diff --git a/ci/OWNERS b/ci/OWNERS
index 4f5f9eaa8ba2..25eb63420859 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -245,7 +245,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /pkgs/applications/networking/browsers/firefox/update.nix
 /pkgs/applications/networking/browsers/firefox/packages/firefox.nix @mweinelt
 /pkgs/applications/networking/browsers/firefox/packages/firefox-esr-*.nix @mweinelt
-/pkgs/applications/networking/browsers/librewolf @squalus @DominicWrege @fpletz @LordGrimmauld
+/pkgs/applications/networking/browsers/librewolf @squalus @DominicWrege @fpletz
 /pkgs/applications/networking/browsers/chromium @emilylange @networkException
 /nixos/tests/chromium.nix @emilylange @networkException
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 161b48e0498b..b2855238b23c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17901,6 +17901,11 @@
     githubId = 30654959;
     name = "Michele Sciabarra";
   };
+  mse63 = {
+    name = "Mahmoud Elsharawy";
+    github = "mse63";
+    githubId = 81396550;
+  };
   msgilligan = {
     email = "sean@msgilligan.com";
     github = "msgilligan";
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 0ae0aacd91e7..ccb6a5600ad4 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -20,8 +20,8 @@ let
     sha256Hash = "sha256-xs9ABQ9f8/gtxcoiZkf/xEtmTOj6rb4Ty+w70/+C4Ss=";
   };
   betaVersion = {
-    version = "2025.2.3.6"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 RC 1"
-    sha256Hash = "sha256-UysTlKH2h+8FElFgYYTiP4LCPYCssMRSrSA4lwsk6ek=";
+    version = "2025.2.3.7"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 RC 2"
+    sha256Hash = "sha256-d5BcAUkYV7O25wyoifiZxfUsANPxLa/QkuT9u1qqfP8=";
   };
   latestVersion = {
     version = "2025.3.1.1"; # "Android Studio Panda 1 | 2025.3.1 Canary 1"
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix
index 0afe9f91657a..ccb39de0dc8d 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@@ -33,7 +33,6 @@ in
       squalus
       dwrege
       fpletz
-      grimmauld
     ];
     platforms = lib.platforms.unix;
     broken = stdenv.buildPlatform.is32bit;
diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index 55bca1158da1..403a4619c1a4 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.25.11";
+  version = "1.25.12";
 
   src = fetchFromGitHub {
     owner = "artpixls";
     repo = "ART";
     tag = version;
-    hash = "sha256-viX2GjPV4ZvaK7u6KgANbbMLCFRLbCwd48NiIcsHqSY=";
+    hash = "sha256-iF409zromKDliFRjGWYHBeK38UsxUCH70dgSsHLHhhw=";
   };
 
   # Fix the build with CMake 4.
diff --git a/pkgs/by-name/aw/aws-gate/fix-compatibility-with-marshmallow-4.x.patch b/pkgs/by-name/aw/aws-gate/fix-compatibility-with-marshmallow-4.x.patch
new file mode 100644
index 000000000000..be34c27de265
--- /dev/null
+++ b/pkgs/by-name/aw/aws-gate/fix-compatibility-with-marshmallow-4.x.patch
@@ -0,0 +1,28 @@
+From d6b05accc05abcd13aefd66c50e6f4414f098b71 Mon Sep 17 00:00:00 2001
+From: Moraxyc <i@qaq.li>
+Date: Thu, 1 Jan 2026 10:49:08 +0800
+Subject: [PATCH] fix(config.py): fix compatibility with marshmallow 4.x
+
+---
+ aws_gate/config.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/aws_gate/config.py b/aws_gate/config.py
+index bfb84bf..0a1153f 100644
+--- a/aws_gate/config.py
++++ b/aws_gate/config.py
+@@ -45,9 +45,9 @@ class HostSchema(Schema):
+ 
+ class GateConfigSchema(Schema):
+     defaults = fields.Nested(
+-        DefaultsSchema, required=False, missing={}, validate=validate_defaults
++        DefaultsSchema, required=False, load_default={}, validate=validate_defaults
+     )
+-    hosts = fields.List(fields.Nested(HostSchema), required=False, missing=[])
++    hosts = fields.List(fields.Nested(HostSchema), required=False, load_default=[])
+ 
+     # pylint: disable=unused-argument
+     @post_load
+-- 
+2.51.2
+
diff --git a/pkgs/by-name/aw/aws-gate/package.nix b/pkgs/by-name/aw/aws-gate/package.nix
index 847c9b64c5b6..1e42ef045e52 100644
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@@ -20,6 +20,9 @@ python3Packages.buildPythonApplication rec {
 
   patches = [
     ./disable-bootstrap.patch
+    # default and missing parameters, which were replaced by dump_default and load_default
+    # https://github.com/xen0l/aws-gate/pull/1770
+    ./fix-compatibility-with-marshmallow-4.x.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/c2/c2patool/package.nix b/pkgs/by-name/c2/c2patool/package.nix
index 9b80ad800b4f..7de0dcc0aef9 100644
--- a/pkgs/by-name/c2/c2patool/package.nix
+++ b/pkgs/by-name/c2/c2patool/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.7";
+  version = "0.26.8";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-Nc72JDKQXrwL7izFGkqyig9GB5Ov5qmJ0YBC3bseC9M=";
+    hash = "sha256-2LZeXy/uuWH2BW9bmpRs+a2G7BOFOTPGS03Efn96Dp8=";
   };
 
-  cargoHash = "sha256-incPpMqapRqQsyaNcG1k132vBsQEgmj42jKDl8FGqxc=";
+  cargoHash = "sha256-Qdl7uIfS993a3FPwAXbQVLwsEgFHLaYN48Elw4JMYpQ=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ca/canfigger/package.nix b/pkgs/by-name/ca/canfigger/package.nix
new file mode 100644
index 000000000000..dd563cffb6e2
--- /dev/null
+++ b/pkgs/by-name/ca/canfigger/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "canfigger";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "andy5995";
+    repo = "canfigger";
+    rev = "v${version}";
+    hash = "sha256-S2rEQT8wKSjJ7LFF6vcigqb9r5QR/nNUCzNdhuBNjTo=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  # canfigger has asan and ubsan enabled by default, disable it here
+  mesonFlags = [
+    "-Dcanfigger:b_sanitize=none"
+  ];
+
+  meta = {
+    description = "Lightweight library designed to parse configuration files";
+    homepage = "https://github.com/andy5995/canfigger";
+    changelog = "https://github.com/andy5995/canfigger/blob/${src.rev}/ChangeLog.txt";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ iynaix ];
+    mainProgram = "canfigger";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/cg/cgns/package.nix b/pkgs/by-name/cg/cgns/package.nix
index 6eea0db29d4b..989b8345e72d 100644
--- a/pkgs/by-name/cg/cgns/package.nix
+++ b/pkgs/by-name/cg/cgns/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cgns";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "cgns";
     repo = "cgns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lPbXIC+O4hTtacxUcyNjZUWpEwo081MjEWhfIH3MWus=";
+    hash = "sha256-9i44GJesbZ2kV+ZSpYPYEhH873W8DxD1/aYzD19eAJ8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 42a1e2e9e47d..111fd54dd3ed 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -6,6 +6,7 @@
   python3,
   pkg-config,
   pixman,
+  nodejs_22,
   cairo,
   pango,
   stdenv,
@@ -22,6 +23,8 @@ buildNpmPackage rec {
     hash = "sha256-RPFEquxMRnNW+L6azcDmrIKXG27DAF2PxDmSB3ErOHk=";
   };
 
