diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 69a83c07c5e3..16e0a385c0b8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1903,6 +1903,12 @@
     matrix = "@schuelermine:matrix.org";
     keys = [ { fingerprint = "CDBF ECA8 36FE E340 1CEB  58FF BA34 EE1A BA3A 0955"; } ];
   }; # currently on hiatus, please do not ping until this notice is removed (or if it’s been like two years)
+  anstylian = {
+    email = "agathangelos.stylianidis@gmail.com";
+    github = "anstylian";
+    githubId = 11269403;
+    name = "Angelos Stylinidis";
+  };
   anthonyroussel = {
     email = "anthony@roussel.dev";
     github = "anthonyroussel";
@@ -10815,7 +10821,7 @@
   };
   husjon = {
     name = "Jon Erling Hustadnes";
-    email = "jonerling.hustadnes+nixpkgs@gmail.com";
+    email = "jonerling.hustadnes+nixpkgs@proton.me";
     github = "husjon";
     githubId = 554229;
   };
@@ -14534,6 +14540,12 @@
     github = "juuyokka";
     githubId = 15185244;
   };
+  Ladas552 = {
+    email = "l.tokshalov@gmail.com";
+    github = "Ladas552";
+    githubId = 94762349;
+    name = "Ladas552";
+  };
   lafrenierejm = {
     email = "joseph@lafreniere.xyz";
     github = "lafrenierejm";
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 0344a0aa2f3c..89800b309fe9 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -76,6 +76,18 @@
   "module-services-tandoor-recipes-migrating-media-option-disallow-access": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-disallow-access"
   ],
+  "module-virtualisation-xen": [
+    "index.html#module-virtualisation-xen"
+  ],
+  "module-virtualisation-xen-installation-dom0": [
+    "index.html#module-virtualisation-xen-installation-dom0"
+  ],
+  "module-virtualisation-xen-installation-domU": [
+    "index.html#module-virtualisation-xen-installation-domU"
+  ],
+  "module-virtualisation-xen-introduction": [
+    "index.html#module-virtualisation-xen-introduction"
+  ],
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 6625d7876ed7..d1fe153f0df1 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -133,6 +133,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
 
+- Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
+
 - `services.frp` now supports multiple instances through `services.frp.instances` to make it possible to run multiple frp clients or servers at the same time.
 
 - `hyphen` now supports over 40 language variants through `hyphenDicts` and now allows to enable all supported languages through `hyphenDicts.all`.
diff --git a/nixos/modules/services/desktop-managers/budgie.nix b/nixos/modules/services/desktop-managers/budgie.nix
index 80511c4e9116..a32caa838779 100644
--- a/nixos/modules/services/desktop-managers/budgie.nix
+++ b/nixos/modules/services/desktop-managers/budgie.nix
@@ -156,15 +156,19 @@ in
       fi
     '';
 
+    # https://docs.buddiesofbudgie.org/10.10/developer/workflow/building-budgie-desktop/#compositor-recommendations
+    programs.labwc.enable = mkDefault true;
+    programs.gtklock.enable = mkDefault true;
+
     environment.systemPackages =
       with pkgs;
       [
         # Budgie Desktop.
         budgie-backgrounds
         budgie-control-center'
+        budgie-desktop-services
         (budgie-desktop-with-plugins.override { plugins = cfg.extraPlugins; })
         budgie-desktop-view
-        budgie-screensaver
         budgie-session
 
         # Required by Budgie Menu.
@@ -190,6 +194,17 @@ in
         mate.mate-system-monitor
         vlc
 
+        # Supplemental tooling.
+        # See budgie-desktop's with-runtime-dependencies meson option.
+        gammastep
+        grim
+        killall
+        slurp
+        swaybg
+        swayidle
+        wdisplays
+        wlopm
+
         # Desktop themes.
         qogir-theme
         qogir-icon-theme
@@ -224,9 +239,6 @@ in
     services.xserver.updateDbusEnvironment = true;
     programs.dconf.enable = true;
 
-    # Required by Budgie Screensaver.
-    security.pam.services.budgie-screensaver = { };
-
     # Required by Budgie's Polkit Dialog.
     security.polkit.enable = mkDefault true;
 
@@ -240,6 +252,7 @@ in
     xdg.portal.enable = mkDefault true; # for BCC's Applications panel.
     xdg.portal.extraPortals = with pkgs; [
       xdg-desktop-portal-gtk # provides a XDG Portals implementation.
+      xdg-desktop-portal-wlr # for screenshot and screencast.
     ];
     xdg.portal.configPackages = mkDefault [ pkgs.budgie-desktop ];
 
@@ -274,11 +287,7 @@ in
     # Register packages for DBus.
     services.dbus.packages = [
       budgie-control-center'
-    ];
-
-    # Register packages for udev.
-    services.udev.packages = with pkgs; [
-      magpie
+      pkgs.budgie-desktop-services
     ];
 
     # Shell integration for MATE Terminal.
diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 8b7cfce32514..4d16ddfd9a22 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -13,7 +13,6 @@ let
     mkOptionDefault
     mkIf
     literalExpression
-    optionalString
     types
     ;
   inherit (lib.generators)
@@ -79,7 +78,6 @@ let
       mkSection = (
         depth: attrs:
         let
-          atoms = extractAtoms attrs;
           sections = extractSections attrs;
           sectionHeadingLeft = lib.concatStrings (lib.replicate (depth + 1) "[");
           sectionHeadingRight = lib.concatStrings (lib.replicate (depth + 1) "]");
@@ -103,7 +101,8 @@ let
     else
       (configObjIni { }).generate "public-settings.ini" allSettings;
 
-  sabnzbdIniPath = "/var/lib/${cfg.stateDir}/sabnzbd.ini";
+  sabnzbdIniPath =
+    if cfg.configFile != null then cfg.configFile else "/var/lib/${cfg.stateDir}/sabnzbd.ini";
 in
 
 {
@@ -115,8 +114,12 @@ in
 
       configFile = mkOption {
         type = types.nullOr types.path;
-        default = null;
-        description = "Path to config file (deprecated, use `settings` instead)";
+        default =
+          if lib.versionOlder config.system.stateVersion "26.05" then
+            "/var/lib/sabnzbd/sabnzbd.ini"
+          else
+            null;
+        description = "Path to config file (deprecated, use `settings` instead and set this value to null)";
       };
 
       stateDir = mkOption {
@@ -511,7 +514,10 @@ in
     systemd.services.sabnzbd =
       let
         files =
-          (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
+          if cfg.configFile != null then
+            [ sabnzbdIniPath ]
+          else
+            (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
         iniPathQuoted = lib.escapeShellArg sabnzbdIniPath;
       in
       {
@@ -531,11 +537,20 @@ in
 
           ${lib.toShellVar "files" files}
 
+          tmpfile=$(mktemp)
+
           ${lib.getExe (pkgs.python3.withPackages (py: [ py.configobj ]))} \
             ${./config_merge.py} \
-            "''${files[@]}" | \
-          install -D -m ${if cfg.allowConfigWrite then "600" else "400"} \
-            -o '${cfg.user}' -g '${cfg.group}' /dev/stdin ${iniPathQuoted}
+            "''${files[@]}" \
+            > "$tmpfile"
+
+          install -D \
+            -m ${if cfg.allowConfigWrite then "600" else "400"} \
+            -o '${cfg.user}' -g '${cfg.group}' \
+            "$tmpfile" \
+            ${iniPathQuoted}
+
+          rm "$tmpfile"
         '';
       };
 
diff --git a/nixos/modules/services/system/userborn.nix b/nixos/modules/services/system/userborn.nix
index f9595fe72654..5649b438965b 100644
--- a/nixos/modules/services/system/userborn.nix
+++ b/nixos/modules/services/system/userborn.nix
@@ -38,6 +38,7 @@ let
   userbornStaticFiles =
     pkgs.runCommand "static-userborn" { }
       "mkdir -p $out; ${lib.getExe cfg.package} ${userbornConfigJson} $out";
+  previousConfigPath = "/var/lib/userborn/previous-userborn.json";
 
   immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
   # The filenames created by userborn.
@@ -155,6 +156,10 @@ in
         # This way we don't have to re-declare all the dependencies to other
         # services again.
         aliases = [ "systemd-sysusers.service" ];
+        environment = {
+          USERBORN_MUTABLE_USERS = lib.boolToString userCfg.mutableUsers;
+          USERBORN_PREVIOUS_CONFIG = lib.mkIf userCfg.mutableUsers previousConfigPath;
+        };
 
         unitConfig = {
           Description = "Manage Users and Groups";
@@ -165,6 +170,7 @@ in
           Type = "oneshot";
           RemainAfterExit = true;
           TimeoutSec = "90s";
+          StateDirectory = "userborn";
 
           ExecStart = "${lib.getExe cfg.package} ${userbornConfigJson} ${cfg.passwordFilesLocation}";
 
@@ -179,13 +185,18 @@ in
             ))
           ];
 
-          # Make the source files read-only after userborn has finished.
-          ExecStartPost = lib.mkIf (!userCfg.mutableUsers) (
-            lib.map (
-              file:
-              "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
-            ) passwordFiles
-          );
+          ExecStartPost =
+            if userCfg.mutableUsers then
+              # Store the config somewhere for the next invocation
+              [
+                "${pkgs.coreutils}/bin/ln -sf ${userbornConfigJson} ${previousConfigPath}"
+              ]
+            else
+              # Make the source files read-only after userborn has finished.
+              (lib.map (
+                file:
+                "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
+              ) passwordFiles);
         };
       };
     };
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index 409a3ec30dbb..bbd6bfb57751 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -935,5 +935,8 @@ in
       };
     };
   };
-  meta.maintainers = teams.xen.members;
+  meta = {
+    doc = ./xen.md;
+    maintainers = teams.xen.members;
+  };
 }
diff --git a/nixos/modules/virtualisation/xen.md b/nixos/modules/virtualisation/xen.md
new file mode 100644
index 000000000000..89a0fa55237a
--- /dev/null
+++ b/nixos/modules/virtualisation/xen.md
@@ -0,0 +1,62 @@
+# Xen Project Hypervisor {#module-virtualisation-xen}
+
+## Introduction {#module-virtualisation-xen-introduction}
+
+The [**Xen Project Hypervisor**](https://xenproject.org/) is an open-source
+type-1 virtual machine manager which allows multiple virtual machines, known as
+*domains*, to run concurrently with the host on the physical machine. This is
+unlike a typical type-2 hypervisor, such as QEMU, where the virtual machines run
+as applications on top of the host. NixOS runs as the privileged *Domain 0*, and
+can paravirtualise (PV Mode) or fully virtualise (HVM Mode) unprivileged domains
+(`domUs`).
+
+Xen is security-supported in NixOS. All
+[Xen Security Advisories](https://xenbits.xenproject.org/xsa) are patched within
+hours of release, and generally reach the binary cache channels within a couple
+of days.
+
+## Domain 0 Installation {#module-virtualisation-xen-installation-dom0}
+
+Xen may be used as a Domain 0 since
+[NixOS 24.11](#sec-release-24.11-highlights), using the
+{option}`virtualisation.xen.enable` option. There are various hardware and
+software requirements to running a Xen Domain 0; the module is configured to
+prevent running Xen on a NixOS system that does not meet the software
+requirements. (i.e. a NixOS system that uses the legacy, scripted initial
+ramdisk.) The module does not yet check if the hardware requirements are met:
+please manually ensure that the target machine supports
+[SLAT](Second_Level_Address_Translation) and
+[IOMMU](https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit),
+the latter being required only for non-PV domains to be virtualised.
+
+The boot menu on a Xen-enabled NixOS system will show duplicate entries for each
+generation: one boots a normal NixOS system, and the other boots into the Xen
+Project Hypervisor. The [`systemd-boot`](#opt-boot.loader.systemd-boot.enable)
+and [Limine](#opt-boot.loader.limine.enable) bootloaders are the only supported
+boot methods at this time.
+
+Xen may be managed through various frontend configuration systems. `libxenlight`
+is one such configuration system, and is built into all Xen systems. The `xl`
+command is the primary command-line interface to `libxenlight`, and is capable
+of managing a NixOS Domain 0.
+
+## Unprivileged Domain Installation {#module-virtualisation-xen-installation-domU}
+
+Known generically as guests, unprivileged domains running NixOS may import the
+[`xen-domU.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/xen-domU.nix)
+profile in their configurations to automatically enable various recommended
+optimisations which are relevant for unprivileged domains.
+
+:::{.example}
+
+# Import the Xen Unprivileged Domain profile into a NixOS configuration
+
+```nix
+{
+  imports = [
+    <nixpkgs/nixos/modules/virtualisation/xen-domU.nix>
+  ];
+}
+```
+
+:::
diff --git a/nixos/tests/budgie.nix b/nixos/tests/budgie.nix
index a9bb55756797..b1aa2798e8b0 100644
--- a/nixos/tests/budgie.nix
+++ b/nixos/tests/budgie.nix
@@ -29,37 +29,38 @@
           pkgs.budgie-analogue-clock-applet
         ];
       };
+
+      environment.systemPackages = [ pkgs.wlrctl ];
     };
 
+  enableOCR = true;
+
   testScript =
     { nodes, ... }:
     let
       user = nodes.machine.users.users.alice;
-      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
-      su = command: "su - ${user.name} -c '${env} ${command}'";
+      env = "XDG_RUNTIME_DIR=/run/user/${toString user.uid}";
     in
     ''
       with subtest("Wait for login"):
-          machine.wait_for_x()
+          machine.wait_for_unit("display-manager.service")
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
           machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"')
-          machine.wait_for_file("${user.home}/.Xauthority")
-          machine.succeed("xauth merge ${user.home}/.Xauthority")
+          machine.wait_until_succeeds('journalctl --grep "Compositor is fully initialized"')
 
       with subtest("Check that logging in has given the user ownership of devices"):
           # Change back to /dev/snd/timer after systemd-258.1
           machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Budgie session components actually start"):
-          for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "bsd-media-keys", "gsd-xsettings"]:
+          for i in ["budgie-daemon", "budgie-panel", "labwc", "budgie-session", "swaybg", "swayidle"]:
               machine.wait_until_succeeds(f"pgrep {i}")
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.gnome-settings-daemon}/libexec/gsd-sound")
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.budgie-desktop-services}/bin/org.buddiesofbudgie.Services")
           machine.wait_until_succeeds("pgrep -xf /run/current-system/sw/bin/org.buddiesofbudgie.budgie-desktop-view")
-          # We don't check xwininfo for budgie-wm.
-          # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754
-          machine.wait_for_window("budgie-daemon")
-          machine.wait_for_window("budgie-panel")
 
       with subtest("Check if various environment variables are set"):
-          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ"
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-panel)/environ"
           machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie'")
           machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'")
           # From the nixos/budgie module
@@ -67,28 +68,22 @@
 
       with subtest("Open run dialog"):
           machine.send_key("alt-f2")
-          machine.wait_for_window("budgie-run-dialog")
+          machine.wait_until_succeeds("pgrep -xf budgie-run-dialog")
           machine.sleep(2)
           machine.screenshot("run_dialog")
           machine.send_key("esc")
 
       with subtest("Open Budgie Control Center"):
-          machine.succeed("${su "budgie-control-center >&2 &"}")
-          machine.wait_for_window("Budgie Control Center")
-
-      with subtest("Lock the screen"):
-          machine.succeed("${su "budgie-screensaver-command -l >&2 &"}")
-          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is active'")
-          machine.sleep(2)
-          machine.send_chars("${user.password}", delay=0.5)
-          machine.screenshot("budgie_screensaver")
-          machine.send_chars("\n")
-          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is inactive'")
-          machine.sleep(2)
+          machine.succeed("su - ${user.name} -c '${env} budgie-control-center >&2 &'")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} wlrctl toplevel list | grep org.buddiesofbudgie.ControlCenter'")
+          machine.wait_for_text("Network|Ethernet|Control|Connected")
 
       with subtest("Open GNOME terminal"):
-          machine.succeed("${su "gnome-terminal"}")
-          machine.wait_for_window("${user.name}@machine: ~")
+          machine.succeed("su - ${user.name} -c '${env} gnome-terminal >&2 &'")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} wlrctl toplevel list | grep ${user.name}@machine'")
+
+      with subtest("Check if labwc bridge is working"):
+          machine.wait_until_succeeds("cat /home/${user.name}/.config/budgie-desktop/labwc/rc.xml | grep Qogir")
 
       with subtest("Check if Budgie has ever coredumped"):
           machine.fail("coredumpctl --json=short | grep budgie")
diff --git a/nixos/tests/userborn-immutable-etc.nix b/nixos/tests/userborn-immutable-etc.nix
index b4b1b56fc2fd..dc34537b9b51 100644
--- a/nixos/tests/userborn-immutable-etc.nix
+++ b/nixos/tests/userborn-immutable-etc.nix
@@ -21,7 +21,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -38,7 +38,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-immutable-users.nix b/nixos/tests/userborn-immutable-users.nix
index 887d2d312eb7..46ea6d4a4be2 100644
--- a/nixos/tests/userborn-immutable-users.nix
+++ b/nixos/tests/userborn-immutable-users.nix
@@ -16,7 +16,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -33,7 +33,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-mutable-etc.nix b/nixos/tests/userborn-mutable-etc.nix
index 6199b84ce71d..020c29a048b9 100644
--- a/nixos/tests/userborn-mutable-etc.nix
+++ b/nixos/tests/userborn-mutable-etc.nix
@@ -20,7 +20,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -37,7 +37,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-mutable-users.nix b/nixos/tests/userborn-mutable-users.nix
index e2b9c3df4953..8f23afce9b9a 100644
--- a/nixos/tests/userborn-mutable-users.nix
+++ b/nixos/tests/userborn-mutable-users.nix
@@ -16,7 +16,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -34,7 +34,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
@@ -42,6 +42,10 @@ in
             new-normalo = {
               isNormalUser = true;
             };
+            mutable-to-declarative = {
+              isNormalUser = true;
+              description = "I'm now declaratively managed";
+            };
           };
         };
       };
@@ -54,16 +58,25 @@ in
       assert 1000 == int(machine.succeed("id --user normalo")), "normalo user doesn't have UID 1000"
       assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
 
