diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 05afe086e2e5..6928e9ae7d32 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -453,10 +453,13 @@ jobs:
       - name: Install Nix
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
-      - name: Run misc eval tasks in parallel
+      - name: Ensure flake outputs on all systems still evaluate
+        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
+
+      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
-          # Ensure flake outputs on all systems still evaluate
-          nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1' &
-          # Query nixpkgs with aliases enabled to check for basic syntax errors
-          nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null &
-          wait
+          time nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
+
+      - name: Ensure NixOS modules meta is valid
+        run: |
+          time nix-instantiate -I ./nixpkgs/untrusted --strict --eval --json ./nixpkgs/untrusted/nixos --arg configuration '{}' --attr config.meta --option restrict-eval true --option allow-import-from-derivation false
diff --git a/ci/OWNERS b/ci/OWNERS
index 35f6c7cd84a2..fa76f045c29b 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -36,7 +36,7 @@
 /maintainers/computed-team-list.nix @infinisil
 ## Standard environment–related libraries
 /lib/customisation.nix      @alyssais @NixOS/stdenv
-/lib/derivations.nix        @alyssais @NixOS/stdenv
+/lib/derivations.nix        @NixOS/stdenv
 /lib/fetchers.nix           @alyssais @NixOS/stdenv
 /lib/meta.nix               @alyssais @NixOS/stdenv
 /lib/source-types.nix       @alyssais @NixOS/stdenv
diff --git a/nixos/modules/security/run0.nix b/nixos/modules/security/run0.nix
index 430c03706063..22296a76c95e 100644
--- a/nixos/modules/security/run0.nix
+++ b/nixos/modules/security/run0.nix
@@ -8,7 +8,7 @@
 let
   cfg = config.security.run0;
 
-  sudoAlias = pkgs.writeScriptBin "sudo" ''
+  sudoAlias = pkgs.writeShellScriptBin "sudo" ''
     if [[ "$1" == -* ]]; then
       echo "This script is a sudo-alias to systemd's run0 and does not support any sudo parameters."
       exit 1
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ee1c593430c6..75b6121ace98 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1254,6 +1254,10 @@ in
     inherit runTest;
     php = pkgs.php84;
   };
+  php85 = import ./php/default.nix {
+    inherit runTest;
+    php = pkgs.php85;
+  };
   phylactery = runTest ./web-apps/phylactery.nix;
   pict-rs = runTest ./pict-rs.nix;
   pihole-ftl = import ./pihole-ftl { inherit runTest; };
diff --git a/nixos/tests/postgresql/postgresql-tls-client-cert.nix b/nixos/tests/postgresql/postgresql-tls-client-cert.nix
index 6cb86d1ff8fc..acb531780f76 100644
--- a/nixos/tests/postgresql/postgresql-tls-client-cert.nix
+++ b/nixos/tests/postgresql/postgresql-tls-client-cert.nix
@@ -40,8 +40,15 @@ let
       nodes.server =
         { ... }:
         {
-          system.activationScripts = {
-            keyPlacement.text = ''
+          systemd.services.create-keys = {
+            wantedBy = [ "postgresql.target" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            script = ''
               mkdir -p '${serverKeyPath}'
               cp '${serverKey}' '${serverKeyPath}/server.key'
               chown postgres:postgres '${serverKeyPath}/server.key'
@@ -85,8 +92,15 @@ let
       nodes.client =
         { ... }:
         {
-          system.activationScripts = {
-            keyPlacement.text = ''
+          systemd.services.create-keys = {
+            wantedBy = [ "multi-user.target" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            script = ''
               mkdir -p '${clientKeyPath}'
               cp '${clientKey}' '${clientKeyPath}/client.key'
               chown root:root '${clientKeyPath}/client.key'
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 52f1c2990e31..f9fe66d16cc8 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -92,63 +92,27 @@ in
   plugins = callPackage ./plugins { };
 }
 
-// lib.optionalAttrs config.allowAliases rec {
+// lib.optionalAttrs config.allowAliases {
 
   # Deprecated products and aliases.
 
-  aqua =
-    lib.warnOnInstantiate
-      "jetbrains.aqua: Aqua has been discontinued by Jetbrains and is not receiving updates. It will be removed in NixOS 26.05."
-      (mkBinIde ./ides/aqua.nix { });
+  aqua = throw "jetbrains.aqua: Aqua has been removed as it has been discontinued by JetBrains";
 
-  idea-community =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community: IntelliJ IDEA Community has been discontinued by Jetbrains. This deprecated alias uses the, no longer updated, binary build on Darwin & Linux aarch64. On other platforms it uses IDEA Open Source, built from source. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/"
-      (
-        if stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64 then
-          idea-community-bin
-        else
-          _idea-oss
-      );
+  idea-community = throw "jetbrains.idea-community: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";
 
-  idea-community-bin =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community-bin: IntelliJ IDEA Community has been discontinued by Jetbrains. This binary build is no longer updated. Switch to 'jetbrains.idea-oss' for open source builds (from source) or 'jetbrains.idea' for commercial builds (binary, unfree). See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/"
-      (mkBinIde ./ides/idea-community.nix { });
+  idea-community-bin = throw "jetbrains.idea-community-bin: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";
 
-  idea-ultimate =
-    lib.warnOnInstantiate "'jetbrains.idea-ultimate' has been renamed to/replaced by 'jetbrains.idea'"
-      (mkBinIde ./ides/idea.nix { });
+  idea-community-src = throw "jetbrains.idea-community-src: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";
 
-  idea-community-src = lib.warnOnInstantiate "jetbrains.idea-community-src: IntelliJ IDEA Community has been discontinued by Jetbrains. This is now an alias for 'jetbrains.idea-oss', the Open Source build of IntelliJ. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/" _idea-oss;
+  idea-ultimate = throw "'jetbrains.idea-ultimate' has been renamed to/replaced by 'jetbrains.idea'";
 
-  pycharm-community =
-    lib.warnOnInstantiate
-      "pycharm-community: PyCharm Community has been discontinued by Jetbrains. This deprecated alias uses the, no longer updated, binary build on Darwin. On Linux it uses PyCharm Open Source, built from source. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (
-        if stdenv.hostPlatform.isDarwin then
-          pycharm-community-bin
-        else
-          (mkSrcIde ./ides/pycharm-oss.nix { inherit pyCharmCommonOverrides; })
-      );
+  pycharm-community = throw "jetbrains.pycharm-community: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";
 
-  pycharm-community-bin =
-    lib.warnOnInstantiate
-      "pycharm-community-bin: PyCharm Community has been discontinued by Jetbrains. This binary build is no longer updated. Switch to 'jetbrains.pycharm-oss' for open source builds (from source) or 'jetbrains.pycharm' for commercial builds (binary, unfree). See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (mkBinIde ./ides/pycharm-community.nix { inherit pyCharmCommonOverrides; });
+  pycharm-community-bin = throw "jetbrains.pycharm-community-bin: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";
 
-  pycharm-community-src =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community-src: PyCharm Community has been discontinued by Jetbrains. This is now an alias for 'jetbrains.pycharm-oss', the Open Source build of PyCharm. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (mkSrcIde ./ides/pycharm-oss.nix { inherit pyCharmCommonOverrides; });
+  pycharm-community-src = throw "jetbrains.pycharm-community-src: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";
 
-  pycharm-professional =
-    lib.warnOnInstantiate
-      "'jetbrains.pycharm-professional' has been renamed to/replaced by 'jetbrains.pycharm'"
-      (mkBinIde ./ides/pycharm.nix { inherit pyCharmCommonOverrides; });
+  pycharm-professional = throw "'jetbrains.pycharm-professional' has been renamed to/replaced by 'jetbrains.pycharm'";
 