+  nodejs = nodejs_22;
+
   npmDepsHash = "sha256-h4Ipmmo0Jf6/rzCAKtLLCYrUi1anVKZSgy/kcEKDQJg=";
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index b191782cb3e5..5f0e06f3690f 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -49,6 +49,8 @@ stdenv'.mkDerivation (finalAttrs: {
       --replace-fail \
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.1 FATAL_ERROR)' \
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
+
+    sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch b/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch
deleted file mode 100644
index b63c9bb44165..000000000000
--- a/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-diff --git a/CMakeLists.txt.orig b/CMakeLists.txt
-index ac0488e..a3724bc 100644
---- a/CMakeLists.txt.orig
-+++ b/CMakeLists.txt
-@@ -50,14 +50,6 @@ include(FetchContent)
- 
- set(CMAKE_VERBOSE_MAKEFILE ON)
- 
--#========================================== PRE-CHECKS ============================================#
--include(FindGit)
--find_package(Git)
--
--if (NOT Git_FOUND)
--    message(FATAL_ERROR "Required package 'Git' not found on system.")
--endif ()
--
- #======================================== LIB IMPORTS =============================================#
- # ======= #
- # OpenSSL #
-@@ -65,40 +57,17 @@ endif ()
- find_package(OpenSSL REQUIRED)
- include_directories(${OPENSSL_INCLUDE_DIR})
- 
--# ============== #
--# JSON-C library #
--# ============== #
--set(JSONC_DOWNLOAD_PATH "${TEMP_DIR_PATH}/libjsonc")
--set(JSONC_INSTALL_PATH "${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}")
--
--add_custom_target(make-jsonc-install-dir ALL
--        COMMAND ${CMAKE_COMMAND} -E make_directory ${JSONC_INSTALL_PATH}
--)
--
--ExternalProject_Add(libjsonc
--        PREFIX         "${JSONC_DOWNLOAD_PATH}"
--        SOURCE_DIR     "${JSONC_DOWNLOAD_PATH}/src/libjsonc-build"
--        GIT_REPOSITORY "https://github.com/json-c/json-c.git"
--        GIT_TAG        "json-c-0.18-20240915"
--        CMAKE_ARGS     "-DBUILD_STATIC_LIBS=ON"
--                       "-DBUILD_SHARED_LIBS=OFF"
--                       "-DCMAKE_INSTALL_PREFIX:PATH=${JSONC_INSTALL_PATH}"
--                       "-DHAVE_ARC4RANDOM=OFF"
--                       "-DCMAKE_BUILD_TYPE=release"
--                       "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
--)
--
--set(JSONC_LIBRARIES
--        ${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/lib/libjson-c.a
--#        bsd
--)
--
- # ============ #
- # Curl library #
- # ============ #
- find_package(CURL REQUIRED)
- include_directories(${CURL_INCLUDE_DIR})
- 
-+find_package(PkgConfig REQUIRED)
-+pkg_check_modules(JSONC REQUIRED json-c)
-+include_directories(${JSONC_INCLUDE_DIRS})
-+
-+
- # ================================ #
- # nCurses - for the user interface #
- # ================================ #
-@@ -410,7 +379,7 @@ add_subdirectory(docs)
- #endforeach()
- 
- add_executable(ctune ${SOURCE_FILES})
--add_dependencies(ctune ctune_logger libjsonc)
-+add_dependencies(ctune ctune_logger)
- include_directories(${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/include)
- 
- add_dependencies(ctune ${CTUNE_PLUGIN_LIST_AUDIO_PLAYER})
-@@ -450,4 +419,4 @@ if(TARGET uninstall)
- 
-     add_custom_target(uninstall
-             COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_SOURCE_DIR}/CMakeUninstall.cmake)
--endif()
-\ No newline at end of file
-+endif()
diff --git a/pkgs/by-name/ct/ctune/cmake_remove_git_check.patch b/pkgs/by-name/ct/ctune/cmake_remove_git_check.patch
new file mode 100644
index 000000000000..e9527217f0f2
--- /dev/null
+++ b/pkgs/by-name/ct/ctune/cmake_remove_git_check.patch
@@ -0,0 +1,17 @@
+diff --git a/CMakeLists.txt.orig b/CMakeLists.txt
+index 20ba56d..85750c8 100644
+--- a/CMakeLists.txt.orig
++++ b/CMakeLists.txt
+@@ -52,12 +52,7 @@ set(CMAKE_VERBOSE_MAKEFILE ON)
+ 
+ #========================================== PRE-CHECKS ============================================#
+ find_package(PkgConfig REQUIRED)
+-include(FindGit)
+-find_package(Git)
+ 
+-if (NOT Git_FOUND)
+-    message(FATAL_ERROR "Required package 'Git' not found on system.")
+-endif ()
+ 
+ #======================================== LIB IMPORTS =============================================#
+ # ======= #
diff --git a/pkgs/by-name/ct/ctune/docs_cmake_fix_man_install_dir.patch b/pkgs/by-name/ct/ctune/docs_cmake_fix_man_install_dir.patch
new file mode 100644
index 000000000000..826b26e7eaf1
--- /dev/null
+++ b/pkgs/by-name/ct/ctune/docs_cmake_fix_man_install_dir.patch
@@ -0,0 +1,14 @@
+diff --git a/docs/CMakeLists.txt.orig b/docs/CMakeLists.txt
+index bb4d641..b37936e 100644
+--- a/docs/CMakeLists.txt.orig
++++ b/docs/CMakeLists.txt
+@@ -46,7 +46,7 @@ add_custom_command(
+ )
+ 
+ install(FILES ${MAN_OUT_DIR}/${MAN_OUT_FILENAME_GZ}
+-        DESTINATION ${CMAKE_INSTALL_PREFIX}/man/man1
++        DESTINATION ${MAN_INSTALL_DIR}
+ )
+ 
+ install(CODE "execute_process(COMMAND ${CMAKE_SOURCE_DIR}/cmake/scripts/update_mandb.sh ARGS ${CMAKE_BUILD_TYPE})")
+\ No newline at end of file
diff --git a/pkgs/by-name/ct/ctune/package.nix b/pkgs/by-name/ct/ctune/package.nix
index ff4e754fcaf0..5a14f6c1b091 100644
--- a/pkgs/by-name/ct/ctune/package.nix
+++ b/pkgs/by-name/ct/ctune/package.nix
@@ -14,16 +14,17 @@
   ncurses,
   libuuid,
   pandoc,
+  pipewire,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctune";
-  version = "1.3.4";
+  version = "1.3.9";
 
   src = fetchFromGitHub {
     owner = "An7ar35";
     repo = "ctune";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-36Y19CbUnv8NtvZjCMKod/Y/Ofjgr9BsxgMMdoMK+hU=";
+    hash = "sha256-HGCXtntsCQsWKoTbhRZ71NxfD4rFuYDE2IbGVh0Cj/E=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     json_c
     ncurses
     libuuid
+    pipewire
   ];
 
   strictDeps = true;
@@ -52,7 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_PREFIX=''"
   ];
 
-  patches = [ ./cmake_disable_git_clone.patch ];
+  patches = [
+    ./cmake_remove_git_check.patch
+    ./docs_cmake_fix_man_install_dir.patch
+  ];
 
   meta = {
     description = "Nice terminal nCurses (tui) internet radio player for Linux, browse and search from api.radio-browser.info";
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 666cf8dc12fb..1e111ab2083d 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.224.2";
+  version = "2.225.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-IaRwBqz1A2ZkcAQ+jAL6NxyEgtjM70T+N0mf0kvpxmA=";
+    hash = "sha256-nzXQfi4N7t/tm5Zub29AIYKgBYzZN8k/fPLqRK3PKwM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-CSssn/aYWcGoQmBsJFWJG4ZIuAJcIeDO2CeAcOiUdP4=";
+  npmDepsHash = "sha256-TADFJd6kWmEsXi9+04OAGlhR2rX+++K5OraaQatLSho=";
 
   nativeBuildInputs = [
     prisma_6
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index af1bb663cd1c..8d2ebc49a4f1 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "0.0.372";
+  version = "0.0.373";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@github/copilot/-/copilot-${finalAttrs.version}.tgz";
-    hash = "sha256-YtGt9J7dPL7m1Tc0nYf/sZrl30LxXrcIOZv1de4tLT8=";
+    hash = "sha256-Mo6RdDEXaLzWCyKPO1Oalc9hO8/gW6x01tpHiFVGiWM=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/go/goverlay/package.nix b/pkgs/by-name/go/goverlay/package.nix
index 2ea25a618975..e3a8fbc13694 100644
--- a/pkgs/by-name/go/goverlay/package.nix
+++ b/pkgs/by-name/go/goverlay/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goverlay";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "goverlay";
     tag = finalAttrs.version;
-    hash = "sha256-36gc+S8KgL7fZueKW2T/TlSlLx3/JfmcQfOQ7PDqDvo=";
+    hash = "sha256-88Ev83onTrtH+xPu11RNTZN4pCsWJ+eTJc6J2XTN7Z4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gr/grayjay/package.nix b/pkgs/by-name/gr/grayjay/package.nix
index 93c690aa8698..e0f247491023 100644
--- a/pkgs/by-name/gr/grayjay/package.nix
+++ b/pkgs/by-name/gr/grayjay/package.nix
@@ -181,7 +181,7 @@ buildDotnetModule (finalAttrs: {
         "--subpackage"
         "frontend"
         "--url"
-        "https://github.com/futo-org/Grayjay.Desktop"
+        "https://gitlab.futo.org/api/v4/projects/videostreaming%2FGrayjay%2EDesktop/repository/archive.tar.gz?sha=refs%2Ftags%2F10"
       ];
     })
     (finalAttrs.passthru.fetch-deps)
diff --git a/pkgs/by-name/gs/gscan2pdf/package.nix b/pkgs/by-name/gs/gscan2pdf/package.nix
index 012440348119..fc62127f647b 100644
--- a/pkgs/by-name/gs/gscan2pdf/package.nix
+++ b/pkgs/by-name/gs/gscan2pdf/package.nix
@@ -123,6 +123,15 @@ perlPackages.buildPerlPackage rec {
   ]);
 
