diff --git a/flake.nix b/flake.nix
index 1bac7569d3ea..beced0fef048 100644
--- a/flake.nix
+++ b/flake.nix
@@ -116,6 +116,10 @@
               && !self.legacyPackages.${system}.stdenv.targetPlatform.isPower64
               # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
               && system != "armv6l-linux"
+              # Exclude armv7l-linux because "cannot bootstrap GHC on this platform ('armv7l-linux' with libc 'defaultLibc')"
+              && system != "armv7l-linux"
+              # Exclude powerpc64le-linux because "cannot bootstrap GHC on this platform ('powerpc64le-linux' with libc 'defaultLibc')"
+              && system != "powerpc64le-linux"
               # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
               && system != "riscv64-linux"
             )
@@ -165,6 +169,10 @@
             (
               # Exclude armv6l-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
               system != "armv6l-linux"
+              # Exclude armv7l-linux because "cannot bootstrap GHC on this platform ('armv7l-linux' with libc 'defaultLibc')"
+              && system != "armv7l-linux"
+              # Exclude powerpc64le-linux because "cannot bootstrap GHC on this platform ('powerpc64le-linux' with libc 'defaultLibc')"
+              && system != "powerpc64le-linux"
               # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
               && system != "riscv64-linux"
               # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
@@ -182,6 +190,10 @@
         system: _:
         # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
         system != "armv6l-linux"
+        # Exclude armv7l-linux because "cannot bootstrap GHC on this platform ('armv7l-linux' with libc 'defaultLibc')"
+        && system != "armv7l-linux"
+        # Exclude powerpc64le-linux because "cannot bootstrap GHC on this platform ('powerpc64le-linux' with libc 'defaultLibc')"
+        && system != "powerpc64le-linux"
         # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
         && system != "riscv64-linux"
         # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 19faf1fdd9d8..b79a3170eddf 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15729,7 +15729,7 @@
     github = "M0streng0";
     githubId = 85799811;
   };
-  m0ustache3 = {
+  M0ustach3 = {
     name = "M0ustach3";
     github = "M0ustach3";
     githubId = 37956764;
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 4e107833f6f9..dcb05e349197 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -20,6 +20,9 @@ let
       rhs = optCall rhs_ { inherit lib pkgs; };
     in
     lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
     // lib.optionalAttrs (lhs ? packageOverrides) {
       packageOverrides =
         pkgs:
diff --git a/nixos/modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix b/nixos/modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix
new file mode 100644
index 000000000000..201a43314fbf
--- /dev/null
+++ b/nixos/modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix
@@ -0,0 +1,124 @@
+# Test for allowUnfreePackages merging across multiple modules
+# Run with: nix-build -A nixosTests.nixpkgs-config-allow-unfree --show-trace
+
+{
+  evalMinimalConfig,
+  lib,
+}:
+let
+  eval =
+    modules:
+    evalMinimalConfig {
+      imports = [
+        ../nixpkgs.nix
+      ]
+      ++ modules;
+    };
+
+  getConfig = evalResult: evalResult.config.nixpkgs.config;
+
+  sortList = list: builtins.sort builtins.lessThan list;
+
+  assertEquals =
+    expected: actual:
+    let
+      prettyExpected = lib.generators.toPretty { } expected;
+      prettyActual = lib.generators.toPretty { } actual;
+    in
+    lib.assertMsg (expected == actual) "Expected ${prettyExpected} but got ${prettyActual}";
+
+  assertUnfreePackages =
+    listOfModules: expectedPackages:
+    let
+      config = getConfig (eval listOfModules);
+      actualAllowedUnfreePackages = sortList config.allowUnfreePackages;
+    in
+    assertEquals expectedPackages actualAllowedUnfreePackages;
+in
+lib.recurseIntoAttrs {
+
+  singleModuleTest =
+    assertUnfreePackages
+      [
+        {
+          nixpkgs.config.allowUnfreePackages = [
+            "package1"
+            "package2"
+          ];
+        }
+      ]
+      [
+        "package1"
+        "package2"
+      ];
+
+  multipleModulesMerging =
+    assertUnfreePackages
+      [
+        {
+          _file = "module1.nix";
+          nixpkgs.config.allowUnfreePackages = [
+            "package1"
+            "package2"
+          ];
+        }
+        {
+          _file = "module2.nix";
+          nixpkgs.config.allowUnfreePackages = [
+            "package3"
+            "package4"
+          ];
+        }
+        {
+          _file = "module3.nix";
+          nixpkgs.config.allowUnfreePackages = [ "package5" ];
+        }
+      ]
+      [
+        "package1"
+        "package2"
+        "package3"
+        "package4"
+        "package5"
+      ];
+
+  overlappingPackagesMerging =
+    assertUnfreePackages
+      [
+        {
+          _file = "moduleA.nix";
+          nixpkgs.config.allowUnfreePackages = [
+            "shared-package"
+            "unique-a"
+          ];
+        }
+        {
+          _file = "moduleB.nix";
+          nixpkgs.config.allowUnfreePackages = [
+            "shared-package"
+            "unique-b"
+          ];
+        }
+      ]
+      [
+        "shared-package"
+        "shared-package"
+        "unique-a"
+        "unique-b"
+      ];
+
+  emptyListMerging =
+    assertUnfreePackages
+      [
+        {
+          _file = "empty.nix";
+          nixpkgs.config.allowUnfreePackages = [ ];
+        }
+        {
+          _file = "non-empty.nix";
+          nixpkgs.config.allowUnfreePackages = [ "some-package" ];
+        }
+      ]
+      [ "some-package" ];
+
+}
diff --git a/nixos/modules/programs/dsearch.nix b/nixos/modules/programs/dsearch.nix
index a719631312be..f1597189fa38 100644
--- a/nixos/modules/programs/dsearch.nix
+++ b/nixos/modules/programs/dsearch.nix
@@ -49,5 +49,5 @@ in
     systemd.user.services.dsearch.wantedBy = mkIf cfg.systemd.enable [ cfg.systemd.target ];
   };
 
-  meta.maintainers = lib.teams.danklinux.maintainers;
+  meta.maintainers = lib.teams.danklinux.members;
 }
diff --git a/nixos/modules/programs/wayland/dms-shell.nix b/nixos/modules/programs/wayland/dms-shell.nix
index 233590bcf3ec..53f84c1a41b1 100644
--- a/nixos/modules/programs/wayland/dms-shell.nix
+++ b/nixos/modules/programs/wayland/dms-shell.nix
@@ -226,5 +226,5 @@ in
     hardware.graphics.enable = lib.mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.maintainers;
+  meta.maintainers = lib.teams.danklinux.members;
 }
diff --git a/nixos/modules/services/display-managers/dms-greeter.nix b/nixos/modules/services/display-managers/dms-greeter.nix
index 246a02ea414f..94b79bd19a5f 100644
--- a/nixos/modules/services/display-managers/dms-greeter.nix
+++ b/nixos/modules/services/display-managers/dms-greeter.nix
@@ -294,5 +294,5 @@ in
     services.libinput.enable = mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.maintainers;
+  meta.maintainers = lib.teams.danklinux.members;
 }
diff --git a/nixos/modules/services/misc/memos.nix b/nixos/modules/services/misc/memos.nix
index 5847e90c9c06..5e74931c579f 100644
--- a/nixos/modules/services/misc/memos.nix
+++ b/nixos/modules/services/misc/memos.nix
@@ -195,5 +195,5 @@ in
     };
   };
 
-  meta.maintainers = [ lib.maintainers.m0ustach3 ];
+  meta.maintainers = [ lib.maintainers.M0ustach3 ];
 }
diff --git a/nixos/modules/services/security/crowdsec.nix b/nixos/modules/services/security/crowdsec.nix
index 003ed7595fb8..7d89659f5dd1 100644
--- a/nixos/modules/services/security/crowdsec.nix
+++ b/nixos/modules/services/security/crowdsec.nix
@@ -983,7 +983,7 @@ in
 
   meta = {
     maintainers = with lib.maintainers; [
-      m0ustach3
+      M0ustach3
       tornax
       jk
     ];
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index bd095ce0b408..cb9f5509c102 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -30,7 +30,7 @@ let
       xf86-video-intel
       xf86-video-mga
       xf86-video-neomagic
-      xf86_video_nested
+      xf86-video-nested
       xf86-video-nouveau
       xf86-video-nv
       xf86-video-omap
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index da285ba3e7d0..ee1c593430c6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1115,6 +1115,13 @@ in
     imports = [ ./nixos-rebuild-target-host.nix ];
   };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
+  nixpkgs-config-allow-unfree =
+    pkgs.callPackage ../modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix
+      { inherit evalMinimalConfig; };
+  nixpkgs-config-allow-unfree-packages-and-predicate =
+    pkgs.callPackage ../../pkgs/stdenv/generic/check-meta-test.nix
+      { };
+  nixseparatedebuginfod = runTest ./nixseparatedebuginfod.nix;
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
   node-red = runTest ./node-red.nix;
   nohang = runTest ./nohang.nix;
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 49feef8bd9e6..5374661cb4cf 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1171,38 +1171,64 @@ let
         exporterTest = ''
           wait_for_unit("prometheus-node-cert-exporter.service")
           wait_for_open_port(9141)
+          succeed("test -f /run/certs/node-cert.cert")
           wait_until_succeeds(
               "curl -sSf http://localhost:9141/metrics | grep 'ssl_certificate_expiry_seconds{.\\+path=\"/run/certs/node-cert\\.cert\".\\+}'"
           )
         '';
 
-        metricProvider = {
-          system.activationScripts.cert.text = ''
-            mkdir -p /run/certs
-            cd /run/certs
+        metricProvider =
+          { config, ... }:
+          {
+            systemd.services.prometheus-node-cert-exporter = {
+              serviceConfig.ExecStartPre =
+                let
+                  createDir = pkgs.writeShellApplication {
+                    name = "create-dir";
+                    text =
+                      let
+                        inherit (config.services.prometheus.exporters.node-cert) user;
+                      in
+                      ''
+                        mkdir -p /run/certs
+                        chown ${user}:${user} /run/certs
+                        chmod ug+rwx /run/certs
+                      '';
+                  };
+                  createCerts = pkgs.writeShellApplication {
+                    name = "create-certs";
+                    text = ''
+                      cd /run/certs
 