-    with subtest("Add new user manually"):
+    with subtest("Add new user manual-normalo manually"):
       machine.succeed("useradd manual-normalo")
       assert 1001 == int(machine.succeed("id --user manual-normalo")), "manual-normalo user doesn't have UID 1001"
 
-    with subtest("Delete manual--normalo user manually"):
-      machine.succeed("userdel manual-normalo")
-
+    with subtest("Add new user mutable-to-declarative manually"):
+      machine.succeed("useradd --comment 'I was created imperatively' mutable-to-declarative")
+      assert 1002 == int(machine.succeed("id --user mutable-to-declarative")), "mutable-to-declarative user doesn't have UID 1002"
 
     machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
 
+    with subtest("manual-normalo user is still enabled"):
+      manual_normalo_shadow = machine.succeed("getent shadow manual-normalo")
+      print(manual_normalo_shadow)
+      t.assertNotIn("!*", manual_normalo_shadow, "manual-normalo user is falsely disabled")
+
+    with subtest("mutable-to-declarative user description has changed"):
+      mutable_to_declarative_passwd = machine.succeed("getent passwd mutable-to-declarative")
+      print(mutable_to_declarative_passwd)
+      t.assertIn("I'm now declaratively managed", mutable_to_declarative_passwd, "mutable-to-declarative user description is unchanged")
 
     with subtest("normalo user is disabled"):
       print(machine.succeed("getent shadow normalo"))
@@ -71,6 +84,9 @@ in
 
     with subtest("new-normalo user is created after switching to new generation"):
       print(machine.succeed("getent passwd new-normalo"))
-      assert 1001 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1001"
+      assert 1003 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1003"
+
+    with subtest("Delete manual-normalo user manually"):
+      machine.succeed("userdel manual-normalo")
   '';
 }
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index e8e44c3560d4..c5d26cd14a66 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.55";
+  version = "7.59";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-meTuaGH9zwx/sT+h0I7JRSCRPD8AryGPvoHUKbyzpHA="
+        "sha256-S4RAXWss1tPzmO0zzKfkXPrcgBqwNN5EE1jpjEZ5mYk="
       else
         {
-          x86_64-linux = "sha256-BOjS39GySB6ptiEJvwlShL4ZcDot2nsKXCAU/CeMEIc=";
-          aarch64-linux = "sha256-oqEwEQKFhpaFMqzcSc28v0njuiMi5CAGjP3fLDECUXU=";
+          x86_64-linux = "sha256-II2QOv7eHD4JtE5We1uuEuCt5RZmK6VFtZFyLEArUSc=";
+          aarch64-linux = "sha256-/iDQBnYf+1xYJ+JFFT5ikGWDmQdhe2L1o+lZr8pB+Q0=";
         }
         .${stdenv.hostPlatform.system};
   };
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index f782672bc5ef..e87c52979760 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -5093,8 +5093,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-test";
-          version = "0.43.1";
-          hash = "sha256-yiKBG1A5ahvB6iTqh2yzFzcKJlU1lu4dqd+4cygWVQ4=";
+          version = "0.44.0";
+          hash = "sha256-Qr4Ms15Nq+/yygWYBDvN5dHIKpQ0yYQjI1p/RNFMWjw=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/version-management/sublime-merge/default.nix b/pkgs/applications/version-management/sublime-merge/default.nix
index 6e91361e1d03..7526a19f0dba 100644
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@@ -11,9 +11,9 @@ in
   } { };
 
   sublime-merge-dev = common {
-    buildVersion = "2111";
+    buildVersion = "2120";
     dev = true;
-    aarch64sha256 = "ZDERtZ1NbYdc/rZYfiFPkjwSQVMvacVElRAW/PBrgCg=";
-    x64sha256 = "NgHRF8Wh3ktr0Z+efL2FTwFAdF3c0yaXNFEwcvefSy0=";
+    aarch64sha256 = "3JKxLke1l7l+fxhIJWbXbMHK5wPgjZTEWcZd9IvrdPM=";
+    x64sha256 = "N8lhSmQnj+Ee1A2eIOkhdhQnHBK3B6vFA3vrPAbYtaI=";
   } { };
 }
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 7a017714b26a..edc86454c5ef 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.32";
+  version = "2.2.34";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-Wxzv1iLJ+OWw+g6ndBX36AR2v9cSu2uZysegz97+XaM=";
+    hash = "sha256-58NFlB6viWXG13J+RBzMj6LlYFClpWpGQ/aCNxJ5wKQ=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/by-name/_9/_9base/package.nix b/pkgs/by-name/_9/_9base/package.nix
index 2b4f76e55f42..47e81a9b919e 100644
--- a/pkgs/by-name/_9/_9base/package.nix
+++ b/pkgs/by-name/_9/_9base/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchgit,
   pkg-config,
+  unstableGitUpdater,
   patches ? [ ],
   pkgsBuildHost,
   enableStatic ? stdenv.hostPlatform.isStatic,
@@ -10,7 +11,7 @@
 
 stdenv.mkDerivation {
   pname = "9base";
-  version = "unstable-2019-09-11";
+  version = "6-unstable-2019-09-13";
 
   src = fetchgit {
     url = "https://git.suckless.org/9base";
@@ -70,6 +71,8 @@ stdenv.mkDerivation {
     "troff"
   ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     homepage = "https://tools.suckless.org/9base/";
     description = "Port of various original Plan 9 tools for Unix, based on plan9port";
diff --git a/pkgs/by-name/ac/accelergy/package.nix b/pkgs/by-name/ac/accelergy/package.nix
index f151bbe41e0f..e071addd7197 100644
--- a/pkgs/by-name/ac/accelergy/package.nix
+++ b/pkgs/by-name/ac/accelergy/package.nix
@@ -2,18 +2,19 @@
   lib,
   fetchFromGitHub,
   python3Packages,
+  unstableGitUpdater,
 }:
 
 python3Packages.buildPythonApplication {
   pname = "accelergy";
-  version = "unstable-2022-05-03";
+  version = "0.1-unstable-2025-05-26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Accelergy-Project";
     repo = "accelergy";
-    rev = "34df8e87a889ae55cecba58992d4573466b40565";
-    hash = "sha256-SRtt1EocHy5fKszpoumC+mOK/qhreoA2/Ff1wcu5WKo=";
+    rev = "6911d15686ee7efdceba7d95605102df4472ae3a";
+    hash = "sha256-YgJbmxJfuw7jk+Ssj5r3cmJYSSepf7aw+Ti3a9brm6o=";
   };
 
   build-system = with python3Packages; [
@@ -24,8 +25,16 @@ python3Packages.buildPythonApplication {
     pyyaml
     yamlordereddictloader
     pyfiglet
+    ruamel-yaml
+    deepdiff
+    jinja2
   ];
 
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+    tagFormat = "v*";
+  };
+
   meta = {
     description = "Architecture-level energy/area estimator for accelerator designs";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/ae/aefs/package.nix b/pkgs/by-name/ae/aefs/package.nix
index 962a1e817a1a..09e0face1105 100644
--- a/pkgs/by-name/ae/aefs/package.nix
+++ b/pkgs/by-name/ae/aefs/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
   autoreconfHook,
   fuse,
   git,
@@ -9,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "aefs";
-  version = "unstable-2015-05-06";
+  version = "0-unstable-2015-05-06";
 
   src = fetchFromGitHub {
     owner = "edolstra";
@@ -40,6 +41,10 @@ stdenv.mkDerivation {
 
   buildInputs = [ fuse ];
 
+  passthru.updateScript = unstableGitUpdater {
+    hardcodeZeroVersion = true;
+  };
+
   meta = {
     homepage = "https://github.com/edolstra/aefs";
     description = "Cryptographic filesystem implemented in userspace using FUSE";
diff --git a/pkgs/by-name/bp/bpflinter/package.nix b/pkgs/by-name/bp/bpflinter/package.nix
new file mode 100644
index 000000000000..c20e970d9e3f
--- /dev/null
+++ b/pkgs/by-name/bp/bpflinter/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchpatch,
+  nix-update-script,
+  fetchCrate,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bpflinter";
+  version = "0.1.5";
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-oX4fgUKOASiI/NMFSjr6afmyg1VBK44lqni+xBXlZLo=";
+  };
+
+  cargoHash = "sha256-3TIWrqgePnBMEJFB5fkch5ycU4NXE6JlbUpq9/8DbHc=";
+
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    mainProgram = "bpflinter";
+    description = "Linting functionality for BPF C programs";
+    homepage = "https://github.com/d-e-s-o/bpflint";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ fzakaria ];
+  };
+})
diff --git a/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix b/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
index d050b32d7ff1..67a757efa13d 100644
--- a/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
+++ b/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-analogue-clock-applet";
-  version = "2.2";
+  version = "2.2-unstable-2026-01-13";
 
   src = fetchFromGitHub {
     owner = "samlane-ma";
     repo = "analogue-clock-applet";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-8kqDEzcUqg/TvwpazYQt1oQDVC00fOxFLVsKYMDuV9I=";
+    rev = "22b04faeea8f95eb83ad96ae89529560811d76d9";
+    hash = "sha256-8ZFExgE1aJ8XN4+ugSzI34UjdPHbtbhJ+3xetcLZ6sg=";
   };
 
   nativeBuildInputs = [
@@ -38,18 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
     libpeas2
   ];
 
-  postPatch = ''
-    # https://github.com/samlane-ma/analogue-clock-applet/issues/7
-    substituteInPlace budgie-analogue-clock-widget/src/meson.build \
-      --replace-fail "dependency('budgie-raven-plugin-1.0')" "dependency('budgie-raven-plugin-2.0')"
-  '';
-
-  mesonFlags = [
-    # The meson option actually enables libpeas2 support
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
-    "-Dfor-wayland=true"
-  ];
-
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/bu/budgie-control-center/introduction.list b/pkgs/by-name/bu/budgie-control-center/introduction.list
new file mode 100644
index 000000000000..520e673a2c03
--- /dev/null
+++ b/pkgs/by-name/bu/budgie-control-center/introduction.list
@@ -0,0 +1,5 @@
+# Introduction panel default applications
+# This file contains full paths to .desktop files to display
+# Lines starting with # are comments
+@wdisplays@/share/applications/network.cycles.wdisplays.desktop
+@budgie_desktop@/share/applications/org.buddiesofbudgie.BudgieDesktopSettings.desktop
diff --git a/pkgs/by-name/bu/budgie-control-center/package.nix b/pkgs/by-name/bu/budgie-control-center/package.nix
index 1dc34f6398af..341af1c971dc 100644
--- a/pkgs/by-name/bu/budgie-control-center/package.nix
+++ b/pkgs/by-name/bu/budgie-control-center/package.nix
@@ -4,11 +4,8 @@
   fetchFromGitHub,
   replaceVars,
   accountsservice,
-  adwaita-icon-theme,
   budgie-desktop,
   cheese,
-  clutter,
-  clutter-gtk,
   colord,
   colord-gtk,
   cups,
@@ -25,14 +22,11 @@
   gnome-bluetooth_1_0,
   gnome-color-manager,
   gnome-desktop,
-  gnome-remote-desktop,
   gnome-settings-daemon,
-  gnome-user-share,
   gsettings-desktop-schemas,
   gsound,
   gtk3,
   ibus,
-  libcanberra-gtk3,
   libepoxy,
   libgnomekbd,
   libgtop,
@@ -49,7 +43,6 @@
   libxslt,
   meson,
   modemmanager,
-  mutter,
   networkmanager,
   networkmanagerapplet,
   ninja,
@@ -63,21 +56,30 @@
   tzdata,
   udisks,
   upower,
+  wdisplays,
   webp-pixbuf-loader,
   wrapGAppsHook3,
   enableSshSocket ? false,
 }:
 
+let
+  introduction_list = (
+    replaceVars ./introduction.list {
+      budgie_desktop = budgie-desktop;
+      inherit wdisplays;
+    }
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-control-center";
-  version = "1.4.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-control-center";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Je3X1V4U2t0LMxWwtoYZKEI56IS4zK/w6OL615tqKkk=";
+    hash = "sha256-sdAzReZVAZ5omLOhly/l3buiw01eem+k9+3RbVPzS2g=";
   };
 
   patches = [
@@ -106,8 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     accountsservice
-    clutter
-    clutter-gtk
     colord
     colord-gtk
     fontconfig
@@ -117,18 +117,13 @@ stdenv.mkDerivation (finalAttrs: {
     glib-networking
     gnome-desktop
     gst_all_1.gstreamer
-    adwaita-icon-theme
     cheese
     gnome-bluetooth_1_0
-    gnome-remote-desktop
     gnome-settings-daemon
-    gnome-user-share
-    mutter
     gsettings-desktop-schemas
     gsound
     gtk3
     ibus
-    libcanberra-gtk3
     libepoxy
     libgtop
     libgudev
@@ -137,7 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
     libnma
     libpulseaudio
     libpwquality
-    librsvg
     libsecret
     libwacom
     libxml2
@@ -167,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: {
         ];
       }
     }"
+
+    install -Dm644 ${introduction_list} $out/share/budgie-control-center/introduction/introduction.list
   '';
 
   preFixup = ''
@@ -176,18 +172,11 @@ stdenv.mkDerivation (finalAttrs: {
       # Thumbnailers (for setting user profile pictures)
       --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
       --prefix XDG_DATA_DIRS : "${librsvg}/share"
-      # WM keyboard shortcuts
-      --prefix XDG_DATA_DIRS : "${mutter}/share"
     )
   '';
 
   separateDebugInfo = true;
 
