diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index d84a0645a234..cf9f53baba96 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -210,6 +210,7 @@
 
 - `mold` is now wrapped by default.
 
+- `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB.
 
 ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cecc92804e56..9b47bd505228 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21810,7 +21810,6 @@
     email = "aaron@bolddaemon.com";
     github = "qbit";
     githubId = 68368;
-    matrix = "@qbit:tapenet.org";
     keys = [ { fingerprint = "3586 3350 BFEA C101 DB1A 4AF0 1F81 112D 62A9 ADCE"; } ];
   };
   qdlmcfresh = {
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 6b5e9dd045b9..98ec3ae17cdd 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -78,7 +78,7 @@ luadbi-postgresql,,,,,,
 luadbi-sqlite3,,,,,,
 luaepnf,,,,,,
 luaevent,,,,,,
-luaexpat,,,,1.4.1-1,,arobyn flosse
+luaexpat,,,,,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
 luafilesystem,,,,,,flosse
 lualdap,,,,,,aanderse
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 7e302a190a87..30b1f284b10d 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -10,8 +10,9 @@ let
   # Partition environment variables into regular and file-based (_FILE suffix)
   envVarToCredName = varName: lib.toLower varName;
   partitionEnv =
-    env:
+    allEnv:
     let
+      env = lib.filterAttrs (_name: value: value != null) allEnv;
       regular = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) env;
       fileBased = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) env;
       fileBasedTransformed = lib.mapAttrs' (
@@ -240,14 +241,6 @@ in
               (coercedTo bool builtins.toJSON str)
             ]);
           options = {
-            N8N_RUNNERS_CONFIG_PATH = lib.mkOption {
-              internal = true;
-              type = with lib.types; nullOr path;
-              default = launcherConfigFile;
-              description = ''
-                Path to the configuration file for the task runner launcher.
-              '';
-            };
             N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkOption {
               type = with lib.types; nullOr path;
               default = cfg.environment.N8N_RUNNERS_AUTH_TOKEN_FILE;
@@ -401,7 +394,11 @@ in
       after = [ "n8n.service" ];
       requires = [ "n8n.service" ];
       wantedBy = [ "multi-user.target" ];
-      environment = runnersEnv.regular // runnersEnv.fileBasedTransformed;
+      environment = {
+        N8N_RUNNERS_CONFIG_PATH = launcherConfigFile;
+      }
+      // runnersEnv.regular
+      // runnersEnv.fileBasedTransformed;
       serviceConfig = {
         Type = "simple";
         ExecStart = "${lib.getExe runnersCfg.launcherPackage} ${lib.concatStringsSep " " runnerTypes}";
diff --git a/nixos/modules/services/security/reaction.nix b/nixos/modules/services/security/reaction.nix
index 63e7eb586f60..039e507ae57f 100644
--- a/nixos/modules/services/security/reaction.nix
+++ b/nixos/modules/services/security/reaction.nix
@@ -7,10 +7,21 @@
 let
   settingsFormat = pkgs.formats.yaml { };
 
+  cfg = config.services.reaction;
+
   inherit (lib)
-    mkOption
+    concatMapStringsSep
+    filterAttrs
+    getExe
+    mkDefault
     mkEnableOption
+    mkIf
+    mkOption
     mkPackageOption
+    mapAttrs
+    optional
+    optionals
+    optionalString
     types
     ;
 in
@@ -30,7 +41,65 @@ in
       default = { };
       type = types.submodule {
         freeformType = settingsFormat.type;
-        options = { };
+        options = {
+          plugins = mkOption {
+            description = ''
+              Nixpkgs provides a `reaction-plugins` package set which includes both offical and community plugins for reaction.
+
+              To use the plugins in your module configuration, in `settings.plugins` you can use for e.g. `''${lib.getExe reaction-plugins.reaction-plugin-ipset}`
+              See https://reaction.ppom.me/plugins/ to configure plugins.
+            '';
+            default = { };
+            type = types.attrsOf (
+              types.submodule (
+                { name, ... }:
+                {
+                  options = {
+                    enable = mkOption {
+                      description = "enable reaction-plugin-${name}";
+                      type = types.bool;
+                      default = true;
+                    };
+                    path = mkOption {
+                      description = "path to the plugin binary";
+                      type = types.str;
+                      default = "${cfg.package.plugins."reaction-plugin-${name}"}/bin/reaction-plugin-${name}";
+                      defaultText = lib.literalExpression ''''${cfg.package.plugins."reaction-plugin-${name}"}/bin/reaction-plugin-${name}'';
+                    };
+                    check_root = mkOption {
+                      description = "Whether reaction must check that the executable is owned by root";
+                      type = types.bool;
+                      default = true;
+                    };
+                    systemd = mkOption {
+                      description = "Whether reaction must isolate the plugin using systemd's run0";
+                      type = types.bool;
+                      default = cfg.runAsRoot;
+                      defaultText = "config.services.reaction.runAsRoot";
+                    };
+                    systemd_options = mkOption {
+                      description = ''
+                        A key-value map of systemd options.
+                        Keys must be strings and values must be string arrays.
+
+                        See `man systemd.directives` for all supported options, and particularly options in `man systemd.exec`
+                      '';
+                      type = types.attrsOf (types.listOf types.str);
+                      default = { };
+                    };
+                  };
+                }
+              )
+            );
+            # Filter plugins which are disabled
+            apply =
+              self:
+              lib.pipe self [
+                (filterAttrs (name: p: p.enable))
+                (mapAttrs (name: p: removeAttrs p [ "enable" ]))
+              ];
+          };
+        };
       };
     };
 
@@ -113,25 +182,39 @@ in
           services.openssh.settings.LogLevel = lib.mkDefault "VERBOSE";
         }
         ```
+
+        ```nix
+        # core ipset plugin requires these if running as non-root
+        systemd.services.reaction.serviceConfig = {
+          CapabilityBoundingSet = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+            "CAP_DAC_READ_SEARCH" # for journalctl
+          ];
+          AmbientCapabilities = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+            "CAP_DAC_READ_SEARCH"
+          ];
+        };
+        ```
       '';
     };
   };
 
   config =
     let
-      cfg = config.services.reaction;
-
       generatedSettings = settingsFormat.generate "reaction.yml" cfg.settings;
       settingsDir = pkgs.runCommand "reaction-settings-dir" { } ''
         mkdir -p $out
-        ${lib.concatMapStringsSep "\n" (file: ''
+        ${concatMapStringsSep "\n" (file: ''
           filename=$(basename "${file}")
           ln -s "${file}" "$out/$filename"
         '') cfg.settingsFiles}
         ln -s ${generatedSettings} $out/reaction.yml
       '';
     in
-    lib.mkIf cfg.enable {
+    mkIf cfg.enable {
       assertions = [
         {
           assertion = cfg.settings != { } || (builtins.length cfg.settingsFiles) != 0;
@@ -139,7 +222,7 @@ in
         }
       ];
 
-      users = lib.mkIf (!cfg.runAsRoot) {
+      users = mkIf (!cfg.runAsRoot) {
         users.reaction = {
           isSystemUser = true;
           group = "reaction";
@@ -148,27 +231,29 @@ in
       };
 
       system.checks =
-        lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform)
+        optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform)
           (
             pkgs.runCommand "reaction-config-validation" { } ''
-              ${lib.getExe cfg.package} test-config -c ${settingsDir} >/dev/null
+              ${getExe cfg.package} test-config -c ${settingsDir} >/dev/null
               echo "reaction config ${settingsDir} is valid"
               touch $out
             ''
           );
 
       systemd.services.reaction = {
-        description = "Scan logs and take action";
+        description = "A daemon that scans program outputs for repeated patterns, and takes action.";
+        documentation = [ "https://reaction.ppom.me" ];
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        partOf = lib.optionals cfg.stopForFirewall [ "firewall.service" ];
+        partOf = optionals cfg.stopForFirewall [ "firewall.service" ];
         path = [ pkgs.iptables ];
         serviceConfig = {
           Type = "simple";
+          KillMode = "mixed"; # for plugins
           User = if (!cfg.runAsRoot) then "reaction" else "root";
           ExecStart = ''
-            ${lib.getExe cfg.package} start -c ${settingsDir}${
-              lib.optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
+            ${getExe cfg.package} start -c ${settingsDir}${
+              optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
             }
           '';
 
@@ -197,6 +282,20 @@ in
         };
       };
 