-  writerside =
-    lib.warnOnInstantiate
-      "jetbrains.writerside: Writerside has been discontinued by Jetbrains and is not receiving updates. It will be removed in NixOS 26.05."
-      (mkBinIde ./ides/writerside.nix { });
+  writerside = throw "jetbrains.writerside: Writerside has been removed as it has been discontinued by JetBrains";
 }
diff --git a/pkgs/applications/editors/jetbrains/ides/aqua.nix b/pkgs/applications/editors/jetbrains/ides/aqua.nix
deleted file mode 100644
index ff219361821e..000000000000
--- a/pkgs/applications/editors/jetbrains/ides/aqua.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  lldb,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2.tar.gz";
-      sha256 = "de073e8a3734a2c4ef984b3e1bd68f5de72a6180e73400889510439ac3f419aa";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2-aarch64.tar.gz";
-      sha256 = "d2a3c781756a83ccea63dc6d9aebf85f819de1edb5bcd4e5a1a161eaa0779c84";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2.dmg";
-      sha256 = "423d492e9849beb7edbbd1771650a04e8df9f469bf1789b41bc5878c84cee393";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2-aarch64.dmg";
-      sha256 = "43974cdbbb71aaf5bfcfaf2cfd0e69e9920dda3973e64671936c1d52b267494d";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "aqua";
-
-  wmClass = "jetbrains-aqua";
-  product = "Aqua";
-
-  # update-script-start: version
-  version = "2024.3.2";
-  buildNumber = "243.23654.154";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  buildInputs = [
-    lldb
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/aqua/";
-    description = "Test automation IDE from JetBrains";
-    longDescription = "Aqua is a test automation IDE from jetbrains that can deal with many languages and frameworks to improve your test workflows. Has support for popular testing frameworks like Selenium, Cypress, and Playwright.";
-    maintainers = with lib.maintainers; [ remcoschrijver ];
-    license = lib.licenses.unfree;
-    sourceProvenance =
-      if stdenv.hostPlatform.isDarwin then
-        [ lib.sourceTypes.binaryNativeCode ]
-      else
-        [ lib.sourceTypes.binaryBytecode ];
-  };
-}
diff --git a/pkgs/applications/editors/jetbrains/ides/idea-community.nix b/pkgs/applications/editors/jetbrains/ides/idea-community.nix
deleted file mode 100644
index 19b81e123367..000000000000
--- a/pkgs/applications/editors/jetbrains/ides/idea-community.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  maven,
-  zlib,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5.tar.gz";
-      sha256 = "995c334cc3e143f13467abafef07a1ccf7d06275512bb6f4c91123948786ab7c";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5-aarch64.tar.gz";
-      sha256 = "4c57a783f31ee6f2c82d8c43bb5d0334a9afbc8bfb4542e732048c41f61e63a0";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5.dmg";
-      sha256 = "ff48a1e60869342a91db867fa482a49d4cdf38476496911c109f34a7e8d6523d";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5-aarch64.dmg";
-      sha256 = "52065492d433f0ea9df4debd5f0683154ab4dab5846394cabc8a49903d70e5bc";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "idea-community";
-
-  wmClass = "jetbrains-idea-ce";
-  product = "IntelliJ IDEA CE";
-  productShort = "IDEA";
-
-  # update-script-start: version
-  version = "2025.2.5";
-  buildNumber = "252.28238.7";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  extraLdPath = [ zlib ];
-  extraWrapperArgs = [
-    ''--set M2_HOME "${maven}/maven"''
-    ''--set M2 "${maven}/maven/bin"''
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/idea/";
-    description = "Free Java, Kotlin, Groovy and Scala IDE from Jetbrains (built from source)";
-    longDescription = "IDE for Java SE, Groovy & Scala development Powerful environment for building Google Android apps Integration with JUnit, TestNG, popular SCMs, Ant & Maven. Also known as IntelliJ.";
-    maintainers = with lib.maintainers; [
-      gytis-ivaskevicius
-      tymscar
-    ];
-    license = lib.licenses.asl20;
-    sourceProvenance = [ lib.sourceTypes.fromSource ];
-  };
-}
diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm-community.nix b/pkgs/applications/editors/jetbrains/ides/pycharm-community.nix
deleted file mode 100644
index 8f527410fd20..000000000000
--- a/pkgs/applications/editors/jetbrains/ides/pycharm-community.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  pyCharmCommonOverrides,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5.tar.gz";
-      sha256 = "7f49a014f53f0f6f7c46f6710b131f390302287f4046b606331d88081cdb551f";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5-aarch64.tar.gz";
-      sha256 = "67b61a3e788b043d93b3cc3e0dd3cea350e6d170402fd94adaf792cfc57e5462";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5.dmg";
-      sha256 = "08ba97a278031ff1942ddefb18d8acf7582f0bb4a28ccdf5d65721bfb80ca456";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5-aarch64.dmg";
-      sha256 = "040a4ed6bb7563972d844c450f615d0d11385e524fbbfdbfc9fc68d78811e994";
-    };
-  };
-  # update-script-end: urls
-in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "pycharm-community";
-
-  wmClass = "jetbrains-pycharm-ce";
-  product = "PyCharm CE";
-  productShort = "PyCharm";
-
-  # update-script-start: version
-  version = "2025.2.5";
-  buildNumber = "252.28238.29";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/pycharm/";
-    description = "Free Python IDE from JetBrains (built from source)";
-    longDescription = "Python IDE with complete set of tools for productive development with Python programming language. In addition, the IDE provides high-class capabilities for professional Web development with Django framework and Google App Engine. It has powerful coding assistance, navigation, a lot of refactoring features, tight integration with various Version Control Systems, Unit testing, powerful all-singing all-dancing Debugger and entire customization. PyCharm is developer driven IDE. It was developed with the aim of providing you almost everything you need for your comfortable and productive development!";
-    maintainers = with lib.maintainers; [
-      tymscar
-    ];
-    license = lib.licenses.asl20;
-    sourceProvenance = [ lib.sourceTypes.fromSource ];
-  };
-}).overrideAttrs
-  pyCharmCommonOverrides
diff --git a/pkgs/applications/editors/jetbrains/ides/writerside.nix b/pkgs/applications/editors/jetbrains/ides/writerside.nix
deleted file mode 100644
index a156e8fdbec5..000000000000
--- a/pkgs/applications/editors/jetbrains/ides/writerside.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  musl,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371.tar.gz";
-      sha256 = "d49e58020d51ec4ccdbdffea5d42b5a2d776a809fc00789cef5abda7b23bd3f6";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371-aarch64.tar.gz";
-      sha256 = "6067f6f73c4a178e2d0ae42bd18669045d85b5b5ed2c9115c2488ba7aa2a3d88";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371.dmg";
-      sha256 = "0c78b8035497c855aea5666256716778abd46dadf68f51e4f91c0db01f62b280";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371-aarch64.dmg";
-      sha256 = "9d86ef50b4c6d2a07d236219e9b05c0557241fb017d52ac395719bdb425130f5";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "writerside";
-
-  wmClass = "jetbrains-writerside";
-  product = "Writerside";
-
-  # update-script-start: version
-  version = "2024.3 EAP";
-  buildNumber = "243.22562.371";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  buildInputs = [
-    musl
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/writerside/";
-    description = "Documentation IDE from JetBrains";
-    longDescription = "The most powerful development environment – now adapted for writing documentation.";
-    maintainers = with lib.maintainers; [ zlepper ];
-    license = lib.licenses.unfree;
-    sourceProvenance =
-      if stdenv.hostPlatform.isDarwin then
-        [ lib.sourceTypes.binaryNativeCode ]
-      else
-        [ lib.sourceTypes.binaryBytecode ];
-  };
-}
diff --git a/pkgs/applications/editors/jetbrains/plugins/tests.nix b/pkgs/applications/editors/jetbrains/plugins/tests.nix
index b87744dc63e4..7f84beb2889e 100644
--- a/pkgs/applications/editors/jetbrains/plugins/tests.nix
+++ b/pkgs/applications/editors/jetbrains/plugins/tests.nix
@@ -14,27 +14,21 @@ let
     if ideName == null then
       with jetbrains;
       [
-        aqua
         clion
         datagrip
         dataspell
         gateway
         goland
-        idea-community-src
-        idea-community-bin
         idea-oss
         idea
         mps
         phpstorm
-        pycharm-community-src
-        pycharm-community-bin
         pycharm-oss
         pycharm
         rider
         ruby-mine
         rust-rover
         webstorm
-        writerside
       ]
     else
       [ (jetbrains.${ideName}) ];
diff --git a/pkgs/applications/editors/jetbrains/readme.md b/pkgs/applications/editors/jetbrains/readme.md
index e7a320111122..b0919920d2e0 100644
--- a/pkgs/applications/editors/jetbrains/readme.md
+++ b/pkgs/applications/editors/jetbrains/readme.md
@@ -56,8 +56,7 @@ Any comments or other manual changes between these markers will be removed when
  - Add it to `default.nix`
 
 ### TODO:
- - drop the community IDEs
- - Switch `mkJetBrainsProduct` to use `lib.extendMkDerivation`, see also:
+ - Switch `mkJetbrainsProduct` to use `lib.extendMkDerivation`, see also:
    - https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655305961
    - https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655348886
  - move PyCharm overrides to a common place outside of `default.nix`
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index 3baa3386f3d5..0c774decd4d5 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2026-01-20";
+  version = "0.0.27-unstable-2026-01-24";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "08b202a5c5dc93959bfe7dc276adfcba84ecc5be";
-    hash = "sha256-YDlxwAOimaTFo7mTICQBdb7EQCp8vrBnwjWwxmBImis=";
+    rev = "fde9a524457d17661618678f085649d4e8d3fd6f";
+    hash = "sha256-i+IxrUcqQk9okjXkHm7m+PF6+H4YKUkOtuyF/ZuoCWc=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 6ab1011a5295..753ee1259192 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.19";
-    hash = "sha256-Qh7wUa+WK5FNsIcxJ2HxO1LHlRVdIcM7Y9ubtRONczc=";
+    version = "2.1.20";
+    hash = "sha256-8r2/bF5zkq4LkMKvI5YcBMaaMzgWAIezdIwTMQQBHsM=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 841e6c459d14..04034000c17f 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.12.16-16";
+  version = "2026.01.26-11";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-Ep+CmTT2yCimchUAxdnRU3QqtLOfJWbw0gRioB0snQI=";
+    hash = "sha256-EsVPzibUta0cmKA6bYLqCKKij5FWbwPHgMmIs2THpL0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 54cc0ec5ba81..33aa661cd634 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -27,14 +27,14 @@
   srtp,
   libnice,
   gnutls,
-  gstreamer,
-  gst-plugins-base,
-  gst-plugins-good,
-  gst-plugins-bad,
-  gst-vaapi,
+  gst_all_1,
   webrtc-audio-processing,
 }:
 
+# Upstream is very deliberate about which features are enabled per default or are automatically enabled.
+# Everything that is disabled per default has to been seen experimental and should not be enabled without strong reasoning.
+# see https://github.com/NixOS/nixpkgs/issues/469614#issuecomment-3649662176
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "dino";
   version = "0.5.1";
@@ -79,24 +79,13 @@ stdenv.mkDerivation (finalAttrs: {
     srtp
     libnice
     gnutls
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good # contains rtpbin, required for VP9
-    gst-plugins-bad # required for H264, MSDK
-    gst-vaapi # required for VAAPI
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
     webrtc-audio-processing
   ];
 
   doCheck = true;
 
-  mesonFlags = [
-    "-Dplugin-notification-sound=enabled"
-    "-Dplugin-rtp-h264=enabled"
-    "-Dplugin-rtp-msdk=enabled"
-    "-Dplugin-rtp-vaapi=enabled"
-    "-Dplugin-rtp-vp9=enabled"
-  ];
-
   # Undefined symbols for architecture arm64: "_gpg_strerror"
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lgpg-error";
 
@@ -108,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
   # will load
   #
   # See https://github.com/dino/dino/wiki/macOS
-  postFixup = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     cd "$out/lib/dino/plugins/"
     for f in *.dylib; do
       mv "$f" "$(basename "$f" .dylib).so"
diff --git a/pkgs/by-name/ca/cargo-geiger/package.nix b/pkgs/by-name/ca/cargo-geiger/package.nix
index 6fbcd284d5fb..adb07a71445a 100644
--- a/pkgs/by-name/ca/cargo-geiger/package.nix
+++ b/pkgs/by-name/ca/cargo-geiger/package.nix
@@ -13,19 +13,26 @@
   cargo-geiger,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-geiger";
   version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "geiger-rs";
     repo = "cargo-geiger";
-    tag = "cargo-geiger-${version}";
+    tag = "cargo-geiger-${finalAttrs.version}";
     hash = "sha256-dZ71WbTKsR6g5UhWuJNfNAAqNNxbTgwL5fsgkm50BaM=";
   };
 
   cargoHash = "sha256-GgCmUNOwvyTB82Y/ddgJIAb1SpO4mRPjECqCagJ8GmE=";
 
+  postPatch = ''
+    # https://github.com/geiger-rs/cargo-geiger/pull/562
+    # Fix unused import warning which is treated as an error
+    substituteInPlace cargo-geiger/tests/integration_tests.rs \
+      --replace-fail "use std::env;" ""
+  '';
+
   buildInputs = [
     openssl
   ]
@@ -76,7 +83,7 @@ rustPlatform.buildRustPackage rec {
       code is appropriate.
     '';
     homepage = "https://github.com/geiger-rs/cargo-geiger";
-    changelog = "https://github.com/geiger-rs/cargo-geiger/blob/cargo-geiger-${version}/CHANGELOG.md";
+    changelog = "https://github.com/geiger-rs/cargo-geiger/blob/cargo-geiger-${finalAttrs.version}/CHANGELOG.md";
     mainProgram = "cargo-geiger";
     license = with lib.licenses; [
       asl20 # or
@@ -89,4 +96,4 @@ rustPlatform.buildRustPackage rec {
       matthiasbeyer
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock b/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
index db75a59c33ba..17ee521dab6d 100644
--- a/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
+++ b/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
@@ -1,12 +1,12 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
@@ -25,15 +25,15 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
 
 [[package]]
 name = "bstr"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -42,15 +42,15 @@ dependencies = [
 
 [[package]]
 name = "camino"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "276a59bf2b2c967788139340c9f0c5b12d7fd6630315c15c217e559de85d2609"
+checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"
 