-            cat >ca.template <<EOF
-            organization = "prometheus-node-cert-exporter"
-            cn = "prometheus-node-cert-exporter"
-            expiration_days = 365
-            ca
-            cert_signing_key
-            crl_signing_key
-            EOF
+                      cat >ca.template <<EOF
+                      organization = "prometheus-node-cert-exporter"
+                      cn = "prometheus-node-cert-exporter"
+                      expiration_days = 365
+                      ca
+                      cert_signing_key
+                      crl_signing_key
+                      EOF
 
-            ${pkgs.gnutls}/bin/certtool  \
-              --generate-privkey         \
-              --key-type rsa             \
-              --sec-param High           \
-              --outfile node-cert.key
+                      ${pkgs.gnutls}/bin/certtool  \
+                        --generate-privkey         \
+                        --key-type rsa             \
+                        --sec-param High           \
+                        --outfile node-cert.key
 
-            ${pkgs.gnutls}/bin/certtool     \
-              --generate-self-signed        \
-              --load-privkey node-cert.key  \
-              --template ca.template        \
-              --outfile node-cert.cert
-          '';
-        };
+                      ${pkgs.gnutls}/bin/certtool     \
+                        --generate-self-signed        \
+                        --load-privkey node-cert.key  \
+                        --template ca.template        \
+                        --outfile node-cert.cert
+                    '';
+                  };
+                in
+                [
+                  "+${lib.getExe createDir}"
+                  "${lib.getExe createCerts}"
+                ];
+            };
+          };
       };
 
     pgbouncer =
diff --git a/pkgs/applications/graphics/inkscape/extensions/inkstitch/default.nix b/pkgs/applications/graphics/inkscape/extensions/inkstitch/default.nix
index be267ad83b7c..7ad563339584 100644
--- a/pkgs/applications/graphics/inkscape/extensions/inkstitch/default.nix
+++ b/pkgs/applications/graphics/inkscape/extensions/inkstitch/default.nix
@@ -2,37 +2,17 @@
   lib,
   python3,
   fetchFromGitHub,
-  fetchFromGitLab,
+  fetchpatch,
   gettext,
 }:
 let
-  # on update check compatibility to nixpkgs inkex
   version = "3.2.2";
 
-  # remove and use nixpkgs version is recent enough
-  inkex' = python3.pkgs.inkex.overrideAttrs (old: rec {
-    # this is no special commit, just the most recent as of writing
-    version = "3150a5b3b06f7e4c2104d9e8eb6dc448982bb2b0";
-    src = fetchFromGitLab {
-      owner = "inkscape";
-      repo = "extensions";
-      rev = "${version}";
-      hash = "sha256-FYBZ66ERC3nVYCaAmFPqKnBxDOKAoQwT14C0fKLn10c=";
-    };
-
-    postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace-fail 'scour = "^0.37"' 'scour = ">=0.37"'
-    '';
-  });
-
   dependencies =
     with python3.pkgs;
     [
       pyembroidery
-      # inkex upstream release & nixpkgs is too old
-      # use nixpkgs inkex once up to date
-      inkex'
+      inkex
       wxpython
       networkx
       platformdirs
@@ -94,6 +74,13 @@ python3.pkgs.buildPythonApplication {
     ./0002-plugin-invocation-use-python-script-as-entrypoint.patch
     ./0003-lazy-load-module-to-access-global_settings.patch
     ./0004-enable-force-insertion-of-python-path.patch
+
+    # Fix compatibility with inkex 1.4
+    # https://github.com/inkstitch/inkstitch/pull/3825
+    (fetchpatch {
+      url = "https://github.com/inkstitch/inkstitch/commit/454b5ee1a00e9d4b96f5f057a8611da68a6cc796.patch";
+      hash = "sha256-nAs1rAr3lvN5Qwhj0I+7puM3R2X1NoHpB0ltvlwHDXA=";
+    })
   ];
 
   doCheck = false;
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index d72793a21015..7e0984150dc0 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "148.0b3";
+  version = "148.0b6";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "4a005fa884dd7728016c92ad2f7019bbbb5abcedfcedd916c9e0b8e9bae5566f855e79a5c9bf533b0f7c324b6a298113a20afdb65b19ccbf323c9bcce01266c7";
+    sha512 = "a8dfcff028d28d63dc635f9cda8e2dcf2f6b55363ac4e1686561c77aff56216d3f897b1d3686bf32f388eed4e1df146d3795a55eb2a696523dc7c176bb63cd07";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index d7df8b9e428d..44f0afe16557 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "148.0b3";
+  version = "148.0b4";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e9853be515265b7738d87b4aa030a54758b5d3357c2204ab6a883d0bcdaf71b887bb03c79f5746866f1edd79de2cec5d7edc9898f48e49dae7c50e2934bff530";
+    sha512 = "951da65733ab4226839cf23fa0f667d8bcdeeb8c2e729b6395d7ee39b10263a4409380eebde132156f8acc56ab5b4bf96eed1991a31820037b57214a1d22e520";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/by-name/ae/aegisub/package.nix b/pkgs/by-name/ae/aegisub/package.nix
index 5571e8051691..2f6110a33b19 100644
--- a/pkgs/by-name/ae/aegisub/package.nix
+++ b/pkgs/by-name/ae/aegisub/package.nix
@@ -39,6 +39,10 @@
   useBundledLuaJIT ? false,
 }:
 
+let
+  luajit' = luajit.override { enable52Compat = true; };
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "aegisub";
   version = "3.4.2";
@@ -82,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals portaudioSupport [ portaudio ]
   ++ lib.optionals pulseaudioSupport [ libpulseaudio ]
   ++ lib.optionals spellcheckSupport [ hunspell ]
-  ++ lib.optionals (!useBundledLuaJIT) [ luajit ];
+  ++ lib.optionals (!useBundledLuaJIT) [ luajit' ];
 
   mesonFlags = [
     (lib.mesonEnable "alsa" alsaSupport)
diff --git a/pkgs/by-name/br/brainflow/package.nix b/pkgs/by-name/br/brainflow/package.nix
index 85e799bb6d0a..811748e10e8f 100644
--- a/pkgs/by-name/br/brainflow/package.nix
+++ b/pkgs/by-name/br/brainflow/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.20.0";
+  version = "5.20.1";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-qxITJjO6Rf9cx4XWRguOlohud8gnMSQDb/qgwv3wA+8=";
+    hash = "sha256-eQgjEFYEuJXLNB+qeWLeN3ZRmq1lR5qpcFcPgHn8Az8=";
   };
 
   patches = [ ];
diff --git a/pkgs/by-name/cg/cgal/package.nix b/pkgs/by-name/cg/cgal/package.nix
index f25ddd927790..9c7be9d86df0 100644
--- a/pkgs/by-name/cg/cgal/package.nix
+++ b/pkgs/by-name/cg/cgal/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cgal";
-  version = "6.1";
+  version = "6.1.1";
 
   src = fetchurl {
     url = "https://github.com/CGAL/cgal/releases/download/v${finalAttrs.version}/CGAL-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-YY2oqLP1vka08KR6Hvs8nmwD1qqw9VMdVtNV0ycB158=";
+    sha256 = "sha256-UlBpNfcOJH7Sd348ZfIOhveSCMKi0OGArnR12vEclu8=";
   };
 
   patches = [ ./cgal_path.patch ];
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index 1165899352d9..5feee2664fa6 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -37,14 +37,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.497";
+  version = "3.2.499";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-aovAkxEqNYkYczbUvf/Ei2FJVSstk8XdHWnzAq2ydUw=";
+    hash = "sha256-1jb+ot8m7MS+BvXL7QakBHoViEmk+eORVmlmBJDfAtM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/da/darktable/package.nix b/pkgs/by-name/da/darktable/package.nix
index ec270b04428b..ce87ec77391a 100644
--- a/pkgs/by-name/da/darktable/package.nix
+++ b/pkgs/by-name/da/darktable/package.nix
@@ -53,7 +53,7 @@
   libtiff,
   libwebp,
   libxml2,
-  lua,
+  lua5_4,
   util-linux,
   openexr,
   openjpeg,
@@ -78,7 +78,9 @@
   versionCheckHook,
   gitUpdater,
 }:
-
+let
+  pugixml-shared = pugixml.override { shared = true; };
+in
 stdenv.mkDerivation rec {
   version = "5.4.0";
   pname = "darktable";
@@ -138,13 +140,13 @@ stdenv.mkDerivation rec {
     libtiff
     libwebp
     libxml2
-    lua
+    lua5_4
     openexr
     openjpeg
     osm-gps-map
     pcre2
     portmidi
-    pugixml
+    pugixml-shared
     sqlite
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/di/dialog/package.nix b/pkgs/by-name/di/dialog/package.nix
index 04c7f1936a41..c7568e76d06d 100644
--- a/pkgs/by-name/di/dialog/package.nix
+++ b/pkgs/by-name/di/dialog/package.nix
@@ -12,11 +12,11 @@
 assert unicodeSupport -> ncurses.unicodeSupport;
 stdenv.mkDerivation (finalAttrs: {
   pname = "dialog";
-  version = "1.3-20231002";
+  version = "1.3-20260107";
 
   src = fetchurl {
     url = "https://invisible-island.net/archives/dialog/dialog-${finalAttrs.version}.tgz";
-    hash = "sha256-MVZAqwcZIl1cvKsTBYXAXweR/PBzBypf6UeZaaorgzs=";
+    hash = "sha256-eLPdGNleUPC+j5ucHnz/4oyb8c3yDVs+8XJ5xNo1xbU=";
   };
 
   nativeBuildInputs = lib.optionals withLibrary [
diff --git a/pkgs/by-name/fr/fresh-editor/package.nix b/pkgs/by-name/fr/fresh-editor/package.nix
index 641a86727d6f..7edfe42ae493 100644
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.1.88";
+  version = "0.1.90";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aGGLqtvJ/kaGZtbpzLUQ40wPMp+g8+WCxXk9t+fQR7M=";
+    hash = "sha256-ZJ6T1LUeuuaGu4l5mVUNcmtId3qleP5PE4lY+fGGnaE=";
   };
 