+      # pre-configure official plugins
+      services.reaction.settings.plugins = {
+        ipset = {
+          enable = mkDefault true;
+          systemd_options = {
+            CapabilityBoundingSet = [
+              "~CAP_NET_ADMIN"
+              "~CAP_PERFMON"
+            ];
+          };
+        };
+        virtual.enable = mkDefault true;
+      };
+
       environment.systemPackages = [ cfg.package ];
     };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 34cc5e601125..109a14676734 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1386,8 +1386,10 @@ in
   rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
   rauc = runTest ./rauc.nix;
-  reaction = runTest ./reaction.nix;
-  reaction-firewall = runTest ./reaction-firewall.nix;
+  reaction = import ./reaction {
+    inherit (pkgs) lib;
+    inherit runTest;
+  };
   readarr = runTest ./readarr.nix;
   readeck = runTest ./readeck.nix;
   realm = runTest ./realm.nix;
diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix
index 270f63648904..3d2c1ad4d9c1 100644
--- a/nixos/tests/n8n.nix
+++ b/nixos/tests/n8n.nix
@@ -16,9 +16,11 @@ in
 
   node.pkgsReadOnly = false;
 
-  nodes.machine =
-    { ... }:
-    {
+  nodes = {
+    machine_simple = {
+      services.n8n.enable = true;
+    };
+    machine_configured = {
       services.n8n = {
         enable = true;
         customNodes = [ pkgs.n8n-nodes-carbonejs ];
@@ -49,52 +51,58 @@ in
         };
       };
     };
+  };
 
   testScript = ''
-    machine.wait_for_unit("n8n.service")
-    machine.wait_for_console_text("Editor is now accessible via")
+    machine_simple.wait_for_unit("n8n.service")
+    machine_simple.wait_for_console_text("Editor is now accessible via")
+    machine_simple.succeed("curl --fail -vvv http://localhost:${toString port}/")
+
+
+    machine_configured.wait_for_unit("n8n.service")
+    machine_configured.wait_for_console_text("Editor is now accessible via")
 
     # Test regular environment variables
-    machine.succeed("curl --fail -vvv http://localhost:${toString port}/")
-    machine.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
-    machine.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_DIAGNOSTICS_ENABLED=false' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_TEMPLATES_ENABLED=false' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'DB_PING_INTERVAL_SECONDS=2' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("curl --fail -vvv http://localhost:${toString port}/")
+    machine_configured.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
+    machine_configured.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_DIAGNOSTICS_ENABLED=false' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_TEMPLATES_ENABLED=false' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'DB_PING_INTERVAL_SECONDS=2' /etc/systemd/system/n8n.service")
 
     # Test _FILE environment variables
-    machine.succeed("grep -qF 'LoadCredential=n8n_encryption_key_file:${secretFile}' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_ENCRYPTION_KEY_FILE=%d/n8n_encryption_key_file' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_encryption_key_file:${secretFile}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_ENCRYPTION_KEY_FILE=%d/n8n_encryption_key_file' /etc/systemd/system/n8n.service")
 
     # Test custom nodes
-    machine.succeed("grep -qF 'N8N_CUSTOM_EXTENSIONS=' /etc/systemd/system/n8n.service")
-    custom_extensions_dir = machine.succeed("grep -oP 'N8N_CUSTOM_EXTENSIONS=\\K[^\"]+' /etc/systemd/system/n8n.service").strip()
-    machine.succeed(f"test -L {custom_extensions_dir}/n8n-nodes-carbonejs")
-    machine.succeed(f"test -f {custom_extensions_dir}/n8n-nodes-carbonejs/package.json")
+    machine_configured.succeed("grep -qF 'N8N_CUSTOM_EXTENSIONS=' /etc/systemd/system/n8n.service")
+    custom_extensions_dir = machine_configured.succeed("grep -oP 'N8N_CUSTOM_EXTENSIONS=\\K[^\"]+' /etc/systemd/system/n8n.service").strip()
+    machine_configured.succeed(f"test -L {custom_extensions_dir}/n8n-nodes-carbonejs")
+    machine_configured.succeed(f"test -f {custom_extensions_dir}/n8n-nodes-carbonejs/package.json")
 
     # Test task runner integration on n8n service
-    machine.succeed("grep -qF 'N8N_RUNNERS_MODE=external' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_RUNNERS_BROKER_PORT=${toString brokerPort}' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_MODE=external' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_BROKER_PORT=${toString brokerPort}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n.service")
 
     # Test task runner service
-    machine.wait_for_unit("n8n-task-runner.service")
-    machine.succeed("systemctl is-active n8n-task-runner.service")
+    machine_configured.wait_for_unit("n8n-task-runner.service")
+    machine_configured.succeed("systemctl is-active n8n-task-runner.service")
 
     # Test that both runner types are enabled
-    machine.succeed("grep -qF 'javascript python' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'javascript python' /etc/systemd/system/n8n-task-runner.service")
 
     # Test common environment variables are passed to launcher
-    machine.succeed("grep -qF 'N8N_RUNNERS_MAX_CONCURRENCY=10' /etc/systemd/system/n8n-task-runner.service")
-    machine.succeed("grep -qF 'N8N_RUNNERS_TASK_BROKER_URI=http://127.0.0.1:${toString brokerPort}' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_MAX_CONCURRENCY=10' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_TASK_BROKER_URI=http://127.0.0.1:${toString brokerPort}' /etc/systemd/system/n8n-task-runner.service")
 
     # Test auth token is loaded via credentials
-    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n-task-runner.service")
 
     # Test launcher config file
-    config_path = machine.succeed("grep -oP 'N8N_RUNNERS_CONFIG_PATH=\\K[^[:space:]\"]+' /etc/systemd/system/n8n-task-runner.service").strip()
-    config = machine.succeed(f"cat {config_path}")
+    config_path = machine_configured.succeed("grep -oP 'N8N_RUNNERS_CONFIG_PATH=\\K[^[:space:]\"]+' /etc/systemd/system/n8n-task-runner.service").strip()
+    config = machine_configured.succeed(f"cat {config_path}")
     assert "NODE_FUNCTION_ALLOW_BUILTIN" in config, "JavaScript env-override not in config"
     assert "N8N_RUNNERS_STDLIB_ALLOW" in config, "Python env-override not in config"
     assert "N8N_RUNNERS_MAX_CONCURRENCY" in config, "Common allowed-env not in config"
diff --git a/nixos/tests/reaction.nix b/nixos/tests/reaction/basic.nix
similarity index 95%
rename from nixos/tests/reaction.nix
rename to nixos/tests/reaction/basic.nix
index 4cef6ead87a9..2b454723c8b2 100644
--- a/nixos/tests/reaction.nix
+++ b/nixos/tests/reaction/basic.nix
@@ -10,7 +10,7 @@
     services.reaction = {
       enable = true;
       stopForFirewall = false;
-      # example.jsonnet/example.yml can be copied and modified from ${pkgs.reaction}/share/examples
+      # example.jsonnet or example.yml can be copied and modified from ${pkgs.reaction}/share/examples
       settingsFiles = [ "${pkgs.reaction}/share/examples/example.jsonnet" ];
       runAsRoot = false;
     };
@@ -92,6 +92,7 @@
     {
       # not needed, only for manual interactive debugging
       virtualisation.memorySize = 4096;
+      virtualisation.graphics = false;
       environment.systemPackages = with pkgs; [
         btop
         sysz
diff --git a/nixos/tests/reaction/default.nix b/nixos/tests/reaction/default.nix
new file mode 100644
index 000000000000..38328b56c5ca
--- /dev/null
+++ b/nixos/tests/reaction/default.nix
@@ -0,0 +1,6 @@
+{ lib, runTest }:
+lib.recurseIntoAttrs {
+  basic = runTest ./basic.nix;
+  firewall = runTest ./firewall.nix;
+  plugins = runTest ./plugins.nix;
+}
diff --git a/nixos/tests/reaction-firewall.nix b/nixos/tests/reaction/firewall.nix
similarity index 88%
rename from nixos/tests/reaction-firewall.nix
rename to nixos/tests/reaction/firewall.nix
index 49d4d276da02..9286c036a025 100644
--- a/nixos/tests/reaction-firewall.nix
+++ b/nixos/tests/reaction/firewall.nix
@@ -17,6 +17,12 @@
           # "${pkgs.reaction}/share/examples/example.yml" # can't specify both because conflicts
         ];
         runAsRoot = true;
+        settings = {
+          # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
+          # see https://reaction.ppom.me/reference.html#systemd
+          plugins.ipset.systemd = false;
+          plugins.virtual.systemd = false;
+        };
       };
       networking.firewall.enable = true;
     };
@@ -68,6 +74,9 @@
   # - nix run .#nixosTests.reaction-firewall.driverInteractive -L
   # - run_tests()
   interactive.sshBackdoor.enable = true; # ssh -o User=root vsock%3
+  interactive.nodes.machine = _: {
+    virtualisation.graphics = false;
+  };
 