 [[package]]
 name = "cargo-config2"
-version = "0.1.38"
+version = "0.1.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf2da6c8158a7ad35217e3187ac07db64d19719a934ffaf9b7591cda1f31964"
+checksum = "3795d3a48839a46854805f56c8fe9c558f10804bcf57df53925ca843d87c788f"
 dependencies = [
  "serde",
  "serde_derive",
@@ -60,7 +60,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-llvm-cov"
-version = "0.6.20"
+version = "0.8.1"
 dependencies = [
  "anyhow",
  "camino",
@@ -88,15 +88,15 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "duct"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7478638a31d1f1f3d6c9f5e57c76b906a04ac4879d6fd0fb6245bc88f73fd0b"
+checksum = "7e66e9c0c03d094e1a0ba1be130b849034aa80c3a2ab8ee94316bc809f3fa684"
 dependencies = [
  "libc",
  "os_pipe",
@@ -122,21 +122,20 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "filetime"
-version = "0.2.26"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0505cd1b6fa6580283f6bdf70a73fcf4aba1184038c90902b92b3dd0df63ed"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
 dependencies = [
  "cfg-if",
  "libc",
  "libredox",
- "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "fs-err"
-version = "3.1.3"
+version = "3.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ad492b2cf1d89d568a43508ab24f98501fe03f2f31c01e1d0fe7366a71745d2"
+checksum = "baf68cef89750956493a66a10f512b9e58d9db21f2a573c079c0bdf1207a54a7"
 dependencies = [
  "autocfg",
 ]
@@ -149,9 +148,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
 [[package]]
 name = "lcov2cobertura"
@@ -173,15 +172,15 @@ checksum = "9fa0e2a1fcbe2f6be6c42e342259976206b383122fc152e872795338b5a3f3a7"
 
 [[package]]
 name = "libc"
-version = "0.2.176"
+version = "0.2.180"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 
 [[package]]
 name = "libredox"
-version = "0.1.10"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
+checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
 dependencies = [
  "bitflags",
  "libc",
@@ -217,30 +216,30 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "opener"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb9024962ab91e00c89d2a14352a8d0fc1a64346bf96f1839b45c09149564e47"
+checksum = "a2fa337e0cf13357c13ef1dc108df1333eb192f75fc170bea03fcf1fd404c2ee"
 dependencies = [
  "bstr",
  "normpath",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "os_pipe"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db335f4760b14ead6290116f2427bf33a14d4f0617d49f78a246de10c1831224"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.101"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
@@ -256,27 +255,27 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.18"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+checksum = "49f3fe0889e69e2ae9e41f4d6c4c0181701d00e4697b356fb1f74173a5e0ee27"
 dependencies = [
  "bitflags",
 ]
 
 [[package]]
 name = "regex"
-version = "1.11.3"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b5288124840bee7b386bc413c487869b360b2b4ec421ea56425128692f2a82c"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -286,9 +285,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "833eb9ce86d40ef33cb1306d8accf7bc8ec2bfea4355cbdebb3df68b40925cad"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -297,21 +296,21 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.6"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
 [[package]]
 name = "rustix"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
  "bitflags",
  "errno",
@@ -328,15 +327,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ruzstd"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640bec8aad418d7d03c72ea2de10d5c646a598f9883c7babc160d91e3c1b26c"
-
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "e5ff0cc5e135c8870a775d3320910cd9b564ec036b4dc0b8741629020be63f01"
 
 [[package]]
 name = "same-file"
@@ -378,22 +371,22 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.2"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5417783452c2be558477e104686f7de5dae53dba813c28435e0e70f82d9b04ee"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 dependencies = [
  "serde_core",
 ]
@@ -422,9 +415,9 @@ checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
 
 [[package]]
 name = "syn"
-version = "2.0.106"
+version = "2.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -444,9 +437,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
  "fastrand",
  "once_cell",
@@ -473,9 +466,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.7"
+version = "0.9.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e5e5d9bf2475ac9d4f0d9edab68cc573dc2fd644b0dba36b0c30a92dd9eaa0"
+checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
 dependencies = [
  "serde_core",
  "serde_spanned",
@@ -486,27 +479,27 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.2"
+version = "0.7.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f1085dec27c2b6632b04c80b3bb1b4300d6495d1e129693bdda7d91e72eec1"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.3"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cf893c33be71572e0e9aa6dd15e6677937abd686b066eac3f8cd3531688a627"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 dependencies = [
  "winnow",
 ]
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.19"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
 
 [[package]]
 name = "walkdir"
@@ -533,22 +526,13 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -560,22 +544,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.53.5"
@@ -583,106 +551,58 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
  "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.53.1"
@@ -691,9 +611,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 
 [[package]]
 name = "xattr"
@@ -704,3 +624,9 @@ dependencies = [
  "libc",
  "rustix",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
diff --git a/pkgs/by-name/ca/cargo-llvm-cov/package.nix b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
index bed69775d64d..023164ff40d9 100644
--- a/pkgs/by-name/ca/cargo-llvm-cov/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
@@ -25,7 +25,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.6.20";
+  version = "0.8.1";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit owner;
     repo = "cargo-llvm-cov";
     rev = "v${version}";
-    sha256 = "sha256-LAiN9Opc0XQVepQ9IhK9JFWGoeRR3U6V680jgGiaDGo=";
+    sha256 = "sha256-w7UHfb5g8g9AYGbxoUpmiBsFEnSuc/RBEAZAYwoFjRg=";
   };
 
   # Upstream doesn't include the lockfile so we need to add it back
diff --git a/pkgs/by-name/cl/claude-code-bin/manifest.json b/pkgs/by-name/cl/claude-code-bin/manifest.json
new file mode 100644
index 000000000000..ce6494a756e8
--- /dev/null
+++ b/pkgs/by-name/cl/claude-code-bin/manifest.json
@@ -0,0 +1,34 @@
+{
+  "version": "2.1.20",
+  "buildDate": "2026-01-27T00:41:34Z",
+  "platforms": {
+    "darwin-arm64": {
+      "checksum": "c5703596ed854ae8e5775cf38de5d71d8a56ecfe3f36904812870e9e34178c8c",
+      "size": 181661168
+    },
+    "darwin-x64": {
+      "checksum": "0d38292770c88bd9b13b0684afb0d2dc0028a1437d0c09be3449d2b3d369b045",
+      "size": 187958208
+    },
+    "linux-arm64": {
+      "checksum": "eb8801c7a4a8501b21c235f36674f17328e65e796cf8a6196b3bf9a23ae16f99",
+      "size": 216047898
+    },
+    "linux-x64": {
+      "checksum": "f9d3698f5378a486db2d4eea5c80f95c2ceb410fbcea9ffc5703b5aac9574fcc",
+      "size": 223852550
+    },
+    "linux-arm64-musl": {
+      "checksum": "2a7d24d2b85068c5aca6c014dd5f3f94bd8d55803a06f0d39eea776ab3282d76",
+      "size": 211311930
+    },
+    "linux-x64-musl": {
+      "checksum": "0b392cc1c268f0e48ceedee384535451013f69887a61e23f989e3b743373796a",
+      "size": 216541126
+    },
+    "win32-x64": {
+      "checksum": "12e88d78570b6e979f5cf290652dc45ca8b9327f43bb27e275f87146190bef05",
+      "size": 233703072
+    }
+  }
+}
diff --git a/pkgs/by-name/cl/claude-code-bin/package.nix b/pkgs/by-name/cl/claude-code-bin/package.nix
new file mode 100644
index 000000000000..d8635c169508
--- /dev/null
+++ b/pkgs/by-name/cl/claude-code-bin/package.nix
@@ -0,0 +1,101 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  installShellFiles,
+  makeBinaryWrapper,
+  autoPatchelfHook,
+  procps,
+  ripgrep,
+  bubblewrap,
+  socat,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+let
+  stdenv = stdenvNoCC;
+  baseUrl = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases";
+  manifest = lib.importJSON ./manifest.json;
+  platformKey = "${stdenv.hostPlatform.node.platform}-${stdenv.hostPlatform.node.arch}";
+  platformManifestEntry = manifest.platforms.${platformKey};
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "claude-code-bin";
+  inherit (manifest) version;
+
+  src = fetchurl {
+    url = "${baseUrl}/${finalAttrs.version}/${platformKey}/claude";
+    sha256 = platformManifestEntry.checksum;
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+  __noChroot = stdenv.hostPlatform.isDarwin;
+  # otherwise the bun runtime is executed instead of the binary
+  dontStrip = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isElf [ autoPatchelfHook ];
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin $src
+
+    wrapProgram $out/bin/claude \
+      --set DISABLE_AUTOUPDATER 1 \
+      --set USE_BUILTIN_RIPGREP 0 \
+      --prefix PATH : ${
+        lib.makeBinPath (
+          [
+            # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)
+            procps
+            # https://code.claude.com/docs/en/troubleshooting#search-and-discovery-issues
+            ripgrep
+          ]
+          # the following packages are required for the sandbox to work (Linux only)
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            bubblewrap
+            socat
+          ]
+        )
+      }
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://claude.com/product/claude-code";
+    changelog = "https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+      mirkolenz
+    ];
+    mainProgram = "claude";
+  };
+})
diff --git a/pkgs/by-name/cl/claude-code-bin/update.sh b/pkgs/by-name/cl/claude-code-bin/update.sh
new file mode 100755
index 000000000000..e60893c580f1
--- /dev/null
+++ b/pkgs/by-name/cl/claude-code-bin/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix
+#!nix shell --ignore-environment .#cacert .#curl .#bash --command bash
+
+set -euo pipefail
+
+BASE_URL="https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases"
+
+VERSION=$(curl -fsSL "$BASE_URL/latest")
+
+curl -fsSL "$BASE_URL/$VERSION/manifest.json" --output pkgs/by-name/cl/claude-code-bin/manifest.json
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index adb3cafb5d2a..c827c4f5e386 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.1.19",
+  "version": "2.1.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.1.19",
+      "version": "2.1.20",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index cfd075b0e2a4..d5bf48971472 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -1,6 +1,6 @@
 # NOTE: Use the following command to update the package
 # ```sh
-# nix-shell maintainers/scripts/update.nix --argstr commit true --arg predicate '(path: pkg: builtins.elem path [["claude-code"] ["vscode-extensions" "anthropic" "claude-code"]])'
+# nix-shell maintainers/scripts/update.nix --argstr commit true --arg predicate '(path: pkg: builtins.elem path [["claude-code"] ["claude-code-bin"] ["vscode-extensions" "anthropic" "claude-code"]])'
 # ```
 {
   lib,
@@ -15,19 +15,23 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.1.19";
+  version = "2.1.20";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-K2fJf1eRAyqmtAvKBzpAtMohQ4B1icwC9yf5zEf52C8=";
+    hash = "sha256-V2BIqUUJnQpjIsCAAk932L8wp5T74s22q3KgFoxfdDg=";
   };
 
-  npmDepsHash = "sha256-C8HVKSz1ZQmYNMoLUKk2XUpf5y+Np4nTacCGMVEqO8c=";
+  npmDepsHash = "sha256-X8j7httM9qMpAPR11oDAWwDpkxZ2bc20y6ruMoStMsQ=";
 
   strictDeps = true;
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
+
+    # https://github.com/anthropics/claude-code/issues/15195
+    substituteInPlace cli.js \
+          --replace-fail '#!/bin/sh' '#!/usr/bin/env sh'
   '';
 
   dontNpmBuild = true;
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index 1ee5799587d4..89836ea18f2f 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "12.19.0";
+  version = "12.19.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-lFnXkBPokDO/eduWhg/lSqqjRhC8/5tGqkS/RZHhZnU=";
+    hash = "sha256-9POb9iQrLSLl8pwLg+y1SzjlxYvcGuIJx5o+djsOxIc=";
   };
 
   subPackages = [ "apps/cnquery" ];
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
index 43fefc03b2a6..8e76815b5976 100644
--- a/pkgs/by-name/di/disko/package.nix
+++ b/pkgs/by-name/di/disko/package.nix
@@ -7,17 +7,18 @@
   nix,
   nixos-install,
   coreutils,
+  xcp,
   testers,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "disko";
-  version = "1.12.0";
+  version = "1.13.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=";
+    hash = "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];
@@ -26,17 +27,25 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mkdir -p $out/bin $out/share/disko
     cp -r install-cli.nix cli.nix default.nix disk-deactivate lib $out/share/disko
 
