sha256-Dz7DqucOxr5HzLNOdGNOG4iMw66bkOj64qOvqeADTic="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -391,18 +391,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "99fcd816eeaa7da46688bc4b9f4f9e71be13c2e8",
-        "hash": "sha256-SOIvGkR3k7TAs9KFA3mFbBSq5h4eJghKo38IVioOK3U="
+        "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
+        "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "a75457c637a365910508f3c2c2b986a701b03a2e",
-        "hash": "sha256-v3+Rj3jS/lCYZNjjAXB6zohdvM45PKayB43jX37ntsU="
+        "rev": "02d0fad2c512380b7270d6e704c86521075d7d54",
+        "hash": "sha256-T9ibgp0glfY5EhwMiwlvXKZat0InDu7PoqE1H8/lS5A="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "45d6317a64aad3d5060b800db267f7cea3f27198",
-        "hash": "sha256-SmU+c9YveQ4N13bteuhtmo0uvySeCnmZYpC5NYiMJuo="
+        "rev": "8acf9249344ea9ff9806d0d7f46e07640fddf550",
+        "hash": "sha256-qIIyCHay3vkE14GVCq77psm1OyuEYs4guAaQDlEwiMg="
       },
       "src/third_party/beto-core/src": {
         "url": "https://beto-core.googlesource.com/beto-core.git",
@@ -414,15 +414,25 @@
         "rev": "fa07beb12babc3b25e0c5b1f38c16aa8cb6b8f84",
         "hash": "sha256-GS4ccnuiqxMs/LVYAtvSlVAYFp4a5GoZsxcriTX3k78="
       },
+      "src/third_party/jetstream/main": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
+        "rev": "0260caf74b5c115507ee0adb6d9cdf6aefb0965f",
+        "hash": "sha256-DbRup4tOAYv27plzB2JKi2DBX2FVMDtFR7AzuovXUDU="
+      },
+      "src/third_party/jetstream/v2.2": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
+        "rev": "2145cedef4ca2777b792cb0059d3400ee2a6153c",
+        "hash": "sha256-zucA2tqNOsvjhwYQKZ5bFUC73ZF/Fu7KpBflSelvixw="
+      },
       "src/third_party/speedometer/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "d6b5ffea959ad31e231c203d7446bf8b39e987ce",
-        "hash": "sha256-lCwGk4Q+OXwO8vOlOQrkgygYqLrwpku/PkR03oEdX3Y="
+        "rev": "c760d160caa05792d3ed7650e85861c9f9462506",
+        "hash": "sha256-/nAK2uLjpPem37XCHHx3LGZEpvL/7w4Uw5bVpQ4C6ms="
       },
       "src/third_party/speedometer/v3.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "cc9ee085ae18f05961ff3dfa1ee1a90d67b7f8ee",
-        "hash": "sha256-28vGPZLaD9xSwursTRRK1xndedeBUZ5TF/4hdy0RjFc="
+        "rev": "1386415be8fef2f6b6bbdbe1828872471c5d802a",
+        "hash": "sha256-G89mrrgRaANT1vqzhKPQKemHbz56YwR+oku7rlRoCHw="
       },
       "src/third_party/speedometer/v3.0": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
@@ -466,8 +476,8 @@
       },
       "src/third_party/libjpeg_turbo": {
         "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-        "rev": "927aabfcd26897abb9776ecf2a6c38ea5bb52ab6",
-        "hash": "sha256-qgHXAjCDFxQ+QqJ8pSmI1NUvHvKKTi4MkIe1I/+hUAI="
+        "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
+        "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs="
       },
       "src/third_party/liblouis/src": {
         "url": "https://chromium.googlesource.com/external/liblouis-github.git",
@@ -501,13 +511,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "2bfb9f9e0a9cca18cd5a0045e931b49dac390c79",
-        "hash": "sha256-BWid6iU7CDEElh8j13a+S767vwnO8qQg26Vp5nQGEHc="
+        "rev": "027bbee30a0103b99d86327b48d29567fed11688",
+        "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "b4f01ea3ed6fd00923caa383bb2cf6f7a0b7f633",
-        "hash": "sha256-yQ5MIUKtuWQM5SfD74vPeqGEdLJNss2/RBUZfq5701A="
+        "rev": "e79a98159fdf6d1aa37b3500e32c6410a2cbe268",
+        "hash": "sha256-t7An0vYzukel0poLaU4t2k78k3tTR5didbcV47cGWxQ="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -521,8 +531,8 @@
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
-        "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
-        "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw="
+        "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
+        "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY="
       },
       "src/third_party/material_color_utilities/src": {
         "url": "https://chromium.googlesource.com/external/github.com/material-foundation/material-color-utilities.git",
@@ -536,8 +546,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
-        "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY="
+        "rev": "767a169c8811b090df222a458b25dfa137fc637e",
+        "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -551,8 +561,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "b756f3c04ba53983a94cd12eb29b7f22e472fd58",
-        "hash": "sha256-P6vAoVF1/geM6MjihcEBQtbf8CxE8sPSKTRLz8/c2yE="
+        "rev": "db9e1ea566813606ca055868be13f6ff4a760ab8",
+        "hash": "sha256-K/frmCf3JMvPVZc6ZKPFAQrq4Pz4io3XBvADS0O5u78="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -566,23 +576,23 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "2919d07ee57020e3e4b66cce45c61104d80304d2",
-        "hash": "sha256-zE6a0R8NZ3SE0bHwPan3dTh5kmq5JmYTbDQIvyNICeg="
+        "rev": "ca83e69429af8f0bfa34b22dc54f538b9eebf5c5",
+        "hash": "sha256-6gsur+fx546YJn/PUOOthuj+XrSIruVUeAYl4nRI6xM="
       },
       "src/third_party/perfetto": {
-        "url": "https://android.googlesource.com/platform/external/perfetto.git",
-        "rev": "aa4d8267bafad6782a1f2c8d979104f2aaa622a0",
-        "hash": "sha256-smVQykQVZdhybEUz7BlRLc+FVNH0UyGh+0eSxP8Jzrc="
+        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
+        "rev": "054635b91453895720951f7329619d003a98b3e4",
+        "hash": "sha256-2jKRhHLitR0m2a4/asvVvTqAOhUlyLsBBSjpQAer4GA="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
-        "rev": "426b2e025aa59c23a1b6e19fbacd6b4a11bfad16",
-        "hash": "sha256-5uieIE6ygM4Ooz9xbu1NVKCHHsPn6Ekz6OzqfWiA7/M="
+        "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
+        "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M="
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "f94ab76fe99754960035d520dce28e15b647e8cf",
-        "hash": "sha256-NdKKMnXZ6rYOC2wA6a1bPNStxpemzGckN6PPWom6mFA="
+        "rev": "4e1831c02c74334a35ead03362f3342b6cea2a86",
+        "hash": "sha256-mB1QaAuY8vfv8FasPyio1AF75iYH+dM8t1GIr0Ty/+g="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -591,8 +601,8 @@
       },
       "src/third_party/quic_trace/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
-        "rev": "413da873d93a03d3662f24b881ea459a79f9c589",
-        "hash": "sha256-N1uFoNd3mz/LH1z06581Ds7BUyc67SNXUPzqomYREr8="
+        "rev": "ed3deb8a056b260c59f2fd42af6dfa3db48a8cad",
+        "hash": "sha256-vbXqddDgwqetU0bDYn3qo7OBqT5eG926/MbA1hKkCT0="
       },
       "src/third_party/pywebsocket3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/pywebsocket3.git",
@@ -611,13 +621,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "48ba13bfb5488755a5d72aa60ff4a47069be498f",
-        "hash": "sha256-//z0HlMOkGTcp1IjbS0m+0dmgVYsG7EkfCiK2vvG2wU="
+        "rev": "07834ba1e5ebfb333d0b73556b7c4d62a53cb455",
+        "hash": "sha256-DTz351NpoygQLESm/z+fzFc/KGJyQelLnWpzNMmNT9o="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "5a44cdd70f04aa65fa063caa1a7e3028d75236f8",
-        "hash": "sha256-QX3b+S0IuxJKmlMudL6420+bXRhDkWYC7GNRKxKNm8A="
+        "rev": "bcce46ca33b67cc302dd53927a63013b8f53bf73",
+        "hash": "sha256-ei95CJRfNPrsYt8XcDi7Pnl5dGiJu3qs7R4rAcZ24Uc="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -636,8 +646,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "c12c13839d689f411911326b1f72e96eb525686c",
-        "hash": "sha256-C8y5ShwMffNZpFuILYNw3WOMVJp/jPen/wNbFl1vqBY="
+        "rev": "4982425ff1bdcb2ce52a360edde58a379119bfde",
+        "hash": "sha256-QTGU9Dgc6rgMeFZvhZyYeYj5W+ClJO8Yfa4+K7TmEec="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -646,18 +656,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "d120e39920c0e61cc1227bc1abe50fd6ecd3ce66",
-        "hash": "sha256-9p0/tR3bPvCJn+6eofmQXKbyfzxfbeVexdvuHpn50wk="
+        "rev": "c8ed430d092acd485f00e7a9d7a888a0857d0430",
+        "hash": "sha256-S5zkpQZdhRdnZRUrUfi5FCrF2XFe3y/adAWwfh1OQYE="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "c1c31f4d17a9e4b2af40d85c89d573eb43187e0d",
-        "hash": "sha256-uEsy4PBhO3EBJF6YdWj32GmMabgKWQJUeW3cWInAinE="
+        "rev": "1648e664337ca19a4f8679cbb9547a5b4b926995",
+        "hash": "sha256-CI0X6zbRV/snGcQZOUKQFn8Zo6D6Out6nN027HGZaa8="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "8b822ee8ac2c3e52926820f46ad858532a895951",
-        "hash": "sha256-hPd5roeHOgMiz2VUx13bUsKKDSvgQAXRdk7wfdi6e48="
+        "rev": "e57f993cff981c8c3ffd38967e030f04d13781a9",
+        "hash": "sha256-nr7pGPNPMbmL/XnL27M4m5in8qnCDcpNtVsxBAc7zms="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -666,38 +676,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "54a521dd130ae1b2f38fef79b09515702d135bdd",
-        "hash": "sha256-PScDq8HhQPFUs78N75QyL9oEykmjZmAhdxCAqQ0LJds="
+        "rev": "8c88e0c4c94a21de825efccba5f99a862b049825",
+        "hash": "sha256-s0Pe7kg5syKhK8qEZH8b7UCDa87Xk32Lh95cQbpLdAc="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "f289d047f49fb60488301ec62bafab85573668cc",
-        "hash": "sha256-2Wv0dxVQ8NvuDRTcsXkH1GKmuA6lsIuwTl0j6kbTefo="
+        "rev": "2e83ad7e6f2cc51f7eaff3ffeb10e34351b3c157",
+        "hash": "sha256-u4WDbWywua71yWB1cVIt1IDZRe4NnT5bUq3yHLKBgPo="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "952f776f6573aafbb62ea717d871cd1d6816c387",
-        "hash": "sha256-LfJ7um+rzc4HdkJerHWkuPWeEc7ZFSBafbP+svAjklk="
+        "rev": "78c359741d855213e8685278eb81bb62599f8e56",
+        "hash": "sha256-VqKQeJd81feSgYnYLqb2sYirCmnHN9Rr19/4cPZ2TzE="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "809941a4ca137df69dc9c6e8eb456bd70309197c",
-        "hash": "sha256-FPXAofnMfgUkwwRGh8rqtXrmLjouP5A8umXV1pHm1ck="
+        "rev": "723d6b4aa35853315c6e021ec86388b3a2559fae",
+        "hash": "sha256-tDW5ed6gsDKlCKf4gT8MNi1yaafocUTohL1upGKB+Cc="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "fb8f5a5d69f4590ff1f5ecacb5e3957b6d11daee",
-        "hash": "sha256-fO6fkWOMYbf/um7gKFyjtrFE21g1kYx3lLvPv4gY7qw="
+        "rev": "289efccc7560f2b970e2b4e0f50349da87669311",
+        "hash": "sha256-Cw7LWBPRbDVlfmeMM4CYEC9xbfqT1wV7yuUcpGMLahs="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "2d8f273ebd4b843c402d9ee881616895b854e42f",
-        "hash": "sha256-nD/WTBTwCnfZdwdNKldDVpcuirSghCIeJRBeX+uQXBk="
+        "rev": "0d5b49b80f17bca25e7f9321ad4e671a56f70887",
+        "hash": "sha256-NdvjtdCrNVKY23B4YDL33KB+/9HsSWTVolZJOto8+pc="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "4e7b0c905b1a0401e24333800937cc8792efa037",
-        "hash": "sha256-CCpfWpyGki9klgHInjs6gAhw5shPXlzmFgccCHNfGQY="
+        "rev": "73d7d74bc979c8a16c823c4eae4ee881153e000a",
+        "hash": "sha256-2GII+RBRzPZTTib82srUEFDG+CbtPTZ6lX3oDJBC2gU="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -736,23 +746,23 @@
       },
       "src/third_party/webgl/src": {
         "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git",
-        "rev": "450cceb587613ac1469c5a131fac15935c99e0e7",
-        "hash": "sha256-32r3BdmsNA89mo0k+vK1G3718AOjseE7cJlopZ/0pSw="
+        "rev": "c01b768bce4a143e152c1870b6ba99ea6267d2b0",
+        "hash": "sha256-mSketnpcDtz3NnhPkXMpMpq8MWcFiSviJbK6h06fcnw="
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "dcfb0d153f1e19905b0af26e640470c9ec5578e7",
-        "hash": "sha256-726p6OfKAzHtnjz/8WtMcsRxuq4wqyJv3+DHOHDTeYY="
+        "rev": "92f4eb4dae0f5439f2cdc7ce467d66b10e165f42",
+        "hash": "sha256-vXyp0+6eyKOzzQbkRa8f8dO+B9cyUCY2hCZEFc7+7lU="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "d812e180206934eb3b7ae411d82d61bc21c22f70",
-        "hash": "sha256-KAkkFVxEfQxbSjD+55LO4UZYWWwmGK6B9ENFSPljNu0="
+        "rev": "2c5049abfc2cf36ece82f7f84ebdcb786659eaf7",
+        "hash": "sha256-lMqCZ27TJ4aXKWDuN22VtceXh0jNH4Ll1234xCbEOro="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9e5db68b15087eccd8d2493b4e8539c1657e0f75",
-        "hash": "sha256-gXdBDo+fzp6hJB8qyhscV7ajwSfCUeYvSxhL10g56rU="
+        "rev": "2c8f5be6924d507ee74191b1aeadcec07f747f21",
+        "hash": "sha256-cNONf88oSbsdYuSdPiLxgTI973qOP6fb1OKb2WMQMMg="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -771,8 +781,8 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "7702e723fa25102db8b633ead4e3c221a5121487",
-        "hash": "sha256-n3FxY4HESzNyccQLENbuisU29v79c2x+7fYOsUrQnFg="
+        "rev": "d6fc3be20b0d3e3742157fa26c5359babaa8bc8b",
+        "hash": "sha256-p5DjGNH9IR0KPWSFmbsdt2PU+kHgWRAnBw7J9sLV/S8="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
@@ -781,8 +791,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e2591684c45463aa1e46ebefc3fd35deee63f37c",
-        "hash": "sha256-tbGzFdqmkoSiVGk1WMRroWC3NR5GaHRuMwGzPhVodxk="
+        "rev": "b6178615ecae6d84b347cb7a1812cad9afca51f2",
+        "hash": "sha256-Gc7huCu+d5XBwI420V1nutKeJpqBfvJ6fhh5zpRtMw4="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
new file mode 100644
index 000000000000..879acac20469
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
@@ -0,0 +1,19 @@
+diff --git a/third_party/node/check_version.js b/third_party/node/check_version.js
+index 0a037ab449c3b8780e68506993e6281d44cef7dc..e7cba2e457543eb8767c9868d851e5e4f5c32f2a 100644
+--- a/third_party/node/check_version.js
++++ b/third_party/node/check_version.js
+@@ -29,11 +29,9 @@ async function main() {
+   const expectedVersion = extractExpectedVersion(contents);
+ 
+   const errorMessage =
+-      `Failed NodeJS version check: Expected version '${expectedVersion}', ` +
+-      `but found '${process.version}'. Did you run 'gclient sync'? If the ` +
+-      `problem persists try running 'gclient sync -f' instead, or deleting ` +
+-      `third_party/node/{linux,win,mac} folders and trying again.`;
++      `Failed NodeJS version check: Expected at least version '${expectedVersion}', ` +
++      `but found '${process.version}'.`;
+ 
+-  assert.equal(expectedVersion, process.version, errorMessage);
++  assert.ok(expectedVersion <= process.version, errorMessage);
+ }
+ main();
diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
index 6785299be8e4..9827f278e44e 100644
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -9,7 +9,7 @@
 (
   (buildMozillaMach rec {
     pname = "floorp";
-    packageVersion = "11.25.0";
+    packageVersion = "11.26.0";
     applicationName = "Floorp";
     binaryName = "floorp";
     branding = "browser/branding/official";
@@ -17,14 +17,14 @@
     allowAddonSideload = true;
 
