diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8ff34fe8e3683..d27d315bc71ab 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21301,6 +21301,12 @@
     matrix = "@pschmitt:one.ems.host";
     keys = [ { fingerprint = "9FBF 2ABF FB37 F7F3 F502  44E5 DC43 9C47 EACB 17F9"; } ];
   };
+  pseudocc = {
+    email = "pseudoc@163.com";
+    github = "pseudocc";
+    githubId = 85104110;
+    name = "Atlas Yu";
+  };
   pshirshov = {
     email = "pshirshov@eml.cc";
     github = "pshirshov";
diff --git a/nixos/modules/config/nsswitch.nix b/nixos/modules/config/nsswitch.nix
index 354c506e0ae89..797d2422e27c0 100644
--- a/nixos/modules/config/nsswitch.nix
+++ b/nixos/modules/config/nsswitch.nix
@@ -97,6 +97,30 @@
         '';
         default = [ ];
       };
+
+      subuid = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          List of subuid entries to configure in {file}`/etc/nsswitch.conf`.
+
+          Note that "files" is always prepended.
+
+          This option only takes effect if nscd is enabled.
+        '';
+        default = [ ];
+      };
+
+      subgid = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          List of subgid entries to configure in {file}`/etc/nsswitch.conf`.
+
+          Note that "files" is always prepended.
+
+          This option only takes effect if nscd is enabled.
+        '';
+        default = [ ];
+      };
     };
   };
 
@@ -133,6 +157,9 @@
       services:  ${lib.concatStringsSep " " config.system.nssDatabases.services}
       protocols: files
       rpc:       files
+
+      subuid:    ${lib.concatStringsSep " " config.system.nssDatabases.subuid}
+      subgid:    ${lib.concatStringsSep " " config.system.nssDatabases.subgid}
     '';
 
     system.nssDatabases = {
@@ -145,6 +172,8 @@
         (lib.mkOrder 1499 [ "dns" ])
       ];
       services = lib.mkBefore [ "files" ];
+      subuid = lib.mkBefore [ "files" ];
+      subgid = lib.mkBefore [ "files" ];
     };
   };
 }
diff --git a/nixos/modules/hardware/cpu/intel-npu.nix b/nixos/modules/hardware/cpu/intel-npu.nix
new file mode 100644
index 0000000000000..a384708e35447
--- /dev/null
+++ b/nixos/modules/hardware/cpu/intel-npu.nix
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.hardware.cpu.intel.npu;
+in
+{
+  options = {
+    hardware.cpu.intel.npu = {
+      enable = lib.mkEnableOption "Intel NPU support";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.intel-npu-driver.validation
+      pkgs.level-zero
+    ];
+
+    hardware = {
+      firmware = [ pkgs.intel-npu-driver.firmware ];
+      graphics = {
+        enable = true;
+        extraPackages = [ pkgs.intel-npu-driver ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index f6f99b6218d28..68f6494510cb2 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/x30lnlgk1s16rynrfslbf8phr6h6rqf2-nix-2.31.2";
-  i686-linux = "/nix/store/ix94q6rrdg6cr4893cjpzdbmibhlm0dv-nix-2.31.2";
-  aarch64-linux = "/nix/store/xnybj9lk0kwvmr2va253avanq7m3cpyg-nix-2.31.2";
-  riscv64-linux = "/nix/store/33as1vqp8mq36nr5bb5gr7ziw1nf4q1v-nix-riscv64-unknown-linux-gnu-2.31.2";
-  x86_64-darwin = "/nix/store/b9dvary8rcljj7ajv1x64hwwch4cvyvp-nix-2.31.2";
-  aarch64-darwin = "/nix/store/lvv1j8qbrvlnl3aagcjrhf42d458zgb5-nix-2.31.2";
+  x86_64-linux = "/nix/store/mxn3vxpvk2b42kgd08aw4bn27qhf434w-nix-2.31.3";
+  i686-linux = "/nix/store/b7d35ifww9683l74ydkb0qhrq6lqcisi-nix-2.31.3";
+  aarch64-linux = "/nix/store/ysz7dwmy4zd1zm3wzx5dh9g999xv7pbm-nix-2.31.3";
+  riscv64-linux = "/nix/store/avfv2lqbnphj2ap8y5ihg1l0sqhpjll7-nix-riscv64-unknown-linux-gnu-2.31.3";
+  x86_64-darwin = "/nix/store/s8lcl6nrd5ia7nr4zx9mg720i9f8qm37-nix-2.31.3";
+  aarch64-darwin = "/nix/store/vfjzbcl3kf9jjwh0g2x03cvz2x5hg8py-nix-2.31.3";
 }
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 9397d06e7ae78..bbd0a093b998d 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,6 +205,16 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
+    # Intel NPU driver
+    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
+    if ($vendor eq "0x8086" &&
+        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e"))
+    {
+        push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
+        push @attrs, "hardware.cpu.intel.npu.enable = true;";
+    }
+
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).
     # FIXME: do we want to enable an unfree driver here?
diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix
index b9ed5ff36bf75..0951cc0d262de 100644
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@@ -307,6 +307,7 @@ in
           allowed_uids = lib.concatStringsSep ", " cfg.ifpAllowedUids;
         };
       };
+      subIDsIntegration = true;
     };
 
     networking.timeServers = lib.optional cfg.useAsTimeserver cfg.server;
diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index 05351a040916c..5a4c3a3f45cad 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -93,6 +93,15 @@ in
           Kerberos will be configured to cache credentials in SSS.
         '';
       };
+
+      subIDsIntegration = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to use SSS as a source for subuid and subgid.
+        '';
+      };
+
       environmentFile = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
@@ -246,6 +255,11 @@ in
       services.openssh.authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
       services.openssh.authorizedKeysCommandUser = "nobody";
     })
+
+    (lib.mkIf cfg.subIDsIntegration {
+      system.nssDatabases.subuid = [ "sss" ];
+      system.nssDatabases.subgid = [ "sss" ];
+    })
   ];
 
   meta.maintainers = with lib.maintainers; [ bbigras ];
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index f55bffa67262f..804d858bf078e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-13";
+  version = "7.1.2-18";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-meADRjoV1c48laD35TuWAwuE95L90agROuuKBd++Kn8=";
+    hash = "sha256-bt8PlCeEWaRsdMe/FP4HSgmzi1OATjH2Kx233OgleyI=";
   };
 