-  cargoHash = "sha256-67XM9j3dZ+4TKVYsM4mTuKHZcxc4EcvlHjxSNRIz9y0=";
+  cargoHash = "sha256-tHuesoVUZ5OC9R662T4q0W8deXM/Gzvl0WEpHIltBOM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/kr/kryoptic/cargo-lock.patch b/pkgs/by-name/kr/kryoptic/0001-Add-Cargo.lock.patch
similarity index 82%
rename from pkgs/by-name/kr/kryoptic/cargo-lock.patch
rename to pkgs/by-name/kr/kryoptic/0001-Add-Cargo.lock.patch
index 54265aa2955d..4cfd9a099ca2 100644
--- a/pkgs/by-name/kr/kryoptic/cargo-lock.patch
+++ b/pkgs/by-name/kr/kryoptic/0001-Add-Cargo.lock.patch
@@ -1,19 +1,19 @@
-From 5386104b9b4bffa044587a9ab573c8ed24a0bab2 Mon Sep 17 00:00:00 2001
+From 9c18bc06ee221eaf53d6cf9ffc58a8dacb001e47 Mon Sep 17 00:00:00 2001
 From: Morgan Jones <me@numin.it>
-Date: Mon, 10 Nov 2025 23:25:00 -0800
+Date: Sun, 25 Jan 2026 16:48:38 -0800
 Subject: [PATCH] Add Cargo.lock
 
 ---
- Cargo.lock | 1089 ++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 1089 insertions(+)
+ Cargo.lock | 1049 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 1049 insertions(+)
  create mode 100644 Cargo.lock
 
 diff --git a/Cargo.lock b/Cargo.lock
 new file mode 100644
-index 0000000..a4a3c6e
+index 0000000..d137ab5
 --- /dev/null
 +++ b/Cargo.lock
-@@ -0,0 +1,1089 @@
+@@ -0,0 +1,1049 @@
 +# This file is automatically @generated by Cargo.
 +# It is not intended for manual editing.
 +version = 4
@@ -112,15 +112,15 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "bumpalo"
-+version = "3.19.0"
++version = "3.19.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
++checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
 +
 +[[package]]
 +name = "cc"
-+version = "1.2.45"
++version = "1.2.54"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "35900b6c8d709fb1d854671ae27aeaa9eec2f8b01b364e1619a40da3e6fe2afe"
++checksum = "6354c81bbfd62d9cfa9cb3c773c2b7b2a3a482d569de977fd0e961f6e7c00583"
 +dependencies = [
 + "find-msvc-tools",
 + "shlex",
@@ -154,9 +154,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "clap"
-+version = "4.5.51"
++version = "4.5.54"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5"
++checksum = "c6e6ff9dcd79cff5cd969a17a545d79e84ab086e444102a591e288a8aa3ce394"
 +dependencies = [
 + "clap_builder",
 + "clap_derive",
@@ -164,9 +164,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "clap_builder"
-+version = "4.5.51"
++version = "4.5.54"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a"
++checksum = "fa42cf4d2b7a41bc8f663a7cab4031ebafa1bf3875705bfaf8466dc60ab52c00"
 +dependencies = [
 + "anstyle",
 + "clap_lex",
@@ -186,9 +186,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "clap_lex"
-+version = "0.7.6"
++version = "0.7.7"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
++checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
 +
 +[[package]]
 +name = "constant_time_eq"
@@ -221,9 +221,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "data-encoding"
-+version = "2.9.0"
++version = "2.10.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
++checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
 +
 +[[package]]
 +name = "deranged"
@@ -254,34 +254,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "find-msvc-tools"
-+version = "0.1.4"
++version = "0.1.8"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127"
-+
-+[[package]]
-+name = "futures"
-+version = "0.3.31"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
-+dependencies = [
-+ "futures-channel",
-+ "futures-core",
-+ "futures-executor",
-+ "futures-io",
-+ "futures-sink",
-+ "futures-task",
-+ "futures-util",
-+]
-+
-+[[package]]
-+name = "futures-channel"
-+version = "0.3.31"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
-+dependencies = [
-+ "futures-core",
-+ "futures-sink",
-+]
++checksum = "8591b0bcc8a98a64310a2fae1bb3e9b8564dd10e381e6e28010fde8e8e8568db"
 +
 +[[package]]
 +name = "futures-core"
@@ -301,18 +276,6 @@ index 0000000..a4a3c6e
 +]
 +
 +[[package]]
-+name = "futures-io"
-+version = "0.3.31"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
-+
-+[[package]]
-+name = "futures-sink"
-+version = "0.3.31"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
-+
-+[[package]]
 +name = "futures-task"
 +version = "0.3.31"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -324,12 +287,8 @@ index 0000000..a4a3c6e
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 +dependencies = [
-+ "futures-channel",
 + "futures-core",
-+ "futures-io",
-+ "futures-sink",
 + "futures-task",
-+ "memchr",
 + "pin-project-lite",
 + "pin-utils",
 + "slab",
@@ -403,15 +362,15 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "itoa"
-+version = "1.0.15"
++version = "1.0.17"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
++checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 +
 +[[package]]
 +name = "js-sys"
-+version = "0.3.82"
++version = "0.3.85"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b011eec8cc36da2aab2d5cff675ec18454fad408585853910a202391cf9f8e65"
++checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
 +dependencies = [
 + "once_cell",
 + "wasm-bindgen",
@@ -419,7 +378,7 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "kryoptic"
-+version = "1.3.1"
++version = "1.4.0"
 +dependencies = [
 + "kryoptic-lib",
 + "ossl",
@@ -427,7 +386,7 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "kryoptic-lib"
-+version = "1.3.1"
++version = "1.4.0"
 +dependencies = [
 + "asn1",
 + "bimap",
@@ -454,7 +413,7 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "kryoptic-tools"
-+version = "1.3.1"
++version = "1.4.0"
 +dependencies = [
 + "clap",
 + "cryptoki",
@@ -468,9 +427,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "libc"
-+version = "0.2.177"
++version = "0.2.180"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
++checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 +
 +[[package]]
 +name = "libloading"
@@ -504,9 +463,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "log"
-+version = "0.4.28"
++version = "0.4.29"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
++checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 +
 +[[package]]
 +name = "memchr"
@@ -542,9 +501,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "num-conv"
-+version = "0.1.0"
++version = "0.2.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
 +
 +[[package]]
 +name = "num-integer"
@@ -572,7 +531,7 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "ossl"
-+version = "1.3.1"
++version = "1.4.0"
 +dependencies = [
 + "bindgen",
 + "cfg-if",
@@ -650,18 +609,18 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "proc-macro2"
-+version = "1.0.103"
++version = "1.0.106"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
++checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 +dependencies = [
 + "unicode-ident",
 +]
 +
 +[[package]]
 +name = "quick-xml"
-+version = "0.38.3"
++version = "0.38.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "42a232e7487fc2ef313d96dde7948e7a3c05101870d8985e4fd8d26aedd27b89"
++checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
 +dependencies = [
 + "memchr",
 + "serde",
@@ -669,9 +628,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "quote"
-+version = "1.0.42"
++version = "1.0.44"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
++checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 +dependencies = [
 + "proc-macro2",
 +]
@@ -747,12 +706,6 @@ index 0000000..a4a3c6e
 +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 +
 +[[package]]
-+name = "ryu"
-+version = "1.0.20"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-+
-+[[package]]
 +name = "scc"
 +version = "2.4.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -814,33 +767,34 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "serde_json"
-+version = "1.0.145"
++version = "1.0.149"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
++checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 +dependencies = [
 + "itoa",
 + "memchr",
-+ "ryu",
 + "serde",
 + "serde_core",
++ "zmij",
 +]
 +
 +[[package]]
 +name = "serde_spanned"
-+version = "1.0.3"
++version = "1.0.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
++checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 +dependencies = [
 + "serde_core",
 +]
 +
 +[[package]]
 +name = "serial_test"
-+version = "3.2.0"
++version = "3.3.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
++checksum = "0d0b343e184fc3b7bb44dff0705fffcf4b3756ba6aff420dddd8b24ca145e555"
 +dependencies = [
-+ "futures",
++ "futures-executor",
++ "futures-util",
 + "log",
 + "once_cell",
 + "parking_lot",
@@ -850,9 +804,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "serial_test_derive"
-+version = "3.2.0"
++version = "3.3.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
++checksum = "6f50427f258fb77356e4cd4aa0e87e2bd2c66dbcee41dc405282cae2bfc26c83"
 +dependencies = [
 + "proc-macro2",
 + "quote",
@@ -889,9 +843,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "syn"
-+version = "2.0.110"
++version = "2.0.114"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea"
++checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
 +dependencies = [
 + "proc-macro2",
 + "quote",
@@ -900,30 +854,30 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "time"
-+version = "0.3.44"
++version = "0.3.46"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
++checksum = "9da98b7d9b7dad93488a84b8248efc35352b0b2657397d4167e7ad67e5d535e5"
 +dependencies = [
 + "deranged",
 + "itoa",
 + "num-conv",
 + "powerfmt",
-+ "serde",
++ "serde_core",
 + "time-core",
 + "time-macros",
 +]
 +
 +[[package]]
 +name = "time-core"
-+version = "0.1.6"
++version = "0.1.8"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
++checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 +
 +[[package]]
 +name = "time-macros"
-+version = "0.2.24"
++version = "0.2.26"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
++checksum = "78cc610bac2dcee56805c99642447d4c5dbde4d01f752ffea0199aee1f601dc4"
 +dependencies = [
 + "num-conv",
 + "time-core",
@@ -931,9 +885,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "toml"
-+version = "0.9.8"
++version = "0.9.11+spec-1.1.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
++checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
 +dependencies = [
 + "serde_core",
 + "serde_spanned",
@@ -945,27 +899,27 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "toml_datetime"
-+version = "0.7.3"
++version = "0.7.5+spec-1.1.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
++checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 +dependencies = [
 + "serde_core",
 +]
 +
 +[[package]]
 +name = "toml_parser"
-+version = "1.0.4"
++version = "1.0.6+spec-1.1.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
++checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 +dependencies = [
 + "winnow",
 +]
 +
 +[[package]]
 +name = "toml_writer"
-+version = "1.0.4"
++version = "1.0.6+spec-1.1.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
++checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
 +
 +[[package]]
 +name = "unicode-ident"
@@ -975,9 +929,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "uuid"
-+version = "1.18.1"
++version = "1.20.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
++checksum = "ee48d38b119b0cd71fe4141b30f5ba9c7c5d9f4e7a3a8b4a674e4b6ef789976f"
 +dependencies = [
 + "getrandom",
 + "js-sys",
@@ -1008,18 +962,18 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "wasip2"
-+version = "1.0.1+wasi-0.2.4"
++version = "1.0.2+wasi-0.2.9"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
++checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
 +dependencies = [
 + "wit-bindgen",
 +]
 +
 +[[package]]
 +name = "wasm-bindgen"
-+version = "0.2.105"
++version = "0.2.108"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "da95793dfc411fbbd93f5be7715b0578ec61fe87cb1a42b12eb625caa5c5ea60"
++checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
 +dependencies = [
 + "cfg-if",
 + "once_cell",
@@ -1030,9 +984,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "wasm-bindgen-macro"
-+version = "0.2.105"
++version = "0.2.108"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "04264334509e04a7bf8690f2384ef5265f05143a4bff3889ab7a3269adab59c2"
++checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
 +dependencies = [
 + "quote",
 + "wasm-bindgen-macro-support",
@@ -1040,9 +994,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "wasm-bindgen-macro-support"
-+version = "0.2.105"
++version = "0.2.108"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "420bc339d9f322e562942d52e115d57e950d12d88983a14c79b86859ee6c7ebc"
++checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
 +dependencies = [
 + "bumpalo",
 + "proc-macro2",
@@ -1053,9 +1007,9 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "wasm-bindgen-shared"
-+version = "0.2.105"
++version = "0.2.108"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "76f218a38c84bcb33c25ec7059b07847d465ce0e0a76b995e134a45adcb6af76"
++checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
 +dependencies = [
 + "unicode-ident",
 +]
@@ -1068,30 +1022,30 @@ index 0000000..a4a3c6e
 +
 +[[package]]
 +name = "winnow"
-+version = "0.7.13"
++version = "0.7.14"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
++checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 +
 +[[package]]
 +name = "wit-bindgen"
-+version = "0.46.0"
++version = "0.51.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
++checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
 +
 +[[package]]
 +name = "zerocopy"
-+version = "0.8.27"
++version = "0.8.33"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
++checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
 +dependencies = [
 + "zerocopy-derive",
 +]
 +
 +[[package]]
 +name = "zerocopy-derive"
-+version = "0.8.27"
++version = "0.8.33"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
++checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
 +dependencies = [
 + "proc-macro2",
 + "quote",
@@ -1103,6 +1057,12 @@ index 0000000..a4a3c6e
 +version = "1.8.2"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
++
++[[package]]
++name = "zmij"
++version = "1.0.17"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
 -- 
 2.50.1
 