     # Must match the contents of `browser/config/version.txt` in the source tree
-    version = "128.9.0";
+    version = "128.10.0";
 
     src = fetchFromGitHub {
       owner = "Floorp-Projects";
       repo = "Floorp";
       fetchSubmodules = true;
       rev = "v${packageVersion}";
-      hash = "sha256-zY0JklGWsulZXj45/yKJpJypGSA5qwH/zo8F52gp2nE=";
+      hash = "sha256-gv6wEaESFoL4RvZ+alhwUOfPQbSpyQr1yTQedP2RSwE=";
     };
 
     extraConfigureFlags = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 901441ce671a..4976d871c824 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -417,13 +417,13 @@
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
   "equinix": {
-    "hash": "sha256-L/1cNCPmDDxbdJYOtzIl1dCDZBu6DlH96ZN1SisywgQ=",
+    "hash": "sha256-ae9mtP5at9b3EB8aaBcjomL3ahr6ta+wm8jv9reQW20=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v3.6.0",
+    "rev": "v3.7.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-K3tQQytOQ81duLMyCZu9PczsS1NUYF0AmPMQo5UcUXo="
+    "vendorHash": "sha256-sjEgBLwk/dYUmq+kL0PtamEukXgC9rzeyTT87HK0Y8E="
   },
   "exoscale": {
     "hash": "sha256-RUO4Ge2z4e4N2FWiLtSNv/w2ivgOJVNYQCJvT8hN/8g=",
@@ -1228,11 +1228,11 @@
     "vendorHash": "sha256-oEamCseBGmETqeBLiBHfh81oQNUHWfTrsegkFijvb20="
   },
   "spotinst": {
-    "hash": "sha256-8BP8ltL2fWbTxRCdiypPzKvWpbUfLG6mRTAx3onujHY=",
+    "hash": "sha256-dQeOucXwHW0GeZ2irKbdx+GvnjuA1PKnW+RFjvjwNc0=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.216.1",
+    "rev": "v1.216.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-STIPYBMj6r630/J71fAeLTkrvop/8u7gToGcijopqCo="
   },
@@ -1264,11 +1264,11 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic": {
-    "hash": "sha256-15ZM0Uk0VEEPTC/paxUq4dTG/myV1yyJX8wJW/BuH/0=",
+    "hash": "sha256-HdK4YOrOoaivdYOHBTcOjjx4kI7kAITWY39aZ6WFpgU=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.0.8",
+    "rev": "v3.0.9",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-S3SBp17+qqA64tWydD5DYc9KahycJ+qDrdXvFwu6Lbc="
   },
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index cc65d141adcb..d235ebd71ecb 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "0-unstable-2025-04-19";
+  version = "0-unstable-2025-04-21";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "c6c66c31ba0af106d45132bcf5e14540d54f24d0";
-    hash = "sha256-AYi9biVjJatG8lEGj1oJvukre+ZbFePyBZIYc5aMpXY=";
+    rev = "daca9301afa8f75be3f803179face2ccad2ca437";
+    hash = "sha256-3iaPtsYTQTFzcqUkzqtqzzQGoXwR81V7VStF6xt86Ec=";
   };
 
   vendorHash = "sha256-NZlIZYytk3OKtIdEwVInnQhORL1iSzuWzmZjrknD71E=";
diff --git a/pkgs/applications/video/mpv/scripts/mpvacious.nix b/pkgs/applications/video/mpv/scripts/mpvacious.nix
index a6a00283129e..7c85120bcf6b 100644
--- a/pkgs/applications/video/mpv/scripts/mpvacious.nix
+++ b/pkgs/applications/video/mpv/scripts/mpvacious.nix
@@ -10,13 +10,13 @@
 