   checkPhase = ''
+    # Temporarily disable a test failing because of a behavioural change in ImageMagick7
+    # t/04_Page.t ................................... 1/12
+    #   Failed test 'undefined'
+    #   at t/04_Page.t line 114.
+    #          got: '72'
+    #     expected: '300'
+    # Looks like you failed 1 test of 12.
+    rm t/04_Page.t
+
     export XDG_CACHE_HOME="$(mktemp -d)"
     xvfb-run -s '-screen 0 800x600x24' \
       make test
diff --git a/pkgs/by-name/hu/hunspell/dictionaries.nix b/pkgs/by-name/hu/hunspell/dictionaries.nix
index effde844fecf..56b04d1ead2b 100644
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@@ -969,14 +969,14 @@ rec {
   th_TH = th-th;
   th-th = mkDict {
     pname = "hunspell-dict-th-th";
-    version = "0-unstable-2025-12-23";
+    version = "0-unstable-2025-12-29";
     dictFileName = "th_TH";
     readmeFile = "README.md";
     src = fetchFromGitHub {
       owner = "SyafiqHadzir";
       repo = "Hunspell-TH";
-      rev = "2c85c67288df6c5c161086eb5314cb7ba360c961";
-      sha256 = "sha256-2+tfLJGPHopfwOp2FufZYVHiWSo2z4LjvCozqr6TyGU=";
+      rev = "a23b0521438f2735dc73efaee61391c6106ae196";
+      sha256 = "sha256-fRHtglTVoUgeQ8v/+pBWxfk+EgZv/uAt9Ka6tK1GJgA=";
     };
     meta = {
       description = "Hunspell dictionary for Central Thai (Thailand)";
diff --git a/pkgs/by-name/li/libraspberrypi/package.nix b/pkgs/by-name/li/libraspberrypi/package.nix
index 0e913d939fc8..00ad3ed53c78 100644
--- a/pkgs/by-name/li/libraspberrypi/package.nix
+++ b/pkgs/by-name/li/libraspberrypi/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   cmakeFlags = [
     # -DARM64=ON disables all targets that only build on 32-bit ARM; this allows
     # the package to build on aarch64 and other architectures
diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
new file mode 100644
index 000000000000..409d61f98502
--- /dev/null
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "lichess-bot";
+  version = "2025.12.23.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "lichess-bot-devs";
+    repo = "lichess-bot";
+    rev = "6ea42dfaffa65efea0da09d94b058853d724a989";
+    hash = "sha256-G8DiW96mRnvmmmRALRcYDnjLilQIRqH5m6+aTluhohI=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    chess
+    pyyaml
+    requests
+    backoff
+    rich
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    substituteInPlace "lib/lichess_bot.py" \
+      --replace 'open("lib/versioning.yml")' \
+                'open("'$out'/share/lichess-bot/lib/versioning.yml")'
+
+
+    mkdir -p "$out"/{bin,share/lichess-bot}
+    cp -R . $out/share/lichess-bot
+
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/lichess-bot \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/lichess-bot" \
+      --add-flags "$out/share/lichess-bot/lichess-bot.py"
+    echo $out > $out/my_dir.txt
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Bridge between lichess.org and bots";
+    homepage = "https://github.com/lichess-bot-devs/lichess-bot";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ mse63 ];
+    platforms = lib.platforms.unix;
+    mainProgram = "lichess-bot";
+  };
+
+}
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 7b9178f65744..71ca9fbaec55 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -74,13 +74,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "7527";
+  version = "7581";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-Nl4l812wZvqZs1Y7HOAf2g9zXLY4EwvfxX+So0tdT0U=";
+    hash = "sha256-8xQ6Azdr2Nwn+2EYAn/YDGLDRI6hqKVQsBDmfa7f5uk=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 0d58fe98a33c..c306574fc947 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.228";
+  version = "1.236";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-1RCcvlgbOE06DIgBALq2PJxipGVFonhQJcFr03dOEzc=";
+    hash = "sha256-cH6i4Jp0fhgpkv6yrs3EkiSN7jAHFOPJC8+Kbk4tKIs=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ma/manticoresearch/cctz-cmake-policy.patch b/pkgs/by-name/ma/manticoresearch/cctz-cmake-policy.patch
new file mode 100644
index 000000000000..4fa323984372
--- /dev/null
+++ b/pkgs/by-name/ma/manticoresearch/cctz-cmake-policy.patch
@@ -0,0 +1,9 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,1 +1,2 @@
+-cmake_minimum_required(VERSION 2.8.12)
++# Fix the build with CMake 4
++cmake_minimum_required(VERSION 3.5)
+
+ if (POLICY CMP0025)
+   cmake_policy(SET CMP0025 NEW)
diff --git a/pkgs/by-name/ma/manticoresearch/columnar.nix b/pkgs/by-name/ma/manticoresearch/columnar.nix
new file mode 100644
index 000000000000..296d50176bcb
--- /dev/null
+++ b/pkgs/by-name/ma/manticoresearch/columnar.nix
@@ -0,0 +1,172 @@
+{
+  cmake,
+  fetchFromGitHub,
+  fetchzip,
+  lib,
+  pkg-config,
+  replaceVars,
+  simde,
+  stdenv,
+}:
+
+let
+  # Manticore fetches columnar from a tag that indicates the versions of libraries that columnar includes.
+  # (See NEED_COLUMNAR_API/NEED_SECONDARY_API/NEED_KNN_API in Manticore's cmake/GetColumnar.cmake)
+  # So this tag indicates columnar v27, secondary v18, and knn v9.
+  libraryVersion = "c27-s18-k9";
+  # If you inspect the revision that tag points to, there's also hopefully a more normal version tag too
+  numericVersion = "9.0.0";
+  columnarSource = fetchFromGitHub {
+    owner = "manticoresoftware";
+    repo = "columnar";
+    tag = libraryVersion;
+    hash = "sha256-26zSdLNJkC7zYHT8sDq/2mZPRfdc9db1vIIrkaiPqFM=";
+  };
+  hnswlib = stdenv.mkDerivation (finalAttrs: {
+    pname = "hnswlib";
+    version = "d7bb3bbd59220f62203012b2f649aa537cc97cdc"; # see HNSW_GITHUB in columnar's cmake/GetHNSW.cmake
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "hnswlib";
+      rev = "d7bb3bbd59220f62203012b2f649aa537cc97cdc";
+      hash = "sha256-SDYf8J4auzqGBHqFMDFR6TVyNthCA4q6J4glcIssAJU=";
+    };
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+    meta = {
+      description = "Header-only C++/python library for fast approximate nearest neighbors";
+      homepage = "https://github.com/nmslib/hnswlib";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  });
+  pgm-index = stdenv.mkDerivation (finalAttrs: {
+    pname = "pgm-index";
+    version = "pgm_2022_08_02"; # see PGM_GITHUB in columnar's cmake/GetPGM.cmake
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "PGM-index";
+      rev = "5a5a763c7c07e56f56fd33137dcee9f1b3c3b640";
+      hash = "sha256-p8CjY9r1TEi91HBac9rZ39Yae2XuNh2yQWbo65n90jU=";
+    };
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+    # Use the custom CMakeLists.txt from columnar
+    postPatch = ''
+      cp ${columnarSource}/pgm/CMakeLists.txt CMakeLists.txt
+    '';
+    meta = {
+      description = "Piecewise Geometric Model index - a fast and space-efficient data structure";
+      homepage = "https://github.com/gvinciguerra/PGM-index";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  });
+  streamvbyte = stdenv.mkDerivation (finalAttrs: rec {
+    pname = "streamvbyte";
+    version = "efdd9dace81a4a8f844267631879b500c6d913cf"; # see SVB_GITHUB in columnar's cmake/GetStreamvbyte.cmake
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "streamvbyte";
+      rev = version;
+      hash = "sha256-a9E1aWBY/P7wI+kgHqhEiD3THctFfeFcy658RcNpHfQ=";
+    };
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+    # Enable SSE4.1 on x86_64 to avoid GCC 14 target attribute issues
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isx86_64 "-msse4.1";
+    # Use the custom CMakeLists.txt from columnar
+    postPatch = ''
+      cp ${columnarSource}/streamvbyte/CMakeLists.txt CMakeLists.txt
+    '';
+    meta = {
+      description = "Fast integer compression library using StreamVByte encoding";
+      homepage = "https://github.com/manticoresoftware/streamvbyte/";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  });
+  fastpfor = stdenv.mkDerivation (finalAttrs: {
+    pname = "fastpfor";
+    version = "simde"; # see FP_GITHUB in columnar's cmake/GetFastPFor.cmake
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "FastPFor";
+      rev = "5f6b7df8f0dba402bb616a81ca510bfeb04c42ce";
+      hash = "sha256-O9nqgsZKT+q9dHdh2RahF1U8KXCmDp0ld7hNvVREM8k=";
+    };
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+    buildInputs = [ simde ];
+    # Enable SSE3/SSSE3/SSE4.1 on x86_64 to avoid GCC 14 target attribute issues
+    # (Columnar's custom libfastpfor/CMakeLists.txt comments these out. I think get away with it because they just build with clang?)
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isx86_64 "-msse3 -mssse3 -msse4.1";
+
+    # Columnar uses its own version of CMakeLists.txt to compile libfastpfor
+    prePatch = ''
+      cp ${columnarSource}/libfastpfor/CMakeLists.txt CMakeLists.txt
+    '';
+    patches = [ ./fastpfor-cmake-policy.patch ];
+    postPatch = ''
+      # Use nixpkgs simde rather than FetchContent-ing from github
+      sed -i '/Add simde for arm/,/FetchContent_GetProperties ( simde )/c\
+        message(STATUS "Using nixpkgs simde for arm")\n\
+        set(simde_SOURCE_DIR "${simde.src}")\n\
+        set(simde_POPULATED 1)\n\
+      ' CMakeLists.txt
+    '';
+    meta = {
+      description = "Fast integer compression";
+      homepage = "https://github.com/manticoresoftware/FastPFor/";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "manticore-columnar";
+  version = numericVersion;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = columnarSource;
+  nativeBuildInputs = [
+    cmake
+  ];
+  buildInputs = [
+    fastpfor
+    hnswlib
+    pgm-index
+    streamvbyte
+  ];
+
+  patches = [
+    (replaceVars ./columnar.patch {
+      version = numericVersion;
+    })
+  ];
+  cmakeFlags = [
+    "-DSKIP_KNN=ON" # Skip KNN & embeddings for now
+  ];
+  postPatch = ''
+    # I've failed to get avx compiled, skip it for now.
+    sed -i '/set (ADD_AVX_BUILDS 1)/d' CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    description = "Manticore Columnar Library - columnar storage and secondary indexes library for Manticore Search";
+    homepage = "https://github.com/manticoresoftware/columnar";
+    license = licenses.asl20;
+  };
+})
diff --git a/pkgs/by-name/ma/manticoresearch/columnar.patch b/pkgs/by-name/ma/manticoresearch/columnar.patch
new file mode 100644
index 000000000000..568310ebe983
--- /dev/null
+++ b/pkgs/by-name/ma/manticoresearch/columnar.patch
@@ -0,0 +1,33 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 3bfbc5ef9043..2a25188f8f92 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -26,7 +26,7 @@ set ( CMAKE_INTERPROCEDURAL_OPTIMIZATION $ENV{CMAKE_INTERPROCEDURAL_OPTIMIZATION
+ set ( _CMAKE_BUILD_TYPE ${CMAKE_BUILD_TYPE} )
+ 
+ # The below version is used for versioning of the package and is replaced by the version from the pack workflow
+-project ( columnar VERSION 0.0.0 )
++project ( columnar VERSION @version@ )
+ 
+ # sometimes CMAKE_BUILD_TYPE became set after PROJECT statement, undo it.
+ if (NOT _CMAKE_BUILD_TYPE AND CMAKE_BUILD_TYPE)
+@@ -108,7 +108,7 @@ set (_includes include/manticore-columnar-api)
+ target_include_directories ( columnar_api INTERFACE $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>$<INSTALL_INTERFACE:${_includes}> )
+ 
+ # install columnar and secondary API (only headers, no packaging, don't build anything at all)
+-if (API_ONLY)
++# if (API_ONLY)
+ 	install ( TARGETS columnar_api EXPORT apiexport )
+ 	install ( TARGETS secondary_api EXPORT apiexport )
+ 	install ( TARGETS knn_api EXPORT apiexport )
+@@ -147,8 +147,8 @@ include(\"\${CMAKE_CURRENT_LIST_DIR}/columnar-targets.cmake\")" )
+ 	install ( FILES "${CMAKE_CURRENT_BINARY_DIR}/columnar-config-version.cmake" DESTINATION "${API_CMAKE_DIR}" )
+ 
+ 	# finish configuration, as it is API_ONLY
+-	return()
+-endif ()
++	# return()
++# endif ()
+ 
+ # here we came in case of full build (i.e. columnar and/or secondary and/or knn)
+ 
diff --git a/pkgs/by-name/ma/manticoresearch/fastpfor-cmake-policy.patch b/pkgs/by-name/ma/manticoresearch/fastpfor-cmake-policy.patch
new file mode 100644
index 000000000000..c1820e7a5c70
--- /dev/null
+++ b/pkgs/by-name/ma/manticoresearch/fastpfor-cmake-policy.patch
@@ -0,0 +1,14 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index efedf74..effa1ec 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -4,7 +4,8 @@
+ # Copyright (c) 2012 Louis Dionne
+ # Copyright (c) 2021-2022 Manticore Software LTD
+ #
+-cmake_minimum_required ( VERSION 3.17 )
++# Fix build with CMake 4
++cmake_minimum_required ( VERSION 3.5 )
+ 
+ foreach (policy CMP0091 CMP0022)
+ 	if (POLICY ${policy})
diff --git a/pkgs/by-name/ma/manticoresearch/package.nix b/pkgs/by-name/ma/manticoresearch/package.nix
index c0b190e29e60..ae6c0c857af5 100644
--- a/pkgs/by-name/ma/manticoresearch/package.nix
+++ b/pkgs/by-name/ma/manticoresearch/package.nix
@@ -1,40 +1,25 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
   bison,
-  cmake,
-  flex,
-  pkg-config,
   boost,
+  callPackage,
+  cmake,
+  croaring,
+  fetchFromGitHub,
+  flex,
   icu,
+  lib,
   libstemmer,
-  mariadb-connector-c,
-  re2,
-  nlohmann_json,
-  testers,
   manticoresearch,
+  mariadb-connector-c,
+  nlohmann_json,
+  pkg-config,
+  re2,
+  stdenv,
+  testers,
 }:
 
