diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c63da58967cf..c972ea8a2618 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9870,13 +9870,6 @@
     githubId = 6179496;
     name = "Grayson Head";
   };
-  grburst = {
-    email = "GRBurst@protonmail.com";
-    github = "GRBurst";
-    githubId = 4647221;
-    name = "GRBurst";
-    keys = [ { fingerprint = "7FC7 98AB 390E 1646 ED4D  8F1F 797F 6238 68CD 00C2"; } ];
-  };
   greaka = {
     email = "git@greaka.de";
     github = "greaka";
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index ccb6a5600ad4..c2604cdeabdf 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -24,8 +24,8 @@ let
     sha256Hash = "sha256-d5BcAUkYV7O25wyoifiZxfUsANPxLa/QkuT9u1qqfP8=";
   };
   latestVersion = {
-    version = "2025.3.1.1"; # "Android Studio Panda 1 | 2025.3.1 Canary 1"
-    sha256Hash = "sha256-hCWt8wMxqA4So/oZL6RzRRY3Kg6vAYr9xDAzQ/5ZXow=";
+    version = "2025.3.1.2"; # "Android Studio Panda 1 | 2025.3.1 Canary 2"
+    sha256Hash = "sha256-kgYPwMF/CypkCq4w/y+HnraNdPNHf53198x35S0i7OA=";
   };
 in
 {
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 519f8cda20e4..0774f577f4c4 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7328,12 +7328,12 @@ final: prev: {
 
   kulala-nvim = buildVimPlugin {
     pname = "kulala.nvim";
-    version = "5.3.3-unstable-2025-12-16";
+    version = "5.3.3-unstable-2025-12-25";
     src = fetchFromGitHub {
       owner = "mistweaverco";
       repo = "kulala.nvim";
-      rev = "9fc4831a116fb32b0fd420ed483f5102a873446a";
-      hash = "sha256-A5yNW1XLLoSmsT8/7qB+SGguE7IMmcwv6tnhbF6nb2Y=";
+      rev = "cd3eaa83b8d60533837202dede73238334d71832";
+      hash = "sha256-xyhhvWLF+k+QG7GYOHEdmusZWsHlFg5O3np0a8pT2SU=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/mistweaverco/kulala.nvim/";
@@ -12117,12 +12117,12 @@ final: prev: {
 
   nvim-treesitter-textobjects = buildVimPlugin {
     pname = "nvim-treesitter-textobjects";
-    version = "0-unstable-2025-10-31";
+    version = "0-unstable-2025-12-27";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "5ca4aaa6efdcc59be46b95a3e876300cfead05ef";
-      hash = "sha256-lf+AwSu96iKO1vWWU2D7jWHGfjXkbX9R2CX3gMZaD4M=";
+      rev = "ecd03f5811eb5c66d2fa420b79121b866feecd82";
+      hash = "sha256-mMxCAkrGqTstEgaf/vwQMEF7D8swH3oyUJtaxuXzpcs=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
     meta.hydraPlatforms = [ ];
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 40e371956232..c0e94b15e074 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1591,7 +1591,6 @@ assertNoAdditions {
       dependencies = [ kulala-http-grammar ];
       buildInputs = [ curl ];
 