diff --git a/pkgs/by-name/kr/kryoptic/package.nix b/pkgs/by-name/kr/kryoptic/package.nix
index b18fc723e570..c3d23ad99f7e 100644
--- a/pkgs/by-name/kr/kryoptic/package.nix
+++ b/pkgs/by-name/kr/kryoptic/package.nix
@@ -1,5 +1,7 @@
 {
   lib,
+  stdenv,
+  fetchpatch,
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
@@ -8,35 +10,32 @@
   openssl,
   pkg-config,
   sqlite,
-  fips ? false,
+  withPostQuantum ? true,
 }:
 
 rustPlatform.buildRustPackage (finalPackage: {
   pname = "kryoptic";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = "kryoptic";
     tag = "v${finalPackage.version}";
-    hash = "sha256-EzWZQLAtO7ZR28aOSfwXQOyHbL8Ss75dCxVnPkJIEbw=";
+    hash = "sha256-tP2BZkGCZqfLNLZ/mYAVkICWKTM1EbL7lbw+Mnx4VTk=";
   };
 
-  postPatch =
-    let
-      # Creates an -I command line for overriding an include.
-      inc = name: ''format!("-I{}", env!("${name}_INCLUDE")).as_str()'';
-      fipsArgs = lib.optionalString fips ''"-D_KRYOPTIC_FIPS"'';
-    in
-    ''
-      substituteInPlace ossl/build.rs \
-        --replace-fail 'ossl_bindings(&["-std=c90"], out_file)' 'ossl_bindings(&["-std=c90", ${inc "OPENSSL"}, ${inc "LIBC"}, ${fipsArgs}], out_file)'
-    '';
+  patches = [
+    # Support additional arguments for bindgen so it can find our glibc.
+    # https://github.com/latchset/kryoptic/pull/386
+    (fetchpatch {
+      url = "https://github.com/latchset/kryoptic/commit/54b3deeb4eb84ebd7c5b52ccb9401e319fb00294.patch";
+      hash = "sha256-QChVS/MnsGp6To4OWYA8Se6kgRCGABchLLnSHfrEj1E=";
+    })
+  ];
 
   env = {
     # Pass these include paths for bindgen in via the environment.
-    OPENSSL_INCLUDE = "${lib.getInclude openssl}/include";
-    LIBC_INCLUDE = "${lib.getInclude glibc}/include";
+    OSSL_BINDGEN_CLANG_ARGS = "-I${lib.getInclude glibc}/include";
     LIBCLANG_PATH = "${lib.getLib clang.cc}/lib";
   };
 
@@ -47,24 +46,28 @@ rustPlatform.buildRustPackage (finalPackage: {
     sqlite
   ];
 
-  cargoPatches = [ ./cargo-lock.patch ];
+  cargoPatches = [
+    ./0001-Add-Cargo.lock.patch
+  ];
 
-  cargoHash = "sha256-NWtL1ZzxGqTn8SS4XitOYJvGRYA/j52f14oul4ZPoyw=";
+  cargoHash = "sha256-eekiW9HCKwx7/y2WSqQH6adgAeAnQojM3QcNTc3kx2I=";
 
   cargoBuildFlags = [
     "--no-default-features"
     "--features=${
       lib.concatStringsSep "," (
         [
-          (if fips then "fips" else "standard")
-          "dynamic" # dynamic linking
+          "standard"
           "sqlitedb"
           "nssdb"
           "log"
         ]
-        ++ lib.optionals (!fips) [
+        ++ lib.optionals withPostQuantum [
           "pqc" # post-quantum
         ]
+        ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
+          "dynamic"
+        ]
       )
     }"
   ];
diff --git a/pkgs/by-name/li/liboprf/package.nix b/pkgs/by-name/li/liboprf/package.nix
index 30e0c77c65c6..77a71b083359 100644
--- a/pkgs/by-name/li/liboprf/package.nix
+++ b/pkgs/by-name/li/liboprf/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=maybe-uninitialized";
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/li/libxvmc/package.nix b/pkgs/by-name/li/libxvmc/package.nix
index 59ab561a47df..7ce4d196f44b 100644
--- a/pkgs/by-name/li/libxvmc/package.nix
+++ b/pkgs/by-name/li/libxvmc/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxvmc";
-  version = "1.0.14";
+  version = "1.0.15";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXvMC-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5L6etra6/bv4H0f3FjBHIVN25F4tx4bQ6mGByTByXtk=";
+    hash = "sha256-T1GK/ePX/UNTRq97No0vc1F/PV+CZHyWLK8/e7j/cHg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/me/mediainfo/package.nix b/pkgs/by-name/me/mediainfo/package.nix
index 41e801aaa920..f3ace7125452 100644
--- a/pkgs/by-name/me/mediainfo/package.nix
+++ b/pkgs/by-name/me/mediainfo/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mediainfo";
-  version = "25.09";
+  version = "25.10";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    hash = "sha256-jUug2L19QJf9CjiNQTHeQMNaxdvlKkdgt52PHSnvLmM=";
+    hash = "sha256-NmsyUQGrGppO55+9uOPdnni8wKIcD5sZZjE6rtPTNQI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/meshtasticd/package.nix b/pkgs/by-name/me/meshtasticd/package.nix
index 0c72b014b9d0..7a9ec6d4a12a 100644
--- a/pkgs/by-name/me/meshtasticd/package.nix
+++ b/pkgs/by-name/me/meshtasticd/package.nix
@@ -36,11 +36,11 @@
 assert builtins.isBool enableDefaultConfig;
 
 let
-  version = "2.7.16.a597230";
+  version = "2.7.18.fb3bf78";
 
   platformio-deps-native = fetchzip {
     url = "https://github.com/meshtastic/firmware/releases/download/v${version}/platformio-deps-native-tft-${version}.zip";
-    hash = "sha256-Jo7e6zsCaiJs6NyIRmD6BWJFwbs0xVlUih206ePUpwk=";
+    hash = "sha256-rud8F+aYVljNw2rpApIkjuN8ob/ZxvcXNJ+oAVSeMpE=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "meshtastic";
     repo = "firmware";
-    hash = "sha256-oU3Z8qjBNeNGPGT74VStAPHgsGqsQJKngHJR6m2CBa0=";
+    hash = "sha256-RI1U0xZDy22C+YO5gKbxo5YWDzVeRWJ8u6tTyDdwqGU=";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
   };
@@ -118,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     install -Dm644 bin/org.meshtastic.meshtasticd.svg -t $out/share/icons/hicolor/scalable/apps/
     install -Dm644 bin/org.meshtastic.meshtasticd.desktop -t $out/share/applications/
-    install -Dm755 .pio/build/native-tft/program $out/bin/meshtasticd
+    install -Dm755 .pio/build/native-tft/meshtasticd -t $out/bin
 
     install -Dm644 bin/99-meshtasticd-udev.rules -t $out/etc/udev/rules.d
   ''
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index fffba61effcb..bd874c58f6e6 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.7";
+  version = "8.4.8";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wL8zqUzbkI8UmuoHl6/7GxOSYszw4Ll4ehckYgdULmk=";
+    hash = "sha256-vp2Wzfh/J2lSos3ZYPEGuWCohg5GwRXtOcG18uA4eiA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 0f7a97f99074..8e6430bfa6cd 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nuclei-templates";
-  version = "10.3.7";
+  version = "10.3.8";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kiafZbt19UInpSGq9I3QkXM3ZA4Hzp2OEW9morLm/yQ=";
+    hash = "sha256-LLJrG2bmb1eDDvcLBK35GSn6EvDJslXeu/R57wKjzX8=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/od/odin/package.nix b/pkgs/by-name/od/odin/package.nix
index 92885da46bb2..062bf82a0b5c 100644
--- a/pkgs/by-name/od/odin/package.nix
+++ b/pkgs/by-name/od/odin/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  llvmPackages,
+  llvmPackages_18,
   fetchFromGitHub,
   makeBinaryWrapper,
   which,
@@ -8,6 +8,7 @@
 }:
 
 let
+  llvmPackages = llvmPackages_18;
   inherit (llvmPackages) stdenv;
 in
 stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index cf24dc98c613..75b0f26c0230 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -14,12 +14,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.1.30";
+  version = "1.1.36";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RTj64yrVLTFNpVc8MvPAJISOlBo/j2MnuL5jo4VtKWM=";
+    hash = "sha256-ovFGFI2dSZLKSeuanRZg9cNvMCxYnS3UbtaCKls5BYQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-37pmIiJzPEWeA7+5u5lz39vlFPI+N13Qw9weHrAaGW4=";
+    outputHash = "sha256-MPzEzyx+Av0sa6EU3ewjUSwAOyA+GJGfvEoROYqZjkM=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/ot/otree/package.nix b/pkgs/by-name/ot/otree/package.nix
index 50731694d28a..4741ac51f266 100644
--- a/pkgs/by-name/ot/otree/package.nix
+++ b/pkgs/by-name/ot/otree/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "otree";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "fioncat";
     repo = "otree";
     tag = "v${version}";
-    hash = "sha256-l2hU1a2yfXo8u8wjSmvzL+nzniMQFKvdBhQ0eqqG3tg=";
+    hash = "sha256-7Yv8krhtA+YAbJmF/bxgWb6NZBzg/fubxkzDEeOw4xU=";
   };
 