 let
-  columnar = stdenv.mkDerivation (finalAttrs: {
-    pname = "columnar";
-    version = "c21-s10"; # see NEED_COLUMNAR_API/NEED_SECONDARY_API in Manticore's cmake/GetColumnar.cmake
-    src = fetchFromGitHub {
-      owner = "manticoresoftware";
-      repo = "columnar";
-      rev = finalAttrs.version;
-      hash = "sha256-TGFGFfoyHnPSr2U/9dpqFLUN3Dt2jDQrTF/xxDY4pdE=";
-    };
-    nativeBuildInputs = [ cmake ];
-    cmakeFlags = [ "-DAPI_ONLY=ON" ];
-    meta = {
-      description = "Column-oriented storage and secondary indexing library";
-      homepage = "https://github.com/manticoresoftware/columnar/";
-      license = lib.licenses.asl20;
-      platforms = lib.platforms.all;
-    };
-  });
+  columnar = callPackage ./columnar.nix { };
   uni-algo = stdenv.mkDerivation (finalAttrs: {
     pname = "uni-algo";
     version = "0.7.2";
@@ -52,16 +37,60 @@ let
       platforms = lib.platforms.all;
     };
   });
+  cctz = stdenv.mkDerivation {
+    pname = "manticore-cctz";
+    version = "0-unstable-2024-05-08";
+
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "cctz";
+      rev = "cf11f758e2532161c9e21c3ec2461b0fafb15853";
+      hash = "sha256-oXn6YowOg+9jaXXSX1fggkgE9o9xZ4hlmrpdpEHot68=";
+    };
+
+    patches = [ ./cctz-cmake-policy.patch ];
+
+    nativeBuildInputs = [ cmake ];
+    cmakeBuildDir = "build_dir"; # Avoid conflicts with the pre-existing `BUILD` file on case-insensitive FS
+
+    meta = {
+      description = "Library for translating between absolute and civil times using the rules of a time zone";
+      homepage = "https://github.com/manticoresoftware/cctz";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  };
+  xxhash = stdenv.mkDerivation {
+    pname = "manticore-xxhash";
+    version = "0.8.2-unstable-2024-07-24";
+
+    src = fetchFromGitHub {
+      owner = "manticoresoftware";
+      repo = "xxHash";
+      rev = "72997b0070a031c063f86a308aec77ae742706d3";
+      hash = "sha256-QAIxZeMiohm/BYyO0f70En6GOv7t3yLH2pJfkUek7Js=";
+    };
+    nativeBuildInputs = [ cmake ];
+    meta = {
+      description = "Extremely fast non-cryptographic hash algorithm";
+      homepage = "https://github.com/manticoresoftware/xxhash";
+      license = with lib.licenses; [
+        bsd2
+        gpl2
+      ];
+      platforms = lib.platforms.all;
+    };
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "manticoresearch";
-  version = "6.2.12";
+  version = "15.1.0";
 
   src = fetchFromGitHub {
     owner = "manticoresoftware";
     repo = "manticoresearch";
     tag = finalAttrs.version;
-    hash = "sha256-UD/r7rlJ5mR3wg4doKT/nTwTWzlulngUjOPNEjmykB8=";
+    hash = "sha256-ESiM2D11o1QnctDzL7WQ+usad7nvs0YSPOpZzSfYv4Y=";
   };
 
   nativeBuildInputs = [
@@ -73,41 +102,54 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     boost
-    columnar
+    cctz
+    columnar.dev
+    croaring
     icu.dev
     libstemmer
     mariadb-connector-c
     nlohmann_json
     uni-algo
     re2
+    xxhash
   ];
 
   postPatch = ''
     sed -i 's/set ( Boost_USE_STATIC_LIBS ON )/set ( Boost_USE_STATIC_LIBS OFF )/' src/CMakeLists.txt
 
-    # supply our own packages rather than letting manticore download dependencies during build
-    sed -i 's/^with_get/with_menu/' CMakeLists.txt
-    sed -i 's/get_dep \( nlohmann_json .* \)/find_package(nlohmann_json)/' CMakeLists.txt
-    sed -i 's/get_dep \( uni-algo .* \)/find_package(uni-algo)/' CMakeLists.txt
+    # Skip jieba, it requires a bunch of additional dependencies
+    sed -i '/with_get ( jieba /d' CMakeLists.txt
+
+    # Fill in a version number for the VERNUMBERS macro
+    sed -i 's/0\.0\.0/${finalAttrs.version}/' src/sphinxversion.h.in
   '';
 
   cmakeFlags = [
     "-DWITH_GALERA=0"
+    "-DWITH_ICU=1"
+    # Supply our own packages rather than letting manticore download dependencies during build
+    "-DWITH_ICU_FORCE_STATIC=OFF"
+    "-DWITH_RE2_FORCE_STATIC=OFF"
+    "-DWITH_STEMMER_FORCE_STATIC=OFF"
     "-DWITH_MYSQL=1"
     "-DMYSQL_INCLUDE_DIR=${mariadb-connector-c.dev}/include/mariadb"
     "-DMYSQL_LIB=${mariadb-connector-c.out}/lib/mariadb/libmysqlclient.a"
     "-DCONFDIR=${placeholder "out"}/etc"
     "-DLOGDIR=/var/lib/manticoresearch/log"
     "-DRUNDIR=/var/run/manticoresearch"
+    "-DDISTR=nixpkgs"
   ];
 
   postFixup = ''
     mkdir -p $out/lib/systemd/system
     cp ${finalAttrs.src}/dist/deb/manticore.service.in $out/lib/systemd/system/manticore.service
     substituteInPlace $out/lib/systemd/system/manticore.service \
-      --replace "@CMAKE_INSTALL_FULL_RUNSTATEDIR@" "/var/lib/manticore" \
-      --replace "@CMAKE_INSTALL_FULL_BINDIR@" "$out/bin" \
-      --replace "@CMAKE_INSTALL_FULL_SYSCONFDIR@" "$out/etc"
+      --replace-fail "@CMAKE_INSTALL_FULL_RUNSTATEDIR@" "/var/lib/manticore" \
+      --replace-fail "@CMAKE_INSTALL_FULL_BINDIR@" "$out/bin" \
+      --replace-fail "@CMAKE_INSTALL_FULL_SYSCONFDIR@" "$out/etc"
+
+    mkdir $out/share/manticore/modules
+    cp ${columnar}/share/manticore/modules/* $out/share/manticore/modules
   '';
 
   passthru.tests.version = testers.testVersion {
@@ -120,7 +162,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Easy to use open source fast database for search";
     homepage = "https://manticoresearch.com";
     changelog = "https://github.com/manticoresoftware/manticoresearch/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl3Plus;
     mainProgram = "searchd";
     maintainers = [ lib.maintainers.jdelStrother ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/md/mdbook-footnote/package.nix b/pkgs/by-name/md/mdbook-footnote/package.nix
index 56b3c05cc0e4..bd0a45bec4a3 100644
--- a/pkgs/by-name/md/mdbook-footnote/package.nix
+++ b/pkgs/by-name/md/mdbook-footnote/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-footnote";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "daviddrysdale";
     repo = "mdbook-footnote";
     tag = "v${version}";
-    hash = "sha256-WUMgm1hwsU9BeheLfb8Di0AfvVQ6j92kXxH2SyG3ses=";
+    hash = "sha256-YFMo+gufUEvHRnA9I98fGRXHcQjSTHY7DSRo90wcSHk=";
   };
 
-  cargoHash = "sha256-3tuejWMZlEAOgnBKEqZP2a72a8QP1yamfE/g2BJDEbg=";
+  cargoHash = "sha256-Gr/6Et+TlVBlDf++1z3YgzqRfIolHc5qT9BwtIkjnM4=";
 
   meta = {
     description = "Preprocessor for mdbook to support the inclusion of automatically numbered footnotes";
diff --git a/pkgs/by-name/mp/mpack/package.nix b/pkgs/by-name/mp/mpack/package.nix
index 84921bda7216..e9ceb444c513 100644
--- a/pkgs/by-name/mp/mpack/package.nix
+++ b/pkgs/by-name/mp/mpack/package.nix
@@ -73,6 +73,9 @@ stdenv.mkDerivation rec {
       --replace-fail "char buf[1024], buf2[1024];" "char buf[1024], buf2[1066];"
   '';
 
+  # fix build with gcc15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   nativeBuildInputs = [ autoreconfHook ];
 
   postInstall = ''
diff --git a/pkgs/by-name/no/noctalia-shell/package.nix b/pkgs/by-name/no/noctalia-shell/package.nix
index 5fa2706a6bcb..d45e317395dd 100644
--- a/pkgs/by-name/no/noctalia-shell/package.nix
+++ b/pkgs/by-name/no/noctalia-shell/package.nix
@@ -66,13 +66,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noctalia-shell";
-  version = "3.7.5";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TBrsYS+n+8AsXRAP4wA3JNOdT604QmPo8yeSTT/p61I=";
+    hash = "sha256-Bh4XcEyG6XRQugahL/2Vd42k/YeGK0f+yW3+Oc74Rp4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/protonup-rs/package.nix b/pkgs/by-name/pr/protonup-rs/package.nix
index b0699685a9b7..6e5cb47f7abe 100644
--- a/pkgs/by-name/pr/protonup-rs/package.nix
+++ b/pkgs/by-name/pr/protonup-rs/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protonup-rs";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-mysYcBmXKkXz1vlhZv8okVnnD83h/QyGwT9ijluOgms=";
+    hash = "sha256-GpKiecfEV66TGgU3f/WlQZZ4mVJD4+quZSb+45fsWpM=";
   };
 