   meta.maintainers =
     with lib.maintainers;
diff --git a/nixos/tests/reaction/plugins.nix b/nixos/tests/reaction/plugins.nix
new file mode 100644
index 000000000000..68bec4408469
--- /dev/null
+++ b/nixos/tests/reaction/plugins.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "reaction-core-plugins";
+
+  nodes.server = args: {
+    services.reaction = {
+      enable = true;
+      stopForFirewall = false;
+      runAsRoot = false;
+      settings = import ./settings.nix args;
+      /*
+        # NOTE: When runAsRoot is true, disable run0
+        settings = {
+          # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
+          # see https://reaction.ppom.me/reference.html#systemd
+          plugins.ipset.systemd = false;
+          plugins.virtual.systemd = false;
+        };
+      */
+    };
+    /*
+      NOTE:
+        - if reaction is run as non-root, the plugins need these capabilities, remove these if runAsRoot is true
+        - CAP_DAC_READ_SEARCH is for journalctl for accessing ssh logs
+        - useful tools: capable (from package bcc), captree, getpcaps (from libpcap)
+    */
+    systemd.services.reaction.serviceConfig = {
+      CapabilityBoundingSet = [
+        "CAP_NET_ADMIN"
+        "CAP_NET_RAW"
+        "CAP_DAC_READ_SEARCH"
+      ];
+      AmbientCapabilities = [
+        "CAP_NET_ADMIN"
+        "CAP_NET_RAW"
+        "CAP_DAC_READ_SEARCH"
+      ];
+    };
+    services.openssh.enable = true;
+
+    users.users.nixos.isNormalUser = true; # neeeded to establish a ssh connection, by default root login is succeeding without any password
+  };
+
+  nodes.client = _: {
+    environment.systemPackages = [
+      pkgs.sshpass
+      pkgs.libressl.nc
+    ];
+  };
+
+  testScript =
+    { nodes, ... }: # py
+    ''
+      start_all()
+
+      # Wait for everything to be ready.
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("reaction")
+      server.wait_for_unit("sshd")
+
+      client_addr = "${(lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address}"
+      server_addr = "${(lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address}"
+
+      # Verify there is not ban and the port is reachable from the client.
+      server.succeed(f"reaction show | grep -q {client_addr} || test $? -eq 1")
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+
+      # Cause authentication failure log entries.
+      for _ in range(2):
+        client.fail(f"""
+          sshpass -p 'wrongpassword' \
+            ssh -o StrictHostKeyChecking=no \
+              -o User=nixos \
+              -o ServerAliveInterval=1 \
+              -o ServerAliveCountMax=2 \
+              {server_addr}
+        """)
+
+      # Verify there is a ban and the port is unreachable from the client.
+      server.sleep(2)
+      output = server.succeed("reaction show")
+      print(output)
+      assert client_addr in output, f"client did not get banned, {client_addr}"
+
+      client.fail(f"nc -w3 -z {server_addr} 22")
+
+      # Check that unbanning works
+      output = server.succeed("reaction flush")
+      print(output)
+
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+    '';
+
+  # Debug interactively with:
+  # - nix run .#nixosTests.reaction.driverInteractive -L
+  # - run_tests()
+  # ssh -o User=root vsock%3 (can also do vsock/3, but % works with scp etc.)
+  # ssh -o User=root vsock%4
+  interactive.sshBackdoor.enable = true;
+
+  interactive.nodes.server =
+    { config, ... }:
+    {
+      # not needed, only for manual interactive debugging
+      virtualisation.memorySize = 4096;
+      virtualisation.graphics = false;
+      environment.systemPackages = with pkgs; [
+        btop
+        sysz
+        sshpass
+        libressl.nc
+      ];
+    };
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
+      ppom
+    ]
+    ++ lib.teams.ngi.members;
+}
diff --git a/nixos/tests/reaction/settings.nix b/nixos/tests/reaction/settings.nix
new file mode 100644
index 000000000000..c342f4384f78
--- /dev/null
+++ b/nixos/tests/reaction/settings.nix
@@ -0,0 +1,74 @@
+{ config, ... }:
+let
+  banFor = name: duration: {
+    ban = {
+      type = "ipset";
+      options = {
+        set = "reaction-${name}";
+        action = "add";
+      };
+    };
+    unban = {
+      after = duration;
+      type = "ipset";
+      options = {
+        set = "reaction-${name}";
+        action = "del";
+      };
+    };
+  };
+
+  journalctl = "${config.systemd.package}/bin/journalctl";
+in
+{
+  patterns = {
+    ip = {
+      type = "ip";
+      ipv6mask = 64;
+      ignore = [
+        "127.0.0.1"
+        "::1"
+      ];
+      ignorecidr = [
+        "10.1.1.0/24"
+        "2a01:e0a:b3a:1dd0::/64"
+      ];
+    };
+  };
+
+  streams = {
+    ssh = {
+      cmd = [
+        journalctl
+        "-fn0"
+        "-o"
+        "cat"
+        "-u"
+        "sshd.service"
+      ];
+      filters = {
+        failedlogin = {
+          regex = [
+            "authentication failure;.*rhost=<ip>(?: |$)"
+            "Failed password for .* from <ip> port"
+            "Invalid user .* from <ip> "
+            "Connection (?:reset|closed) by invalid user .* <ip> port"
+          ];
+          retry = 2;
+          retryperiod = "6h";
+          actions = banFor "ssh" "48h";
+        };
+        connectionreset = {
+          regex = [
+            "Connection (?:reset|closed) by(?: authenticating user .*)? <ip> port"
+            "Received disconnect from <ip> port .*[preauth]"
+            "Timeout before authentication for connection from <ip> to"
+          ];
+          retry = 2;
+          retryperiod = "6h";
+          actions = banFor "sshreset" "48h";
+        };
+      };
+    };
+  };
+}
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 47d55e3042b6..23968bf21d0e 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -177,7 +177,7 @@ let
       # the function you would have passed to python.withPackages
       extraPythonPackages ? (_: [ ]),
       # the function you would have passed to python.withPackages
-      withPython3 ? true,
+      withPython3 ? false,
       extraPython3Packages ? (_: [ ]),
       # the function you would have passed to lua.withPackages
       extraLuaPackages ? (_: [ ]),
@@ -243,9 +243,9 @@ let
   */
   generateProviderRc =
     {
-      withPython3 ? true,
+      withPython3 ? false,
       withNodeJs ? false,
-      withRuby ? true,
+      withRuby ? false,
       # Perl is problematic https://github.com/NixOS/nixpkgs/issues/132368
       withPerl ? false,
 
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index e8f04ad30fc3..5234ad484c41 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -37,14 +37,14 @@ let
       # should contain all args but the binary. Can be either a string or list
       wrapperArgs ? [ ],
       withPython2 ? false,
-      withPython3 ? true,
+      withPython3 ? false,
       # the function you would have passed to python3.withPackages
       extraPython3Packages ? (_: [ ]),
 
       waylandSupport ? lib.meta.availableOn stdenv.hostPlatform wayland,
       withNodeJs ? false,
       withPerl ? false,
-      withRuby ? true,
+      withRuby ? false,
 
       # wether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
       vimAlias ? false,
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index 2e72b7526c4e..177486c90f51 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.50.2";
+  version = "0.51.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Lg8X0t5u4Mq/eWc0yfuLyn4HlE+j6qSsLE+MFBjBpbk=";
+    hash = "sha256-fnkoIXv6QYJPYtsLZldOEjOxke6YVDEds3jF5SGZGKE=";
   };
 