 buildLua rec {
   pname = "mpvacious";
-  version = "0.39";
+  version = "0.40";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "sha256-8E/EGIePK5siCchZPL81XMgspvNaRunqiLVU/J3nsmI=";
+    sha256 = "sha256-PxLbv9aGVQV4Gea2H/GcWv/yuaRSqBRqbzRXu612kLE=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 3138498e3682..d14e62812540 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -745,7 +745,7 @@ stdenvNoCC.mkDerivation {
     # no `/usr/include`, there’s essentially no risk to dropping
     # the flag there. See discussion in NixOS/nixpkgs#191152.
     #
-    + optionalString ((cc.isClang or false) && !(cc.isROCm or false) && !targetPlatform.isDarwin) ''
+    + optionalString ((cc.isClang or false) && !(cc.isROCm or false) && !targetPlatform.isDarwin && !targetPlatform.isAndroid) ''
       echo " -nostdlibinc" >> $out/nix-support/cc-cflags
     ''
 
diff --git a/pkgs/by-name/az/azure-storage-azcopy/package.nix b/pkgs/by-name/az/azure-storage-azcopy/package.nix
index fb324cc58ad7..dd308075d730 100644
--- a/pkgs/by-name/az/azure-storage-azcopy/package.nix
+++ b/pkgs/by-name/az/azure-storage-azcopy/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.28.1";
+  version = "10.29.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     tag = "v${version}";
-    hash = "sha256-9TWccJYcQrl986GyLAvQPTubg7P6lT+OjdkTdjww7nU=";
+    hash = "sha256-PkgIMSXWldorwmMri1tASnP9bjXrWFbeguMFXoPEYfw=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-Cno1H6p4qr+0CDGSd6TyCVEi+lLGoruwGVkDe8lMg08=";
+  vendorHash = "sha256-w8ux6W2cPjz5cORP/KU8Tw8rUe/eGVMeK5xIM3ZSa+c=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/bd/bdf2psf/package.nix b/pkgs/by-name/bd/bdf2psf/package.nix
index 96ed72c3a07a..4c8c369fa384 100644
--- a/pkgs/by-name/bd/bdf2psf/package.nix
+++ b/pkgs/by-name/bd/bdf2psf/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.235";
+  version = "1.236";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "sha256-liJHtkJ53wtI91ztozygQNc0x6XOzesgaURJei0z4rg=";
+    sha256 = "sha256-b4zEgpDxvllj/9EuKdgTOz1X6bB+4nk/W1WUUMBCU+s=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/by-name/c2/c2patool/package.nix b/pkgs/by-name/c2/c2patool/package.nix
index 746a8a971242..1448d1cefcb0 100644
--- a/pkgs/by-name/c2/c2patool/package.nix
+++ b/pkgs/by-name/c2/c2patool/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-mJ9839jW8+HuzyFJuT+PwERGXO765ST5iMmHz4DdbGQ=";
+    hash = "sha256-W9I7I4sukKBg4seRyn9iXoNhkRoSKcjbpjgZjvQKCGw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cRMeaQUkm5YenLruM+l3BWkWQqYhtRpb4s9HyzRn71k=";
+  cargoHash = "sha256-C5PkwMfP/MyO8QlQk0DwkU2Z/u/FdJIvwpE3gseUG/Q=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ci/civo/package.nix b/pkgs/by-name/ci/civo/package.nix
index 7fc0cf094054..3c22e76f3d72 100644
--- a/pkgs/by-name/ci/civo/package.nix
+++ b/pkgs/by-name/ci/civo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "civo";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-zOdQ3bodAHEMQdq5DbVD7VoTS66OHFn5gP1HbowzIV4=";
+    hash = "sha256-+gDdUbVgAaid1Eufd1xpvRyVtIOxcU0ZoSyJy1wlAfI=";
   };
 
-  vendorHash = "sha256-F0ULVAOLMgBlwRlJekKXKCqSYbU4pAL/AkuPTsUTMsI=";
+  vendorHash = "sha256-yRhY/+lDZ3dOVj34tD+1YLU178LSgSb9YVBVZfnoVIg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/co/converseen/package.nix b/pkgs/by-name/co/converseen/package.nix
index 2bf443fb52b8..470c2535842e 100644
--- a/pkgs/by-name/co/converseen/package.nix
+++ b/pkgs/by-name/co/converseen/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "converseen";
-  version = "0.13.0.1";
+  version = "0.14.0.0";
 
   src = fetchFromGitHub {
     owner = "Faster3ck";
     repo = "Converseen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EFeOBk/KK7CaX+Da5PxIWsImw8Sgjlvcl29QKO71V+Y=";
+    hash = "sha256-i7r6AyOk+WtMjlDc5/tDvaUV6yMKaQ7xZ9z9s+KBmts=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/cy/cyclonedx-python/package.nix b/pkgs/by-name/cy/cyclonedx-python/package.nix
index 623571326d9d..ece1d1645f5c 100644
--- a/pkgs/by-name/cy/cyclonedx-python/package.nix
+++ b/pkgs/by-name/cy/cyclonedx-python/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cyclonedx-python";
-  version = "5.5.0";
+  version = "6.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${version}";
-    hash = "sha256-6sWDUuABGDgaim3YSrRNedu5z2XOIY0ERgit78ZM1+E=";
+    hash = "sha256-58btE2eMX4oucgg9gbiouKZvX8TVct69YpOP2Bp2Ez8=";
   };
 
   build-system = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 50dc42dc2eac..7e03d6713172 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.124.0";
+  version = "1.125.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-B3qozldNmCYLCuBoWMHycf9gNKbvUvPHK2CDOvMYEt8=";
+    sha256 = "sha256-9Kwkwtwo9PB2XU3zP+ZGe1/qrPmkTPW7cRNOviwh8mM=";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/dr/dropwatch/package.nix b/pkgs/by-name/dr/dropwatch/package.nix
index 0fbf7865dd63..78266fd3d9a3 100644
--- a/pkgs/by-name/dr/dropwatch/package.nix
+++ b/pkgs/by-name/dr/dropwatch/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dropwatch";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "nhorman";
     repo = "dropwatch";
     rev = "v${version}";
-    sha256 = "sha256-TbhgcX5WzuigP5/Mj5JuK7O/UKcu70D7dcOcvo4fxeQ=";
+    sha256 = "sha256-+7bT1Gw4ncwLFkrxxbXjNs3KMM1sSQrCqXMYxKso9/4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ed/edl/package.nix b/pkgs/by-name/ed/edl/package.nix
index d160d76cdbba..b516f8b19f31 100644
--- a/pkgs/by-name/ed/edl/package.nix
+++ b/pkgs/by-name/ed/edl/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonPackage {
   pname = "edl";
-  version = "3.52.1-unstable-2025-03-23";
+  version = "3.52.1-unstable-2025-04-16";
 
   src = fetchFromGitHub {
     owner = "bkerler";
     repo = "edl";
-    rev = "9acf74d0ccca4aff85c8698cdd49ad964128e7d1";
+    rev = "3adab1652cdac05cb567646dda94ea06a14f8961";
     fetchSubmodules = true;
-    hash = "sha256-mdA3a3VS0oDt1Y4n/KPzXUVq/ldyvpJjMtkv9i5w1Jg=";
+    hash = "sha256-fhbZ0KZLE4jdTjvlZNKlXgE0kta7YXWsG7xkIznchGU=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 61c3e00d8e0a..9665dd19831f 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.174";
+  version = "0.0.175";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-L+h9ASl1LOJLaXAsxr6nxzai3MGOpjOTZ6uhb2rkeaQ=";
+    hash = "sha256-6uqPnkJeyn4R1mc/vVSVIl6sarSo41drKe9tTqWDJU0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ge/geant4/package.nix b/pkgs/by-name/ge/geant4/package.nix
index 13bc349112e6..923e9c3536fe 100644
--- a/pkgs/by-name/ge/geant4/package.nix
+++ b/pkgs/by-name/ge/geant4/package.nix
@@ -38,12 +38,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "11.3.1";
+  version = "11.3.2";
   pname = "geant4";
 
   src = fetchurl {
     url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-yTyplvbzWqQ/lI/8q6lgNGjfAd7rYvYcM7p2kifDGf4=";
+    hash = "sha256-iSrt10JSYqUKw9PHEX2BwMDaS0CMaIDbr1R4uTAeSIw=";
   };
 
   # Fix broken paths in a .pc
diff --git a/pkgs/by-name/gr/grcov/0001-update-time-rs.patch b/pkgs/by-name/gr/grcov/0001-update-time-rs.patch
deleted file mode 100644
index e3eb06eea939..000000000000
--- a/pkgs/by-name/gr/grcov/0001-update-time-rs.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-From cd983416673fabf7bc55c0888c0f73f209f35e4e Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Fri, 27 Sep 2024 16:03:44 +0800
-Subject: [PATCH] update time-rs
-
----
- Cargo.lock | 63 ++++++++++++++++++++++++++++++++++++++----------------
- 1 file changed, 44 insertions(+), 19 deletions(-)
-
-diff --git a/Cargo.lock b/Cargo.lock
-index af7c7f2..30cb4c3 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -353,7 +353,7 @@ dependencies = [
-  "heck",
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
- ]
- 
- [[package]]
-@@ -463,6 +463,15 @@ dependencies = [
-  "uuid",
- ]
- 
-+[[package]]
-+name = "deranged"
-+version = "0.3.11"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
-+dependencies = [
-+ "powerfmt",
-+]
-+
- [[package]]
- name = "deunicode"
- version = "0.4.3"
-@@ -871,6 +880,12 @@ dependencies = [
-  "bitflags 1.3.2",
- ]
- 
-+[[package]]
-+name = "num-conv"
-+version = "0.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-+
- [[package]]
- name = "num-traits"
- version = "0.2.15"
-@@ -970,7 +985,7 @@ dependencies = [
-  "pest_meta",
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
- ]
- 
- [[package]]
-@@ -1029,6 +1044,12 @@ version = "0.3.27"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
- 
-+[[package]]
-+name = "powerfmt"
-+version = "0.2.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-+
- [[package]]
- name = "ppv-lite86"
- version = "0.2.17"
-@@ -1275,22 +1296,22 @@ dependencies = [
- 
- [[package]]
- name = "serde"
--version = "1.0.171"
-+version = "1.0.193"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
-+checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
- dependencies = [
-  "serde_derive",
- ]
- 
- [[package]]
- name = "serde_derive"
--version = "1.0.171"
-+version = "1.0.193"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
-+checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
- dependencies = [
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
- ]
- 
- [[package]]
-@@ -1323,7 +1344,7 @@ checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
- dependencies = [
-  "log",
-  "termcolor",
-- "time 0.3.23",
-+ "time 0.3.36",
- ]
- 
- [[package]]
-@@ -1403,9 +1424,9 @@ dependencies = [
- 
- [[package]]
- name = "syn"
--version = "2.0.25"
-+version = "2.0.32"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "15e3fc8c0c74267e2df136e5e5fb656a464158aa57624053375eb9c8c6e25ae2"
-+checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -1536,7 +1557,7 @@ checksum = "463fe12d7993d3b327787537ce8dd4dfa058de32fc2b195ef3cde03dc4771e8f"
- dependencies = [
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
- ]
- 
- [[package]]
-@@ -1561,13 +1582,16 @@ dependencies = [
- 
- [[package]]
- name = "time"
--version = "0.3.23"
-+version = "0.3.36"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "59e399c068f43a5d116fedaf73b203fa4f9c519f17e2b34f63221d3792f81446"
-+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
- dependencies = [
-+ "deranged",
-  "itoa",
-  "libc",
-+ "num-conv",
-  "num_threads",
-+ "powerfmt",
-  "serde",
-  "time-core",
-  "time-macros",
-@@ -1575,16 +1599,17 @@ dependencies = [
- 
- [[package]]
- name = "time-core"
--version = "0.1.1"
-+version = "0.1.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
-+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
- 
- [[package]]
- name = "time-macros"
--version = "0.2.10"
-+version = "0.2.18"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "96ba15a897f3c86766b757e5ac7221554c6750054d74d5b28844fce5fb36a6c4"
-+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
- dependencies = [
-+ "num-conv",
-  "time-core",
- ]
- 
-@@ -1762,7 +1787,7 @@ dependencies = [
-  "once_cell",
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
-  "wasm-bindgen-shared",
- ]
- 
-@@ -1784,7 +1809,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
- dependencies = [
-  "proc-macro2",
-  "quote",
-- "syn 2.0.25",
-+ "syn 2.0.32",
-  "wasm-bindgen-backend",
-  "wasm-bindgen-shared",
- ]
--- 
-2.46.0
-
diff --git a/pkgs/by-name/gr/grcov/package.nix b/pkgs/by-name/gr/grcov/package.nix
index 6fcb3d75affb..0c3b55f9ebc9 100644
--- a/pkgs/by-name/gr/grcov/package.nix
+++ b/pkgs/by-name/gr/grcov/package.nix
@@ -4,23 +4,19 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grcov";
-  version = "0.8.19";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "grcov";
-    tag = "v${version}";
-    sha256 = "sha256-1t+hzB9sSApLScCkjBnLk9i2dsoEwZmWCFukEOvHhZI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e3RQn6wKvVm40UK8ZlgIi2gRS9eEFBnEXdmXtCgv0Go=";
   };
 