-    for i in disko disko-install; do
+    scripts=(disko)
+    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+      scripts+=(disko-install)
+    ''}
+
+    for i in "''${scripts[@]}"; do
       sed -e "s|libexec_dir=\".*\"|libexec_dir=\"$out/share/disko\"|" "$i" > "$out/bin/$i"
       chmod 755 "$out/bin/$i"
       wrapProgram "$out/bin/$i" \
         --set DISKO_VERSION "${finalAttrs.version}" \
         --prefix PATH : ${
-          lib.makeBinPath [
-            nix
-            coreutils
-            nixos-install
-          ]
+          lib.makeBinPath (
+            [
+              nix
+              coreutils
+              xcp
+            ]
+            ++ lib.optional (!stdenvNoCC.isDarwin) nixos-install
+          )
         }
     done
     runHook postInstall
@@ -45,7 +54,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installCheckPhase = ''
     runHook preInstallCheck
     $out/bin/disko --help
-    $out/bin/disko-install --help
+    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+      $out/bin/disko-install --help
+    ''}
     runHook postInstallCheck
   '';
 
@@ -60,7 +71,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       mic92
       lassulus
       iFreilicht
+      Enzime
     ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/fa/fastcdr/package.nix b/pkgs/by-name/fa/fastcdr/package.nix
index 056e31e61b81..51db946d878d 100644
--- a/pkgs/by-name/fa/fastcdr/package.nix
+++ b/pkgs/by-name/fa/fastcdr/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastcdr";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-CDR";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KXQRQieyDPuSmLltf7iOVO4QdsHgaek+x1vneZyEg0E=";
+    hash = "sha256-gWENB3zqnFll047Jv+GL4k497wrzNaIaVTbXY7feRNQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index b76f86ddcbd9..321ba140a1d3 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.70.2";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-D79muCj4L4bhnDwTDkD5Ovr8AWpdcAGznBtvtFX/ktA=";
+    hash = "sha256-bzIrP6bUxEEgQ+lCKV3jpdyBNMAanCYXiMCr8ypUkUY=";
   };
 
-  cargoHash = "sha256-1ej1CNvlB6WtRB5BYaaSMSHWKJ3anvJVpJqEL2feQuA=";
+  cargoHash = "sha256-DP4Qe9bzDkuE36RldYPYNeGrQWVqBewU5GUt8zw3GAA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/js/jsonschema-cli/package.nix b/pkgs/by-name/js/jsonschema-cli/package.nix
index a5eb941f4e09..825bfa5f78c3 100644
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@@ -2,21 +2,26 @@
   lib,
   fetchCrate,
   rustPlatform,
+  cacert,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.38.1";
+  version = "0.40.0";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-W3pyT5DK8ADkWi7znuTDTq1hjRTOwhg9rSmuGZTX8r0=";
+    hash = "sha256-giHE1iawz3iahO98C5Wq6QboLX2nTzeK/xhASzzDmAY=";
   };
 
-  cargoHash = "sha256-C8A+cyNix0Q9OACyyPM3A74jZKNBCGz/622YsZqtY2E=";
+  cargoHash = "sha256-PhWT0ewOQ1ZUQ8xyCeDTNs96XjFGmk+uzvDSWANDCjo=";
+
+  preCheck = ''
+    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+  '';
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index b176c8e7cd50..3522f8176624 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -31,17 +31,18 @@
   libtommath,
   sdl3,
   icu78,
+  simdjson,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2026-01-11";
+  version = "0-unstable-2026-01-27";
 
   src = fetchFromGitHub {
     owner = "LadybirdBrowser";
     repo = "ladybird";
-    rev = "7814b497850ce131dfbfff8bd48836c121c2b237";
-    hash = "sha256-MMIk1FF9GB4pPNDdeSAGMjqqbVybn67EVtzcEOVbRIg=";
+    rev = "6b9797f480509b29afae4a88bc5931221ac7e7fe";
+    hash = "sha256-wqY7bG2Y5QNAeOMccvKbf8QFU7u6iRs2bGcDDe5K8cQ=";
   };
 
   postPatch = ''
@@ -113,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     }))
     woff2
     icu78
+    simdjson
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux [
     libpulseaudio.dev
diff --git a/pkgs/by-name/li/libresplit/package.nix b/pkgs/by-name/li/libresplit/package.nix
index bdf1979ea092..04d760855786 100644
--- a/pkgs/by-name/li/libresplit/package.nix
+++ b/pkgs/by-name/li/libresplit/package.nix
@@ -14,13 +14,13 @@
 
 gcc15Stdenv.mkDerivation {
   pname = "libresplit";
-  version = "0-unstable-2026-01-09";
+  version = "0-unstable-2026-01-22";
 
   src = fetchFromGitHub {
     owner = "LibreSplit";
     repo = "LibreSplit";
-    rev = "5cce8434645c249b2a8bfc4bcf10ce8766df9fe6";
-    hash = "sha256-nn6EmsG0RqpljylX4lAXDJC1JTWzzMDVCT+ObhVl5E4=";
+    rev = "be1ae0ea476846bb7e296613f471ba8803b1d7ff";
+    hash = "sha256-9BzzpKun8c9TFzwHHbGxFK6ThfVHRMUUqjwRiS+Lfks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/makemkv/package.nix b/pkgs/by-name/ma/makemkv/package.nix
index 65b9292569c0..d41778ef3915 100644
--- a/pkgs/by-name/ma/makemkv/package.nix
+++ b/pkgs/by-name/ma/makemkv/package.nix
@@ -26,19 +26,19 @@ stdenv.mkDerivation (
         "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
       ];
-      hash = "sha256-v8THzrwPAEl2cf/Vbmo08HcKnmr37/LwEn76FD8oY24=";
+      hash = "sha256-we5yCukbJ2p8ib6GEUbFuTRjGDHo1sj0U0BkNXJOkr0=";
     };
     srcs.oss = fetchurl {
       urls = [
         "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
       ];
-      hash = "sha256-uUl/VVXCV/XTx/GLarA8dM/z6kQ36ANJ1hjRFb9fpEU=";
+      hash = "sha256-vIuwhK46q81QPVu5PvwnPgRuT9RmPTmpg2zgwEf+6CM=";
     };
   in
   {
     pname = "makemkv";
-    version = "1.18.2";
+    version = "1.18.3";
 
     srcs = lib.attrValues finalAttrs.passthru.srcs;
     sourceRoot = "makemkv-oss-${version}";
diff --git a/pkgs/by-name/ma/managarr/package.nix b/pkgs/by-name/ma/managarr/package.nix
index c4159101561b..72126aa74180 100644
--- a/pkgs/by-name/ma/managarr/package.nix
+++ b/pkgs/by-name/ma/managarr/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "managarr";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "Dark-Alex-17";
     repo = "managarr";
     tag = "v${version}";
-    hash = "sha256-RBJ4Z5WTArQ/fG3Bv6wHAPJzRJNrIGTNphPYjV8Ocqc=";
+    hash = "sha256-6aqJxnhc1eXqJIuX07aKSEooNeVwnq8ic7yZnJaokR8=";
   };
 
-  cargoHash = "sha256-om4zGqh4bEgQZ+G2/MVGi9SCbopLdZ2K8hjIPIefiSQ=";
+  cargoHash = "sha256-BdgJVByyJ7Nq8gjPXxSaeQQYVQRM/leTd9AxWd7IpDw=";
 
   nativeBuildInputs = [ perl ];
 
diff --git a/pkgs/by-name/ma/mangayomi/package.nix b/pkgs/by-name/ma/mangayomi/package.nix
index 864f7c317fda..6f0216eae4f8 100644
--- a/pkgs/by-name/ma/mangayomi/package.nix
+++ b/pkgs/by-name/ma/mangayomi/package.nix
@@ -14,13 +14,13 @@
 
 let
   pname = "mangayomi";
-  version = "0.6.85";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "kodjodevf";
     repo = "mangayomi";
     tag = "v${version}";
-    hash = "sha256-Zy4B0nl9R/LmXj/DUI4v98GbSUu8YWGOO0GCXpRHtBA=";
+    hash = "sha256-NcM0saSuNlxw16+MIT5o/DLRhV5+PbNBb2HnbRpYl/o=";
   };
 