-  # Fix GCC 14 build.
-  # cc-display-panel.c:962:41: error: passing argument 1 of 'gtk_widget_set_sensitive'
-  # from incompatible pointer type [-Wincompatible-pointer-types]
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
-
   passthru = {
     tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/bu/budgie-desktop-services/package.nix b/pkgs/by-name/bu/budgie-desktop-services/package.nix
new file mode 100644
index 000000000000..4bf24d317998
--- /dev/null
+++ b/pkgs/by-name/bu/budgie-desktop-services/package.nix
@@ -0,0 +1,50 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitea,
+  cmake,
+  kdePackages,
+  qt6,
+  toml11,
+  buildPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "budgie-desktop-services";
+  version = "1.0.2";
+
+  src = fetchFromGitea {
+    domain = "forge.moderndesktop.dev";
+    owner = "BuddiesOfBudgie";
+    repo = "budgie-desktop-services";
+    tag = finalAttrs.version;
+    hash = "sha256-YOa2pUePp33d1xKF7HrBX2EkjEQsRmzoiJMq72fl3CE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    kdePackages.extra-cmake-modules
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    kdePackages.kwayland
+    qt6.qtbase
+    toml11
+  ];
+
+  postPatch = ''
+    substituteInPlace cmake/ECMFindModuleHelpersStub.cmake --replace-fail \
+      '/usr/share/ECM/modules//ECMFindModuleHelpers.cmake' \
+      '${buildPackages.kdePackages.extra-cmake-modules}/share/ECM/modules/ECMFindModuleHelpers.cmake'
+  '';
+
+  meta = {
+    description = "Future central hub and orchestrator for Budgie Desktop";
+    mainProgram = "org.buddiesofbudgie.Services";
+    homepage = "https://forge.moderndesktop.dev/BuddiesOfBudgie/budgie-desktop-services";
+    license = lib.licenses.mpl20;
+    teams = [ lib.teams.budgie ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/bu/budgie-desktop-view/package.nix b/pkgs/by-name/bu/budgie-desktop-view/package.nix
index f59d65b5d73e..3256db4b1240 100644
--- a/pkgs/by-name/bu/budgie-desktop-view/package.nix
+++ b/pkgs/by-name/bu/budgie-desktop-view/package.nix
@@ -5,7 +5,9 @@
   desktop-file-utils,
   glib,
   gtk3,
+  gtk-layer-shell,
   intltool,
+  libxfce4windowing,
   meson,
   ninja,
   nix-update-script,
@@ -16,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-desktop-view";
-  version = "1.3";
+  version = "10.10.1";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop-view";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k6VfAGWvUarhBFnREasOvWH3M9uuT5SFUpMFmKo1fmE=";
+    hash = "sha256-ro+/Aqsyr9py3SEdsRg+eiQLDkFI0wI4MMdCyH02E3U=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     glib
     gtk3
+    gtk-layer-shell
+    libxfce4windowing
   ];
 
   mesonFlags = [ (lib.mesonBool "werror" false) ];
diff --git a/pkgs/by-name/bu/budgie-desktop/package.nix b/pkgs/by-name/bu/budgie-desktop/package.nix
index 29e729bfa3d3..0eb71d8165a3 100644
--- a/pkgs/by-name/bu/budgie-desktop/package.nix
+++ b/pkgs/by-name/bu/budgie-desktop/package.nix
@@ -4,58 +4,61 @@
   fetchFromGitHub,
   accountsservice,
   alsa-lib,
-  budgie-screensaver,
+  budgie-desktop-services,
+  budgie-session,
   docbook-xsl-nons,
   glib,
   gnome-desktop,
   gnome-settings-daemon,
   gobject-introspection,
-  graphene,
   gst_all_1,
   gtk-doc,
   gtk3,
+  gtk-layer-shell,
   ibus,
   intltool,
   libcanberra-gtk3,
   libgee,
-  libGL,
-  libgudev,
   libnotify,
   libpeas2,
   libpulseaudio,
   libuuid,
   libwacom,
   libwnck,
-  magpie,
-  libgbm,
+  libxfce4windowing,
   meson,
   mutter,
   ninja,
   nix-update-script,
-  nixosTests,
   pkg-config,
-  polkit,
+  python3,
   sassc,
   testers,
-  udev,
   upower,
   vala,
   validatePkgConfig,
-  libxfce4windowing,
   wrapGAppsHook3,
-  zenity,
 }:
 
+let
+  pythonEnv = python3.withPackages (
+    pp: with pp; [
+      psutil
+      pygobject3
+      systemd-python
+    ]
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-desktop";
-  version = "10.9.4";
+  version = "10.10.1";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-e1kkmzSYX8TwiY0IIZYIK/FgMbZ/8PqkUn8pk3CcXHU=";
+    hash = "sha256-6SRnub0FMRE9AcHwsnYH4WMdG2kqEpl5dfHy56FwrGU=";
   };
 
   outputs = [
@@ -76,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    sassc
     vala
     validatePkgConfig
     wrapGAppsHook3
@@ -84,54 +88,50 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     accountsservice
     alsa-lib
-    budgie-screensaver
     glib
     gnome-desktop
     gnome-settings-daemon
-    mutter
-    zenity
-    graphene
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gtk3
+    gtk-layer-shell
     ibus
     libcanberra-gtk3
     libgee
-    libGL
-    libgudev
     libnotify
     libpulseaudio
     libuuid
     libwacom
     libwnck
-    magpie
-    libgbm
-    polkit
-    sassc
-    udev
-    upower
     libxfce4windowing
+    mutter # org.gnome.mutter.keybindings
+    pythonEnv
+    upower
   ];
 
   propagatedBuildInputs = [
-    # budgie-1.0.pc, budgie-raven-plugin-1.0.pc
+    # budgie-3.0.pc, budgie-raven-plugin-3.0.pc
     libpeas2
   ];
 
   mesonFlags = [
-    # FIXME: The meson option name is confusing
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/739#discussion_r2359421711
-    "-Dbsd-libexecdir=${gnome-settings-daemon}/libexec"
+    "-Dgsd-libexecdir=${gnome-settings-daemon}/libexec"
+    "-Dwith-runtime-dependencies=false"
   ];
 
+  postPatch = ''
+    substituteInPlace src/session/budgie-desktop.in \
+      --replace-fail "@bindir@/org.buddiesofbudgie.Services" "${lib.getExe budgie-desktop-services}" \
+      --replace-fail "@gsd_libexecdir@/budgie-session-compositor-ready" "${budgie-session}/libexec/budgie-session-compositor-ready"
+
+    chmod +x src/bridges/labwc/labwc_bridge.py
+    substituteInPlace src/bridges/labwc/org.buddiesofbudgie.labwc-bridge.desktop.in \
+      --replace-fail "Exec=python3 @libexecdir@/labwc_bridge.py" "Exec=@libexecdir@/labwc_bridge.py"
+  '';
+
   passthru = {
     providedSessions = [ "budgie-desktop" ];
-
-    tests = {
-      inherit (nixosTests) budgie;
-      pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
-    };
-
+    tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
     updateScript = nix-update-script { };
   };
 
@@ -147,8 +147,8 @@ stdenv.mkDerivation (finalAttrs: {
     teams = [ lib.teams.budgie ];
     platforms = lib.platforms.linux;
     pkgConfigModules = [
-      "budgie-2.0"
-      "budgie-raven-plugin-2.0"
+      "budgie-3.0"
+      "budgie-raven-plugin-3.0"
       "budgie-theme-1.0"
     ];
   };
diff --git a/pkgs/by-name/bu/budgie-screensaver/package.nix b/pkgs/by-name/bu/budgie-screensaver/package.nix
deleted file mode 100644
index 59c6b9dbbe44..000000000000
--- a/pkgs/by-name/bu/budgie-screensaver/package.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  dbus-glib,
-  glib,
-  gnome-desktop,
-  gtk3,
-  intltool,
-  libgnomekbd,
-  libX11,
-  linux-pam,
-  meson,
-  ninja,
-  nix-update-script,
-  pkg-config,
-  systemd,
-  testers,
-  wrapGAppsHook3,
-  libxxf86vm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "budgie-screensaver";
-  version = "5.1.0";
-
-  src = fetchFromGitHub {
-    owner = "BuddiesOfBudgie";
-    repo = "budgie-screensaver";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-N8x9hdbaMDisTbQPJedNO4UMLnCn+Q2hhm4udJZgQlc=";
-  };
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    intltool
-    meson
-    ninja
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    dbus-glib
-    glib
-    gnome-desktop
-    gtk3
-    libgnomekbd
-    libX11
-    linux-pam
-    systemd
-    libxxf86vm
-  ];
-
-  # Fix GCC 14 build.
-  # https://hydra.nixos.org/build/282164464/nixlog/3
-  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE -Wno-error=implicit-function-declaration";
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "budgie-screensaver-command --version";
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Fork of old GNOME Screensaver for purposes of providing an authentication prompt on wake";
-    homepage = "https://github.com/BuddiesOfBudgie/budgie-screensaver";
-    changelog = "https://github.com/BuddiesOfBudgie/budgie-screensaver/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl2Only;
-    teams = [ lib.teams.budgie ];
-    mainProgram = "budgie-screensaver";
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/bu/budgie-session/fix-paths.patch b/pkgs/by-name/bu/budgie-session/fix-paths.patch
index 1c011d26b549..00e4d772fa3e 100644
--- a/pkgs/by-name/bu/budgie-session/fix-paths.patch
+++ b/pkgs/by-name/bu/budgie-session/fix-paths.patch
@@ -27,9 +27,9 @@ index 327c7c7f..301ec7ee 100644
 @@ -219,7 +219,7 @@ require_dbus_session (int      argc,
          }
          new_argv[i + 2] = NULL;
-         
+ 
 -        if (!execvp ("dbus-launch", new_argv)) {
 +        if (!execvp ("@dbusLaunch@", new_argv)) {
-                 g_set_error (error, 
+                 g_set_error (error,
                               G_SPAWN_ERROR,
                               G_SPAWN_ERROR_FAILED,
diff --git a/pkgs/by-name/bu/budgie-session/package.nix b/pkgs/by-name/bu/budgie-session/package.nix
index 307d6febde4a..2aae236f1527 100644
--- a/pkgs/by-name/bu/budgie-session/package.nix
+++ b/pkgs/by-name/bu/budgie-session/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-session";
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-session";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mz+Yh3NK2Tag+MWVofFFXYYXspxhmYBD6YCiuATpZSI=";
+    hash = "sha256-KBNX1jbQ2yv+5rymoB9/w5V3bRZhBdZIJoysp9cNgn4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix b/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
index 462a6daa5bf8..3c6aefe451c5 100644
--- a/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
+++ b/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   glib,
   gtk3,
+  gtk-layer-shell,
   libgee,
   libgtop,
   libpeas2,
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     budgie-desktop
     glib
     gtk3
+    gtk-layer-shell
     libgee
     libgtop
     libpeas2
@@ -53,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     # https://github.com/prateekmedia/budgie-systemmonitor-applet/issues/4
     substituteInPlace meson.build \
       --replace-fail "dependency('libpeas-1.0', version: '>= 1.8.0')" "dependency('libpeas-2')" \
-      --replace-fail "dependency('budgie-1.0', version: '>= 2')" "dependency('budgie-2.0')"
+      --replace-fail "dependency('budgie-1.0', version: '>= 2')" "dependency('budgie-3.0')"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix b/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
index 1da60058ec24..b98c03ccff4d 100644
--- a/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
+++ b/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
@@ -5,6 +5,7 @@
   accountsservice,
   budgie-desktop,
   gtk3,
+  gtk-layer-shell,
   intltool,
   libgee,
   libpeas2,
@@ -39,11 +40,17 @@ stdenv.mkDerivation (finalAttrs: {
     accountsservice
     budgie-desktop
     gtk3
+    gtk-layer-shell
     libgee
     libpeas2
     sassc
   ];
 
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "dependency('budgie-2.0', version: '>= 3')" "dependency('budgie-3.0')"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/by/byobu/package.nix b/pkgs/by-name/by/byobu/package.nix
index df1b769f2b7d..95db27a77ca8 100644
--- a/pkgs/by-name/by/byobu/package.nix
+++ b/pkgs/by-name/by/byobu/package.nix
@@ -69,6 +69,13 @@ stdenv.mkDerivation (finalAttrs: {
       # scripts points to the filename and byobu matches against this to know
       # which backend to start with
       bname="$(basename $file)"
+
+      # Don't wrap byobu-launch to fix failing automatic byobu launches
+      # See: https://github.com/NixOS/nixpkgs/issues/131353
+      if [ $bname == "byobu-launch" ]; then
+        continue
+      fi
+
       mv "$file" "$out/bin/.$bname"
       makeWrapper "$out/bin/.$bname" "$out/bin/$bname" \
         --argv0 $bname \
diff --git a/pkgs/by-name/cc/ccls/package.nix b/pkgs/by-name/cc/ccls/package.nix
index c6c7f597277a..c4d554e3968c 100644
--- a/pkgs/by-name/cc/ccls/package.nix
+++ b/pkgs/by-name/cc/ccls/package.nix
@@ -3,29 +3,32 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  llvmPackages_19,
+  llvmPackages,
   rapidjson,
   runtimeShell,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ccls";
-  version = "0.20241108";
+  version = "0.20250815.1";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
-    rev = finalAttrs.version;
-    sha256 = "sha256-0hZ4VnscnKYBrXy58IjeoeDxja1oNq0mNaQGPmej5BA=";
+    tag = finalAttrs.version;
+    hash = "sha256-3Wi8hsjFtFa0/HCZtli2omOskIlxV7FndbJv9MOWhMo=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
-    llvmPackages_19.llvm.dev
+    llvmPackages.clang
+    llvmPackages.llvm.dev
   ];
-  buildInputs = with llvmPackages_19; [
-    libclang
-    llvm
+  buildInputs = [
+    llvmPackages.libclang
+    llvmPackages.llvm
     rapidjson
   ];
 
@@ -35,13 +38,13 @@ stdenv.mkDerivation (finalAttrs: {
     cmakeFlagsArray+=(-DCMAKE_CXX_FLAGS="-fvisibility=hidden -fno-rtti")
   '';
 
-  clang = llvmPackages_19.clang;
-  shell = runtimeShell;
-
   postFixup = ''
     export wrapped=".ccls-wrapped"
     mv $out/bin/ccls $out/bin/$wrapped
-    substituteAll ${./wrapper} $out/bin/ccls
+    substitute ${./wrapper} $out/bin/ccls \
+      --replace-fail '@clang@' '${llvmPackages.clang}' \
+      --replace-fail '@shell@' '${runtimeShell}' \
+      --replace-fail '@wrapped@' "$wrapped"
     chmod --reference=$out/bin/$wrapped $out/bin/ccls
   '';
 
@@ -51,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/MaskRay/ccls";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [
-      mic92
-      tobim
+    maintainers = [
+      lib.maintainers.mic92
+      lib.maintainers.tobim
     ];
   };
 })
diff --git a/pkgs/by-name/cc/ccls/wrapper b/pkgs/by-name/cc/ccls/wrapper
index 294b60893a3f..703bd88cfaed 100644
--- a/pkgs/by-name/cc/ccls/wrapper
+++ b/pkgs/by-name/cc/ccls/wrapper
@@ -1,9 +1,11 @@
 #! @shell@ -e
 
+dirpath=$(CDPATH=  cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
 printf -v extraArgs ',\"%s\"' \
   $(cat @clang@/nix-support/libc-cflags \
         @clang@/nix-support/libcxx-cxxflags) \
   ${NIX_CFLAGS_COMPILE}
 initString="--init={\"clang\":{\"extraArgs\":[${extraArgs:1}],\"resourceDir\":\"@clang@/resource-root\"}}"
 
-exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
+exec -a "$0" "$dirpath/@wrapped@" "${initString}" "$@"
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index d2bbfcbea610..3a52e1378bf7 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.12.3.21-stable";
-  rev = "7c3f65751609dab4f2f66de305cbc96dbeb1c4f2";
-  hash = "sha256-1cPAEh8CuKGLcQhUSAMXE8sR3pStzVEtPpgUTj2z0cw=";
+  version = "25.12.4.35-stable";
+  rev = "4b2fbdcba83cf43fcf641e8dc492dfe0eaddce1a";
+  hash = "sha256-XC6Mt+XmCcRp4V0U8RPBIqPNZdN3KdSz8IDh49ZcWBE=";
   lts = false;
 }
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 22e004a969dd..ebd4a3f3d846 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.6.3";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-J9h4G+4jv02/gbpHd/THLAxxII/hlmsFuaJUTU8TMgQ=";
+    hash = "sha256-aH2sm7GkHbjy0/KwgyCIpAFNHDmJURd4xyn+51MCr+Y=";
   };
 
   # Fix CMake 4 compatibility
diff --git a/pkgs/by-name/de/delly/package.nix b/pkgs/by-name/de/delly/package.nix
index 7e9777ad1777..b85de53d7b2c 100644
--- a/pkgs/by-name/de/delly/package.nix
+++ b/pkgs/by-name/de/delly/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "delly";
-  version = "1.5.0";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "dellytools";
     repo = "delly";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OoQivDDoYtYYPsl5U4hJGE7b+IU/jrqWejiXY5Py4n4=";
+    hash = "sha256-wlaRHCRcbj4Hw7PVYeB6N1bMS4FL3gPo1uC1OOmJwuA=";
   };
 
   postPatch = lib.optionalString stdenv.cc.isClang ''
diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index cf5419c434aa..87ea62df7ab7 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.81.0";
+  version = "1.82.0";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:d26fd269228ce287141aef81ef54e23a0001d2c6c6a3e16db286488c7d769c8c";
-  updateJobProxy.hash = "sha256-6mmiI2AjKxopeC5SfTa9XOR4hatxEu6M/28wycRnz2w=";
+  updateJobProxy.imageDigest = "sha256:70cf9a8f006db9cde732faf9e33a4f60af895532bbe803268fc8fd2f70aa3202";
+  updateJobProxy.hash = "sha256-HTqXW+q/kdOVRplh1b23uQIJ6D9Xf2i1Gtv6dlRPPYc=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:5964979027fe1d6fc358e89774074bfe34fa89b2b53ce7d45b44b4ebf71b7953";
-  updaterGitHubActions.hash = "sha256-dmMq/T7DLomvzPtOGIBQnrv+k5/NpfxbcXFxxo5ij6o=";
+  updaterGitHubActions.imageDigest = "sha256:16b379590f4eda319c618de70e0e9cd29f49a10d9b80b905e4aa05df78389c1a";
+  updaterGitHubActions.hash = "sha256-/kWULJVxOPK22pMctd9QPi3nld0qOnJE0pWwVO/nIsQ=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,7 +34,7 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-9//TW+56UM/5J6psJWcS6lJqyKwQUEOWftTOJxEaCcQ=";
+    hash = "sha256-ZMMpOrOMuqheoUyTPEx2J7AMQ32yfhwW4u4PtoSuuBE=";
   };
 
   vendorHash = "sha256-dD48OKpuGAJAro7qV4tqpf/uENV2X1VQ2kUvAuJLXc0=";
@@ -61,6 +61,10 @@ buildGoModule {
     "-skip=TestDependabot"
   ];
 
+  # Some tests fail on *-darwin because they require host port binding or a Docker environment.
+  # So, we skip the test entirely on *-darwin.
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/dependabot --help
diff --git a/pkgs/by-name/di/di/package.nix b/pkgs/by-name/di/di/package.nix
index 0e37012325dd..fe45f1438216 100644
--- a/pkgs/by-name/di/di/package.nix
+++ b/pkgs/by-name/di/di/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "6.0.0";
+  version = "6.2.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/diskinfo-di/${pname}-${version}.tar.gz";
-    sha256 = "sha256-e2Y+TbBEsfpJhr0Bj4J8GOlv5tH5o2cy3LsEUOf1GMs=";
+    sha256 = "sha256-Ge7rfrytMGGueBTNrlWTrM+yuyYc4keVpgSigsv8YP4=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 04fedc522b2f..b050554f54cc 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-01-18";
+  version = "2026-02-03";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-ZV8CcpZzxK1uts8RzUmzp4mKXvS/xv8D02Jsv7DzByQ=";
+    hash = "sha256-NEav9U7rqPRtDTZPRIP7UTa/cbbRRz5G2YOWZmAabO8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fa/fanficfare/package.nix b/pkgs/by-name/fa/fanficfare/package.nix
index cbc910efa1bb..8a01553ce3ad 100644
--- a/pkgs/by-name/fa/fanficfare/package.nix
+++ b/pkgs/by-name/fa/fanficfare/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "fanficfare";
-  version = "4.50.0";
+  version = "4.53.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+4hasWmQx//HzKwOmtlGqutw95rKFvWL97Ec1xLE1Js=";
+    hash = "sha256-lUeMP7wWs5+ZzP4pEr0BUvzAIo+NKAqs4bGSGcSmi/k=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/fi/figma-agent/package.nix b/pkgs/by-name/fi/figma-agent/package.nix
index b20d9f077246..1145ec9e2a7c 100644
--- a/pkgs/by-name/fi/figma-agent/package.nix
+++ b/pkgs/by-name/fi/figma-agent/package.nix
@@ -2,37 +2,19 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
-  fontconfig,
-  freetype,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "figma-agent";
-  version = "0.3.2-unstable-2024-11-16";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "neetly";
     repo = "figma-agent-linux";
-    rev = "6709a1b7ffcbfb227472d8f017bfbbda77ddca7d";
-    sha256 = "sha256-Cq+ivyrj6wt7DEUM730BG44sMkpOMt4qxb+J3itVar4=";
+    tag = finalAttrs.version;
+    hash = "sha256-eP2C/u4CWdf7ABHdxapFcrmI1Un405wIHE0kpvz7y7A=";
   };
 
-  cargoHash = "sha256-QdEs1zaQ2CQT50nIhKxtp7zpJfa64xQgOy3sTOUGmxk=";
-
-  nativeBuildInputs = [
-    pkg-config
-    rustPlatform.bindgenHook
-  ];
-
-  buildInputs = [
-    fontconfig
-    freetype
-  ];
-
-  checkFlags = [
-    # All tests fail due to unavailable bindings
-    "--skip=figma-agent-freetype-sys"
-  ];
+  cargoHash = "sha256-KmoTsriLnYvEI+yOOV9sLQ6qPRKqYRDzaYj7Kp72sP0=";
 
   meta = {
     description = "Figma Agent for Linux with a focus on performance";
@@ -42,4 +24,4 @@ rustPlatform.buildRustPackage {
     mainProgram = "figma-agent";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 8154a047e795..97b1630bfe10 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -150,13 +150,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.3.3";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-mAEsqAXwge5FUuYD4yge7TfwrmAyhpzjrbjPOoQKQDo=";
+    hash = "sha256-vUNmlEVQ5nxXSDfpgQ3l/+dzYW/MllhcfJhmFx4kY/A=";
   };
 
   env = {
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-fwERCvGfBOXlVFHQl6moZV8kNmHA7N/PkS3eDaLKPkA=";
+    hash = "sha256-9Wi9KlMzTrecEkHyfW/H9WPHpQDEMpdGB8snFs7zFb4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fl/flink/package.nix b/pkgs/by-name/fl/flink/package.nix
index 006f23c9811b..a837b051d18c 100644
--- a/pkgs/by-name/fl/flink/package.nix
+++ b/pkgs/by-name/fl/flink/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "flink";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.12.tgz";
-    sha256 = "sha256-B/EhLtDKve1SKoayDy6E64Lk4FTln3FL79kh3CcHLEU=";
+    sha256 = "sha256-tmx9xuGVNyCd3DlDDWvn54XUjcB41rLSaapgFQlbSF8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index 12eec85f538a..6d2578e3cf39 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -6,7 +6,6 @@
   php,
   brotli,
   watcher,
-  testers,
   frankenphp,
   cctools,
   darwin,
@@ -15,6 +14,7 @@
   makeBinaryWrapper,
   runCommand,
   writeText,
+  versionCheckHook,
 }:
 
 let
@@ -34,7 +34,7 @@ buildGoModule rec {
   version = "1.11.1";
 
   src = fetchFromGitHub {
-    owner = "dunglas";
+    owner = "php";
     repo = "frankenphp";
     tag = "v${version}";
     hash = "sha256-JzZXg/tkSZqLZn56RyLb8Q8SaeG/tHA8Sqxu99s5ks0=";
@@ -60,6 +60,7 @@ buildGoModule rec {
     pkg-config
     cctools
     darwin.autoSignDarwinBinariesHook
+    libiconv
   ];
 
   subPackages = [ "frankenphp" ];
@@ -87,11 +88,6 @@ buildGoModule rec {
     export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${version} \
       $(${phpConfig} --ldflags) \
       $(${phpConfig} --libs)"
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # replace hard-code homebrew path
-    substituteInPlace ../frankenphp.go \
-      --replace "-L/opt/homebrew/opt/libiconv/lib" "-L${libiconv}/lib"
   '';
 
   preFixup = ''
@@ -103,15 +99,14 @@ buildGoModule rec {
 
   doCheck = false;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
   passthru = {
     php = phpEmbedWithZts;
     tests = {
       # TODO: real NixOS test with Symfony application
-      version = testers.testVersion {
-        inherit version;
-        package = frankenphp;
-        command = "frankenphp version";
-      };
       phpinfo =
         runCommand "php-cli-phpinfo"
           {
@@ -126,12 +121,12 @@ buildGoModule rec {
   };
 
   meta = {
-    changelog = "https://github.com/dunglas/frankenphp/releases/tag/v${version}";
+    changelog = "https://github.com/php/frankenphp/releases/tag/v${version}";
     description = "Modern PHP app server";
-    homepage = "https://github.com/dunglas/frankenphp";
+    homepage = "https://github.com/php/frankenphp";
     license = lib.licenses.mit;
     mainProgram = "frankenphp";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.piotrkwiecinski ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/ft/ft2-clone/package.nix b/pkgs/by-name/ft/ft2-clone/package.nix
index 76a75f49da0a..ae5ba97bacce 100644
--- a/pkgs/by-name/ft/ft2-clone/package.nix
+++ b/pkgs/by-name/ft/ft2-clone/package.nix
@@ -29,6 +29,17 @@ stdenv.mkDerivation (finalAttrs: {
     libiconv
   ];
 
+  postInstall = ''
+    install -Dm444 "$src/release/other/Freedesktop.org Resources/Fasttracker II clone.desktop" \
+      $out/share/applications/ft2-clone.desktop
+    install -Dm444 "$src/release/other/Freedesktop.org Resources/Fasttracker II clone.png" \
+      $out/share/icons/hicolor/512x512/apps/ft2-clone.png
+    # gtk-update-icon-cache does not like whitespace. Note that removing this
+    # will not make the build fail, but it will make the NixOS test fail.
+    substituteInPlace $out/share/applications/ft2-clone.desktop \
+      --replace-fail "Icon=Fasttracker II clone" Icon=ft2-clone
+  '';
+
   passthru.tests = {
     ft2-clone-starts = nixosTests.ft2-clone;
   };
diff --git a/pkgs/by-name/go/gopls/package.nix b/pkgs/by-name/go/gopls/package.nix
index 52a0b10e9ec8..2e7979f6822c 100644
--- a/pkgs/by-name/go/gopls/package.nix
+++ b/pkgs/by-name/go/gopls/package.nix
@@ -36,6 +36,7 @@ buildGoLatestModule (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckKeepEnvironment = [ "TMPDIR" ];
   versionCheckProgramArg = "version";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=gopls/(.*)" ]; };
diff --git a/pkgs/by-name/he/heroku/package.nix b/pkgs/by-name/he/heroku/package.nix
index d9e80ea96bcd..2885810fe8fc 100644
--- a/pkgs/by-name/he/heroku/package.nix
+++ b/pkgs/by-name/he/heroku/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation {
   pname = "heroku";
-  version = "10.13.2";
+  version = "10.16.0";
 
   src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/10.13.2/82c0564/heroku-v10.13.2-82c0564-linux-x64.tar.xz";
-    hash = "sha256-JfaOnVaN60MG4dDJ8IdmRucfCIb9EtWdJy+90fG6zuw=";
+    url = "https://cli-assets.heroku.com/versions/10.16.0/3f0b8a2/heroku-v10.16.0-3f0b8a2-linux-x64.tar.xz";
+    hash = "sha256-WvabMaOvkaizRxA0d4Lk6pi693tpVd9VH7x77xuMzKU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/in/intel-gpu-tools/package.nix b/pkgs/by-name/in/intel-gpu-tools/package.nix
index 508a673cced8..276c675a0cc1 100644
--- a/pkgs/by-name/in/intel-gpu-tools/package.nix
+++ b/pkgs/by-name/in/intel-gpu-tools/package.nix
@@ -43,14 +43,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-gpu-tools";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "drm";
     repo = "igt-gpu-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Lt/mqx13nHyD5QiDl8oWGiYIiK006uQvbbzHH44LB/0=";
+    hash = "sha256-CkVBImPPM93Q2SVpKzRAREd7cK+SmUgySiuq3LfO2O8=";
   };
 
   nativeBuildInputs = [
@@ -107,6 +107,9 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "i686-linux"
     ];
-    maintainers = with lib.maintainers; [ pSub ];
+    maintainers = with lib.maintainers; [
+      pSub
+      ilkecan
+    ];
   };
 })
diff --git a/pkgs/by-name/ja/jailer/package.nix b/pkgs/by-name/ja/jailer/package.nix
index 573a8701e610..090591f33797 100644
--- a/pkgs/by-name/ja/jailer/package.nix
+++ b/pkgs/by-name/ja/jailer/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jailer";
-  version = "16.9.3";
+  version = "16.11";
 
   src = fetchFromGitHub {
     owner = "Wisser";
     repo = "Jailer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4uXJZZ528Bc4vL8NUQDjoWGPBu/Bd9jhOMxC3e+s9hc=";
+    hash = "sha256-bSwLxO7UtKv82WoF/OcFROtbLfkdeupLtoR2/ELzO1U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ju/junicode/package.nix b/pkgs/by-name/ju/junicode/package.nix
index 000c3bbf2658..fbf232c6c2f7 100644
--- a/pkgs/by-name/ju/junicode/package.nix
+++ b/pkgs/by-name/ju/junicode/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "junicode";
-  version = "2.220";
+  version = "2.222";
 