-  cargoPatches = [
-    ./0001-update-time-rs.patch
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WOVIlUBPiZyBFfl3hwfN63jSxd3vysRY9VKUqk0lCc8=";
+  cargoHash = "sha256-v4laGVbWmK8WFJXX5ChtViyKyMtmwpehSgNG6F31Mn0=";
 
   # tests do not find grcov path correctly
   checkFlags =
@@ -46,4 +42,4 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ DieracDelta ];
   };
-}
+})
diff --git a/pkgs/by-name/gr/grype/package.nix b/pkgs/by-name/gr/grype/package.nix
index 2df384d4b2a9..30b331f98f08 100644
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -7,15 +7,15 @@
   openssl,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "grype";
-  version = "0.87.0";
+  version = "0.91.2";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "grype";
-    tag = "v${version}";
-    hash = "sha256-El7cegeHMb6fhO1Vr6FK0E3Mlk/dbU0Dv4lUYNu0Gcc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-y1uq7tNTzAhEAX/LZkrwfAanWDJpzuM+AWHlVcOVpqg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-SbKvDAzWq58O0e/+1r5oI3rxfdsnPenMPwqNRTOe7AI=";
+  vendorHash = "sha256-A0YvbCI2n67Q9vA86PMY3DUGi6zbTgR8iWg8Nfvy9IQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -46,8 +46,8 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=main.version=${version}"
-    "-X=main.gitDescription=v${version}"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.gitDescription=v${finalAttrs.version}"
     "-X=main.gitTreeState=clean"
   ];
 
@@ -67,13 +67,15 @@ buildGoModule rec {
     unset ldflags
 
     # patch utility script
-    patchShebangs grype/db/legacy/distribution/test-fixtures/tls/generate-x509-cert-pair.sh
+    patchShebangs grype/db/v5/distribution/test-fixtures/tls/generate-x509-cert-pair.sh
 
     # FIXME: these tests fail when building with Nix
     substituteInPlace test/cli/config_test.go \
       --replace-fail "Test_configLoading" "Skip_configLoading"
     substituteInPlace test/cli/db_providers_test.go \
       --replace-fail "TestDBProviders" "SkipDBProviders"
+    substituteInPlace grype/presenter/cyclonedx/presenter_test.go \
+      --replace-fail "TestCycloneDxPresenterDir" "SkipCycloneDxPresenterDir"
 
     # remove tests that depend on docker
     substituteInPlace test/cli/cmd_test.go \
@@ -115,20 +117,20 @@ buildGoModule rec {
       --zsh <($out/bin/grype completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Vulnerability scanner for container images and filesystems";
     homepage = "https://github.com/anchore/grype";
-    changelog = "https://github.com/anchore/grype/releases/tag/v${version}";
+    changelog = "https://github.com/anchore/grype/releases/tag/v${finalAttrs.version}";
     longDescription = ''
       As a vulnerability scanner grype is able to scan the contents of a
       container image or filesystem to find known vulnerabilities.
     '';
-    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [
       fab
       jk
       kashw2
     ];
     mainProgram = "grype";
   };
-}
+})
diff --git a/pkgs/by-name/hy/hyprland-qtutils/package.nix b/pkgs/by-name/hy/hyprland-qtutils/package.nix
index 58993158991f..695fc391751e 100644
--- a/pkgs/by-name/hy/hyprland-qtutils/package.nix
+++ b/pkgs/by-name/hy/hyprland-qtutils/package.nix
@@ -14,13 +14,13 @@ let
 in
 gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland-qtutils";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland-qtutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9m/Ha7hrxtbBl4UylZTYzTT/8a6Sy5DvTmBJrcQ6FwQ=";
+    hash = "sha256-2dModE32doiyQMmd6EDAQeZnz+5LOs6KXyE0qX76WIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/intentrace/package.nix b/pkgs/by-name/in/intentrace/package.nix
index 149215230e4c..a88cb4f75eed 100644
--- a/pkgs/by-name/in/intentrace/package.nix
+++ b/pkgs/by-name/in/intentrace/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.9.0";
+  version = "0.9.5";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
     owner = "sectordistrict";
     repo = "intentrace";
     tag = "v${version}";
-    hash = "sha256-0TrM6Kb+5v7d98VJOsZXtsYZ4BGIbqXA3B6d4gqvl90=";
+    hash = "sha256-9frNVC9jSWYiElTP6z+xoU5GW9QKxfxvt2v5jkhyH9I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XHhu5B2GyZvKj9egbSOLJ7W/4BNdcGDYHYmb97Lhcpc=";
+  cargoHash = "sha256-SinuOXJ9Z+HQMTAKm+pUzx6jrLMypoK3f2DLmRaI70E=";
 
   meta = {
     description = "Prettified Linux syscall tracing tool (like strace)";
diff --git a/pkgs/by-name/lu/lunatask/package.nix b/pkgs/by-name/lu/lunatask/package.nix
index 6c4d5a680b3a..acc3b4c5eb78 100644
--- a/pkgs/by-name/lu/lunatask/package.nix
+++ b/pkgs/by-name/lu/lunatask/package.nix
@@ -6,12 +6,12 @@
 }:
 
 let
-  version = "2.0.20";
+  version = "2.0.22";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage";
-    hash = "sha256-yhlRN2Owp+wbNgoAgJD4U21LvaZc+sSCfyp0AU0slWo=";
+    hash = "sha256-5V4h7x9NMZPAEinWmvhcBj8WrtKXp7naacSaMOEzwl0=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/me/mercure/package.nix b/pkgs/by-name/me/mercure/package.nix
index 52fdad672cbe..7612dfd164bf 100644
--- a/pkgs/by-name/me/mercure/package.nix
+++ b/pkgs/by-name/me/mercure/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "mercure";
-  version = "0.18.4";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "mercure";
     rev = "v${version}";
-    hash = "sha256-igPb2b3q3gGewg9DhSBVCSnFvwbGxIOQTCN1sEzdSJE=";
+    hash = "sha256-TpcxSNvSzn5g7WxEEEbxpHKEwa1W4T6LmYbBCMA8P88=";
   };
 
   sourceRoot = "${src.name}/caddy";
 
-  vendorHash = "sha256-AzlLZ4+4bpsDfYGMDBH9V79BKa1N4iVzRsH3+XHAFSQ=";
+  vendorHash = "sha256-g6MQOJJXLFibMelRblXsQEqcsBNpmdViOPVgYoWzOPw=";
 
   subPackages = [ "mercure" ];
   excludedPackages = [ "../cmd/mercure" ];
diff --git a/pkgs/by-name/na/narsil/package.nix b/pkgs/by-name/na/narsil/package.nix
index 76d3ac329ad9..2b65576cd5c7 100644
--- a/pkgs/by-name/na/narsil/package.nix
+++ b/pkgs/by-name/na/narsil/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "narsil";
-  version = "1.4.0-48-gaf7c8c1b3";
+  version = "1.4.0-49-g64a513fe4";
 
   src = fetchFromGitHub {
     owner = "NickMcConnell";
     repo = "NarSil";
     tag = version;
-    hash = "sha256-w/rXKD66Kx+XE1ItOwurf5XWE02OHirofVMUQqpf6WQ=";
+    hash = "sha256-YSPaquQfWTRGswttA+z7zIDJu+i8bDegzAetQMKlgZA=";
   };
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index 718ee0ef7a94..92c9229f5508 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "0.48.3";
+  version = "0.48.4";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-D5CiIC9JVF3fhS0MplWekliOdGAblFzJPafrlYDq1Js=";
+    hash = "sha256-Gq3XkSTpvJ22aUxCGrPkb/m+8x+Uuiwi9+dLVUdpTJ0=";
   };
 
   vendorHash = "sha256-LMDIpgtMbwr/cpVoAAnr56c/G81ocuOQCJDI+S0z1XU=";
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index 6fdc26636c8a..3cd7e864b90c 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "openfga";
-  version = "1.8.9";
+  version = "1.8.10";
 in
 
 buildGoModule {
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "openfga";
     repo = "openfga";
     rev = "v${version}";
-    hash = "sha256-yrj59gZjYxYPVqizCm98INsWmMTTx9BkK++6Gr5mr/Y=";
+    hash = "sha256-G2H9YM1cPt1qLIBBlRuUX/uyAwQxlsCMIXqsuI1ryrA=";
   };
 