   outputs = [
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index c62b5cc27db18..3a50f6771344b 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -136,11 +136,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.1.2";
+  version = "10.1.5";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nXXzMcGly5tuuP2fZPVj7C6rNGyCLLl/izXNgtPxFHk=";
+    hash = "sha256-HxIJtNuC5sRBfq9ufgsHNWNXKgQtn7dJKwhLplqcBpM=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 944e45edac1bc..ae76e7a223f71 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -202,13 +202,32 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
     # the link time chosen objects will be those of runtime linking.
     declare -A rpaths
     for dir in ${libDirs+"${libDirs[@]}"}; do
-        if [[ "$dir" =~ [/.][/.] ]] && dir2=$(readlink -f "$dir"); then
+        # If the path is in the store, do not resolve any symlinks and add it to the rpath.
+        # Resolving symlinks in the store breaks bootstrapping, see issue #454199.
+        # If it is outside the store, resolve symlinks step by step until it falls
+        # into the store or it becomes not a symlink.
+        # Always canonicalize the path before checking it is in the store or not.
+        if dir2=$(realpath -s "$dir"); then
             dir="$dir2"
+        else
+            continue
         fi
+        while [ -z "${rpaths[$dir]:-}" ] && [[ "$dir" != "${NIX_STORE:-}"/* ]] && [ -L "$dir" ]; do
+            if dir2=$(readlink "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+            if dir2=$(realpath -s "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+        done
+        # If the path turns out to be outside the store, we do not add it to rpath.
+        # This typically happens for libraries in /tmp that are later
+        # copied to $out/lib. If not, we're screwed.
         if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
-            # If the path is not in the store, don't add it to the rpath.
-            # This typically happens for libraries in /tmp that are later
-            # copied to $out/lib.  If not, we're screwed.
             continue
         fi
         for path in "$dir"/*; do
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 183b587c42170..eed3675f3186e 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -172,8 +172,12 @@ def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
     return json.loads(output)
 
 
-def try_get_crate_manifest_path_from_mainfest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    metadata = get_manifest_metadata(manifest_path)
+def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
+    try:
+        metadata = get_manifest_metadata(manifest_path)
+    except subprocess.CalledProcessError:
+        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
+        return None
 
     for pkg in metadata["packages"]:
         if pkg["name"] == crate_name:
@@ -183,11 +187,15 @@ def try_get_crate_manifest_path_from_mainfest_path(manifest_path: Path, crate_na
 
 
 def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # in some cases Cargo.toml is not located at the top level, so we also look at subdirectories
-    manifest_paths = tree.glob("**/Cargo.toml")
+    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
+    # and prefer less-nested manifests first.
+    manifest_paths = sorted(
+        tree.glob("**/Cargo.toml"),
+        key=lambda path: (len(path.parts), str(path)),
+    )
 
     for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_mainfest_path(manifest_path, crate_name)
+        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
         if res is not None:
             return res
 
diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index c49ae029d7fa6..0c4a7dd864618 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.18";
+  version = "9.20.21";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-38VGyZCsRRVSnNRcTdmVhisYrootDLKSCOiJal0yUzE=";
+    hash = "sha256-FeG1oifSiQ98ToI6bqAY3nDuLzoOhZy/89gqrYWQ3gM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 8e406e0190f64..e49cc075b43ac 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -86,7 +86,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.18.0";
+  version = "8.19.0";
 
   src = fetchurl {
     urls = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-QN95Fm50qiAUk2XhHuTHmKRq1Xw05PaP0TEA4smpGUY=";
+    hash = "sha256-TrQUiXkNGeGQ16x+GOgoV83Wivj05mspLO1WLTM/Ed8=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 80f5f017a36a5..a8c982f87805e 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.4";
+  version = "2.7.5";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-npyrtFfB4J3pHbJwbYNlZFeSY46zvh+U27IUkwEIasA=";
+    hash = "sha256-EDLf70/xf3BGSCfaooNpsg9lhNEIvDbxerFnbh7dL5E=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix
index 4ebc0e111e617..c6b725df11d2a 100644
--- a/pkgs/by-name/in/inetutils/package.nix
+++ b/pkgs/by-name/in/inetutils/package.nix
@@ -40,6 +40,21 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc.patch";
       hash = "sha256-ws+ed5vb7kVMHEbqK7yj6FUT355pTv2RZEYuXs5M7Io=";
     })
+    (fetchpatch {
+      name = "CVE-2026-28372.patch";
+      url = "https://codeberg.org/inetutils/inetutils/commit/4db2f19f4caac03c7f4da6363c140bd70df31386.patch";
+      excludes = [
+        "NEWS.md"
+        "THANKS"
+      ];
+      hash = "sha256-ASgcaNC+yo3Hth4M32IVbD3jFt8mxcGtLfl+ULNt4Ag=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-32746.patch";
+      url = "https://codeberg.org/inetutils/inetutils/commit/6864598a29b652a6b69a958f5cd1318aa2b258af.patch";
+      excludes = [ "NEWS.md" ];
+      hash = "sha256-gQH4BZG9rkyGtOQjBqItx+fEBda/Wgg9f46VYPV8HLw=";
+    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
new file mode 100644
index 0000000000000..4ea78a1b57759
--- /dev/null
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  udev,
+  openssl,
+  boost,
+  cmake,
+  git,
+  level-zero,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "intel-npu-driver";
+  version = "1.28.0";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-npu-driver";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-aH7npJompKYlyq2RPXHn/lflQ1C/yYcTp2K+6kX/L0w=";
+  };
+
+  buildInputs = [
+    udev
+    openssl
+    boost
+    level-zero
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  outputs = [
+    "out"
+    "validation"
+    "firmware"
+  ];
+
+  postPatch = ''
+    rm -rf third_party/level-zero
+    rm third_party/cmake/level-zero.cmake
+    rm third_party/cmake/FindLevelZero.cmake
+
+    substituteInPlace third_party/yaml-cpp/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required" \
+      "# cmake_minimum_required"
+
+    substituteInPlace third_party/CMakeLists.txt --replace-fail \
+      "include(cmake/level-zero.cmake)" \
+      ""
+    substituteInPlace third_party/level-zero-npu-extensions/ze_graph_ext.h --replace-fail \
+    "#include \"ze_api.h\"" \
+    "#include <level_zero/ze_api.h>"
+
+    substituteInPlace validation/{kmd-test,umd-test}/CMakeLists.txt --replace-fail \
+      "COMPONENT validation-npu" \
+      "DESTINATION $validation/bin COMPONENT validation-npu"
+
+    substituteInPlace firmware/CMakeLists.txt --replace-fail \
+      "DESTINATION /lib/firmware/updates/intel/vpu/" \
+      "DESTINATION $firmware/lib/firmware/intel/vpu/"
+  '';
+
+  installPhase = ''
+    cmake --install . --component level-zero-npu
+    cmake --install . --component validation-npu
+    cmake --install . --component fw-npu
+  '';
+
+  meta = {
+    homepage = "https://github.com/intel/linux-npu-driver";
+    description = "Intel NPU (Neural Processing Unit) Standalone Driver";
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pseudocc ];
+  };
+}
diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index 1cfcfd29c4b78..0c9dfead431d1 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -31,13 +31,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.4";
+  version = "3.8.6";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qNz7BAvi3dTNg6Bz2cfqaYGKFJlM4C+y/GARsQRRYsY=";
+    hash = "sha256-XNFw0h++7B3ODnEi50zd7q/j1bYQzL1IKB2q3p4IzB4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch b/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
new file mode 100644
index 0000000000000..8ca3625e356c9
--- /dev/null
+++ b/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
@@ -0,0 +1,52 @@
+--- a/src/canberra-gtk-module.c
++++ b/src/canberra-gtk-module.c
+@@ -307,6 +307,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), GDK_WINDOW_XID(w),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_WM_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
+@@ -335,6 +340,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), DefaultRootWindow(GDK_DISPLAY_XDISPLAY(d)),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_CURRENT_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
+@@ -365,6 +375,11 @@
+         gboolean ret = FALSE;
+         Atom xembed;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return FALSE;
++#endif
++
+         /* Gnome Panel applets are XEMBED windows. We need to make sure we
+          * ignore them */
+ 
+--- a/src/canberra-gtk.c
++++ b/src/canberra-gtk.c
+@@ -185,6 +185,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), GDK_WINDOW_XID(w),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_WM_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix
index 79b7a49817c27..bec8d5e9744e0 100644
--- a/pkgs/by-name/li/libcanberra/package.nix
+++ b/pkgs/by-name/li/libcanberra/package.nix
@@ -55,11 +55,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isLinux "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system";
 