-  cargoHash = "sha256-NiJwaD7lH2jnxfc/Hreo3bJ3LC+0UAOlsVMt1UYRcdY=";
+  cargoHash = "sha256-15K6n7npZmbxDroIN09Tr5L8oTUJ0js9/cfiPQDeTTQ=";
 
   checkFlags = [
     # Requires internet access
diff --git a/pkgs/by-name/pu/purpur/package.nix b/pkgs/by-name/pu/purpur/package.nix
index 3b3146e7f71b..51fdcf6a53a2 100644
--- a/pkgs/by-name/pu/purpur/package.nix
+++ b/pkgs/by-name/pu/purpur/package.nix
@@ -7,15 +7,15 @@
   makeWrapper,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "purpur";
-  version = "1.21.3r2358";
+  version = "1.21.10r2535";
 
   src = fetchurl {
     url = "https://api.purpurmc.org/v2/purpur/${
-      builtins.replaceStrings [ "r" ] [ "/" ] version
+      builtins.replaceStrings [ "r" ] [ "/" ] finalAttrs.version
     }/download";
-    sha256 = "sha256-RFrP7q1jgKUztF518HA6Jmj1qXa51l1HegMH1wMr5W4=";
+    sha256 = "sha256-QVl4Nnewi2OVeC5hUMsoZGxw7ZiLeUjAngGqWl6Q9Ug=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -49,4 +49,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     mainProgram = "minecraft-server";
   };
-}
+})
diff --git a/pkgs/by-name/rm/rmw/package.nix b/pkgs/by-name/rm/rmw/package.nix
index f502134f6728..4aae0d64e475 100644
--- a/pkgs/by-name/rm/rmw/package.nix
+++ b/pkgs/by-name/rm/rmw/package.nix
@@ -5,19 +5,20 @@
   meson,
   ninja,
   pkg-config,
+  canfigger,
   ncurses,
   gettext,
 }:
 
 stdenv.mkDerivation rec {
   pname = "rmw";
-  version = "0.9.1";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "theimpossibleastronaut";
     repo = "rmw";
     tag = "v${version}";
-    hash = "sha256-rfJdJHSkusZj/PN74KgV5i36YC0YRZmIfRdvkUNoKEM=";
+    hash = "sha256-/bE9fFjn3mPfUbtsB6bXfQAxUtbtuZiT4pevi5RCQA4=";
     fetchSubmodules = true;
   };
 
@@ -28,15 +29,11 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    canfigger
     ncurses
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin gettext;
 
-  # The subproject "canfigger" has asan and ubsan enabled by default, disable it here
-  mesonFlags = [
-    "-Dcanfigger:b_sanitize=none"
-  ];
-
   meta = {
     description = "Trashcan/ recycle bin utility for the command line";
     homepage = "https://github.com/theimpossibleastronaut/rmw";
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index 93542ebc3fe0..3f77609b9c5e 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0.2.0-nightly-2025-12-26";
+  version = "0.2.0-nightly-2025-12-31";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-z0nvghGEljbWZtKHY9fQlZxVcshcDgSR28wK/XOeZag=";
+    hash = "sha256-mFxwoaIV5TLejQr1R6RNXSbLy/6vkRT17q3zN/UIDrk=";
   };
 
   postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                        "OpenH264Version(${major}, ${minor}, ${patch})"
     '';
 
-  cargoHash = "sha256-9kypz9Qm/gc1jCMTvbRnHmfT4um6HgR8c94wDQQf87o=";
+  cargoHash = "sha256-cgeXV72+XVhCIEdGQgNxNoCetYcAD6r7U8FkUhl3VZ8=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =
diff --git a/pkgs/by-name/si/sillytavern/package.nix b/pkgs/by-name/si/sillytavern/package.nix
index ca81a2dabe7e..342dac2c88ca 100644
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@@ -1,6 +1,7 @@
 {
   buildNpmPackage,
   fetchFromGitHub,
+  nodejs_22,
   lib,
 }:
 buildNpmPackage (finalAttrs: {
@@ -17,6 +18,9 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmBuild = true;
 
+  # https://github.com/NixOS/nixpkgs/issues/474535
+  nodejs = nodejs_22;
+
   # These dirs are not installed automatically.
   # And if they were not in place, the app would try to create them at runtime, which is of course impossible to achieve.
   postInstall = ''
diff --git a/pkgs/by-name/su/sub-store-frontend/package.nix b/pkgs/by-name/su/sub-store-frontend/package.nix
new file mode 100644
index 000000000000..0bbdf7428215
--- /dev/null
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  pnpm_10,
+  pnpm ? pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  nix-update-script,
+  nodejs,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "sub-store-frontend";
+  version = "2.15.85";
+
+  src = fetchFromGitHub {
+    owner = "sub-store-org";
+    repo = "Sub-Store-Front-End";
+    tag = finalAttrs.version;
+    hash = "sha256-K7tAqbM7cQpmZmRQFwJhpiesUoPzvXEKu5q0pYsj+ZA=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm
+  ];
+
+  npmDeps = null;
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-HEeNYLKvzO/RQWYnm5gqRjTrXiiCxKUxf3bcRvz+O4k=";
+  };
+
+  npmConfigHook = pnpmConfigHook;
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Sub-Store Progressive Web App";
+    homepage = "https://github.com/sub-store-org/Sub-Store-Front-End";
+    changelog = "https://github.com/sub-store-org/Sub-Store-Front-End/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    platforms = nodejs.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/su/sub-store/package.nix b/pkgs/by-name/su/sub-store/package.nix
new file mode 100644
index 000000000000..cd1c85e268f4
--- /dev/null
+++ b/pkgs/by-name/su/sub-store/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  pnpm_10,
+  pnpm ? pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  makeBinaryWrapper,
+  nix-update-script,
+
+  nodejs,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "sub-store";
+  version = "2.20.61";
+
+  src = fetchFromGitHub {
+    owner = "sub-store-org";
+    repo = "Sub-Store";
+    tag = finalAttrs.version;
+    hash = "sha256-6NHPVCIlModWXzKOJnPwA41cHrNWy6yXUEwoKpbwpmw=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/backend";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pnpm
+  ];
+
+  npmDeps = null;
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    inherit pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-VsK6qvBeOF2smXRFmMk4gWxQgAD1GG/ExvZdIERdz9g=";
+  };
+
+  npmConfigHook = pnpmConfigHook;
+  npmBuildScript = "bundle:esbuild";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share
+    cp -r dist $out/share/sub-store
+    makeWrapper ${lib.getExe nodejs} $out/bin/sub-store \
+      --add-flags "$out/share/sub-store/sub-store.bundle.js"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Advanced Subscription Manager for QX, Loon, Surge, Stash, Egern and Shadowrocket";
+    homepage = "https://github.com/sub-store-org/Sub-Store";
+    changelog = "https://github.com/sub-store-org/Sub-Store/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "sub-store";
+    platforms = nodejs.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/te/tenacity/cstdlib.patch b/pkgs/by-name/te/tenacity/cstdlib.patch
new file mode 100644
index 000000000000..ed74657c8a97
--- /dev/null
+++ b/pkgs/by-name/te/tenacity/cstdlib.patch
@@ -0,0 +1,26 @@
+From f523f6a4272910417da6d8f02597a560a9c594e4 Mon Sep 17 00:00:00 2001
+From: Ethan Carter Edwards <ethan@ethancedwards.com>
+Date: Wed, 31 Dec 2025 21:17:39 -0500
+Subject: [PATCH] fix compilation for gcc 15
+
+Link: https://github.com/NixOS/nixpkgs/issues/475574
+
+Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
+---
+ libraries/lib-utility/MemoryX.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libraries/lib-utility/MemoryX.h b/libraries/lib-utility/MemoryX.h
+index 2c96af17b..58bf67127 100644
+--- a/libraries/lib-utility/MemoryX.h
++++ b/libraries/lib-utility/MemoryX.h
+@@ -5,6 +5,7 @@
+ #include <iterator>
+ #include <memory>
+ #include <new> // align_val_t and hardware_destructive_interference_size
+ #include <cstdlib> // Needed for free.
++#include <cstdint>
+ #ifndef safenew
+ #define safenew new
+-- 
+2.47.3
diff --git a/pkgs/by-name/te/tenacity/package.nix b/pkgs/by-name/te/tenacity/package.nix
index 3636dc9342ee..4af8231506fb 100644
--- a/pkgs/by-name/te/tenacity/package.nix
+++ b/pkgs/by-name/te/tenacity/package.nix
@@ -61,6 +61,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-2gndOwgEJK2zDSbjcZigbhEpGv301/ygrf+EQhKp8PI=";
   };
 