-  cargoHash = "sha256-UyomqesHDaGDEBHVcQMwUI7kH8akOOuyXOL/r4gfiAo=";
+  cargoHash = "sha256-Op0IIH1whnBWP5Z5LLygdiWpysC/JZJEKX6OLHQAsWo=";
 
   meta = {
     description = "Command line tool to view objects (JSON/YAML/TOML/XML) in TUI tree widget";
diff --git a/pkgs/by-name/ox/oxipng/package.nix b/pkgs/by-name/ox/oxipng/package.nix
index b8a682040b5f..81f4a09c0ddb 100644
--- a/pkgs/by-name/ox/oxipng/package.nix
+++ b/pkgs/by-name/ox/oxipng/package.nix
@@ -5,7 +5,7 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "10.0.0";
+  version = "10.1.0";
   pname = "oxipng";
 
   # do not use fetchCrate (only repository includes tests)
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     owner = "shssoichiro";
     repo = "oxipng";
     tag = "v${version}";
-    hash = "sha256-c8NNTO+6GuFb5BBPpdyDSHbtmojq+9ceOic54Zq3nwE=";
+    hash = "sha256-fPzdko8qcg9zcr79SrEakLqTFj9hDCakl6hTVpW9al8=";
   };
 
-  cargoHash = "sha256-YStZ2j2gjC5uVUnHaQIk6xtSbnPm0IoNONRr/nFOOUg=";
+  cargoHash = "sha256-P8PT75TwdYeS9xJ7EEdIhlgHfd0VlIPUaLkM0SfRPq0=";
 
   # don't require qemu for aarch64-linux tests
   # error: linker `aarch64-linux-gnu-gcc` not found
diff --git a/pkgs/by-name/po/powersupply/package.nix b/pkgs/by-name/po/powersupply/package.nix
index c908ae909e43..88fc8d9c17d4 100644
--- a/pkgs/by-name/po/powersupply/package.nix
+++ b/pkgs/by-name/po/powersupply/package.nix
@@ -14,7 +14,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "powersupply";
-  version = "0.10.1";
+  version = "0.10.2";
 
   pyproject = false;
 
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "postmarketOS";
     repo = "powersupply";
     rev = version;
-    hash = "sha256-sPdtrm2WQYjPu+1bb0ltBiqS9t8FFvbgRdGe1PEthy0=";
+    hash = "sha256-i0AZfxYWj8ct2jiXl2GnCGMU3xBSRRny4H0G/5Qs14Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 227d8dc57305..fca7d602a190 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -31,6 +31,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "reindeer";
     homepage = "https://github.com/facebookincubator/reindeer";
     license = with lib.licenses; [ mit ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ amaanq ];
   };
 }
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index fa6cdaece5d1..9407f5967143 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.151";
+  version = "0.3.153";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-yH+ggH5bJNvdD+iv3gk6PZ/EXHoQhdl7ur9Sj6/GE/Q=";
+    hash = "sha256-/1Fuu1v8kNu0BUFNqhzy7Nexob29NDo/vEOWfQSPF88=";
   };
 
-  cargoHash = "sha256-hi0TghUBEXBMSXq+gjxeGZWzpqzQTBg8WGOdkzP1Q70=";
+  cargoHash = "sha256-cosUcBEb/hRcQ0s/1f30917gDQzGmRKmPNJ4/ASAl+4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 5975d14d314f..aa6d3cdbc192 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   makeWrapper,
-  nodejs,
+  nodejs_22,
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -14,6 +14,9 @@
   nix-update-script,
   yq-go,
 }:
+let
+  nodejs = nodejs_22;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
   version = "42.83.1";
diff --git a/pkgs/by-name/sq/sqlcipher/package.nix b/pkgs/by-name/sq/sqlcipher/package.nix
index 732ffb6ff6e1..aa7141f7e5dc 100644
--- a/pkgs/by-name/sq/sqlcipher/package.nix
+++ b/pkgs/by-name/sq/sqlcipher/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlcipher";
-  version = "4.12.0";
+  version = "4.13.0";
 
   src = fetchFromGitHub {
     owner = "sqlcipher";
     repo = "sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dJBZw8SzcNS0GGt9el4tiR7gc2DOajuUVfDukwrVPeQ=";
+    hash = "sha256-3Qt7nOB0iMyNXfENC3gv3F6sENU7OUTZ3n2mo0M2CSA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/td/tdb/package.nix b/pkgs/by-name/td/tdb/package.nix
index e1de49bc5b8f..7d30160aac5d 100644
--- a/pkgs/by-name/td/tdb/package.nix
+++ b/pkgs/by-name/td/tdb/package.nix
@@ -28,11 +28,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tdb";
-  version = "1.4.14";
+  version = "1.4.15";
 
   src = fetchurl {
     url = "mirror://samba/tdb/${pname}-${version}.tar.gz";
-    hash = "sha256-FE9AfULteg7BRwpA7xetQRM/6RC86GXdn+CE1JyQdSY=";
+    hash = "sha256-+6CdjfHxuQcq6ujniyvUPFr+8gsvbe76YzqhSjd6jdI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vv/vvenc/package.nix b/pkgs/by-name/vv/vvenc/package.nix
index f28ab0e0d436..25d08a97f4f2 100644
--- a/pkgs/by-name/vv/vvenc/package.nix
+++ b/pkgs/by-name/vv/vvenc/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vvenc";
-  version = "1.13.1";
+  version = "1.14.0";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fraunhoferhhi";
     repo = "vvenc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DPR1HmUYTjhKI+gTHERtxqThZ5oKKMoqYsfE709IrhA=";
+    hash = "sha256-MZVXxUXpcZ16de3CZDscLOlnqjHkGZ98muhYCDCcgvs=";
   };
 
   patches = [ ./unset-darwin-cmake-flags.patch ];
diff --git a/pkgs/by-name/xf/xf86-video-ast/package.nix b/pkgs/by-name/xf/xf86-video-ast/package.nix
index c8283bafd934..541cc6da00bd 100644
--- a/pkgs/by-name/xf/xf86-video-ast/package.nix
+++ b/pkgs/by-name/xf/xf86-video-ast/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xf86-video-ast";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "driver";
     repo = "xf86-video-ast";
     tag = "xf86-video-ast-${finalAttrs.version}";
-    hash = "sha256-5fZ0+6Jf/QBuR9l2lOsh4RQEGKrR9XttEvwOVO8w3t4=";
+    hash = "sha256-Xz9ZvngAsEb/9+YOGOkJQIbFzofKw+2V6sST8Ry2tvo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/xf/xf86-video-geode/package.nix b/pkgs/by-name/xf/xf86-video-geode/package.nix
index dba6eaf99ee3..12e7a188392b 100644
--- a/pkgs/by-name/xf/xf86-video-geode/package.nix
+++ b/pkgs/by-name/xf/xf86-video-geode/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xf86-video-geode";
-  version = "2.18.1";
+  version = "2.18.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "driver";
     repo = "xf86-video-geode";
     tag = "xf86-video-geode-${finalAttrs.version}";
-    hash = "sha256-y9fQpMg6qKjaQvDfqYbWscFomtzmHQ1cvzMaa4anhOE=";
+    hash = "sha256-G0w6Ft172ar5dwR3NAu+8vuvJqWKaknmpbdThpPR+kY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/xf/xf86-video-nested/package.nix b/pkgs/by-name/xf/xf86-video-nested/package.nix
new file mode 100644
index 000000000000..59e712a32050
--- /dev/null
+++ b/pkgs/by-name/xf/xf86-video-nested/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  autoreconfHook,
+  pkg-config,
+  util-macros,
+  xorgproto,
+  libx11,
+  libxext,
+  xorg-server,
+}:
+
+stdenv.mkDerivation {
+  pname = "xf86-video-nested";
+  version = "0-unstable-2024-10-26";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    group = "xorg";
+    owner = "driver";
+    repo = "xf86-video-nested";
+    rev = "03dab66493622835a29b873cd63df489f1a96ed9";
+    hash = "sha256-EPQOcE23m6RSG05txjBjREBz9JlwZrmK4Rn6Fg2IyT4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    util-macros
+  ];
+
+  buildInputs = [
+    xorg-server
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  meta = {
+    homepage = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-nested";
+    description = "Video ddriver to run Xorg on top of another X server";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/by-name/xf/xf86_video_nested/package.nix b/pkgs/by-name/xf/xf86_video_nested/package.nix
deleted file mode 100644
index 99c486d13c15..000000000000
--- a/pkgs/by-name/xf/xf86_video_nested/package.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchgit,
-  autoreconfHook,
-  xorgproto,
-  libX11,
-  libXext,
-  pixman,
-  pkg-config,
-  utilmacros,
-  xorgserver,
-}:
-
-stdenv.mkDerivation {
-  pname = "xf86-video-nested";
-  version = "unstable-2017-06-12";
-
-  src = fetchgit {
-    url = "git://anongit.freedesktop.org/xorg/driver/xf86-video-nested";
-    rev = "6a48b385c41ea89354d0b2ee7f4649a1d1d9ec70";
-    sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    autoreconfHook
-  ];
-
-  buildInputs = [
-    xorgproto
-    libX11
-    libXext
-    pixman
-    utilmacros
-    xorgserver
-  ];
-
-  hardeningDisable = [ "fortify" ];
-
-  CFLAGS = "-I${pixman}/include/pixman-1";
-
-  meta = {
-    homepage = "https://cgit.freedesktop.org/xorg/driver/xf86-video-nested";
-    description = "Driver to run Xorg on top of Xorg or something else";
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/by-name/xf/xfsprogs/package.nix b/pkgs/by-name/xf/xfsprogs/package.nix
index 5215bb23ba86..d05b83e9280c 100644
--- a/pkgs/by-name/xf/xfsprogs/package.nix
+++ b/pkgs/by-name/xf/xfsprogs/package.nix
@@ -106,8 +106,5 @@ stdenv.mkDerivation rec {
       dezgeg
       ajs124
     ];
-    # error: ‘struct statx’ has no member named ‘stx_atomic_write_unit_min’ ‘stx_atomic_write_unit_max’ ‘stx_atomic_write_segments_max’
-    # remove if https://www.openwall.com/lists/musl/2024/10/23/6 gets merged
-    broken = stdenv.hostPlatform.isMusl;
   };
 }
diff --git a/pkgs/by-name/xk/xkill/package.nix b/pkgs/by-name/xk/xkill/package.nix
index 9577eb13c53b..ed7cca269274 100644
--- a/pkgs/by-name/xk/xkill/package.nix
+++ b/pkgs/by-name/xk/xkill/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xkill";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchurl {
     url = "mirror://xorg/individual/app/xkill-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5aiqeMR1Z3sRUEZG2o2T2swwdEJYB2ospBiiRDiuuQc=";
+    hash = "sha256-X/JkvE7rwEWSVakgNtyNyEttSMrvhQn4ing76q3qdQs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index fe69c9dcdc5e..8d7057b212e2 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UE5x9w9I4l9OqRVv6klveEvIap+El6vea6OsnnOJHus=";
+    hash = "sha256-od7RWHhyFQ7l3HZaqpOkUVtiWKDQj/tUsd5lGi6m34I=";
   };
 