   patches = [
-    (fetchpatch {
-      name = "0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch";
-      url = "http://git.0pointer.net/libcanberra.git/patch/?id=c0620e432650e81062c1967cc669829dbd29b310";
-      sha256 = "0rc7zwn39yxzxp37qh329g7375r5ywcqcaak8ryd0dgvg8m5hcx9";
-    })
+    ./0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (fetchpatch {
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index baafab3033bf0..040b1d7a0bef3 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   brotli,
   cmake,
   ctestCheckHook,
@@ -32,7 +31,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.11.1";
+  version = "0.11.2";
 
   outputs = [
     "out"
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     tag = "v${version}";
-    hash = "sha256-ORwhKOp5Nog366UkLbuWpjz/6sJhxUO6+SkoJGH+3fE=";
+    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
@@ -145,17 +144,6 @@ stdenv.mkDerivation rec {
     rm -rf third_party/!(sjpeg)/
     shopt -u extglob
 
-    # Fix the build with CMake 4.
-    #
-    # See:
-    #
-    # * <https://github.com/webmproject/sjpeg/commit/9990bdceb22612a62f1492462ef7423f48154072>
-    # * <https://github.com/webmproject/sjpeg/commit/94e0df6d0f8b44228de5be0ff35efb9f946a13c9>
-    substituteInPlace third_party/sjpeg/CMakeLists.txt \
-      --replace-fail \
-        'cmake_minimum_required(VERSION 2.8.7)' \
-        'cmake_minimum_required(VERSION 3.5...3.10)'
-
     substituteInPlace plugins/gdk-pixbuf/jxl.thumbnailer \
       --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
     substituteInPlace CMakeLists.txt \
diff --git a/pkgs/by-name/li/libopenmpt/package.nix b/pkgs/by-name/li/libopenmpt/package.nix
index 59c06637b4831..2bef845c342ad 100644
--- a/pkgs/by-name/li/libopenmpt/package.nix
+++ b/pkgs/by-name/li/libopenmpt/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.8.4";
+  version = "0.8.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-Yn+b8RqsrmFaHyyYLH6IyyHxGy1vAmeUb3yCxerklDs=";
+    hash = "sha256-9oCuq7P4TDcWna2H8V7YPymm67x/aJ+RLU2r7P8OMyQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/libssh/package.nix b/pkgs/by-name/li/libssh/package.nix
index fc9ea4efe5b86..4ae69bf3b3a7e 100644
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/libssh-${version}.tar.xz";
-    hash = "sha256-fYoTYbsJTsP1EZZOeKWk26aJtZhuESr6vk9NDWxhJcM=";
+    hash = "sha256-ACrDIOPWbJ4QDsZXbj6EqgxIlJ79479bQKKAKZIpdwE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index 739d2c1a9a6a0..55267f83054f1 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-OUFmtHGGDU1+7EwfGVzrjPS2hqba0FfIuQl0V7up9Yk=";
+    hash = "sha256-AVH2hY9BhQ6R8WCw6DcdkUSBzm5cTWyBL1pbqnRMVdE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index ce7108175f0c7..199d6151a4962 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -350,20 +350,20 @@ def main() -> None:
 
     try:
         execute(sys.argv)
+    except KeyboardInterrupt:
+        sys.exit(130)
     except CalledProcessError as ex:
-        _handle_called_process_error(ex)
-    except (Exception, KeyboardInterrupt) as ex:
+        sys.exit(_handle_called_process_error(ex))
+    except Exception as ex:
         if logger.isEnabledFor(logging.DEBUG):
             raise
         else:
             sys.exit(str(ex))
 
 
-def _handle_called_process_error(ex: CalledProcessError) -> None:
+def _handle_called_process_error(ex: CalledProcessError) -> int:
     if logger.isEnabledFor(logging.DEBUG):
-        import traceback
-
-        traceback.print_exception(ex)
+        sys.excepthook(*sys.exc_info())
     else:
         import shlex
 
@@ -384,4 +384,4 @@ def _handle_called_process_error(ex: CalledProcessError) -> None:
         print(str(ex), file=sys.stderr)
 
     # Exit with the error code of the process that failed
-    sys.exit(ex.returncode)
+    return ex.returncode
diff --git a/pkgs/by-name/re/re2c/package.nix b/pkgs/by-name/re/re2c/package.nix
index f3cd39eb7c811..1e699a3cbfbca 100644
--- a/pkgs/by-name/re/re2c/package.nix
+++ b/pkgs/by-name/re/re2c/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   nix-update-script,
   python3,
@@ -23,6 +24,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-ihtAB6HLgYhX+FKPFy01RByy/M468YrHv2v5wB9bJws=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-2903.patch";
+      url = "https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97.patch";
+      hash = "sha256-JqnGfK48wpbWHb3aD9Fj3DOyoqHpbjvowppY/Vg5YWA=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     python3
diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index a92873e965c44..7c03fb60b296c 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2025c";
+  version = "2026a";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-SqeeTv/uU/xAKf/l9uvpeTcoLrzfOG1dLakc6EFC+Vc=";
+      hash = "sha256-d7VBclk3u1O9kr1ITAtDvshUXi00Me4B8E748iA7orc=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-aX6+ZiVESu9QgPWOSdA0JLu1Lgi/SD0921rPEMvRV0A=";
+      hash = "sha256-+AoXou3dK1QEH5yY11sKqAOLAW18XecokqFG2ZOHQOE=";
     })
   ];
 