-  cargoHash = "sha256-OjuCABObMRkFrTbtV4wpSHzV9Yqmwr/VotmsUW9qUDk=";
+  cargoHash = "sha256-F4s3h+WF/S6sQ9ux28sqNe9+C1I5H9735b+cVuRFjk8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/fo/foomatic-db/package.nix b/pkgs/by-name/fo/foomatic-db/package.nix
index 0fd0492f58a9..42b27aec5a86 100644
--- a/pkgs/by-name/fo/foomatic-db/package.nix
+++ b/pkgs/by-name/fo/foomatic-db/package.nix
@@ -14,15 +14,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "foomatic-db";
-  version = "0-unstable-2026-01-13";
+  version = "0-unstable-2026-02-09";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db";
-    rev = "abdfdb89a56edb0d1b7e0de2e01ce30cd0dbed22";
-    hash = "sha256-D0ULsTIVv7rJWdgK9EqH7visZoJONc8zGsV0r1uVNKE=";
+    rev = "57e546cb7774c7b03e7090ced65fb1ffd552f33d";
+    hash = "sha256-mQEOV+NJId5h/hYOL+2JrEHjqM77qRExDNeqZ0IyA08=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index 2887b84b11a7..3d90f41dbc61 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -110,8 +110,8 @@ stdenv.mkDerivation (finalAttrs: {
     cp -R FreeFileSync/Build/* $out
     mv $out/{Bin,bin}
 
-    mkdir -p $out/share/pixmaps
-    unzip -j $out/Resources/Icons.zip '*Sync.png' -d $out/share/pixmaps
+    mkdir -p $out/share/icons/hicolor/128x128/apps
+    unzip -j $out/Resources/Icons.zip '*Sync.png' -d $out/share/icons/hicolor/128x128/apps
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix
index 67a1f72cbfff..983691553f72 100644
--- a/pkgs/by-name/fr/freerdp/package.nix
+++ b/pkgs/by-name/fr/freerdp/package.nix
@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.22.0";
+  version = "3.23.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-cJFY0v2zvbaKVINOKVZGvLozwgD7kf2ffVU9EGYBMGQ=";
+    hash = "sha256-WGuRnNwcvxwIudSzPoJB4BmaTLHKU7bsZkgWmzJPLSQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index b86aaa916b29..496499e9ff86 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "incus-ui-canonical";
-  version = "0.19.7";
+  version = "0.19.8";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${finalAttrs.version}";
-    hash = "sha256-YMUGEHhfwDzasSZOqnlhb7zw5qG+LRlKhIHCuAztu2M=";
+    hash = "sha256-Dql04inmmWi7X6dQdjJmw0hkIBxlNlnwlTrK3/EN3yA=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index fc5f995c0a90..2b7f08212d04 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jnv";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VjT0S+eEaO8FOPb1grIpheeP9v1dCpV7FRHn+nJXOEM=";
+    hash = "sha256-sW3wy5m3fnTDIxRC/E/EWEvuJ92o+l4QCmwdqL2tZ98=";
   };
 
-  cargoHash = "sha256-dR9cb3TBxrRGP3BFYro/nGe5XVEfJuTZbQLo+FUfFNs=";
+  cargoHash = "sha256-jKeAgeW54lAgcv6Xpz9Rwt10tdac4S4B5EAmwanaW9c=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ka/kaput-cli/package.nix b/pkgs/by-name/ka/kaput-cli/package.nix
index 1fc0631f9f87..c16fc227e243 100644
--- a/pkgs/by-name/ka/kaput-cli/package.nix
+++ b/pkgs/by-name/ka/kaput-cli/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kaput-cli";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "davidchalifoux";
     repo = "kaput-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sy8k9L9rmiRFzvhLc+hYl9OqmmP8INLxMNRjAx7/V8g=";
+    hash = "sha256-N+vdK9DpooPEtXVUNZtmbdjVSpN5ddYggb4FsrvyCwU=";
   };
 
-  cargoHash = "sha256-yb56rrPlTuc7O4fF9NPNB2djCfq3fLu2hD4gUjRHvqM=";
+  cargoHash = "sha256-bz7K3eWv9i50k5nXBb9k8IZ+xPIz4PSomp6K2LDSH78=";
 
   env = {
     OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/lx/lxcfs/package.nix b/pkgs/by-name/lx/lxcfs/package.nix
index 63a8597bf885..59ea2ea6da7d 100644
--- a/pkgs/by-name/lx/lxcfs/package.nix
+++ b/pkgs/by-name/lx/lxcfs/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lxcfs";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mRTM06QyWcB4XOi0w2qvyDABGuu1SPJX0gjlBktDOac=";
+    hash = "sha256-lEXXbYDxnOi4Xa/fO1Uy/aVLjVfzYeZm6qzR4XBMBsY=";
   };
 
   patches = [
@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "FUSE filesystem for LXC";
     mainProgram = "lxcfs";
     homepage = "https://linuxcontainers.org/lxcfs";
-    changelog = "https://linuxcontainers.org/lxcfs/news/";
+    changelog = "https://github.com/lxc/lxcfs/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.lxc ];
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 4cfc622e53a3..c6c59fc92ed7 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.2.1";
+  version = "2026.2.2";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BpTN9AdQEDD2XnEUsUxgkoq+EPGhtnYgJhLKF4GVZoc=";
+    hash = "sha256-wZEpoUlDEbObXD5d2uA5vNBRrFOw4A6VLAc/MVNC4EE=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-b3d8VcfQjCkcJThebXJ2yvKZfU8u4QnpZgNyqP6XIu0=";
+    hash = "sha256-1jGEzTPPlwAFDKPbH92HvYg4rzFrUJLqhZRMNS+H6GI=";
   };
 
   env = {
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index c2a673959fd8..cd5de0265588 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -25,20 +25,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.8.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-xbJZD+L/8ZK7GPqFKO6H/Cg40Pk2cqN3MWC+mNFVxbI=";
+    hash = "sha256-XXQPZHtY66gOQ+nYH+Q1IjbR+SRZ9g06sgBy2x8gGh4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-gX4pYiztKIRFbJNZhtQviWpp80teOzX1JaYKylGe4TY=";
+    hash = "sha256-TU7HIShYj20QtdcthP0nQdubYl0bdy+XM3CoX5Rvhzk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index 1cd5d65610a5..bca7b0860943 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -23,7 +23,6 @@ let
     maintainers = with lib.maintainers; [
       conradmearns
       zaninime
-      qbit
       kashw2
       w-lfchen
     ];
diff --git a/pkgs/by-name/pa/pascube/package.nix b/pkgs/by-name/pa/pascube/package.nix
index 2d8a1684bce2..61582ef04c47 100644
--- a/pkgs/by-name/pa/pascube/package.nix
+++ b/pkgs/by-name/pa/pascube/package.nix
@@ -1,47 +1,46 @@
 {
-  autoPatchelfHook,
-  copyDesktopItems,
+  clangStdenv,
   fetchFromGitHub,
   fpc,
   lazarus-qt6,
   lib,
-  libGLU,
-  makeDesktopItem,
+  libx11,
+  makeWrapper,
   nix-update-script,
   qt6Packages,
-  stdenv,
+  SDL2,
+  vulkan-loader,
+  zlib,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "pascube";
-  version = "1.5.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "pascube";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-djkrMgX3RTTXSLISYpBfdyCIh3/WWODxd473M53iFKE=";
+    tag = finalAttrs.version;
+    hash = "sha256-qKjOA5/l2trQC238WheeOzqbpltjkwksqzMtcfw7ci0=";
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
     fpc
     lazarus-qt6
+    makeWrapper
     qt6Packages.wrapQtAppsHook
   ];
 
   buildInputs = [
     qt6Packages.libqtpas
     qt6Packages.qtbase
-  ];
-
-  runtimeDependencies = [
-    libGLU
+    SDL2
   ];
 
   buildPhase = ''
     runHook preBuild
+    clang -c -O3 -D linux -fverbose-asm -fno-builtin \
+      pasvulkan/src/lzma_c/LzmaDec.c -o pasvulkan/src/lzma_c/lzmadec_linux_x86_64.o
     HOME=$(mktemp -d) lazbuild \
       --lazarusdir=${lazarus-qt6}/share/lazarus \
       --widgetset=qt6 \
@@ -52,45 +51,33 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
     install -Dm755 pascube $out/bin/pascube
+    wrapProgram $out/bin/pascube --prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        libx11
+        SDL2
+        vulkan-loader
+        zlib
+      ]
+    }
+    mkdir -p $out/share/pascube
+    cp -a assets $out/share/pascube
+    install -Dm644 data/pascube.desktop $out/share/applications/pascube.desktop
     for sz in 128x128 256x256 512x512; do
       install -Dm644 "data/icons/''${sz}/pascube.png" \
         "$out/share/icons/hicolor/''${sz}/apps/pascube.png"
     done
-    install -Dm644 "data/skybox.png" "$out/share/pascube/skybox.png"
     runHook postInstall
   '';
 