-  cargoHash = "sha256-rQ8uBgsJ86K0Qc3uTiFDPmcRU+dF5gu0b5pzMcGAAVU=";
+  cargoHash = "sha256-YW4Yi1gvMjTNAgsAlyX1KMlyQPHCXh/jAoO/Nkrn2Sc=";
 
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
diff --git a/pkgs/development/ocaml-modules/multicore-magic/default.nix b/pkgs/development/ocaml-modules/multicore-magic/default.nix
index 358e3aed57ea..c8bd30b95544 100644
--- a/pkgs/development/ocaml-modules/multicore-magic/default.nix
+++ b/pkgs/development/ocaml-modules/multicore-magic/default.nix
@@ -10,11 +10,11 @@
 
 buildDunePackage rec {
   pname = "multicore-magic";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/multicore-magic/releases/download/${version}/multicore-magic-${version}.tbz";
-    hash = "sha256-Adcgi9yfEhhygbBK04H6N9ozg3O6JJWrXrD1MxUcGV8=";
+    hash = "sha256-jY1wqCOq4c4EMDgIQqqIHErIONJFyvJ+0P8ld1CHF18=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/aiovodafone/default.nix b/pkgs/development/python-modules/aiovodafone/default.nix
index 1d804579bae1..5de8b2940662 100644
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@@ -8,23 +8,22 @@
   fetchFromGitHub,
   orjson,
   poetry-core,
+  pycryptodome,
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
+  segno,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiovodafone";
-  version = "3.0.0";
+  version = "3.1.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aiovodafone";
-    tag = "v${version}";
-    hash = "sha256-JeMB7K2NURvMPgCZRNAFt9ThIu4LDq3WlmAXsgm1CKs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NhtclSuwiEuGAA/zhKEL/5S/WTFTjo87BTQPuSVX0sE=";
   };
 
   build-system = [ poetry-core ];
@@ -32,9 +31,11 @@ buildPythonPackage rec {
   dependencies = [
     aiohttp
     beautifulsoup4
-    cryptography
     colorlog
+    cryptography
     orjson
+    pycryptodome
+    segno
   ];
 
   nativeCheckInputs = [
@@ -47,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to control Vodafon Station";
     homepage = "https://github.com/chemelli74/aiovodafone";
-    changelog = "https://github.com/chemelli74/aiovodafone/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/chemelli74/aiovodafone/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/alibabacloud-credentials/default.nix b/pkgs/development/python-modules/alibabacloud-credentials/default.nix
index c4ae9ef1490f..b02b012391f8 100644
--- a/pkgs/development/python-modules/alibabacloud-credentials/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-credentials/default.nix
@@ -9,15 +9,15 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-credentials";
-  version = "1.0.4";
+  version = "1.0.7";
   pyproject = true;
 
   src = fetchPypi {
     pname = "alibabacloud_credentials";
-    inherit version;
-    hash = "sha256-K3GrMHRSZ6vVJNZPvgY/fgJknaKrbarx7sBXM7f5yPE=";
+    inherit (finalAttrs) version;
+    hash = "sha256-gEKCgLS8+VRh1B0UkKIjYLi2fRgpvx6zj3T6vMaT8bM=";
   };
 
   build-system = [ setuptools ];
@@ -40,4 +40,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 04ed03667916..d2b16878798a 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -7,11 +7,13 @@
   fetchFromGitHub,
   httpx,
   msgpack,
+  oras,
   orjson,
   packageurl-python,
   pydantic,
-  pytestCheckHook,
   pytest-cov-stub,
+  pytestCheckHook,
+  pyyaml,
   rich,
   semver,
   setuptools,
@@ -19,16 +21,16 @@
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "appthreat-vulnerability-db";
-  version = "6.5.1";
+  version = "6.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = "vulnerability-db";
-    tag = "v${version}";
-    hash = "sha256-SyUTDWi9t37Gw8qn7vCpW+l5jBAXFH5b/VACrFhgsRU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/tcfHEvTdk0B/vfcqqkTn9kGT3QIPLWW4l01fjnrhqE=";
   };
 
   pythonRelaxDeps = [
@@ -51,13 +53,24 @@ buildPythonPackage rec {
     semver
     tabulate
   ]
-  ++ httpx.optional-dependencies.http2;
+  ++ httpx.optional-dependencies.http2
+  ++ pydantic.optional-dependencies.email;
+
+  optional-dependencies = {
+    all = [
+      oras
+      pyyaml
+    ];
+    custom = [ pyyaml ];
+    oras = [ oras ];
+  };
 
   nativeCheckInputs = [
     pytest-cov-stub
     pytestCheckHook
     writableTmpDirAsHomeHook
-  ];
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   disabledTests = [
     # Tests require network access
@@ -71,9 +84,9 @@ buildPythonPackage rec {
   meta = {
     description = "Vulnerability database and package search for sources such as OSV, NVD, GitHub and npm";
     homepage = "https://github.com/appthreat/vulnerability-db";
-    changelog = "https://github.com/AppThreat/vulnerability-db/releases/tag/${src.tag}";
+    changelog = "https://github.com/AppThreat/vulnerability-db/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "vdb";
   };
-}
+})
diff --git a/pkgs/development/python-modules/bidsschematools/default.nix b/pkgs/development/python-modules/bidsschematools/default.nix
index 09b68c112f6d..2f4d7e2facf7 100644
--- a/pkgs/development/python-modules/bidsschematools/default.nix
+++ b/pkgs/development/python-modules/bidsschematools/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bidsschematools";
-  version = "1.1.5";
+  version = "1.1.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bids-standard";
     repo = "bids-specification";
     tag = "schema-${version}";
-    hash = "sha256-LAcrmnfksisLQb1JE82p/tm5HhHAfezCApz8CeUciZQ=";
+    hash = "sha256-HMGhEEnmr0BwkcRcysmu9SgTME4BhrwcAAnRt4qF7eI=";
   };
 
   sourceRoot = "${src.name}/tools/schemacode";
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 1ebea8fa33c9..3201bf0ab679 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.34";
+  version = "1.42.35";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-+vzDcTwzG6wRv1X+kT5aOgGCDwzeZAz8RpTfWpSqlVc=";
+    hash = "sha256-IKq13uWdTQqVFSvXvlhPqvufa88Ub//zzWBV9x0AbWo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 1408b6d412e5..686d13255e45 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "botocore-stubs";
-  version = "1.42.34";
+  version = "1.42.35";
   pyproject = true;
 
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-89HFtFwsvhb2Nxmr5jmyOh7rP+ycPqCnJohYW0YujOM=";
+    hash = "sha256-N1z5U09vKjW9LJ5wduiPtJ+31YnFqsEp22qf/BNWHK0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cpe-search/default.nix b/pkgs/development/python-modules/cpe-search/default.nix
index d514f42e084c..030cd7613c0d 100644
--- a/pkgs/development/python-modules/cpe-search/default.nix
+++ b/pkgs/development/python-modules/cpe-search/default.nix
@@ -7,19 +7,20 @@
   hatchling,
   mariadb,
   requests,
+  tqdm,
   ujson,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cpe-search";
-  version = "0.1.7";
+  version = "0.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "cpe_search";
-    tag = "v${version}";
-    hash = "sha256-gCWKVSVDJNspRwDzHi7+vUETGErWYs3jlpsqkOqSY4I=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wnUKLJUUj3idQLv3FSpcUZksa0FvwMxKDId6/hjpEZw=";
   };
 
   build-system = [ hatchling ];
@@ -28,6 +29,7 @@ buildPythonPackage rec {
     aiohttp
     aiolimiter
     requests
+    tqdm
     ujson
   ];
 