-      patches = [ ./patches/kulala-nvim/do-not-install-grammar.patch ];
       postPatch = ''
         substituteInPlace lua/kulala/config/defaults.lua \
           --replace-fail 'curl_path = "curl"' 'curl_path = "${lib.getExe curl}"'
diff --git a/pkgs/applications/editors/vim/plugins/patches/kulala-nvim/do-not-install-grammar.patch b/pkgs/applications/editors/vim/plugins/patches/kulala-nvim/do-not-install-grammar.patch
deleted file mode 100644
index 00a76f9c0492..000000000000
--- a/pkgs/applications/editors/vim/plugins/patches/kulala-nvim/do-not-install-grammar.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/lua/kulala/config/init.lua b/lua/kulala/config/init.lua
-index 7298f95..d781a12 100644
---- a/lua/kulala/config/init.lua
-+++ b/lua/kulala/config/init.lua
-@@ -122,6 +122,10 @@ local function setup_treesitter_master()
- end
- 
- local function set_kulala_parser()
-+  assert(vim.treesitter.language.add("kulala_http"))
-+  vim.treesitter.language.register("kulala_http", { "http", "rest" })
-+  do return end
-+
-   local parsers = vim.F.npcall(require, "nvim-treesitter.parsers")
- 
-   if not parsers then
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 2960933b83fe..4deab3bb7e3b 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -930,7 +930,7 @@ https://github.com/theHamsta/nvim-treesitter-pairs/,HEAD,
 https://github.com/eddiebergman/nvim-treesitter-pyfold/,,
 https://github.com/nvim-treesitter/nvim-treesitter-refactor/,,
 https://github.com/PaterJason/nvim-treesitter-sexp/,HEAD,
-https://github.com/nvim-treesitter/nvim-treesitter-textobjects/,,
+https://github.com/nvim-treesitter/nvim-treesitter-textobjects/,main,
 https://github.com/RRethy/nvim-treesitter-textsubjects/,HEAD,
 https://github.com/AckslD/nvim-trevJ.lua/,HEAD,
 https://github.com/windwp/nvim-ts-autotag/,,
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index 956cdbe87d17..35f6baea1aab 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "0bad9ede6ecd09461f9f73c44073e97f20e45c59556c0db61be93f8695fdf901"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "6dfe83a7d8984a5fe6be63a429698ce3fc61761ce68e3f4f2c6f3ff96a349f37"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "4217e7a36bfecc66cd678e854175f740f6b97dda44b094a132bf751c7198bba9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "9b6a7ea64b7b14a6c43613e4e170902e99c600857265875282f8d4b9dfefa6f4"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "7c21cafa273e4cf30fd43c7fccb147897084bb7eba21c9e99b3ae0246eef7a55"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "cbda428d59a8593267343fb32ad985bf2125f45860425f9b7b31bbea9d305046"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "a52d31f6dbc756ffe8a1701d3ad52d432a904d7b34932049d411f16bc3bb4e2c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "b1a253aab260beabea305517d8d57cce4594d2e071320d5700d389b29eb3c196"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "d35f436ed082ccde1b3712617b05da4464832747bb41dcd14261237834d91296"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "0f6e598bf90b9ced4f1f758db6b0d7f8afbf9b5973d801d8a743c5b27ac3b748"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "a32df1ffd86eb63e5f91e1c69438ff4074020ca76976a293321e524bc1562fc0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "297beda34a0a2a7ff727fced94dba6f999636a4e9b2cdd6e30840cc0e746a4ee"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index d60771de68b2..905c26918e97 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.32.10+k3s1";
-  k3sCommit = "1c5d65cec8e24f5238e2e0b21f0dac8c2f8d5db5";
-  k3sRepoSha256 = "0wfh2m55dxfvf3m74jrwvpc21xxc17gwbifnkl9nyd8kha271876";
-  k3sVendorHash = "sha256-PedpbkyP3XZ8yLlFo/VGjPlImYGOk5ebPYGivPR2Izg=";
+  k3sVersion = "1.32.11+k3s1";
+  k3sCommit = "8119508834f2503e3c7bace3125f5db6b038d377";
+  k3sRepoSha256 = "0fni4sh3a5flyrli7xxd9zxj9sh75kv79msy3zkfbgjxqz7rg4v9";
+  k3sVendorHash = "sha256-8gzvad5Cpkatc8158m9FBGnkGEbajn30alSPlzhor0E=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -11,5 +11,11 @@
   k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
   containerdVersion = "2.1.5-k3s1.32";
   containerdSha256 = "1fzld9q0ycfg9b3054qg70mif1p6i7xqikcbabrmxapk81fy83kn";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.31.0-k3s2";
+  flannelVersion = "v0.27.4";
+  flannelPluginVersion = "v1.8.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s2.32";
+  helmJobVersion = "v0.9.12-build20251215";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
index d62353c580db..d1cce735c16a 100644
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "9cc46db774c51e4195dfe3c2dafe1ecc18c7293bf08e7a81258aec07e60fc26d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "47644f3141878535a1951fdaf03bc485001b50a58b8fb58d97c75c49ea38a1f0"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1a852774a4cf27b24b1c60fc8fdc88e1f31841955dad99dfedd492a4ccfb6c08"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "9b6a7ea64b7b14a6c43613e4e170902e99c600857265875282f8d4b9dfefa6f4"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "4026e1da9f3f184e4d66474d278785c50276867e057376073504b63f06d48e7c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "ee76f65f39a0ca12bbaa6bf9fdd5dc161b553b15a5746d47795cf0113916c063"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c1f1dc4e3a3f42ec1aad051b0d7a6ecb4853f5f428f043c318d1aab5ab73728d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "b1a253aab260beabea305517d8d57cce4594d2e071320d5700d389b29eb3c196"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "7bbe0b76621debfeaf8f50a931e833102d7cade1a65b7fd8ff83027aa8f5add5"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "a2f534291abd4d6491dc669b46e437df1fe0cd7b573485ec30aa813510b22635"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.6%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "059a3595138d019c676b2753b144dab613c4ee1d3892a115a95e74d665009b1b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "87db88828e43179ef30a17ba66b416a3e398c4a00673908bd8d39ae4996ce300"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
index 83459b59dd75..de73eecf3c19 100644
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.33.6+k3s1";
-  k3sCommit = "b5847677be5afdc431f70afec6780679c3845d16";
-  k3sRepoSha256 = "0pm8x121pb6pyn9rq9c5pbr7y293rzyp0q3c5mc1gb4glqwx7f8g";
-  k3sVendorHash = "sha256-Cjacx5i1ahZ9RBXBTsUtmNDyyofw1fedpExTHuU8grA=";
+  k3sVersion = "1.33.7+k3s1";
+  k3sCommit = "0b396d3f7f26e0c2ae5b6a114383830f533938c2";
+  k3sRepoSha256 = "0jkvm7c333zazabsxrjl6wkdsni1m5g5gamriyyf53lly9935wsf";
+  k3sVendorHash = "sha256-HpgcO/mUo64mkH38sAURnLOmXdXmHh3o6iDKtQeUt/E=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -11,5 +11,11 @@
   k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
   containerdVersion = "2.1.5-k3s1.33";
   containerdSha256 = "15iw6px3710rlsx7j933i07qd4a2r7caagfjbhhfcp33m9k19v7h";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.33.0-k3s2";
+  flannelVersion = "v0.27.4";
+  flannelPluginVersion = "v1.8.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s2";
+  helmJobVersion = "v0.9.12-build20251215";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
index 5cbddbcf2378..ca2e2fb2860e 100644
--- a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "4bfa596bec42e8752d6f90e69e724ee438c2a8c3ba7827c3d4f30ca8ca30de35"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "499d7fb0b2eab200e9bf9b3935ce787a7fa0597933dce25ad091703933d6ecc8"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "24359781bd775f513691e98031853d79eac53e265f7d72d1e7325df4f3b18eb0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "b8dff3265568e1be66ab72ac0ded68bd266fa37a32c010f1253dba6547a49ce8"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "ee792ad7b22a03567fd2dea4e16bf239667df50367f6b65070d5daf76e6054f8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "170db25228c873741f895fced05f0e5bdbbddb8ffeb5e0342a5b8e44f3c28757"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "ae43b262c9d739a7b693670825160e9afab6b10fdb975659679de576b84ae286"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "27407fd1553c89b8ccd3b45ad0fbdcd483c1a010e7b28b60b24a8e73b58aa783"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "2e0383744babd5e801acdb2c6bd9cced8cf2d60c7b4a699ecf3311e200aeacdb"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "e67cddf839571cd489aef44acb2aca82285a9789a170c1a44d51b7f8b6129883"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.2%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "41b34aab92bc5166135dc73217ead65766688fd3543166ce32ffff7e101bef46"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "b6cb3c06f19859d3a5fba54b305097e89d2a86b5bce9e8360a46b9d2e67da565"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
index 6e7d8df7cd9e..3cc9396b70cd 100644
--- a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.34.2+k3s1";
-  k3sCommit = "8dac81b2a24e78ce4cf951c7788ea6a8d4a59aa7";
-  k3sRepoSha256 = "1nwh1aggxvjv99kz1zkklim7jqsn0d44g8905653gkfpk0givghq";
-  k3sVendorHash = "sha256-IJi5gVxBsAjeQHi5rQpNRvWOXuNPx2Rtsy18VL+2Yxo=";
+  k3sVersion = "1.34.3+k3s1";
+  k3sCommit = "48ffa7b6893f21b919b3029d54c9d9838ae426a1";
+  k3sRepoSha256 = "1177kzbhp6ihb7dzfdi1a0idgp69y1hwh6wnwvdx1fnivg2gj7aw";
+  k3sVendorHash = "sha256-dp8SU24nuy3WmG1Zln/J2nVHnVQmVyN78FBOSxNjbF8=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -11,5 +11,11 @@
   k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
   containerdVersion = "2.1.5-k3s1";
   containerdSha256 = "0n0g58d352i8wz0bqn87vgrd7z54j268cbmbp19fz68wmifm7fl8";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.34.0-k3s2";
+  flannelVersion = "v0.27.4";
+  flannelPluginVersion = "v1.8.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s3";
+  helmJobVersion = "v0.9.12-build20251215";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index f766104463f8..38835677408a 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -6,7 +6,7 @@ lib:
   k3sCommit,
   k3sRepoSha256 ? lib.fakeHash,
   k3sVendorHash ? lib.fakeHash,
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  # taken from ./scripts/version.sh VERSION_ROOT
   k3sRootVersion,
   k3sRootSha256 ? lib.fakeHash,
   # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/d71ab6317e22dd34673faa307a412a37a16767f6/scripts/download#L29-L32
@@ -14,15 +14,27 @@ lib:
   chartVersions,
   # Air gap container images that are released as assets with every k3s release
   imagesVersions,
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS
   k3sCNIVersion,
   k3sCNISha256 ? lib.fakeHash,
   # taken from ./scripts/version.sh VERSION_CONTAINERD
   containerdVersion,
   containerdSha256 ? lib.fakeHash,
+  # taken from ./scripts/version.sh PKG_CONTAINERD_K3S
+  containerdPackage,
   # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
   criCtlVersion,
   updateScript ? null,
+  # taken from ./scripts/version.sh VERSION_FLANNEL
+  flannelVersion,
+  # taken from ./scripts/version.sh VERSION_FLANNEL_PLUGIN
+  flannelPluginVersion,
+  # taken from ./scripts/version.sh VERSION_KUBE_ROUTER
+  kubeRouterVersion,
+  # taken from ./scripts/version.sh VERSION_CRI_DOCKERD
+  criDockerdVersion,
+  # taken from ./scripts/version.sh VERSION_HELM_JOB
+  helmJobVersion,
 }@attrs:
 
 # builder.nix contains a "builder" expression that, given k3s version and hash
@@ -109,23 +121,58 @@ let
     priority = 5;
   };
 