-  desktopItems = [
-    (makeDesktopItem {
-      name = "pascube";
-      desktopName = "pasCube";
-      comment = finalAttrs.meta.description;
-      exec = finalAttrs.meta.mainProgram;
-      icon = "pascube";
-      terminal = false;
-      categories = [
-        "Graphics"
-        "Education"
-        "Qt"
-      ];
-    })
-  ];
-
-  preFixup = ''
-    qtWrapperArgs+=(
-      --set QT_QPA_PLATFORM xcb
-    )
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Simple OpenGL spinning cube written in Pascal";
     homepage = "https://github.com/benjamimgois/pascube";
-    changelog = "https://github.com/benjamimgois/pascube/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/benjamimgois/pascube/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ RoGreat ];
     mainProgram = "pascube";
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 })
diff --git a/pkgs/by-name/pa/passt/package.nix b/pkgs/by-name/pa/passt/package.nix
index 799dbe2f3eb6..064b36f21465 100644
--- a/pkgs/by-name/pa/passt/package.nix
+++ b/pkgs/by-name/pa/passt/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passt";
-  version = "2026_01_20.386b5f5";
+  version = "2025_09_19.623dbf6";
 
   src = fetchurl {
     url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-s3izbMbReYj9jv3J5DJJWvyWeHw+4jGu5VvH5QxO320=";
+    hash = "sha256-3krWW/QKijgZsmHuelMjpcaL8OyRqmPKC/wUvag0ZHI=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/re/reaction/add-support-for-macos.patch b/pkgs/by-name/re/reaction/add-support-for-macos.patch
new file mode 100644
index 000000000000..f68e0d625873
--- /dev/null
+++ b/pkgs/by-name/re/reaction/add-support-for-macos.patch
@@ -0,0 +1,24 @@
+From dc51d7d432eeb408551ae84c6b08d172efbf4649 Mon Sep 17 00:00:00 2001
+From: ppom <reaction@ppom.me>
+Date: Tue, 17 Feb 2026 12:00:00 +0100
+Subject: [PATCH] Add support for macOS
+
+---
+ src/concepts/plugin.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/concepts/plugin.rs b/src/concepts/plugin.rs
+index c5bc330..8c3c142 100644
+--- a/src/concepts/plugin.rs
++++ b/src/concepts/plugin.rs
+@@ -1,5 +1,7 @@
+ use std::{collections::BTreeMap, io::Error, path, process::Stdio};
+ 
++#[cfg(target_os = "macos")]
++use std::os::darwin::fs::MetadataExt;
+ #[cfg(target_os = "freebsd")]
+ use std::os::freebsd::fs::MetadataExt;
+ #[cfg(target_os = "illumos")]
+-- 
+GitLab
+
diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index e5780fb044cf..b8a693d4349a 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -1,26 +1,34 @@
 {
   lib,
   stdenv,
-  nixosTests,
+  callPackage,
   rustPlatform,
   fetchFromGitLab,
+
   versionCheckHook,
   installShellFiles,
   nix-update-script,
+
+  nixosTests,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "ppom";
     repo = "reaction";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-81i0bkrf86adQWxeZgIoZp/zQQbRJwPqQqZci0ANRFw=";
+    hash = "sha256-OvNJsR9W5MlicqUpr1aOLJ7pI7H7guq1vAlC/hh1Q2o=";
   };
 
-  cargoHash = "sha256-Bf9XmlY0IMPY4Convftd0Hv8mQbYoiE8WrkkAeaS6Z8=";
+  patches = [
+    # remove patch in next tagged version
+    ./add-support-for-macos.patch
+  ];
+
+  cargoHash = "sha256-BOFZlVBKf6fjW1L1J8u7Vf+fzNJHlEtQI6YafDjlZ4U=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -40,13 +48,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # flaky and fails in hydra
     "--skip=concepts::config::tests::merge_config_distinct_concurrency"
   ];
+
   cargoTestFlags = [
     # Skip integration tests for the same reason
     "--lib"
   ];
 
   postInstall = ''
-    installBin $releaseDir/ip46tables $releaseDir/nft46
     installManPage $releaseDir/reaction*.1
     installShellCompletion --cmd reaction \
       --bash $releaseDir/reaction.bash \
@@ -60,17 +68,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
-  passthru.updateScript = nix-update-script { };
-  passthru.tests = { inherit (nixosTests) reaction reaction-firewall; };
+  passthru = {
+    inherit (callPackage ./plugins { }) mkReactionPlugin plugins;
+    updateScript = nix-update-script { };
+    tests = nixosTests.reaction;
+  };
 
   meta = {
+    changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
     description = "Scan logs and take action: an alternative to fail2ban";
     homepage = "https://framagit.org/ppom/reaction";
-    changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
     license = lib.licenses.agpl3Plus;
     mainProgram = "reaction";
     maintainers = with lib.maintainers; [ ppom ];
-    teams = [ lib.teams.ngi ];
     platforms = lib.platforms.unix;
+    teams = [ lib.teams.ngi ];
   };
 })
diff --git a/pkgs/by-name/re/reaction/plugins/default.nix b/pkgs/by-name/re/reaction/plugins/default.nix
new file mode 100644
index 000000000000..c6a7fa124699
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  rustPlatform,
+  callPackage,
+  reaction,
+}:
+{
+  # NOTE: plugins are binaries, so no special integration with the derivation is required
+  # mkReactionPlugin is meant for only official plugins living in the reaction source tree
+  mkReactionPlugin =
+    name: extra:
+    rustPlatform.buildRustPackage (
+      {
+        pname = name;
+        inherit (reaction) version src cargoHash;
+        buildAndTestSubdir = "plugins/${name}";
+
+        meta = {
+          changelog = "https://framagit.org/ppom/reaction/-/releases/v${reaction.version}";
+          description = "Official reaction plugin ${name}";
+          homepage = "https://framagit.org/ppom/reaction";
+          license = lib.licenses.agpl3Plus;
+          mainProgram = name;
+          maintainers = with lib.maintainers; [ ppom ];
+          platforms = lib.platforms.unix;
+          teams = [ lib.teams.ngi ];
+        };
+      }
+      // extra
+    );
+
+  # capture all plugins except default.nix (this file)
+  plugins = lib.removeAttrs (lib.packagesFromDirectoryRecursive {
+    inherit callPackage;
+    directory = ./.;
+  }) [ "default" ];
+}
diff --git a/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix b/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix
new file mode 100644
index 000000000000..23ae70ee4f57
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix
@@ -0,0 +1,14 @@
+{
+  ipset,
+  pkg-config,
+  rustPlatform,
+  reaction,
+  ...
+}:
+reaction.mkReactionPlugin "reaction-plugin-ipset" {
+  buildInputs = [ ipset ];
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    pkg-config
+  ];
+}
diff --git a/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix b/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix
new file mode 100644
index 000000000000..049a96613285
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix
@@ -0,0 +1,5 @@
+{
+  reaction,
+  ...
+}:
+reaction.mkReactionPlugin "reaction-plugin-virtual" { }
diff --git a/pkgs/by-name/si/sizelint/package.nix b/pkgs/by-name/si/sizelint/package.nix
index f42f6c1c7b21..7bac1c3ef04c 100644
--- a/pkgs/by-name/si/sizelint/package.nix
+++ b/pkgs/by-name/si/sizelint/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sizelint";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "a-kenji";
     repo = "sizelint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1k1+7fVWhflEKyhOlb7kMn2xqeAM6Y5N9uHtOJvVn4A=";
+    hash = "sha256-m8Pd7Bnz++5k6J4stbKVd8Y596Y+52xbF0zFJVhdfzI=";
   };
 
   nativeCheckInputs = [ git ];
 