   src = fetchzip {
     url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-NZdNWnWMWscAI0p878mQ8rOoo5TlEDrKYzfiqGeo4lc=";
+    hash = "sha256-fAhK6IAw1UL0Q2CusNmN+LedySZnBrfUAHMQJoHTRl4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch b/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch
new file mode 100644
index 000000000000..bbccb5392c24
--- /dev/null
+++ b/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch
@@ -0,0 +1,59 @@
+diff --git i/errors/src/errors/cli/cli_errors.rs w/errors/src/errors/cli/cli_errors.rs
+index 9e3995743b..89617d451d 100644
+--- i/errors/src/errors/cli/cli_errors.rs
++++ w/errors/src/errors/cli/cli_errors.rs
+@@ -328,6 +328,13 @@ create_messages!(
+         help: None,
+     }
+ 
++    @backtraced
++    nix_update_build_error {
++       args: (),
++       msg: format!("Self update is not supported on Nix."),
++       help: Some("Package must be updated via Nix".to_string()),
++    }
++
+     @backtraced
+     custom {
+         args: (msg: impl Display),
+diff --git i/leo/cli/commands/update.rs w/leo/cli/commands/update.rs
+index 156e3ccce3..83dad3139b 100644
+--- i/leo/cli/commands/update.rs
++++ w/leo/cli/commands/update.rs
+@@ -15,7 +15,6 @@
+ // along with the Leo library. If not, see <https://www.gnu.org/licenses/>.
+ 
+ use super::*;
+-use crate::cli::helpers::updater::Updater;
+ 
+ /// Update Leo to the latest version
+ #[derive(Debug, Parser)]
+@@ -47,27 +46,6 @@ impl Command for LeoUpdate {
+     where
+         Self: Sized,
+     {
+-        match self.list {
+-            true => match Updater::show_available_releases() {
+-                Ok(output) => tracing::info!("{output}"),
+-                Err(error) => tracing::info!("Failed to list the available versions of Leo\n{error}\n"),
+-            },
+-            false => {
+-                let result = Updater::update(!self.quiet, self.name);
+-                if !self.quiet {
+-                    match result {
+-                        Ok(status) => {
+-                            if status.uptodate() {
+-                                tracing::info!("\nLeo is already on the latest version")
+-                            } else if status.updated() {
+-                                tracing::info!("\nLeo has updated to version {}", status.version())
+-                            }
+-                        }
+-                        Err(e) => tracing::info!("\nFailed to update Leo to the latest version\n{e}\n"),
+-                    }
+-                }
+-            }
+-        }
+-        Ok(())
++        return Err(CliError::nix_update_build_error().into());
+     }
+ }
diff --git a/pkgs/by-name/le/leo-lang/package.nix b/pkgs/by-name/le/leo-lang/package.nix
new file mode 100644
index 000000000000..a6e900ac47b4
--- /dev/null
+++ b/pkgs/by-name/le/leo-lang/package.nix
@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
+  curl,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "leo-lang";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ProvableHQ";
+    repo = "leo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VDhD2devY2GPa2vGbZ0hSg1tIc6WJ5pgyDM6RsSb12U=";
+    fetchSubmodules = true;
+  };
+
+  patches = [ ./0001-remove-update-subcommand.patch ];
+
+  cargoHash = "sha256-PI2DviLVtlNFohRSOkGx7SQd2sh4jMKZKzw7RMKNw+o=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ curl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/leo";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  checkFlags = [
+    "--skip=cli::cli::tests::nested_local_dependency_run_test"
+    "--skip=cli::cli::tests::relaxed_shadowing_run_test"
+    "--skip=cli::cli::tests::relaxed_struct_shadowing_run_test"
+  ];
+
+  meta = {
+    description = "Functional, statically-typed programming language built for writing private applications";
+    homepage = "https://github.com/ProvableHQ/leo";
+    changelog = "https://github.com/ProvableHQ/leo/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ anstylian ];
+    mainProgram = "leo";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libgig/package.nix b/pkgs/by-name/li/libgig/package.nix
index b52ae3934cf8..af935114ac84 100644
--- a/pkgs/by-name/li/libgig/package.nix
+++ b/pkgs/by-name/li/libgig/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgig";
-  version = "4.5.0";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://download.linuxsampler.org/packages/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-CHnSi5tjktpZhYJtvdjZyVeyoDKi8QGQUGrvLiLzxUo=";
+    sha256 = "sha256-yivozl4JafkMLfduA9SZ9eJ/tQIe28WH3hgv8n6O/d0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/magpie/package.nix b/pkgs/by-name/ma/magpie/package.nix
deleted file mode 100644
index a63fd4dfff81..000000000000
--- a/pkgs/by-name/ma/magpie/package.nix
+++ /dev/null
@@ -1,188 +0,0 @@
-{
-  fetchFromGitHub,
-  runCommand,
-  lib,
-  fetchpatch,
-  stdenv,
-  pkg-config,
-  gnome-settings-daemon,
-  gettext,
-  gobject-introspection,
-  cairo,
-  colord,
-  lcms2,
-  pango,
-  json-glib,
-  libstartup_notification,
-  libcanberra,
-  ninja,
-  xvfb-run,
-  xkeyboard_config,
-  libxcvt,
-  libxkbfile,
-  libXdamage,
-  libxkbcommon,
-  libXtst,
-  libinput,
-  libdrm,
-  libgbm,
-  gsettings-desktop-schemas,
-  glib,
-  gtk3,
-  gnome-desktop,
-  pipewire,
-  libgudev,
-  libwacom,
-  mesa-gl-headers,
-  meson,
-  nix-update-script,
-  validatePkgConfig,
-  xorgserver,
-  python3,
-  wrapGAppsHook3,
-  gi-docgen,
-  sysprof,
-  testers,
-  libsysprof-capture,
-  desktop-file-utils,
-  libcap_ng,
-  graphene,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "magpie";
-  version = "0.9.4";
-
-  outputs = [
-    "out"
-    "dev"
-    "devdoc"
-  ];
-
-  src = fetchFromGitHub {
-    owner = "BuddiesOfBudgie";
-    repo = "magpie";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-a8e0uzbS0HEH/0sOOnwIiQI0/BizKbpdlVdfb3IbmcU=";
-  };
-
-  patches = [
-    # Fix build with separate sysprof.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2572
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/285a5a4d54ca83b136b787ce5ebf1d774f9499d5.patch";
-      hash = "sha256-/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
-    })
-  ];
-
-  mesonFlags = [
-    "-Degl_device=true"
-    "-Dprofiler=true"
-    "-Ddocs=true"
-  ];
-
-  propagatedBuildInputs = [
-    # required for pkg-config to detect magpie-clutter
-    json-glib
-    libXtst
-    libcap_ng
-    graphene
-    mesa-gl-headers
-  ];
-
-  nativeBuildInputs = [
-    desktop-file-utils
-    gettext
-    libxcvt
-    meson
-    ninja
-    xvfb-run
-    pkg-config
-    python3
-    validatePkgConfig
-    wrapGAppsHook3
-    gi-docgen
-    xorgserver
-  ];
-
-  buildInputs = [
-    cairo
-    glib
-    gnome-desktop
-    gnome-settings-daemon
-    gobject-introspection
-    gsettings-desktop-schemas
-    gtk3
-    libcanberra
-    libdrm
-    libgbm
-    libgudev
-    libinput
-    libstartup_notification
-    libwacom
-    libxkbcommon
-    libxkbfile
-    libXdamage
-    colord
-    lcms2
-    pango
-    pipewire
-    sysprof # for D-Bus interfaces
-    libsysprof-capture
-    xkeyboard_config
-  ];
-
-  postPatch = ''
-    patchShebangs src/backends/native/gen-default-modes.py
-    # Magpie does not install any .desktop files
-    substituteInPlace scripts/mesonPostInstall.sh --replace "update-desktop-database" "# update-desktop-database"
-
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3187
-    substituteInPlace meson.build \
-      --replace "dependency('sysprof-4')" "dependency('sysprof-6')"
-  '';
-
-  postFixup = ''
-    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-    # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/magpie-0/doc" "$devdoc"
-  '';
-
-  # Install udev files into our own tree.
-  env.PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
-
-  separateDebugInfo = true;
-
-  passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/magpie-0";
-
-    tests = {
-      libdirExists = runCommand "magpie-libdir-exists" { } ''
-        if [[ ! -d ${finalAttrs.finalPackage.libdir} ]]; then
-          echo "passthru.libdir should contain a directory, “${finalAttrs.finalPackage.libdir}” is not one."
-          exit 1
-        fi
-        touch $out
-      '';
-
-      pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Softish fork of Mutter 43.x";
-    homepage = "https://github.com/BuddiesOfBudgie/magpie";
-    changelog = "https://github.com/BuddiesOfBudgie/magpie/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl2Plus;
-    teams = [ lib.teams.budgie ];
-    platforms = lib.platforms.linux;
-    pkgConfigModules = [
-      "libmagpie-0"
-      "magpie-clutter-0"
-      "magpie-cogl-0"
-      "magpie-cogl-pango-0"
-    ];
-  };
-})
diff --git a/pkgs/by-name/mb/mbuffer/package.nix b/pkgs/by-name/mb/mbuffer/package.nix
index eeffaae5fb52..e50da5de9adb 100644
--- a/pkgs/by-name/mb/mbuffer/package.nix
+++ b/pkgs/by-name/mb/mbuffer/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mbuffer";
-  version = "20250809";
+  version = "20251025";
   outputs = [
     "out"
     "man"
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "http://www.maier-komor.de/software/mbuffer/mbuffer-${finalAttrs.version}.tgz";
-    sha256 = "sha256-mGXa5CRSQ3oZrkSEZ4EKA6pG1PJeKZlettbU85xnzR4=";
+    sha256 = "sha256-R+UWtBFgOZlnN8T4iV9m563iS37sXpN1SGY3psirNgE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 1256a9cad649..899f1b7cc46d 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2026.1.8";
+  version = "2026.2.1";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-D2WTKMjxUCunp5GDA0TG1P9lilLoytk1KWJiI+ht3XM=";
+    hash = "sha256-7TsSK3mk6tSxvWPNYq8Viyc8x4BYmR/QrqRT/sfetz4=";
   };
 
-  cargoHash = "sha256-2Fv+kRWtDAgAvqehgdqWfznKY4UhUdEj2NRN9MD2vy4=";
+  cargoHash = "sha256-/gltCohAPGdCpcCvou7HBG0yioiOaGjnIF60FQzkB+s=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix b/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
index aa9c3c7b3a3d..d2f86e7797d9 100644
--- a/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
+++ b/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "n8n-nodes-carbonejs";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jreyesr";
     repo = "n8n-nodes-carbonejs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dvl+Kc04i+hQ8rciT7n3oS4rtgke+HEqUszJnQa7UA0=";
+    hash = "sha256-QWErVquOEYCkoHIF6XSaDGzDbbkaNNoE70H/UvdZh6E=";
   };
 
-  npmDepsHash = "sha256-3VwejuSFGvJWNsitLKfVVpB8GnkTrrf/LLobNCpy8gU=";
+  npmDepsHash = "sha256-h780VxvDMUC5tv3JhDxYOZGJ+j40BAhmo4pRczlByKs=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/na/nawk/package.nix b/pkgs/by-name/na/nawk/package.nix
index d607a03bf4d3..c73ca513597b 100644
--- a/pkgs/by-name/na/nawk/package.nix
+++ b/pkgs/by-name/na/nawk/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://awk.dev";
+    homepage = "https://github.com/onetrueawk/awk";
     description = "One, true implementation of AWK";
     longDescription = ''
       This is the version of awk described in "The AWK Programming Language",
diff --git a/pkgs/by-name/nf/nfs-utils/package.nix b/pkgs/by-name/nf/nfs-utils/package.nix
index a6d056e03bec..642cca819f63 100644
--- a/pkgs/by-name/nf/nfs-utils/package.nix
+++ b/pkgs/by-name/nf/nfs-utils/package.nix
@@ -40,11 +40,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-utils";
-  version = "2.8.4";
+  version = "2.8.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/nfs-utils/${finalAttrs.version}/nfs-utils-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EcTMWYpDTX00C60+Byo3O6HcwsSfhV1EsgIiK3js2/U=";
+    hash = "sha256-sTykqd9EGGvb4QdRSyJzLUJD94X5Xa8vuGr8HtuhW7s=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index bee19f675b5a..b8cccfb94058 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -16,7 +16,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "0.2.0-beta";
+  version = "0.2.1-beta";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -25,7 +25,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-73V2j281tfQroRTUbMQAdRdKOTW4x1Nm1u8Vj3aCR2k=";
+    hash = "sha256-ZiOTFVg/jyvoN8YrEvW66BcUKYwgiqxJyXifcFZmAXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/norgolith/package.nix b/pkgs/by-name/no/norgolith/package.nix
new file mode 100644
index 000000000000..2163555e2f77
--- /dev/null
+++ b/pkgs/by-name/no/norgolith/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libgit2,
+  openssl,
+  zlib,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "norgolith";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "NTBBloodbath";
+    repo = "norgolith";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-n9Obf2PoTQ8EyxF/i5YU9/AlN9IizWYW/sG89Z8qp1k=";
+  };
+
+  cargoHash = "sha256-1DOys3N42jlC/tc5D0Ixg+yXV/RRMIi4qcXzUwpl7XQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
+
+  useNextest = true;
+
+  env = {
+    LIBGIT2_NO_VENDOR = true;
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "The monolithic Norg static site generator built with Rust";
+    homepage = "https://norgolith.amartin.beer";
+    changelog = "https://github.com/NTBBloodbath/norgolith/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ Ladas552 ];
+    mainProgram = "lith";
+  };
+})
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 9e43272ea303..9373549cb020 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -138,13 +138,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.15.2";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hfEuVWMmayAO26EV6fu7lRWEL3Es9wyN9sMdm5I+NJE=";
+    hash = "sha256-5dkikrp7jVGnfFwiGkbsGsRnrsS0zcZzWQ7shOn3alw=";
   };
 
   vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc=";
diff --git a/pkgs/by-name/ol/olvid/package.nix b/pkgs/by-name/ol/olvid/package.nix
index ef016788850a..d1f591ec3938 100644
--- a/pkgs/by-name/ol/olvid/package.nix
+++ b/pkgs/by-name/ol/olvid/package.nix
@@ -62,14 +62,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "olvid";
-  version = "2.5.1";
+  version = "2.7.0";
 
   dontUnpack = true;
   dontWrapGApps = true;
 
   src = fetchurl {
     url = "https://static.olvid.io/linux/${repo}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6QEr9mB9UI+rgrG4QxxBs5hOT26Yxcmjwode+pRwYfU=";
+    hash = "sha256-5qpsi31Z2aDIlEZ/lhsj8VjxSwfVvAOiwPbSWcRdby0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prow/package.nix b/pkgs/by-name/pr/prow/package.nix
index 0d8756e802de..8eefeb47415d 100644
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2026-01-26";
-  rev = "a0e74f2f7661a5ce8ecae738314ec0b4d4a182b0";
+  version = "0-unstable-2026-02-01";
+  rev = "a50f011ce108985726aa0d8ecbc65524292f7940";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-EKWd0G6ONOWNYZCyp4UlY4lalfhB27sV5HwkKmyRscs=";
+    hash = "sha256-tWd9Zj8nwAjlnuqfCU2VtCNcP8+p17yX876AsQJI4U4=";
   };
 
   vendorHash = "sha256-Pv9LznRh7Nzm74gMKT2Q/VLIMIIc93en0qX6YA6TwK4=";
diff --git a/pkgs/by-name/pr/prqlc/package.nix b/pkgs/by-name/pr/prqlc/package.nix
index 8bae52076728..0b50018c612e 100644
--- a/pkgs/by-name/pr/prqlc/package.nix
+++ b/pkgs/by-name/pr/prqlc/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "prqlc";
-  version = "0.13.5";
+  version = "0.13.10";
 
   src = fetchFromGitHub {
     owner = "prql";
     repo = "prql";
     rev = version;
-    hash = "sha256-XMxwxg7ij8PBKDWgEfyqCNNPz+a2D5GjIwIS8TMDSHo=";
+    hash = "sha256-SYIrME3iE1SpqjLvP/TxXXeiURfdrRSedN3FlcTwrt8=";
   };
 
-  cargoHash = "sha256-Rw3BZ+l6NiFIhH2zD4UG2hW9st0XP5/UPl1xtvm0XzE=";
+  cargoHash = "sha256-4426LQ8X5iGPyjtyHnlmOQmYNHwmTvf6TowpCa463O4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ra/rapidraw/package.nix b/pkgs/by-name/ra/rapidraw/package.nix
index 81bd053a8391..95e27c462fe1 100644
--- a/pkgs/by-name/ra/rapidraw/package.nix
+++ b/pkgs/by-name/ra/rapidraw/package.nix
@@ -42,13 +42,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rapidraw";
-  version = "1.4.5";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "CyberTimon";
     repo = "RapidRAW";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WG9Dlo7yRt+QZGA5112+BX3HHhjV0XW5nrj7PUORUFE=";
+    hash = "sha256-Jd/t3PWvUaQuTHqd4A4vqAfzR2QpZ/j1352gLyuqRxQ=";
     fetchSubmodules = true;
 
