diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 72b8482ef439..9407fea7f8e5 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -43,6 +43,11 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
       - name: Create backport PRs
         id: backport
         uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
@@ -56,6 +61,11 @@ jobs:
             * [ ] Before merging, ensure that this backport is [acceptable for the release](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
               * Even as a non-committer, if you find that it is not acceptable, leave a comment.
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
       - name: "Add 'has: port to stable' label"
         if: steps.backport.outputs.created_pull_numbers != ''
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 594081924604..20600d9d9a31 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,9 @@ name: Build
 on:
   workflow_call:
     inputs:
+      baseBranch:
+        required: true
+        type: string
       mergedSha:
         required: true
         type: string
@@ -63,7 +66,7 @@ jobs:
       - name: Build NixOS manual
         if: |
           contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
         run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }} --out-link nixos-manual
 
       - name: Build Nixpkgs manual
@@ -81,7 +84,7 @@ jobs:
       - name: Upload NixOS manual
         if: |
           contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: nixos-manual-${{ matrix.system }}
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 966e0f5c0d52..d77bbceb07f1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -2,6 +2,13 @@ name: Check
 
 on:
   workflow_call:
+    inputs:
+      baseBranch:
+        required: true
+        type: string
+      headBranch:
+        required: true
+        type: string
 
 permissions: {}
 
@@ -12,9 +19,7 @@ defaults:
 jobs:
   no-channel-base:
     name: no channel base
-    if: |
-      startsWith(github.base_ref, 'nixos-') ||
-      startsWith(github.base_ref, 'nixpkgs-')
+    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
     runs-on: ubuntu-24.04-arm
     steps:
       - run: |
@@ -29,8 +34,7 @@ jobs:
   cherry-pick:
     if: |
       github.event_name == 'pull_request' ||
-      startsWith(github.base_ref, 'release-') ||
-      (startsWith(github.base_ref, 'staging-') && github.base_ref != 'staging-next')
+      (fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development'))
     permissions:
       pull-requests: write
     runs-on: ubuntu-24.04-arm
@@ -50,6 +54,11 @@ jobs:
         run: |
           ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" checked-cherry-picks.md
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - name: Prepare review
         if: steps.check.outcome == 'failure'
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
@@ -148,3 +157,8 @@ jobs:
                 }`, { node_id: review.node_id })
               })
             )
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 947f441f2e60..89908ede868d 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -79,6 +79,12 @@ jobs:
           permission-administration: read
           permission-members: read
 
+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
       - name: Validate codeowners
         if: steps.app-token.outputs.token
         env:
@@ -90,6 +96,12 @@ jobs:
           EXPERIMENTAL_CHECKS: "avoid-shadowing"
         run: result/bin/codeowners-validator
 
+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
   # Request reviews from code owners
   request:
     name: Request
@@ -116,8 +128,20 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
       - name: Request reviews
         if: steps.app-token.outputs.token
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
+
+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 7a4f590887c9..71ba62cdf4c7 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -66,6 +66,11 @@ jobs:
           name: merged-${{ matrix.system }}
           path: merged/*
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - name: Get target run id
         if: inputs.targetSha
         id: targetRunId
@@ -108,6 +113,11 @@ jobs:
             // This should only happen when Eval is broken on the target branch and this PR fixes it.
             // Continue without targetRunId to skip the remaining steps, but pass the job.
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - uses: actions/download-artifact@v4
         if: steps.targetRunId.outputs.targetRunId
         with:
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 177021ff1497..262a050797b8 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -9,6 +9,10 @@ on:
   schedule:
     - cron: '07,17,27,37,47,57 * * * *'
   workflow_call:
+    inputs:
+      headBranch:
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       updatedWithin:
@@ -266,16 +270,16 @@ jobs:
 
             core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
 
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          !contains(fromJSON(inputs.headBranch).type, 'development')
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml # default
@@ -285,12 +289,7 @@ jobs:
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          !contains(fromJSON(inputs.headBranch).type, 'development')
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler-no-sync.yml
@@ -303,13 +302,13 @@ jobs:
         # the backport labels.
         if: |
           github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login == 'NixOS' && (
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          contains(fromJSON(inputs.headBranch).type, 'development')
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler-development-branches.yml
           sync-labels: true
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 368ede03ffe7..4837ae5f1fc5 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -22,6 +22,8 @@ jobs:
   prepare:
     runs-on: ubuntu-24.04-arm
     outputs:
+      baseBranch: ${{ steps.branches.outputs.base }}
+      headBranch: ${{ steps.branches.outputs.head }}
       mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
       targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
       systems: ${{ steps.systems.outputs.systems }}
@@ -30,6 +32,7 @@ jobs:
         with:
           sparse-checkout: |
             .github/actions
+            ci/supportedBranches.js
             ci/supportedSystems.json
       - name: Check if the PR can be merged and get the test merge commit
         uses: ./.github/actions/get-merge-commit
@@ -40,12 +43,36 @@ jobs:
         run: |
           echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
 
+      - name: Determine branch type
+        id: branches
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const { classify } = require('./ci/supportedBranches.js')
+            const { base, head } = context.payload.pull_request
+
+            const baseClassification = classify(base.ref)
+            core.setOutput('base', baseClassification)
+            core.info('base classification:', baseClassification)
+
+            const headClassification =
+              (base.repo.full_name == head.repo.full_name) ?
+              classify(head.ref) :
+              // PRs from forks are always considered WIP.
+              { type: ['wip'] }
+            core.setOutput('head', headClassification)
+            core.info('head classification:', headClassification)
+
   check:
     name: Check
+    needs: [prepare]
     uses: ./.github/workflows/check.yml
     permissions:
       # cherry-picks
       pull-requests: write
+    with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
+      headBranch: ${{ needs.prepare.outputs.headBranch }}
 
   lint:
     name: Lint
@@ -71,16 +98,20 @@ jobs:
 
   labels:
     name: Labels
-    needs: [eval]
+    needs: [prepare, eval]
     uses: ./.github/workflows/labels.yml
     permissions:
       issues: write
       pull-requests: write
+    with:
+      headBranch: ${{ needs.prepare.outputs.headBranch }}
 
   reviewers:
     name: Reviewers
     needs: [prepare, eval]
-    if: needs.prepare.outputs.targetSha
+    if: |
+      needs.prepare.outputs.targetSha &&
+      !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development')
     uses: ./.github/workflows/reviewers.yml
     secrets:
       OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
@@ -92,6 +123,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
 
   # This job's only purpose is to serve as a target for the "Required Status Checks" branch ruleset.
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 4beb755e2b64..bd1d8aed7204 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -54,6 +54,10 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
 
       # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
       # In the more special case, when a PR is undrafted an eval run will have started already.
@@ -87,6 +91,11 @@ jobs:
             }
             throw new Error("No comparison artifact found.")
 
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - name: Download the comparison results
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
@@ -96,6 +105,17 @@ jobs:
           path: comparison
           merge-multiple: true
 
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
       - name: Requesting maintainer reviews
         if: ${{ steps.app-token.outputs.token }}
         env:
@@ -111,3 +131,14 @@ jobs:
           jq -r 'keys[]' comparison/maintainers.json \
             | while read -r id; do gh api /user/"$id" --jq .login; done \
             | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
diff --git a/ci/.editorconfig b/ci/.editorconfig
new file mode 100644
index 000000000000..180d0765eed9
--- /dev/null
+++ b/ci/.editorconfig
@@ -0,0 +1,4 @@
+# TODO: Move to top-level via staging PR
+[*.js]
+indent_style = space
+indent_size = 2
diff --git a/ci/README.md b/ci/README.md
index 66fb707ebec5..7df3b1533e59 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -20,3 +20,32 @@ Arguments:
 
 - `BASE_BRANCH`: The base branch to use, e.g. master or release-24.05
 - `REPOSITORY`: The repository from which to fetch the base branch. Defaults to <https://github.com/NixOS/nixpkgs.git>.
+
+# Branch classification
+
+For the purposes of CI, branches in the NixOS/nixpkgs repository are classified as follows:
+
+- **Channel** branches
+  - `nixos-` or `nixpkgs-` prefix
+  - Are only updated from `master` or `release-` branches, when hydra passes.
+  - Otherwise not worked on, Pull Requests are not allowed.
+  - Long-lived, no deletion, no force push.
+- **Primary development** branches
+  - `release-` prefix and `master`
+  - Pull Requests required.
+  - Long-lived, no deletion, no force push.
+- **Secondary development** branches
+  - `staging-` prefix, `haskell-updates` and `python-updates`
+  - Pull Requests normally required, except when merging development branches into each other.
+  - Long-lived, no deletion, no force push.
+- **Work-In-Progress** branches
+  - `backport-`, `revert-` and `wip-` prefixes.
+  - Deprecated: All other branches, not matched by channel/development.
+  - Pull Requests are optional.
+  - Short-lived, force push allowed, deleted after merge.
+
+Some branches also have a version component, which is either `unstable` or `YY.MM`.
+
+`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+This classification will then be used to skip certain jobs.
+This script can also be run locally to print basic test cases.
diff --git a/ci/supportedBranches.js b/ci/supportedBranches.js
new file mode 100755
index 000000000000..a8579f96df99
--- /dev/null
+++ b/ci/supportedBranches.js
@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+/*
+#!nix-shell -i node -p nodejs
+*/
+
+const typeConfig = {
+  master: ['development', 'primary'],
+  release: ['development', 'primary'],
+  staging: ['development', 'secondary'],
+  'staging-next': ['development', 'secondary'],
+  'haskell-updates': ['development', 'secondary'],
+  'python-updates': ['development', 'secondary'],
+  nixos: ['channel'],
+  nixpkgs: ['channel'],
+}
+
+function split(branch) {
+  return { ...branch.match(/(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/).groups }
+}
+
+function classify(branch) {
+  const { prefix, version } = split(branch)
+  return {
+    stable: (version ?? 'unstable') !== 'unstable',
+    type: typeConfig[prefix] ?? [ 'wip' ]
+  }
+}
+
+module.exports = { classify }
+
+// If called directly via CLI, runs the following tests:
+if (!module.parent) {
+  console.log('split(branch)')
+  function testSplit(branch) {
+    console.log(branch, split(branch))
+  }
+  testSplit('master')
+  testSplit('release-25.05')
+  testSplit('staging-next')
+  testSplit('staging-25.05')
+  testSplit('staging-next-25.05')
+  testSplit('nixpkgs-25.05-darwin')
+  testSplit('nixpkgs-unstable')
+  testSplit('haskell-updates')
+  testSplit('backport-123-to-release-25.05')
+
+  console.log('')
+
+  console.log('classify(branch)')
+  function testClassify(branch) {
+    console.log(branch, classify(branch))
+  }
+  testClassify('master')
+  testClassify('release-25.05')
+  testClassify('staging-next')
+  testClassify('staging-25.05')
+  testClassify('staging-next-25.05')
+  testClassify('nixpkgs-25.05-darwin')
+  testClassify('nixpkgs-unstable')
+  testClassify('haskell-updates')
+  testClassify('backport-123-to-release-25.05')
+}
diff --git a/lib/tests/modules/types-attrTag.nix b/lib/tests/modules/types-attrTag.nix
index 82d6e3c17590..f30c1fc904f8 100644
--- a/lib/tests/modules/types-attrTag.nix
+++ b/lib/tests/modules/types-attrTag.nix
@@ -7,7 +7,7 @@
 let
   inherit (lib) mkOption types;
   forceDeep = x: builtins.deepSeq x x;
-  mergedSubOption = (options.merged.type.getSubOptions options.merged.loc).extensible."merged.<name>";
+  mergedSubOption = (options.merged.type.getSubOptions options.merged.loc).extensible;
 in
 {
   options = {
diff --git a/lib/types.nix b/lib/types.nix
index 591bcaf7dc9d..9c409f7e254c 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -919,12 +919,7 @@ let
           description = "attribute-tagged union";
           descriptionClass = "noun";
           getSubOptions =
-            prefix:
-            mapAttrs (tagName: tagOption: {
-              "${lib.showOption prefix}" = tagOption // {
-                loc = prefix ++ [ tagName ];
-              };
-            }) tags;
+            prefix: mapAttrs (tagName: tagOption: tagOption // { loc = prefix ++ [ tagName ]; }) tags;
           check = v: isAttrs v && length (attrNames v) == 1 && tags ? ${head (attrNames v)};
           merge =
             loc: defs:
diff --git a/nixos/modules/services/misc/omnom.nix b/nixos/modules/services/misc/omnom.nix
index da21648105e3..6e157ca3b014 100644
--- a/nixos/modules/services/misc/omnom.nix
+++ b/nixos/modules/services/misc/omnom.nix
@@ -104,14 +104,6 @@ in
                 default = "fs";
                 description = "Storage type.";
               };
-              root = lib.mkOption {
-                type = lib.types.path;
-                default = "${cfg.dataDir}/static/data";
-                defaultText = lib.literalExpression ''
-                  "''${config.services.omnom.dataDir}/static/data"
-                '';
-                description = "Where the snapshots are saved.";
-              };
             };
             smtp = {
               tls = lib.mkEnableOption "Whether TLS encryption should be used.";
@@ -142,6 +134,24 @@ in
                 description = "Connection timeout duration in seconds.";
               };
             };
+            activitypub = {
+              pubkey = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/public.pem";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/public.pem"
+                '';
+                description = "ActivityPub public key. Will be generated, by default.";
+              };
+              privkey = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/private.pem";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/private.pem"
+                '';
+                description = "ActivityPub private key. Will be generated, by default.";
+              };
+            };
           };
         };
         default = { };
@@ -150,6 +160,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.omnom = {
+      settings.app = {
+        static_dir = "${cfg.dataDir}/static";
+        template_dir = "${cfg.package}/share/templates";
+      };
+    };
+
     assertions = [
       {
         assertion = !lib.hasAttr "password" cfg.settings.smtp;
@@ -157,16 +174,6 @@ in
           `services.omnom.settings.smtp.password` must be defined in `services.omnom.passwordFile`.
         '';
       }
-      {
-        assertion = !(cfg.settings.storage.root != "${cfg.dataDir}/static/data");
-        message = ''
-          For Omnom to access the snapshots, it needs the storage root
-          directory to be inside the service's working directory.
-
-          As such, `services.omnom.settings.storage.root` must be the same as
-          `''${services.omnom.dataDir}/static/data`.
-        '';
-      }
     ];
 
     systemd.services.omnom = {
@@ -224,10 +231,10 @@ in
       in
       {
         "${cfg.dataDir}"."d" = settings;
-        "${cfg.dataDir}/templates"."L+" = settings // {
-          argument = "${cfg.package}/share/templates";
+        "${cfg.settings.app.static_dir}"."C" = settings // {
+          argument = "${cfg.package}/share/static";
         };
-        "${cfg.settings.storage.root}"."d" = settings;
+        "${cfg.settings.app.static_dir}/data"."d" = settings;
       };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c6926aaeb901..2ef61d4f5784 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1008,6 +1008,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ombi = runTest ./ombi.nix;
+  omnom = runTest ./omnom.nix;
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   opencloud = runTest ./opencloud.nix;
diff --git a/nixos/tests/omnom.nix b/nixos/tests/omnom.nix
new file mode 100644
index 000000000000..4bfdbd679b39
--- /dev/null
+++ b/nixos/tests/omnom.nix
@@ -0,0 +1,42 @@
+{ lib, ... }:
+let
+  servicePort = 9090;
+in
+{
+  name = "Basic Omnom Test";
+  meta = {
+    maintainers = lib.teams.ngi.members;
+  };
+
+  nodes = {
+    server =
+      { config, lib, ... }:
+      {
+        services.omnom = {
+          enable = true;
+          openFirewall = true;
+
+          port = servicePort;
+
+          settings = {
+            app = {
+              disable_signup = false; # restrict CLI user-creation
+              results_per_page = 50;
+            };
+            server.address = "0.0.0.0:${toString servicePort}";
+          };
+        };
+      };
+  };
+
+  # TODO: take a snapshot
+  testScript =
+    { nodes, ... }:
+    # python
+    ''
+      server.start()
+      server.wait_for_unit("omnom.service")
+      server.wait_for_open_port(${toString servicePort})
+      server.succeed("curl -sf http://localhost:${toString servicePort}")
+    '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 49a10e854436..3284df0dc3c3 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2779,8 +2779,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.144.2";
-          hash = "sha256-9OFMQc5Y+979wYkd3qyuLuw7bRBMcsTQ9uSd2ea5cxk=";
+          version = "1.146.2";
+          hash = "sha256-PVs5TVtd8GGRJ/J9LJAZneVgYYuFdoJnN2U7ciKDjCQ=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
index b92fd0df4aae..f57e5a550f32 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
@@ -121,6 +121,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
             --add-needed libssl.so \
             "$file"
         done
+
+        # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+        mkdir -p "$out/lib"
+        ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
       ''}
     )
   '';
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index 743821705917..28aa7f84267f 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-06-14";
+  version = "0-unstable-2025-06-16";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "bdabec1651380f3f736eecff8d859090ae822f9b";
-    hash = "sha256-plUeFjkUSbWKs/TZHqQLR5MtOgWLNZLUg7QedtR+/Vo=";
+    rev = "8c48d34327f5ffc44892899cf2567feaa9bbf72a";
+    hash = "sha256-u5kxj4Sl7LpivEuNhTec8Z2u3Dw/X8xFDBQ++hQAtFc=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/networking/remote/teamviewer/default.nix b/pkgs/applications/networking/remote/teamviewer/default.nix
index bacf6d39f85d..bee49f37d155 100644
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
     "out"
     "dev"
   ];
-  version = "15.61.3";
+  version = "15.66.5";
 
   src =
     let
@@ -39,11 +39,11 @@ mkDerivation rec {
     {
       x86_64-linux = fetchurl {
         url = "${base_url}/teamviewer_${version}_amd64.deb";
-        hash = "sha256-o7Em+QRW4TebRTJS5xjcx1M6KPh1ziB1j0fvlO+RYa4=";
+        hash = "sha256-yQD2iFFFHlR6vX/5vEtBqmIOtGXa4eHbE7v7MdXgBds=";
       };
       aarch64-linux = fetchurl {
         url = "${base_url}/teamviewer_${version}_arm64.deb";
-        hash = "sha256-LDByF4u9xZV1MYApBrnlNrUPndbDrQt6DKX+r8Kmq6k=";
+        hash = "sha256-WqC4/5egq3pHgb4v8EPevJDDNmashuQr+VBQuFLdr7Q=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/applications/science/logic/cvc5/default.nix b/pkgs/applications/science/logic/cvc5/default.nix
index fe0c0172a88b..3fc2336f1885 100644
--- a/pkgs/applications/science/logic/cvc5/default.nix
+++ b/pkgs/applications/science/logic/cvc5/default.nix
@@ -10,10 +10,9 @@
   gmp,
   python3,
   gtest,
-  libantlr3c,
-  antlr3_4,
   boost,
   jdk,
+  libpoly,
 }:
 
 stdenv.mkDerivation rec {
@@ -37,10 +36,9 @@ stdenv.mkDerivation rec {
     symfpu
     gmp
     gtest
-    libantlr3c
-    antlr3_4
     boost
     jdk
+    libpoly
     (python3.withPackages (
       ps: with ps; [
         pyparsing
@@ -57,7 +55,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=1"
-    "-DANTLR3_JAR=${antlr3_4}/lib/antlr/antlr-3.4-complete.jar"
+    "-DUSE_POLY=ON"
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/am/amazon-q-cli/package.nix b/pkgs/by-name/am/amazon-q-cli/package.nix
index 340238e6140a..17ee8e671f3a 100644
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@@ -2,36 +2,32 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  protobuf_26,
   versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amazon-q-cli";
-  version = "1.10.1";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "aws";
-    repo = "amazon-q-developer-cli";
+    repo = "amazon-q-developer-cli-autocomplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HgbF5jistZhzebZmnTmMBlHuL6/fy1kcQplAFldzAV8=";
+    hash = "sha256-oY2hDOsws2WVQPKEFhGNPHITo26p/UZ5XzvRX7DoMyc=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-yhSVnz8gzJy/E9T1U4GsT3b7wmYzSCYXEb8y2HOIQms=";
+  cargoHash = "sha256-xriK88OY6W1cOZVgiUPBIuItVHwEyFNq5Ywh367K6CU=";
 
   cargoBuildFlags = [
     "-p"
     "chat_cli"
   ];
 
-  nativeBuildInputs = [
-    protobuf_26
-  ];
-
   postInstall = ''
     install -m 0755 $out/bin/chat_cli $out/bin/amazon-q
+    rm -f $out/bin/chat_cli $out/bin/test_mcp_server
   '';
 
   cargoTestFlags = [
diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index e0743a65c5f2..daefaaaa76b3 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -9,10 +9,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.0.747";
+  version = "4.0.779";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-eLNxuBCm3vzG/90mZsQCVInGu8lMPrr+/UBAHj+vGJ4=";
+    hash = "sha256-eRA/9OAWcYsn1C8xuC6NFj2/HxOHT0YISDC9Kp8H/Yg=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;
diff --git a/pkgs/by-name/bo/bootdev-cli/package.nix b/pkgs/by-name/bo/bootdev-cli/package.nix
index 780f40250026..4868643c3935 100644
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.19.1";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-cAVCTA4SZdD3QVgbSbha860fExq1swWnJjpWKpfHP2Q=";
+    hash = "sha256-jTI91t/gcEdOc3mwP0dFqL5sYeaC6nD96+RpuQfAf4s=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";
diff --git a/pkgs/by-name/bu/buildstream/package.nix b/pkgs/by-name/bu/buildstream/package.nix
index 21373e5e8914..cefd4f1f28c3 100644
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -94,6 +94,9 @@ python3Packages.buildPythonApplication rec {
 
     # Blob not found in the local CAS
     "test_source_pull_partial_fallback_fetch"
+
+    # FAILED tests/sources/tar.py::test_out_of_basedir_hardlinks - AssertionError
+    "test_out_of_basedir_hardlinks"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index bf7351077857..6ea0daf86645 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.57.2";
+  version = "11.59.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-RlDXoLBsJl/2TCDBfQhdWfr8zQfQiEedW5ckVtQn4eM=";
+    hash = "sha256-xSHIKy9kQrbDhLuTfJd1yDAt/Z7mqYNv4XT6fQZftho=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-JoFj3bHDb0jWwlrioYQv/V6e69ae7HFGkLYBNgntB00=";
+  vendorHash = "sha256-NGrDYN7+JozAmtysSBUcKPiQwKs/fUiQkUVEGrmTTCk=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/db/dbus-broker/package.nix b/pkgs/by-name/db/dbus-broker/package.nix
index 20a3fd102b02..957da1e878b3 100644
--- a/pkgs/by-name/db/dbus-broker/package.nix
+++ b/pkgs/by-name/db/dbus-broker/package.nix
@@ -13,7 +13,10 @@
 
 let
   meta = {
-    maintainers = with lib.maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      rvdp
+    ];
     platforms = lib.platforms.linux;
   };
 
@@ -54,8 +57,8 @@ let
   # part of the dbus-broker project, just in separate repositories.
   c-dvar = dep {
     pname = "c-dvar";
-    version = "1.1.0";
-    hash = "sha256-p/C+BktclVseCtZJ1Q/YK03vP2ClnYRLB1Vmj2OQJD4=";
+    version = "1.2.0";
+    hash = "sha256-OlV6yR1tNWFN+rxPPGmbfbh7WyB6FwORyZR1V553iYE=";
     buildInputs = [
       c-stdaux
       c-utf8
@@ -91,8 +94,8 @@ let
   };
   c-stdaux = dep {
     pname = "c-stdaux";
-    version = "1.5.0";
-    hash = "sha256-MsnuEyVCmOIr/q6I1qyPsNXp48jxIEcXoYLHbOAZtW0=";
+    version = "1.6.0";
+    hash = "sha256-/15lop+WUkTW9v9h7BBdwRSpJgcBXaJNtMM7LXgcQE4=";
   };
   c-utf8 = dep {
     pname = "c-utf8";
@@ -105,13 +108,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "36";
+  version = "37";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
+    hash = "sha256-a9ydcJKZP8MLzu9lv40p9sTyo8IsU++9HOFeGU3+Tok=";
   };
 
   patches = [
diff --git a/pkgs/by-name/db/dbus-broker/paths.patch b/pkgs/by-name/db/dbus-broker/paths.patch
index 577270d30dce..726674c857eb 100644
--- a/pkgs/by-name/db/dbus-broker/paths.patch
+++ b/pkgs/by-name/db/dbus-broker/paths.patch
@@ -1,11 +1,11 @@
 diff --git a/src/launch/launcher.c b/src/launch/launcher.c
-index 5bf5cf5..06ce7f4 100644
+index 7b1fb19..6bc2c46 100644
 --- a/src/launch/launcher.c
 +++ b/src/launch/launcher.c
-@@ -924,9 +924,7 @@ static int launcher_load_standard_session_services(Launcher *launcher, NSSCache
- 
- static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *nss_cache) {
+@@ -945,9 +945,7 @@ static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *
          static const char *default_data_dirs[] = {
+                 "/etc",
+                 "/run",
 -                "/usr/local/share",
 -                "/usr/share",
 -                "/lib",
@@ -13,7 +13,7 @@ index 5bf5cf5..06ce7f4 100644
                  NULL,
          };
          const char *suffix = "dbus-1/system-services";
-@@ -1012,9 +1010,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
+@@ -1033,9 +1031,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
          if (launcher->configfile)
                  configfile = launcher->configfile;
          else if (launcher->user_scope)
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 1b6429aa006a..90d217241ae1 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.0.2";
+  version = "18.1.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,10 +21,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-Phzg0GAKBMfXPqzlMfLZQbKeqZzMKw1YdEDdzSs+IkE=";
+      hash = "sha256-nttZfGjQKRSYCoMHSljojYLNScyDPHd8ayCuDkvKXpE=";
     };
 
-    vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";
+    vendorHash = "sha256-BTpcnaHNyLgdAA9KqqA+mBo18fmQ0+OwLGNOPHRJ/IE=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"
diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
index 6398fe9c6adf..3befb216c4c2 100644
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.5.1";
+  version = "5.6.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    hash = "sha256-N2H9jLpsP39nKrokWwphAspQwXcL3stAdvNVItIHFyo=";
+    hash = "sha256-XerIPK+s0OWYAqKVqE3HSSI+D4cXixYqRHmf9/4C2eg=";
   };
 
-  vendorHash = "sha256-Go02W09799Vu9v7y+P7z1gj7ijG3No5AVprRrmspPZE=";
+  vendorHash = "sha256-qNGACM5DKufyNVKhJyakmMRbaMXi+JJUfojhWdk0ptU=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 63d2a38339fe..a986ca52225e 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.0.2";
+  version = "18.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-zWWQZBN2J69YnjGhhQdB5wv4plC5ikk+kq6EfNPW6ZM=";
+    hash = "sha256-HwjbQLEc/GmFxVvyx0UMKKrNoHmfFADblVN/XOAtMZY=";
   };
 
-  vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
+  vendorHash = "sha256-6ZHKwPhC3N813kiw1NnPOMVc2CBSIClwc4MunDi0gCk=";
   subPackages = [ "." ];
 
   meta = {
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index d4d47349cf2a..71840b4eddce 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.0.2",
-  "repo_hash": "03sqn21bnsdjs518akbmanyh96p8h4dyhpy4vqwcx1dc8lwnidki",
-  "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
+  "version": "18.1.0",
+  "repo_hash": "0d7xs0l6nzs1bpr4slycq0agw3kk9k9bw3q0dqqc2knla71i21fd",
+  "yarn_hash": "0c5pp3dpvw0q0nfl6w1lpdmk7dvkfinwb7z7a3vq22wgzca23x2m",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.0.2-ee",
+  "rev": "v18.1.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.0.2",
-    "GITLAB_PAGES_VERSION": "18.0.2",
+    "GITALY_SERVER_VERSION": "18.1.0",
+    "GITLAB_PAGES_VERSION": "18.1.0",
     "GITLAB_SHELL_VERSION": "14.42.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
-    "GITLAB_WORKHORSE_VERSION": "18.0.2"
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.6.0",
+    "GITLAB_WORKHORSE_VERSION": "18.1.0"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 8c10519ffd9e..4d8c37f266e2 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.0.2";
+  version = "18.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-tLlxsUCoSGvUpJnS0GsNobk2IuSEgs3R4UDUmNf+HrA=";
+  vendorHash = "sha256-jsp68duGIW1p8ltfSlK0jPd22iscjiIOyrxfsr+2QY0=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index 370fca8d9f78..d80bd7c298a3 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -79,10 +79,11 @@ let
             dontBuilt = true;
             installPhase = ''
               cp -R ext/glfm_markdown $out
+              rm $out/Cargo.lock
               cp Cargo.lock $out
             '';
           };
-          hash = "sha256-73uliXjZNT8Ok98ai2rY+b0jYqxoQH3qW5YS+Ap6KK0=";
+          hash = "sha256-TG2pUE80o/Sa147Lcb7yIJC+mfaDzzW7m2d7dTi5yi0=";
         };
 
         dontBuild = false;
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 8be009495335..8913861030c1 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+def next?
+  File.basename(__FILE__) == "Gemfile.next"
+end
+
 source 'https://rubygems.org'
 
 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
@@ -19,13 +23,13 @@ extend ignore_feature_category
 
 gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false, feature_category: :shared
 
-# NOTE: When incrementing the major or minor version here, also increment activerecord_version
-# in vendor/gems/attr_encrypted/attr_encrypted.gemspec until we resolve
-# https://gitlab.com/gitlab-org/gitlab/-/issues/375713
-#
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
 
-gem 'rails', '~> 7.1.5.1', feature_category: :shared
+if next?
+  gem 'rails', '~> 7.2.2.1', feature_category: :shared
+else
+  gem 'rails', '~> 7.1.5.1', feature_category: :shared
+end
 
 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :shared
 # This can be dropped after upgrading to Rails 7.2: https://github.com/rails/rails/pull/49674
@@ -38,9 +42,9 @@ gem 'bootsnap', '~> 1.18.3', require: false, feature_category: :shared
 # Avoid the precompiled native gems because Omnibus needs to build this to ensure
 # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730
 if RUBY_PLATFORM.include?('darwin')
-  gem 'ffi', '~> 1.17', feature_category: :shared
+  gem 'ffi', '~> 1.17.2', feature_category: :shared
 else
-  gem 'ffi', '~> 1.17', force_ruby_platform: true, feature_category: :shared
+  gem 'ffi', '~> 1.17.2', force_ruby_platform: true, feature_category: :shared
 end
 
 gem 'openssl', '~> 3.0', feature_category: :shared
@@ -62,7 +66,7 @@ gem 'responders', '~> 3.0', feature_category: :shared
 gem 'sprockets', '~> 3.7.0', feature_category: :shared
 gem 'sprockets-rails', '~>  3.5.1', feature_category: :shared
 
-gem 'view_component', '~> 3.21.0', feature_category: :shared
+gem 'view_component', '~> 3.23.2', feature_category: :shared
 
 # Supported DBs
 gem 'pg', '~> 1.5.6', feature_category: :database
@@ -72,7 +76,7 @@ gem 'rugged', '~> 1.6', feature_category: :gitaly
 gem 'faraday', '~> 2', feature_category: :shared
 gem 'faraday-retry', '~> 2', feature_category: :shared
 # Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
-gem 'logger', '~> 1.6.0', feature_category: :shared
+gem 'logger', '~> 1.7.0', feature_category: :shared
 
 gem 'marginalia', '~> 1.11.1', feature_category: :database
 
@@ -128,11 +132,11 @@ gem 'invisible_captcha', '~> 2.1.0', feature_category: :insider_threat
 gem 'devise-two-factor', '~> 4.1.1', feature_category: :system_access
 gem 'rqrcode', '~> 2.2', feature_category: :system_access
 
-gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted', feature_category: :shared
+gem 'attr_encrypted', '~> 4.2', feature_category: :shared
 
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.13', feature_category: :pages
-gem 'rubyzip', '~> 2.3.2', require: 'zip', feature_category: :pages
+gem 'rubyzip', '~> 2.4.0', require: 'zip', feature_category: :pages
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0.19', feature_category: :pages
 
@@ -170,7 +174,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
   feature_category: :cell
 
 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.1',
+gem 'gitlab-duo-workflow-service-client', '~> 0.2',
   path: 'vendor/gems/gitlab-duo-workflow-service-client',
   feature_category: :duo_workflow
 
@@ -238,9 +242,9 @@ gem 'seed-fu', '~> 2.3.7', feature_category: :shared
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.223.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.225.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.185.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.189.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
@@ -266,7 +270,7 @@ gem 'asciidoctor-kroki', '~> 0.10.0', require: false, feature_category: :markdow
 gem 'rouge', '~> 4.5.0', feature_category: :shared
 gem 'truncato', '~> 0.7.13', feature_category: :team_planning
 gem 'nokogiri', '~> 1.18', feature_category: :shared
-gem 'gitlab-glfm-markdown', '~> 0.0.30', feature_category: :markdown
+gem 'gitlab-glfm-markdown', '~> 0.0.31', feature_category: :markdown
 gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
 gem 'unicode-emoji', '~> 4.0', feature_category: :markdown
 
@@ -283,7 +287,7 @@ gem 'rack', '~> 2.2.9', feature_category: :shared
 gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base', feature_category: :shared
 
 group :puma do
-  gem 'puma', '= 6.5.0', require: false, feature_category: :shared
+  gem 'puma', '= 6.6.0', require: false, feature_category: :shared
   gem 'sd_notify', '~> 0.1.0', require: false, feature_category: :shared
 end
 
@@ -302,7 +306,7 @@ gem 'gitlab-sidekiq-fetcher',
 gem 'fugit', '~> 1.11.1', feature_category: :continuous_integration
 
 # HTTP requests
-gem 'httparty', '~> 0.22.0', feature_category: :shared
+gem 'httparty', '~> 0.23.0', feature_category: :shared
 
 # Colored output to console
 gem 'rainbow', '~> 3.0', feature_category: :shared
@@ -328,7 +332,7 @@ gem 'device_detector', feature_category: :shared
 # Redis
 gem 'redis', '~> 5.4.0', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis
-gem 'connection_pool', '~> 2.4', feature_category: :shared
+gem 'connection_pool', '~> 2.5.3', feature_category: :shared
 
 # Redis session store
 gem 'redis-actionpack', '~> 5.5.0', feature_category: :redis
@@ -347,7 +351,7 @@ gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers
 gem 'kubeclient', '~> 4.11.0', feature_category: :shared
 
 # AI
-gem 'circuitbox', '2.0.0', feature_category: :ai_abstraction_layer
+gem 'circuitbox', '2.0.0', feature_category: :shared
 
 # Sanitize user input
 gem 'sanitize', '~> 6.0.2', feature_category: :shared
@@ -431,7 +435,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_
 
 # Event-driven reactor for Ruby
 # Required manually in config/initializers/require_async_gem
-gem 'async', '~> 2.23.0', require: false, feature_category: :shared
+gem 'async', '~> 2.24.0', require: false, feature_category: :shared
 
 # Security report schemas used to validate CI job artifacts of security jobs
 gem 'gitlab-security_report_schemas', '0.1.2.min15.0.0.max15.2.1', feature_category: :vulnerability_management
@@ -501,7 +505,7 @@ end
 
 group :development, :test do
   gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared
-  gem 'bullet', '~> 7.2.0', feature_category: :shared
+  gem 'bullet', '~> 8.0.0', feature_category: :shared
   gem 'parser', '= 3.3.8.0', feature_category: :shared
   gem 'pry-byebug', feature_category: :shared
   gem 'pry-rails', '~> 0.3.9', feature_category: :shared
@@ -510,7 +514,7 @@ group :development, :test do
   gem 'awesome_print', require: false, feature_category: :shared
 
   gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
-  gem 'rspec-rails', '~> 7.0.0', feature_category: :shared
+  gem 'rspec-rails', '~> 7.1.0', feature_category: :shared
   gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling
 
   # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
@@ -530,7 +534,7 @@ group :development, :test do
   gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling
 
   gem 'knapsack', '~> 4.0.0', feature_category: :tooling
-  gem 'gitlab-crystalball', '~> 0.7.2', require: false, feature_category: :tooling
+  gem 'gitlab-crystalball', '~> 1.1.0', require: false, feature_category: :tooling
   gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling
 
   gem 'simple_po_parser', '~> 1.1.6', require: false, feature_category: :shared
@@ -639,16 +643,12 @@ gem 'ssh_data', '~> 1.3', feature_category: :shared
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 17.8.0', feature_category: :gitaly
+gem 'gitaly', '~> 18.1.0.pre.rc1', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
 gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management
 
-# Lock the version before issues below are resolved:
-# https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
-# Or we can upgrade to a more recent version as long as we can confirm
-# that it doesn't have the same issues.
-gem 'grpc', '= 1.63.0', feature_category: :shared
+gem 'grpc', '~> 1.72.0', feature_category: :shared
 
 gem 'google-protobuf', '~> 3.25', '>= 3.25.3', feature_category: :shared
 
@@ -756,4 +756,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared
 
 gem "i18n_data", "~> 0.13.1", feature_category: :system_access
 
-gem "gitlab-cloud-connector", "~> 1.11", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
+gem "gitlab-cloud-connector", "~> 1.14", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index bfb3ebad0845..637c16927096 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -48,7 +48,7 @@ PATH
       google-cloud-storage_transfer (~> 1.2.0)
       google-protobuf (~> 3.25, >= 3.25.3)
       googleauth (~> 1.8.1)
-      grpc (= 1.63.0)
+      grpc (~> 1.72.0)
       json (~> 2.7)
       jwt (~> 2.5)
       logger (~> 1.5)
@@ -126,12 +126,6 @@ PATH
       diffy (~> 3.4)
       oj (~> 3.16, >= 3.16.10)
 
-PATH
-  remote: vendor/gems/attr_encrypted
-  specs:
-    attr_encrypted (3.2.4)
-      encryptor (~> 3.0.0)
-
 PATH
   remote: vendor/gems/bundler-checksum
   specs:
@@ -162,7 +156,7 @@ PATH
 PATH
   remote: vendor/gems/gitlab-duo-workflow-service-client
   specs:
-    gitlab-duo-workflow-service-client (0.1)
+    gitlab-duo-workflow-service-client (0.2)
       grpc
 