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     "CFLAGS+=-DZIC_BLOAT_DEFAULT=\\\"fat\\\""
     "cc=${stdenv.cc.targetPrefix}cc"
     "AR=${stdenv.cc.targetPrefix}ar"
+    "REDO=posix_right"
   ]
   ++ lib.optionals stdenv.hostPlatform.isWindows [
     "CFLAGS+=-DHAVE_DIRECT_H"
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index e904c4dfefcca..52c0d752dc0ab 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.8.4";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
+    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index 15924f0934bd5..3fdeb90035932 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.7";
+  version = "1.25.8";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-F48oMoICdLQ+F30y8Go+uwEp5CfdIKXkyI3ywXY88Qo=";
+    hash = "sha256-6YjUokRqx/4/baoImljpk2pSo4E1Wt7ByJgyMKjWxZ4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 12ca0b0f9a551..2d214f78c70cf 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "14";
+        patch = "15";
         suffix = "";
       };
-      hash = "sha256-jT7Y7FyIwclfXlWGEqclRQ0kUoE92tXlj9saU7Egm3g=";
+      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
       inherit passthruFun;
     };
 
@@ -71,10 +71,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "12";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-+4WhNBSwKMSboYu9UjwtBVowtWsYuSzkVOosUe3GVsQ=";
+      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index d91e3971a6f68..8b782a3843049 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.44.4";
+  version = "2.44.5";
 
   outputs = [
     "out"
@@ -38,14 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withIntrospection "devdoc"
   ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
-  src =
-    let
-      inherit (finalAttrs) pname version;
-    in
-    fetchurl {
-      url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      hash = "sha256-k6Gqw/FCeuc0Vzl1gqLDjQSWOKgBeIzL1fSMpge9vRc=";
-    };
+  src = fetchurl {
+    url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-abk+CRObgMDuZhUD1g3rWlh0oxdytRhLnNVGKkEAq2g=";
+  };
 
   patches = [
     # Move installed tests to a separate output
@@ -155,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = finalAttrs.pname;
+      packageName = "gdk-pixbuf";
       versionPolicy = "odd-unstable";
     };
 
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 10720a06a06ed..5fbf223d674bb 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -115,7 +115,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -124,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mJDyYvOyqVZNy2KenraX13uT0fcYl+2hqBcLfc/nMpQ=";
+    hash = "sha256-EQ+4J5Xw5Wmx4nsSq5aZ01x3YuH/TblTNdasjRRCrz0=";
   };
 
   patches = [
@@ -427,6 +427,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 7e77cd97d782b..09b528ae812a1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-8MDibL7apXcyy2pXjozBOhFkvxjXN9VcMzBhxS8MSNc=";
+    hash = "sha256-/FD4hdQfXQQHzgh27HI12ee4LUjbL0vHLF8kSkrHkmM=";
   };
 
   strictDeps = true;
@@ -202,6 +202,6 @@ stdenv.mkDerivation (finalAttrs: {
       "gstreamer-video-1.0"
     ];
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fd588fc2300aa..bd5b3abb75c07 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Cn7bDntC2+a1dfzmGkgIo/ayDghaHq7LwCXQ7CHx53Q=";
+    hash = "sha256-LgvRktBDjqYGpvdqlcjhZUIWdlb/7Cwrw6r27gg3+/Y=";
   };
 
   depsBuildBuild = [
@@ -155,6 +155,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
+      tmarkus
       ttuegel
       matthewbauer
     ];
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index e92607625e9ff..9bb0c76bc56b0 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -37,29 +37,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Y9Rqjv+ooiXiWkZLp1OKzoU/4NwecDZrJ8IIE15UAc4=";
+    hash = "sha256-Vl9IU4jJSYr+v3gAQYPN/xATEhEoZBqlbtql6pRBK+I=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs)
       src
-      patches
       cargoRoot
       ;
     name = "gst-devtools-${finalAttrs.version}";
-    hash = "sha256-gU+SBvxwmrGiyeKXF3SA2ohIHNTS4ZBC+elB0u1QKRE=";
+    hash = "sha256-sqN1IBkbrT3pQqUQKU2pr8G1t4kNMKk0NR7NH7dTvAE=";
   };
 
-  patches = [
-    # dots-viewer: sort static files
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9208
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b3099f78775eab1ac19a9e163c0386e01e74b768.patch";
-      stripLen = 2;
-      hash = "sha256-QRHqbZ6slYcwGl+o9Oi4jV+ANMorCED4cQV5qDS74eg=";
-    })
-  ];
-
   depsBuildBuild = [
     pkg-config
   ];
@@ -132,6 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 60cabc07f942d..bc9ddcf7bf261 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-c0kAlE+Q7OXi85g8M1F4/aUAI/40KqdezZ2KnDi2TZ4=";
+    hash = "sha256-o26HkAtErBYIYS8tYW/AMvnX2SAyfE0jGv+2/pNJcU0=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 60f2c8d2a99c6..0716755bd34c0 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -74,7 +74,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6whi6TQEsHPpjsUDUOzn5mheopNsq4EYwrjpOOLL6os=";
+    hash = "sha256-AB3rCHbV10PNNEir90onrew/2FABL8sbAJlIYb1sEUU=";
   };
 
   patches = [
@@ -293,6 +293,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 990ed19d1b7ba..f5c149fdd1ecf 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-1t4FiE70I3bdjN6JlA97UM7Zb09vUoiOdkzYIz508FI=";
+    hash = "sha256-m7PSaB7w3pLRsanZVRhiNu4i5k83Lbm/wNIuLQ3xmGU=";
   };
 
   nativeBuildInputs = [
@@ -69,6 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index e3bc29fec2949..4a77e4a43e8db 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -261,6 +261,6 @@ stdenv.mkDerivation (finalAttrs: {
       lgpl21Plus
     ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 61dfb7b58037f..1953051f7a67e 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Mo3/JFdBloPypPBsoRnP0ivrYyzuGtaDBZEhMyU1PEQ=";
+    hash = "sha256-th1DBNjOqqoboTn7HOk18E8ac9fhgkPAoFsvsEMFQG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b354474f4a25a..0a35aaf3157df 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PfxDQ1vpfhEIFrrG1gKw8gagOFRieWg9nSU3L/En21I=";
+    hash = "sha256-v5yfcu43SCXP1DhowoW8sBcA3yWEBp51169FX+SCRPg=";
   };
 
   nativeBuildInputs = [
@@ -114,6 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 4f19e307addd5..ed0195c8b1b74 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -30,7 +30,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer-vaapi";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer-vaapi/gstreamer-vaapi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tC1E22PzGVpvMyluHq0ywU0B7ydFK3Bo8aLYZiT1Xqk=";
+    hash = "sha256-8S+TAnPHodPg1/hblP+dE3nRYqzMky6Mo9OJk+0n/Kw=";
   };
 