-  vendorHash = "sha256-6rC8de55fadBCE+15kN17Xm9UmkH/fwbndLI0FXO/Cc=";
+  vendorHash = "sha256-Bzgtb4kYUB/+JhFqYoiLKFe09EpNrBk2gwOndLXDm/8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index 0908777635bb..f7985edd5f61 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -31,16 +31,9 @@
   enableZookeeper ? true,
 }:
 
-let
-  version = "3.1.0";
-  webUiStatic = fetchurl {
-    url = "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-web-ui-${version}.tar.gz";
-    hash = "sha256-05DaaDIFtADnkLFqdHe5eUvo6LRz6BduMvGVmzOeurM=";
-  };
-in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "prometheus";
-  inherit version;
+  version = "3.1.0";
 
   outputs = [
     "out"
@@ -51,19 +44,24 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "prometheus";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Q3f0L6cRVQRL1AHgUI3VNbMG9eTfcApbXfSjOTHr7Go=";
   };
 
   vendorHash = "sha256-vQwBnSxoyIYTeWLk3GD9pKDuUjjsMfwPptgyVnzcTok=";
 
+  webUiStatic = fetchurl {
+    url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
+    hash = "sha256-05DaaDIFtADnkLFqdHe5eUvo6LRz6BduMvGVmzOeurM=";
+  };
+
   excludedPackages = [
     "documentation/prometheus-mixin"
     "web/ui/mantine-ui/src/promql/tools"
   ];
 
   postPatch = ''
-    tar -C web/ui -xzf ${webUiStatic}
+    tar -C web/ui -xzf ${finalAttrs.webUiStatic}
 
     patchShebangs scripts
 
@@ -109,7 +107,7 @@ buildGoModule rec {
     [
       "-s"
       "-w"
-      "-X ${t}.Version=${version}"
+      "-X ${t}.Version=${finalAttrs.version}"
       "-X ${t}.Revision=unknown"
       "-X ${t}.Branch=unknown"
       "-X ${t}.BuildUser=nix@nixpkgs"
@@ -142,4 +140,4 @@ buildGoModule rec {
       Frostman
     ];
   };
-}
+})
diff --git a/pkgs/by-name/qi/qir-runner/package.nix b/pkgs/by-name/qi/qir-runner/package.nix
index cfa1167666a4..2203f4092044 100644
--- a/pkgs/by-name/qi/qir-runner/package.nix
+++ b/pkgs/by-name/qi/qir-runner/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "qir-runner";
-  version = "0.7.6";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "qir-alliance";
     repo = "qir-runner";
     tag = "v${version}";
-    hash = "sha256-dvzvLm8omt4Uh/yTisaUcwuom0ZJnV6SwwFfbDNjHvM=";
+    hash = "sha256-ExCIjn5XqDIIYhvEesHRtNZuc4mRr+b9EYE5LNKqNTc=";
   };
 
   nativeBuildInputs = [ llvmPackages_19.llvm ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-11+TV+7JLLvoWQIwgc4owUV4jNZcjD6S1uUwD8xWAEI=";
+  cargoHash = "sha256-XzxkSzbjJdJaUmXK2nwd9naIDCsfXiLLlTyf8AFSvzA=";
 
   meta = {
     description = "QIR bytecode runner to assist with QIR development and validation";
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index 56994b141155..336f3ef38062 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.1.1";
+  version = "25.1.2";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-HjcgyDEm6m6/ab75GLFy6B5hu3Q7CQDIjxVnTVfCgbA=";
+    sha256 = "sha256-eivXJrfMf7+EAJr+wpOs9dtC8oiyOGy6AY1DNiNVWWA=";
   };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-syAv40Coxy4uRQ6n20ikL7BTdP81N6Un1VKHpICv458=";
+  vendorHash = "sha256-svJQFtwD1/NdlIyV7aSvonK/A7p6E38gLlrGg4r2Mm4=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/by-name/ru/runme/package.nix b/pkgs/by-name/ru/runme/package.nix
index 74c31ad95489..63f415afc738 100644
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "3.13.1";
+  version = "3.13.2";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-tzo8P2K3Bgb5Ssn8m848fjcTnW7XSmng/cV6EhdErEQ=";
+    hash = "sha256-3+Pi6wN5F6RJ+pUSU8bSXlqKKPEXgv7eCu8PPNSXw2s=";
   };
 
-  vendorHash = "sha256-Jh8vB8ZCovB89/CY2105K0260LIEv31Empl/ku504To=";
+  vendorHash = "sha256-9D3vMJCDGw3ohaShIcpAk1kAzRIRFhJtANp//YnS3A8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ru/rure/Cargo.lock b/pkgs/by-name/ru/rure/Cargo.lock
index 9984478e480f..33b7e44c2fa7 100644
--- a/pkgs/by-name/ru/rure/Cargo.lock
+++ b/pkgs/by-name/ru/rure/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aho-corasick"
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "memchr"
@@ -25,9 +25,9 @@ checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "regex"
-version = "1.10.5"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -37,9 +37,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -48,9 +48,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "rure"
diff --git a/pkgs/by-name/ru/rure/package.nix b/pkgs/by-name/ru/rure/package.nix
index 58cce26b19ea..c812d587fc76 100644
--- a/pkgs/by-name/ru/rure/package.nix
+++ b/pkgs/by-name/ru/rure/package.nix
@@ -4,6 +4,7 @@
   rustPlatform,
   fetchCrate,
   fixDarwinDylibNames,
+  haskellPackages,
 }:
 
 let
@@ -36,7 +37,10 @@ rustPlatform.buildRustPackage {
     fixDarwinDylibNames
   ];
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    updateScript = ./update.sh;
+    tests.haskell-bindings = haskellPackages.regex-rure;
+  };
 
   meta = {
     description = "C API for Rust's regular expression library";
diff --git a/pkgs/by-name/ru/rure/pin.json b/pkgs/by-name/ru/rure/pin.json
index 9825f6e29ab9..528371275bfc 100644
--- a/pkgs/by-name/ru/rure/pin.json
+++ b/pkgs/by-name/ru/rure/pin.json
@@ -1,5 +1,5 @@
 {
   "pname": "rure",
   "version": "0.2.2",
-  "hash": "sha256-BuTFOTmWrtGXNl5X0Nx+b7XdKnMN5XdowOy5rNBKTFg="
+  "hash": "sha256:0n2c9b8arfgcq1l7gr8dfcmdvdbggvfd0msy6sbx3bln74wwbr06"
 }
diff --git a/pkgs/by-name/ru/rure/update.sh b/pkgs/by-name/ru/rure/update.sh
index d9a31cf68a80..4ee38a3d57b5 100755
--- a/pkgs/by-name/ru/rure/update.sh
+++ b/pkgs/by-name/ru/rure/update.sh
@@ -27,7 +27,7 @@ cat > pin.json <<EOF
 {
   "pname": "$crate",
   "version": "$version",
-  "hash": "$(nix hash to-sri --type sha256 "$(printf '%s' "$prefetch" | head -n1)")"
+  "hash": "sha256:$(printf '%s' "$prefetch" | head -n1)"
 }
 EOF
 
diff --git a/pkgs/by-name/sn/snipe-it/package.nix b/pkgs/by-name/sn/snipe-it/package.nix
index 26674a859f2d..23b5928f1888 100644
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.0.4";
+  version = "8.1.0";
 
   src = fetchFromGitHub {
-    owner = "snipe";
+    owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iS9PfWZlwWfxMkCJS7Lbp2+XxoGJz2yedn4nsu34YhU=";
+    hash = "sha256-/yIuoyHkONv94J+MOeahVDXhHbwW1scfwNqcO3NaDwA=";
   };
 
-  vendorHash = "sha256-6lNNwktcWU5FlzSPl1G4TW8OGMzLbWeVebNOvuYx9ls=";
+  vendorHash = "sha256-+TGloF4V/r9lgO5itk2MnQNj3Fsgq8cwUB5zbA1ZQWM=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"
diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index e88fb4197c99..ff5fd7d770a7 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.26";
+  version = "1.0.27";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-sSfiFK1CHuhM1vdZ5rBv1SZsEctvLc8xP+GYwnEdezI=";
+    hash = "sha256-R4SnH84uagweU6ne4LE1D0Xpb9PVUvJT+zrH44jU3qA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix
index be929ce90544..59af61c628df 100644
--- a/pkgs/by-name/wi/witness/package.nix
+++ b/pkgs/by-name/wi/witness/package.nix
@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "witness";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "in-toto";
     repo = "witness";
     rev = "v${version}";
-    sha256 = "sha256-taTK/b3HA18UPyi3zxGWBG6Wy4XtHcfTaA8NiYZaPA0=";
+    sha256 = "sha256-+/GRG9YW/InQd76ZgsZf3nRVwk9zGrCeY0XGlk7QgCM=";
   };
-  vendorHash = "sha256-3/vn+rWVbljkPksiNXoTU0volV3xwxunMwCV9w9fAWo=";
+  vendorHash = "sha256-teutgu/u37U4qDWT0tnOkAOCnfroavt5BkC3fxhXg18=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
index 64220e3c483a..533b5d89bf41 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-termfilechooser";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "hunkyburrito";
     repo = "xdg-desktop-portal-termfilechooser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uwUND1K0UCztDS68APZf578zhvVm0BhL3f7dLrdKTHE=";
+    hash = "sha256-o2FBPSJrcyAz6bJKQukj6Y5ikGpFuH1Un1qwX4w73os=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index e6aedacd4ebd..00ac892e98f0 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -2,245 +2,165 @@
   stdenv,
   lib,
   fetchurl,
-  pipewire,
-  makeWrapper,
-  xar,
-  cpio,
-  # Dynamic libraries
-  alsa-lib,
-  atk,
-  at-spi2-atk,
-  at-spi2-core,
-  cairo,
-  cups,
-  dbus,
-  expat,
-  libdrm,
-  libGL,
-  fontconfig,
-  freetype,
-  gtk3,
-  gdk-pixbuf,
-  glib,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  wayland,
-  xorg,
-  libxkbcommon,
-  udev,
-  zlib,
-  libkrb5,
-  # Runtime
-  coreutils,
-  pciutils,
-  procps,
-  util-linux,
   pulseaudioSupport ? true,
-  libpulseaudio,
-  pulseaudio,
+  xdgDesktopPortalSupport ? true,
   callPackage,
+  buildFHSEnv,
 }:
 
 let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";
+  unpacked = stdenv.mkDerivation (finalAttrs: {
+    pname = "zoom";
+    version = "6.4.6.1370";
 