     # darwin/linux hash mismatch in rawler submodule
@@ -58,11 +58,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-6oI88cvlCR6TBiAAUka+Q8bkoYyTXvpMDNMfwlPjtIU=";
+  cargoHash = "sha256-ijyrq2BwNeJM8eM6yc5jmCicpLndhtKVlwHviMwpFS4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-w806JHqy2ZLFcfYVm09VKnLd7BpLI1houfMYbY3sHe0=";
+    hash = "sha256-jenSEANarab/oQnC80NoM1jWmvdeXF3bJ9I/vOGcBb0=";
   };
 
   nativeBuildInputs = [
@@ -125,10 +125,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'if !is_valid' 'if false'
   '';
 
+  # Fix dyld error about onnxruntime not being loaded on darwin during cargo test
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${onnxruntime}/lib:$DYLD_LIBRARY_PATH"
+  '';
+
   dontWrapGApps = true;
 
-  # needs to be declared twice annoyingly
-  ORT_STRATEGY = "system";
+  env = {
+    ORT_STRATEGY = "system";
+  };
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     # Patch the .desktop file to set the Categories field
@@ -139,16 +145,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # link the .so file
     ln -sf ${onnxruntime}/lib/libonnxruntime.so $out/lib/RapidRAW/resources/libonnxruntime.so
-
-    # remove the .dylib file
-    rm -rf $out/lib/RapidRAW/resources/libonnxruntime.dylib
   '';
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapGApp $out/bin/rapidraw \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath finalAttrs.buildInputs} \
-      --set ORT_STRATEGY "system" \
-      --set ORT_DYLIB_PATH "${onnxruntime}/lib/libonnxruntime.so"
+      --set ORT_STRATEGY "system"
   '';
 
   meta = {
diff --git a/pkgs/by-name/ru/runapp/package.nix b/pkgs/by-name/ru/runapp/package.nix
index 4a255a51bbd4..2be5bdb336c9 100644
--- a/pkgs/by-name/ru/runapp/package.nix
+++ b/pkgs/by-name/ru/runapp/package.nix
@@ -8,13 +8,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "runapp";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "c4rlo";
     repo = "runapp";
     tag = finalAttrs.version;
-    hash = "sha256-+dIawnBTf8QU0dv93NQUCgW60BrlUXljaoNnRQjfJZQ=";
+    hash = "sha256-/i3IJf/KWfYmu9ISp97au5hAhcZCVDhb/t6cyat0JlE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 6ca9d8588e76..8a4c2d073d3d 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.07";
+  version = "4.08";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     tag = finalAttrs.version;
-    hash = "sha256-MeMB5YuRVWL9bR2LUvSzRcaNpSu+D5IwLqPI/OKvjoI=";
+    hash = "sha256-i+CBU1aKx6ZTgtSSDZHefQ96sgqSNtqCglhj7hHH6fI=";
   };
 
-  vendorHash = "sha256-m3rOw41lJA9rRd5788V0H9tlJf10BDzKJNAZepMQ9oI=";
+  vendorHash = "sha256-77KoE0gbybWpRLiaiqD+ZC0zH3BcYuZ1TkC7aPFkAv8=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libredirect.hook ];
 
diff --git a/pkgs/by-name/se/semantic-release/package.nix b/pkgs/by-name/se/semantic-release/package.nix
index 7287e7a67d55..16d07edb37e3 100644
--- a/pkgs/by-name/se/semantic-release/package.nix
+++ b/pkgs/by-name/se/semantic-release/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "25.0.1";
+  version = "25.0.2";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-6OgqZh9OXITPwOtCD209H7KjPGf2MK/sCcrzZgpasyE=";
+    hash = "sha256-iucXpzB9Rd7HuAxg7ZYLuY8j7zRCYxjly5zhyFOmDak=";
   };
 
-  npmDepsHash = "sha256-/Ba4udEUZAEfUmMcUHykkLGPvH9lr8Wxb+6FkJKYiWQ=";
+  npmDepsHash = "sha256-FrwwER5/QNBV7Ppby7bJMBV8bfgTCWjeORPv9/KjeNo=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/so/socklog/package.nix b/pkgs/by-name/so/socklog/package.nix
index 523a9f03aebf..56731a2d8ec6 100644
--- a/pkgs/by-name/so/socklog/package.nix
+++ b/pkgs/by-name/so/socklog/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "socklog";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "https://smarden.org/socklog/socklog-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6xk3JB1seyoEArSf/evwIrsvzaPgDBsaF66Lzx5KObo=";
+    hash = "sha256-e8ej+ejhWn55EoHAV0GkwM8N6G50hw/SxvTX55QrleY=";
   };
 
   sourceRoot = "admin/socklog-${finalAttrs.version}";
diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index 97fd607200b5..60b8b5aea133 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -4,32 +4,32 @@
   fetchFromGitHub,
   pkg-config,
   wrapGAppsHook4,
+  nix-update-script,
   cairo,
   gdk-pixbuf,
+  gettext,
   glib,
   gtk4,
   pango,
   polkit,
 }:
-let
-  version = "0.2.0";
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "soteria";
-  inherit version;
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "imvaskel";
     repo = "soteria";
-    tag = "v${version}";
-    hash = "sha256-bZhxz6aycx7J3itInSsl2glbIs6OpIEkfSp3nYfPojk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g6DGb8PWfc5YyjUpO9q3q0MxcPUbMjatOi6POFcZEE4=";
   };
 
-  cargoHash = "sha256-rxZRDx+5srBbMTVLMNH8liOqjyg90FvTaTT7g+3fq7E=";
+  cargoHash = "sha256-6Pk60J2RAInRgCiIk9thZRwwAyCQvychh5nVHmKU7Iw=";
 
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook4
+    gettext
   ];
 
   buildInputs = [
@@ -40,15 +40,22 @@ rustPlatform.buildRustPackage {
     pango
   ];
 
-  # From upstream packaging:
-  #  Takes advantage of nixpkgs manually editing PACKAGE_PREFIX by grabbing it from
-  #  the binary itself.
-  #  https://github.com/NixOS/nixpkgs/blob/9b5328b7f761a7bbdc0e332ac4cf076a3eedb89b/pkgs/development/libraries/polkit/default.nix#L142
-  #  https://github.com/polkit-org/polkit/blob/d89c3604e2a86f4904566896c89e1e6b037a6f50/src/polkitagent/polkitagentsession.c#L599
   preBuild = ''
-    export POLKIT_AGENT_HELPER_PATH="$(strings ${polkit.out}/lib/libpolkit-agent-1.so | grep "polkit-agent-helper-1")"
+    export SOTERIA_DEFAULT_LOCALE_DIR=$out/share/locale
   '';
 
+  postInstall = ''
+    mkdir -p $SOTERIA_DEFAULT_LOCALE_DIR
+    for file in po/*.po; do
+      lang=''${file%.*}
+      lang=''${lang#po/}
+      mkdir -p "$SOTERIA_DEFAULT_LOCALE_DIR/$lang/LC_MESSAGES"
+      msgfmt "$file" -o "$SOTERIA_DEFAULT_LOCALE_DIR/$lang/LC_MESSAGES/soteria.mo"
+    done
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Polkit authentication agent written in GTK designed to be used with any desktop environment";
     homepage = "https://github.com/ImVaskel/soteria";
@@ -59,4 +66,4 @@ rustPlatform.buildRustPackage {
     ];
     inherit (polkit.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/sp/spicy-parser-generator/package.nix b/pkgs/by-name/sp/spicy-parser-generator/package.nix
index 3e418cf9b8e8..226d8d05066f 100644
--- a/pkgs/by-name/sp/spicy-parser-generator/package.nix
+++ b/pkgs/by-name/sp/spicy-parser-generator/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spicy";
-  version = "1.14.0";
+  version = "1.15.0";
 
   strictDeps = true;
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "zeek";
     repo = "spicy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pc4BqQiaifB/kAbcaHYyTUeUE/HLlvg0qDSPdC/gMko=";
+    hash = "sha256-vZSqUcJoFleZM9sqLdc/g2M+UQrns3kys4eHOfs4Cvk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch b/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
index c12bf9d857d3..5ba8592c29a7 100644
--- a/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
+++ b/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
@@ -1,38 +1,25 @@
-From e246c4f87c1af78be5f5a76f79bd66c27d63918f Mon Sep 17 00:00:00 2001
-From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Date: Wed, 3 Jul 2024 21:38:15 +0200
-Subject: [PATCH] module support
-
-Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
----
- go.mod | 26 ++++++++++++++++++++++++++
- go.sum | 42 ++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 68 insertions(+)
- create mode 100644 go.mod
- create mode 100644 go.sum
-
 diff --git a/go.mod b/go.mod
 new file mode 100644
-index 00000000..51c79d4c
+index 0000000..99454d8
 --- /dev/null
 +++ b/go.mod
 @@ -0,0 +1,26 @@
 +module github.com/aws/session-manager-plugin
 +
-+go 1.22.3
++go 1.25.5
 +
 +require (
-+	github.com/aws/aws-sdk-go v1.54.14
++	github.com/aws/aws-sdk-go v1.55.8
 +	github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575
 +	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
-+	github.com/fsnotify/fsnotify v1.7.0
++	github.com/fsnotify/fsnotify v1.9.0
 +	github.com/gorilla/websocket v1.5.3
-+	github.com/stretchr/testify v1.9.0
++	github.com/stretchr/testify v1.11.1
 +	github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19
-+	github.com/xtaci/smux v1.5.24
-+	golang.org/x/crypto v0.24.0
-+	golang.org/x/sync v0.7.0
-+	golang.org/x/sys v0.21.0
++	github.com/xtaci/smux v1.5.55
++	golang.org/x/crypto v0.47.0
++	golang.org/x/sync v0.19.0
++	golang.org/x/sys v0.40.0
 +)
 +
 +require (
@@ -40,17 +27,17 @@ index 00000000..51c79d4c
 +	github.com/jmespath/go-jmespath v0.4.0 // indirect
 +	github.com/pmezard/go-difflib v1.0.0 // indirect
 +	github.com/stretchr/objx v0.5.2 // indirect
-+	golang.org/x/term v0.21.0 // indirect
++	golang.org/x/term v0.39.0 // indirect
 +	gopkg.in/yaml.v3 v3.0.1 // indirect
 +)
 diff --git a/go.sum b/go.sum
 new file mode 100644
-index 00000000..ca623749
+index 0000000..7c72807
 --- /dev/null
 +++ b/go.sum
 @@ -0,0 +1,42 @@
-+github.com/aws/aws-sdk-go v1.54.14 h1:llJ60MzLzovyDE/rEDbUjS1cICh7krk1PwQwNlKRoeQ=
-+github.com/aws/aws-sdk-go v1.54.14/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
++github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
++github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 +github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 h1:kHaBemcxl8o/pQ5VM1c8PVE1PubbNx3mjUr09OqWGCs=
 +github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575/go.mod h1:9d6lWj8KzO/fd/NrVaLscBKmPigpZpn5YawRPw+e3Yo=
 +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -58,8 +45,8 @@ index 00000000..ca623749
 +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 +github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
 +github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
-+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
++github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
++github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 +github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 +github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 +github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -71,26 +58,23 @@ index 00000000..ca623749
 +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
++github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
++github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 +github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19 h1:HlxV0XiEKMMyjS3gGtJmmFZsxQ22GsLvA7F980il+1w=
 +github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19/go.mod h1:mMgcE1RHFUFqe5AfiwlINXisXfDGro23fWdPUfOMjRY=
-+github.com/xtaci/smux v1.5.24 h1:77emW9dtnOxxOQ5ltR+8BbsX1kzcOxQ5gB+aaV9hXOY=
-+github.com/xtaci/smux v1.5.24/go.mod h1:OMlQbT5vcgl2gb49mFkYo6SMf+zP3rcjcwQz7ZU7IGY=
-+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
++github.com/xtaci/smux v1.5.55 h1:BdOj0tHZmiZOeZ8VQaOKpBcuL2MIMed5Ubhn5G3xDlo=
++github.com/xtaci/smux v1.5.55/go.mod h1:IGQ9QYrBphmb/4aTnLEcJby0TNr3NV+OslIOMrX825Q=
++golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
++golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
++golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
++golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
++golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
++golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
++golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
++golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 +gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 +gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- 
-2.45.1
-
diff --git a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
index a58b01a34cda..b0a3636ea924 100644
--- a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
+++ b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
@@ -41,7 +41,8 @@ buildGoModule rec {
     rm -rf vendor
   '';
 
-  vendorHash = "sha256-wK+aWRC5yrPtdihXAj6RlYC9ZTTPuGUg9wLY33skzeE=";
+  proxyVendor = true;
+  vendorHash = "sha256-pQAet0dYsLeXwpbCHSbqiIWXQ0mM2X/cKHqkx0BuwLY=";
 
   subPackages = [ "src/sessionmanagerplugin-main" ];
 
diff --git a/pkgs/by-name/su/sundials/package.nix b/pkgs/by-name/su/sundials/package.nix
index 29ca0a19b99a..2fac59ab8d93 100644
--- a/pkgs/by-name/su/sundials/package.nix
+++ b/pkgs/by-name/su/sundials/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sundials";
-  version = "7.5.0";
+  version = "7.6.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "LLNL";
     repo = "sundials";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZyUTFaMEbfNtR9oGIy0fQ+qQwb3hQ7CxTv9IevkeidE=";
+    hash = "sha256-DdVZXFfQXpJ9z5ikaK1ZQ/ZkL/vAGdlNsE9MJsIkLdM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index d165241db53f..1bd55fc5d4ab 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${version}";
-    hash = "sha256-ytABOKqW1wUl715JW9QD3twwXLq77x0PlIlFwQbfjjc=";
+    hash = "sha256-2mNGKftkqRGrAstjEmVuzix4Ls75vYsop+E9EyBWwrw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/ta/taskflow/package.nix b/pkgs/by-name/ta/taskflow/package.nix
index cfe18e3c20a6..14e3cb8176e2 100644
--- a/pkgs/by-name/ta/taskflow/package.nix
+++ b/pkgs/by-name/ta/taskflow/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taskflow";
-  version = "3.11.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GIP/69JlygdmryRA4uiyXM3FZZ0wkvP3DceYGkn4+QY=";
+    hash = "sha256-cWnKA6tCsKRfkleBJ38NRP2ciJu4sHtyTS8y5bBTfcA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index 4cdfa2971b2f..e7ecedc183e0 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.37.1";
+  version = "1.37.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-UXJxIgqhbqGPSHdGHQLyi6EFngZjfptmCnhfhAwqKEg=";
+    hash = "sha256-5sgDhA9+Z33dvYlhYq80T12JSJOC5QXejms8COsGiQA=";
   };
 
-  vendorHash = "sha256-7tVxLeIz5wl5+Qvcq96bFixfwqDmlHlvB7hnzI3DolI=";
+  vendorHash = "sha256-xpPYXHDL0h2P3trH5SlWTvLKqjbb5mClwfd5TU0lKQc=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 55ee5d1f6b75..96f229f1885c 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "16.8.0";
+  version = "16.9.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${version}";
-    hash = "sha256-6TimSkPxmDvXAPDlLbPYpnXg20dTbBKzv1Lj0tI973U=";
+    hash = "sha256-jWjyW/CYrPt8gEgCa1T56+5sBtaNpnV6RZz30S6nYIs=";
   };
 