@@ -37,6 +39,7 @@ buildPythonPackage rec {
       aiolimiter
       mariadb
       requests
+      tqdm
       ujson
     ];
     mariadb = [
@@ -52,8 +55,8 @@ buildPythonPackage rec {
   meta = {
     description = "Search for Common Platform Enumeration (CPE) strings using software names and titles";
     homepage = "https://github.com/ra1nb0rn/cpe_search";
-    changelog = "https://github.com/ra1nb0rn/cpe_search/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/ra1nb0rn/cpe_search/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 1e6a92692117..101649f5c17e 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2025.12.0";
+  version = "2026.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = "distributed";
     tag = version;
-    hash = "sha256-srFYbAdlnxpxhSVFqd1geOBoD7bbpLNSlAUWNtefokM=";
+    hash = "sha256-xriIsrdFNSHAO9SmdowXK9uPW06ziz9uGie3PkYncqo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index da49be1fef1d..8eef3ec95d97 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202601261";
+  version = "0.1.202601271";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vjCyMNTaXALc5wecg6YO3kg5fdYfZ8tAWa0LrmoiOTE=";
+    hash = "sha256-bOnbWxSV3Aoukh403YS61SCkIsjp20cVpSOXcsQQj6U=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/inkex/default.nix b/pkgs/development/python-modules/inkex/default.nix
index 2a77286bd94d..0ea95ed65750 100644
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   buildPythonPackage,
+  fetchpatch,
   inkscape,
   poetry-core,
   cssselect,
@@ -25,6 +26,17 @@ buildPythonPackage {
 
   inherit (inkscape) src;
 
+  patches = [
+    # Fix tests with newer libxml2
+    # https://gitlab.com/inkscape/extensions/-/merge_requests/712
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/extensions/-/commit/b04ab718b400778a264f2085bbc779faebc08368.patch";
+      hash = "sha256-BXRcfoeX7X8+x6CuKKBhrnzUHIwgnPay22Z8+rPZS54=";
+      stripLen = 1;
+      extraPrefix = "share/extensions/";
+    })
+  ];
+
   build-system = [ poetry-core ];
 
   pythonRelaxDeps = [
@@ -72,9 +84,6 @@ buildPythonPackage {
     "tests/test_inkex_gui_window.py"
     # Failed to find pixmap 'image-missing' in /build/source/tests/data/
     "tests/test_inkex_gui_pixmaps.py"
-    # Fails with libxml2 >= 2.15 with "lxml.etree was compiled without Schematron support"
-    "inkex/tester/test_inx_file.py"
-    "tests/test_inkex_inx.py"
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/model-bakery/default.nix b/pkgs/development/python-modules/model-bakery/default.nix
index f0a231d9bb41..254d91613461 100644
--- a/pkgs/development/python-modules/model-bakery/default.nix
+++ b/pkgs/development/python-modules/model-bakery/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "model-bakery";
-  version = "1.23.0";
+  version = "1.23.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "model-bakers";
     repo = "model_bakery";
     tag = finalAttrs.version;
-    hash = "sha256-AwdHsysCaxSS6+dH1gO7dyV2Q4PIA84Mc810KNrqP/g=";
+    hash = "sha256-7RMFbUFYUJI8gI5GVQ6kivjb6oeHGKzYbyTukMjK+8Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 3be034c68ec9..5d53d8d63497 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -347,8 +347,8 @@ in
       "sha256-omWYUcr7Aj6r1F1kKAmM32fn9577UeUgqesnIiBIpPQ=";
 
   mypy-boto3-connectcases =
-    buildMypyBoto3Package "connectcases" "1.42.3"
-      "sha256-OpFwfLIgldcA31CkZfgcD8H9vOPNVNSxmr0J3taPKV8=";
+    buildMypyBoto3Package "connectcases" "1.42.35"
+      "sha256-y/EYsonfz1GwySCHmcVK5i3gVGarbM3bLvDIj/nFh9o=";
 
   mypy-boto3-connectparticipant =
     buildMypyBoto3Package "connectparticipant" "1.42.3"
@@ -443,8 +443,8 @@ in
       "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.33"
-      "sha256-6FgPHidDOccO4DvmCnE+1tDvZU+V/2I1aJ563D8/rDs=";
+    buildMypyBoto3Package "ec2" "1.42.35"
+      "sha256-uiUIfubdYTR0JL4fLLArnL9fHMc35JtpBwud2pW3HEw=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -519,8 +519,8 @@ in
       "sha256-zoJFU3RC1bgWvK/rTsAKRoWDbl1+VehjlGM9s18h7Fg=";
 
   mypy-boto3-evidently =
-    buildMypyBoto3Package "evidently" "1.42.3"
-      "sha256-t+mFGfaY21XDIDWgKthnXeg+couyjop0grL6QjHpi9g=";
+    buildMypyBoto3Package "evidently" "1.42.35"
+      "sha256-kdSGsikyLazIdSKidTt6bk5i+syJgx/GE0y+KRpC1rw=";
 
   mypy-boto3-finspace =
     buildMypyBoto3Package "finspace" "1.42.3"
@@ -586,8 +586,8 @@ in
       "sha256-w3vOm8K/2rToF1CFWtAobCzswkv2d/gm1bzy6XiOFVA=";
 
   mypy-boto3-groundstation =
-    buildMypyBoto3Package "groundstation" "1.42.3"
-      "sha256-BrtHCaCwsfpaB5GA9kEhCFapQceZsjpyv3HVgpXUOFA=";
+    buildMypyBoto3Package "groundstation" "1.42.35"
+      "sha256-UIxD9R+oQjVmR90OfD8Dp7GW3E73zny6LFTkxrSdmNU=";
 
   mypy-boto3-guardduty =
     buildMypyBoto3Package "guardduty" "1.42.33"
diff --git a/pkgs/development/python-modules/pydexcom/default.nix b/pkgs/development/python-modules/pydexcom/default.nix
index da88fad14d0e..b1ecf3b6282f 100644
--- a/pkgs/development/python-modules/pydexcom/default.nix
+++ b/pkgs/development/python-modules/pydexcom/default.nix
@@ -7,16 +7,16 @@
   requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pydexcom";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gagebenne";
     repo = "pydexcom";
-    tag = version;
-    hash = "sha256-IqSZZHe5epcgO2uoIsGkNaac3+UplHzqEcFWTzwAqPg=";
+    tag = finalAttrs.version;
+    hash = "sha256-u94OI45PmofPLpuJUpjbvGLla+mJEHy1t6/4fiI6+zc=";
   };
 
   build-system = [
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API to interact with Dexcom Share service";
     homepage = "https://github.com/gagebenne/pydexcom";
-    changelog = "https://github.com/gagebenne/pydexcom/releases/tag/${src.tag}";
+    changelog = "https://github.com/gagebenne/pydexcom/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index e640a29a0713..0a883e2cf968 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyexploitdb";
-  version = "0.3.10";
+  version = "0.3.11";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-EZX2eCNc46UuqbBEypjp6NcHOAI6C7SiFu+AZPXcSg8=";
+    hash = "sha256-SKIGVjgNhM22Ia/ZxZD5uwFiE4XcYmnKMvNG/KGltYw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pykoplenti/default.nix b/pkgs/development/python-modules/pykoplenti/default.nix
index 80d6c0069c76..bfb63d93e269 100644
--- a/pkgs/development/python-modules/pykoplenti/default.nix
+++ b/pkgs/development/python-modules/pykoplenti/default.nix
@@ -7,28 +7,26 @@
   prompt-toolkit,
   pycryptodome,
   pydantic,
-  setuptools,
+  hatchling,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pykoplenti";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stegm";
     repo = "pykoplenti";
-    tag = "v${version}";
-    hash = "sha256-vsqbjNj5x7X0VGbTq+CdZ9rPXVDypBkgaCI6MImloLo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mwh6QOdsvf32U09ebleEKL7vt3xz8tjiftVVxKL/lO4=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     pycryptodome
     pydantic
@@ -48,10 +46,10 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python REST client API for Kostal Plenticore Inverters";
-    mainProgram = "pykoplenti";
     homepage = "https://github.com/stegm/pykoplenti/";
-    changelog = "https://github.com/stegm/pykoplenti/releases/tag/v${version}";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/stegm/pykoplenti/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pykoplenti";
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyvlx/default.nix b/pkgs/development/python-modules/pyvlx/default.nix
index 1dcc98be36bc..5ab2052c9b97 100644
--- a/pkgs/development/python-modules/pyvlx/default.nix
+++ b/pkgs/development/python-modules/pyvlx/default.nix
@@ -9,16 +9,16 @@
   zeroconf,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyvlx";
-  version = "0.2.27";
+  version = "0.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Julius2342";
     repo = "pyvlx";
-    tag = version;
-    hash = "sha256-FOchtl3HDByHIBRh0MXYnQYh6opzkcHOOYaINmMPu7w=";
+    tag = finalAttrs.version;
+    hash = "sha256-l+Yfp8s6x+l/1ssL0wgyzd8QbA4ikr+ZUVMdTEaIjYE=";
   };
 
   build-system = [ setuptools ];
@@ -40,8 +40,8 @@ buildPythonPackage rec {
       devices, e.g. Velux Windows.
     '';
     homepage = "https://github.com/Julius2342/pyvlx";
-    changelog = "https://github.com/Julius2342/pyvlx/releases/tag/${src.tag}";
+    changelog = "https://github.com/Julius2342/pyvlx/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl2Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index 40782b57d4a3..6cf36fd5e46f 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -17,7 +17,7 @@ let
 in
 buildPythonPackage rec {
   pname = "reportlab";
-  version = "4.4.7";
+  version = "4.4.9";
   pyproject = true;
 
   # See https://bitbucket.org/pypy/compatibility/wiki/reportlab%20toolkit
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Qegoevll5ZlnZJM/PnXn82PDtvJSuhcvlCnoFljXsXA=";
+    hash = "sha256-fPSHdkKU7nkaR4H1oVe+vOJipmauS7uHeGdgqWdsk3g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 3fae6f8903a9..a83ed24524df 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.37";
+  version = "3.1.38";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-gtvmqQzKXwChwTyh0iOnZwVArNOHUuzAlT6hKRPfckU=";
+    hash = "sha256-YwCouaDX41sKJ45O5a1gGuXBKdEpZ+UVOVn1F2VtKd8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ukkonen/default.nix b/pkgs/development/python-modules/ukkonen/default.nix
index 4de244797b59..e3364ea5752d 100644
--- a/pkgs/development/python-modules/ukkonen/default.nix
+++ b/pkgs/development/python-modules/ukkonen/default.nix
@@ -4,21 +4,27 @@
   fetchFromGitHub,
   cffi,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ukkonen";
-  version = "1.0.1";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = "ukkonen";
-    rev = "v${version}";
-    sha256 = "jG6VP/P5sadrdrmneH36/ExSld9blyMAAG963QS9+p0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vXyOLAiY92Df7g57quiSnOz8yhaIsm8MTB6Fbiv6axQ=";
   };
 