-  cargoHash = "sha256-Z+pmlp/0LlKfc4QLosePw7TdLFYe6AnAVOJSw2DzlfI=";
+  cargoHash = "sha256-7cDZrRNTGPdzbvVNt3/HTp7PgoH2txX26RCxdpeo4dM=";
 
   meta = {
     description = "Lint your file tree based on file sizes";
diff --git a/pkgs/by-name/sl/slade-unstable/package.nix b/pkgs/by-name/sl/slade-unstable/package.nix
index 14eebfe9310e..3377d07a6a2c 100644
--- a/pkgs/by-name/sl/slade-unstable/package.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.11-unstable-2026-02-18";
+  version = "3.2.12-unstable-2026-02-21";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "3615810ce2aee36909fb0a1a1e8a605edc2caf81";
-    hash = "sha256-/70LynJvcrjM4ztudaPp2pv6hPy+TQXwafwLj0n7T8E=";
+    rev = "030cab09eb2108c65b47c088d1ce97d27e671b9a";
+    hash = "sha256-dU08yoHikQsGO9yEhFoRvWE1C38ZQ1W/f7DmJyrAijQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index e06231993204..ffc71c475733 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -48,7 +48,7 @@ buildGoModule rec {
     description = "Step plugin to manage keys and certificates on cloud KMSs and HSMs";
     homepage = "https://smallstep.com/cli/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ qbit ];
+    maintainers = [ ];
     mainProgram = "step-kms-plugin";
   };
 }
diff --git a/pkgs/by-name/sy/syncthing-macos/package.nix b/pkgs/by-name/sy/syncthing-macos/package.nix
index 61a93cf2b8ae..245b0a166c12 100644
--- a/pkgs/by-name/sy/syncthing-macos/package.nix
+++ b/pkgs/by-name/sy/syncthing-macos/package.nix
@@ -3,15 +3,16 @@
   fetchurl,
   stdenv,
   undmg,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syncthing-macos";
-  version = "1.30.0-1";
+  version = "2.0.14-1";
 
   src = fetchurl {
     url = "https://github.com/syncthing/syncthing-macos/releases/download/v${finalAttrs.version}/Syncthing-${finalAttrs.version}.dmg";
-    hash = "sha256-9kerr89PZ90fQwxPfqrSlujuLYY9THv6Ne/cUErt3YU=";
+    hash = "sha256-5BjYwS2xcANqEXWadbppUwIGNd1UTQjzhWIAyATwWEU=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -27,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
+
   meta = {
     description = "Official frugal and native macOS Syncthing application bundle";
     homepage = "https://github.com/syncthing/syncthing-macos";
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index 92c6c5f395a3..23236cb515dd 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -219,7 +219,6 @@ buildNpmPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       gerg-l
-      qbit
       spikespaz
     ];
     # `castlabs-electron` doesn't have a distribution for `aarch64-linux`.
diff --git a/pkgs/by-name/un/undmg/package.nix b/pkgs/by-name/un/undmg/package.nix
index 868062c3dde2..480d49f62588 100644
--- a/pkgs/by-name/un/undmg/package.nix
+++ b/pkgs/by-name/un/undmg/package.nix
@@ -9,6 +9,9 @@
   pkg-config,
 }:
 
+let
+  zlib' = zlib.override { static = false; };
+in
 stdenv.mkDerivation {
   pname = "undmg";
   version = "1.1.0-unstable-2024-08-02";
@@ -23,7 +26,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    zlib
+    zlib'
     bzip2
     lzfse
     xz
diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index cdc83367027b..e7a0985d9496 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -15,12 +15,12 @@
 
 let
   executableName = "vikunja-desktop";
-  version = "2.0.0";
+  version = "2.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-EfAhJq2LPuCF8Pwyg0TYqSjNCaG15iZ2paDLfA6JI5w=";
+    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmInstallFlags
       ;
     fetcherVersion = 1;
-    hash = "sha256-9KPQaRLep4n+2b9mk8KQoK22zdlMFrCb1VT6SEHxanQ=";
+    hash = "sha256-yiVlEr1gi2g3m+hkYfDv6qd/wRlwwknM6lAaIeR58Ok=";
   };
 
   env = {
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 10bf66ed8a78..07e9c5424849 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -14,12 +14,12 @@
 }:
 
 let
-  version = "2.0.0";
+  version = "2.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-EfAhJq2LPuCF8Pwyg0TYqSjNCaG15iZ2paDLfA6JI5w=";
+    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ let
         ;
       pnpm = pnpm_10;
       fetcherVersion = 1;
-      hash = "sha256-ME9sGKGRY3vaOTFwbFyzsDT20HnEnrfq3Z5nrL19k0A=";
+      hash = "sha256-oY8DXJFFwLBjUno3EithLhmnA8hTksq4xgMSSOGtwuo=";
     };
 
     nativeBuildInputs = [
@@ -142,11 +142,14 @@ buildGoModule {
   };
 
   meta = {
-    changelog = "https://kolaente.dev/vikunja/api/src/tag/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/go-vikunja/vikunja/blob/v${version}/CHANGELOG.md";
     description = "Todo-app to organize your life";
     homepage = "https://vikunja.io/";
     license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ leona ];
+    maintainers = with lib.maintainers; [
+      leona
+      adamcstephens
+    ];
     mainProgram = "vikunja";
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index ce762a3b4711..b6e9b7532cc9 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdp-tools";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KIUuAaWmU5BsmLsp8T3S2hSF4p7BJ506luS82RpmOKs=";
+    hash = "sha256-CtXJAYR4T/4NyJlgvdc1E9JBIVWY7lN5gtyTUfmAkp8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ze/zensical/package.nix b/pkgs/by-name/ze/zensical/package.nix
index 70ecee996539..27d11cfe010f 100644
--- a/pkgs/by-name/ze/zensical/package.nix
+++ b/pkgs/by-name/ze/zensical/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zensical";
-  version = "0.0.23";
+  version = "0.0.24";
   pyproject = true;
 
   # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   # We could combine sources, but then nix-update won't work.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-XE/DqvB135nYz0G58lZuTViBgNmolJMBTTYH3+UKxLw=";
+    hash = "sha256-tdmeIlMpv0+YyAIr3woO6ViML62ntN8be4lvzGKzfsM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-cS8gxMPRpMMHwrjqXjyxBl4dbwll01Y+G4eOBZ3/vdM=";
+    hash = "sha256-oBg9wq/hJPvAIpl6IEJKVAWnUIVO6L+3q+L5z9UtvKg=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/beam-modules/expert/default.nix b/pkgs/development/beam-modules/expert/default.nix
index 8448f51e6045..a04d967638eb 100644
--- a/pkgs/development/beam-modules/expert/default.nix
+++ b/pkgs/development/beam-modules/expert/default.nix
@@ -6,13 +6,13 @@
   fetchMixDeps,
 }:
 let
-  version = "0.1.0-rc.4";
+  version = "0.1.0-rc.5";
 
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "expert";
     tag = "v${version}";
-    hash = "sha256-DghNlNbGUTMX859Y9HYRowCXvAxZKJffodTzy94Mb5Q=";
+    hash = "sha256-7e8zi3AFHESXyxTA0/YRmzR4L4tl19L0LHKaEM1l0P4=";
   };
 
   engineDeps = fetchMixDeps {
@@ -62,7 +62,7 @@ mixRelease rec {
 
   meta = {
     homepage = "https://github.com/elixir-lang/expert";
-    changelog = "https://github.com/elixir-lang/expert/releases/tag/v${version}";
+    changelog = "https://github.com/elixir-lang/expert/blob/v${version}/CHANGELOG.md";
     description = "Official Elixir Language Server Protocol implementation";
     longDescription = ''
       Expert is the official language server implementation for the Elixir programming language.
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
index 83f3e16bf4ad..5e7743f117b6 100644
--- a/pkgs/development/libraries/mesa/darwin.nix
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -3,8 +3,12 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  apple-sdk_26,
   bison,
+  darwinMinVersionHook,
   flex,
+  glslang,
+  libpng,
   libxml2,
   llvmPackages,
   meson,
@@ -15,8 +19,30 @@
   libxext,
   libx11,
   libxcb,
+  libxshmfence,
+  spirv-llvm-translator,
+  spirv-tools,
   zlib,
+  eglPlatforms ? [
+    "macos"
+    "x11"
+  ],
+  galliumDrivers ? [
+    "llvmpipe" # software renderer
+    "softpipe" # older software renderer
+  ],
+  vulkanDrivers ? [
+    "kosmickrisp" # Vulkan on Metal
+  ],
+  vulkanLayers ? [
+    "anti-lag"
+    "intel-nullhw"
+    "overlay"
+    "screenshot"
+    "vram-report-limit"
+  ],
 }:
+
 let
   common = import ./common.nix { inherit lib fetchFromGitLab; };
 in
@@ -28,6 +54,11 @@ stdenv.mkDerivation {
     meta
     ;
 
+  patches = [
+    # Required to build KosmicKrisp
+    ./opencl.patch
+  ];
+
   outputs = [
     "out"
     "dev"
@@ -36,6 +67,9 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     bison
     flex
+    # Use bin output from glslang to not propagate the dev output at
+    # the build time with the host glslang.
+    (lib.getBin glslang)
     meson
     ninja
     pkg-config
@@ -46,12 +80,21 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
+    apple-sdk_26 # KosmicKrisp requires Metal 4 to build, but …
+    (darwinMinVersionHook "15.0") # … it supports back to Metal 3.2, which requires macOS 15.
+    libpng
     libxml2 # should be propagated from libllvm
+    llvmPackages.libclang
+    llvmPackages.libclc
     llvmPackages.libllvm
+    python3Packages.python # for shebang
+    spirv-llvm-translator
+    spirv-tools
     libx11
     libxext
     libxfixes
     libxcb
+    libxshmfence
     zlib
   ];
 
@@ -60,10 +103,30 @@ stdenv.mkDerivation {
   mesonFlags = [
     "--sysconfdir=/etc"
     "--datadir=${placeholder "out"}/share"
+
+    # What to build
+    (lib.mesonOption "platforms" (lib.concatStringsSep "," eglPlatforms))
+    (lib.mesonOption "gallium-drivers" (lib.concatStringsSep "," galliumDrivers))
+    (lib.mesonOption "vulkan-drivers" (lib.concatStringsSep "," vulkanDrivers))
+    (lib.mesonOption "vulkan-layers" (lib.concatStringsSep "," vulkanLayers))
+
+    # Disable glvnd on Darwin
     (lib.mesonEnable "glvnd" false)
+    (lib.mesonEnable "gbm" false)
+    (lib.mesonBool "libgbm-external" false)
+
+    # Needed for KosmicKrisp
+    (lib.mesonOption "clang-libdir" "${lib.getLib llvmPackages.libclang}/lib")
     (lib.mesonEnable "llvm" true)
+    (lib.mesonEnable "shared-llvm" true)
+    (lib.mesonEnable "spirv-tools" true)
+
+    # Needed for Apple GLX support
+    (lib.mesonOption "glx" "dri")
   ];
 
+  mesonBuildType = "release";
+
   passthru = {
     # needed to pass evaluation of bad platforms
     driverLink = throw "driverLink not supported on darwin";
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 17e1f569f8c6..62b03f8b230e 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    hash = "sha256-8enkRWmPLZXBtlD9v8N7zuZB+Fv+igl30W7q2UqI2ZE=";
+    hash = "sha256-8dfktmiiwJ0CVB5BCNBLmTYuUG9Y9Ik2esJNmynJvCU=";
   };
 
   outputs = [
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index dfcc51cb6e30..5a03d98ebeea 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2593,17 +2593,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luaexpat";
-      version = "1.4.1-1";
+      version = "1.5.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luaexpat-1.4.1-1.rockspec";
-          sha256 = "1abwd385x7wnza7qqz5s4aj6m2l1c23pjmbgnpq73q0s17pn1h0c";
+          url = "mirror://luarocks/luaexpat-1.5.2-1.rockspec";
+          sha256 = "0wdbph2c92zmvvyp3q669rbjy1xjm7jy1i13lin8b636vswykw6p";
         }).outPath;
       src = fetchFromGitHub {
         owner = "lunarmodules";
         repo = "luaexpat";
-        tag = "1.4.1";
-        hash = "sha256-SnI+a7555R/EFFdnrvJohP6uzwQiMNQPqgp0jxAI178=";
+        tag = "1.5.2";
+        hash = "sha256-PudxKlN4WKUUK/h6ekVNSa/C453CnLh3TxCncXIOiw8=";
       };
 
       disabled = luaOlder "5.1";
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index b0dcac2f2f42..170f0e3fa873 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -52,17 +52,15 @@ let
   ];
 in
 
-buildDunePackage {
-  version = "6.0.0-unstable-2025-08-11";
+buildDunePackage (finalAttrs: {
+  version = "7.0.0";
   pname = "ocsigenserver";
 
-  minimalOCamlVersion = "4.08";
-
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "ocsigenserver";
-    rev = "0d3c74d71fbdf738d1e45a98814b7ebdd1efe6c1";
-    hash = "sha256-KEHTw4cCPRJSE4SAnUFWzeoiEz8y9nUQFpaFiNxAsiU=";
+    tag = finalAttrs.version;
+    hash = "sha256-J2XBelpRWJGeIF9RdC9+icJI1hc6Oe0k1w25QHZz0zs=";
   };
 
   nativeBuildInputs = [
@@ -110,8 +108,7 @@ buildDunePackage {
       A full featured Web server. It implements most features of the HTTP protocol, and has a very powerful extension mechanism that make very easy to plug your own OCaml modules for generating pages.
     '';
     license = lib.licenses.lgpl21Only;
-    inherit (ocaml.meta) platforms;
     maintainers = [ lib.maintainers.gal_bolle ];
   };
 
-}
+})
diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index 145b26cfab01..bc1f9d6ec47f 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -5,6 +5,7 @@
   ocaml,
   fetchFromGitHub,
   menhir,
+  bitwuzla-cxx,
   bos,
   cmdliner,
   dolmen_model,
@@ -47,6 +48,7 @@ buildDunePackage (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
+    bitwuzla-cxx
     bos
     cmdliner
     dolmen_model
diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index 4d33e8f943c0..29b135fb27fa 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -163,11 +163,14 @@ buildPythonPackage {
 
     (lib.cmakeFeature "CMAKE_HIP_ARCHITECTURES" (builtins.concatStringsSep ";" rocmGpuTargets))
   ];
-  CUDA_HOME = lib.optionalString cudaSupport "${cuda-native-redist}";
-  NVCC_PREPEND_FLAGS = lib.optionals cudaSupport [
-    "-I${cuda-native-redist}/include"
-    "-L${cuda-native-redist}/lib"
-  ];
+
+  env = lib.optionalAttrs cudaSupport {
+    CUDA_HOME = cuda-native-redist;
+    NVCC_PREPEND_FLAGS = toString [
+      "-I${cuda-native-redist}/include"
+      "-L${cuda-native-redist}/lib"
+    ];
+  };
 
   preBuild = ''
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/development/python-modules/forecast-solar/default.nix b/pkgs/development/python-modules/forecast-solar/default.nix
index 4965722508e0..f8edb6cee3cd 100644
--- a/pkgs/development/python-modules/forecast-solar/default.nix
+++ b/pkgs/development/python-modules/forecast-solar/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "forecast-solar";
-  version = "4.2.0";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "forecast_solar";
     tag = "v${version}";
-    hash = "sha256-ZBkuhONvn1/QpD+ml3HJinMIdg1HFpVj5KZAlUt/qR4=";
+    hash = "sha256-gFa1jq4Dq6fWqL/3eY+OGcJU+T+R6TZs8CX1ynnW+pU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/lerobot/default.nix b/pkgs/development/python-modules/lerobot/default.nix
index 90730adc2769..187fac569c01 100644
--- a/pkgs/development/python-modules/lerobot/default.nix
+++ b/pkgs/development/python-modules/lerobot/default.nix
@@ -58,6 +58,7 @@ buildPythonPackage (finalAttrs: {
   pythonRelaxDeps = [
     "av"
     "datasets"
+    "diffusers"
     "draccus"
     "gymnasium"
     "huggingface-hub"
@@ -104,6 +105,17 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = [
+    # TypeError: only 0-dimensional arrays can be converted to Python scalars
+    "test_add_frame"
+    "test_add_frame_state_numpy"
+    "test_data_consistency_across_episodes"
+    "test_delta_timestamps_query_returns_correct_values"
+    "test_episode_boundary_integrity"
+    "test_from_lerobot_dataset"
+    "test_statistics_metadata_validation"
+    "test_task_indexing_and_validation"
+    "test_to_lerobot_dataset"
+
     # RuntimeError: OpenCVCamera(/build/source/tests/artifacts/cameras/image_480x270.png) read failed
     "test_async_read"
     "test_fourcc_with_camer"
diff --git a/pkgs/development/python-modules/mpd2/default.nix b/pkgs/development/python-modules/mpd2/default.nix
index 79c4ed1653c2..09bd308fd74c 100644
--- a/pkgs/development/python-modules/mpd2/default.nix
+++ b/pkgs/development/python-modules/mpd2/default.nix
@@ -1,32 +1,34 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   twisted,
   unittestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-mpd2";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-S67DWEzEPtmUjVVZB5+vwmebBrKt4nPpCbNYJlSys/U=";
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "python-mpd2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3isX3e4Fu1orxuRsC3u8RxoFDQcE4XxQhf8PIHdo/e4=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   optional-dependencies = {
     twisted = [ twisted ];
   };
 
-  nativeCheckInputs = [ unittestCheckHook ] ++ optional-dependencies.twisted;
+  nativeCheckInputs = [ unittestCheckHook ] ++ finalAttrs.passthru.optional-dependencies.twisted;
 
   meta = {
-    changelog = "https://github.com/Mic92/python-mpd2/blob/v${version}/doc/changes.rst";
+    changelog = "https://github.com/Mic92/python-mpd2/blob/${finalAttrs.src.tag}/doc/changes.rst";
     description = "Python client module for the Music Player Daemon";
     homepage = "https://github.com/Mic92/python-mpd2";
     license = lib.licenses.lgpl3Plus;
@@ -35,4 +37,4 @@ buildPythonPackage rec {
       hexa
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 668c49daebfa..52285d5bfdd5 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -79,6 +79,8 @@ buildPythonPackage (finalAttrs: {
     ];
   };
 
+  pythonImportsCheck = [ "pymilvus" ];
+
   nativeCheckInputs = [
     grpcio-testing
     pytest-asyncio
@@ -88,13 +90,13 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ finalAttrs.passthru.optional-dependencies.bulk_writer;
 
-  pythonImportsCheck = [ "pymilvus" ];
-
   disabledTests = [
     # tries to read .git
     "test_get_commit"
+
     # requires network access
     "test_deadline_exceeded_shows_connecting_state"
+
     # mock issue in sandbox
     "test_milvus_client_creates_unbound_alias"
   ];
@@ -102,6 +104,7 @@ buildPythonPackage (finalAttrs: {
   disabledTestPaths = [
     # requires running milvus server
     "examples/"
+
     # tries to write to nix store
     "tests/test_bulk_writer_stage.py"
   ];
@@ -109,7 +112,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python SDK for Milvus";
     homepage = "https://github.com/milvus-io/pymilvus";
-    changelog = "https://github.com/milvus-io/pymilvus/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/milvus-io/pymilvus/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ happysalada ];
   };
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 9e92c08480fe..1b3376fa3a24 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -3,18 +3,24 @@
   callPackage,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+
+  # build-system
   cython,
-  spacy,
+  setuptools,
+
+  # dependencies
   numpy,
-  transformers,
-  torch,
-  srsly,
+  spacy,
   spacy-alignments,
+  srsly,
+  torch,
+  transformers,
+
+  # tests
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spacy-transformers";
   version = "1.3.9";
   pyproject = true;
@@ -22,22 +28,33 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "spacy-transformers";
-    tag = "release-v${version}";
+    tag = "release-v${finalAttrs.version}";
     hash = "sha256-06M/e8/+hMVQdZfqyI3qGaZY7iznMwMtblEkFR6Sro0=";
   };
 
+  # ImportError: cannot import name 'BatchEncoding' from 'transformers.tokenization_utils' (unknown location)
+  postPatch = ''
+    substituteInPlace \
+      spacy_transformers/data_classes.py \
+      spacy_transformers/layers/transformer_model.py \
+      spacy_transformers/util.py \
+      --replace-fail \
+        "from transformers.tokenization_utils import BatchEncoding" \
+        "from transformers import BatchEncoding"
+  '';
+
   build-system = [
-    setuptools
     cython
+    setuptools
   ];
 
   dependencies = [
-    spacy
     numpy
-    transformers
-    torch
-    srsly
+    spacy
     spacy-alignments
+    srsly
+    torch
+    transformers
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -54,8 +71,8 @@ buildPythonPackage rec {
   meta = {
     description = "spaCy pipelines for pretrained BERT, XLNet and GPT-2";
     homepage = "https://github.com/explosion/spacy-transformers";
-    changelog = "https://github.com/explosion/spacy-transformers/releases/tag/${src.tag}";
+    changelog = "https://github.com/explosion/spacy-transformers/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/systemrdl-compiler/default.nix b/pkgs/development/python-modules/systemrdl-compiler/default.nix
index 70430c4777b2..fcf0e6486c15 100644
--- a/pkgs/development/python-modules/systemrdl-compiler/default.nix
+++ b/pkgs/development/python-modules/systemrdl-compiler/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "systemrdl-compiler";
-  version = "1.32.1";
+  version = "1.32.2";
 
   pyproject = true;
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "SystemRDL";
     repo = "systemrdl-compiler";
     tag = "v${version}";
-    hash = "sha256-BTONBzNE9GfBeallS6P4E1ukPs2EzFa31/SpxEjXmKw=";
+    hash = "sha256-1Dx6WxSzGaZxwRzXR/bjfZSU7TsvTYNVN0NaK3qQ7eo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 56aa5a429995..efce4dd939c3 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -75,12 +75,12 @@
 }:
 
 let
-  version = "0.24.0";
+  version = "0.25.0";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-dICa/sIFEHI59gJxrvWyI9Uc3rbwXi+Xh60O/hElZh0=";
+    hash = "sha256-ouJHMPcWiHn2p0mFatmC28xUmjzxsoDW9WBX6FzjyDc=";
   };
 
   gpu-stats = rustPlatform.buildRustPackage {
@@ -90,7 +90,7 @@ let
 
     sourceRoot = "${src.name}/gpu_stats";
 
-    cargoHash = "sha256-iZinowkbBc3nuE0uRS2zLN2y97eCMD1mp/MKVKdnXaE=";
+    cargoHash = "sha256-yzvXJYkQTNOScOI3yfVBH6IGZzcFduuXqW3pI5hEZGw=";
 
     checkFlags = [
       # fails in sandbox
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index fad7f3538163..0dd8cc79f635 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,13 +30,13 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.14",
-        "hash": "sha256:1f3wv9vdg43cy1lnqd60zqgki6px67mdhfkfnpk1npqq5akk86cd",
-        "lts": true
+        "version": "6.18.13",
+        "hash": "sha256:0zv8qml075jpk2i58cxp61hm3yb74mpkbkjg15n87riqzmakqb7d",
+        "lts": false
     },
     "6.19": {
-        "version": "6.19.4",
-        "hash": "sha256:1b68i7z91fbs1zayzzzf71g9ilfk0wi2fr8nralha60xq723p6r7",
+        "version": "6.19.3",
+        "hash": "sha256:1glf369wfr66lmv9wmijin6idlfgijfsh0gx2qly7gpwmml4jiqf",
         "lts": false
     }
 }
diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index 00146c43365d..f6b53c26db14 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -50,11 +50,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.6-6";
+  version = "8.4.7-7";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-q01k+/TzvT7h52bqn9icc6VMlrUUjMDNKz0UdTyAWjU=";
+    hash = "sha256-5UBegcT25a1QUt4QQ6LlKWB7UGBnfQG6PK/Hxp9GYaY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 7eef0c06e74b..62b8cb1c7b91 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -12,16 +12,16 @@ buildPgrxExtension (finalAttrs: {
   cargo-pgrx = cargo-pgrx_0_16_0;
 
   pname = "vectorchord";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "tensorchord";
     repo = "vectorchord";
     tag = finalAttrs.version;
-    hash = "sha256-+BOuiinbKPZZaDl9aYsIoZPgvLZ4FA6Rb4/W+lAz4so=";
+    hash = "sha256-8Gk5/wIGu5/t8EKeG9Wna7yUWKiuCOC9yjJFo2euF/I=";
   };
 
-  cargoHash = "sha256-kwe2x7OTjpdPonZsvnR1C/89D5W/R5JswYF79YcSFEA=";
+  cargoHash = "sha256-o7NZEH3NCf/T81kL7jDa4HHGWsyTkLXXhq4KQR2/PGM=";
 
   # Include upgrade scripts in the final package
   # https://github.com/tensorchord/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b0bec92c53e1..b7fc449cbfe4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3826,6 +3826,8 @@ with pkgs;
 
   dprint-plugins = recurseIntoAttrs (callPackage ../by-name/dp/dprint/plugins { });
 
+  reaction-plugins = reaction.passthru.plugins;
+
   elm2nix = haskell.lib.compose.justStaticExecutables haskellPackages.elm2nix;
 
   elmPackages = recurseIntoAttrs (callPackage ../development/compilers/elm { });