-  cargoHash = "sha256-DehLOUrqxGvlNw/12PyDOtyGuZThx/jqqjmKltqk7Ck=";
+  cargoHash = "sha256-WScgutM8e/lwYQBjyZGG/9ieLoaPQA+X1IhRlz3Izew=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ts/tsgolint/package.nix b/pkgs/by-name/ts/tsgolint/package.nix
index d7ad26cc72d3..d9daa29e6f1a 100644
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tsgolint";
-  version = "0.11.2";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "tsgolint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gby8JW3bwVOIuNgLCIIt0y3egdljrR5cgbqAGqqqzpI=";
+    hash = "sha256-/1od2yijBSTi5PFhEQ95KTjQJYYgXRX4v6M/lIfQXtM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/tv/tvm/package.nix b/pkgs/by-name/tv/tvm/package.nix
index 237942231276..5bf348d96614 100644
--- a/pkgs/by-name/tv/tvm/package.nix
+++ b/pkgs/by-name/tv/tvm/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tvm";
-  version = "0.19.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "incubator-tvm";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-/5IpOraFTgg6sQ1TLHoepq/C8VHKg5BXKrNMBSyYajA=";
+    hash = "sha256-KcHUcblwtqxNofHKofuQHu2d7hIqS9FUvc41OkCVtnY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/up/upsies/package.nix b/pkgs/by-name/up/upsies/package.nix
index c7218760da58..7fbb97301e17 100644
--- a/pkgs/by-name/up/upsies/package.nix
+++ b/pkgs/by-name/up/upsies/package.nix
@@ -18,14 +18,14 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "upsies";
-  version = "2026.01.03";
+  version = "2026.01.26";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "plotski";
     repo = "upsies";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ya1v0DR5a4fPsFVJKVSDbgy+hWE136aRV3pFMExlRhU=";
+    hash = "sha256-gsWIyyUkpdUQjwZJXcevMLG0T1fgJj7brbVHfcks31w=";
   };
 
   patches = [
diff --git a/pkgs/by-name/us/userborn/package.nix b/pkgs/by-name/us/userborn/package.nix
index 331b44575634..0fa93590ebb3 100644
--- a/pkgs/by-name/us/userborn/package.nix
+++ b/pkgs/by-name/us/userborn/package.nix
@@ -9,18 +9,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "userborn";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nikstur";
     repo = "userborn";
     rev = version;
-    hash = "sha256-Zh2u7we/MAIM7varuJA4AmEWeSMuA/C+0NSIUJN7zTs=";
+    hash = "sha256-mXXakR75Iz6AFf/TYgIHE8SxOri2HyReYUYTT3lCEPA=";
   };
 
   sourceRoot = "${src.name}/rust/userborn";
 
-  cargoHash = "sha256-oLw/I8PEv75tz+KxbIJrwl8Wr0I/RzDh1SDZ6mRQpL8=";
+  cargoHash = "sha256-uAid5GsM9lasVQAYfeo9jwp4xg1MrXdJqtD0l6ME6OQ=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix
index ab3eac0ccdae..7ec0a9906f39 100644
--- a/pkgs/by-name/ve/vector/package.nix
+++ b/pkgs/by-name/ve/vector/package.nix
@@ -121,6 +121,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=sources::socket::test::multicast_udp_message"
     "--skip=sources::socket::test::multiple_multicast_addresses_udp_message"
     "--skip=sources::syslog::test::test_udp_syslog"
+
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
+    # Fails on aarch64-darwin (https://github.com/vectordotdev/vector/issues/23813)
+    "--skip=sources::file::tests::file_start_position_server_restart_unfinalized"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+    # Flakey on aarch64-linux
+    "--skip=topology::test::backpressure::buffer_drop_fan_out"
+    "--skip=topology::test::backpressure::default_fan_out"
+    "--skip=topology::test::backpressure::serial_backpressure"
   ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/zi/zimfw/package.nix b/pkgs/by-name/zi/zimfw/package.nix
index 51449fd11213..aed62c1e5957 100644
--- a/pkgs/by-name/zi/zimfw/package.nix
+++ b/pkgs/by-name/zi/zimfw/package.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zimfw";
-  version = "1.18.0";
+  version = "1.20.0";
   src = fetchFromGitHub {
     owner = "zimfw";
     repo = "zimfw";
     tag = "v${finalAttrs.version}";
     ## zim only needs this one file to be installed.
     sparseCheckout = [ "zimfw.zsh" ];
-    hash = "sha256-qQViaQOpLp8F4zvJETbNp0lxpdVhM1Meg7WcMKkjJRQ=";
+    hash = "sha256-fwpmeFDQRsTnWSoa9N3C+G/LDBCmDtbl+ckcyndMr7c=";
   };
   strictDeps = true;
   dontConfigure = true;
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 9608a0daff3d..4534be6b4677 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.10.1";
+  version = "11.11.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-H9gtrYNk4W1OjjZwVX3ugDeqhW0rTvEJyhSRuz6XrYg=";
+    hash = "sha256-pxLpHeFBdmbuw4VtVgrOMfE8uPft2AyYcwdIyXpUz2s=";
   };
-  npmDepsHash = "sha256-oxa9JzbvXRvm+hfHrfhp5XBzTwcvW7yHJIvrKKu54B4=";
+  npmDepsHash = "sha256-BZnHHIjRbhMCq8miK4lPkhIfE13sEv4q0Ting/mmavQ=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/coq-modules/LibHyps/default.nix b/pkgs/development/coq-modules/LibHyps/default.nix
index 3ed3318a941c..9f8d47944ebf 100644
--- a/pkgs/development/coq-modules/LibHyps/default.nix
+++ b/pkgs/development/coq-modules/LibHyps/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   coq,
+  stdlib,
   version ? null,
 }:
 
@@ -9,13 +10,15 @@ mkCoqDerivation {
   pname = "LibHyps";
   owner = "Matafou";
   inherit version;
-  defaultVersion = if (lib.versions.range "8.11" "8.20") coq.version then "2.0.8" else null;
+  defaultVersion = if (lib.versions.range "8.11" "9.0") coq.version then "2.0.8" else null;
   release = {
     "2.0.8".sha256 = "sha256-u8T7ZWfgYNFBsIPss0uUS0oBvdlwPp3t5yYIMjYzfLc=";
   };
 
   configureScript = "./configure.sh";
 
+  propagatedBuildInputs = [ stdlib ];
+
   releaseRev = (v: "libhyps-${v}");
 
   meta = {
diff --git a/pkgs/development/coq-modules/aac-tactics/default.nix b/pkgs/development/coq-modules/aac-tactics/default.nix
index db8aca777402..46e8948abab1 100644
--- a/pkgs/development/coq-modules/aac-tactics/default.nix
+++ b/pkgs/development/coq-modules/aac-tactics/default.nix
@@ -11,6 +11,7 @@ mkCoqDerivation {
 
   releaseRev = v: "v${v}";
 
+  release."9.0.0".sha256 = "sha256-mln1182EOeXZCa1NzjAiovK93Xm+5JMZpGqJVrM67Jo=";
   release."8.20.0".sha256 = "sha256-VQzeINIZAfP3Qyh29uPqcNVlNJfIzzRLtN0Cm4EuGCk=";
   release."8.19.1".sha256 = "sha256-W/V57h+rjb3m0ktCG83PquMHfXiv6H1Nhvw9sVEPLqM=";
   release."8.19.0".sha256 = "sha256-IeCBd8gcu4bAXH5I/XIT7neQIILi+EWR6qqAA4GzQD0=";
@@ -34,6 +35,10 @@ mkCoqDerivation {
   defaultVersion =
 
     lib.switch coq.coq-version [
+      {
+        case = "9.0";
+        out = "9.0.0";
+      }
       {
         case = "8.20";
         out = "8.20.0";
diff --git a/pkgs/development/coq-modules/mtac2/default.nix b/pkgs/development/coq-modules/mtac2/default.nix
index d7fd6f4a36d8..ef06e17f2d7f 100644
--- a/pkgs/development/coq-modules/mtac2/default.nix
+++ b/pkgs/development/coq-modules/mtac2/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   coq,
+  stdlib,
   unicoq,
   version ? null,
 }:
@@ -14,14 +15,19 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.19" "8.19";
+        case = range "8.19" "9.0";
         out = "1.4-coq${coq.coq-version}";
       }
     ] null;
+  release."1.4-coq9.0".sha256 = "sha256-pAPBRCW7M46UZPJ+v/0xAT8mpQURN8czMmlrfYz/MVU=";
+  release."1.4-coq8.20".sha256 = "sha256-3nu/8zDvdnl6WzGtw46mVcdqgkRgc6Xy8/I+lUOrSIY=";
   release."1.4-coq8.19".sha256 = "sha256-G9eK0eLyECdT20/yf8yyz7M8Xq2WnHHaHpxVGP0yTtU=";
   releaseRev = v: "v${v}";
   mlPlugin = true;
-  propagatedBuildInputs = [ unicoq ];
+  propagatedBuildInputs = [
+    stdlib
+    unicoq
+  ];
   meta = {
     description = "Typed tactic language for Coq";
     license = lib.licenses.mit;
diff --git a/pkgs/development/coq-modules/paramcoq/default.nix b/pkgs/development/coq-modules/paramcoq/default.nix
index 3039d7092640..2687c890b740 100644
--- a/pkgs/development/coq-modules/paramcoq/default.nix
+++ b/pkgs/development/coq-modules/paramcoq/default.nix
@@ -12,7 +12,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.10" "8.20";
+        case = range "8.10" "9.0";
         out = "1.1.3+coq${coq.coq-version}";
       }
       {
@@ -23,6 +23,7 @@ mkCoqDerivation {
   displayVersion = {
     paramcoq = "...";
   };
+  release."1.1.3+coq9.0".sha256 = "sha256-zibQ9nBadSElpyI8iMTDRW/mqtxmxClaVb24o5W6ajE=";
   release."1.1.3+coq8.20".sha256 = "sha256-34xDOz/2xO39fnQW6Zb9CI2EKFuJZjrAdOpMEmwuzY0=";
   release."1.1.3+coq8.19".sha256 = "sha256-5NVsdLXaoz6qrr5ra5YfoHeuK4pEf8JX/X9+SZA0U+U=";
   release."1.1.3+coq8.18".sha256 = "sha256-hNBaj9hB+OzwXsOX+TOXtDLjA5oP4EmEgseLwxFxW+I=";
diff --git a/pkgs/development/coq-modules/rewriter/default.nix b/pkgs/development/coq-modules/rewriter/default.nix
index d7c4ff330e1f..42cc8f777125 100644
--- a/pkgs/development/coq-modules/rewriter/default.nix
+++ b/pkgs/development/coq-modules/rewriter/default.nix
@@ -16,12 +16,12 @@ mkCoqDerivation {
     in
     lib.switch coq.coq-version [
       {
-        case = range "8.17" "8.19";
-        out = "0.0.11";
+        case = range "8.17" "9.0";
+        out = "0.0.15";
       }
     ] null;
   release = {
-    "0.0.11".sha256 = "sha256-aYoO08nwItlOoE5BnKRGib2Zk4Fz4Ni/L4QaqkObPow=";
+    "0.0.15".sha256 = "sha256-zxNIMppFXUKShOXLbdZphy0Je5ii6cjcWUUcQMTcaHk=";
   };
   releaseRev = v: "v${v}";
 
diff --git a/pkgs/development/coq-modules/simple-io/default.nix b/pkgs/development/coq-modules/simple-io/default.nix
index 8b7209692f27..85c0e2fce056 100644
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@@ -18,10 +18,11 @@
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.17" "9.1") "1.10.0")
+      (case (range "8.17" "9.1") "1.11.0")
       (case (range "8.11" "8.19") "1.8.0")
       (case (range "8.7" "8.13") "1.3.0")
     ] null;
+  release."1.11.0".sha256 = "sha256-sgbH7eI4TPHOQ5qBvM6x7G3j8B40HSEMEzFaN1G9VEw=";
   release."1.10.0".sha256 = "sha256-67cBhLvRMWLWBL7NXK1zZTQC4PtSKu9qtesU4SqKkOw=";
   release."1.8.0".sha256 = "sha256-3ADNeXrBIpYRlfUW+LkLHUWV1w1HFrVc/TZISMuwvRY=";
   release."1.7.0".sha256 = "sha256:1a1q9x2abx71hqvjdai3n12jxzd49mhf3nqqh3ya2ssl2lj609ci";
diff --git a/pkgs/development/coq-modules/unicoq/default.nix b/pkgs/development/coq-modules/unicoq/default.nix
index aa9a84ac8315..401015b89dec 100644
--- a/pkgs/development/coq-modules/unicoq/default.nix
+++ b/pkgs/development/coq-modules/unicoq/default.nix
@@ -12,11 +12,16 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = range "8.20" "9.0";
+        out = "1.6-8.20";
+      }
       {
         case = range "8.19" "8.19";
-        out = "1.6-${coq.coq-version}";
+        out = "1.6-8.19";
       }
     ] null;
+  release."1.6-8.20".sha256 = "sha256-zne9LB0lGdqUfrBe8cDK8fwuxfBDFU4PqNlt9nl7rNI=";
   release."1.6-8.19".sha256 = "sha256-fDk60B8AzJwiemxHGgWjNu6PTu6NcJoI9uK7Ww2AT14=";
   releaseRev = v: "v${v}";
   mlPlugin = true;
diff --git a/pkgs/development/python-modules/autopage/default.nix b/pkgs/development/python-modules/autopage/default.nix
index 7536d4d9e462..58f1a6d13250 100644
--- a/pkgs/development/python-modules/autopage/default.nix
+++ b/pkgs/development/python-modules/autopage/default.nix
@@ -1,29 +1,41 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
+  fixtures,
+  less,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "autopage";
-  version = "0.5.2";
-
+  version = "0.6.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-gmmW10xaqfS2kWGVVHMSrGOEusOBC4UXBj8pMkgle3I=";
+  src = fetchFromGitHub {
+    owner = "zaneb";
+    repo = "autopage";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oBZoGVvgUhrfcEUvmhIN7Wnsv+SvkC553LAhHGCVIBQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    fixtures
+    less
+    pytestCheckHook
+  ]
+  ++ fixtures.optional-dependencies.streams;
 
   pythonImportsCheck = [ "autopage" ];
 
   meta = {
+    changelog = "https://github.com/zaneb/autopage/releases/tag/${finalAttrs.src.tag}";
     description = "Library to provide automatic paging for console output";
     homepage = "https://github.com/zaneb/autopage";
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/fava-portfolio-returns/default.nix b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
index 061356b7be15..ec38ca5fe303 100644
--- a/pkgs/development/python-modules/fava-portfolio-returns/default.nix
+++ b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   buildNpmPackage,
   fetchFromGitHub,
-  stdenv,
   fava,
   hatch-vcs,
   hatchling,
@@ -71,16 +70,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "fava_portfolio_returns" ];
 
-  # Stay in the root of the repository, so that relative paths to example files
-  # loaded by tests stay correct.
-  # Remove `src` to avoid `PYTHONPATH` issues related to `pytestCheckHook` ([1])
+  # Use importlib import mode to avoid `PYTHONPATH` issues related to `pytestCheckHook` ([1])
   # [1]: https://github.com/NixOS/nixpkgs/issues/255262
-  preCheck = ''
-    rm -rf src
-  '';
-
   pytestFlags = [
-    "${placeholder "out"}"
+    "--import-mode=importlib"
   ];
 
   passthru = {
diff --git a/pkgs/development/python-modules/fava/default.nix b/pkgs/development/python-modules/fava/default.nix
index 2d45a92473b1..0c2db1d6bb9b 100644
--- a/pkgs/development/python-modules/fava/default.nix
+++ b/pkgs/development/python-modules/fava/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   buildNpmPackage,
+  fetchpatch2,
   fetchFromGitHub,
   stdenv,
   babel,
@@ -55,7 +56,15 @@ buildPythonPackage {
 
   inherit src;
 
-  patches = [ ./dont-compile-frontend.patch ];
+  patches = [
+    ./dont-compile-frontend.patch
+    # https://github.com/beancount/fava/pull/2176
+    (fetchpatch2 {
+      name = "fix-have-excel-replacement.patch";
+      url = "https://github.com/beancount/fava/commit/36eba34495d189cd391fae0276aa1b6c94940203.patch?full_index=1";
+      hash = "sha256-XSkzygnq8eHkIcp1TT7J3NdcLCIwUxDoyipO4M9M3nE=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace tests/test_cli.py \
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 06c7f3043833..5c43ddfdb036 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2026.1.15.112308";
+  version = "2026.1.28.162006";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-Q+9BUS0A/e0hIBq8J2hRZi/L7LKhf7vSEIFkPI0RMj0=";
+    hash = "sha256-RbQYL33UtvhnU3EhwPeMTpUcH4c8+tfcp4Hk9uRIFMo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/numericalunits/default.nix b/pkgs/development/python-modules/numericalunits/default.nix
index b4b463ddc5d8..b58fcf9cba67 100644
--- a/pkgs/development/python-modules/numericalunits/default.nix
+++ b/pkgs/development/python-modules/numericalunits/default.nix
@@ -1,20 +1,24 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
   setuptools,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "numericalunits";
   version = "1.26";
   pyproject = true;
 