   nativeBuildInputs = [
@@ -102,6 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl21Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 24287d4280656..70353953b6421 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.3.5";
+  version = "3.3.8";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-J1SButHDPy0gGkVOZKfemaMF0MY/lifB5n39+3GRKR8=";
+    hash = "sha256-bJJdfr+OybCl8L27m1uRynGaU1V8D70bSzQjkDuqMDU=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 06f618c231791..7e4781e5114ea 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch b/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
index d26bf4267c138..bed920da611ff 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
@@ -1,13 +1,13 @@
 diff --git a/cmake/QtPublicSbomHelpers.cmake b/cmake/QtPublicSbomHelpers.cmake
-index 3767fb4ff26..b642ea3e4b6 100644
+index 45342c2efb6..74bf58e6246 100644
 --- a/cmake/QtPublicSbomHelpers.cmake
 +++ b/cmake/QtPublicSbomHelpers.cmake
-@@ -369,7 +369,7 @@ function(_qt_internal_setup_sbom)
-     endif()
+@@ -538,7 +538,7 @@ function(_qt_internal_setup_sbom)
+     # Main SBOM toggle. Used to be the toggle for SPDX v2.3 only, but now would also enable Cyclone
+     # DX as well.
+     set(sbom_help_string "Generate SBOM.")
+-    option(QT_GENERATE_SBOM "${sbom_help_string}" "${default_value}")
++    option(QT_GENERATE_SBOM "${sbom_help_string}" OFF)
  
-     option(QT_GENERATE_SBOM "Generate SBOM documents in SPDX v2.3 tag:value format."
--        "${default_value}")
-+        OFF)
  