-  # Zoom versions are released at different times for each platform
-  # and often with different versions. We write them on three lines
-  # like this (rather than using {}) so that the updater script can
-  # find where to edit them.
-  versions.aarch64-darwin = "6.3.11.50104";
-  versions.x86_64-darwin = "6.3.11.50104";
-  versions.x86_64-linux = "6.3.11.7212";
-
-  srcs = {
-    aarch64-darwin = fetchurl {
-      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
-      name = "zoomusInstallerFull.pkg";
-      hash = "sha256-RZVBq2TQcPs+8wx3YwwISVgaPvxS8hP93vxbJMpEhT0=";
+    src = fetchurl {
+      url = "https://zoom.us/client/${finalAttrs.version}/zoom_x86_64.pkg.tar.xz";
+      hash = "sha256-Y+8garSqDcKLCVv1cTiqGEfrGKpK3UoXIq8X4E8CF+8=";
     };
-    x86_64-darwin = fetchurl {
-      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-OwHVqQZVIQlasehX6UTD1fg1YZDAtvBZSdPq2Ze2JTA=";
-    };
-    x86_64-linux = fetchurl {
-      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-wSXb2v2qXoLXctmjOZpL0SiOP8+ySwpTDpJmPrfQQco=";
-    };
-  };
 
-  libs = lib.makeLibraryPath (
-    [
-      # $ LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH:$PWD ldd zoom | grep 'not found'
-      alsa-lib
-      atk
-      at-spi2-atk
-      at-spi2-core
-      cairo
-      cups
-      dbus
-      expat
-      libdrm
-      libGL
-      pipewire
-      fontconfig
-      freetype
-      gtk3
-      gdk-pixbuf
-      glib
-      libgbm
-      nspr
-      nss
-      pango
-      stdenv.cc.cc
-      wayland
-      xorg.libX11
-      xorg.libxcb
-      xorg.libXcomposite
-      xorg.libXdamage
-      xorg.libXext
-      libxkbcommon
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libxshmfence
-      xorg.xcbutilimage
-      xorg.xcbutilkeysyms
-      xorg.xcbutilrenderutil
-      xorg.xcbutilwm
-      xorg.libXfixes
-      xorg.libXtst
-      udev
-      zlib
-      libkrb5
-    ]
-    ++ lib.optional (pulseaudioSupport) libpulseaudio
-  );
+    dontUnpack = true;
 
-  binPath = lib.makeBinPath (
-    [
-      coreutils
-      glib.dev
-      pciutils
-      pipewire
-      procps
-      util-linux
-    ]
-    ++ lib.optional pulseaudioSupport pulseaudio
-  );
-in
-stdenv.mkDerivation {
-  pname = "zoom";
-  version = versions.${system} or throwSystem;
+    # Note: In order to uncover missing libraries,
+    # add "pkgs" to this file's arguments
+    # (at the top of this file), then add these attributes here:
+    # > buildInputs = linuxGetDependencies pkgs;
+    # > dontAutoPatchelf = true;
+    # > dontWrapQtApps = true;
+    # > nativeBuildInputs = [ pkgs.autoPatchelfHook ];
+    # > preFixup = ''
+    # >   addAutoPatchelfSearchPath $out/opt/zoom
+    # >   autoPatchelf $out/opt/zoom/{cef,Qt,*.so*,aomhost,zoom,zopen,ZoomLauncher,ZoomWebviewHost}
+    # > '';
+    # Then build `zoom-us.unpacked`:
+    # `autoPatchelfHook` will report missing library files.
 
-  src = srcs.${system} or throwSystem;
-
-  dontUnpack = stdenv.hostPlatform.isLinux;
-  unpackPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    xar -xf $src
-    zcat < zoomus.pkg/Payload | cpio -i
-  '';
-
-  nativeBuildInputs =
-    [
-      makeWrapper
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xar
-      cpio
-    ];
-
-  installPhase = ''
-    runHook preInstall
-    ${
-      rec {
-        aarch64-darwin = ''
-          mkdir -p $out/Applications
-          cp -R zoom.us.app $out/Applications/
-        '';
-        # darwin steps same on both architectures
-        x86_64-darwin = aarch64-darwin;
-        x86_64-linux = ''
-          mkdir $out
-          tar -C $out -xf $src
-          mv $out/usr/* $out/
-        '';
-      }
-      .${system} or throwSystem
-    }
-    runHook postInstall
-  '';
-
-  postFixup =
-    lib.optionalString stdenv.hostPlatform.isDarwin ''
-      makeWrapper $out/Applications/zoom.us.app/Contents/MacOS/zoom.us $out/bin/zoom
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      # Desktop File
-      substituteInPlace $out/share/applications/Zoom.desktop \
-          --replace-fail "Exec=/usr/bin/zoom" "Exec=$out/bin/zoom"
-
-      for i in aomhost zopen ZoomLauncher ZoomWebviewHost; do
-        if [ -f $out/opt/zoom/$i ]; then
-          patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/zoom/$i
-        fi
-      done
-
-      # ZoomLauncher sets LD_LIBRARY_PATH before execing zoom
-      # IPC breaks if the executable name does not end in 'zoom'
-      # zoom binary does not like being touched by patchelf
-      #   => we call it indirectly via the dynamic linker
-      # zoom binary inspects /proc/self/exe to find its data files
-      #   => we must place a copy (not symlink) of the linker in zoom's data dir
-      mv $out/opt/zoom/zoom $out/opt/zoom/.zoom
-      cp "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/zoom/ld.so
-      makeWrapper $out/opt/zoom/ld.so $out/opt/zoom/zoom \
-        --add-flags $out/opt/zoom/.zoom \
-        --prefix LD_LIBRARY_PATH ":" ${libs}
-
-      rm $out/bin/zoom
-      # Zoom expects "zopen" executable (needed for web login) to be present in CWD. Or does it expect
-      # everybody runs Zoom only after cd to Zoom package directory? Anyway, :facepalm:
-      # Clear Qt paths to prevent tripping over "foreign" Qt resources.
-      # Clear Qt screen scaling settings to prevent over-scaling.
-      makeWrapper $out/opt/zoom/ZoomLauncher $out/bin/zoom \
-        --chdir "$out/opt/zoom" \
-        --unset QML2_IMPORT_PATH \
-        --unset QT_PLUGIN_PATH \
-        --unset QT_SCREEN_SCALE_FACTORS \
-        --prefix PATH : ${binPath} \
-        --prefix LD_LIBRARY_PATH ":" ${libs}
-
-      if [ -f $out/opt/zoom/ZoomWebviewHost ]; then
-        wrapProgram $out/opt/zoom/ZoomWebviewHost \
-          --unset QML2_IMPORT_PATH \
-          --unset QT_PLUGIN_PATH \
-          --unset QT_SCREEN_SCALE_FACTORS \
-          --prefix LD_LIBRARY_PATH ":" ${libs}
-      fi
-
-      # Backwards compatibility: we used to call it zoom-us
-      ln -s $out/bin/{zoom,zoom-us}
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      tar -C $out -xf $src
+      mv $out/usr/* $out/
+      runHook postInstall
     '';
 
-  # already done
-  dontPatchELF = true;
+    dontPatchELF = true;
 
-  passthru.updateScript = ./update.sh;
-  passthru.tests.startwindow = callPackage ./test.nix { };
+    passthru.updateScript = ./update.sh;
+    passthru.tests.startwindow = callPackage ./test.nix { };
 
-  meta = with lib; {
-    homepage = "https://zoom.us/";
-    changelog = "https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061222";
-    description = "zoom.us video conferencing application";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    platforms = builtins.attrNames srcs;
-    maintainers = with maintainers; [
-      danbst
-      tadfisher
+    meta = {
+      homepage = "https://zoom.us/";
+      changelog = "https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061222";
+      description = "zoom.us video conferencing application";
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      license = lib.licenses.unfree;
+      platforms = [ "x86_64-linux" ];
+      maintainers = with lib.maintainers; [
+        danbst
+        tadfisher
+      ];
+    };
+  });
+
+  linuxGetDependencies =
+    pkgs:
+    [
+      pkgs.alsa-lib
+      pkgs.at-spi2-atk
+      pkgs.at-spi2-core
+      pkgs.atk
+      pkgs.cairo
+      pkgs.coreutils
+      pkgs.cups
+      pkgs.dbus
+      pkgs.expat
+      pkgs.fontconfig
+      pkgs.freetype
+      pkgs.gdk-pixbuf
+      pkgs.glib
+      pkgs.glib.dev
+      pkgs.gtk3
+      pkgs.libGL
+      pkgs.libdrm
+      pkgs.libgbm
+      pkgs.libkrb5
+      pkgs.libxkbcommon
+      pkgs.nspr
+      pkgs.nss
+      pkgs.pango
+      pkgs.pciutils
+      pkgs.pipewire
+      pkgs.procps
+      pkgs.qt5.qt3d
+      pkgs.qt5.qtgamepad
+      pkgs.qt5.qtlottie
+      pkgs.qt5.qtmultimedia
+      pkgs.qt5.qtremoteobjects
+      pkgs.qt5.qtxmlpatterns
+      pkgs.stdenv.cc.cc
+      pkgs.udev
+      pkgs.util-linux
+      pkgs.wayland
+      pkgs.xorg.libX11
+      pkgs.xorg.libXcomposite
+      pkgs.xorg.libXdamage
+      pkgs.xorg.libXext
+      pkgs.xorg.libXfixes
+      pkgs.xorg.libXrandr
+      pkgs.xorg.libXrender
+      pkgs.xorg.libXtst
+      pkgs.xorg.libxcb
+      pkgs.xorg.libxshmfence
+      pkgs.xorg.xcbutilimage
+      pkgs.xorg.xcbutilkeysyms
+      pkgs.xorg.xcbutilrenderutil
+      pkgs.xorg.xcbutilwm
+      pkgs.zlib
+    ]
+    ++ lib.optionals pulseaudioSupport [
+      pkgs.libpulseaudio
+      pkgs.pulseaudio
+    ]
+    ++ lib.optionals xdgDesktopPortalSupport [
+      pkgs.kdePackages.xdg-desktop-portal-kde
+      pkgs.lxqt.xdg-desktop-portal-lxqt
+      pkgs.plasma5Packages.xdg-desktop-portal-kde
+      pkgs.xdg-desktop-portal
+      pkgs.xdg-desktop-portal-gnome
+      pkgs.xdg-desktop-portal-gtk
+      pkgs.xdg-desktop-portal-hyprland
+      pkgs.xdg-desktop-portal-wlr
+      pkgs.xdg-desktop-portal-xapp
     ];
-    mainProgram = "zoom";
+
+in
+
+# We add the `unpacked` zoom archive to the FHS env
+# and also bind-mount its `/opt` directory.
+# This should assist Zoom in finding all its
+# files in the places where it expects them to be.
+buildFHSEnv rec {
+  pname = "zoom"; # Will also be the program's name!
+  inherit (unpacked) version;
+
+  targetPkgs = pkgs: (linuxGetDependencies pkgs) ++ [ unpacked ];
+  extraPreBwrapCmds = "unset QT_PLUGIN_PATH";
+  extraBwrapArgs = [ "--ro-bind ${unpacked}/opt /opt" ];
+  runScript = "/opt/zoom/ZoomLauncher";
+
+  extraInstallCommands = ''
+    cp -Rt $out/ ${unpacked}/share
+    substituteInPlace \
+        $out/share/applications/Zoom.desktop \
+        --replace-fail Exec={/usr/bin/,}zoom
+
+    # Backwards compatibility: we used to call it zoom-us
+    ln -s $out/bin/{zoom,zoom-us}
+  '';
+
+  passthru = unpacked.passthru // {
+    inherit unpacked;
+  };
+  meta = unpacked.meta // {
+    mainProgram = pname;
   };
 }
diff --git a/pkgs/by-name/zo/zoom-us/test.nix b/pkgs/by-name/zo/zoom-us/test.nix
index 98ededc27563..ecfc2170f91c 100644
--- a/pkgs/by-name/zo/zoom-us/test.nix
+++ b/pkgs/by-name/zo/zoom-us/test.nix
@@ -22,7 +22,7 @@ let
             | tee window-names
         grep -q "Zoom Workplace" window-names
       }
-      # don't let zoom eat all RAM, like it did
+      # Don't let zoom eat all RAM, like it did, cf.
       # https://github.com/NixOS/nixpkgs/issues/371488
       prlimit --{as,data}=$((4*2**30)):$((4*2**30)) zoom-us &
       for _ in {0..900} ; do
@@ -31,8 +31,8 @@ let
         fi
         sleep 1
       done
-      # if libraries are missing, the window still appears,
-      # but disappears again immediatelly; check for that too:
+      # If libraries are missing, the window still appears,
+      # but then disappears again immediately; check for that also.
       sleep 20
       is_zoom_window_present
     '';
diff --git a/pkgs/by-name/zo/zoom-us/update.sh b/pkgs/by-name/zo/zoom-us/update.sh
index df27da6f3ba4..16d1e8f4fca0 100755
--- a/pkgs/by-name/zo/zoom-us/update.sh
+++ b/pkgs/by-name/zo/zoom-us/update.sh
@@ -3,32 +3,4 @@
 