   metaCommon = {
diff --git a/pkgs/by-name/ma/mangayomi/pubspec.lock.json b/pkgs/by-name/ma/mangayomi/pubspec.lock.json
index 352b598c7306..7e5f5149d1aa 100644
--- a/pkgs/by-name/ma/mangayomi/pubspec.lock.json
+++ b/pkgs/by-name/ma/mangayomi/pubspec.lock.json
@@ -30,16 +30,6 @@
       "source": "hosted",
       "version": "0.1.10"
     },
-    "analyzer_plugin": {
-      "dependency": "transitive",
-      "description": {
-        "name": "analyzer_plugin",
-        "sha256": "a5ab7590c27b779f3d4de67f31c4109dbe13dd7339f86461a6f2a8ab2594d8ce",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.13.4"
-    },
     "antlr4": {
       "dependency": "transitive",
       "description": {
@@ -390,35 +380,15 @@
       "source": "hosted",
       "version": "1.0.8"
     },
-    "custom_lint_core": {
-      "dependency": "transitive",
-      "description": {
-        "name": "custom_lint_core",
-        "sha256": "cc4684d22ca05bf0a4a51127e19a8aea576b42079ed2bc9e956f11aaebe35dd1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.8.0"
-    },
-    "custom_lint_visitor": {
-      "dependency": "transitive",
-      "description": {
-        "name": "custom_lint_visitor",
-        "sha256": "4a86a0d8415a91fbb8298d6ef03e9034dc8e323a599ddc4120a0e36c433983a2",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0+7.7.0"
-    },
     "d4rt": {
       "dependency": "direct main",
       "description": {
         "name": "d4rt",
-        "sha256": "03d99e97cc893e312d568c657e9fe1034a0941f14043388a578e28500d1a31fb",
+        "sha256": "eff6a10f31e9e5b60b99146a33204c5f2d74e20ac3eeb14132d8a8ed0921c6e1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.8"
+      "version": "0.1.9"
     },
     "dart_style": {
       "dependency": "transitive",
@@ -576,11 +546,11 @@
       "dependency": "direct main",
       "description": {
         "name": "ffigen",
-        "sha256": "2bd9a420ca42cb5ce8cff5d80f88547b547a042ae26807704b1698714e4464a2",
+        "sha256": "b7803707faeec4ce3c1b0c2274906504b796e3b70ad573577e72333bd1c9b3ba",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "19.1.0"
+      "version": "20.1.1"
     },
     "file": {
       "dependency": "transitive",
@@ -596,11 +566,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "7872545770c277236fd32b022767576c562ba28366204ff1a5628853cf8f2200",
+        "sha256": "d974b6ba2606371ac71dd94254beefb6fa81185bde0b59bdc1df09885da85fde",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.3.7"
+      "version": "10.3.8"
     },
     "fixnum": {
       "dependency": "transitive",
@@ -790,11 +760,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_riverpod",
-        "sha256": "9e2d6907f12cc7d23a846847615941bddee8709bf2bfd274acdf5e80bcf22fde",
+        "sha256": "38ec6c303e2c83ee84512f5fc2a82ae311531021938e63d7137eccc107bf3c02",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.3"
+      "version": "3.1.0"
     },
     "flutter_rust_bridge": {
       "dependency": "direct main",
@@ -893,21 +863,21 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "c92d18e1fe994cb06d48aa786c46b142a5633067e8297cff6b5a3ac742620104",
+        "sha256": "eff94d2a6fc79fa8b811dde79c7549808c2346037ee107a1121b4a644c745f2a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "17.0.0"
+      "version": "17.0.1"
     },
     "google_fonts": {
       "dependency": "direct main",
       "description": {
         "name": "google_fonts",
-        "sha256": "517b20870220c48752eafa0ba1a797a092fb22df0d89535fd9991e86ee2cdd9c",
+        "sha256": "eefe5ee217f331627d8bbcf01f91b21c730bf66e225d6dc8a148370b0819168d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.2"
+      "version": "7.0.0"
     },
     "graphs": {
       "dependency": "transitive",
@@ -1722,41 +1692,41 @@
       "dependency": "transitive",
       "description": {
         "name": "riverpod",
-        "sha256": "c406de02bff19d920b832bddfb8283548bfa05ce41c59afba57ce643e116aa59",
+        "sha256": "16ff608d21e8ea64364f2b7c049c94a02ab81668f78845862b6e88b71dd4935a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.3"
+      "version": "3.1.0"
     },
     "riverpod_analyzer_utils": {
       "dependency": "transitive",
       "description": {
         "name": "riverpod_analyzer_utils",
-        "sha256": "a0f68adb078b790faa3c655110a017f9a7b7b079a57bbd40f540e80dce5fcd29",
+        "sha256": "947b05d04c52a546a2ac6b19ef2a54b08520ff6bdf9f23d67957a4c8df1c3bc0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0-dev.7"
+      "version": "1.0.0-dev.8"
     },
     "riverpod_annotation": {
       "dependency": "direct main",
       "description": {
         "name": "riverpod_annotation",
-        "sha256": "7230014155777fc31ba3351bc2cb5a3b5717b11bfafe52b1553cb47d385f8897",
+        "sha256": "cc1474bc2df55ec3c1da1989d139dcef22cd5e2bd78da382e867a69a8eca2e46",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.3"
+      "version": "4.0.0"
     },
     "riverpod_generator": {
       "dependency": "direct dev",
       "description": {
         "name": "riverpod_generator",
-        "sha256": "49894543a42cf7a9954fc4e7366b6d3cb2e6ec0fa07775f660afcdd92d097702",
+        "sha256": "e43b1537229cc8f487f09b0c20d15dba840acbadcf5fc6dad7ad5e8ab75950dc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.3"
+      "version": "4.0.0+1"
     },
     "rust_lib_mangayomi": {
       "dependency": "direct main",
@@ -2505,7 +2475,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.10.1 <4.0.0",
+    "dart": ">=3.10.4 <4.0.0",
     "flutter": ">=3.38.1"
   }
 }
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 2d61fb07669d..1256a9cad649 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2026.1.5";
+  version = "2026.1.8";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-rOeTm4Qc8+cqce5jx4LciVMiQ7Jvu4883t0KdqgeTy4=";
+    hash = "sha256-D2WTKMjxUCunp5GDA0TG1P9lilLoytk1KWJiI+ht3XM=";
   };
 
-  cargoHash = "sha256-/QcnUD8/WsZnbQY+Ecc33KT4tOj0Ua+BOBFybBK/O4Y=";
+  cargoHash = "sha256-2Fv+kRWtDAgAvqehgdqWfznKY4UhUdEj2NRN9MD2vy4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 54fa8f47821a..a0ccf8aff638 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.10.26";
+  version = "0.10.27";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1C0BCbDJ6/nYzWEL5UA9GQW4vSo4ZfP6BuA3i4JoiuY=";
+    hash = "sha256-5KHxoOozqZMvq91oKZ18Hmt0W8r9Va0AJr0hWMmBCfs=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-pZwWqWkcq142iIO0Ier9NH56P1EWXAoRiqDCNyElXCA=";
+  cargoHash = "sha256-OQVHG0iUyYcpc63N4Y3i8oWohDO4JBUIk3LEAf6ifL0=";
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
     data = ./deps.json;
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-m5/7fD4OBJcY7stZhwDLw4asmXqUThUjTaRb3oVul78=";
+    hash = "sha256-N57RSuVRX33AhQBjHbxR0g9q62rYVqAlYJ1dhuUu0xw=";
   };
 
   nativeBuildInputs = [
@@ -163,6 +163,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       getchoo
       hythera
+      encode42
     ];
     mainProgram = "ModrinthApp";
     platforms = with lib.platforms; linux ++ darwin;
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 5f64508fae60..85c231626b10 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.11.5";
+    version = "0.11.6";
 
     __structuredAttrs = true;
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-OsvLB9kynCbQ8PDQ2VQ+L56iy7pZ0ZP69J2cEG8Ad8A=";
+      hash = "sha256-GdfCaKNe/qPaUV2NJPXY+ATnQNWnyFTFnkOYDyLhTNg=";
     };
 
     strictDeps = true;
diff --git a/pkgs/by-name/pl/plasticscm-client-core-unwrapped/package.nix b/pkgs/by-name/pl/plasticscm-client-core-unwrapped/package.nix
index c7dd724920dd..8998073a27c3 100644
--- a/pkgs/by-name/pl/plasticscm-client-core-unwrapped/package.nix
+++ b/pkgs/by-name/pl/plasticscm-client-core-unwrapped/package.nix
@@ -12,11 +12,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasticscm-client-core-unwrapped";
-  version = "11.0.16.9872";
+  version = "11.0.16.9890";
 
   src = fetchurl {
     url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-core_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-5V1x21+Dal6JDI8KBEFr9PXH1k12LutVWbaMOuDL954=";
+    hash = "sha256-J87bDtuAN+5sRLecdCXmaUlICTnCp25XMMIS+IQM/jQ=";
     nativeBuildInputs = [ dpkg ];
     downloadToTemp = true;
     recursiveHash = true;
diff --git a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
index be208bacb07d..4dd8c42d22b6 100644
--- a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "projectm-sdl-cpp";
-  version = "0-unstable-2025-12-27";
+  version = "0-unstable-2026-01-20";
 
   src = fetchFromGitHub {
     owner = "projectM-visualizer";
     repo = "frontend-sdl-cpp";
-    rev = "0231108c9574c7ba04490fe0036b314f7f37ca6e";
-    hash = "sha256-NSwy0pJeJpqRxQI451J2kdevNt5EWUF4REhsmF0HS3w=";
+    rev = "7a07229428c51378f43843cf160bcddc21ef70ff";
+    hash = "sha256-hz1Au5Gn10Yi5f7d7UiQOHTCU00Ze5UoQ40jirg54Pc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pr/prow/package.nix b/pkgs/by-name/pr/prow/package.nix
index 5f4a86ebebf4..0d8756e802de 100644
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2025-12-23";
-  rev = "f0341d7b566080979b11661dc61a98f64db0d028";
+  version = "0-unstable-2026-01-26";
+  rev = "a0e74f2f7661a5ce8ecae738314ec0b4d4a182b0";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-V0tdABcZ/ob3duUkKbdcLn4AyOA8um7WkcohoH5J/pQ=";
+    hash = "sha256-EKWd0G6ONOWNYZCyp4UlY4lalfhB27sV5HwkKmyRscs=";
   };
 
-  vendorHash = "sha256-/ZAnYxUHHq+tqk0hcJrt6ZrpDDRqyLITWGL/hgW4A6A=";
+  vendorHash = "sha256-Pv9LznRh7Nzm74gMKT2Q/VLIMIIc93en0qX6YA6TwK4=";
 
   # doCheck = false;
 
diff --git a/pkgs/by-name/ra/rauthy/package.nix b/pkgs/by-name/ra/rauthy/package.nix
index 7e29ddf106df..b71b7e440dee 100644
--- a/pkgs/by-name/ra/rauthy/package.nix
+++ b/pkgs/by-name/ra/rauthy/package.nix
@@ -13,19 +13,19 @@
   lld,
 }:
 let
-  version = "0.34.1";
+  version = "0.34.2";
   pname = "rauthy";
 
   src = fetchFromGitHub {
     owner = "sebadob";
     repo = "rauthy";
     tag = "v${version}";
-    hash = "sha256-6Ddf8ukwEecxBp9hMbWS4odxrRGB/uIXWdTbIU3MAUM=";
+    hash = "sha256-h7Nd17l/BR7p+b+9AqX8IYf0mfcc9QI9LQnR2cBc2s4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-fXe4bQRLscUk7fdAQGwzwBVJIRs8+puWfTeAjby1MmE=";
+    hash = "sha256-jhli1axBU/UV6k5apxbE7g9+F6dsHzY30/QKSgJ22Ws=";
   };
 
   # Wasm modules are needed to build the frontend and are part of the main Rust repo.
@@ -77,7 +77,7 @@ let
       "-p2"
     ];
 
-    npmDepsHash = "sha256-F8/zbqI7Nmm8GLtkL25QDX222yzhlg7NA32tpBa8b5o=";
+    npmDepsHash = "sha256-pfrT2cXZWOetoquaMMNslo8nTy9DBornLCp48pGHRIM=";
 
     preBuild = ''
       mkdir -p ./src/wasm/
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 84bbf1aab535..853e0869c624 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-01-12";
+  version = "0-unstable-2026-01-23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "b47b972dff8a835be2999cab8cd167d8778ce53a";
-    hash = "sha256-34BEX7WaFZJVNeXxfPr6V6MGiqrIJ/Wdal8iwQkr4tQ=";
+    rev = "778be81b48eeeeb7991a49a816b350e4a88e0be1";
+    hash = "sha256-Bmfty8W02RVTFU5yhIhkcDmO2yE8ECV87kbAsNNRGcY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index afc1a1a1a6d3..43208ea79eb2 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "roave-backward-compatibility-check";
-  version = "8.15.0";
+  version = "8.17.0";
 
   src = fetchFromGitHub {
     owner = "Roave";
     repo = "BackwardCompatibilityCheck";
     tag = finalAttrs.version;
-    hash = "sha256-vhoV8AkkcL1pDmHkpPYs5lD6TUcvMC6BXkQF1T2esIE=";
+    hash = "sha256-+LoAR7pViUnzIICRUUWa7Z5DvSBXo+lr4bjFrTSwq0g=";
   };
 