-  nativeBuildInputs = [ cffi ];
+  build-system = [
+    cffi
+    setuptools
+  ];
+
+  dependencies = [ cffi ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -30,4 +36,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
index de22d3c86057..5be97d77376e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.9.5";
+  version = "4.9.7";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-0odR9ZCXS8vovQTX81U2PL1i45ftijJ/WRWk00DBWXc=";
+    hash = "sha256-vEQtpoafjMCkpeOnfPa1u5pDo34LapLkRFUoblZ5ntg=";
   };
 
-  npmDepsHash = "sha256-Z9u7fNd9XB41HiD0MuMy9xjq3mROSYp1sTRyJ0Rf9xw=";
+  npmDepsHash = "sha256-iTyiPtzKld8Lx1k2GtZ4rwPl79OgHf4bMbAkAeD/8uY=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index 3119c7b68ec5..868d9b2b9ca3 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.0.44";
+  version = "8.0.45";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YJUi7R/vzlqziN7CXg0bzhMjgtom4rd7aPB0HApkE1Y=";
+    hash = "sha256-tDXyLmWMj8k7gWmPo0uaVjJaMEs/Pf+H8n+2dMkKu8s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/stdenv/generic/check-meta-test.nix b/pkgs/stdenv/generic/check-meta-test.nix
new file mode 100644
index 000000000000..0dedb25afbd2
--- /dev/null
+++ b/pkgs/stdenv/generic/check-meta-test.nix
@@ -0,0 +1,128 @@
+# Execute with
+#   nix-build -A nixosTests.nixpkgs-config-allow-unfree-packages-and-predicate --show-trace
+#
+# This test exercises the interaction between:
+#
+#   - nixos/modules/misc/nixpkgs.nix  (config merging, esp. allowUnfreePackages)
+#   - pkgs/stdenv/generic/check-meta.nix (allowUnfreePredicate logic)
+#
+# It checks how:
+#
+#   * config.allowUnfreePackages
+#   * config.allowUnfreePredicate
+#
+# interact to determine whether unfree packages are allowed.
+{
+  lib,
+  pkgs,
+}:
+
+let
+  inherit (lib)
+    assertMsg
+    generators
+    licenses
+    recurseIntoAttrs
+    ;
+
+  mkUnfreePkg = name: {
+    pname = name;
+    version = "1.0";
+    meta.license = licenses.unfree;
+  };
+  assertValidity =
+    {
+      nixpkgsConfig,
+      pkg,
+      expected ? true,
+    }:
+    let
+      testPkgs = import ../../.. {
+        system = pkgs.stdenv.hostPlatform.system;
+        config = nixpkgsConfig;
+      };
+      checkMeta = testPkgs.callPackage ./check-meta.nix { };
+      tryEval = expression: builtins.tryEval (builtins.deepSeq expression expression);
+      actual = tryEval (
+        checkMeta.assertValidity {
+          meta = pkg.meta;
+          attrs = pkg;
+        }
+      );
+      toPretty = generators.toPretty { };
+    in
+    assertMsg (actual.success == expected) ''
+      Expected validity of package ${lib.getName pkg} to be ${toPretty expected},
+      but got ${toPretty actual} with config:
+      ${toPretty nixpkgsConfig}
+    '';
+
+  runAssertions = assertions: lib.deepSeq assertions "";
+
+in
+recurseIntoAttrs {
+
+  allowOnlyFreePackagesByDefault = assertValidity {
+    nixpkgsConfig = { };
+    pkg = mkUnfreePkg "forbidden";
+    expected = false;
+  };
+
+  allowAllUnfreePackages = assertValidity {
+    nixpkgsConfig = {
+      allowUnfree = true;
+    };
+    pkg = mkUnfreePkg "allowed";
+  };
+
+  allowUnfreePackagesWithPredicate =
+    let
+      nixpkgsConfig = {
+        allowUnfreePredicate = pkg: lib.getName pkg == "allowed-by-predicate";
+      };
+    in
+    [
+      (assertValidity {
+        inherit nixpkgsConfig;
+        pkg = mkUnfreePkg "allowed-by-predicate";
+      })
+      (assertValidity {
+        inherit nixpkgsConfig;
+        pkg = mkUnfreePkg "allowed-by-nothing";
+        expected = false;
+      })
+    ];
+
+  allowUnfreeWithPackages = runAssertions [
+    (assertValidity {
+      nixpkgsConfig = {
+        allowUnfreePackages = [ "unfree" ];
+      };
+      pkg = mkUnfreePkg "unfree";
+      expected = true;
+    })
+  ];
+
+  allowUnfreePackagesOrPredicate =
+    let
+      nixpkgsConfig = {
+        allowUnfreePackages = [ "allowed-by-packages" ];
+        allowUnfreePredicate = pkg: lib.getName pkg == "allowed-by-predicate";
+      };
+    in
+    runAssertions [
+      (assertValidity {
+        inherit nixpkgsConfig;
+        pkg = mkUnfreePkg "allowed-by-packages";
+      })
+      (assertValidity {
+        inherit nixpkgsConfig;
+        pkg = mkUnfreePkg "allowed-by-predicate";
+      })
+      (assertValidity {
+        inherit nixpkgsConfig;
+        pkg = mkUnfreePkg "forbidden";
+        expected = false;
+      })
+    ];
+}
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 28de9c68110e..ae868ab14ac1 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -158,7 +158,19 @@ let
   #   allowUnfree = false;
   #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "vscode" x.name);
   # }
-  allowUnfreePredicate = config.allowUnfreePredicate or (x: false);
+  # Defaults to allow all names defined in config.allowUnfreePackages
+  allowUnfreePredicate =
+    let
+      listPredicate = pkg: builtins.elem (lib.getName pkg) (config.allowUnfreePackages or [ ]);
+
+      # Be robust against misconfigured allowUnfreePredicate values such as null
+      explicitPredicate =
+        let
+          raw = config.allowUnfreePredicate or null;
+        in
+        if builtins.isFunction raw then raw else (_: false);
+    in
+    pkg: (listPredicate pkg) || (explicitPredicate pkg);
 
   # Check whether unfree packages are allowed and if not, whether the
   # package has an unfree license and is not explicitly allowed by the
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d2686039707a..25d37970b584 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1873,6 +1873,7 @@ mapAliases {
   xdragon = throw "'xdragon' has been renamed to/replaced by 'dragon-drop'"; # Converted to throw 2025-10-27
   xf86_input_cmt = xf86-input-cmt; # Added 2025-12-12
   xf86_input_wacom = xf86-input-wacom; # Added 2025-12-12
+  xf86_video_nested = xf86-video-nested; # added 2026-01-13
   xf86inputjoystick = xf86-input-joystick; # Added 2026-01-19
   xf86inputkeyboard = xf86-input-keyboard; # Added 2026-01-19
   xf86inputmouse = xf86-input-mouse; # Added 2026-01-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24c7cfdc4999..637032faf635 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -956,13 +956,6 @@ with pkgs;
 
   opnplug = adlplug.override { type = "OPN"; };
 
-  aegisub = callPackage ../by-name/ae/aegisub/package.nix (
-    {
-      luajit = luajit.override { enable52Compat = true; };
-    }
-    // (config.aegisub or { })
-  );
-
   acme-client = callPackage ../tools/networking/acme-client {
     stdenv = gccStdenv;
   };
@@ -7784,10 +7777,6 @@ with pkgs;
   librdf_redland = callPackage ../development/libraries/librdf/redland.nix { };
   redland = librdf_redland; # added 2018-04-25
 
-  renovate = callPackage ../by-name/re/renovate/package.nix {
-    nodejs = nodejs_22;
-  };
-
   qadwaitadecorations-qt6 = callPackage ../by-name/qa/qadwaitadecorations/package.nix {
     useQt6 = true;
   };
@@ -9453,10 +9442,6 @@ with pkgs;
 
   open-vm-tools-headless = open-vm-tools.override { withX = false; };
 
-  odin = callPackage ../by-name/od/odin/package.nix {
-    llvmPackages = llvmPackages_18;
-  };
-
   pam =
     if stdenv.hostPlatform.isLinux then
       linux-pam
@@ -10055,11 +10040,6 @@ with pkgs;
     haskell.lib.compose.justStaticExecutables haskellPackages.darcs
   );
 
-  darktable = callPackage ../by-name/da/darktable/package.nix {
-    lua = lua5_4;
-    pugixml = pugixml.override { shared = true; };
-  };
-
   datadog-agent = callPackage ../tools/networking/dd-agent/datadog-agent.nix {
     pythonPackages = datadog-integrations-core { };
   };
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index 757274fd1dc7..e58ef07ca41f 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -226,6 +226,23 @@ let
       '';
     };
 
+    allowUnfreePackages = mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "ut1999" ];
+      description = ''
+        Allows specific unfree packages to be used.
+
+        This option composes with `nixpkgs.config.allowUnfreePredicate` by also allowing the listed package names.
+
+        Unlike `nixpkgs.config.allowUnfreePredicate`, this option merges additively, similar to `environment.systemPackages`.
+        This enables defining allowed unfree packages in multiple modules, close to where they are used.
+
+        This avoids the need to centralize all unfree package declarations or globally enable unfree packages via
+        `nixpkgs.config.allowUnfree = true`.
+      '';
+    };
+
     allowBroken = mkOption {
       type = types.bool;
       default = false;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 29e619bb19de..c8b4a2eee9b7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -35269,6 +35269,23 @@ with self;
     };
   };
 
+  TestStrict = buildPerlPackage {
+    pname = "Test-Strict";
+    version = "0.54";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MA/MANWAR/Test-Strict-0.54.tar.gz";
+      hash = "sha256-9oB1F4I6kKlrQN7q7ZqggAgt7UtQpRIE9b4efOd0yFw=";
+    };
+    buildInputs = [ IOStringy ];
+    meta = {
+      description = "Check syntax, presence of use strict; and test coverage";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   TestSubCalls = buildPerlPackage {
     pname = "Test-SubCalls";
     version = "1.10";