 set -eu -o pipefail
 
-scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
-nixpkgs=$(realpath "$scriptDir"/../../../..)
-
-echo >&2 "=== Obtaining version data from https://zoom.us/rest/download ..."
-linux_data=$(curl -Ls 'https://zoom.us/rest/download?os=linux' | jq .result.downloadVO)
-mac_data=$(curl -Ls 'https://zoom.us/rest/download?os=mac' | jq .result.downloadVO)
-
-version_aarch64_darwin=$(jq -r .zoomArm64.version <<<"$mac_data")
-version_x86_64_darwin=$(jq -r .zoom.version <<<"$mac_data")
-version_x86_64_linux=$(jq -r .zoom.version <<<"$linux_data")
-
-echo >&2 "=== Downloading packages and computing hashes..."
-# We precalculate the hashes before calling update-source-version
-# because it attempts to calculate each architecture's package's hash
-# by running `nix-build --system <architecture> -A zoom-us.src` which
-# causes cross compiling headaches; using nix-prefetch-url with
-# hard-coded URLs is simpler.  Keep these URLs in sync with the ones
-# in package.nix where `srcs` is defined.
-hash_aarch64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_aarch64_darwin}/zoomusInstallerFull.pkg?archType=arm64"))
-hash_x86_64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_darwin}/zoomusInstallerFull.pkg"))
-hash_x86_64_linux=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_linux}/zoom_x86_64.pkg.tar.xz"))
-
-echo >&2 "=== Updating package.nix ..."
-# update-source-version expects to be at the root of nixpkgs
-(cd "$nixpkgs" && update-source-version zoom-us "$version_aarch64_darwin" $hash_aarch64_darwin --system=aarch64-darwin --version-key=versions.aarch64-darwin)
-(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_darwin" $hash_x86_64_darwin --system=x86_64-darwin --version-key=versions.x86_64-darwin)
-(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_linux" $hash_x86_64_linux --system=x86_64-linux --version-key=versions.x86_64-linux)
-
-echo >&2 "=== Done!"
+update-source-version zoom-us $(curl -Ls 'https://zoom.us/rest/download?os=linux' | jq -r .result.downloadVO.zoom.version) --source-key=unpacked.src
diff --git a/pkgs/development/python-modules/blis/default.nix b/pkgs/development/python-modules/blis/default.nix
index c17823eb0717..0aabdaea5196 100644
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "blis";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "cython-blis";
     tag = "release-v${version}";
-    hash = "sha256-krUqAEPxJXdlolSbV5R0ZqrWaFuXh7IxSeFTsCr6iss=";
+    hash = "sha256-mSIfFjnLhPLqSNLHMS5gTeAmqmNfXpcbyH7ejv4YgQU=";
   };
 
   build-system = [
@@ -79,7 +79,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/explosion/cython-blis/releases/tag/release-${version}";
+    changelog = "https://github.com/explosion/cython-blis/releases/tag/release-v${version}";
     description = "BLAS-like linear algebra library";
     homepage = "https://github.com/explosion/cython-blis";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/clarifai-grpc/default.nix b/pkgs/development/python-modules/clarifai-grpc/default.nix
index 7d5978086c55..729e8e796714 100644
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "11.3.2";
+  version = "11.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python-grpc";
     tag = version;
-    hash = "sha256-Q5xOhvi50sp1+TPdjY3hqVK1nbUuOV4w4WPXtg6ueYk=";
+    hash = "sha256-alBlYWQ75l7vX/XK6QFSSb+g7efUM9Zz1bgROgEgKUw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/databricks-sql-connector/default.nix b/pkgs/development/python-modules/databricks-sql-connector/default.nix
index 2cc4e91fb962..17f5c0f6472b 100644
--- a/pkgs/development/python-modules/databricks-sql-connector/default.nix
+++ b/pkgs/development/python-modules/databricks-sql-connector/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-sql-connector";
-  version = "4.0.2";
+  version = "4.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = "databricks-sql-python";
     tag = "v${version}";
-    hash = "sha256-zrEbenakeaFd6/DkmtHDjw9zgl6FxEXmBGTT7pFvUVU=";
+    hash = "sha256-9+U5XOlvPQF6fLkT6/bgjSqSlGj0995mNVH0PCGQEYE=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/manimgl/default.nix b/pkgs/development/python-modules/manimgl/default.nix
new file mode 100644
index 000000000000..5eb569e2452d
--- /dev/null
+++ b/pkgs/development/python-modules/manimgl/default.nix
@@ -0,0 +1,246 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  texliveInfraOnly,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  addict,
+  appdirs,
+  colour,
+  diskcache,
+  fonttools,
+  ipython,
+  isosurfaces,
+  manimpango,
+  mapbox-earcut,
+  matplotlib,
+  moderngl,
+  moderngl-window,
+  numpy,
+  pillow,
+  pydub,
+  pygments,
+  pyopengl,
+  pyperclip,
+  pyyaml,
+  rich,
+  scipy,
+  screeninfo,
+  skia-pathops,
+  svgelements,
+  sympy,
+  tqdm,
+  typing-extensions,
+  validators,
+
+  # tests
+  ffmpeg,
+}:
+
+let
+  # This is a list of all LaTeX packages used by manimgl according to manimlib/tex_templates.yml
+  manim-tinytex = texliveInfraOnly.withPackages (
+    ps: with ps; [
+
+      # tinytex
+      amsfonts
+      amsmath
+      atbegshi
+      atveryend
+      auxhook
+      babel
+      bibtex
+      bigintcalc
+      bitset
+      booktabs
+      cm
+      dehyph
+      dvipdfmx
+      dvips
+      ec
+      epstopdf-pkg
+      etex
+      etexcmds
+      etoolbox
+      euenc
+      everyshi
+      fancyvrb
+      filehook
+      firstaid
+      float
+      fontspec
+      framed
+      geometry
+      gettitlestring
+      glyphlist
+      graphics
+      graphics-cfg
+      graphics-def
+      grffile
+      helvetic
+      hycolor
+      hyperref
+      hyph-utf8
+      iftex
+      inconsolata
+      infwarerr
+      intcalc
+      knuth-lib
+      kvdefinekeys
+      kvoptions
+      kvsetkeys
+      l3backend
+      l3kernel
+      l3packages
+      latex
+      latex-amsmath-dev
+      latex-bin
+      latex-fonts
+      latex-tools-dev
+      latexconfig
+      latexmk
+      letltxmacro
+      lm
+      lm-math
+      ltxcmds
+      lua-alt-getopt
+      luahbtex
+      lualatex-math
+      lualibs
+      luaotfload
+      luatex
+      mdwtools
+      metafont
+      mfware
+      natbib
+      pdfescape
+      pdftex
+      pdftexcmds
+      plain
+      psnfss
+      refcount
+      rerunfilecheck
+      stringenc
+      tex
+      tex-ini-files
+      times
+      tipa
+      tools
+      unicode-data
+      unicode-math
+      uniquecounter
+      url
+      xcolor
+      xetex
+      xetexconfig
+      xkeyval
+      xunicode
+      zapfding
+
+      # manim-latex
+      standalone
+      everysel
+      preview
+      doublestroke
+      setspace
+      rsfs
+      relsize
+      ragged2e
+      fundus-calligra
+      microtype
+      wasysym
+      physics
+      dvisvgm
+      jknapltx
+      wasy
+      cm-super
+      babel-english
+      gnu-freefont
+      mathastext
+      cbfonts-fd
+    ]
+  );
+in
+buildPythonPackage {
+  pname = "manimgl";
+  pyproject = true;
+  version = "1.7.2";
+
+  # Using hash rev because the tarball for the tag v1.7.2 gives the source to 1.7.1
+  src = fetchFromGitHub {
+    owner = "3b1b";
+    repo = "manim";
+    rev = "0c69ab6a32d4193f03ba9a604278eb3ce9699518";
+    hash = "sha256-mh55R0uTuPz86+dJNlHcgJP1KWXoBYi2p8NUCnu4gEo=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    addict
+    appdirs
+    colour
+    diskcache
+    fonttools
+    ipython
+    isosurfaces
+    manimpango
+    mapbox-earcut
+    matplotlib
+    moderngl
+    moderngl-window
+    numpy
+    pillow
+    pydub
+    pygments
+    pyopengl
+    pyperclip
+    pyyaml
+    rich
+    setuptools
+    scipy
+    screeninfo
+    skia-pathops
+    svgelements
+    sympy
+    tqdm
+    typing-extensions
+    validators
+  ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      ffmpeg
+      manim-tinytex
+    ])
+  ];
+
+  doCheck = false;
+
+  meta = {
+    description = "Animation engine for explanatory math videos";
+    longDescription = ''
+      Manim is an engine for precise programmatic animations, designed for creating
+      explanatory math videos, as seen in the videos of 3Blue1Brown on Youtube.
+      This is the original version that is maintained by Grant Sanderson which is
+      based on OpenGL.
+    '';
+    changelog = "https://3b1b.github.io/manim/development/changelog.html";
+    homepage = "https://github.com/3b1b/manim";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      L0L1P0P
+      osbm
+    ];
+    mainProgram = "manimgl";
+  };
+}
diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index 492b3fe8c007..dbe29f233da1 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.22";
+  version = "0.3.23";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${version}";
-    hash = "sha256-2+fA9hw7dIbWOzP5fX7j7dlAhW8L55mKXG3hUhnCSdw=";
+    hash = "sha256-UhIimbD+Nx2v/W+A0y2L4a/iYFGF+PH59wCqW2Q4ioQ=";
   };
 