-  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
-  versionldflags = [
-    "-X github.com/k3s-io/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
-    "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
-    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
-    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
-    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/component-base/version.gitTreeState=clean"
-    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
-    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
-    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
-    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
-  ];
+  # https://github.com/k3s-io/k3s/blob/fd48cd623340a4a6e3b2717dede368283cedec1a/scripts/build#L23-L59
+  versionldflags =
+    let
+      PKG = "github.com/k3s-io/k3s";
+      PKG_CONTAINERD = "github.com/containerd/containerd/v2";
+      PKG_CRICTL = "sigs.k8s.io/cri-tools/pkg";
+      PKG_K8S_BASE = "k8s.io/component-base";
+      PKG_K8S_CLIENT = "k8s.io/client-go/pkg";
+      PKG_CNI_PLUGINS = "github.com/containernetworking/plugins";
+      PKG_KUBE_ROUTER = "github.com/cloudnativelabs/kube-router/v2";
+      PKG_CRI_DOCKERD = "github.com/Mirantis/cri-dockerd";
+      PKG_ETCD = "go.etcd.io/etcd";
+      PKG_HELM_CONTROLLER = "github.com/k3s-io/helm-controller";
+      buildDate = "1970-01-01T01:01:01Z";
+    in
+    [
+      "-X ${PKG}/pkg/version.Version=${k3sVersion}"
+      "-X ${PKG}/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+      "-X ${PKG}/pkg/version.UpstreamGolang=go${go.version}"
+
+      "-X ${PKG_K8S_CLIENT}/version.gitVersion=v${k3sVersion}"
+      "-X ${PKG_K8S_CLIENT}/version.gitCommit=${k3sCommit}"
+      "-X ${PKG_K8S_CLIENT}/version.gitTreeState=clean"
+      "-X ${PKG_K8S_CLIENT}/version.buildDate=${buildDate}"
+
+      "-X ${PKG_K8S_BASE}/version.gitVersion=v${k3sVersion}"
+      "-X ${PKG_K8S_BASE}/version.gitCommit=${k3sCommit}"
+      "-X ${PKG_K8S_BASE}/version.gitTreeState=clean"
+      "-X ${PKG_K8S_BASE}/version.buildDate=${buildDate}"
+
+      "-X ${PKG_CRICTL}/version.Version=${criCtlVersion}"
+
+      "-X ${PKG_CONTAINERD}/version.Version=${containerdVersion}"
+      "-X ${PKG_CONTAINERD}/version.Package=${containerdPackage}"
+
+      "-X ${PKG_CNI_PLUGINS}/pkg/utils/buildversion.BuildVersion=${k3sCNIVersion}"
+      "-X ${PKG_CNI_PLUGINS}/plugins/meta/flannel.Program=flannel"
+      "-X ${PKG_CNI_PLUGINS}/plugins/meta/flannel.Version=${flannelPluginVersion}+${flannelVersion}"
+      "-X ${PKG_CNI_PLUGINS}/plugins/meta/flannel.Commit=HEAD"
+      "-X ${PKG_CNI_PLUGINS}/plugins/meta/flannel.buildDate=${buildDate}"
+
+      "-X ${PKG_KUBE_ROUTER}/pkg/version.Version=${kubeRouterVersion}"
+      "-X ${PKG_KUBE_ROUTER}/pkg/version.BuildDate=${buildDate}"
+
+      "-X ${PKG_CRI_DOCKERD}/cmd/version.Version=${criDockerdVersion}"
+      "-X ${PKG_CRI_DOCKERD}/cmd/version.GitCommit=HEAD"
+      "-X ${PKG_CRI_DOCKERD}/cmd/version.BuildTime=${buildDate}"
+
+      "-X ${PKG_ETCD}/api/v3/version.GitSHA=HEAD"
+
+      "-X ${PKG_HELM_CONTROLLER}/pkg/controllers/chart.DefaultJobImage=rancher/klipper-helm:${helmJobVersion}"
+    ];
 
   # bundled into the k3s binary
   traefik = {
@@ -346,16 +393,6 @@ buildGoModule (finalAttrs: {
       --replace-fail '"$LDFLAGS $STATIC" -o' \
                 '"$LDFLAGS" -o'
 
-    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
-
-    substituteInPlace scripts/package-cli \
-      --replace-fail '"''${GO}" generate' \
-                'GOFLAGS="" \
-                 GOOS="${pkgsBuildBuild.go.GOOS}" \
-                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
-                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
-                 "''${GO}" generate'
-
     # Add the -e flag to process "errornous" packages. We need to modify this because the upstream
     # build-time version detection doesn't work with a vendor directory.
     substituteInPlace scripts/version.sh \
@@ -426,8 +463,8 @@ buildGoModule (finalAttrs: {
     rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
 
     export ARCH=$GOARCH
-    export DRONE_TAG="v${k3sVersion}"
-    export DRONE_COMMIT="${k3sCommit}"
+    export TAG="v${k3sVersion}"
+    export GITHUB_SHA="${k3sCommit}"
     # use ./scripts/package-cli to run 'go generate' + 'go build'
 
     ./scripts/package-cli
diff --git a/pkgs/applications/networking/cluster/k3s/update-script.sh b/pkgs/applications/networking/cluster/k3s/update-script.sh
index aced5253abf1..73c9b7348629 100755
--- a/pkgs/applications/networking/cluster/k3s/update-script.sh
+++ b/pkgs/applications/networking/cluster/k3s/update-script.sh
@@ -35,8 +35,8 @@ K3S_REPO_SHA256=${PREFETCH_META%$'\n'*}
 
 cd "$K3S_STORE_PATH"
 # Set the DRONE variables as they are expected to be set in version.sh
-DRONE_TAG="$LATEST_TAG_NAME"
-DRONE_COMMIT="$K3S_COMMIT"
+TAG="$LATEST_TAG_NAME"
+GITHUB_SHA="$K3S_COMMIT"
 NO_DAPPER="" # Source git_version.sh in scripts/version.sh#L8
 source "${K3S_STORE_PATH}/scripts/version.sh"
 