+  # https://codeberg.org/tenacityteam/tenacity/pulls/696
+  # can be removed at next version bump
+  patches = [
+    ./cstdlib.patch
+  ];
+
   postPatch = ''
     # GIT_DESCRIBE is used for the version string and can't be passed in
     # as an option, so we substitute it instead.
diff --git a/pkgs/by-name/un/unrtf/package.nix b/pkgs/by-name/un/unrtf/package.nix
index ec986657c241..0657563f8012 100644
--- a/pkgs/by-name/un/unrtf/package.nix
+++ b/pkgs/by-name/un/unrtf/package.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
   pname = "unrtf";
   version = "0.21.10";
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/${pname}/${pname}-${version}.tar.gz";
     sha256 = "1bil6z4niydz9gqm2j861dkxmqnpc8m7hvidsjbzz7x63whj17xl";
diff --git a/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch b/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch
deleted file mode 100644
index d55caab22e69..000000000000
--- a/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-Index: usb-modeswitch-2.6.0/Makefile
-===================================================================
---- usb-modeswitch-2.6.0.orig/Makefile
-+++ usb-modeswitch-2.6.0/Makefile
-@@ -5,17 +5,24 @@ CFLAGS      += -Wall -Wno-deprecated-dec
- LIBS        = `pkg-config --libs --cflags libusb-1.0`
- RM          = /bin/rm -f
- OBJS        = usb_modeswitch.c
--PREFIX      = $(DESTDIR)/usr
--ETCDIR      = $(DESTDIR)/etc
-+PREFIX      = /usr/local
-+ETCDIR      = $(PREFIX)/etc
- SYSDIR      = $(ETCDIR)/systemd/system
- UPSDIR      = $(ETCDIR)/init
--UDEVDIR     = $(DESTDIR)/lib/udev
-+UDEVDIR     = $(PREFIX)/lib/udev
- SBINDIR     = $(PREFIX)/sbin
- MANDIR      = $(PREFIX)/share/man/man1
- 
-+USE_UPSTART=$(shell if command -v initctl > /dev/null; then echo "true"; fi)
-+USE_SYSTEMD=$(shell if command -v systemctl > /dev/null; then echo "true"; fi)
-+
- .PHONY: clean install install-common uninstall \
- 	dispatcher-script dispatcher-dynlink dispatcher-statlink \
--	install-script install-dynlink install-statlink
-+	install-script install-dynlink install-statlink \
-+	install-upstart install-systemd \
-+	configure-dispatcher configure-script \
-+	configure-upstart configure-systemd \
-+	configure
- 
- all: all-with-script-dispatcher
- 
-@@ -28,7 +35,25 @@ all-with-statlink-dispatcher: $(PROG) di
- $(PROG): $(OBJS) usb_modeswitch.h
- 	$(CC) -o $(PROG) $(OBJS) $(CFLAGS) $(LIBS) $(LDFLAGS)
- 
--dispatcher-script: usb_modeswitch_dispatcher.tcl
-+configure-dispatcher:
-+	sed -i \
-+	  -e 's,^\(set setup(sbindir) \).*$$,\1$(SBINDIR),' \
-+	  -e 's,^\(set setup(etcdir) \).*$$,\1$(ETCDIR),' \
-+	  usb_modeswitch_dispatcher.tcl
-+
-+configure-script:
-+	sed -i -e 's,^\(SBINDIR=\).*$$,\1$(SBINDIR),' usb_modeswitch.sh
-+
-+configure-systemd:
-+	sed -i -e 's,@sbindir@,$(SBINDIR),' usb_modeswitch@.service
-+
-+configure-upstart:
-+	sed -i -e 's,@sbindir@,$(SBINDIR),' usb-modeswitch-upstart.conf
-+
-+configure: configure-dispatcher configure-script \
-+	configure-systemd configure-upstart
-+
-+dispatcher-script: configure-dispatcher usb_modeswitch_dispatcher.tcl
- 	DISPATCH=dispatcher-script
- 	cp -f usb_modeswitch_dispatcher.tcl usb_modeswitch_dispatcher
- 
-@@ -53,16 +78,28 @@ distclean: clean
- # If the systemd folder is present, install the service for starting the dispatcher
- # If not, use the dispatcher directly from the udev rule as in previous versions
- 
--install-common: $(PROG) $(DISPATCH)
--	install -D --mode=755 usb_modeswitch $(SBINDIR)/usb_modeswitch
--	install -D --mode=755 usb_modeswitch.sh $(UDEVDIR)/usb_modeswitch
--	install -D --mode=644 usb_modeswitch.conf $(ETCDIR)/usb_modeswitch.conf
--	install -D --mode=644 usb_modeswitch.1 $(MANDIR)/usb_modeswitch.1
--	install -D --mode=644 usb_modeswitch_dispatcher.1 $(MANDIR)/usb_modeswitch_dispatcher.1
--	install -D --mode=755 usb_modeswitch_dispatcher $(SBINDIR)/usb_modeswitch_dispatcher
-+install-common: $(PROG) configure $(DISPATCH)
-+	install -D --mode=755 usb_modeswitch $(DESTDIR)$(SBINDIR)/usb_modeswitch
-+	install -D --mode=755 usb_modeswitch.sh $(DESTDIR)$(UDEVDIR)/usb_modeswitch
-+	install -D --mode=644 usb_modeswitch.conf $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
-+	install -D --mode=644 usb_modeswitch.1 $(DESTDIR)$(MANDIR)/usb_modeswitch.1
-+	install -D --mode=644 usb_modeswitch_dispatcher.1 $(DESTDIR)$(MANDIR)/usb_modeswitch_dispatcher.1
-+	install -D --mode=755 usb_modeswitch_dispatcher $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
- 	install -d $(DESTDIR)/var/lib/usb_modeswitch
--	test -d $(UPSDIR) -a -e /sbin/initctl && install --mode=644 usb-modeswitch-upstart.conf $(UPSDIR) || test 1
--	test -d $(SYSDIR) -a \( -e /usr/bin/systemctl -o -e /bin/systemctl \) && install --mode=644 usb_modeswitch@.service $(SYSDIR) || test 1
-+
-+install-upstart:
-+	install -D --mode=644 usb-modeswitch-upstart.conf $(DESTDIR)$(UPSDIR)/usb-modeswitch-upstart.conf
-+
-+install-systemd:
-+	install -D --mode=644 usb_modeswitch@.service $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
-+
-+ifeq ($(USE_UPSTART),true)
-+install-common: install-upstart
-+endif
-+
-+ifeq ($(USE_SYSTEMD),true)
-+install-common: install-systemd
-+endif
- 
- install: install-script
- 
-@@ -73,10 +110,10 @@ install-dynlink: dispatcher-dynlink inst
- install-statlink: dispatcher-statlink install-common
- 
- uninstall:
--	$(RM) $(SBINDIR)/usb_modeswitch
--	$(RM) $(SBINDIR)/usb_modeswitch_dispatcher
--	$(RM) $(UDEVDIR)/usb_modeswitch
--	$(RM) $(ETCDIR)/usb_modeswitch.conf
--	$(RM) $(MANDIR)/usb_modeswitch.1
-+	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch
-+	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
-+	$(RM) $(DESTDIR)$(UDEVDIR)/usb_modeswitch
-+	$(RM) $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
-+	$(RM) $(DESTDIR)$(MANDIR)/usb_modeswitch.1
- 	$(RM) -R $(DESTDIR)/var/lib/usb_modeswitch
--	$(RM) $(SYSDIR)/usb_modeswitch@.service
-+	$(RM) $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
-Index: usb-modeswitch-2.6.0/usb-modeswitch-upstart.conf
-===================================================================
---- usb-modeswitch-2.6.0.orig/usb-modeswitch-upstart.conf
-+++ usb-modeswitch-2.6.0/usb-modeswitch-upstart.conf
-@@ -1,5 +1,5 @@
- start on usb-modeswitch-upstart
- task
- script
--	exec /usr/sbin/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
-+	exec @sbindir@/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
- end script
-Index: usb-modeswitch-2.6.0/usb_modeswitch.sh
-===================================================================
---- usb-modeswitch-2.6.0.orig/usb_modeswitch.sh
-+++ usb-modeswitch-2.6.0/usb_modeswitch.sh
-@@ -1,5 +1,9 @@
- #!/bin/sh
- # part of usb_modeswitch 2.6.0
-+
-+# Compile time configuration, injected by the Makefile
-+SBINDIR=/usr/sbin
-+
- device_in()
- {
- 	if [ ! -e /var/lib/usb_modeswitch/$1 ]; then
-@@ -37,7 +41,7 @@ if [ $(expr "$1" : "--.*") ]; then
- 		v_id=$3
- 	fi
- fi
--PATH=/sbin:/usr/sbin:$PATH
-+
- case "$1" in
- 	--driver-bind)
- 		# driver binding code removed
-@@ -46,9 +50,7 @@ case "$1" in
- 	--symlink-name)
- 		device_in "link_list" $v_id $p_id
- 		if [ "$?" = "1" ]; then
--			if [ -e "/usr/sbin/usb_modeswitch_dispatcher" ]; then
--				exec usb_modeswitch_dispatcher $1 $2 2>>/dev/null
--			fi
-+			exec $SBINDIR/usb_modeswitch_dispatcher $1 $2 2>>/dev/null
- 		fi
- 		exit 0
- 		;;
-@@ -61,15 +63,13 @@ if [ "$p2" = "" -a "$p1" != "" ]; then
- 	p2=$p1
- fi
- 
--PATH=/bin:/sbin:/usr/bin:/usr/sbin
--init_path=`readlink -f /sbin/init`
--if [ `basename $init_path` = "systemd" ]; then
-+if command -v systemctl > /dev/null; then
- 	systemctl --no-block restart usb_modeswitch@$p2.service
--elif [ -e "/etc/init/usb-modeswitch-upstart.conf" ]; then
-+elif command -v initctl > /dev/null; then
- 	initctl emit --no-wait usb-modeswitch-upstart UMS_PARAM=$p2
- else
- 	# only old distros, new udev will kill all subprocesses
- 	exec 1<&- 2<&- 5<&- 7<&-
--	exec usb_modeswitch_dispatcher --switch-mode $p2 &
-+	exec $SBINDIR/usb_modeswitch_dispatcher --switch-mode $p2 &
- fi
- exit 0
-Index: usb-modeswitch-2.6.0/usb_modeswitch@.service
-===================================================================
---- usb-modeswitch-2.6.0.orig/usb_modeswitch@.service
-+++ usb-modeswitch-2.6.0/usb_modeswitch@.service
-@@ -3,6 +3,6 @@ Description=USB_ModeSwitch_%i
- 
- [Service]
- Type=oneshot
--ExecStart=/usr/sbin/usb_modeswitch_dispatcher --switch-mode %i
-+ExecStart=@sbindir@/usb_modeswitch_dispatcher --switch-mode %i
- #ExecStart=/bin/echo %i
- 
-Index: usb-modeswitch-2.6.0/usb_modeswitch_dispatcher.tcl
-===================================================================
---- usb-modeswitch-2.6.0.orig/usb_modeswitch_dispatcher.tcl
-+++ usb-modeswitch-2.6.0/usb_modeswitch_dispatcher.tcl
-@@ -12,6 +12,16 @@
- # Part of usb-modeswitch-2.6.0 package
- # (C) Josua Dietze 2009-2019
- 
-+# Compile-time configuration, injected by the Makefile.
-+set setup(sbindir) /usr/sbin
-+set setup(etcdir) /etc
-+
-+# External dependency default location
-+set setup(dbdir) /usr/share/usb_modeswitch
-+
-+# Derived configuration
-+set setup(dbdir_etc) $setup(etcdir)/usb_modeswitch.d
-+
- set arg0 [lindex $argv 0]
- if [regexp {\.tcl$} $arg0] {
- 	if [file exists $arg0] {
-@@ -115,10 +125,8 @@ if {![regexp {(.*?):.*$} $arg1 d device]
- 	}
- }
- 
--set setup(dbdir) /usr/share/usb_modeswitch
--set setup(dbdir_etc) /etc/usb_modeswitch.d
- if {![file exists $setup(dbdir)] && ![file exists $setup(dbdir_etc)]} {
--	Log "\nError: no config database found in /usr/share or /etc. Exit"
-+	Log "\nError: no config database found in $setup(dbdir) or $setup(dbdir_etc). Exit"
- 	SafeExit
- }
- 
-@@ -285,7 +293,7 @@ if {$config(NoMBIMCheck)==0 && $usb(bNum
- 	if [CheckMBIM] {
- 		Log " driver for MBIM devices is available"
- 		Log "Find MBIM configuration number ..."
--		if [catch {set cfgno [exec /usr/sbin/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
-+		if [catch {set cfgno [exec $setup(sbindir)/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
- 			Log "Error when trying to find MBIM configuration, switch to legacy modem mode"
- 		} else {
- 			set cfgno [string trim $cfgno]
-@@ -321,7 +329,7 @@ if {$report == ""} {
- 	# Now we are actually switching
- 	if $flags(logging) {
- 		Log "Command line:\nusb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f \$flags(config)"
--		catch {set report [exec /usr/sbin/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
-+		catch {set report [exec $setup(sbindir)/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
- 		Log "\nVerbose debug output of usb_modeswitch and libusb follows"
- 		Log "(Note that some USB errors are to be expected in the process)"
- 		Log "--------------------------------"
-@@ -329,7 +337,7 @@ if {$report == ""} {
- 		Log "--------------------------------"
- 		Log "(end of usb_modeswitch output)\n"
- 	} else {
--		catch {set report [exec /usr/sbin/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
-+		catch {set report [exec $setup(sbindir)/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
- 	}
- }
- 
-@@ -522,12 +530,12 @@ return 1
- 
- proc {ParseGlobalConfig} {path} {
- 
--global flags
-+global flags setup
- set configFile ""
- if [string length $path] {
- 	set places [list $path]
- } else {
--	set places [list /etc/usb_modeswitch.conf /etc/sysconfig/usb_modeswitch /etc/default/usb_modeswitch]
-+	set places [list $setup(etcdir)/usb_modeswitch.conf $setup(etcdir)/sysconfig/usb_modeswitch $setup(etcdir)/default/usb_modeswitch]
- }
- foreach cfg $places {
- 	if [file exists $cfg] {
-@@ -923,10 +931,12 @@ proc {SysLog} {msg} {
- 
- global flags
- if {![info exists flags(logger)]} {
--	set flags(logger) ""
--	foreach fn {/bin/logger /usr/bin/logger} {
--		if [file exists $fn] {
--			set flags(logger) $fn
-+	set flags(logger) [exec sh -c "command -v logger || true"]
-+	if {$flags(logger) == ""} {
-+		foreach fn {/bin/logger /usr/bin/logger} {
-+			if [file exists $fn] {
-+				set flags(logger) $fn
-+			}
- 		}
- 	}
- 	Log "Logger is $flags(logger)"
diff --git a/pkgs/by-name/us/usb-modeswitch/package.nix b/pkgs/by-name/us/usb-modeswitch/package.nix
index c16acb517d11..3dbcce763660 100644
--- a/pkgs/by-name/us/usb-modeswitch/package.nix
+++ b/pkgs/by-name/us/usb-modeswitch/package.nix
@@ -11,19 +11,16 @@
   bash,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "usb-modeswitch";
-  version = "2.6.0";
+  version = "2.6.2";
 
   src = fetchurl {
-    url = "http://www.draisberghof.de/usb_modeswitch/${pname}-${version}.tar.bz2";
-    sha256 = "18wbbxc5cfsmikba0msdvd5qlaga27b32nhrzicyd9mdddp265f2";
+    url = "http://www.draisberghof.de/usb_modeswitch/usb-modeswitch-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-96vTN3hKnRvTnLilh1GK/28qQ9kWFF6v2Asbi3FG22Y=";
   };
 
-  patches = [
-    ./configurable-usb-modeswitch.patch
-    ./pkg-config.patch
-  ];
+  patches = [ ./pkg-config.patch ];
 
   # Remove attempts to write to /etc and /var/lib.
   postPatch = ''
@@ -57,6 +54,7 @@ stdenv.mkDerivation rec {
     libusb1
     tcl
   ];
+
   nativeBuildInputs = [
     pkg-config
     makeWrapper
@@ -72,4 +70,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     mainProgram = "usb_modeswitch";
   };
-}
+})
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 5d8d5dea14f3..1a56818da207 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.25.3";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aWVAikQeAxt+Ej1QPhkW9x4zi4S/v+U2XaMYMfRhL8Y=";
+    hash = "sha256-Com3Q6/xPM6fDW0rNP8QQpn8A/bUSC7cLs3xwRiTGDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index c48ec8265167..523b9683c006 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -21,6 +21,8 @@ rustPlatform.buildRustPackage (
       patches = [ ./web-ui-package-json.patch ];
 
       npmDepsHash = "sha256-jgsNF93DkEVgPGzdi192HKoSHPYhdrtog28jZvOLK6E=";
+      # Fix peer dependency conflicts with ESLint 9.
+      npmFlags = [ "--legacy-peer-deps" ];
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
diff --git a/pkgs/by-name/wi/wireguard-go/package.nix b/pkgs/by-name/wi/wireguard-go/package.nix
index 11ce83bcc317..438aacec0e10 100644
--- a/pkgs/by-name/wi/wireguard-go/package.nix
+++ b/pkgs/by-name/wi/wireguard-go/package.nix
@@ -1,70 +1,62 @@
 {
   lib,
   buildGoModule,
-  fetchzip,
-  testers,
-  wireguard-go,
+  fetchgit,
+  versionCheckHook,
 }:
 
-buildGoModule (
-  finalAttrs:
-  let
-    version = "0.0.20250522";
-  in
-  {
-    pname = "wireguard-go";
-    inherit version;
+buildGoModule (finalAttrs: {
+  pname = "wireguard-go";
+  version = "0.0.20250522";
 
-    src = fetchzip {
-      url = "https://git.zx2c4.com/wireguard-go/snapshot/wireguard-go-${version}.tar.xz";
-      hash = "sha256-GRr8NKKb4SHd0WxmNL84eiofFHcauDDmSyNNrXermcA=";
-    };
+  src = fetchgit {
+    url = "https://git.zx2c4.com/wireguard-go";
+    tag = finalAttrs.version;
+    hash = "sha256-GRr8NKKb4SHd0WxmNL84eiofFHcauDDmSyNNrXermcA=";
+  };
 
-    postPatch = ''
-      # Skip formatting tests
-      rm -f format_test.go
-    '';
+  postPatch = ''
+    # Skip formatting tests
+    rm -f format_test.go
+  '';
 
-    vendorHash = "sha256-sCajxTV26jjlmgmbV4GG6hg9NkLGS773ZbFyKucvuBE=";
+  vendorHash = "sha256-sCajxTV26jjlmgmbV4GG6hg9NkLGS773ZbFyKucvuBE=";
 
-    subPackages = [ "." ];
+  subPackages = [ "." ];
 
-    ldflags = [ "-s" ];
+  ldflags = [ "-s" ];
 
-    # No tests besides the formatting one are in root.
-    # We can't override subPackages per-phase (and we don't
-    # want to needlessly build packages that have build
-    # constraints), so just use the upstream Makefile (that
-    # runs `go test ./...`) to actually run the tests.
-    checkPhase = ''
-      runHook preCheck
-      export GOFLAGS=''${GOFLAGS//-trimpath/}
-      make test
-      runHook postCheck
-    '';
+  # No tests besides the formatting one are in root.
+  # We can't override subPackages per-phase (and we don't
+  # want to needlessly build packages that have build
+  # constraints), so just use the upstream Makefile (that
+  # runs `go test ./...`) to actually run the tests.
+  checkPhase = ''
+    runHook preCheck
+    export GOFLAGS=''${GOFLAGS//-trimpath/}
+    make test
+    runHook postCheck
+  '';
 
-    # Tests require networking.
-    __darwinAllowLocalNetworking = finalAttrs.doCheck;
+  # Tests require networking.
+  __darwinAllowLocalNetworking = finalAttrs.doCheck;
 
-    postInstall = ''
-      mv $out/bin/wireguard $out/bin/wireguard-go
-    '';
+  postInstall = ''
+    mv $out/bin/wireguard $out/bin/wireguard-go
+  '';
 
-    passthru.tests.version = testers.testVersion {
-      package = wireguard-go;
-      version = "v${version}";
-    };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
-    meta = {
-      description = "Userspace Go implementation of WireGuard";
-      homepage = "https://git.zx2c4.com/wireguard-go/about/";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [
-        kirelagin
-        winter
-        zx2c4
-      ];
-      mainProgram = "wireguard-go";
-    };
-  }
-)
+  meta = {
+    description = "Userspace Go implementation of WireGuard";
+    homepage = "https://git.zx2c4.com/wireguard-go/about/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      kirelagin
+      winter
+      zx2c4
+    ];
+    mainProgram = "wireguard-go";
+  };
+})
diff --git a/pkgs/by-name/ya/yaak/package.nix b/pkgs/by-name/ya/yaak/package.nix
index ccca382348cd..8f0795275211 100644
--- a/pkgs/by-name/ya/yaak/package.nix
+++ b/pkgs/by-name/ya/yaak/package.nix
@@ -15,6 +15,9 @@
   pango,
   cairo,
   pixman,
+  librsvg,
+  gdk-pixbuf,
+  adwaita-icon-theme,
   protobuf,
   perl,
   makeWrapper,
@@ -23,6 +26,7 @@
   lld,
   wasm-pack,
   wasm-bindgen-cli_0_2_100,
+  wrapGAppsHook3,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -57,6 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     lld
     wasm-pack
     wasm-bindgen-cli_0_2_100
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -66,6 +71,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pango
     cairo
     pixman
+    librsvg
+    gdk-pixbuf
+    adwaita-icon-theme
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     webkitgtk_4_1
@@ -76,11 +84,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env.NPM_CONFIG_IGNORE_SCRIPTS = "true";
 
   postPatch = ''
+    substituteInPlace package.json \
+      --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"'
+
     substituteInPlace src-tauri/tauri.conf.json \
       --replace-fail '"0.0.0"' '"${finalAttrs.version}"'
+
     substituteInPlace src-tauri/tauri.commercial.conf.json \
       --replace-fail '"createUpdaterArtifacts": "v1Compatible"' '"createUpdaterArtifacts": false' \
       --replace-fail '"https://update.yaak.app/check/{{target}}/{{arch}}/{{current_version}}"' '"https://non.existent.domain"'
+
     substituteInPlace package.json \
       --replace-fail '"bootstrap:vendor-node": "node scripts/vendor-node.cjs",' "" \
       --replace-fail '"bootstrap:vendor-protoc": "node scripts/vendor-protoc.cjs",' ""
@@ -128,7 +141,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/yaak-app \
       --inherit-argv0 \
-      --set-default WEBKIT_DISABLE_DMABUF_RENDERER 1
+      --set-default WEBKIT_DISABLE_DMABUF_RENDERER 1 \
+      --set-default WEBKIT_DISABLE_COMPOSITING_MODE 1
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/zv/zvm/package.nix b/pkgs/by-name/zv/zvm/package.nix
index 6526e447c6f5..7e7a3411e651 100644
--- a/pkgs/by-name/zv/zvm/package.nix
+++ b/pkgs/by-name/zv/zvm/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "zvm";
-  version = "0.8.10";
+  version = "0.8.11";
 
   src = fetchFromGitHub {
     owner = "tristanisham";
     repo = "zvm";
     tag = "v${version}";
-    hash = "sha256-n6V6fMfE7yBSta+RLkQbTFjQUOs4VuonEu6ecWQIFUc=";
+    hash = "sha256-RMXF69zqqNK3tifbeDM7dxkiHMws7n+PeeHvCUK7/OU=";
   };
 
-  vendorHash = "sha256-yk1n0mW4WIKHTg9xgr+1IKbUpZWIaBaYrA6FwNBjVKc=";
+  vendorHash = "sha256-dM9FiUucSBkk8L93HfzoHQ1EyyRmAZjfedvOyRBDFBA=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/development/python-modules/agate/default.nix b/pkgs/development/python-modules/agate/default.nix
index c7c87ef1fe68..34659ff19f3e 100644
--- a/pkgs/development/python-modules/agate/default.nix
+++ b/pkgs/development/python-modules/agate/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   babel,
   buildPythonPackage,
   cssselect,
@@ -22,8 +23,6 @@ buildPythonPackage rec {
   version = "1.14.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "wireservice";
     repo = "agate";
@@ -50,6 +49,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # Output is slightly different on macOS
+    "test_cast_format_locale"
+  ];
+
   pythonImportsCheck = [ "agate" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/aiobtclientrpc/default.nix b/pkgs/development/python-modules/aiobtclientrpc/default.nix
index 05cfda87cad4..928647d5d5d3 100644
--- a/pkgs/development/python-modules/aiobtclientrpc/default.nix
+++ b/pkgs/development/python-modules/aiobtclientrpc/default.nix
@@ -12,6 +12,7 @@
   python-socks,
   rencode,
   setuptools,
+  fetchpatch,
 }:
 
 buildPythonPackage rec {
@@ -27,6 +28,14 @@ buildPythonPackage rec {
     hash = "sha256-2nBrIMlYUI4PwirkiSJSkw5zw2Kc/KoVRyIIYYx4iYs=";
   };
 
+  patches = [
+    # compatibility with python3.14: fix retrival of non-running event loop
+    (fetchpatch {
+      url = "https://codeberg.org/plotski/aiobtclientrpc/commit/1328e281d28f17c9b2c092539b4ab7402f1082b3.patch";
+      hash = "sha256-ixHyG/w2h7tkaVYxmvpInfNW4AxVTn4Bflztzt1TOwM=";
+    })
+  ];
+
   pythonRelaxDeps = [ "async-timeout" ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cryptodatahub/default.nix b/pkgs/development/python-modules/cryptodatahub/default.nix
index b608ee7688f8..8e74f6ca8574 100644
--- a/pkgs/development/python-modules/cryptodatahub/default.nix
+++ b/pkgs/development/python-modules/cryptodatahub/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "cryptodatahub";
-  version = "1.0.0";
+  version = "1.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitLab {
     owner = "coroner";
     repo = "cryptodatahub";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-taYpSYkfucc9GQpVDiAZgCt/D3Akld20LkFEhsdKH0Q=";
+    tag = "v${version}";
+    hash = "sha256-DQspaa9GsnRjETKUca2i91iBPbT4qATmKiL8M0nBP/A=";
   };
 
   build-system = [
@@ -51,7 +51,6 @@ buildPythonPackage rec {
   preCheck = ''
     # failing tests
     rm test/updaters/test_common.py
-    rm test/common/test_key.py
     # Tests require network access
     rm test/common/test_utils.py
   '';
@@ -59,8 +58,8 @@ buildPythonPackage rec {
   meta = {
     description = "Repository of cryptography-related data";
     homepage = "https://gitlab.com/coroner/cryptodatahub";
-    changelog = "https://gitlab.com/coroner/cryptodatahub/-/blob/${version}/CHANGELOG.rst";
+    changelog = "https://gitlab.com/coroner/cryptodatahub/-/blob/${src.tag}/CHANGELOG.rst";
     license = lib.licenses.mpl20;
-    maintainers = [ ];
+    teams = with lib.teams; [ ngi ];
   };
 }
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index aaccb336fa97..f676a9b0b979 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -1,19 +1,38 @@
 {
+  stdenv,
   lib,
+  nodejs,
   buildNpmPackage,
   buildPythonPackage,
+  runCommand,
   fetchFromGitHub,
+  fetchPypi,
   flit-core,
   accessible-pygments,
   beautifulsoup4,
   pygments,
   sphinx,
   sphinx-basic-ng,
+  unzip,
 }:
 
 let
   pname = "furo";
   version = "2025.07.19";
+  # version on pypi doesn't have month & day padded with 0
+  pypiVersion =
+    let
+      versionComponents = lib.strings.splitString "." version;
+      dropLeadingZero = lib.strings.removePrefix "0";
+    in
+    # year
+    (lib.lists.elemAt versionComponents 0)
+    + "."
+    # month
+    + (dropLeadingZero (lib.lists.elemAt versionComponents 1))
+    + "."
+    # day
+    + (dropLeadingZero (lib.lists.elemAt versionComponents 2));
 
   src = fetchFromGitHub {
     owner = "pradyunsg";
@@ -22,7 +41,28 @@ let
     hash = "sha256-pIF5zrh5YbkuSkrateEB/tDULSNbeVn2Qx+Fm3nOYGE=";
   };
 
-  web = buildNpmPackage {
+  web-bin =
+    let
+      web-bin-src = fetchPypi {
+        inherit pname;
+        version = pypiVersion;
+        format = "wheel";
+        dist = "py3";
+        python = "py3";
+        hash = "sha256-veqGmCLf0rSU6oTAlzk3410Vda8Ii2chopx/eHityeM=";
+      };
+    in
+    runCommand "${pname}-web-bin"
+      {
+        nativeBuildInputs = [ unzip ];
+      }
+      ''
+        mkdir $out
+        unzip ${web-bin-src}
+        cp -rv furo/theme/furo/static/{scripts,styles} $out/
+      '';
+
+  web-native = buildNpmPackage {
     pname = "${pname}-web";
     inherit version src;
 
@@ -35,6 +75,8 @@ let
       popd
     '';
   };
+
+  web = if (lib.meta.availableOn stdenv.buildPlatform nodejs) then web-native else web-bin;
 in
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/marshmallow/default.nix b/pkgs/development/python-modules/marshmallow/default.nix
index a5aa9ee8713d..2b3d7b7deee8 100644
--- a/pkgs/development/python-modules/marshmallow/default.nix
+++ b/pkgs/development/python-modules/marshmallow/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "marshmallow";
-  version = "4.1.0";
+  version = "4.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "marshmallow-code";
     repo = "marshmallow";
     tag = version;
-    hash = "sha256-h1wkeJbJY/0K3Vpxz+Bc2/2PDWgOMqropG0XMBzAOq8=";
+    hash = "sha256-qEjq1tEWoYqlN7L/cECnpFGPinSdZXexJHZfXreLAZc=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/tmdbsimple/default.nix b/pkgs/development/python-modules/tmdbsimple/default.nix
index d629e66ac1ce..97fd4e3a9982 100644
--- a/pkgs/development/python-modules/tmdbsimple/default.nix
+++ b/pkgs/development/python-modules/tmdbsimple/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   setuptools,
   requests,
+  unstableGitUpdater,
 }:
 
 buildPythonPackage {
@@ -27,6 +28,8 @@ buildPythonPackage {
   # The tests require an internet connection and an API key
   doCheck = false;
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     description = "Wrapper for The Movie Database API v3";
     homepage = "https://github.com/celiao/tmdbsimple";
diff --git a/pkgs/development/python-modules/unstructured-inference/default.nix b/pkgs/development/python-modules/unstructured-inference/default.nix
index 468cae7e1765..443d93f4a95c 100644
--- a/pkgs/development/python-modules/unstructured-inference/default.nix
+++ b/pkgs/development/python-modules/unstructured-inference/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "unstructured-inference";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-inference";
     tag = version;
-    hash = "sha256-/vWyywsnNzkwcl2L5BcS6qqaCk2LPxaNlCPeMnDIHPU=";
+    hash = "sha256-2yLBP2FNEn3tQV63qtlpz6mMjE4rsDr3JItYnpIU3iM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index 91f532c77744..25212f3f17b2 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -6,13 +6,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "25.12.0";
+  version = "26.01.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-DN2QUxCVVjYn7b4xt/7+k5g1/7dfZ+cp5Yi0nJWh1mM=";
+    hash = "sha256-3PjKFARsN3BE5c3/JonNj+LpKBPT1N3hc1bK6NdWDTQ=";
   };
 
   postInstall = ''
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 3d103f6e1a61..e45cb91e0939 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -23,7 +23,7 @@ let
   # NOTE: when updating this to a new non-patch version, please also try to
   # update the plugins. Plugins only work if they are compiled for the same
   # major/minor version.
-  version = "0.108.0";
+  version = "0.109.1";
 in
 rustPlatform.buildRustPackage {
   pname = "nushell";
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage {
     owner = "nushell";
     repo = "nushell";
     tag = version;
-    hash = "sha256-8OMTscMObV+IOSgOoTSzJvZTz6q/l2AjrOb9y3p2tZY=";
+    hash = "sha256-XNDEfmvmUNS90PU4e/EWFyJeg428R8nFPJHpF3tgRWo=";
   };
 
-  cargoHash = "sha256-M2wkhhaS3bVhwaa3O0CUK5hL757qFObr7EDtBFXXwxg=";
+  cargoHash = "sha256-UX0WmvrzrWlrTnvMqaWAxoSie7RzQSC4thEb26LAz+A=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index e370b1cb11f8..ddb0914dbe84 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -4,14 +4,15 @@
   fetchurl,
   ed,
   autoreconfHook,
+  testers,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "patch";
   version = "2.8";
 
   src = fetchurl {
-    url = "mirror://gnu/patch/patch-${version}.tar.xz";
+    url = "mirror://gnu/patch/patch-${finalAttrs.version}.tar.xz";
     hash = "sha256-+Hzuae7CtPy/YKOWsDCtaqNBXxkqpffuhMrV4R9/WuM=";
   };
 
@@ -32,18 +33,14 @@ stdenv.mkDerivation rec {
   meta = {
     description = "GNU Patch, a program to apply differences to files";
     mainProgram = "patch";
-
     longDescription = ''
       GNU Patch takes a patch file containing a difference listing
       produced by the diff program and applies those differences to one or
       more original files, producing patched versions.
     '';
-
     homepage = "https://savannah.gnu.org/projects/patch";
-
     license = lib.licenses.gpl3Plus;
-
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ mdaniels5757 ];
     platforms = lib.platforms.all;
   };
-}
+})