-  vendorHash = "sha256-LBvqnBcSpjffS3cjgVgql8eNmaP45uNx9BKr72Mr+ZY=";
+  vendorHash = "sha256-q3n3VIxGlIz+xI5h/JNq40CvXFbShXeVoQ5VoIjk21I=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/sn/snell/package.nix b/pkgs/by-name/sn/snell/package.nix
index c55ab58baa1e..d4a331bb0937 100644
--- a/pkgs/by-name/sn/snell/package.nix
+++ b/pkgs/by-name/sn/snell/package.nix
@@ -2,50 +2,68 @@
   lib,
   stdenv,
   fetchzip,
-  autoPatchelfHook,
   upx,
+  autoPatchelfHook,
+  versionCheckHook,
+  writeShellScript,
+  nix-update,
 }:
-let
-  platformMap = {
-    "x86_64-linux" = "linux-amd64";
-    "aarch64-linux" = "linux-aarch64";
-  };
-  system = stdenv.hostPlatform.system;
-  platform = platformMap.${system} or (throw "Unsupported platform: ${system}");
-  hashs = {
-    "x86_64-linux" = "sha256-J2kRVJRC0GhxLMarg7Ucdk8uvzTsKbFHePEflPjwsHU=";
-    "aarch64-linux" = "sha256-UT+Rd6TEMYL/+xfqGxGN/tiSBvN8ntDrkCBj4PuMRwg=";
-  };
-in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "snell-server";
   version = "5.0.1";
 
-  src = fetchzip {
-    url = "https://dl.nssurge.com/snell/snell-server-v${finalAttrs.version}-${platform}.zip";
-    hash = hashs.${system};
-  };
+  src =
+    let
+      selectSystem = attrs: attrs.${stdenv.hostPlatform.system};
+      arch = selectSystem {
+        x86_64-linux = "amd64";
+        aarch64-linux = "aarch64";
+      };
+    in
+    fetchzip {
+      url = "https://dl.nssurge.com/snell/snell-server-v${finalAttrs.version}-linux-${arch}.zip";
+      hash = selectSystem {
+        x86_64-linux = "sha256-J2kRVJRC0GhxLMarg7Ucdk8uvzTsKbFHePEflPjwsHU=";
+        aarch64-linux = "sha256-UT+Rd6TEMYL/+xfqGxGN/tiSBvN8ntDrkCBj4PuMRwg=";
+      };
+    };
 
   nativeBuildInputs = [
     upx
     autoPatchelfHook
+    versionCheckHook
   ];
-  buildInputs = [
-    (lib.getLib stdenv.cc.cc)
-  ];
+
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
   installPhase = ''
     runHook preInstall
+
     upx -d snell-server
     install -Dm755 snell-server $out/bin/snell-server
+
     runHook postInstall
   '';
 
+  doInstallCheck = true;
+
+  passthru.updateScript = writeShellScript "update-snell-server" ''
+    latestVersion=$(curl --fail --silent https://kb.nssurge.com/surge-knowledge-base/release-notes/snell | grep -oE 'snell-server-v[0-9]+\.[0-9]+\.[0-9]+' | sed 's/snell-server-v//' | sort -V | tail -n1)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then exit 0; fi
+    ${lib.getExe nix-update} pkgsCross.gnu64.snell --version "$latestVersion"
+    ${lib.getExe nix-update} pkgsCross.aarch64-multiplatform.snell --version skip
+  '';
+
   meta = {
     description = "Lean encrypted proxy protocol";
     homepage = "https://kb.nssurge.com/surge-knowledge-base/release-notes/snell";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    platforms = lib.attrNames platformMap;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     maintainers = with lib.maintainers; [
       mlyxshi
     ];
diff --git a/pkgs/by-name/ss/sshfs-fuse/common.nix b/pkgs/by-name/ss/sshfs-fuse/common.nix
index 404d9c5e3768..6c07df8fe07f 100644
--- a/pkgs/by-name/ss/sshfs-fuse/common.nix
+++ b/pkgs/by-name/ss/sshfs-fuse/common.nix
@@ -66,6 +66,11 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
   '';
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   # doCheck = true;
   checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     # The tests need fusermount:
diff --git a/pkgs/by-name/ts/tsgolint/package.nix b/pkgs/by-name/ts/tsgolint/package.nix
index 3a28d20f94e0..d7ad26cc72d3 100644
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tsgolint";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "tsgolint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s+rXbUrP/mJiqUruFUlzz8gxG4LDfvFRLKmlUIOcFho=";
+    hash = "sha256-Gby8JW3bwVOIuNgLCIIt0y3egdljrR5cgbqAGqqqzpI=";
     fetchSubmodules = true;
   };
 
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
     '';
 
   proxyVendor = true;
-  vendorHash = "sha256-CGgLQKNGMKqIjfBnR7Uv6TwOfukfLX3hpLmSNHAZRv8=";
+  vendorHash = "sha256-pCmPL0OVwclCV5riL8wozCiQA2zRDafBKTxdkt/q3ns=";
 
   subPackages = [ "cmd/tsgolint" ];
 
diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index f710d42d58e8..b8d38fd14f4d 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.7.3";
+  version = "2.7.6";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DLe3gCMSSB8464DAKnzDk6iJVVL2yL02+1sUOGbdGxI=";
+    hash = "sha256-skpTDC27F2S+rKB+24+I1OxgDX6AmdI9QwnUAr0Ps4o=";
   };
 
-  cargoHash = "sha256-1M0EGZIiYkQcEByKZFRVEfWDp9Yb/kHr/VijRFNronk=";
+  cargoHash = "sha256-47ATXzlArTT+QsQvCQ7AfnFOXxTbPfXqmMS3zIimkEc=";
 
   nativeBuildInputs = [
     capnproto
@@ -82,6 +82,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       getchoo
+      hythera
     ];
     mainProgram = "turbo";
   };
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 250c486dc1af..512c3b258d13 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-2KPnFNutndxE5ap0E9BCL5w6vpnfow8GIY4/N9dgYy8=";
+    hash = "sha256-8mpTz0X7rV+lNX/qyWywomkBVY0Gq9UrKF8pv5dNlcI=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-E/kR6AxzpIqKMM80+ute5Z6LUL5f39RYfj7BnGOg6V4=";
+  cargoHash = "sha256-8W37Ul7hx99rSbzGsVKp5burq0D55I+dezidYfJ60a8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/vi/viennarna/package.nix b/pkgs/by-name/vi/viennarna/package.nix
index 61cf15ea0db0..3231c61f2b2a 100644
--- a/pkgs/by-name/vi/viennarna/package.nix
+++ b/pkgs/by-name/vi/viennarna/package.nix
@@ -2,20 +2,20 @@
   lib,
   stdenv,
   fetchurl,
+  pkg-config,
   dlib,
   gsl,
   mpfr,
   perl,
   python3,
 }:
-
 stdenv.mkDerivation rec {
   pname = "viennarna";
-  version = "2.7.0";
+  version = "2.7.2";
 
   src = fetchurl {
     url = "https://www.tbi.univie.ac.at/RNA/download/sourcecode/2_7_x/ViennaRNA-${version}.tar.gz";
-    hash = "sha256-mpn9aO04CJTe+01eaooocWKScAKM338W8KBdpujHFHM=";
+    hash = "sha256-GrX0pPdvyFoiQ1RgiORfXYXy16VsxlbpabAFzOm/q18=";
   };
 
   # use nixpkgs dlib sources instead of bundled ones
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
     find ./src/dlib-19.24 -type d -exec chmod +w {} \;
   '';
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = [
     gsl
     mpfr
diff --git a/pkgs/by-name/wa/wafw00f/package.nix b/pkgs/by-name/wa/wafw00f/package.nix
index eff94bfd933b..eb3103bb7068 100644
--- a/pkgs/by-name/wa/wafw00f/package.nix
+++ b/pkgs/by-name/wa/wafw00f/package.nix
@@ -4,16 +4,16 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "wafw00f";
-  version = "2.3.2";
+  version = "2.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnableSecurity";
     repo = "wafw00f";
-    tag = "v${version}";
-    hash = "sha256-nJNJAmSjEYKgqVYcNDIL8O6AQzK6DrIN8P4U0s/PWQM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vGTqgvAVO6fbgRN5V5HhlKFrI9Z2XZaAjI1L19RIi9U=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -31,9 +31,9 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Tool to identify and fingerprint Web Application Firewalls (WAF)";
     homepage = "https://github.com/EnableSecurity/wafw00f";
-    changelog = "https://github.com/EnableSecurity/wafw00f/releases/tag/v${version}";
+    changelog = "https://github.com/EnableSecurity/wafw00f/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "wafw00f";
   };
-}
+})
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 03c634a84b7a..9b1dd141fd73 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -186,6 +186,18 @@ stdenv.mkDerivation (finalAttrs: {
 
     (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)
 
+    # XSA #477
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa477.patch";
+      hash = "sha256-c9i61GvHPiLwMGvd+5IKgUwyu/NPub+mtnxUPHW/HhI=";
+    })
+
+    # XSA #479
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa479.patch";
+      hash = "sha256-2o6RYyT4Nrg1le6BUOQ3AwedorCvxvKao2uMYWrUV1Y=";
+    })
+
     # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
diff --git a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
index 381954efcaab..c89fd10e2518 100644
--- a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "25.5.31-unstable-2026-01-21";
+  version = "25.12.29-unstable-2026-01-27";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "3227a30b21f69b68df513754b5a00d6e75cece57";
-    hash = "sha256-yhptHABQ0alVab2i367D5grJyG7SrfHH8H4JuGeYFyk=";
+    rev = "c5d4b487d6277dd68ea9d3c6537641bf4ae9cf8e";
+    hash = "sha256-HjTRAfUHs6vlEWKruQWeA2wT/Mcd+WEHM90egFTYcWQ=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ze/zenmonitor/package.nix b/pkgs/by-name/ze/zenmonitor/package.nix
index 1fa30ef1c5f7..1dea44a53e2e 100644
--- a/pkgs/by-name/ze/zenmonitor/package.nix
+++ b/pkgs/by-name/ze/zenmonitor/package.nix
@@ -1,21 +1,21 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
   pkg-config,
   gtk3,
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "zenmonitor";
-  version = "unstable-2024-12-19";
+  version = "unstable-2025-06-12";
 