 PATH
@@ -334,7 +328,7 @@ GEM
     asciidoctor-plantuml (0.0.16)
       asciidoctor (>= 2.0.17, < 3.0.0)
     ast (2.4.2)
-    async (2.23.1)
+    async (2.24.0)
       console (~> 1.29)
       fiber-annotation
       io-event (~> 1.9)
@@ -342,15 +336,17 @@ GEM
       traces (~> 0.15)
     atlassian-jwt (0.2.1)
       jwt (~> 2.1)
+    attr_encrypted (4.2.0)
+      encryptor (~> 3.0.0)
     attr_required (1.0.2)
     awesome_print (1.9.2)
     awrence (1.2.1)
     aws-eventstream (1.3.0)
     aws-partitions (1.1001.0)
-    aws-sdk-cloudformation (1.41.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.223.0)
+    aws-sdk-cloudformation (1.131.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-core (3.225.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -360,8 +356,8 @@ GEM
     aws-sdk-kms (1.76.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.185.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-s3 (1.189.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.9.1)
@@ -400,11 +396,11 @@ GEM
     bindata (2.4.11)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.18.4)
+    bootsnap (1.18.6)
       msgpack (~> 1.2)
     browser (5.3.1)
     builder (3.2.4)
-    bullet (7.2.0)
+    bullet (8.0.8)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     byebug (12.0.0)
@@ -527,7 +523,7 @@ GEM
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
     devfile (0.4.4)
-    device_detector (1.0.0)
+    device_detector (1.1.3)
     devise (4.9.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
@@ -541,7 +537,7 @@ GEM
       railties (~> 7.0)
       rotp (~> 6.0)
     diff-lcs (1.5.0)
-    diffy (3.4.3)
+    diffy (3.4.4)
     digest-crc (0.6.5)
       rake (>= 12.0.0, < 14.0.0)
     docile (1.4.0)
@@ -615,7 +611,7 @@ GEM
     factory_bot_rails (6.4.4)
       factory_bot (~> 6.5)
       railties (>= 5.0.0)
-    faraday (2.12.2)
+    faraday (2.13.1)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
@@ -731,19 +727,20 @@ GEM
     git (1.19.1)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (17.8.4)
+    gitaly (18.1.0.pre.rc1)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.6)
       numerizer (~> 0.2)
-    gitlab-cloud-connector (1.12.0)
+    gitlab-cloud-connector (1.17.0)
       activesupport (~> 7.0)
       jwt (~> 2.9.3)
-    gitlab-crystalball (0.7.2)
+    gitlab-crystalball (1.1.0)
       git (< 4)
-    gitlab-dangerfiles (4.9.1)
+      ostruct (< 1)
+    gitlab-dangerfiles (4.9.2)
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
       rake (~> 13.0)
@@ -759,9 +756,9 @@ GEM
       mime-types
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    gitlab-glfm-markdown (0.0.30)
+    gitlab-glfm-markdown (0.0.31)
       rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (17.11.2)
+    gitlab-kas-grpc (17.11.3)
       grpc (~> 1.0)
     gitlab-labkit (0.37.0)
       actionpack (>= 5.0.0, < 8.1.0)
@@ -785,8 +782,8 @@ GEM
       activesupport (>= 5.2.0)
       rake (~> 13.0)
       snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.26.1)
-      grpc (~> 1.63.0)
+    gitlab-secret_detection (0.29.1)
+      grpc (>= 1.63.0, < 2)
       grpc_reflection (~> 0.1)
       parallel (~> 1)
       re2 (~> 2.7)
@@ -907,12 +904,12 @@ GEM
     google-cloud-storage_transfer-v1 (0.8.0)
       gapic-common (>= 0.20.0, < 2.a)
       google-cloud-errors (~> 1.0)
-    google-protobuf (3.25.7)
+    google-protobuf (3.25.8)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
       grpc (~> 1.27)
-    googleapis-common-protos-types (1.19.0)
+    googleapis-common-protos-types (1.20.0)
       google-protobuf (>= 3.18, < 5.a)
     googleauth (1.8.1)
       faraday (>= 0.17.3, < 3.a)
@@ -959,8 +956,8 @@ GEM
       graphql (~> 2.0)
       html-pipeline (~> 2.14, >= 2.14.3)
       sass-embedded (~> 1.58)
-    grpc (1.63.0)
-      google-protobuf (~> 3.25)
+    grpc (1.72.0)
+      google-protobuf (>= 3.25, < 5.0)
       googleapis-common-protos-types (~> 1.0)
     grpc-google-iam-v1 (1.5.0)
       google-protobuf (~> 3.18)
@@ -1020,7 +1017,7 @@ GEM
     http-cookie (1.0.5)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
-    httparty (0.22.0)
+    httparty (0.23.1)
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
@@ -1049,7 +1046,7 @@ GEM
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
-    jaro_winkler (1.6.0)
+    jaro_winkler (1.6.1)
     jira-ruby (2.3.0)
       activesupport
       atlassian-jwt
@@ -1107,7 +1104,7 @@ GEM
     language_server-protocol (3.17.0.3)
     launchy (2.5.2)
       addressable (~> 2.8)
-    lefthook (1.11.5)
+    lefthook (1.11.13)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
     letter_opener_web (3.0.0)
@@ -1138,13 +1135,13 @@ GEM
       rake (~> 13.0)
     locale (2.1.4)
     lockbox (1.3.0)
-    logger (1.6.6)
+    logger (1.7.0)
     lograge (0.11.2)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.24.0)
+    loofah (2.24.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lookbook (2.3.4)
@@ -1232,13 +1229,14 @@ GEM
       shellany (~> 0.0)
     numerizer (0.2.0)
     oauth (0.5.6)
-    oauth2 (2.0.9)
-      faraday (>= 0.17.3, < 3.0)
-      jwt (>= 1.0, < 3.0)
+    oauth2 (2.0.10)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
+      version_gem (>= 1.1.8, < 3)
     observer (0.1.2)
     octokit (9.2.0)
       faraday (>= 1, < 3)
@@ -1256,7 +1254,7 @@ GEM
       plist (~> 3.1)
       train-core
       wmi-lite (~> 1.0)
-    oj (3.16.10)
+    oj (3.16.11)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     oj-introspect (0.8.0)
@@ -1449,7 +1447,7 @@ GEM
     paper_trail (16.0.0)
       activerecord (>= 6.1)
       request_store (~> 1.4)
-    parallel (1.26.3)
+    parallel (1.27.0)
     parser (3.3.8.0)
       ast (~> 2.4.1)
       racc
@@ -1492,7 +1490,7 @@ GEM
       coderay
       parser
       unparser
-    prometheus-client-mmap (1.2.9)
+    prometheus-client-mmap (1.2.10)
       base64
       bigdecimal
       logger
@@ -1513,7 +1511,7 @@ GEM
       date
       stringio
     public_suffix (6.0.1)
-    puma (6.5.0)
+    puma (6.6.0)
       nio4r (~> 2.0)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
@@ -1647,7 +1645,7 @@ GEM
     rexml (3.4.1)
     rinku (2.0.0)
     rotp (6.3.0)
-    rouge (4.5.1)
+    rouge (4.5.2)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
@@ -1680,7 +1678,7 @@ GEM
     rspec-parameterized-table_syntax (1.0.0)
       binding_of_caller
       rspec-parameterized-core (< 2)
-    rspec-rails (7.0.1)
+    rspec-rails (7.1.1)
       actionpack (>= 7.0)
       activesupport (>= 7.0)
       railties (>= 7.0)
@@ -1731,15 +1729,15 @@ GEM
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
       multipart-post (~> 2.0)
-    ruby-lsp (0.23.15)
+    ruby-lsp (0.23.20)
       language_server-protocol (~> 3.17.0)
       prism (>= 1.2, < 2.0)
       rbs (>= 3, < 4)
       sorbet-runtime (>= 0.5.10782)
     ruby-lsp-rails (0.3.31)
       ruby-lsp (>= 0.23.0, < 0.24.0)
-    ruby-lsp-rspec (0.1.22)
-      ruby-lsp (~> 0.23.0)
+    ruby-lsp-rspec (0.1.23)
+      ruby-lsp (~> 0.23.19)
     ruby-magic (0.6.0)
       mini_portile2 (~> 2.8)
     ruby-progressbar (1.11.0)
@@ -1750,7 +1748,7 @@ GEM
     ruby2_keywords (0.0.5)
     rubyntlm (0.6.3)
     rubypants (0.2.0)
-    rubyzip (2.3.2)
+    rubyzip (2.4.1)
     rugged (1.6.3)
     safe_yaml (1.0.4)
     safety_net_attestation (0.4.0)
@@ -1769,7 +1767,7 @@ GEM
     seed-fu (2.3.9)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    selenium-webdriver (4.27.0)
+    selenium-webdriver (4.32.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -1828,12 +1826,12 @@ GEM
       hashie
       version_gem (~> 1.1)
     snowplow-tracker (0.8.0)
-    solargraph (0.54.2)
+    solargraph (0.54.4)
       backport (~> 1.2)
       benchmark (~> 0.4)
       bundler (~> 2.0)
       diff-lcs (~> 1.4)
-      jaro_winkler (~> 1.6)
+      jaro_winkler (~> 1.6, >= 1.6.1)
       kramdown (~> 2.3)
       kramdown-parser-gfm (~> 1.1)
       logger (~> 1.6)
@@ -1991,11 +1989,11 @@ GEM
     validates_hostname (1.0.13)
       activerecord (>= 3.0)
       activesupport (>= 3.0)
-    version_gem (1.1.0)
+    version_gem (1.1.8)
     version_sorter (2.3.0)
-    view_component (3.21.0)
+    view_component (3.23.2)
       activesupport (>= 5.2.0, < 8.1)
-      concurrent-ruby (~> 1.0)
+      concurrent-ruby (~> 1)
       method_source (~> 1.0)
     virtus (2.0.0)
       axiom-types (~> 0.1)
@@ -2027,7 +2025,7 @@ GEM
       activesupport
       faraday (~> 2.0)
       faraday-follow_redirects
-    webmock (3.25.0)
+    webmock (3.25.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -2071,13 +2069,13 @@ DEPENDENCIES
   asciidoctor-include-ext (~> 0.4.0)
   asciidoctor-kroki (~> 0.10.0)
   asciidoctor-plantuml (~> 0.0.16)
-  async (~> 2.23.0)
+  async (~> 2.24.0)
   atlassian-jwt (~> 0.2.1)
-  attr_encrypted (~> 3.2.4)!
+  attr_encrypted (~> 4.2)
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.223.0)
-  aws-sdk-s3 (~> 1.185.0)
+  aws-sdk-core (~> 3.225.0)
+  aws-sdk-s3 (~> 1.189.0)
   axe-core-rspec (~> 4.10.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
@@ -2088,7 +2086,7 @@ DEPENDENCIES
   better_errors (~> 2.10.1)
   bootsnap (~> 1.18.3)
   browser (~> 5.3.1)
-  bullet (~> 7.2.0)
+  bullet (~> 8.0.0)
   bundler-checksum (~> 0.1.0)!
   capybara (~> 3.40)
   capybara-screenshot (~> 1.0.26)
@@ -2099,7 +2097,7 @@ DEPENDENCIES
   cloud_profiler_agent (~> 0.0.0)!
   commonmarker (~> 0.23.10)
   concurrent-ruby (~> 1.1)
-  connection_pool (~> 2.4)
+  connection_pool (~> 2.5.3)
   countries (~> 4.0.0)
   coverband (= 6.1.5)
   creole (~> 0.5.0)
@@ -2138,7 +2136,7 @@ DEPENDENCIES
   faraday_middleware-aws-sigv4 (~> 1.0.1)
   fast_blank (~> 1.0.1)
   ffaker (~> 2.24)
-  ffi (~> 1.17)
+  ffi (~> 1.17.2)
   flipper (~> 0.28.0)
   flipper-active_record (~> 0.28.0)
   flipper-active_support_cache_store (~> 0.28.0)
@@ -2152,17 +2150,17 @@ DEPENDENCIES
   gettext (~> 3.5, >= 3.5.1)
   gettext_i18n_rails (~> 1.13.0)
   git (~> 1.8)
-  gitaly (~> 17.8.0)
+  gitaly (~> 18.1.0.pre.rc1)
   gitlab-active-context!
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.11)
-  gitlab-crystalball (~> 0.7.2)
+  gitlab-cloud-connector (~> 1.14)
+  gitlab-crystalball (~> 1.1.0)
   gitlab-dangerfiles (~> 4.9.0)
-  gitlab-duo-workflow-service-client (~> 0.1)!
+  gitlab-duo-workflow-service-client (~> 0.2)!
   gitlab-experiment (~> 0.9.1)
   gitlab-fog-azure-rm (~> 2.2.0)
-  gitlab-glfm-markdown (~> 0.0.30)
+  gitlab-glfm-markdown (~> 0.0.31)
   gitlab-housekeeper!
   gitlab-http!
   gitlab-kas-grpc (~> 17.11.0)
@@ -2212,7 +2210,7 @@ DEPENDENCIES
   graphlyte (~> 1.0.0)
   graphql (= 2.4.13)
   graphql-docs (~> 5.0.0)
-  grpc (= 1.63.0)
+  grpc (~> 1.72.0)
   gssapi (~> 1.3.1)
   guard-rspec
   haml_lint (~> 0.58)
@@ -2221,7 +2219,7 @@ DEPENDENCIES
   health_check (~> 3.0)
   html-pipeline (~> 2.14.3)
   html2text
-  httparty (~> 0.22.0)
+  httparty (~> 0.23.0)
   i18n_data (~> 0.13.1)
   icalendar (~> 2.10.1)
   influxdb-client (~> 3.1)
@@ -2244,7 +2242,7 @@ DEPENDENCIES
   licensee (~> 9.16)
   listen (~> 3.7)
   lockbox (~> 1.3.0)
-  logger (~> 1.6.0)
+  logger (~> 1.7.0)
   lograge (~> 0.5)
   loofah (~> 2.24.0)
   lookbook (~> 2.3)
@@ -2326,7 +2324,7 @@ DEPENDENCIES
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.4)
-  puma (= 6.5.0)
+  puma (= 6.6.0)
   rack (~> 2.2.9)
   rack-attack (~> 6.7.0)
   rack-cors (~> 2.0.1)
@@ -2351,7 +2349,7 @@ DEPENDENCIES
   rqrcode (~> 2.2)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0, >= 1.0.2)
-  rspec-rails (~> 7.0.0)
+  rspec-rails (~> 7.1.0)
   rspec-retry (~> 0.6.2)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.9)
@@ -2363,7 +2361,7 @@ DEPENDENCIES
   ruby-magic (~> 0.6)
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.18)
-  rubyzip (~> 2.3.2)
+  rubyzip (~> 2.4.0)
   rugged (~> 1.6)
   sanitize (~> 6.0.2)
   sd_notify (~> 0.1.0)
@@ -2414,7 +2412,7 @@ DEPENDENCIES
   valid_email (~> 0.1)
   validates_hostname (~> 1.0.13)
   version_sorter (~> 2.3)
-  view_component (~> 3.21.0)
+  view_component (~> 3.23.2)
   vite_rails (~> 3.0.17)
   vite_ruby (~> 3.9.0)
   vmstat (~> 2.3.0)
@@ -2427,4 +2425,4 @@ DEPENDENCIES
   yard (~> 0.9)
 
 BUNDLED WITH
-   2.6.6
+   2.6.9
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 4e033992dc9f..33afdf2cb5d1 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -468,10 +468,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01jh5b1wh9gvgrkl2bgc93pimc0ncjbi5vsadgxxp9a8d4s9fb31";
+      sha256 = "0xs3qdlm8fj6zksqp5daamc51azwgbrp3b6mbqcxl22qdnn137aq";
       type = "gem";
     };
-    version = "2.23.1";
+    version = "2.24.0";
   };
   atlassian-jwt = {
     dependencies = [ "jwt" ];
@@ -489,10 +489,11 @@ src: {
     groups = [ "default" ];
     platforms = [ ];
     source = {
-      path = "${src}/vendor/gems/attr_encrypted";
-      type = "path";
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lddh6dznfvpic6c9pbb6wgzwd3jyp26abjfvi0fsf3fkqaq0p3y";
+      type = "gem";
     };
-    version = "3.2.4";
+    version = "4.2.0";
   };
   attr_required = {
     groups = [ "default" ];
@@ -556,10 +557,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09kb3k5vpymg846gajc5d3wznww63yiv3ygdf4v42d4pf4wpbr1i";
+      sha256 = "1bkkx0sz1lkqhzkrpklnalpv2dshvrdi12yq47xmv0nflhgzysmp";
       type = "gem";
     };
-    version = "1.41.0";
+    version = "1.131.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -574,10 +575,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xwcimg5i93ansmmww7ap8k6xxyijkxa8p896bxj9kc7cw8hkhyq";
+      sha256 = "1kafaaa9a2yh2cia6s2bn3m5jmya43l239j2ncbsndcq925xhjkw";
       type = "gem";
     };
-    version = "3.223.0";
+    version = "3.225.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -603,10 +604,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ix5g1qnp7m0f8jk0bx0b5csx8p7zrxhnvkqc7jsyp9a3c4vnpky";
+      sha256 = "0x3ylssjaq9bvsgs89l601x1fywxzi80dc1xc8zgvzigsyk2yqia";
       type = "gem";
     };
-    version = "1.185.0";
+    version = "1.189.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -873,10 +874,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mdgj9yw1hmx3xh2qxyjc31y8igmxzd9h0c245ay2zkz76pl4k5c";
+      sha256 = "003xl226y120cbq1n99805jw6w75gcz1gs941yz3h7li3qy3kqha";
       type = "gem";
     };
-    version = "1.18.4";
+    version = "1.18.6";
   };
   browser = {
     groups = [ "default" ];
@@ -914,10 +915,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12gacycw1adsdjp14pm43619c6lcdaddhgbdizy7gnzmnjhwh0im";
+      sha256 = "0hn5nysivwlzwgwgh3m97kzjgfy8g7nl82b2pahdj0xqnrg91fdl";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "8.0.8";
   };
   bundler-checksum = {
     dependencies = [ ];
@@ -1636,10 +1637,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zbsjj1bgwmsiqiw6x5fzbzp25xc10c02s37ggl2635ha0qzn05q";
+      sha256 = "0ycwbakxxir8dwh2fwg47hvi05dvp1s20fqr3yh8lbmb5kj3zzn5";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.1.3";
   };
   devise = {
     dependencies = [
@@ -1716,10 +1717,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19xaz5qmw0kg1rdsjh13vk7674bpcmjy6cnddx1cvl80vgkvjr22";
+      sha256 = "1qs7drxvyzk3dg22xgblc12lq5kww9hhj7vpn8ay3l42rasllf3r";
       type = "gem";
     };
-    version = "3.4.3";
+    version = "3.4.4";
   };
   digest-crc = {
     dependencies = [ "rake" ];
@@ -2211,10 +2212,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mls9g490k63rdmjc9shqshqzznfn1y21wawkxrwp2vvbk13jwqm";
+      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
       type = "gem";
     };
-    version = "2.12.2";
+    version = "2.13.1";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -2762,10 +2763,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kvv1idqscqh03wp6xcb5mi03j5hksbnn8dadcwpv2izm0srfv8r";
+      sha256 = "02p7ysnali576bpdivlgnx31h4zwmg7aggx4kwfck51npg2s0rcg";
       type = "gem";
     };
-    version = "17.8.4";
+    version = "18.1.0.pre.rc1";
   };
   gitlab = {
     dependencies = [
@@ -2856,13 +2857,16 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bshayyh9pb2rgb9qc82dc9fr1xkf4kxj10rd0lkjqxnbh7ppsxi";
+      sha256 = "0d5zrz5vgb8zrnri42awqfvcq9kfzlrc032nprknddpb9iagbsmr";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.17.0";
   };
   gitlab-crystalball = {
-    dependencies = [ "git" ];
+    dependencies = [
+      "git"
+      "ostruct"
+    ];
     groups = [
       "development"
       "test"
@@ -2870,10 +2874,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16mlrsd4lyvp9faqrnd7nmrl485wzrj2vp6y72x7f8wmsmqpivf4";
+      sha256 = "1a42qg2m7w0qn7as3zrc4v7lrxig532izi7yb2w8rbcwm114fcdx";
       type = "gem";
     };
-    version = "0.7.2";
+    version = "1.1.0";
   };
   gitlab-dangerfiles = {
     dependencies = [
@@ -2889,10 +2893,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cpiznkzlvsbanfcvnqdf0lxrzjd3i592d0j766xmr55mkc1jsr9";
+      sha256 = "162p00p59rxbhxglanzapl6qckc52q97s6hrf1p0ywnqhpv51h6m";
       type = "gem";
     };
-    version = "4.9.1";
+    version = "4.9.2";
   };
   gitlab-duo-workflow-service-client = {
     dependencies = [ "grpc" ];
@@ -2902,7 +2906,7 @@ src: {
       path = "${src}/vendor/gems/gitlab-duo-workflow-service-client";
       type = "path";
     };
-    version = "0.1";
+    version = "0.2";
   };
   gitlab-experiment = {
     dependencies = [
@@ -2944,10 +2948,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rh0bij1nk0c6agqg39p5qwhc93fdgriwqwnshgrkn66kwzs7ppk";
+      sha256 = "06rd3q4xznh483aqmg2llaaa946psagrxd6va8g9zm3q3k3fkj4i";
       type = "gem";
     };
-    version = "0.0.30";
+    version = "0.0.31";
   };
   gitlab-housekeeper = {
     dependencies = [
@@ -2990,10 +2994,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "075fasc3mv2l87l34cw5pw1vyf2ad254gsa9jpl4cqv3rx6hbfgj";
+      sha256 = "0lsz61cr7i3d72i6rxvbfqbq6f5anzbbmhmrmr7mprna4dy93d7q";
       type = "gem";
     };
-    version = "17.11.2";
+    version = "17.11.3";
   };
   gitlab-labkit = {
     dependencies = [
@@ -3152,10 +3156,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1gip6bgsh6b284sjlz24ljydshsa9p5ikizwrmb82gnsc46dcsmk";
+      sha256 = "0b4908vic675qq1mh1i45vh5z9vdg1ynanxdbdzaazxvjkakdwzd";
       type = "gem";
     };
-    version = "0.26.1";
+    version = "0.29.1";
   };
   gitlab-security_report_schemas = {
     dependencies = [
@@ -3656,10 +3660,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1afriizkvwwcyh0s0j1x9d9045pn4f767gpj5q49hicsqz8flq58";
+      sha256 = "1dsj349xm6jmd94xix8bgdn5m8jqqk9bsivlm9fll8ifa008ab0h";
       type = "gem";
     };
-    version = "3.25.7";
+    version = "3.25.8";
   };
   googleapis-common-protos = {
     dependencies = [
@@ -3685,10 +3689,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "152nfvcnj1i1gsphhs7mhxzd0wa9pjdjb0xhgb2bry16ag57djxf";
+      sha256 = "0zyh9pxsw4zwv3iissirwqnx98qzkywqf3bwdrai6zpwph34ndsy";
       type = "gem";
     };
-    version = "1.19.0";
+    version = "1.20.0";
   };
   googleauth = {
     dependencies = [
@@ -3882,10 +3886,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11ink0ayf14qgs3msn5a7dpg49vm3ck2415r64nfk1i8xv286hsz";
+      sha256 = "02gakdhvpl777b41i8cgkrj7gk0jlq4fza9hjksp2r7ryji0vyjn";
       type = "gem";
     };
-    version = "1.63.0";
+    version = "1.72.0";
   };
   grpc-google-iam-v1 = {
     dependencies = [
@@ -4203,10 +4207,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v7s60abgwkahkqi4lf68hmz3j69jli3q25jsf9h1kvijif2lrbq";
+      sha256 = "0mbbjr774zxb2wcpbwc93l0i481bxk7ga5hpap76w3q1y9idvh9s";
       type = "gem";
     };
-    version = "0.22.0";
+    version = "0.23.1";
   };
   httpclient = {
     groups = [ "default" ];
@@ -4410,10 +4414,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09645h5an19zc1i7wlmixszj8xxqb2zc8qlf8dmx39bxpas1l24b";
+      sha256 = "14xkw4lb6wwvbcwqkf6ds116sridk9c8yz6y3caw07vzpwdvcmn0";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.1";
   };
   jira-ruby = {
     dependencies = [
@@ -4693,10 +4697,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09m8m65iyk8d1y0g52srl7994c80f8ai33z8flbzhsjqr2wy17rh";
+      sha256 = "18msiw0b3krm9krxrahiladblh6pjpj395wcjjw2fvsimwyy7vk4";
       type = "gem";
     };
-    version = "1.11.5";
+    version = "1.11.13";
   };
   letter_opener = {
     dependencies = [ "launchy" ];
@@ -4838,15 +4842,16 @@ src: {
       "danger"
       "default"
       "development"
+      "monorepo"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   lograge = {
     dependencies = [
@@ -4878,10 +4883,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "07pfa5kgl7k2hxlzzn89qna6bmiyrxlchgbzi0885frsi08agrk1";
+      sha256 = "0dx316q03x6rpdbl610rdaj2vfd5s8fanixk21j4gv3h5f230nk5";
       type = "gem";
     };
-    version = "2.24.0";
+    version = "2.24.1";
   };
   lookbook = {
     dependencies = [
@@ -5561,6 +5566,7 @@ src: {
     dependencies = [
       "faraday"
       "jwt"
+      "logger"
       "multi_xml"
       "rack"
       "snaky_hash"
@@ -5570,10 +5576,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yzpaghh8kwzgmvmrlbzf36ks5s2hf34rayzw081dp2jrzprs7xj";
+      sha256 = "0hisvj04523xsq0cmaw2lzwjj2pgwvkxfs6c9dfqh8cdb5wjc4wg";
       type = "gem";
     };
-    version = "2.0.9";
+    version = "2.0.10";
   };
   observer = {
     groups = [
@@ -5640,10 +5646,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0z1xw7xm7xkxnslhxqvfzvv5f1q1cl40niwvaxny2cg3fkcvw9kz";
+      sha256 = "1cajn3ylwhby1x51d9hbchm964qwb5zp63f7sfdm55n85ffn1ara";
       type = "gem";
     };
-    version = "3.16.10";
+    version = "3.16.11";
   };
   oj-introspect = {
     dependencies = [ "oj" ];
@@ -6523,10 +6529,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vy7sjs2pgz4i96v5yk9b7aafbffnvq7nn419fgvw55qlavsnsyq";
+      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
       type = "gem";
     };
-    version = "1.26.3";
+    version = "1.27.0";
   };
   parser = {
     dependencies = [
@@ -6792,10 +6798,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0120712ar9cmjgyqrihf36pcslx8m73gp0l86dfw8yvn8gs9xzr0";
+      sha256 = "0i0l7v26vq8k6wvsfk9fzpswilbg4214d9p9xc87kmswl1kwxm26";
       type = "gem";
     };
-    version = "1.2.9";
+    version = "1.2.10";
   };
   pry = {
     dependencies = [
@@ -6904,10 +6910,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wl9q4fl8gvhwdpfxghx6jdqi4508287pcgiwi96sdbzmdfbglcl";
+      sha256 = "11xd3207k5rl6bz0qxhcb3zcr941rhx7ig2f19gxxmdk7s3hcp7j";
       type = "gem";
     };
-    version = "6.5.0";
+    version = "6.6.0";
   };
   pyu-ruby-sasl = {
     groups = [ "default" ];
@@ -7659,10 +7665,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pchwrkr0994v7mh054lcp0na3bk3mj2sk0dc33bn6bhxrnirj1a";
+      sha256 = "18v8if3jix029rr3j8iwisv73facw223353n0h7avl39ibxk6hh3";
       type = "gem";
     };
-    version = "4.5.1";
+    version = "4.5.2";
   };
   rqrcode = {
     dependencies = [
@@ -7845,10 +7851,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ycjggcmzbgrfjk04v26b43c3fj5jq2qic911qk7585wvav2qaxd";
+      sha256 = "0cg3ay2jin7jv20carhx3icv3gnwka0hqcr15zcjy7i1xnmwqpg1";
       type = "gem";
     };
-    version = "7.0.1";
+    version = "7.1.1";
   };
   rspec-retry = {
     dependencies = [ "rspec-core" ];
@@ -8082,10 +8088,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17z0hi70s201gxw251hgv4r9zmfky2jlmp3pwma7hixsfpkx6gay";
+      sha256 = "0s97zck9v2c1awk4lbj5ccsnn6p0jp018mrq12fvh5hp00sn3586";
       type = "gem";
     };
-    version = "0.23.15";
+    version = "0.23.20";
   };
   ruby-lsp-rails = {
     dependencies = [ "ruby-lsp" ];
@@ -8104,10 +8110,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h2rnylicx9cw2agrxzgxcr0bl2ac8iy99sz7w657hbfrpsyv0p9";
+      sha256 = "1lv886262vzmjpgcd0759zn86yaidjn1wznnscn75saj4d81bafj";
       type = "gem";
     };
-    version = "0.1.22";
+    version = "0.1.23";
   };
   ruby-magic = {
     dependencies = [ "mini_portile2" ];
@@ -8206,10 +8212,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
+      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
       type = "gem";
     };
-    version = "2.3.2";
+    version = "2.4.1";
   };
   rugged = {
     groups = [
@@ -8352,10 +8358,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q5nbszbxz566yzyiv0a4lvfk56q89k0lk4mqp6wyddrc2nz88c8";
+      sha256 = "1zlamvlgszczfx2f2v1b34q0lka15cqj46krwb4ymgl6nlkxznr0";
       type = "gem";
     };
-    version = "4.27.0";
+    version = "4.32.0";
   };
   semver_dialects = {
     dependencies = [
@@ -8687,10 +8693,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mkc1fxz4anv7fcq9jn26dc5ppwriand778f9dklzrpgq9pga8py";
+      sha256 = "1q40v3xrx8zzcpk84mcb4f80zc49vp98pphlffb5w20sa760a9w4";
       type = "gem";
     };
-    version = "0.54.2";
+    version = "0.54.4";
   };
   solargraph-rspec = {
     dependencies = [ "solargraph" ];
@@ -9643,10 +9649,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "104s7p4zp5yvf0bvbwd9mqmnkgz2z89h4hbvxi8pzd8d08c9a03b";
+      sha256 = "0270m29n7mq9yq4xnjzryzr6jxf292ahjn9fzywm2rg3rdz7cr59";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.8";
   };
   version_sorter = {
     groups = [ "default" ];
@@ -9671,10 +9677,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0p6z21kqz05966l77rfj7hdmhb6drld7qaxdbx4qawwylay7fnkz";
+      sha256 = "0aw962shs2x52dy1vhzkw1qc0b5vxmgaab6lld7hggrqkr5ysbrw";
       type = "gem";
     };
-    version = "3.21.0";
+    version = "3.23.2";
   };
   virtus = {
     dependencies = [
@@ -9807,10 +9813,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "13hrfja9as50ymbzsmlqsnv3ijirnf6mini21y1qq04793y26g2p";
+      sha256 = "08v374yrqqhjj3xjzmvwnv3yz21r22kn071yr0i67gmwaf9mv7db";
       type = "gem";
     };
-    version = "3.25.0";
+    version = "3.25.1";
   };
   webrick = {
     groups = [
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 57cb365205e6..bdb3c6ec8316 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "79dfd9aa295e53773aad45480b44c131da29f35b";
-    hash = "sha256-X3WAS322EsebI4ohJcXhKpiyG1v+7wE4VOiXy1pxM/c=";
+    rev = "7c35504839f915abec86a96435b881ead7eb6a2b";
+    hash = "sha256-6WH0aRFay79r775RuTqUcnoZNm6A4uHxU1sbcNIk63s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ja/jasmin-compiler/package.nix b/pkgs/by-name/ja/jasmin-compiler/package.nix
index c9d3350ea293..78617d04a8bd 100644
--- a/pkgs/by-name/ja/jasmin-compiler/package.nix
+++ b/pkgs/by-name/ja/jasmin-compiler/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jasmin-compiler";
-  version = "2025.02.1";
+  version = "2025.06.0";
 