@@ -119,7 +119,13 @@ cat >versions.nix <<EOF
   k3sCNISha256 = "${CNIPLUGINS_SHA256}";
   containerdVersion = "${VERSION_CONTAINERD:1}";
   containerdSha256 = "${CONTAINERD_SHA256}";
+  containerdPackage = "${PKG_CONTAINERD_K3S}";
   criCtlVersion = "${VERSION_CRICTL:1}";
+  flannelVersion = "${VERSION_FLANNEL}";
+  flannelPluginVersion = "${VERSION_FLANNEL_PLUGIN}";
+  kubeRouterVersion = "${VERSION_KUBE_ROUTER}";
+  criDockerdVersion = "${VERSION_CRI_DOCKERD}";
+  helmJobVersion = "${VERSION_HELM_JOB}";
 }
 EOF
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1e373e237b3b..20d6395fb434 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-S4GJqoUkqGNe3oZ0pwPR08+qkG5f2RiReVBU+UHkfFw=",
+    "hash": "sha256-RVhClLMaoCtMhh+4NL8aOj/sK2WtFA/LNjkscKmxIiU=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.90.0",
+    "rev": "v0.91.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Vcp/AvcBz7wO8k89c1u3WGjhl0iuNMbWRAOIbEGXhbw="
+    "vendorHash": "sha256-/kRacnH+zVEm0u091euV0UIyadAcYnykn2tJiYY19I8="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
diff --git a/pkgs/by-name/am/amber-lang/fix_gnused_detection.patch b/pkgs/by-name/am/amber-lang/fix_gnused_detection.patch
deleted file mode 100644
index a4d2e99ea729..000000000000
--- a/pkgs/by-name/am/amber-lang/fix_gnused_detection.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From cae2ad70d6202bc97623be8c7c123ee2736a4644 Mon Sep 17 00:00:00 2001
-From: aleksana <me@aleksana.moe>
-Date: Sun, 9 Mar 2025 21:19:27 +0800
-Subject: [PATCH] replace_regex: remove bash word boundary when detecting
- gnused
-
-Bash linked against C libraries other than GLibc may not support GNU
-extensions of POSIX Extended Regular Regex. For example,
-
-> re='\bx'; [[ 'x' =~ $re ]] && echo "1"
-
-does not output the same result on Linux/GLibc and macOS.
----
- src/std/text.ab | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/std/text.ab b/src/std/text.ab
-index fe071e33..82449a02 100644
---- a/src/std/text.ab
-+++ b/src/std/text.ab
-@@ -19,7 +19,7 @@ pub fun replace_regex(source: Text, search: Text, replace: Text, extended: Bool
-             // GNU sed versions 4.0 through 4.2 support extended regex syntax,
-             // but only via the "-r" option; use that if the version information
-             // contains "GNU sed".
--            $ re='\bCopyright\b.+\bFree Software Foundation\b'; [[ \$(sed --version 2>/dev/null) =~ \$re ]] $
-+            $ re='Copyright.+Free Software Foundation'; [[ \$(sed --version 2>/dev/null) =~ \$re ]] $
-             let flag = status == 0 then "-r" else "-E"
-             return $ echo "{source}" | sed "{flag}" -e "s/{search}/{replace}/g" $
-         } else {
diff --git a/pkgs/by-name/am/amber-lang/fix_word_boundaries.patch b/pkgs/by-name/am/amber-lang/fix_word_boundaries.patch
new file mode 100644
index 000000000000..ec73631eccae
--- /dev/null
+++ b/pkgs/by-name/am/amber-lang/fix_word_boundaries.patch
@@ -0,0 +1,38 @@
+From efdbecaf721ccb217ece34a5105eaac68e27aa51 Mon Sep 17 00:00:00 2001
+From: Max Karou <maxkarou@protonmail.com>
+Date: Sun, 4 Jan 2026 01:47:51 +0100
+Subject: [PATCH] sed_version: remove word boundary assertions
+
+Word boundary assertions (\b) are GNU regex extensions that may fail
+on systems using non-glibc C libraries (e.g., musl, macOS).
+
+This was previously fixed in replace_regex() via NixOS/nixpkgs#388412,
+which was subsequently upstreamed in amber-lang/amber#686.
+
+Changes in amber-lang/amber#717 reintroduced the same portability issue.
+---
+ src/std/text.ab | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/std/text.ab b/src/std/text.ab
+index 5f2d935..a5dac3f 100644
+--- a/src/std/text.ab
++++ b/src/std/text.ab
+@@ -51,12 +51,12 @@ const SED_VERSION_BUSYBOX = 2
+ fun sed_version(): Int {
+     // We can't match against a word "GNU" because
+     // alpine's busybox sed returns "This is not GNU sed version"
+-    trust $ re='\bCopyright\b.+\bFree Software Foundation\b'; [[ \$(sed --version 2>/dev/null) =~ \$re ]] $
++    trust $ re='Copyright.+Free Software Foundation'; [[ \$(sed --version 2>/dev/null) =~ \$re ]] $
+     if status == 0 {
+         return SED_VERSION_GNU
+     }
+     // On BSD single `sed` waits for stdin. We must use `sed --help` to avoid this.
+-    trust $ re='\bBusyBox\b'; [[ \$(sed --help 2>&1) =~ \$re ]] $
++    trust $ re='BusyBox'; [[ \$(sed --help 2>&1) =~ \$re ]] $
+     if status == 0 {
+         return SED_VERSION_BUSYBOX
+     }
+-- 
+2.51.2
+
diff --git a/pkgs/by-name/am/amber-lang/package.nix b/pkgs/by-name/am/amber-lang/package.nix
index e3180bf19415..a704fbd47fa1 100644
--- a/pkgs/by-name/am/amber-lang/package.nix
+++ b/pkgs/by-name/am/amber-lang/package.nix
@@ -15,21 +15,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "amber-lang";
-  version = "0.4.0-alpha";
+  version = "0.5.1-alpha";
 
   src = fetchFromGitHub {
     owner = "amber-lang";
     repo = "amber";
     tag = version;
-    hash = "sha256-N9G/2G8+vrpr1/K7XLwgW+X2oAyAaz4qvN+EbLOCU1Q=";
+    hash = "sha256-v1uJe3vVGKXaZcQzdoYzu/bJKMQnS4IYET4QLPW+J8Y=";
   };
 
   patches = [
-    # https://github.com/amber-lang/amber/pull/686
-    ./fix_gnused_detection.patch
+    # Upstreamed in #995, can be removed in >= 0.5.2
+    # github.com/amber-lang/amber/pull/995
+    ./fix_word_boundaries.patch
   ];
 
-  cargoHash = "sha256-e5+L7Qgd6hyqT1Pb9X7bVtRr+xm428Z5J4hhsYNnGtU=";
+  cargoHash = "sha256-aXcxlmmDYLFbyRJYyGE1gbQMbdysHx4iWXsrUj10Eco=";
 
   preConfigure = ''
     substituteInPlace src/compiler.rs \
diff --git a/pkgs/by-name/ar/armagetronad/package.nix b/pkgs/by-name/ar/armagetronad/package.nix
index 146fe963c05e..78d217979804 100644
--- a/pkgs/by-name/ar/armagetronad/package.nix
+++ b/pkgs/by-name/ar/armagetronad/package.nix
@@ -50,9 +50,9 @@ let
       # https://gitlab.com/armagetronad/armagetronad/-/tags
       ${latestVersionMajor} =
         let
-          version = "${latestVersionMajor}.2.3";
+          version = "${latestVersionMajor}.2.5";
           rev = "v${version}";
-          hash = "sha256-lfYJ3luGK9hB0aiiBiJIqq5ddANqGaVtKXckbo4fl2g=";
+          hash = "sha256-bj+oUqz0WHAjZ0iS7GlbIfLeMFSPQkH99mPaLdapkPo=";
         in
         dedicatedServer: {
           inherit version;
@@ -98,8 +98,8 @@ let
       # https://gitlab.com/armagetronad/armagetronad/-/commits/hack-0.2.8-sty+ct+ap/?ref_type=heads
       "${latestVersionMajor}-sty+ct+ap" =
         let
-          rev = "c907ee3efd76f3b1e6eb41257cf7127f3eab280c";
-          hash = "sha256-d5uWBSz07OinbGHoxUQ64go3eOugLu/tWNjeihobQdo=";
+          rev = "22fdbee08ca301c09ae4dee7210ccef02536670d";
+          hash = "sha256-F+nnQxI2TTTa+gJYWjQPFjd8tQLCh/dEu/oTV0ie8BI=";
         in
         dedicatedServer: {
           version = "${latestVersionMajor}-sty+ct+ap-${lib.substring 0 8 rev}";
diff --git a/pkgs/by-name/br/bront_fonts/package.nix b/pkgs/by-name/br/bront_fonts/package.nix
index ffaaddcb10c6..15e4447e2b48 100644
--- a/pkgs/by-name/br/bront_fonts/package.nix
+++ b/pkgs/by-name/br/bront_fonts/package.nix
@@ -28,6 +28,6 @@ stdenvNoCC.mkDerivation {
       ufl
     ];
     platforms = lib.platforms.all;
-    maintainers = [ lib.maintainers.grburst ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/fs/fstar/package.nix b/pkgs/by-name/fs/fstar/package.nix
index 0886216122c8..b694bf7cdbf0 100644
--- a/pkgs/by-name/fs/fstar/package.nix
+++ b/pkgs/by-name/fs/fstar/package.nix
@@ -19,13 +19,13 @@ let
 in
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "fstar";
-  version = "2025.10.06";
+  version = "2025.12.15";
 
   src = fetchFromGitHub {
     owner = "FStarLang";
     repo = "FStar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PH3ylEiUS+mfFtYV+KI7xrCewkEutM1c14A+ARsyOQY=";
+    hash = "sha256-UuwDX6178YMhEQqpEOATswzoUNpEECq7Nyh2yk5gKRg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnucobol/package.nix b/pkgs/by-name/gn/gnucobol/package.nix
index 76231551ccc7..a4d5cf34a611 100644
--- a/pkgs/by-name/gn/gnucobol/package.nix
+++ b/pkgs/by-name/gn/gnucobol/package.nix
@@ -91,9 +91,23 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace configure --replace-fail '"GNU strip"' 'FAKE GNU strip'
   '';
 