-     string(CONCAT help_string
-         "Generate SBOM documents in SPDX v2.3 JSON format if required python dependency "
+     # Toggle for SPDX V2.3 generation.
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch
new file mode 100644
index 0000000000000..e63a70c53708f
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch
@@ -0,0 +1,16 @@
+--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
++++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
+@@ -1583,10 +1583,9 @@
+                     o->deleteLater();
+             } else {
+                 // If the object is C++-owned, we still have to release the weak reference we have
+-                // to it.
+-                ddata->jsWrapper.clear();
+-                if (lastCall && ddata->propertyCache)
+-                    ddata->propertyCache.reset();
++                // to it. If the "main" wrapper is not ours, we should leave it alone, though.
++                if (ddata->jsWrapper.as<QObjectWrapper>() == this)
++                    ddata->jsWrapper.clear();
+             }
+         }
+     }
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 58271c82c9bad..972a8f3721702 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -35,6 +35,11 @@ qtModule {
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
+
+    # Backport of https://codereview.qt-project.org/c/qt/qtdeclarative/+/704031
+    # Fixes common Plasma crash
+    # FIXME: remove in 6.10.3
+    ./another-crash-fix.patch
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index e2f1b86f12b08..ea00d966e8a39 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.10.1";
+  version = "6.10.2";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-ve9fyhUZFI6TAr/SFRXJudA1yTmTlg8+Fgyc9OUv3ds=";
+    hash = "sha256-NjYvL6BCn0UP7F2CW81upzZ8EwFAkhoUa5cdaH0uhM4=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 38ac43ed4c396..585e16fb01486 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qt3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16lw0gpjcaf90iqnff95hxw3hng42c8hzknxczf4h7kv9zakynb0";
-      name = "qt3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qt3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0vdvid42m9jyhmpclfgpc7j1ivxlj0jr23kp5pxa1v0z96fwmfzy";
+      name = "qt3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qt5compat-everywhere-src-6.10.1.tar.xz";
-      sha256 = "097yvzmfz9w5xsrr3dxd2gv4q826mplwmw0wnh0ywg8m18b6sfbj";
-      name = "qt5compat-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qt5compat-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1hk18428bpp60ypjzabzpc77nr10bzignqppqppvjbn0zbq1i91z";
+      name = "qt5compat-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtactiveqt-everywhere-src-6.10.1.tar.xz";
-      sha256 = "078bnj8a1faln3dibx14wxdsic5s94m00x73zwncfzx7ywczcr05";
-      name = "qtactiveqt-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtactiveqt-everywhere-src-6.10.2.tar.xz";
+      sha256 = "09swk8xv93gmk67v6zccxr3hjy4404q0awljfjlapas9xi10bnym";
+      name = "qtactiveqt-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtbase-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0p96bnkgfb9s5aw6qkfcy1y49xgkafx1w4i36bf1zd9xwbvjcqjs";
-      name = "qtbase-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtbase-everywhere-src-6.10.2.tar.xz";
+      sha256 = "07pjmnwmlsbxc9zxgcazq9w4jnq6ypw50ndm7kamyaqs54lqvdxf";
+      name = "qtbase-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtcharts-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1x1adsv3nnx44y9ldfjrz4nlhacxalsixdklxypqzyvw05w2568p";
-      name = "qtcharts-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtcharts-everywhere-src-6.10.2.tar.xz";
+      sha256 = "001ckwq5w5w164cz2hkkb2dvci1d77mm9hf4hha9ivgdqns1cla0";
+      name = "qtcharts-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtconnectivity-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1zsl46nbacpkvgma9si39p8k7qhqq3cdwnfw7pij0f67j0xgvbkv";
-      name = "qtconnectivity-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtconnectivity-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0chs66537ki0yvq94m2i3k69wf8kyr741m4wg6vbamr8ychz0n6g";
+      name = "qtconnectivity-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdatavis3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "01xva2m5x71avdqzp48zlq57l8v7kishzg75iwjjbrbazpx7q730";
-      name = "qtdatavis3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdatavis3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1hav6ncccdhw2kyx608xhchpmygx6sbfap8x6ch35l53yj5l0sdp";
+      name = "qtdatavis3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdeclarative-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0gl4akd7p0g6sf0y234lwkxvr16njjbxc19maj465fg0jjwfzd2g";
-      name = "qtdeclarative-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdeclarative-everywhere-src-6.10.2.tar.xz";
+      sha256 = "03sb1wfxqvy5dhyd85yc0776vvm2jzczlpwbvzqdpp3cyr7r2jd2";
+      name = "qtdeclarative-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdoc-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16h90yp34yn17z56y570yldl287glfasq4ayci7sk09jpd5n39h3";
-      name = "qtdoc-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdoc-everywhere-src-6.10.2.tar.xz";
+      sha256 = "011pp0nf019dg790vhr9i3xiy6vspzjpr8w8xd9cpyk723nsj54c";
+      name = "qtdoc-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtgraphs-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0vjpbv7ck5p8z38j9a70a6kgsjvfx432lvh5slmbgim33yra0ksd";
-      name = "qtgraphs-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtgraphs-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1bvsvmwf4csl63fqf4gdqb03s97b9dl0sdyffrp9mn37lmmgr47n";
+      name = "qtgraphs-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtgrpc-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0zspyhlhl4irwrr4vm4pg3mppyybyw0q76zlgvpj4j9wcfw8y4wq";
-      name = "qtgrpc-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtgrpc-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0dnibqlsnra4kwk1dng4g6rrndszx5kz1p12zzjj0y8cq74vz1kk";
+      name = "qtgrpc-everywhere-src-6.10.2.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qthttpserver-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0fz98hczfkkrhjmkwxi7159zpal4wvv5sb2y8pid9d2bsfb8sv52";
-      name = "qthttpserver-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qthttpserver-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0hs6zq1qfs4yfr9bf2d089q37wcyhgvx48vq54szsn72prcqsmi6";
+      name = "qthttpserver-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtimageformats-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0wksip3a9xszlkq6368fdkz60qszfqy3wawl13w9dnw14ggsp3j9";
-      name = "qtimageformats-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtimageformats-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0rwxcdpzx5mls7sqvscq58hb2h01j4qpy3h07ixiw21qhrqrr3wb";
+      name = "qtimageformats-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlanguageserver-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0v2m18bbm82n9lhb0lxabqnsabfh2nga8a8yndrncmad9xmm4q1k";
-      name = "qtlanguageserver-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlanguageserver-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0lqdqknblw4nsv1mgi5jw6rqsf7h9zf59af7bw371d5hhhn3y14s";
+      name = "qtlanguageserver-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlocation-everywhere-src-6.10.1.tar.xz";
-      sha256 = "02agg502pkdqgl3156al26bn4ascgyjz6ybsd7b53p4wp7qii5ib";
-      name = "qtlocation-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlocation-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0g0gwldmdslzx0zjdpi3vc0pqnd266qkxynh8xy534y5xmfz04yk";
+      name = "qtlocation-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlottie-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1hjp0hml4cih3vk9dgn3cs94klp7q2di29cdk457jva890y3d75w";
-      name = "qtlottie-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlottie-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1302lh7432372qy0mw2pv67miikf2ny2n103s8mhyfl30xx6pn55";
+      name = "qtlottie-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtmultimedia-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1f371qrcf9rp384niqxqfx0wa01m7p5hv7rjyzwz1m2052ygk97p";
-      name = "qtmultimedia-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtmultimedia-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0aryhch6qlamgfcbrxc0d1ggq4f96vjg68r7b8b33mzv0q0yzxwk";
+      name = "qtmultimedia-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtnetworkauth-everywhere-src-6.10.1.tar.xz";
-      sha256 = "039qrymh18as1ksch470mzrxixr3fry2jnkrs7bqin3jh5cynd8l";
-      name = "qtnetworkauth-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtnetworkauth-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1cw1355xxf0ca96xwjaw33nnrxh1qw26naa2zha5fpsh9fggsaag";
+      name = "qtnetworkauth-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtpositioning-everywhere-src-6.10.1.tar.xz";
-      sha256 = "08xy8rzm86b55pr8hk1g5rym7y0kblk0wj121l4rzqyn3gpi3cxb";