+  # AttributeError: module 'ast' has no attribute 'Num'
+  disabled = pythonAtLeast "3.14";
+
   src = fetchFromGitHub {
     owner = "sbyrnes321";
     repo = "numericalunits";
-    tag = "numericalunits-${version}";
+    tag = "numericalunits-${finalAttrs.version}";
     hash = "sha256-vPB1r+j+p9n+YLnBjHuk2t+QSr+adEOjyC45QSbeb4M=";
   };
 
@@ -26,6 +30,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "numericalunits" ];
+
   enabledTestPaths = [
     "tests/tests.py"
   ];
@@ -36,4 +42,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/py-libzfs/default.nix b/pkgs/development/python-modules/py-libzfs/default.nix
index de4d805addf9..7161f2bfe109 100644
--- a/pkgs/development/python-modules/py-libzfs/default.nix
+++ b/pkgs/development/python-modules/py-libzfs/default.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   fetchpatch2,
   cython_0,
-  zfs,
+  zfs_2_3,
 }:
 
 buildPythonPackage rec {
@@ -30,14 +30,14 @@ buildPythonPackage rec {
   ];
 
   build-system = [ cython_0 ];
-  buildInputs = [ zfs ];
+  buildInputs = [ zfs_2_3 ];
 
   # Passing CFLAGS in configureFlags does not work, see https://github.com/truenas/py-libzfs/issues/107
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace configure \
       --replace-fail \
         'CFLAGS="-DCYTHON_FALLTHROUGH"' \
-        'CFLAGS="-DCYTHON_FALLTHROUGH -I${zfs.dev}/include/libzfs -I${zfs.dev}/include/libspl"' \
+        'CFLAGS="-DCYTHON_FALLTHROUGH -I${zfs_2_3.dev}/include/libzfs -I${zfs_2_3.dev}/include/libspl"' \
       --replace-fail 'zof=false' 'zof=true'
   '';
 
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index ade8f0740fa1..fc42fdb4fa21 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -35,6 +35,12 @@ buildPythonPackage rec {
       url = "https://github.com/rapidfuzz/RapidFuzz/commit/0ef2a4980c41b852283e6db7a747a1632307c75e.patch";
       hash = "sha256-xb+J3PXwD51lZqIJcTzPJWrT/oqrIXxh1cLp91DhIPg=";
     })
+    # https://github.com/rapidfuzz/RapidFuzz/pull/470
+    (fetchpatch {
+      name = "support-taskflow-4.0.0.patch";
+      url = "https://github.com/rapidfuzz/RapidFuzz/commit/4b794e6168d98fff4c518a64c4d809238b17d8fe.patch";
+      hash = "sha256-F4gwV4ewcHfR7ptcEVAvbiNFIvXqFCIM/Qk8giv4jAc=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/rmsd/default.nix b/pkgs/development/python-modules/rmsd/default.nix
index 969db3fb3f6b..5b752ff48fc8 100644
--- a/pkgs/development/python-modules/rmsd/default.nix
+++ b/pkgs/development/python-modules/rmsd/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "rmsd";
-  version = "1.6.4";
+  version = "1.6.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dhLsFGts45PitSVZxXw5FND3EOeHHWYrH8PZJEYoq+M=";
+    hash = "sha256-blEDbbrGtOz067Jq24QMBU5P8otmBwnUl8Tpjvc7TLo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/slither-analyzer/default.nix b/pkgs/development/python-modules/slither-analyzer/default.nix
index 045574b56631..2f53803f885c 100644
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@@ -1,16 +1,27 @@
 {
   lib,
   buildPythonPackage,
-  crytic-compile,
   fetchFromGitHub,
+
+  # build-system
   hatchling,
+
+  # nativeBuildInputs
   makeWrapper,
+
+  # dependencies
+  crytic-compile,
   packaging,
   prettytable,
-  solc,
-  testers,
-  versionCheckHook,
   web3,
+
+  # tests
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # postFixup
+  solc,
+
   withSolc ? false,
 }:
 
@@ -37,18 +48,17 @@ buildPythonPackage (finalAttrs: {
     web3
   ];
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
 
   postFixup = lib.optionalString withSolc ''
     wrapProgram $out/bin/slither \
       --prefix PATH : "${lib.makeBinPath [ solc ]}"
   '';
 
-  # required for pythonImportsCheck
-  postInstall = ''
-    export HOME="$TEMP"
-  '';
-
   pythonImportsCheck = [
     "slither"
     "slither.all_exceptions"
@@ -66,8 +76,6 @@ buildPythonPackage (finalAttrs: {
     "slither.vyper_parsing"
   ];
 
-  doInstallCheck = true;
-
   meta = {
     description = "Static Analyzer for Solidity";
     longDescription = ''
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index 54d194d3fe57..0f40c9771197 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "testcontainers";
-  version = "4.14.0";
+  version = "4.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "testcontainers";
     repo = "testcontainers-python";
     tag = "testcontainers-v${finalAttrs.version}";
-    hash = "sha256-Zquh1tY9Z2BU6BPsEGR4eBjcHVB4KsxOQ81Tk6YTyTQ=";
+    hash = "sha256-BB09uQX33/MiCfEBOXHjhl/OB2S/zKxqxYYcfJqWysY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 54e62ce9af68..bfb7a1b1ecb2 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -40,23 +40,18 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uiprotect";
-  version = "10.0.1";
+  version = "10.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "uilibs";
     repo = "uiprotect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pxxl/NhvJh2Ur8g+25padewvshqSUZmB7vpGmVlH15k=";
+    hash = "sha256-tQeDZMukKg3xL/tGeQ7+Rm3lzNJQEcDkErbLfKnaxN8=";
   };
 
   build-system = [ poetry-core ];
 
-  pythonRelaxDeps = [
-    "aiofiles"
-    "pydantic"
-  ];
-
   dependencies = [
     aiofiles
     aiohttp
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index 01c4e15df120..305336dd4f68 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@
 
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "1.10.0";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA=";
+    hash = "sha256-od7RWHhyFQ7l3HZaqpOkUVtiWKDQj/tUsd5lGi6m34I=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA=";
+    hash = "sha256-YW4Yi1gvMjTNAgsAlyX1KMlyQPHCXh/jAoO/Nkrn2Sc=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/VirusTotal/yara-x/tree/main/py";
     changelog = "https://github.com/VirusTotal/yara-x/tree/${src.tag}/py";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ ivyfanchiang ];
+    maintainers = with lib.maintainers; [
+      ivyfanchiang
+      lesuisse
+    ];
   };
 }
diff --git a/pkgs/development/rocm-modules/miopen/default.nix b/pkgs/development/rocm-modules/miopen/default.nix
index 13dbfa9d4dfc..77ac8cab1533 100644
--- a/pkgs/development/rocm-modules/miopen/default.nix
+++ b/pkgs/development/rocm-modules/miopen/default.nix
@@ -65,6 +65,15 @@ let
     "gfx1201"
   ] gpuTargets;
 
+  kdbTargets = lib.intersectLists [
+    "gfx900"
+    "gfx906"
+    "gfx908"
+    "gfx90a"
+    "gfx942"
+    "gfx1030"
+  ] gpuTargets;
+
   src = fetchFromGitHub {
     owner = "ROCm";
     repo = "MIOpen";
@@ -111,25 +120,20 @@ let
     )
   );
 
-  gfx900 = runCommand "miopen-gfx900.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx900.kdb.bz2 > $out
-  '';
+  kernelDatabases = lib.genAttrs kdbTargets (
+    target:
+    runCommand "miopen-${target}.kdb" { preferLocalBuild = true; } ''
+      ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/${target}.kdb.bz2 > $out
+    ''
+  );
 
-  gfx906 = runCommand "miopen-gfx906.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx906.kdb.bz2 > $out
-  '';
-
-  gfx908 = runCommand "miopen-gfx908.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx908.kdb.bz2 > $out
-  '';
-
-  gfx90a = runCommand "miopen-gfx90a.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx90a.kdb.bz2 > $out
-  '';
-
-  gfx1030 = runCommand "miopen-gfx1030.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx1030.kdb.bz2 > $out
-  '';
+  linkKDBsTo =
+    targetPath:
+    lib.concatStringsSep "" (
+      map (target: ''
+        ln -sf ${kernelDatabases.${target}} ${targetPath}/${target}.kdb
+      '') kdbTargets
+    );
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit version src;
@@ -254,19 +258,12 @@ stdenv.mkDerivation (finalAttrs: {
       return()'
 
     patchShebangs test src/composable_kernel fin utils install_deps.cmake
-
-    ln -sf ${gfx900} src/kernels/gfx900.kdb
-    ln -sf ${gfx906} src/kernels/gfx906.kdb
-    ln -sf ${gfx908} src/kernels/gfx908.kdb
-    ln -sf ${gfx90a} src/kernels/gfx90a.kdb
-    ln -sf ${gfx1030} src/kernels/gfx1030.kdb
+  ''
+  + linkKDBsTo "src/kernels"
+  + ''
     mkdir -p build/share/miopen/db/
-    ln -sf ${gfx900} build/share/miopen/db/gfx900.kdb
-    ln -sf ${gfx906} build/share/miopen/db/gfx906.kdb
-    ln -sf ${gfx908} build/share/miopen/db/gfx908.kdb
-    ln -sf ${gfx90a} build/share/miopen/db/gfx90a.kdb
-    ln -sf ${gfx1030} build/share/miopen/db/gfx1030.kdb
-  '';
+  ''
+  + linkKDBsTo "build/share/miopen/db";
 
   # Unfortunately, it seems like we have to call make on these manually
   postBuild =
@@ -279,12 +276,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     rm $out/libexec/miopen/install_precompiled_kernels.sh
-    ln -sf ${gfx900} $out/share/miopen/db/gfx900.kdb
-    ln -sf ${gfx906} $out/share/miopen/db/gfx906.kdb
-    ln -sf ${gfx908} $out/share/miopen/db/gfx908.kdb
-    ln -sf ${gfx90a} $out/share/miopen/db/gfx90a.kdb
-    ln -sf ${gfx1030} $out/share/miopen/db/gfx1030.kdb
   ''
+  + linkKDBsTo "$out/share/miopen/db"
   + lib.optionalString buildDocs ''
     mv ../doc/html $out/share/doc/miopen-hip
   ''
diff --git a/pkgs/development/rocq-modules/relation-algebra/default.nix b/pkgs/development/rocq-modules/relation-algebra/default.nix
new file mode 100644
index 000000000000..0bb2e1d289ad
--- /dev/null
+++ b/pkgs/development/rocq-modules/relation-algebra/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  mkRocqDerivation,
+  rocq-core,
+  stdlib,
+  version ? null,
+}:
+
+mkRocqDerivation {
+  pname = "relation-algebra";
+  owner = "damien-pous";
+
+  inherit version;
+  defaultVersion =
+    lib.switch
+      [ rocq-core.rocq-version ]
+      [
+        {
+          cases = [ (lib.versions.isEq "9.0") ];
+          out = "1.8.0";
+        }
+      ]
+      null;
+
+  releaseRev = v: "v${v}";
+
+  release."1.8.0".sha256 = "sha256-RnY+a57KnStACteaT5dKQoCCH0qp7/W+4qoaApIilj0=";
+
+  propagatedBuildInputs = [
+    stdlib
+  ];
+
+  dontConfigure = true;
+
+  mlPlugin = true;
+
+  meta = {
+    description = "Relation algebra library for Rocq";
+    maintainers = with lib.maintainers; [ siraben ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 77a237432e71..ca91b9d69b2e 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -9,6 +9,7 @@
   brotli,
   c-ares,
   libuv,
+  lief,
   llhttp,
   nghttp2,
   nghttp3,
@@ -124,6 +125,7 @@ let
   # TODO: also handle MIPS flags (mips_arch, mips_fpu, mips_float_abi).
 
   useSharedAdaAndSimd = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.2";
+  useSharedLief = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "25.6";
   useSharedSQLite = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.5";
   useSharedZstd = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.15";
 
@@ -161,6 +163,9 @@ let
     // (lib.optionalAttrs useSharedSQLite {
       inherit sqlite;
     })
+    // (lib.optionalAttrs useSharedLief {
+      inherit lief;
+    })
     // (lib.optionalAttrs useSharedZstd {
       inherit zstd;
     });
diff --git a/pkgs/development/web/nodejs/v25.nix b/pkgs/development/web/nodejs/v25.nix
index 0387c253810b..91215b2a2c32 100644
--- a/pkgs/development/web/nodejs/v25.nix
+++ b/pkgs/development/web/nodejs/v25.nix
@@ -25,8 +25,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "25.5.0";
-  sha256 = "7e35efaf63c8fe7737b8c62792ec547e5a95a69f1f813fcfba28566aecc9fd92";
+  version = "25.6.0";
+  sha256 = "9db6848c802b1981c0faeb71a5b8cc79913f82a747f7f1d50260c6d2f781ef7e";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 85e6e5aa4362..a3246b2fdd87 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -391,6 +391,7 @@ mapAliases {
   brogue = warnAlias "Use 'brogue-ce' instead of 'brogue' for updated releases" brogue-ce; # Added 2025-10-04
   btanks = throw "'btanks' has been removed as it's been unmaintained since 2010 and fails to build"; # Added 2025-11-29
   buck = throw "'buck' has been removed has it was deprecated and archived upstream. Consider moving to buck2"; # Added 2026-01-16
+  budgie-screensaver = throw "'budgie-screensaver' has been removed, no longer used by budgie-desktop."; # Added 2025-11-19
   buildBowerComponents = throw "buildBowerComponents has been removed as bower was removed. It is recommended to migrate to yarn."; # Added 2025-09-17
   buildGo123Module = throw "Go 1.23 is end-of-life, and 'buildGo123Module' has been removed. Please use a newer builder version."; # Added 2025-08-13
   buildPlatform = warnAlias "'buildPlatform' has been renamed to/replaced by 'stdenv.buildPlatform'" stdenv.buildPlatform; # Converted to warning 2025-10-28
@@ -1165,6 +1166,7 @@ mapAliases {
   MACS2 = throw "'MACS2' has been renamed to/replaced by 'macs2'"; # Converted to throw 2025-10-27
   magma_2_6_2 = throw "'magma_2_6_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
   magma_2_7_2 = throw "'magma_2_7_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
+  magpie = throw "'magpie' has been removed, no longer used by budgie-desktop."; # Added 2025-11-19
   mailcore2 = throw "'mailcore2' has been removed due to lack of upstream maintenance."; # Added 2025-06-09
   mailnag = throw "mailnag has been removed because it has been marked as broken since 2022."; # Added 2025-10-12
   mailnagWithPlugins = throw "mailnagWithPlugins has been removed because mailnag has been marked as broken since 2022."; # Added 2025-10-12
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index 84f6f26bb8c4..ed0327ee96ec 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -46,6 +46,7 @@ let
       mathcomp-field = self.mathcomp.field;
       mathcomp-character = self.mathcomp.character;
       parseque = callPackage ../development/rocq-modules/parseque { };
+      relation-algebra = callPackage ../development/rocq-modules/relation-algebra { };
       rocq-elpi = callPackage ../development/rocq-modules/rocq-elpi { };
       stdlib = callPackage ../development/rocq-modules/stdlib { };
       vsrocq-language-server = callPackage ../development/rocq-modules/vsrocq-language-server { };