-  # error: call to undeclared function 'xmlCleanupParser'
-  # ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
-  env.CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-error=implicit-function-declaration";
+  # GCC 15 changed some warnings to errors, particularly around function pointer types
+  # (C23 empty parentheses means no args, not unspecified). These flags are needed
+  # until gnucobol is updated to compile cleanly with GCC 15.
+  # See: https://gcc.gnu.org/gcc-15/porting_to.html
+  env.CFLAGS =
+    let
+      # Clang needs -Wno-error=implicit-function-declaration for xmlCleanupParser
+      clangFlags = "-Wno-error=implicit-function-declaration";
+      # GCC 15+ needs additional flags for incompatible pointer type errors
+      gcc15Flags = "-Wno-error=incompatible-pointer-types -std=gnu11";
+    in
+    if stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "15.0.0" then
+      gcc15Flags
+    else if stdenv.cc.isClang then
+      clangFlags
+    else
+      "";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/go/goat/package.nix b/pkgs/by-name/go/goat/package.nix
index f2c3bc98a6e2..3c8a041dce8d 100644
--- a/pkgs/by-name/go/goat/package.nix
+++ b/pkgs/by-name/go/goat/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goat";
-  version = "0.2.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "blampe";
     repo = "goat";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/m9qRTVrak+C4Df5y+36Ff7E0TdwHVbQEyrP+qfNF6E=";
+    hash = "sha256-+x+bOgNa9nOMWUMUVK816DK7f4SuoWEbRr2OZ+iSPig=";
   };
 
-  vendorHash = "sha256-24YllmSUzRcqWbJ8NLyhsJaoGG2+yE8/eXX6teJ1nV8=";
+  vendorHash = "sha256-RRjEFZLbfeiFUWjGZI4HSZ8PhVj1IMlU5D4Nb1sexoQ=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ju/just-lsp/package.nix b/pkgs/by-name/ju/just-lsp/package.nix
index d3d2a538eeb6..a3f4bec19cdc 100644
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-VA6rUcOc/O4KocefxGr4BFnGSb1Gv8+UObtHua/6lbg=";
+    hash = "sha256-43w5kA/rGEt7mZCPWlSzYQAme7YJ4EZ97zHmNiDzZ0c=";
   };
 
-  cargoHash = "sha256-t+a24rBEHLgnrADRzMtrZHdeQ2tDxHK/bMzYidLPNQw=";
+  cargoHash = "sha256-/Y9GCKsam5x1FjWcNxKiwf3LiYRg3SWILWGnuyhptrc=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ka/kafkactl/package.nix b/pkgs/by-name/ka/kafkactl/package.nix
index e94e4ddf1fc8..d627a4fef654 100644
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -33,6 +33,6 @@ buildGoModule rec {
       - directly access kafka clusters inside your kubernetes cluster
     '';
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ grburst ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/ke/keystore-explorer/package.nix b/pkgs/by-name/ke/keystore-explorer/package.nix
index 6739ab2d1b0e..646028c204ac 100644
--- a/pkgs/by-name/ke/keystore-explorer/package.nix
+++ b/pkgs/by-name/ke/keystore-explorer/package.nix
@@ -11,13 +11,13 @@ let
   jdk = jdk11;
 in
 stdenv.mkDerivation rec {
-  version = "5.6.0";
+  version = "5.6.1";
   pname = "keystore-explorer";
   src = fetchzip {
     url = "https://github.com/kaikramer/keystore-explorer/releases/download/v${version}/kse-${
       lib.replaceStrings [ "." ] [ "" ] version
     }.zip";
-    sha256 = "sha256-+ZgALJaZodLmAtdCIE1SG6D0lzlETg4mMPXheXmGhPc=";
+    sha256 = "sha256-yhYQpeBoicILYEXpW+oqDdF+KieDbNmTFpxL+aA8vTw=";
   };
 
   # glib is necessary so file dialogs don't hang.
diff --git a/pkgs/by-name/li/linkwarden/package.nix b/pkgs/by-name/li/linkwarden/package.nix
index 3d8289cbbec3..d25eab008b58 100644
--- a/pkgs/by-name/li/linkwarden/package.nix
+++ b/pkgs/by-name/li/linkwarden/package.nix
@@ -6,6 +6,7 @@
   yarn-berry,
   makeBinaryWrapper,
   nixosTests,
+  stdenv,
   # dependencies
   bash,
   monolith,
@@ -46,6 +47,13 @@ let
       "Bentham"
     ];
   };
+
+  chromeDir =
+    {
+      x86_64-linux = "chrome-linux64";
+      aarch64-linux = "chrome-linux";
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "linkwarden";
@@ -173,7 +181,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --set-default PRISMA_QUERY_ENGINE_LIBRARY "${prisma-engines_6}/lib/libquery_engine.node" \
       --set-default PRISMA_QUERY_ENGINE_BINARY "${prisma-engines_6}/bin/query-engine" \
       --set-default PRISMA_SCHEMA_ENGINE_BINARY "${prisma-engines_6}/bin/schema-engine" \
-      --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${playwright-driver.browsers-chromium}/chromium-*/chrome-linux/chrome \
+      --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${playwright-driver.browsers-chromium}/chromium-*/${chromeDir}/chrome \
       --set-default LINKWARDEN_CACHE_DIR /var/cache/linkwarden \
       --set-default LINKWARDEN_HOST localhost \
       --set-default LINKWARDEN_PORT 3000 \
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 71ca9fbaec55..133b59620f13 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -74,13 +74,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "7581";
+  version = "7628";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-8xQ6Azdr2Nwn+2EYAn/YDGLDRI6hqKVQsBDmfa7f5uk=";
+    hash = "sha256-SRz8uLjXtjpHhekqrksUc7oUuz6cYdWfvcdHxWNEgbs=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lm/lmstudio/linux.nix b/pkgs/by-name/lm/lmstudio/linux.nix
index 5b6e09171819..054bb7b900c3 100644
--- a/pkgs/by-name/lm/lmstudio/linux.nix
+++ b/pkgs/by-name/lm/lmstudio/linux.nix
@@ -9,6 +9,7 @@
   stdenv,
   lib,
   passthru,
+  graphicsmagick,
 }:
 let
   src = fetchurl { inherit url hash; };
@@ -24,11 +25,21 @@ appimageTools.wrapType2 {
     passthru
     ;
 
+  nativeBuildInputs = [ graphicsmagick ];
+
   extraPkgs = pkgs: [ pkgs.ocl-icd ];
 
   extraInstallCommands = ''
     mkdir -p $out/share/applications
-    cp -r ${appimageContents}/usr/share/icons $out/share
+
+    # setup icons (see https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=lmstudio#n55 for how Arch solved this; approach adapted to here)
+    src_icon="${appimageContents}/usr/share/icons/hicolor/0x0/apps/lm-studio.png"
+    sizes=("16x16" "32x32" "48x48" "64x64" "128x128" "256x256")
+    for size in "''${sizes[@]}"; do
+      install -dm755 "$out/share/icons/hicolor/$size/apps"
+      gm convert "$src_icon" -resize "$size" "$out/share/icons/hicolor/$size/apps/lm-studio.png"
+    done
+
     install -m 444 -D ${appimageContents}/lm-studio.desktop -t $out/share/applications
 