   src = fetchurl {
     url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    hash = "sha256-7WGEtsTJ4/R+30gzFlYpCvZrZyziZ6gDCemWEFX+5hk=";
+    hash = "sha256-VjWNvg/aF+omobF8b4YpRwVYM5K/b0GLoe1P/83ilk8=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
diff --git a/pkgs/by-name/ka/kaniko/package.nix b/pkgs/by-name/ka/kaniko/package.nix
index a56e73a5f064..26541d4ed24b 100644
--- a/pkgs/by-name/ka/kaniko/package.nix
+++ b/pkgs/by-name/ka/kaniko/package.nix
@@ -6,17 +6,18 @@
   installShellFiles,
   testers,
   kaniko,
+  versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "kaniko";
-  version = "1.24.0";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
-    owner = "GoogleContainerTools";
+    owner = "chainguard-dev";
     repo = "kaniko";
-    rev = "v${version}";
-    hash = "sha256-Y/sdbLcmBxUBU9io1RV/CnbuBN4I334BWUDeBoHFRm8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6WOczDWIbxFH9OLMQ+KirUEwPeiq3vFm3MdQQk9D+po=";
   };
 
   vendorHash = null;
@@ -24,29 +25,34 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/GoogleContainerTools/kaniko/pkg/version.version=${version}"
+    "-X github.com/chainguard-dev/kaniko/pkg/version.version=${finalAttrs.version}"
   ];
 
+  excludedPackages = [ "hack/release_notes" ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   doCheck = false; # requires docker, container-diff (unpackaged yet)
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    for shell in bash fish zsh; do
-      $out/bin/executor completion $shell > executor.$shell
-      installShellCompletion executor.$shell
-    done
-  '';
+  postInstall =
+    let
+      inherit (finalAttrs.meta) mainProgram;
+    in
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      for shell in bash fish zsh; do
+        $out/bin/${mainProgram} completion $shell > ${mainProgram}.$shell
+        installShellCompletion ${mainProgram}.$shell
+      done
+    '';
 
-  passthru.tests.version = testers.testVersion {
-    package = kaniko;
-    version = version;
-    command = "${kaniko}/bin/executor version";
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
 
   meta = {
     description = "Tool to build container images from a Dockerfile, inside a container or Kubernetes cluster";
-    homepage = "https://github.com/GoogleContainerTools/kaniko";
+    homepage = "https://github.com/chainguard-dev/kaniko";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
@@ -55,4 +61,4 @@ buildGoModule rec {
     ];
     mainProgram = "executor";
   };
-}
+})
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index f5dd9850902a..ba0571bf782d 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.17";
+  version = "11.18";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-GPuor0A9NsObRr66HUYXCQJmM2EW87FyeMJiwB/K6Vc=";
+    hash = "sha256-RkxnV9b7gzZgRl5YaMwwVkOJwdtEFwyZRvQw/B1CciM=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index cf9efdfc0b45..3b46fe46c70d 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -9,14 +9,14 @@
 
 buildGoModule rec {
   pname = "museum";
-  version = "1.0.10";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-CX12JrKlI7FMizk29LXO5e5i7pmgjzni/RY97020UZg=";
+    hash = "sha256-1LG8JcZxG4zWSQ9qQCRQwuXfL5HY9rOQKK2n5erq/kU=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";
diff --git a/pkgs/by-name/ne/nezha/package.nix b/pkgs/by-name/ne/nezha/package.nix
index 48509c03fdef..6dd38fffd15d 100644
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@@ -14,7 +14,7 @@
 
 let
   pname = "nezha";
-  version = "1.12.4";
+  version = "1.13.0";
 
   frontendName = lib.removePrefix "nezha-theme-";
 
@@ -58,7 +58,7 @@ buildGo124Module {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${version}";
-    hash = "sha256-f9zP9koWjP8PPtQhbYx56J1mW8+xKuZCfxgOLw6XGc0=";
+    hash = "sha256-lZN9ZH70AzDCtvFnr2dxjXSKhGd/+HvN9hCydlOYpKU=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/no/noto-fonts-color-emoji/package.nix b/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
index d5a9874ded54..ef2a82f0a959 100644
--- a/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
+++ b/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts-color-emoji";
-  version = "2.047";
+  version = "2.048";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "noto-emoji";
     rev = "v${version}";
-    hash = "sha256-v1vLXs8peNF6S7iBLViAWQSW042lwIDqAjB270pRPF0=";
+    hash = "sha256-GYBnMpSUDNjAOZtbRPSmbW39TWP5ljEMukQRwq4J9U4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index fd2794345816..2df334577e59 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -31,9 +31,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "25.04.20.01";
-  buildId = "4758"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "10e01bf182e51d1fc2b6060622108a1fb98ae7b7";
+  version = "25.06.17.01";
+  buildId = "4899"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "dc90221a4528e92e147de5746a6657d87b1856fa";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -44,7 +44,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-7Xdd6AdDpHQUmQ3ogEyir/OQwvOcVDMtweE3D/v4uuQ=";
+    hash = "sha256-s73gIjqxTloYr5gwL9fHPhBh+fq5d1RFp8PeLe6bI84=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/om/omnom/0001-fix-minimal-go-version.patch b/pkgs/by-name/om/omnom/0001-fix-minimal-go-version.patch
deleted file mode 100644
index 64f63f1bf6ff..000000000000
--- a/pkgs/by-name/om/omnom/0001-fix-minimal-go-version.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-Bump the minimal Go version as some features require Go 1.17 and higher to work
-
----
- go.mod | 48 ++++++++++++++++++++++++++++++++++++++----------
- 1 file changed, 38 insertions(+), 10 deletions(-)
-
-diff --git a/go.mod b/go.mod
-index 1756ffe..81f7fa2 100644
---- a/go.mod
-+++ b/go.mod
-@@ -1,31 +1,59 @@
- module github.com/asciimoo/omnom
-
--go 1.15
-+go 1.17
-
- require (
--	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
--	github.com/bytedance/sonic v1.12.1 // indirect
--	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
- 	github.com/gin-contrib/multitemplate v1.0.1
- 	github.com/gin-gonic/contrib v0.0.0-20240508051311-c1c6bf0061b0
- 	github.com/gin-gonic/gin v1.10.0
-+	github.com/spf13/cobra v1.8.1
-+	github.com/xhit/go-simple-mail/v2 v2.16.0
-+	golang.org/x/net v0.27.0
-+	gopkg.in/yaml.v2 v2.4.0
-+	gorm.io/driver/sqlite v1.5.6
-+	gorm.io/gorm v1.25.11
-+)
-+
-+require (
-+	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
-+	github.com/bytedance/sonic v1.12.1 // indirect
-+	github.com/bytedance/sonic/loader v0.2.0 // indirect
-+	github.com/cloudwego/base64x v0.1.4 // indirect
-+	github.com/cloudwego/iasm v0.2.0 // indirect
-+	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
-+	github.com/gin-contrib/sse v0.1.0 // indirect
-+	github.com/go-playground/locales v0.14.1 // indirect
-+	github.com/go-playground/universal-translator v0.18.1 // indirect
- 	github.com/go-playground/validator/v10 v10.22.0 // indirect
- 	github.com/go-test/deep v1.1.1 // indirect
- 	github.com/goccy/go-json v0.10.3 // indirect
-+	github.com/gomodule/redigo v2.0.0+incompatible // indirect
-+	github.com/google/go-cmp v0.6.0 // indirect
- 	github.com/gorilla/context v1.1.2 // indirect
-+	github.com/gorilla/securecookie v1.1.2 // indirect
- 	github.com/gorilla/sessions v1.3.0 // indirect
-+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-+	github.com/jinzhu/inflection v1.0.0 // indirect
-+	github.com/jinzhu/now v1.1.5 // indirect
-+	github.com/json-iterator/go v1.1.12 // indirect
- 	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
- 	github.com/kr/pretty v0.3.0 // indirect
-+	github.com/leodido/go-urn v1.4.0 // indirect
-+	github.com/mattn/go-isatty v0.0.20 // indirect
-+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
-+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-+	github.com/modern-go/reflect2 v1.0.2 // indirect
-+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
- 	github.com/rogpeppe/go-internal v1.8.0 // indirect
--	github.com/spf13/cobra v1.8.1
-+	github.com/spf13/pflag v1.0.5 // indirect
- 	github.com/toorop/go-dkim v0.0.0-20240103092955-90b7d1423f92 // indirect
--	github.com/xhit/go-simple-mail/v2 v2.16.0
-+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-+	github.com/ugorji/go/codec v1.2.12 // indirect
- 	golang.org/x/arch v0.9.0 // indirect
--	golang.org/x/net v0.27.0
-+	golang.org/x/crypto v0.25.0 // indirect
- 	golang.org/x/sys v0.23.0 // indirect
-+	golang.org/x/text v0.16.0 // indirect
- 	google.golang.org/protobuf v1.34.2 // indirect
- 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
--	gopkg.in/yaml.v2 v2.4.0
--	gorm.io/driver/sqlite v1.5.6
--	gorm.io/gorm v1.25.11
-+	gopkg.in/yaml.v3 v3.0.1 // indirect
- )
---
-2.45.2
-
diff --git a/pkgs/by-name/om/omnom/package.nix b/pkgs/by-name/om/omnom/package.nix
index 9e4076306615..8074a8ce4f94 100644
--- a/pkgs/by-name/om/omnom/package.nix
+++ b/pkgs/by-name/om/omnom/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   makeWrapper,
+  nixosTests,
 
   # for addons
   buildNpmPackage,
@@ -12,22 +13,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "omnom";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "asciimoo";
     repo = "omnom";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2D+hEOlyjCJQKnLBBO1cXeqTS/QUWraPWPtI8pCf9KM=";
+    hash = "sha256-xspzTRIYUJSdI2Z/FAS2ecLpEEmEVGIwlhjrS5Yxh2c=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-dsS5w8JXIwkneWScOFzLSDiXq+clgK+RdYiMw0+FnvY=";
+  vendorHash = "sha256-qOl6f83k91K7YNF7lBbL66lXb/XWbGHyXeN7ZTchsI8=";
 
   passthru.updateScript = nix-update-script { };
 
-  patches = [ ./0001-fix-minimal-go-version.patch ];
-
   nativeBuildInputs = [ makeWrapper ];
 
   ldflags = [
@@ -47,6 +46,12 @@ buildGoModule (finalAttrs: {
 
         nativeBuildInputs = [ zip ];
 
+        # Fix path for the `static` directory
+        postConfigure = ''
+          substituteInPlace webpack.config.js \
+          --replace-fail '"..", ".."' '".."'
+        '';
+
         postBuild = ''
           mkdir -p $out
 
@@ -77,6 +82,8 @@ buildGoModule (finalAttrs: {
     cp config.yml_sample $out/share/examples/config.yml
   '';
 
+  passthru.tests = nixosTests.omnom;
+
   meta = {
     description = "Webpage bookmarking and snapshotting service";
     homepage = "https://github.com/asciimoo/omnom";
diff --git a/pkgs/by-name/ou/ouch/package.nix b/pkgs/by-name/ou/ouch/package.nix
index 539f64907e9b..f3574b3d23a1 100644
--- a/pkgs/by-name/ou/ouch/package.nix
+++ b/pkgs/by-name/ou/ouch/package.nix
@@ -10,6 +10,10 @@
   git,
   zlib,
   zstd,
+
+  # RAR code is under non-free unRAR license
+  # see the meta.license section below for more details
+  enableUnfree ? false,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -44,7 +48,17 @@ rustPlatform.buildRustPackage rec {
     zstd
   ];
 
-  buildFeatures = [ "zstd/pkg-config" ];
+  buildNoDefaultFeatures = true;
+  buildFeatures =
+    [
+      "use_zlib"
+      "use_zstd_thin"
+      # "bzip3" will be optional in the next version
+      "zstd/pkg-config"
+    ]
+    ++ lib.optionals enableUnfree [
+      "unrar"
+    ];
 
   postInstall = ''
     installManPage artifacts/*.1
@@ -57,7 +71,7 @@ rustPlatform.buildRustPackage rec {
     description = "Command-line utility for easily compressing and decompressing files and directories";
     homepage = "https://github.com/ouch-org/ouch";
     changelog = "https://github.com/ouch-org/ouch/blob/${version}/CHANGELOG.md";
-    license = lib.licenses.mit;
+    license = with lib.licenses; [ mit ] ++ lib.optionals enableUnfree [ unfreeRedistributable ];
     maintainers = with lib.maintainers; [
       figsoda
       psibi
diff --git a/pkgs/by-name/si/sillytavern/package.nix b/pkgs/by-name/si/sillytavern/package.nix
index 160e2bd5e64f..79bbd55a1d0b 100644
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@@ -7,15 +7,15 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "sillytavern";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "SillyTavern";
     repo = "SillyTavern";
     tag = finalAttrs.version;
-    hash = "sha256-HUlypAPadlad12J60Xfa30qE18II6MceVYkMqANWlyI=";
+    hash = "sha256-rWDJBuGzgG34jpsBPdLqIegcOfV3bRyOdulRsMS2mhg=";
   };
-  npmDepsHash = "sha256-IZMwDgazY+6oyuOlE7zdWcDn5D2/8v2mHX9yDBwK+4I=";
+  npmDepsHash = "sha256-DyqAaaeSCAdsKXWUo1t4FpUuqu1n4TfZBLg23URuNUM=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index b6d12ac41cae..f053dc50e6df 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -14,7 +14,7 @@
 
 python312Packages.buildPythonApplication rec {
   pname = "snapcraft";
-  version = "8.9.4";
+  version = "8.9.5";
 
   pyproject = true;
 
@@ -22,7 +22,7 @@ python312Packages.buildPythonApplication rec {
     owner = "canonical";
     repo = "snapcraft";
     tag = version;
-    hash = "sha256-iiz+sVncztaCNndU+4YMhxECw7R6ks+25apRnd0WgyM=";
+    hash = "sha256-bwk9wK8fIXhhmj4XdtpTzZfzZkAtETpfMleTrbYt6Ww=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index bff98d0f0b97..9ce46e47ab7c 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -14,13 +14,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "snx-rs";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${version}";
-    hash = "sha256-dGK+52sOyJs4P3SfTdjPPSbBgSyVGFHcNw45Jed6aVo=";
+    hash = "sha256-FVrj26pQthy6gY6UWXD4ACvy0/PPLXM0zrGOIjXl07U=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9yZ8TSWy+S1sNS4cnJvEi7Ttt8zqF4PkxR5/FzVg4Ds=";
+  cargoHash = "sha256-ZzVTl1IVTAut+7o9QXaPDk8QCemRt2EoYX/Wi0RXJ3U=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 82845e00ca8b..a0e7745f0ba3 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.45";
+  version = "3.15.48";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-ONPW+AAFSeG808KUyGpvIYrnKrCu9WLoLkrxsaYPD5o=";
+    hash = "sha256-nUwtgfOf/JialxNHwTT9JAYZtdGZevVPKLwpLrU8T5A=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ta/task-master-ai/package.nix b/pkgs/by-name/ta/task-master-ai/package.nix
index 9a5e2ad84825..a726c6343059 100644
--- a/pkgs/by-name/ta/task-master-ai/package.nix
+++ b/pkgs/by-name/ta/task-master-ai/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  nodejs,
   nix-update-script,
 }:
 buildNpmPackage (finalAttrs: {
@@ -19,6 +20,8 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmBuild = true;
 
+  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ nodejs ]}" ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/to/tombi/package.nix b/pkgs/by-name/to/tombi/package.nix
index f6a9a8e01d01..4ca2f3657fc2 100644
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "0.4.9";
+  version = "0.4.13";
 
   src = fetchFromGitHub {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2516aT6zaI5bntjjJ/p/yk0gWW6fzixQx5ESs29aS6Q=";
+    hash = "sha256-DYr9RtWV2Fs1YGQ5V00eACLerJSsm34mPYdmVWRKXSQ=";
   };
 
   # Tests relies on the presence of network
   doCheck = false;
   cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-cVj0dL9vGVm3WPQ5IA2LDxDLHia5T+pLi6rTQxAqoC4=";
+  cargoHash = "sha256-JyYA/Bu1gcj7s5hxx9LOcrN28Klhz3Qy1SbGoWEiwnA=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \
diff --git a/pkgs/by-name/un/uncover/package.nix b/pkgs/by-name/un/uncover/package.nix
index 2cb350cf6750..208951568d45 100644
--- a/pkgs/by-name/un/uncover/package.nix
+++ b/pkgs/by-name/un/uncover/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "uncover";
-  version = "1.0.10";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "uncover";
     tag = "v${version}";
-    hash = "sha256-q8ecgTY2uDo4O+/CqK9aYnYb4oArDIvga9C/tG9IooE=";
+    hash = "sha256-BRh25lvk3Zut5M6dedLuSET4514R9j0fUHmamw4rp5U=";
   };
 
-  vendorHash = "sha256-Pm3CFHdp0VHZ5tRrjnpXXaIwQFu7EXyVgo/K9OOqHBI=";
+  vendorHash = "sha256-6TvPKp/P0v/ZJRGRICp77C/8FHupyr9Hy2+zlYc2HIU=";
 
   subPackages = [ "cmd/uncover" ];
 
diff --git a/pkgs/by-name/wl/wlr-which-key/package.nix b/pkgs/by-name/wl/wlr-which-key/package.nix
index fa49d11db5e0..77db14b541aa 100644
--- a/pkgs/by-name/wl/wlr-which-key/package.nix
+++ b/pkgs/by-name/wl/wlr-which-key/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wlr-which-key";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "MaxVerevkin";
     repo = "wlr-which-key";
     rev = "v${version}";
-    hash = "sha256-BEf1qpy0bVPi5nmu3UUiv8k0bJvE5VFB5Zqb5lS0+t4=";
+    hash = "sha256-P7DtSTyAfgACEfpnxYXhQ+Rvdw4rg2hFllCN1mEGfJQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-409PW1Ya38imGqtrVqOI50yJa49/RjB68yGQZSvyYd0=";
+  cargoHash = "sha256-yH05tpJiEDP0qEhDY3dpf2cxYeJYVOvOQyfcgg2vPQk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/wo/worldpainter/package.nix b/pkgs/by-name/wo/worldpainter/package.nix
index 22c13cf57525..0a4bc65c2e3f 100644
--- a/pkgs/by-name/wo/worldpainter/package.nix
+++ b/pkgs/by-name/wo/worldpainter/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "worldpainter";
-  version = "2.24.1";
+  version = "2.24.2";
 
   src = fetchurl {
     url = "https://www.worldpainter.net/files/${pname}_${version}.tar.gz";
-    hash = "sha256-I7bf+BKaHSsR08stLtJu+wY5ek8cj+SjRVwu+RwqEq0=";
+    hash = "sha256-tY4K8yNPRrNU4u5rpPy/sPyOh2NhvlbqXbj8WNLVRq4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/dolmen/linol-common-migration.patch b/pkgs/development/ocaml-modules/dolmen/linol-common-migration.patch
new file mode 100644
index 000000000000..cad42e5eb8a3
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dolmen/linol-common-migration.patch
@@ -0,0 +1,137 @@
+diff --git i/src/lsp/diagnostic.ml w/src/lsp/diagnostic.ml
+index 149cde11..bd93298a 100644
+--- i/src/lsp/diagnostic.ml
++++ w/src/lsp/diagnostic.ml
+@@ -1,13 +1,12 @@
+-
+ (* This file is free software, part of dolmen. See file "LICENSE" for more information *)
+ 
+-type t = Lsp.Types.Diagnostic.t
++type t = Linol__.Common_.Lsp.Types.Diagnostic.t
+ 
+ let lsp_pos line character =
+-  Lsp.Types.Position.create ~line ~character
++  Linol__.Common_.Lsp.Types.Position.create ~line ~character
+ 
+ let lsp_range start end_ =
+-  Lsp.Types.Range.create ~start ~end_
++  Linol__.Common_.Lsp.Types.Range.create ~start ~end_
+ 
+ let start_pos = lsp_pos 1 1
+ let start_range = lsp_range start_pos start_pos
+@@ -23,17 +22,15 @@ let range_of_loc = function
+         (lsp_pos (l.stop_line - 1) l.stop_column)
+ 
+ let warn ?loc message =
+-  Lsp.Types.Diagnostic.create ()
++  Linol__.Common_.Lsp.Types.Diagnostic.create ()
+     ~range:(range_of_loc loc)
+     ~severity:Warning
+     ~source:"dolmenls"
+     ~message
+ 
+ let error ?loc message =
+-  Lsp.Types.Diagnostic.create ()
++  Linol__.Common_.Lsp.Types.Diagnostic.create ()
+     ~range:(range_of_loc loc)
+     ~severity:Error
+     ~source:"dolmenls"
+     ~message
+-
+-
+diff --git i/src/lsp/main.ml w/src/lsp/main.ml
+index 8d6fc760..b52dd25c 100644
+--- i/src/lsp/main.ml
++++ w/src/lsp/main.ml
+@@ -3,7 +3,7 @@
+ 
+ let run () =
+   let s = new Server.dolmen_lsp_server in
+-  let server = Linol_lwt.Jsonrpc2.create_stdio s in
++  let server = Linol_lwt.Jsonrpc2.create_stdio ~env:() s in
+   let task = Linol_lwt.Jsonrpc2.run server in
+   match Linol_lwt.run task with
+   | () -> ()
+diff --git i/src/lsp/server.ml w/src/lsp/server.ml
+index e895cc6a..a01ed9fb 100644
+--- i/src/lsp/server.ml
++++ w/src/lsp/server.ml
+@@ -44,25 +44,28 @@ class dolmen_lsp_server =
+   object(self)
+     inherit Linol_lwt.Jsonrpc2.server
+ 
++    method spawn_query_handler f = Linol_lwt.spawn f
++
+     (* one env per document *)
+-    val buffers: (Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
++    val buffers: (Linol__.Common_.Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
+ 
+     (* A list of include statements of the prelude files *)
+     val mutable prelude = []
+ 
+     method! config_sync_opts =
+       (* configure how sync happens *)
+-      let change = Lsp.Types.TextDocumentSyncKind.Incremental in
+-      (* Lsp.Types.TextDocumentSyncKind.Full *)
+-      Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
+-        ~save:(Lsp.Types.SaveOptions.create ~includeText:false ())
++      let change = Linol__.Common_.Lsp.Types.TextDocumentSyncKind.Incremental in
++      (* Linol__.Common_.Lsp.Types.TextDocumentSyncKind.Full *)
++      Linol__.Common_.Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
++        ~save:(`SaveOptions (Linol__.Common_.Lsp.Types.SaveOptions.create ~includeText:false ()))
+         ()
+ 
+     method private _on_doc
+         ~(notify_back:Linol_lwt.Jsonrpc2.notify_back)
+-        (uri:Lsp.Types.DocumentUri.t) (contents:string) =
++        (uri:Linol__.Common_.Lsp.Types.DocumentUri.t) (contents:string) =
+       (* TODO: unescape uri/translate it to a correct path ? *)
+-      match Loop.process prelude (preprocess_uri uri) (Some contents) with
++      let uri_path = Linol__.Common_.Lsp.Uri.to_path uri in
++      match Loop.process prelude (preprocess_uri uri_path) (Some contents) with
+       | Ok state ->
+         let diags = State.get State.diagnostics state in
+         Hashtbl.replace buffers uri state;
+@@ -79,9 +82,9 @@ class dolmen_lsp_server =
+       self#_on_doc ~notify_back d.uri new_content
+ 
+     method! on_notification_unhandled
+-        ~notify_back:_ (n:Lsp.Client_notification.t) =
++        ~notify_back:_ (n:Linol__.Common_.Lsp.Client_notification.t) =
+       match n with
+-      | Lsp.Client_notification.ChangeConfiguration { settings; } ->
++      | Linol__.Common_.Lsp.Client_notification.ChangeConfiguration { settings; } ->
+         begin try
+             prelude <- mk_prelude (parse_settings settings);
+             Linol_lwt.Jsonrpc2.IO.return ()
+@@ -89,7 +92,7 @@ class dolmen_lsp_server =
+             Linol_lwt.Jsonrpc2.IO.failwith s
+         end
+       | _ ->
+-        Lwt.return ()
++        Linol_lwt.Jsonrpc2.IO.return ()
+ 
+     method on_notif_doc_did_close ~notify_back d =
+       Hashtbl.remove buffers d.uri;
+diff --git i/src/lsp/state.ml w/src/lsp/state.ml
+index f3e89640..3f8a36ab 100644
+--- i/src/lsp/state.ml
++++ w/src/lsp/state.ml
+@@ -45,7 +45,7 @@ let warn ?file:_ ?loc t warn payload =
+   in
+   Format.kfprintf (fun _ ->
+       let msg = Format.flush_str_formatter () in
+-      let d = Diagnostic.warn ~loc msg in
++      let d = Diagnostic.warn ~loc (`String msg) in
+       add_diag d t) Format.str_formatter "%a"
+     Dolmen_loop.Report.Warning.print (warn, payload)
+ 
+@@ -67,7 +67,7 @@ let error ?file:_ ?loc t err payload =
+   (* Print the error message *)
+   Format.kfprintf (fun _ ->
+       let msg = Format.flush_str_formatter () in
+-      let d = Diagnostic.error ~loc msg in
++      let d = Diagnostic.error ~loc (`String msg) in
+       add_diag d t) Format.str_formatter "%a"
+     Dolmen_loop.Report.Error.print (err, payload)
+ 
diff --git a/pkgs/development/ocaml-modules/dolmen/linol-lwt-6.patch b/pkgs/development/ocaml-modules/dolmen/linol-lwt-6.patch
deleted file mode 100644
index b92bfa46cd66..000000000000
--- a/pkgs/development/ocaml-modules/dolmen/linol-lwt-6.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/src/lsp/main.ml b/src/lsp/main.ml
-index 8d6fc760..b52dd25c 100644
---- a/src/lsp/main.ml
-+++ b/src/lsp/main.ml
-@@ -3,7 +3,7 @@
- 
- let run () =
-   let s = new Server.dolmen_lsp_server in
--  let server = Linol_lwt.Jsonrpc2.create_stdio s in
-+  let server = Linol_lwt.Jsonrpc2.create_stdio ~env:() s in
-   let task = Linol_lwt.Jsonrpc2.run server in
-   match Linol_lwt.run task with
-   | () -> ()
-diff --git a/src/lsp/server.ml b/src/lsp/server.ml
-index e895cc6a..c9a3f237 100644
---- a/src/lsp/server.ml
-+++ b/src/lsp/server.ml
-@@ -44,6 +44,8 @@ class dolmen_lsp_server =
-   object(self)
-     inherit Linol_lwt.Jsonrpc2.server
- 
-+    method spawn_query_handler _ = ()
-+
-     (* one env per document *)
-     val buffers: (Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
- 
-@@ -55,14 +57,14 @@ class dolmen_lsp_server =
-       let change = Lsp.Types.TextDocumentSyncKind.Incremental in
-       (* Lsp.Types.TextDocumentSyncKind.Full *)
-       Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
--        ~save:(Lsp.Types.SaveOptions.create ~includeText:false ())
-+        ~save:(`SaveOptions (Lsp.Types.SaveOptions.create ~includeText:false ()))
-         ()
- 
-     method private _on_doc
-         ~(notify_back:Linol_lwt.Jsonrpc2.notify_back)
-         (uri:Lsp.Types.DocumentUri.t) (contents:string) =
-       (* TODO: unescape uri/translate it to a correct path ? *)
--      match Loop.process prelude (preprocess_uri uri) (Some contents) with
-+      match Loop.process prelude (preprocess_uri (Lsp.Types.DocumentUri.to_string uri)) (Some contents) with
-       | Ok state ->
-         let diags = State.get State.diagnostics state in
-         Hashtbl.replace buffers uri state;
diff --git a/pkgs/development/ocaml-modules/dolmen/lsp.nix b/pkgs/development/ocaml-modules/dolmen/lsp.nix
index 5d92bd1278ed..97bb68cdd746 100644
--- a/pkgs/development/ocaml-modules/dolmen/lsp.nix
+++ b/pkgs/development/ocaml-modules/dolmen/lsp.nix
@@ -7,14 +7,14 @@
   linol,
   linol-lwt,
   logs,
-# lsp, # transitive dependency from linol
+  lsp,
 }:
 
 buildDunePackage {
   pname = "dolmen_lsp";
   inherit (dolmen) src version;
 
-  patches = [ ./linol-lwt-6.patch ];
+  patches = [ ./linol-common-migration.patch ];
 
   buildInputs = [
     dolmen
@@ -23,7 +23,7 @@ buildDunePackage {
     linol
     linol-lwt
     logs
-    # lsp # transitive dependency from linol
+    lsp
   ];
 
   meta = dolmen.meta // {
diff --git a/pkgs/development/ocaml-modules/linol/default.nix b/pkgs/development/ocaml-modules/linol/default.nix
index 3d0f513cad5b..7b41c28b9d6a 100644
--- a/pkgs/development/ocaml-modules/linol/default.nix
+++ b/pkgs/development/ocaml-modules/linol/default.nix
@@ -1,37 +1,43 @@
 {
   lib,
-  fetchurl,
+  fetchFromGitHub,
   buildDunePackage,
-  yojson,
   logs,
-  lsp,
   ppx_yojson_conv_lib,
   trace,
+  uutf,
+  yojson,
 }:
 
 buildDunePackage rec {
   pname = "linol";
-  version = "0.6";
+  version = "0.10";
 
   minimalOCamlVersion = "4.14";
 
-  src = fetchurl {
-    url = "https://github.com/c-cube/linol/releases/download/v${version}/linol-${version}.tbz";
-    hash = "sha256-MwEisPJdzZN1VRnssotvExNMYOQdffS+Y2B8ZSUDVfo=";
+  src = fetchFromGitHub {
+    owner = "c-cube";
+    repo = "linol";
+    tag = "v${version}";
+    hash = "sha256-G/5nTJd+MxPgNObKW2Hmmwn4HejQ81c3f4oVXjpNSZg=";
   };
 
   propagatedBuildInputs = [
-    yojson
     logs
-    (lsp.override { version = "1.18.0"; })
     ppx_yojson_conv_lib
     trace
+    uutf
+    yojson
   ];
 
-  meta = with lib; {
+  meta = {
     description = "LSP server library";
-    license = licenses.mit;
-    maintainers = [ maintainers.ulrikstrid ];
     homepage = "https://github.com/c-cube/linol";
+    changelog = "https://raw.githubusercontent.com/c-cube/linol/refs/tags/v${version}/CHANGES.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      stepbrobd
+      ulrikstrid
+    ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/linol/eio.nix b/pkgs/development/ocaml-modules/linol/eio.nix
new file mode 100644
index 000000000000..807f6d744284
--- /dev/null
+++ b/pkgs/development/ocaml-modules/linol/eio.nix
@@ -0,0 +1,21 @@
+{
+  buildDunePackage,
+  eio,
+  linol,
+  yojson,
+}:
+
+buildDunePackage {
+  pname = "linol-eio";
+  inherit (linol) version src;
+
+  propagatedBuildInputs = [
+    eio
+    linol
+    yojson
+  ];
+
+  meta = linol.meta // {
+    description = "LSP server library (with Eio for concurrency)";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/linol/lwt.nix b/pkgs/development/ocaml-modules/linol/lwt.nix
index a8c211be0ba6..f757db90ee6e 100644
--- a/pkgs/development/ocaml-modules/linol/lwt.nix
+++ b/pkgs/development/ocaml-modules/linol/lwt.nix
@@ -1,7 +1,6 @@
 {
   buildDunePackage,
   linol,
-  jsonrpc,
   lwt,
   yojson,
 }:
@@ -12,7 +11,6 @@ buildDunePackage {
 
   propagatedBuildInputs = [
     linol
-    jsonrpc
     lwt
     yojson
   ];
diff --git a/pkgs/development/python-modules/influxdb3-python/default.nix b/pkgs/development/python-modules/influxdb3-python/default.nix
index 27c19da11a9c..da19130dbae4 100644
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "influxdb3-python";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "InfluxCommunity";
     repo = "influxdb3-python";
     tag = "v${version}";
-    hash = "sha256-QYf1XUmnP0nPo5F1nFwVCw7W2CdUCgp7vJNV+QM4pPE=";
+    hash = "sha256-gCLH1MtLYggB3t/+B062w31go5mGf0GELZWhO0DnZy8=";
   };
 
   postPatch = ''
@@ -65,7 +65,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module that provides a simple and convenient way to interact with InfluxDB 3.0";
     homepage = "https://github.com/InfluxCommunity/influxdb3-python";
-    changelog = "https://github.com/InfluxCommunity/influxdb3-python/releases/tag/v${version}";
+    changelog = "https://github.com/InfluxCommunity/influxdb3-python/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/itables/default.nix b/pkgs/development/python-modules/itables/default.nix
index 712ee86840e0..42ad02c9f741 100644
--- a/pkgs/development/python-modules/itables/default.nix
+++ b/pkgs/development/python-modules/itables/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "itables";
-  version = "2.4.0";
+  version = "2.4.2";
 
   # itables has 4 different node packages, each with their own
   # package-lock.json, and partially depending on each other.
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   # the source tarball from pypi, which includes the javascript bundle already.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-S5HASUVfqTny+Vu15MYSSrEffCaJuL7UhDOc3eudVWI=";
+    hash = "sha256-1Qbw0SNTea6kTSoE/BZ46nZL266Mq8OBQb8+pdgLK6I=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/kmapper/default.nix b/pkgs/development/python-modules/kmapper/default.nix
index d0a1d730bbce..895e94b1db51 100644
--- a/pkgs/development/python-modules/kmapper/default.nix
+++ b/pkgs/development/python-modules/kmapper/default.nix
@@ -2,17 +2,24 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
-  scikit-learn,
-  numpy,
-  scipy,
+
+  # dependencies
   jinja2,
-  pytestCheckHook,
-  networkx,
-  matplotlib,
+  numpy,
+  scikit-learn,
+  scipy,
+
+  # tests
+  anywidget,
   igraph,
-  plotly,
   ipywidgets,
+  matplotlib,
+  networkx,
+  plotly,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -30,27 +37,29 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    scikit-learn
-    numpy
-    scipy
     jinja2
+    numpy
+    scikit-learn
+    scipy
   ];
 
   pythonImportsCheck = [ "kmapper" ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    networkx
-    matplotlib
+    anywidget
     igraph
-    plotly
     ipywidgets
+    matplotlib
+    networkx
+    plotly
+    pytestCheckHook
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Python implementation of Mapper algorithm for Topological Data Analysis";
     homepage = "https://kepler-mapper.scikit-tda.org/";
-    license = licenses.mit;
+    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/v${version}";
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 6da656c5f92c..53607e48ef51 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "12.0.1";
+  version = "12.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-mine";
     repo = "mcstatus";
     tag = "v${version}";
-    hash = "sha256-FSXELbEQYUUu2maWBFb5Fj7Y3zXqwmFQRAu+nNco0lQ=";
+    hash = "sha256-DWIpN7oBbb/F5aER0v0qhcQsDoa/EfizjHgy/BE2P6E=";
   };
 
   build-system = [ hatchling ];
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     description = "Python library for checking the status of Minecraft servers";
     mainProgram = "mcstatus";
     homepage = "https://github.com/py-mine/mcstatus";
-    changelog = "https://github.com/py-mine/mcstatus/releases/tag/v${version}";
+    changelog = "https://github.com/py-mine/mcstatus/releases/tag/${src.tag}";
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [
       fab
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index 74220864148c..52261a1ca483 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.35";
+  version = "0.36.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     tag = "v${version}";
-    hash = "sha256-/Y02+XaImJfZj/6+mkUR31LA9HkVXelFdcJok3/Ui+g=";
+    hash = "sha256-S6l/nH+UWLgNUOkRVjLptKhWeYrlN1KL8jSfyBHMI3s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index ec2118d4e149..a8726a155b68 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "6.1.0";
+  version = "6.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     tag = "v${version}";
-    hash = "sha256-B5wjZTnL/T+zRbPd3tVSekDbYnKBvIdIpXhc3sUvT3E=";
+    hash = "sha256-+vIq//pDLaaTmRGW+oytho3TfMmLCtuIoHeFenLVcek=";
   };
 
   postPatch = ''
@@ -103,11 +103,28 @@ buildPythonPackage rec {
     "test_acceptance_named"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # requires local networking
-    "plotly/tests/test_io/test_renderers.py"
     # fails to launch kaleido subprocess
-    "plotly/tests/test_optional/test_kaleido"
+    "tests/test_optional/test_kaleido"
+    # numpy2 related error, RecursionError
+    # See: https://github.com/plotly/plotly.py/issues/4852
+    "tests/test_plotly_utils/validators/test_angle_validator.py"
+    "tests/test_plotly_utils/validators/test_any_validator.py"
+    "tests/test_plotly_utils/validators/test_color_validator.py"
+    "tests/test_plotly_utils/validators/test_colorlist_validator.py"
+    "tests/test_plotly_utils/validators/test_colorscale_validator.py"
+    "tests/test_plotly_utils/validators/test_dataarray_validator.py"
+    "tests/test_plotly_utils/validators/test_enumerated_validator.py"
+    "tests/test_plotly_utils/validators/test_fig_deepcopy.py"
+    "tests/test_plotly_utils/validators/test_flaglist_validator.py"
+    "tests/test_plotly_utils/validators/test_infoarray_validator.py"
+    "tests/test_plotly_utils/validators/test_integer_validator.py"
+    "tests/test_plotly_utils/validators/test_number_validator.py"
+    "tests/test_plotly_utils/validators/test_pandas_series_input.py"
+    "tests/test_plotly_utils/validators/test_string_validator.py"
+    "tests/test_plotly_utils/validators/test_xarray_input.py"
   ];
 
   pythonImportsCheck = [ "plotly" ];
diff --git a/pkgs/development/python-modules/translation-finder/default.nix b/pkgs/development/python-modules/translation-finder/default.nix
index bb9df2e38cf5..dd3300256649 100644
--- a/pkgs/development/python-modules/translation-finder/default.nix
+++ b/pkgs/development/python-modules/translation-finder/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "translation-finder";
-  version = "2.19";
+  version = "2.22";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "WeblateOrg";
     repo = "translation-finder";
     tag = version;
-    hash = "sha256-Hc1KxmzlFqCLHSAgFF8cgxH0dTdUnBV/2T2ZkfzVvSw=";
+    hash = "sha256-1OQCSWsslJVuBjBsasWGMIpt/k8ey4nKLfbIS5LlCw4=";
   };
 
   build-system = [ setuptools ];
@@ -37,8 +37,9 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Translation file finder for Weblate";
     homepage = "https://github.com/WeblateOrg/translation-finder";
-    changelog = "https://github.com/WeblateOrg/translation-finder/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/WeblateOrg/translation-finder/blob/${src.tag}/CHANGES.rst";
     license = licenses.gpl3Only;
+    mainProgram = "weblate-discover";
     maintainers = with maintainers; [ erictapen ];
   };
 
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index c1cd72394c8a..2e1f170a6a25 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -492,10 +492,11 @@ in
           dontBuilt = true;
           installPhase = ''
             cp -R ext/fast_mmaped_file_rs $out
+            rm $out/Cargo.lock
             cp Cargo.lock $out
           '';
         };
-        hash = "sha256-KVbmDAa9EFwTUTHPF/8ZzycbieMhAuiidiz5rqGIKOo=";
+        hash = "sha256-mukk+tWWeG62q4GcDzkk8TyxVsDjShz30wEj82cElt4=";
       };
 
       nativeBuildInputs = [
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 9a0089bbeeb3..e041740e3ba0 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20250523.7fa0305";
+  version = "20250615.b589c5e";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-knUhiDMF0pchXzCVCntKiXYVJW8HXBoAMH+a9O652bk=";
+    hash = "sha256-pasxe+87XQy2pTI1Lrk4zekry1pgJIlwLF7kmGxceKQ=";
   };
 
   sgt-puzzles-menu = fetchurl {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0ae0a95d36b8..ff74c59be145 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9676,7 +9676,9 @@ with pkgs;
     hdf5 = hdf5.override { usev110Api = true; };
   };
 
-  vllm = with python3Packages; toPythonApplication vllm;
+  # Temporarily use python 3.12
+  # See: https://github.com/vllm-project/vllm/issues/12083
+  vllm = with python312Packages; toPythonApplication vllm;
 
   vte-gtk4 = vte.override {
     gtkVersion = "4";
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7a2e21f7941a..96fefa20d8ad 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1042,6 +1042,8 @@ let
 
         linol = callPackage ../development/ocaml-modules/linol { };
 
+        linol-eio = callPackage ../development/ocaml-modules/linol/eio.nix { };
+
         linol-lwt = callPackage ../development/ocaml-modules/linol/lwt.nix { };
 
         llvm = callPackage ../development/ocaml-modules/llvm {