-      name = "qtpositioning-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtpositioning-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1kndqjh3ylbs5a2chqv3a6jip83j6zy9dlya82c7crkw8xjgllbh";
+      name = "qtpositioning-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquick3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1rh3wi6pxahdpzlnxw8xrxfx5l931k7kncv03fvxmw6fprr05m0p";
-      name = "qtquick3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquick3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0xfdlafzz7k3vps0kzz4mnyv0cmr0f5v8a4qkqvhqn0y3prkjm5r";
+      name = "qtquick3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquick3dphysics-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1vigiln79xy6xgr00wgmbfngqqpv6wsr5pviww8yfvmyy5yq8wyr";
-      name = "qtquick3dphysics-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquick3dphysics-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1nqw5kqrivmajbw2sqxll8zgqjk79g2pic8rghfkb52ps1xzdbxp";
+      name = "qtquick3dphysics-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquickeffectmaker-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1jdc2bgkrk1kl72h2cjb6j8p9pd2p7ck0zbw9afgam2hqm69hdih";
-      name = "qtquickeffectmaker-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquickeffectmaker-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1i62d7s6fl4lf92cfwljk7blirz82mv174k1d5nrw38c9qxz3jp3";
+      name = "qtquickeffectmaker-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquicktimeline-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1dsiwbvd5gqlwm87s05w4qb20731sxqmlm724kisqaf2nj4x4bl8";
-      name = "qtquicktimeline-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquicktimeline-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0933sggxp28mybdr8wgfyny9m0c23h70f3fy1mwxy7yjb2vxhckh";
+      name = "qtquicktimeline-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtremoteobjects-everywhere-src-6.10.1.tar.xz";
-      sha256 = "03cakd52p33qi8cjn9zjjmympjd74bc2fsk22cyy6064wbdmd7kw";
-      name = "qtremoteobjects-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtremoteobjects-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1kb5xd1ckp4phq820rl9h6nbaryrybzk2zxlq83cykg79w23ys5w";
+      name = "qtremoteobjects-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtscxml-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0s8q7873bklgd19ynwil0fxi03m0b7wbx39z07iqim66skjs0rzb";
-      name = "qtscxml-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtscxml-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0si3vpzva8wyqa0gh0fyk75knlgmsyjalahp41nv1cginf6ig70g";
+      name = "qtscxml-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtsensors-everywhere-src-6.10.1.tar.xz";
-      sha256 = "15dkhkb6hfybzy4wib3w2bzjqmkymi7fzb7wdmq8jii36gh9rkj9";
-      name = "qtsensors-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtsensors-everywhere-src-6.10.2.tar.xz";
+      sha256 = "10gmis63gpqhbb7ljy1gx3gh7hww6psk66c6jqvaxgzbgidm3rli";
+      name = "qtsensors-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtserialbus-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1m9ymfggv3l8lj7ji6kgayr5x6cisi20r3ikasbsbpzjgbvzqf95";
-      name = "qtserialbus-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtserialbus-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0yrsg50gmjlxnp1574fzkfbxls1cmjkn1qpagayhx55nrzzbydj7";
+      name = "qtserialbus-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtserialport-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0k2c1zbx20mcrn6hkcnsxy1252g1ycjh3mszqyh8axzn6n2gdchp";
-      name = "qtserialport-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtserialport-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0sxxvrn1bwrzm140988prn12f14pj15v8z3yxs7zl7qiv8lvy35l";
+      name = "qtserialport-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtshadertools-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1djvynddqksxnbb94m2pvf1ngkdqc8631xa61nnkvdaj6fk98y5n";
-      name = "qtshadertools-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtshadertools-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1j8ncwhjcy2k6p05cldnb20vbqijq1frdac9xpk9cvky9yydpn8q";
+      name = "qtshadertools-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtspeech-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0kvzic83d98szj6scgkm6hhj1p6jgr3i17c1523dw43f1xafrjj2";
-      name = "qtspeech-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtspeech-everywhere-src-6.10.2.tar.xz";
+      sha256 = "051h4v0qqjkz1brkypx6i2wzdpn8pwz5353f0f7hsavr2p3zcdyr";
+      name = "qtspeech-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtsvg-everywhere-src-6.10.1.tar.xz";
-      sha256 = "07xh78s2krgnhvdsysf2ji5dicmfns4g92v2990czfzkb1d3aby0";
-      name = "qtsvg-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtsvg-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1qfnv8ssflndjhv6r8s9vxfl8yblra956d00f8c3bwna707zhzzh";
+      name = "qtsvg-everywhere-src-6.10.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qttools-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16yl0hj540bnf1c1w4h7ph6s6bk15f0mqc1638807spzh21l0j41";
-      name = "qttools-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qttools-everywhere-src-6.10.2.tar.xz";
+      sha256 = "092vimkdpad6q9dilkhc45wmzzzs5ykfmbkfbi1d4xpxq43jqg8y";
+      name = "qttools-everywhere-src-6.10.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qttranslations-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0513kpwmsmmk85rwzh77nkmmgkwi58kvvrws8xm3fb51i3gs4jcf";
-      name = "qttranslations-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qttranslations-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0i56a03b7f6snvxfjsa5q4mnw6x7kxjnx2yw2rbm8sypr4xq3cxk";
+      name = "qttranslations-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtvirtualkeyboard-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1pxnp4lg6i3v57ynqvisljp3dmfcjpp6q0dr0av03g5gi0qxx72v";
-      name = "qtvirtualkeyboard-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtvirtualkeyboard-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0swqvcgp6p80k2g7nzb6dcjr2spxcj4lk48s7ll3ygx8j5h2awv2";
+      name = "qtvirtualkeyboard-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwayland-everywhere-src-6.10.1.tar.xz";
-      sha256 = "04yb4x7k0dv4m7j6qagvgxz2k08yvl1msk0zjwn6nyi202w6vgs9";
-      name = "qtwayland-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwayland-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1qkyabklzzzbh4ryxhbnvnpz52vzqvyqwzd6lqkdy6978gmrh69r";
+      name = "qtwayland-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebchannel-everywhere-src-6.10.1.tar.xz";
-      sha256 = "049iv4vhzx061ka5skz2803npjsb477c20nfxxc0zrihy8jnk8bv";
-      name = "qtwebchannel-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebchannel-everywhere-src-6.10.2.tar.xz";
+      sha256 = "09rc9y51bdb46pj7wad59gycy2l4ki3siizxai6kgq0risgsa7p3";
+      name = "qtwebchannel-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebengine-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1qyix9wbb2k96ybfavl56ffh3s6kbkfswvv5irmrlhm0hrhymdbp";
-      name = "qtwebengine-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebengine-everywhere-src-6.10.2.tar.xz";
+      sha256 = "07ln4f89qlxvsxg5gjwvwqhcfkhvf5kympk7hmhqi6m6jbrdsvl5";
+      name = "qtwebengine-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebsockets-everywhere-src-6.10.1.tar.xz";
-      sha256 = "00dxjl3zr2vgj374vd31frnp8sxxknl3pmw46cxv3qhq8klwfai7";
-      name = "qtwebsockets-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebsockets-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1g9fnj73q3s8a49qzhr1iv2h7z50hwwnja80s9bgd7jhx8dpbk7c";
+      name = "qtwebsockets-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebview-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0vvgn95bkrisjqwml16964zk0r9s6qvc6g81anl69xbs7mc80422";
-      name = "qtwebview-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebview-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1d7as06xmbmjx1rfnhrvizhy85dz3xdlx3pzy370r44q17zhdi3y";
+      name = "qtwebview-everywhere-src-6.10.2.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/python-modules/cairosvg/default.nix b/pkgs/development/python-modules/cairosvg/default.nix
index 509f6b18256f9..7daab37c42a46 100644
--- a/pkgs/development/python-modules/cairosvg/default.nix
+++ b/pkgs/development/python-modules/cairosvg/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "cairosvg";
-  version = "2.8.2";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "CairoSVG";
     tag = version;
-    hash = "sha256-KWUZA8pcHMnDEkAYZt3zDzPNynhGBuLZuagNPfHF8EA=";
+    hash = "sha256-WtMFOYaN/cRrL1Q4ma/UkR3kNFObNhp0Gm7i9NQAqz8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 0688f35b9855c..598dfcfb70568 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.28";
+  version = "4.2.29";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-dxlTonT8zFIFGFrrOW4GFKOy5b0chcESxt9i9xHO8h4=";
+    hash = "sha256-30OcLxtACSxLJ1jT+k7fmM8CyMyleXSPc+l7/3JZKzI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 52c3119e435fd..abbc71377ceac 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.26.0";
+  version = "1.26.11";
 