     # Rename the main executable from lmstudio to lm-studio
diff --git a/pkgs/by-name/me/meli/package.nix b/pkgs/by-name/me/meli/package.nix
index 9ed50bba7621..f4332eba458c 100644
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@@ -28,7 +28,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "meli";
-  version = "0.8.12";
+  version = "0.8.13";
 
   src = fetchzip {
     urls = [
@@ -36,10 +36,10 @@ rustPlatform.buildRustPackage rec {
       "https://codeberg.org/meli/meli/archive/v${version}.tar.gz"
       "https://github.com/meli/meli/archive/refs/tags/v${version}.tar.gz"
     ];
-    hash = "sha256-Dp0WI1Cl+m7oxZ/4zEi0TtOwqRX681jZht9bNMFnmsU=";
+    hash = "sha256-uyhxNEKoRKrqvU76SuTKl1wlwOdHIxMFLXB5LwsdvQE=";
   };
 
-  cargoHash = "sha256-DJtk8xLppXdl9sSt6GcaXwZ5MEIY/s/z/bdcdr8YdLw=";
+  cargoHash = "sha256-wDj4g5Cjm6zedjCmpc/A40peHO951lLuEQGsn+i3eT0=";
 
   # Needed to get openssl-sys to use pkg-config
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index ebc6e2bfead3..c2e42872e1aa 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-tYGzU/sn6KLLetDmAyph5u8bCocmfF4ZysTkOCSVf+U=";
+    hash = "sha256-8dym3E6VinpExE4A+ekbhiQ+Zhwvue6/s1mAhBkwPMU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 718fb15a7ca8..335ee9a1cd3c 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "5.5.0";
+  version = "5.5.1";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-swfzmuw7TtRvYeAlRTP1v3zvuSUsD/j1FddPfMDekbs=";
+    hash = "sha256-6K/mlx1l8Ijmligefb2Wcwq9aSGh5PbvgoyJpx0U4w4=";
   };
 
-  vendorHash = "sha256-Gi/y6fCrfphBrF4Zag1zkAXuRhvvl9sTm3Magm6k0Q0=";
+  vendorHash = "sha256-Tl8ubucPn72TGD5ER3zeDHJUoSklNeeByitj/WfICoU=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/nx/nxv/package.nix b/pkgs/by-name/nx/nxv/package.nix
index 42087f68caed..3fac23f6d872 100644
--- a/pkgs/by-name/nx/nxv/package.nix
+++ b/pkgs/by-name/nx/nxv/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nxv";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "jamesbrink";
     repo = "nxv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tKjb+B65ZrLIJ7aDYGC3kj71iAXoFmAaj5I8+o4EzlM=";
+    hash = "sha256-Gj+5Tgt0IO2P/GyPVM9yBgYoiSkpdfcq1r8TmZLZMSs=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-RW3WrG1A/J1xuWWcHOARG6EEmSWWnDeycAtbppY52OI=";
+  cargoHash = "sha256-7c1LryJvrOsSiLPYNvGIFaTONhA0c99n918/yNRKkxo=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 1bf49b13e252..37b59c1e875d 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.12.7";
+  version = "26.1.4";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-C05YNT6BfrWMuzph8DxNnc5eu2b3nqj06bzWqEWm0hU=";
+    hash = "sha256-+YDDbG1M/po1ln/vpzoWcj8wD5302o1kjv9b6UWZsNU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/runescape/package.nix b/pkgs/by-name/ru/runescape/package.nix
index f0f6751701f3..16aaec3a34a7 100644
--- a/pkgs/by-name/ru/runescape/package.nix
+++ b/pkgs/by-name/ru/runescape/package.nix
@@ -99,7 +99,7 @@ let
       homepage = "https://www.runescape.com/";
       sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
       license = lib.licenses.unfree;
-      maintainers = with lib.maintainers; [ grburst ];
+      maintainers = [ ];
       platforms = [ "x86_64-linux" ];
     };
   };
@@ -149,7 +149,7 @@ buildFHSEnv {
     description = "RuneScape Game Client (NXT) - Launcher for RuneScape 3";
     homepage = "https://www.runescape.com/";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ grburst ];
+    maintainers = [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/by-name/sh/showtime/package.nix b/pkgs/by-name/sh/showtime/package.nix
index ad483746311d..8988fee92d3b 100644
--- a/pkgs/by-name/sh/showtime/package.nix
+++ b/pkgs/by-name/sh/showtime/package.nix
@@ -69,6 +69,13 @@ python3Packages.buildPythonApplication rec {
     export HOME="$TEMPDIR"
   '';
 
+  # HACK: To get rid of unreproducible __pycache__ created by pythonImportsCheck.
+  # See https://github.com/NixOS/nixpkgs/issues/469081
+  deletePycachePhase = ''
+    find $out/lib -type d -name __pycache__ -prune -exec rm -vr {} \;
+  '';
+  postPhases = [ "deletePycachePhase" ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "showtime";
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index df8edd29a7b8..ddf349aead95 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -20,16 +20,16 @@ let
   television = rustPlatform.buildRustPackage (finalAttrs: {
     pname = "television";
 
-    version = "0.14.3";
+    version = "0.14.4";
 
     src = fetchFromGitHub {
       owner = "alexpasmantier";
       repo = "television";
       tag = finalAttrs.version;
-      hash = "sha256-z+ztj21JJaMuqTaN44JVAyAzSmOzUgjo9t23lTnehyI=";
+      hash = "sha256-OXWRJGfnNcZQMkmeCjNEsOTTDmvwYTCI8eyWNU4l8D4=";
     };
 
-    cargoHash = "sha256-TAj6QgQK/ZOcUMeIePD2tzBKav4BJSeOjaSSaO5eD6o=";
+    cargoHash = "sha256-yLv8Jw3buKg3s0yB+KrVSPM/s+LpBu0brz1U11B/dZg=";
 
     strictDeps = true;
     nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/watcher/package.nix b/pkgs/by-name/wa/watcher/package.nix
index 78d08eb9dbde..1ee9b6c37f30 100644
--- a/pkgs/by-name/wa/watcher/package.nix
+++ b/pkgs/by-name/wa/watcher/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "watcher";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "e-dant";
     repo = "watcher";
     tag = version;
-    hash = "sha256-Rqsm6DBS8SHxibQvrwO30RZ5ZPLWQvdTOM7i2zzCPXc=";
+    hash = "sha256-UO17PcLVsPgSFOfCPFth/SzEQaZRcXWPHKQFLTrPnEU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xc/xcwd/package.nix b/pkgs/by-name/xc/xcwd/package.nix
index 58808c9ec962..b206010dfbdb 100644
--- a/pkgs/by-name/xc/xcwd/package.nix
+++ b/pkgs/by-name/xc/xcwd/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/schischi/xcwd";
     license = lib.licenses.bsd3;
     mainProgram = "xcwd";
-    maintainers = [ lib.maintainers.grburst ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index 827af00f896e..2a680f122d99 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.8.129";
+  version = "0.8.130";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y7iIODMczLFRisOPxLPsl2Ot44I8pvjflD3vI+4rIlk=";
+    hash = "sha256-v2o+AhfI1qqRRc1yEhOYLnZb8cEdIye4HeMQ2hcwbOU=";
 
     nativeBuildInputs = [
       git
diff --git a/pkgs/development/compilers/dart/default.nix b/pkgs/development/compilers/dart/default.nix
index 82ebeba65138..352fc6e5337c 100644
--- a/pkgs/development/compilers/dart/default.nix
+++ b/pkgs/development/compilers/dart/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://dart.dev";
-    maintainers = with lib.maintainers; [ grburst ];
+    maintainers = [ ];
     description = "Scalable programming language, with robust libraries and runtimes, for building web, server, and mobile apps";
     longDescription = ''
       Dart is a class-based, single inheritance, object-oriented language
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index e61bdbb2d1fd..c37a6a2988e5 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -1,8 +1,6 @@
 {
   lib,
   stdenv,
-  # Enables some expensive tests, useful for verifying an update
-  afdko,
   antlr4_13,
   booleanoperations,
   buildPythonPackage,
@@ -26,7 +24,7 @@
   ufoprocessor,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "afdko";
   version = "4.0.2";
   pyproject = true;
@@ -36,7 +34,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "adobe-type-tools";
     repo = "afdko";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256:0955dvbydifhgx9gswbf5drsmmghry7iyf6jwz6qczhj86clswcm";
   };
 