   build-system = [ setuptools ];
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python Library for writing distributed self-replicating programs";
     homepage = "https://github.com/mitogen-hq/mitogen";
-    changelog = "https://github.com/mitogen-hq/mitogen/blob/v${version}/docs/changelog.rst";
+    changelog = "https://github.com/mitogen-hq/mitogen/blob/${src.tag}/docs/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index a7d252500b69..32362feb636c 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.7.3";
+  version = "1.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-VnL8rCSpNEs0NnghhgSO4k1Q+yqP5LCMZirC/hLZRO4=";
+    hash = "sha256-0Xfy1HKaVraEjhB6CS6V+EkU5gmKr6SQse+p7l1x8d8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix
index 3f14d0c60b46..02ceff2c6dc9 100644
--- a/pkgs/development/python-modules/sagemaker-core/default.nix
+++ b/pkgs/development/python-modules/sagemaker-core/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker-core";
-  version = "1.0.28";
+  version = "1.0.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-core";
     tag = "v${version}";
-    hash = "sha256-RxkwBr+Xq5vIrcLnJsoJ8FYX1Kj5YK7sSFx//9YA5VU=";
+    hash = "sha256-m/gxOnQmYhNjAMM5DG3DzllWcWmfjD3B0NRY+wyGVP8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scrap-engine/default.nix b/pkgs/development/python-modules/scrap-engine/default.nix
index 2583c637f7a8..933cde187234 100644
--- a/pkgs/development/python-modules/scrap-engine/default.nix
+++ b/pkgs/development/python-modules/scrap-engine/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "scrap-engine";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "scrap_engine";
     inherit version;
-    hash = "sha256-9jiStwFD5vhPSxWsEVmHOvfRgNgVOUvlzAa1Rmf+faE=";
+    hash = "sha256-dNMOS8vYTMsIu28PLt2jhHjL+fSUgdb91V2HsKAjxOo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 656079d0d43f..39538231dbe3 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -204,7 +204,9 @@ buildPythonPackage rec {
     "test_auto_session_tracking_with_aggregates"
     # timing sensitive
     "test_profile_captured"
-    "test_continuous_profiler_manual_start_and_stop"
+    "test_continuous_profiler_auto"
+    "test_continuous_profiler_manual"
+    "test_stacktrace_big_recursion"
     # assert ('socks' in "<class 'httpcore.connectionpool'>") == True
     "test_socks_proxy"
     # requires socksio to mock, but that crashes pytest-forked
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 8e7d420db04d..47b370605a2b 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1366";
+  version = "3.0.1367";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-wfFGrqku03a/9mvemBOQELIBxw27ys06906C/4/6fvA=";
+    hash = "sha256-DY//LYVzL1gCqp++yk6R1O9HBa8Df8x3q980bDTvGWA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tree-sitter-grammars/default.nix b/pkgs/development/python-modules/tree-sitter-grammars/default.nix
index a8ea305dc2ae..d87ded63867c 100644
--- a/pkgs/development/python-modules/tree-sitter-grammars/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-grammars/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   pytestCheckHook,
   tree-sitter,
@@ -132,6 +133,10 @@ buildPythonPackage {
     ];
   };
 
+  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${grammarDrv}"
+  '';
+
   preCheck = ''
     # https://github.com/NixOS/nixpkgs/issues/255262
     rm -r ${snakeCaseName}
diff --git a/pkgs/development/python-modules/ttkbootstrap/default.nix b/pkgs/development/python-modules/ttkbootstrap/default.nix
index 58066bf65318..11316094e9ee 100644
--- a/pkgs/development/python-modules/ttkbootstrap/default.nix
+++ b/pkgs/development/python-modules/ttkbootstrap/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "ttkbootstrap";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "israel-dryer";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-YvBVhohkz75JRjawquOyeI5ikUv81JwumTGCA4DT6KY=";
+    hash = "sha256-Pkp45lB1Xeu9ZoLjKS8aSW2By/k3ID1qwMig/jdYHh4=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
index b6dad1d370bd..1fe65f570857 100644
--- a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "jmcollin78";
   domain = "versatile_thermostat";
-  version = "7.2.9";
+  version = "7.2.10";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = "refs/tags/${version}";
-    hash = "sha256-dnCiB/IRk+FjZKTdXid6eheyml8eOUWMgYaS+JuJGV0=";
+    hash = "sha256-cg2FinRkQ8jNUNah+CovbNAE3uHpnrZAkmDJtl62VLY=";
   };
 
   passthru.updateScript = gitUpdater { ignoredVersions = "(Alpha|Beta|alpha|beta).*"; };
diff --git a/pkgs/tools/networking/octodns/default.nix b/pkgs/tools/networking/octodns/default.nix
index d59389f8b273..8593326ddfe2 100644
--- a/pkgs/tools/networking/octodns/default.nix
+++ b/pkgs/tools/networking/octodns/default.nix
@@ -74,6 +74,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/octodns/octodns";
     changelog = "https://github.com/octodns/octodns/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = [ maintainers.anthonyroussel ];
+    maintainers = teams.octodns.members;
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/bind/package.nix b/pkgs/tools/networking/octodns/providers/bind/package.nix
index 6d9ddd5afdc6..f61d1e276b8c 100644
--- a/pkgs/tools/networking/octodns/providers/bind/package.nix
+++ b/pkgs/tools/networking/octodns/providers/bind/package.nix
@@ -45,6 +45,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-bind";
     changelog = "https://github.com/octodns/octodns-bind/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = teams.octodns.members;
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/cloudflare/package.nix b/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
index 11e924e57a10..9dbd63e272d5 100644
--- a/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
+++ b/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
@@ -43,6 +43,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-cloudflare/";
     changelog = "https://github.com/octodns/octodns-cloudflare/blob/${version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ret2pop ];
+    maintainers = lib.teams.octodns.members ++ [ lib.maintainers.ret2pop ];
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/ddns/package.nix b/pkgs/tools/networking/octodns/providers/ddns/package.nix
index d03bf30653b8..084e96636c20 100644
--- a/pkgs/tools/networking/octodns/providers/ddns/package.nix
+++ b/pkgs/tools/networking/octodns/providers/ddns/package.nix
@@ -48,6 +48,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-ddns";
     changelog = "https://github.com/octodns/octodns-ddns/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.provokateurin ];
+    maintainers = lib.teams.octodns.members ++ [ lib.maintainers.provokateurin ];
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/gandi/package.nix b/pkgs/tools/networking/octodns/providers/gandi/package.nix
index 1c5fb133443d..fd9959efec7d 100644
--- a/pkgs/tools/networking/octodns/providers/gandi/package.nix
+++ b/pkgs/tools/networking/octodns/providers/gandi/package.nix
@@ -45,6 +45,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-gandi";
     changelog = "https://github.com/octodns/octodns-gandi/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ onny ];
+    maintainers = teams.octodns.members ++ [ maintainers.onny ];
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/hetzner/package.nix b/pkgs/tools/networking/octodns/providers/hetzner/package.nix
index e33451922fef..003af5b528f9 100644
--- a/pkgs/tools/networking/octodns/providers/hetzner/package.nix
+++ b/pkgs/tools/networking/octodns/providers/hetzner/package.nix
@@ -46,6 +46,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-hetzner/";
     changelog = "https://github.com/octodns/octodns-hetzner/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = teams.octodns.members;
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/powerdns/package.nix b/pkgs/tools/networking/octodns/providers/powerdns/package.nix
index 844b902bfd0a..aeb8c6abe8db 100644
--- a/pkgs/tools/networking/octodns/providers/powerdns/package.nix
+++ b/pkgs/tools/networking/octodns/providers/powerdns/package.nix
@@ -47,6 +47,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-powerdns/";
     changelog = "https://github.com/octodns/octodns-powerdns/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = teams.octodns.members;
   };
 }
diff --git a/pkgs/tools/networking/octodns/providers/transip/package.nix b/pkgs/tools/networking/octodns/providers/transip/package.nix
index 70557d0ae799..6fdd6fa64732 100644
--- a/pkgs/tools/networking/octodns/providers/transip/package.nix
+++ b/pkgs/tools/networking/octodns/providers/transip/package.nix
@@ -43,6 +43,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/octodns/octodns-transip";
     changelog = "https://github.com/octodns/octodns-transip/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.provokateurin ];
+    maintainers = lib.teams.octodns.members ++ [ lib.maintainers.provokateurin ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c2d40e5cca43..29bfa8334d60 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2349,10 +2349,6 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  grype = callPackage ../by-name/gr/grype/package.nix {
-    buildGoModule = buildGo123Module;
-  };
-
   hocr-tools = with python3Packages; toPythonApplication hocr-tools;
 
   hopper = qt5.callPackage ../development/tools/analysis/hopper { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 36a3f5d30d93..c4924cb7d020 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8404,6 +8404,8 @@ self: super: with self; {
 
   manim-slides = callPackage ../development/python-modules/manim-slides { };
 
+  manimgl = callPackage ../development/python-modules/manimgl { };
+
   manimpango = callPackage ../development/python-modules/manimpango { };
 
   manuel = callPackage ../development/python-modules/manuel { };