-  src = fetchFromGitLab {
-    owner = "shdwchn10";
+  src = fetchFromGitHub {
+    owner = "detiam";
     repo = "zenmonitor3";
-    rev = "a09f0b25d33967fd32f3831304be049b008cdabf";
-    sha256 = "sha256-5N1Hhv2s0cv4Rujw4wFGHyIy7NyKAFThVvAo+xXqSyk=";
+    rev = "1e1ceec7353dc418578fe8ae56536bfee6adeca3";
+    sha256 = "sha256-q5BeLu0A2XJkJL8ptN4hj/iLhQmpb16QEhOuIhNzVaI=";
   };
 
   buildInputs = [ gtk3 ];
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = {
-    inherit (src.meta) homepage;
     description = "Monitoring software for AMD Zen-based CPUs";
+    homepage = "https://github.com/detiam/zenmonitor3";
     mainProgram = "zenmonitor";
     license = lib.licenses.mit;
     platforms = [
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index 3956c4506780..20b884d3f455 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -18,8 +18,8 @@ let
   param =
     if lib.versionAtLeast ppxlib.version "0.36" then
       {
-        version = "3.17.2";
-        hash = "sha256-f0CHAW6MOToT1Xt3N2d7wdvxaXj9Q8GTVNTXmnlMjEc=";
+        version = "3.17.3";
+        hash = "sha256-AcRZG4ITrYxxtunx0YDqvSANRBk27if+n5lka3X5hlw=";
       }
     else
       {
diff --git a/pkgs/development/interpreters/php/8.5.nix b/pkgs/development/interpreters/php/8.5.nix
new file mode 100644
index 000000000000..bf44a1aad7b7
--- /dev/null
+++ b/pkgs/development/interpreters/php/8.5.nix
@@ -0,0 +1,57 @@
+{ callPackage, ... }@_args:
+
+let
+  base = callPackage ./generic.nix (
+    _args
+    // {
+      version = "8.5.2";
+      hash = "sha256-9+/ezMOoELGJIGkjBlNrmaO6hmENvQeVopbPd9P7OgY=";
+    }
+  );
+in
+base.withExtensions (
+  { all, ... }:
+  with all;
+  [
+    bcmath
+    calendar
+    curl
+    ctype
+    dom
+    exif
+    fileinfo
+    filter
+    ftp
+    gd
+    gettext
+    gmp
+    iconv
+    intl
+    ldap
+    mbstring
+    mysqli
+    mysqlnd
+    openssl
+    pcntl
+    pdo
+    pdo_mysql
+    pdo_odbc
+    pdo_pgsql
+    pdo_sqlite
+    pgsql
+    posix
+    readline
+    session
+    simplexml
+    sockets
+    soap
+    sodium
+    sysvsem
+    sqlite3
+    tokenizer
+    xmlreader
+    xmlwriter
+    zip
+    zlib
+  ]
+)
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 6eb8ec596680..08cfabb16f12 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -346,6 +346,10 @@ let
 
             substituteInPlace $dev/bin/phpize \
               --replace-fail "$out/lib" "$dev/lib"
+          ''
+          + lib.optionalString (lib.versionAtLeast version "8.5") ''
+            # PHP 8.5+ has lexbor built into core; dom needs its headers.
+            cp -r ext/lexbor/lexbor $dev/include/php/ext/lexbor/
           '';
 
           src = if phpSrc == null then defaultPhpSrc else phpSrc;
diff --git a/pkgs/development/libraries/dotnetfx35/default.nix b/pkgs/development/libraries/dotnetfx35/default.nix
deleted file mode 100644
index 73e6fa003090..000000000000
--- a/pkgs/development/libraries/dotnetfx35/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv }:
-
-let
-  windir = "/cygdrive/c/WINDOWS";
-in
-{
-  pkg = stdenv.mkDerivation rec {
-    pname = "dotnetfx";
-    version = "3.5";
-    src = "${windir}/Microsoft.NET/Framework/v${version}";
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -s $src/MSBuild.exe $out/bin
-    '';
-  };
-
-  assembly20Path = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v2.0.50727";
-
-  wcfPath = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v3.0/WINDOW~1";
-
-  referenceAssembly30Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.0";
-
-  referenceAssembly35Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.5";
-}
diff --git a/pkgs/development/libraries/dotnetfx40/default.nix b/pkgs/development/libraries/dotnetfx40/default.nix
deleted file mode 100644
index 7ca67f186ac8..000000000000
--- a/pkgs/development/libraries/dotnetfx40/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv }:
-
-let
-  windir = "/cygdrive/c/WINDOWS";
-in
-{
-  pkg = stdenv.mkDerivation rec {
-    pname = "dotnetfx";
-    version = "4.0.30319";
-    src = "${windir}/Microsoft.NET/Framework/v${version}";
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -s $src/MSBuild.exe $out/bin
-    '';
-  };
-
-  assembly20Path = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v2.0.50727";
-
-  wcfPath = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v3.0/WINDOW~1";
-
-  referenceAssembly30Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.0";
-
-  referenceAssembly35Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.5";
-}
diff --git a/pkgs/development/ocaml-modules/gendarme/default.nix b/pkgs/development/ocaml-modules/gendarme/default.nix
index ae5345407847..4237823a2797 100644
--- a/pkgs/development/ocaml-modules/gendarme/default.nix
+++ b/pkgs/development/ocaml-modules/gendarme/default.nix
@@ -4,24 +4,25 @@
   fetchFromGitHub,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "gendarme";
-  version = "0.3";
+  version = "0.4";
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";
 
   src = fetchFromGitHub {
     owner = "bensmrs";
     repo = "gendarme";
-    tag = version;
-    hash = "sha256-GWWAbYevd74YYRpyUjEI4rtzuXGZPp4Wa4uUqD6D7l8=";
+    tag = finalAttrs.version;
+    hash = "sha256-yiHBAhnWYntv+5fKG7Sa1RqsnvWIsW0YDqp+uAzpg/s=";
   };
 
   meta = {
     description = "Marshalling library for OCaml";
     homepage = "https://github.com/bensmrs/gendarme";
-    changelog = "https://github.com/bensmrs/gendarme/releases/tag/${version}";
+    changelog = "https://github.com/bensmrs/gendarme/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.ethancedwards8 ];
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = with lib.teams; [ ngi ];
   };
-}
+})
diff --git a/pkgs/development/php-packages/grpc/default.nix b/pkgs/development/php-packages/grpc/default.nix
index 5a5d261633fb..c96c6090a097 100644
--- a/pkgs/development/php-packages/grpc/default.nix
+++ b/pkgs/development/php-packages/grpc/default.nix
@@ -3,6 +3,7 @@
   pkg-config,
   lib,
   grpc,
+  php,
 }:
 
 buildPecl {
@@ -26,5 +27,6 @@ buildPecl {
     homepage = "https://github.com/grpc/grpc/tree/master/src/php/ext/grpc";
     license = lib.licenses.asl20;
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/igbinary/default.nix b/pkgs/development/php-packages/igbinary/default.nix
index a4be541075bc..f93f16a06e03 100644
--- a/pkgs/development/php-packages/igbinary/default.nix
+++ b/pkgs/development/php-packages/igbinary/default.nix
@@ -1,5 +1,8 @@
-{ buildPecl, lib }:
-
+{
+  buildPecl,
+  lib,
+  php,
+}:
 buildPecl {
   pname = "igbinary";
   version = "3.2.14";
@@ -17,5 +20,6 @@ buildPecl {
     homepage = "https://github.com/igbinary/igbinary/";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/ioncube-loader/default.nix b/pkgs/development/php-packages/ioncube-loader/default.nix
index 07c941094c6e..b2cd73a9ed38 100644
--- a/pkgs/development/php-packages/ioncube-loader/default.nix
+++ b/pkgs/development/php-packages/ioncube-loader/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation {
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ neverbehave ];
+    broken = lib.versionAtLeast php.version "8.5";
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/development/php-packages/memcache/default.nix b/pkgs/development/php-packages/memcache/default.nix
index 9cd31b635ee5..e3ff44172ef7 100644
--- a/pkgs/development/php-packages/memcache/default.nix
+++ b/pkgs/development/php-packages/memcache/default.nix
@@ -31,5 +31,6 @@ buildPecl rec {
     homepage = "https://github.com/websupport-sk/pecl-memcache";
     maintainers = [ lib.maintainers.krzaczek ];
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/openswoole/default.nix b/pkgs/development/php-packages/openswoole/default.nix
index f46c8b6a8f9f..2dec6017a672 100644
--- a/pkgs/development/php-packages/openswoole/default.nix
+++ b/pkgs/development/php-packages/openswoole/default.nix
@@ -35,6 +35,6 @@ buildPecl {
       You can use the sync or async, Coroutine API to write whole applications or create thousands of light weight Coroutines within one Linux process.
     '';
     teams = [ lib.teams.php ];
-    broken = lib.versionOlder php.version "8.2";
+    broken = lib.versionOlder php.version "8.2" || lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/pdo_sqlsrv/default.nix b/pkgs/development/php-packages/pdo_sqlsrv/default.nix
index b691d99487cb..451942fe5604 100644
--- a/pkgs/development/php-packages/pdo_sqlsrv/default.nix
+++ b/pkgs/development/php-packages/pdo_sqlsrv/default.nix
@@ -22,5 +22,6 @@ buildPecl {
     license = lib.licenses.mit;
     homepage = "https://github.com/Microsoft/msphpsql";
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/phalcon/default.nix b/pkgs/development/php-packages/phalcon/default.nix
index 41fe9ff8755c..eec3382df576 100644
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@@ -38,5 +38,6 @@ buildPecl rec {
     homepage = "https://phalcon.io";
     maintainers = [ lib.maintainers.krzaczek ];
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/php-packages/rrd/default.nix b/pkgs/development/php-packages/rrd/default.nix
index 6dcb6359e7bf..9c37fa225543 100644
--- a/pkgs/development/php-packages/rrd/default.nix
+++ b/pkgs/development/php-packages/rrd/default.nix
@@ -3,6 +3,7 @@
   lib,
   pkg-config,
   rrdtool,
+  fetchpatch,
 }:
 
 buildPecl {
@@ -19,6 +20,14 @@ buildPecl {
     pkg-config
   ];
 
+  patches = [
+    # PHP 8.5 compatibility patch
+    (fetchpatch {
+      url = "https://github.com/php/pecl-processing-rrd/pull/4/commits/dd4856dc89499a0141b1710e791f0e1096c7b244.patch";
+      hash = "sha256-ES+cMhMBUubFB5TpTZzzKKfEK2cY737z7zCuNy4XF8Y=";
+    })
+  ];
+
   # Fix GCC 14 build.
   # from incompatible pointer type [-Wincompatible-pointer-types
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
diff --git a/pkgs/development/php-packages/swoole/default.nix b/pkgs/development/php-packages/swoole/default.nix
index 933817c70b8c..76e0345f2041 100644
--- a/pkgs/development/php-packages/swoole/default.nix
+++ b/pkgs/development/php-packages/swoole/default.nix
@@ -33,5 +33,6 @@ buildPecl {
     homepage = "https://www.swoole.com";
     license = lib.licenses.asl20;
     teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 36d367e81759..b29febab24a9 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.13.1";
+  version = "7.13.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coveragepy";
     repo = "coveragepy";
     tag = version;
-    hash = "sha256-xdbgHUE+vbSiqLRDhd5G5u90VU5+TxLehAuwdhdGzBQ=";
+    hash = "sha256-dYgZLAiuPwYs4NomT+c2KS9VXXYEMW8oyHk2y4TCwe0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iterfzf/default.nix b/pkgs/development/python-modules/iterfzf/default.nix
index a4a491024339..f29ad6291e50 100644
--- a/pkgs/development/python-modules/iterfzf/default.nix
+++ b/pkgs/development/python-modules/iterfzf/default.nix
@@ -9,21 +9,21 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "iterfzf";
-  version = "1.8.0.62.0";
+  version = "1.9.0.67.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dahlia";
     repo = "iterfzf";
-    tag = version;
-    hash = "sha256-eLgF+9p+sqxWR1VkSoeL0NPDMamzUYbql4gMeG8fyNY=";
+    tag = finalAttrs.version;
+    hash = "sha256-Giw5d0X8/1PXK1j428LJjg+Gqadm93C51mLfrYc5J94=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'dynamic = ["version"]' 'version = "${version}"' \
+      --replace-fail 'dynamic = ["version"]' 'version = "${finalAttrs.version}"' \
       --replace-fail 'backend-path = ["."]' '# backend-path = ["."]' \
       --replace-fail 'build-backend = "build_dist"' '# build-backend = "build_dist"'
 