@@ -144,14 +142,14 @@ buildPythonPackage rec {
   ];
 
   passthru.tests = {
-    fullTestsuite = afdko.override { runAllTests = true; };
+    fullTestsuite = finalAttrs.finalPackage.override { runAllTests = true; };
   };
 
   meta = {
     description = "Adobe Font Development Kit for OpenType";
-    changelog = "https://github.com/adobe-type-tools/afdko/blob/${version}/NEWS.md";
+    changelog = "https://github.com/adobe-type-tools/afdko/blob/${finalAttrs.version}/NEWS.md";
     homepage = "https://adobe-type-tools.github.io/afdko";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
new file mode 100644
index 000000000000..c9b661eee919
--- /dev/null
+++ b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  click,
+  jinja2,
+  pyyaml,
+  rich,
+  pytest-cov-stub,
+  pytestCheckHook,
+  scikit-learn,
+}:
+
+buildPythonPackage rec {
+  pname = "agentic-threat-hunting-framework";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Nebulock-Inc";
+    repo = "agentic-threat-hunting-framework";
+    tag = "v${version}";
+    hash = "sha256-rt7WmBCbSqoZBpwGi7dzh8QDw8Iby3LSdavnCot1Hr0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    jinja2
+    pyyaml
+    rich
+  ];
+
+  optional-dependencies = {
+    similarity = [ scikit-learn ];
+  };
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "athf" ];
+
+  meta = {
+    description = "Framework for agentic threat hunting";
+    homepage = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework";
+    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiohomematic/default.nix b/pkgs/development/python-modules/aiohomematic/default.nix
index 384c71f3485d..ab3b5dad39ca 100644
--- a/pkgs/development/python-modules/aiohomematic/default.nix
+++ b/pkgs/development/python-modules/aiohomematic/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aiohomematic";
-  version = "2026.1.5";
+  version = "2026.1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "aiohomematic";
     tag = version;
-    hash = "sha256-WOAbfy3cufE/5iDpDR5J0eNFFYyzwCLsgFqIFfLvYZM=";
+    hash = "sha256-bPz40fOSEimhUrSyOO0JVahFjL2V48x8IHdaA6mh3VI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiosmb/default.nix b/pkgs/development/python-modules/aiosmb/default.nix
index ba4fb2bd08f8..4034ca3e9713 100644
--- a/pkgs/development/python-modules/aiosmb/default.nix
+++ b/pkgs/development/python-modules/aiosmb/default.nix
@@ -9,7 +9,6 @@
   minikerberos,
   prompt-toolkit,
   pycryptodomex,
-  pythonOlder,
   setuptools,
   six,
   tqdm,
@@ -19,14 +18,12 @@
 
 buildPythonPackage rec {
   pname = "aiosmb";
-  version = "0.4.13";
+  version = "0.4.14";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ytnzpUnshwKczXgqNPL0vouBMSgY52zONOrwraUVnk8=";
+    hash = "sha256-So6u+sX7EOEIjrYejfWK/z/mH9bxHOcu/YpjF1VfAsM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index df1014ec53a2..be09243c89fd 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.10.0";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-hPcL1FB7O/+YCq+p32KWykfoDTs3g+sk1oBCtrZZERU=";
+    hash = "sha256-mzOarqm7ng4Jz+z5CNjmff8j0wfNGSYjR2LNhtRfmhc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 98267ed28318..61168ec51802 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202601031";
+  version = "0.1.202601051";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
-    tag = "v${version}";
-    hash = "sha256-01PMwJ7F7quyZPHUWVtTe9dkAktZ3j8MbIysIcb+BD4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zCFUaPVocCvFH3eWdfufWHDsgN/ewW/hKoS9D/XnInU=";
   };
 
   __darwinAllowLocalNetworking = true;
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module for utilizing AWS IAM data for Services, Actions, Resources, and Condition Keys";
     homepage = "https://github.com/cloud-copilot/iam-data-python";
-    changelog = "https://github.com/cloud-copilot/iam-data-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/cloud-copilot/iam-data-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix b/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
index 5c83589693bd..c3d6fd8c3bf9 100644
--- a/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
+++ b/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
@@ -16,19 +16,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lance-namespace";
-  version = "0.4.0";
+  version = "0.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance-namespace";
-    tag = "v${version}";
-    hash = "sha256-t6VCKG54Sxf92B1OmfXXsWaJww2fyEcMGpJy4z94HZs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aNo6rrWnnFpFk3iPX1sQsuXTDkE5ZRA/9P7TQeJr4iI=";
   };
 
-  sourceRoot = "${src.name}/python/lance_namespace_urllib3_client";
+  sourceRoot = "${finalAttrs.src.name}/python/lance_namespace_urllib3_client";
 
   build-system = [
     hatchling
@@ -53,4 +53,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/lance-namespace/default.nix b/pkgs/development/python-modules/lance-namespace/default.nix
index dacb8e124dc6..6853775d1816 100644
--- a/pkgs/development/python-modules/lance-namespace/default.nix
+++ b/pkgs/development/python-modules/lance-namespace/default.nix
@@ -28,19 +28,19 @@
   lance-namespace,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lance-namespace";
-  version = "0.4.0";
+  version = "0.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance-namespace";
-    tag = "v${version}";
-    hash = "sha256-t6VCKG54Sxf92B1OmfXXsWaJww2fyEcMGpJy4z94HZs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aNo6rrWnnFpFk3iPX1sQsuXTDkE5ZRA/9P7TQeJr4iI=";
   };
 
-  sourceRoot = "${src.name}/python/lance_namespace";
+  sourceRoot = "${finalAttrs.src.name}/python/lance_namespace";
 
   build-system = [
     hatchling
@@ -74,7 +74,7 @@ buildPythonPackage rec {
     pylance
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.optional-dependencies;
 
   # Tests require pylance, which is a circular dependency
   doCheck = false;
@@ -108,4 +108,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pytorch-tokenizers/add-missing-cstdint-sentencepiece.patch b/pkgs/development/python-modules/pytorch-tokenizers/add-missing-cstdint-sentencepiece.patch
new file mode 100644
index 000000000000..95556a83da45
--- /dev/null
+++ b/pkgs/development/python-modules/pytorch-tokenizers/add-missing-cstdint-sentencepiece.patch
@@ -0,0 +1,13 @@
+Submodule third-party/sentencepiece contains modified content
+diff --git a/third-party/sentencepiece/src/sentencepiece_processor.h b/third-party/sentencepiece/src/sentencepiece_processor.h
+index dd3f092..553fbff 100644
+--- a/third-party/sentencepiece/src/sentencepiece_processor.h
++++ b/third-party/sentencepiece/src/sentencepiece_processor.h
+@@ -16,6 +16,7 @@
+ #define SENTENCEPIECE_PROCESSOR_H_
+ 
+ #include <cstring>
++#include <cstdint>
+ #include <memory>
+ #include <string>
+ #include <string_view>
diff --git a/pkgs/development/python-modules/pytorch-tokenizers/default.nix b/pkgs/development/python-modules/pytorch-tokenizers/default.nix
index e87b613b887a..10f2835577f5 100644
--- a/pkgs/development/python-modules/pytorch-tokenizers/default.nix
+++ b/pkgs/development/python-modules/pytorch-tokenizers/default.nix
@@ -45,6 +45,8 @@ buildPythonPackage rec {
     (replaceVars ./dont-fetch-pybind11.patch {
       pybind11 = pybind11-src;
     })
+    # error: ‘uint32_t’ does not name a type
+    ./add-missing-cstdint-sentencepiece.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/simple-websocket/default.nix b/pkgs/development/python-modules/simple-websocket/default.nix
index a4da26a4bdde..66de62481a04 100644
--- a/pkgs/development/python-modules/simple-websocket/default.nix
+++ b/pkgs/development/python-modules/simple-websocket/default.nix
@@ -2,23 +2,21 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
-  pythonOlder,
   setuptools,
   wsproto,
+  pythonAtLeast,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "simple-websocket";
   version = "1.1.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "simple-websocket";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-dwL6GUyygNGBXqkkTnsHwFFpa1JAaeWc9ycQNRgTN4I=";
   };
 
@@ -33,13 +31,17 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require network access
     "SimpleWebSocketClientTestCase"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # RuntimeError: There is no current event loop in thread 'MainThread'
+    "AioSimpleWebSocketServerTestCase"
   ];
 
   meta = {
     description = "Simple WebSocket server and client for Python";
     homepage = "https://github.com/miguelgrinberg/simple-websocket";
-    changelog = "https://github.com/miguelgrinberg/simple-websocket/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/miguelgrinberg/simple-websocket/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/starlette-admin/default.nix b/pkgs/development/python-modules/starlette-admin/default.nix
index ba2cf376223d..5c341d6d7a4a 100644
--- a/pkgs/development/python-modules/starlette-admin/default.nix
+++ b/pkgs/development/python-modules/starlette-admin/default.nix
@@ -3,15 +3,26 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonAtLeast,
+
+  # build-system
   hatchling,
+
+  # dependencies
+  jinja2,
+  python-multipart,
+  starlette,
+
+  # optional-dependencies
+  babel,
+
+  # tests
   aiosqlite,
   arrow,
-  babel,
   cacert,
   colour,
   fasteners,
   httpx,
-  jinja2,
   mongoengine,
   motor,
   passlib,
@@ -21,25 +32,23 @@
   pydantic,
   pytest-asyncio,
   pytestCheckHook,
-  python-multipart,
   requests,
   sqlalchemy,
   sqlalchemy-file,
   sqlalchemy-utils,
   sqlmodel,
-  starlette,
 }:
 
 buildPythonPackage rec {
   pname = "starlette-admin";
-  version = "0.15.1";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jowilf";
     repo = "starlette-admin";
     tag = version;
-    hash = "sha256-yPePxdKrg41kycXl1fDKf1jWx0YD+K26w8z2LmQV0g0=";
+    hash = "sha256-JVvrfbyKillkx6fOx4DEbHZoHIPxF1Gn3HzkxyJc66o=";
   };
 
   build-system = [ hatchling ];
@@ -85,12 +94,17 @@ buildPythonPackage rec {
     export LOCAL_PATH="$PWD/.storage"
   '';
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-    # flaky, depends on test order
-    "test_ensuring_pk"
-    # flaky, of-by-one
-    "test_api"
-  ];
+  disabledTests =
+    lib.optionals (pythonAtLeast "3.14") [
+      # AssertionError: Regex pattern did not match
+      "test_not_supported_annotation"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # flaky, depends on test order
+      "test_ensuring_pk"
+      # flaky, of-by-one
+      "test_api"
+    ];
 
   disabledTestPaths = [
     # odmantic is not packaged
diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index b3fda97b6897..e17862c54e9c 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,28 @@
 {
   "game": {
     "latest": {
-      "linux": "53.06",
+      "linux": "53.08",
       "darwin": "0.47.05"
     },
     "versions": {
-      "53.06": {
+      "53.08": {
         "df": {
-          "version": "53.06",
+          "version": "53.08",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_53_06_linux.tar.bz2",
-              "outputHash": "sha256-PSoYP9XVgAYMPih3uP2pCMwkWic3jPkz+V5j9g0KO1A="
+              "url": "https://www.bay12games.com/dwarves/df_53_08_linux.tar.bz2",
+              "outputHash": "sha256-0h6vA9n33Qt/y4v9UIuQl7p//SuQOkRV8Moe3MYAfIw="
             }
           }
         },
         "hack": {
-          "version": "53.06-r1",
+          "version": "53.08-r1",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "53.06-r1",
-            "outputHash": "sha256-tjhfr7UKGaiuzjanFrYeG8CS20EDjPchB2fQr/hz9HI="
+            "revision": "53.08-r1",
+            "outputHash": "sha256-LM3lsM1SZR1fKyhfTdbYBOYe+qbGcIkpvJYT3j16OSM="
           },
-          "xmlRev": "24322fe4a30209399c1c5fe903726828edd9032b"
+          "xmlRev": "da0b52eb3ad79866b1228a880be3b734cfac7b55"
         }
       },
       "52.05": {
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 18c080f9d510..25530140c90a 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -4,14 +4,16 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  fmt,
   ninja,
   writeScriptBin,
+  writeText,
   perl,
   XMLLibXML,
   XMLLibXSLT,
   makeWrapper,
   zlib,
-  enableStoneSense ? false,
+  enableStoneSense ? true,
   allegro5,
   libGLU,
   libGL,
@@ -81,9 +83,25 @@ let
     elif [ "$*" = "rev-parse HEAD:library/xml" ]; then
       echo "${xmlRev}"
     else
+      echo "Unhandled git command: '$*'" >&2
       exit 1
     fi
   '';
+
+  needFetchOverrides = versionAtLeast version "53.07-r1";
+
+  fetchOverrides = writeText "fetch-overrides.cmake" ''
+    include_guard(GLOBAL)
+    function(cmake_language_dependency_provider method package_name)
+      if(package_name STREQUAL "fmt")
+        find_package(fmt CONFIG QUIET)
+        if(fmt_FOUND)
+          set(''${package_name}_PROVIDER_SATISFIED TRUE PARENT_SCOPE)
+          return()
+        endif()
+      endif()
+    endfunction()
+  '';
 in
 stdenv.mkDerivation {
   pname = "dfhack";
@@ -150,6 +168,9 @@ stdenv.mkDerivation {
     allegro5
     libGLU
     libGL
+  ]
+  ++ optionals needFetchOverrides [
+    fmt
   ];
 
   preConfigure = ''
@@ -173,6 +194,10 @@ stdenv.mkDerivation {
   ++ optionals enableStoneSense [
     "-DBUILD_STONESENSE=ON"
     "-DSTONESENSE_INTERNAL_SO=OFF"
+  ]
+  ++ optionals needFetchOverrides [
+    "-DFETCHCONTENT_FULLY_DISCONNECTED=ON"
+    "-DCMAKE_PROJECT_TOP_LEVEL_INCLUDES=${fetchOverrides}"
   ];
 
   NIX_CFLAGS_COMPILE = [
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index 6321e88d3dd6..8c941c8879bd 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -18,7 +18,7 @@
   expect,
   xvfb-run,
   writeText,
-  enableStoneSense ? false,
+  enableStoneSense ? enableDFHack,
   enableTWBT ? false,
   twbt,
   themes ? { },
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
index 45b3718be15b..2a7660dad059 100644
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "SukramJ";
   domain = "homematicip_local";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "custom_homematic";
     tag = version;
-    hash = "sha256-r/VKs5npPNoOZmWQmpoyEgCjRBZz8KEpNeLFVo5PECo=";
+    hash = "sha256-lcw1N2xnM+CkzLCSVkp9R/+AEoWUQTnDkGo+q4R21ZU=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0acb8b188d10..85854a912bbd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -142,6 +142,10 @@ self: super: with self; {
 
   agent-py = callPackage ../development/python-modules/agent-py { };
 
+  agentic-threat-hunting-framework =
+    callPackage ../development/python-modules/agentic-threat-hunting-framework
+      { };
+
   aggdraw = callPackage ../development/python-modules/aggdraw { };
 
   aggregate6 = callPackage ../development/python-modules/aggregate6 { };