   format = "other";
 
@@ -32,21 +32,14 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-5QRqBdd6uxVnGtAc0ZCNF9YuWgb114Qb5DQq3io/uNs=";
+    hash = "sha256-ETFrp2m1bSbYsUZMcZipkkyurkgTT321kXH68ac9xDY=";
   };
 
-  patches = [
-    # Fix segfault with PyGObject>=3.52.0
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8653
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/69bba61e548c7a63bc18137e63e41489a7de9d36.patch";
-      stripLen = 2;
-      hash = "sha256-BfWPc8dsB09KiEm9bNT8e+jH76jiDefQlEhhLJoq7tI=";
-    })
-
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
-    ./skip-failing-test-not-initialized.patch
-  ];
+  # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
+  postPatch = ''
+    substituteInPlace testsuite/meson.build \
+      --replace-fail "['gstinit', 'test_gst_init.py']," ""
+  '';
 
   # Python 2.x is not supported.
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch b/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch
deleted file mode 100644
index 169c85a0802ce..0000000000000
--- a/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff --git a/testsuite/test_gst.py b/testsuite/test_gst.py
-index 2111b968..fd8a4627 100644
---- a/testsuite/test_gst.py
-+++ b/testsuite/test_gst.py
-@@ -38,45 +38,6 @@ class TimeArgsTest(TestCase):
-         self.assertEqual(Gst.TIME_ARGS(Gst.SECOND), '0:00:01.000000000')
- 
- 
--class TestNotInitialized(TestCase):
--    def testNotInitialized(self):
--        if sys.version_info >= (3, 0):
--            assert_type = Gst.NotInitialized
--        else:
--            assert_type = TypeError
--
--        with self.assertRaises(assert_type):
--            Gst.Caps.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.Structure.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.ElementFactory.make("identity", None)
--
--    def testNotDeinitialized(self):
--        Gst.init(None)
--
--        assert(Gst.Caps.from_string("audio/x-raw"))
--        assert(Gst.Structure.from_string("audio/x-raw"))
--        assert(Gst.ElementFactory.make("identity", None))
--
--        Gst.deinit()
--        if sys.version_info >= (3, 0):
--            assert_type = Gst.NotInitialized
--        else:
--            assert_type = TypeError
--
--        with self.assertRaises(assert_type):
--            Gst.Caps.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.Structure.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.ElementFactory.make("identity", None)
--
--
- class TestStructure(TestCase):
- 
-     def test_new(self):
diff --git a/pkgs/development/python-modules/multipart/default.nix b/pkgs/development/python-modules/multipart/default.nix
index 4eb143a42c578..1d02c7d6a0c3f 100644
--- a/pkgs/development/python-modules/multipart/default.nix
+++ b/pkgs/development/python-modules/multipart/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "multipart";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "defnull";
     repo = "multipart";
     tag = "v${version}";
-    hash = "sha256-6vlyoi4nayZOKyfO4jbKNzUy7G6K7mySYzkqfp+45O4=";
+    hash = "sha256-kLiOK6ovW3ki1CONXVQZCJw/U3K1AoR6rrmJUstwZOw=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 55fcd3b061620..39826f6418c5e 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_internal_errors_propagate_to_controller"
     # https://github.com/pytest-dev/pytest-xdist/issues/985
     "test_workqueue_ordered_by_size"
+    # https://github.com/pytest-dev/pytest-xdist/issues/1248
+    "test_workqueue_ordered_by_input"
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/python-modules/wand/default.nix b/pkgs/development/python-modules/wand/default.nix
index a55258f573b82..8a4f89a2055ad 100644
--- a/pkgs/development/python-modules/wand/default.nix
+++ b/pkgs/development/python-modules/wand/default.nix
@@ -2,42 +2,37 @@
   stdenv,
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   imagemagickBig,
-  py,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "wand";
-  version = "0.6.13";
-  format = "setuptools";
+  version = "0.7.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "Wand";
-    inherit version;
-    hash = "sha256-9QE0hOr3og6yLRghqu/mC1DMMpciNytfhWXUbUqq/Mo=";
+  src = fetchFromGitHub {
+    owner = "emcconville";
+    repo = "wand";
+    tag = version;
+    hash = "sha256-U4qxtOC72YSgo74OZdFmMG8W2s4wFI0ohJ7uJ4caabA=";
   };
 
   postPatch = ''
-    substituteInPlace wand/api.py --replace \
+    substituteInPlace wand/api.py --replace-fail \
       "magick_home = os.environ.get('MAGICK_HOME')" \
       "magick_home = '${imagemagickBig}'"
   '';
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
-    py
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # https://github.com/emcconville/wand/issues/558
-    "test_forward_fourier_transform"
-    "test_inverse_fourier_transform"
-    # our imagemagick doesn't set MagickReleaseDate
-    "test_configure_options"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # AssertionError: assert wand.color.Color('srgb(255,0,1.41553e-14)') == wand.color.Color('srgb(255,0,0)')
     "test_sparse_color"
   ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 0f693eb3a5c4f..cd84496faafd7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -193,10 +193,19 @@ rustPlatform.buildRustPackage {
     })
   ];
 
-  postPatch = lib.optionalString webUISupport ''
-    substituteInPlace cli/loader/src/lib.rs \
-        --replace-fail 'let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };' 'let emcc_name = "${lib.getExe' emscripten "emcc"}";'
-  '';
+  postPatch =
+    lib.optionalString webUISupport ''
+      substituteInPlace cli/loader/src/lib.rs \
+          --replace-fail 'let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };' 'let emcc_name = "${lib.getExe' emscripten "emcc"}";'
+    ''
+    # when building on static platforms:
+    # 1. remove the `libtree-sitter.$(SOEXT)` step from `all`
+    # 2. remove references to shared object files in the Makefile
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      substituteInPlace ./Makefile \
+          --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
+      sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    '';
 
   # Compile web assembly with emscripten. The --debug flag prevents us from
   # minifying the JavaScript; passing it allows us to side-step more Node
@@ -209,8 +218,8 @@ rustPlatform.buildRustPackage {
 
   postInstall = ''
     PREFIX=$out make install
-    ${lib.optionalString (!enableShared) "rm $out/lib/*.so{,.*}"}
-    ${lib.optionalString (!enableStatic) "rm $out/lib/*.a"}
+    ${lib.optionalString (!enableShared) "rm -f $out/lib/*.so{,.*}"}
+    ${lib.optionalString (!enableStatic) "rm -f $out/lib/*.a"}
   ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tree-sitter \
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index cfc4f014fa1df..d5aabb16c4b5c 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -17,14 +17,16 @@ let
 
   gypPatches =
     if stdenv.buildPlatform.isDarwin then
-      callPackage ./gyp-patches.nix { patch_tools = false; }
+      [
+        ./gyp-patches-set-fallback-value-for-CLT-darwin.patch
+      ]
     else
       [ ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.22.0";
-  sha256 = "4c138012bb5352f49822a8f3e6d1db71e00639d0c36d5b6756f91e4c6f30b683";
+  version = "22.22.2";
+  sha256 = "b6bedd3a8cacd5df7df015a5088264b12c74a277ba60684cb9642ae8eb743132";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c1dac94276505..acb4c053438cf 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -207,13 +207,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "258.3";
+  version = "258.5";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wpg/0z7xrB8ysPaa/zNp1mz+yYRCGyXz0ODZcKapovM=";
+    hash = "sha256-3xz8q0R0gMAwRDV2QmYO0r/0Fw+9LOyR3O3XuMrTpgY=";
   };
 
   # On major changes, or when otherwise required, you *must* :
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e7a186754a516..73e85c951200d 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -177,19 +177,17 @@ lib.makeExtensible (
 
       nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
 
-      nixComponents_2_31 =
-        (nixDependencies.callPackage ./modular/packages.nix rec {
-          version = "2.31.2";
-          inherit (self.nix_2_30.meta) maintainers teams;
-          otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
-          src = fetchFromGitHub {
-            owner = "NixOS";
-            repo = "nix";
-            tag = version;
-            hash = "sha256-NLGXPLjENLeKVOg3OZgHXZ+1x6sPIKq9FHH8pxbCrDI=";
-          };
-        }).appendPatches
-          patches_common;
+      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.31.3";
+        inherit (self.nix_2_30.meta) maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-oe0YWe8f+pwQH4aYD2XXLW5iEHyXNUddurqJ5CUVCIk=";
+        };
+      };
 
       nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;