@@ -53,9 +53,9 @@ buildPythonPackage rec {
   meta = {
     description = "Pythonic interface to fzf, a CLI fuzzy finder";
     homepage = "https://github.com/dahlia/iterfzf";
-    changelog = "https://github.com/dahlia/iterfzf/releases/tag/${version}";
-    license = lib.licenses.gpl3Only;
+    changelog = "https://github.com/dahlia/iterfzf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymssql/default.nix b/pkgs/development/python-modules/pymssql/default.nix
index de3b9e8ceda2..dbffbaaeb278 100644
--- a/pkgs/development/python-modules/pymssql/default.nix
+++ b/pkgs/development/python-modules/pymssql/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   freetds,
   krb5-c,
   openssl,
@@ -13,20 +13,21 @@
   sqlalchemy,
   tomli,
 }:
-
 buildPythonPackage rec {
   pname = "pymssql";
-  version = "2.3.7";
+  version = "2.3.11";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Xm15x7HOxArr7EsJnG5EXMqsJFGeXnZ7SaTm9IwIflA=";
+  src = fetchFromGitHub {
+    owner = "pymssql";
+    repo = "pymssql";
+    tag = "v${version}";
+    hash = "sha256-Ybfg3V4qRqfA5basRAdL027aImt5i2SdfoC+Tfy/qBI=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=54.0,<70.3" "setuptools>=54.0"
+      --replace-fail '"standard-distutils ; python_version>='"'"'3.12'"'"'"' ""
   '';
 
   build-system = [
diff --git a/pkgs/development/tools/godot/default.nix b/pkgs/development/tools/godot/default.nix
index bb7c96f9df39..6e1277a8f2ec 100644
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@@ -61,7 +61,7 @@ rec {
   godotPackages_4_4 = mkGodotPackages "4.4";
   godotPackages_4_5 = mkGodotPackages "4.5";
   godotPackages_4_6 = mkGodotPackages "4.6";
-  godotPackages_4 = godotPackages_4_5;
+  godotPackages_4 = godotPackages_4_6;
   godotPackages = godotPackages_4;
 
   godot_4_3 = godotPackages_4_3.godot;
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index 67bc521cdc9f..9fbedf1c7b9f 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -19,8 +19,8 @@
     {
       "4.12.0" = "4.7-412";
       "4.12.1" = "4.7-412";
-      "4.13.0" = "4.7-413";
-      "4.13.1" = "4.7-413";
+      "4.13.0" = "4.7.1-413";
+      "4.13.1" = "4.7.1-413";
       "4.14.0" = "4.19-414";
       "4.14.1" = "4.19-414";
       "4.14.2" = "4.19-414";
@@ -39,7 +39,7 @@ let
 
   hashes = {
     "4.7-412" = "sha256-0U3Ia7EblKULNy8AuXFVKACZvGN0arYJv7BWiBRgT0Y=";
-    "4.7-413" = "sha256-aVmGWS4bJBLuwsxDKsng/n0A6qlyJ/pnDTcYab/5gyU=";
+    "4.7.1-413" = "sha256-owR9ooUoOrKLOpZbKYDm8Q2ZfDn6C8GJwUF/4HQVRcI=";
     "4.14-500" = "sha256-7CPzJPh1UgzYiX8wPMbU5ZXz1wAJFNQQcp8WuGrR1w4=";
     "4.16-414" = "sha256-xekZdfPfVoSeGzBvNWwxcJorE519V2NLjSHkcyZvzy0="; # Used by ocaml-lsp
     "4.16-501" = "sha256-2lvzCbBAZFwpKuRXLMagpwDb0rz8mWrBPI5cODbCHiY="; # Used by ocaml-lsp
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 66b929b8df57..3bfa8858b03d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -308,9 +308,9 @@
   };
 
   glimmer = {
-    version = "1.4.0";
-    url = "github:ember-tooling/tree-sitter-glimmer?ref=v1.4.0-tree-sitter-glimmer";
-    hash = "sha256-4kEOvObNnZtt2aaf0Df+R/Wvyk/JlFnsvbasDIJxt4w=";
+    version = "1.6.0";
+    url = "github:ember-tooling/tree-sitter-glimmer?ref=v1.6.0-tree-sitter-glimmer";
+    hash = "sha256-AW+jd1Kl3krTgnPc8NoXfSM91fOan/wIB/mo/feWj74=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -598,9 +598,9 @@
   };
 
   markdown = {
-    version = "0.3.2";
+    version = "0.5.2";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-OlVuHz9/5lxsGVT+1WhKx+7XtQiezMW1odiHGinzro8=";
+    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
     location = "tree-sitter-markdown";
     meta = {
       license = lib.licenses.mit;
@@ -609,9 +609,9 @@
 
   markdown-inline = {
     language = "markdown_inline";
-    version = "0.3.2";
+    version = "0.5.2";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-OlVuHz9/5lxsGVT+1WhKx+7XtQiezMW1odiHGinzro8=";
+    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
     location = "tree-sitter-markdown-inline";
     meta = {
       license = lib.licenses.mit;
diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index 31081446ef2d..04eb7ab6e2db 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "unstable-2025-06-17";
+  version = "unstable-2025-12-20";
 
   src = fetchFromGitHub {
     owner = "AliEmreSenel";
     repo = "zenpower3";
-    rev = "41e042935ee9840c0b9dd55d61b6ddd58bc4fde6";
-    hash = "sha256-0U/JmEd6OJJeUm1ZLFYxpKH15n7+QTWYOgtKIFAuf/4=";
+    rev = "dc4f1e2d2f5e26ad5b314497485419cb240e7134";
+    hash = "sha256-NvCBog1rAAjbhT9dMOjsmio6lVZ9h36XvOiE7znJdTo=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 25d37970b584..d394294c8125 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -567,6 +567,8 @@ mapAliases {
   dolphin-emu-beta = throw "'dolphin-emu-beta' has been renamed to/replaced by 'dolphin-emu'"; # Converted to throw 2025-10-27
   dontRecurseIntoAttrs = warnAlias "dontRecurseIntoAttrs has been removed from pkgs, use `lib.dontRecurseIntoAttrs` instead" lib.dontRecurseIntoAttrs; # Added 2025-10-30
   dotnetenv = throw "'dotnetenv' has been removed because it was unmaintained in Nixpkgs"; # Added 2025-07-11
+  dotnetfx35 = throw "'dotnetfx35' has been removed because it was unmaintained in Nixpkgs"; # Added 2026-01-27
+  dotnetfx40 = throw "'dotnetfx40' has been removed because it was unmaintained in Nixpkgs"; # Added 2026-01-27
   dotty = throw "'dotty' has been renamed to/replaced by 'scala_3'"; # Converted to throw 2025-10-27
   dovecot_fts_xapian = throw "'dovecot_fts_xapian' has been removed because it was unmaintained in Nixpkgs. Consider using dovecot-fts-flatcurve instead"; # Added 2025-08-16
   dsd = throw "dsd has been removed, as it was broken and lack of upstream maintenance"; # Added 2025-08-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 637032faf635..63d2d17d15ee 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1756,15 +1756,7 @@ with pkgs;
     asciidoc = asciidoc-full;
   };
 
-  dino = callPackage ../applications/networking/instant-messengers/dino {
-    inherit (gst_all_1)
-      gstreamer
-      gst-plugins-base
-      gst-plugins-bad
-      gst-vaapi
-      ;
-    gst-plugins-good = gst_all_1.gst-plugins-good.override { gtkSupport = true; };
-  };
+  dino = callPackage ../applications/networking/instant-messengers/dino { };
 
   dnschef = python3Packages.callPackage ../tools/networking/dnschef { };
 
@@ -2344,10 +2336,6 @@ with pkgs;
 
   diffutils = callPackage ../tools/text/diffutils { };
 
-  dotnetfx35 = callPackage ../development/libraries/dotnetfx35 { };
-
-  dotnetfx40 = callPackage ../development/libraries/dotnetfx40 { };
-
   drone = callPackage ../development/tools/continuous-integration/drone { };
   drone-oss = callPackage ../development/tools/continuous-integration/drone {
     enableUnfree = false;
@@ -5385,6 +5373,16 @@ with pkgs;
   phpExtensions = recurseIntoAttrs php.extensions;
   phpPackages = recurseIntoAttrs php.packages;
 
+  # Import PHP85 interpreter, extensions and packages
+  php85 = callPackage ../development/interpreters/php/8.5.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+    pcre2 = pcre2.override {
+      withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
+    };
+  };
+  php85Extensions = recurseIntoAttrs php85.extensions;
+  php85Packages = recurseIntoAttrs php85.packages;
+
   # Import PHP84 interpreter, extensions and packages
   php84 = callPackage ../development/interpreters/php/8.4.nix {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index bcbccf76333f..9f6229359de5 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -446,6 +446,10 @@ lib.makeScope pkgs.newScope (
               configureFlags = [
                 "--enable-dom"
               ];
+              # PHP 8.5+ has lexbor built into core; dom needs its headers.
+              env = lib.optionalAttrs (lib.versionAtLeast php.version "8.5") {
+                NIX_CFLAGS_COMPILE = "-I${php.unwrapped.dev}/include/php/ext/lexbor";
+              };
             }
             {
               name = "enchant";
@@ -572,28 +576,6 @@ lib.makeScope pkgs.newScope (
                 '')
               ];
             }
-            {
-              name = "opcache";
-              buildInputs = [
-                pcre2
-              ]
-              ++ lib.optional (
-                !stdenv.hostPlatform.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
-              ) valgrind.dev;
-              configureFlags = lib.optional php.ztsSupport "--disable-opcache-jit";
-              zendExtension = true;
-              postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-                # Tests are flaky on darwin
-                rm ext/opcache/tests/blacklist.phpt
-                rm ext/opcache/tests/bug66338.phpt
-                rm ext/opcache/tests/bug78106.phpt
-                rm ext/opcache/tests/issue0115.phpt
-                rm ext/opcache/tests/issue0149.phpt
-                rm ext/opcache/tests/revalidate_path_01.phpt
-              '';
-              # Tests launch the builtin webserver.
-              __darwinAllowLocalNetworking = true;
-            }
             {
               name = "openssl";
               buildInputs = [ openssl ];
@@ -828,6 +810,30 @@ lib.makeScope pkgs.newScope (
                 "--with-kerberos"
               ];
             }
+          ]
+          ++ lib.optionals (lib.versionOlder php.version "8.5") [
+            {
+              name = "opcache";
+              buildInputs = [
+                pcre2
+              ]
+              ++ lib.optional (
+                !stdenv.hostPlatform.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
+              ) valgrind.dev;
+              configureFlags = lib.optional php.ztsSupport "--disable-opcache-jit";
+              zendExtension = true;
+              postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+                # Tests are flaky on darwin
+                rm ext/opcache/tests/blacklist.phpt
+                rm ext/opcache/tests/bug66338.phpt
+                rm ext/opcache/tests/bug78106.phpt
+                rm ext/opcache/tests/issue0115.phpt
+                rm ext/opcache/tests/issue0149.phpt
+                rm ext/opcache/tests/revalidate_path_01.phpt
+              '';
+              # Tests launch the builtin webserver.
+              __darwinAllowLocalNetworking = true;
+            }
           ];
 
           # Convert the list of attrs: