diff --git a/nixos/tests/dep-scan.nix b/nixos/tests/dep-scan.nix
index ffb43d85367f..8d7bdde8578e 100644
--- a/nixos/tests/dep-scan.nix
+++ b/nixos/tests/dep-scan.nix
@@ -22,12 +22,7 @@
 
     # code repo to scan for vulnerabilites, could be anything
     # I just happened to pick the source of the package
-    environment.etc."dep-scan-source".source = pkgs.fetchFromGitHub {
-      owner = "owasp-dep-scan";
-      repo = "dep-scan";
-      tag = "v6.0.0b3";
-      hash = "sha256-GdrFsECcBZ2J47ojM33flqOtrY3avchGpsZk6pt8Aks=";
-    };
+    environment.etc."dep-scan-source".source = pkgs.dep-scan.src;
 
     # we need to download the database before the vm starts, otherwise
     # the program will try to download them at runtime.
diff --git a/pkgs/by-name/az/azure-storage-azcopy/package.nix b/pkgs/by-name/az/azure-storage-azcopy/package.nix
index 2efd6aa75085..dc0aa2d461ed 100644
--- a/pkgs/by-name/az/azure-storage-azcopy/package.nix
+++ b/pkgs/by-name/az/azure-storage-azcopy/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.31.0";
+  version = "10.31.1";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     tag = "v${version}";
-    hash = "sha256-5ZnQhaQScTK+jeoshwhheVF6//Jiosu7vMfi8s7bQJw=";
+    hash = "sha256-VB7bMbMzBl5ulrTNZIHdNYKx0vHeEYIJi4L50M8BY4M=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-KhlFWo0MuukOtn95T/2ppw21fiGHrcV7CA7RYqK7frs=";
+  vendorHash = "sha256-Z9RAPIdCM5u30mpe5ozafse7ebUYiR8b0X6tqenXNvA=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/co/commitlint/package.nix b/pkgs/by-name/co/commitlint/package.nix
index 269fd1d2c195..ad742c32fd8e 100644
--- a/pkgs/by-name/co/commitlint/package.nix
+++ b/pkgs/by-name/co/commitlint/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.2.0";
+  version = "20.3.0";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L9HfuwpFmKWoEyFdo7+UIEeEcD0jFhunj0x6UFHfhEY=";
+    hash = "sha256-FJ2MhC3EPpJ2wSsWPh+A+tQofWXzDkV9/T89i5ibYl8=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-rKVMSbsipd8J2E+E2RdeXYDsMwSzFZMJJ4zceOLBbCs=";
+    hash = "sha256-wFR/2M0CYQgSlb2a1bDyWdOQt7TGVgK72mhcSESyt84=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index ffa11dafb9e1..5581fb68c3f3 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.12.4";
+  version = "2025.12.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-/dO8BS7L62nSblDAmtO2YY5wKXyHGLWlsrtUwoEu2u4=";
+    hash = "sha256-PCUxnX/Gtlfo8puayBBJt7T98hQT1/iZtlDyrbDwxog=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ke/keychron-udev-rules/package.nix b/pkgs/by-name/ke/keychron-udev-rules/package.nix
index fdb954e734de..7731eba47b37 100644
--- a/pkgs/by-name/ke/keychron-udev-rules/package.nix
+++ b/pkgs/by-name/ke/keychron-udev-rules/package.nix
@@ -13,6 +13,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   src = writeTextFile {
     name = "69-keychron.rules";
     text = ''
+      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="3434", MODE="0660", TAG+="uaccess"
       KERNEL=="event*", SUBSYSTEM=="input", ENV{ID_VENDOR_ID}=="3434", ENV{ID_INPUT_JOYSTICK}=="*?", ENV{ID_INPUT_JOYSTICK}=""
     '';
   };
diff --git a/pkgs/by-name/na/nativefiledialog-extended/package.nix b/pkgs/by-name/na/nativefiledialog-extended/package.nix
index d9ff1ca3b206..4e42acaf486e 100644
--- a/pkgs/by-name/na/nativefiledialog-extended/package.nix
+++ b/pkgs/by-name/na/nativefiledialog-extended/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nativefiledialog-extended";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "btzy";
     repo = "nativefiledialog-extended";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GwT42lMZAAKSJpUJE6MYOpSLKUD5o9nSe9lcsoeXgJY=";
+    hash = "sha256-JrwJP7zt/4oW4OQHCEM23k+zm6j1AVglGJowwkWc29k=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ox/oxfmt/package.nix b/pkgs/by-name/ox/oxfmt/package.nix
index 53edf38b4802..881f4036eb26 100644
--- a/pkgs/by-name/ox/oxfmt/package.nix
+++ b/pkgs/by-name/ox/oxfmt/package.nix
@@ -6,12 +6,14 @@
   cargo,
   cmake,
   makeBinaryWrapper,
+  nodejs_24,
   nodejs-slim,
   pnpmConfigHook,
   pnpm_10,
   rustPlatform,
   rustc,
   versionCheckHook,
+  nix-update-script,
 }:
 
 # Build with pnpm instead of buildRustPackage because Prettier integration
@@ -19,13 +21,13 @@
 # A pure Rust build would lack the Prettier plugin functionality.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxfmt";
-  version = "0.18.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxfmt_v${finalAttrs.version}";
-    hash = "sha256-AatmbW8UE8UbV533I2nhijHNlqIsgvtlE7X98uT7aTA=";
+    hash = "sha256-kMCGKbc7qaY0KUOR+67mLvKW4J5CuvYUmC6Aj9xlzSk=";
   };
 
   # Remove patchedDependencies from both workspace and lockfile
@@ -37,14 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-4G52/8WZgNFM/vcHXBbtWabBZwWo3ZBVadFjOI2SmUk=";
+    hash = "sha256-cesj9jwWHIFxpFV62QDgYl22EUE8qVjIbb2nRObAyLo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-Do2sFEK/8Axj9B9M/W9zqMboPrAo5Zm/zdrMXZvmFg0=";
+    hash = "sha256-cPswWCksQ5TyR9M2Maj5mg9I+UltR0WN3U4ClBvwG68=";
     prePnpmInstall = finalAttrs.postPatch;
   };
 
@@ -52,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     cargo
     cmake
     makeBinaryWrapper
-    nodejs-slim
+    nodejs_24
     pnpmConfigHook
     pnpm_10
     rustPlatform.cargoSetupHook
@@ -95,6 +97,10 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=^oxfmt_v([0-9.]+)$" ];
+  };
+
   meta = {
     description = "JavaScript formatter with Prettier integration";
     homepage = "https://github.com/oxc-project/oxc";
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index 97f6b0209321..2f867f9ee287 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxlint";
-  version = "1.35.0";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-WHSdT4IMl/TUnMJycL3sYfA8aVLtag54dOYSXrDuN9g=";
+    hash = "sha256-kMCGKbc7qaY0KUOR+67mLvKW4J5CuvYUmC6Aj9xlzSk=";
   };
 
-  cargoHash = "sha256-OTxSxDjNDN8MZV7hVg914xQDl199+yjAMukN9jTmQsU=";
+  cargoHash = "sha256-cesj9jwWHIFxpFV62QDgYl22EUE8qVjIbb2nRObAyLo=";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
@@ -30,7 +30,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [
     "--bin=oxlint"
-    "--bin=oxc_language_server"
   ];
   cargoTestFlags = finalAttrs.cargoBuildFlags;
 
diff --git a/pkgs/by-name/pa/pakku/package.nix b/pkgs/by-name/pa/pakku/package.nix
index 09974b1d8b11..8b7556dc3cc2 100644
--- a/pkgs/by-name/pa/pakku/package.nix
+++ b/pkgs/by-name/pa/pakku/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pakku";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "juraj-hrivnak";
     repo = "Pakku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PVET+A9LVWnqLCXz3R9EP7gk6GOViSzhRLrXTjNFPaA=";
+    hash = "sha256-iCBD9al7TbueG2kwkI6qzZT2Rixm1OanNBz1MuLapXI=";
   };
 
   gradleBuildTask = "jvmJar";
diff --git a/pkgs/by-name/pr/proteus/package.nix b/pkgs/by-name/pr/proteus/package.nix
index 5c967aba8760..16f76ab2687f 100644
--- a/pkgs/by-name/pr/proteus/package.nix
+++ b/pkgs/by-name/pr/proteus/package.nix
@@ -44,6 +44,14 @@ stdenv.mkDerivation rec {
     libXrandr
     libXrender
   ];
+
+  postPatch = ''
+    substituteInPlace modules/libsamplerate/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1..3.18)" "cmake_minimum_required(VERSION 3.18)"
+    substituteInPlace modules/{json,RTNeural}/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   # JUCE loads most dependencies at runtime:
   runtimeDependencies = map lib.getLib buildInputs;
 
diff --git a/pkgs/by-name/re/redocly/package.nix b/pkgs/by-name/re/redocly/package.nix
index 9bbd8c74c8c1..91a66e43af7b 100644
--- a/pkgs/by-name/re/redocly/package.nix
+++ b/pkgs/by-name/re/redocly/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "redocly";
-  version = "2.12.6";
+  version = "2.14.3";
 
   src = fetchFromGitHub {
     owner = "Redocly";
     repo = "redocly-cli";
     rev = "@redocly/cli@${version}";
-    hash = "sha256-HpHbqWX9NewfLxsWhPezzSLRz7jj8oZesiyGm+Uhyiw=";
+    hash = "sha256-pMLwGsit4vKZn9BC1Y5aIn7OG0kILmOpnYY/hMx7cSA=";
   };
 
-  npmDepsHash = "sha256-XCLwEmjMXNcG5/QFCAkWdA3pvRuzclzP4Akp8WroAdk=";
+  npmDepsHash = "sha256-7cKjTXMzHu7RTnYFSQVHsh1/zDBV+VDnTITo+LXfjA4=";
 
   npmBuildScript = "prepare";
 
diff --git a/pkgs/by-name/sq/sqlitestudio/package.nix b/pkgs/by-name/sq/sqlitestudio/package.nix
index 99f44eeea9a8..8a2c54465eb8 100644
--- a/pkgs/by-name/sq/sqlitestudio/package.nix
+++ b/pkgs/by-name/sq/sqlitestudio/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "sqlitestudio";
-  version = "3.4.19";
+  version = "3.4.20";
 
   src = fetchFromGitHub {
     owner = "pawelsalawa";
     repo = "sqlitestudio";
     rev = version;
-    hash = "sha256-zANk4mlCmdoPmmP7Fr9bGvCqn5Do7mOfJPSuG6hofrs=";
+    hash = "sha256-bylfbfYpXrXRolPmTRHEDyq6fjF1quVwwzg6q2XRmac=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tr/treemd/package.nix b/pkgs/by-name/tr/treemd/package.nix
index 3048289a2380..97b587c28717 100644
--- a/pkgs/by-name/tr/treemd/package.nix
+++ b/pkgs/by-name/tr/treemd/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "treemd";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "Epistates";
     repo = "treemd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EIAKppVPPSQWH+2jX/z4Wdc9qm09THEnD3J1erva1lY=";
+    hash = "sha256-WpZBV9OarbcTw4QaXz8AkxuihgGAomWgcW+dHAOErY4=";
   };
 
-  cargoHash = "sha256-OtHwKp3uTYDZMyl0/hNw83VwGMIh2WrWkU+nC8JShAw=";
+  cargoHash = "sha256-u/u+z2dFD6Pswin4JQCQZ0NBjvcEcbkAur18QClmkd8=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-luminous/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-luminous/package.nix
index 9534096a3eb2..9c44eaa1e56d 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-luminous/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-luminous/package.nix
@@ -9,29 +9,31 @@
   cargo,
   rustPlatform,
   xdg-desktop-portal,
-  slurp,
   cairo,
   pango,
+  libgbm,
+  libGL,
   libxkbcommon,
   glib,
   pipewire,
+  wayland,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-luminous";
-  version = "0.1.11";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "waycrate";
     repo = "xdg-desktop-portal-luminous";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WxkCZwV4zuDvl0n4Qnanh/eSFTQu+8J1zMtBSTI2hM8=";
+    hash = "sha256-e5gW5oW9rSGzDlcBJ0Lg9rl4v6vULX2j2F7/+esC1lE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-HUImAQ2lDqrLYh+YDHjXNTHZiTthocB5U5L4gBmIGQQ=";
+    hash = "sha256-+7rnlGkWG4MzxbXskNAd+awabAdC7XqcacX5AEmutlM=";
   };
 
   nativeBuildInputs = [
@@ -46,14 +48,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     xdg-desktop-portal
-    slurp
     cairo
     pango
     glib
     pipewire
+    libgbm
+    libGL
     libxkbcommon
   ];
 
+  postInstall = ''
+    patchelf \
+      --add-needed libwayland-client.so.0 \
+      --add-rpath ${lib.makeLibraryPath [ wayland ]} \
+      $out/libexec/xdg-desktop-portal-luminous
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 949805859e10..32a2d917daa5 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -13,10 +13,8 @@
   fetchFromGitHub,
   orjson,
   poetry-core,
-  pytest-asyncio_0,
   pytest-aiohttp,
   pytestCheckHook,
-  pythonOlder,
   zeroconf,
 }:
 
@@ -25,8 +23,6 @@ buildPythonPackage rec {
   version = "3.2.20";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "Jc2k";
     repo = "aiohomekit";
@@ -51,7 +47,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    (pytest-aiohttp.override { pytest-asyncio = pytest-asyncio_0; })
+    pytest-aiohttp
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/aiohomematic/default.nix b/pkgs/development/python-modules/aiohomematic/default.nix
index ab3b5dad39ca..de78b384e023 100644
--- a/pkgs/development/python-modules/aiohomematic/default.nix
+++ b/pkgs/development/python-modules/aiohomematic/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aiohomematic";
-  version = "2026.1.9";
+  version = "2026.1.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "aiohomematic";
     tag = version;
-    hash = "sha256-bPz40fOSEimhUrSyOO0JVahFjL2V48x8IHdaA6mh3VI=";
+    hash = "sha256-47Ts6KmT5oNo67sn1xr7k4saKwHyOSQPnJ5MDT4R1fg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index c48fd244b4db..64a4aa53702d 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -14,21 +14,18 @@
   protobuf,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.33.0";
+  version = "2.34.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     pname = "google_cloud_pubsub";
     inherit version;
-    hash = "sha256-g7xQxU9mnvuSStIThbxwkvoR91duq+89C016qO+pCqY=";
+    hash = "sha256-JfmMO6FqaYcfnruteuzj/mPIr+e6OSqtIJS+cw1UWXY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 42b4f96df1d4..fc3a5542c1f6 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.15.9";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${version}";
-    hash = "sha256-Hqn43KFmte3/zn+f35cxNSLjQ3f7ySPQSVWwMCeQ2Go=";
+    hash = "sha256-UtIb0gSv3hyRDU2ZixSnfxU0eU80tkxsQJgOhnNk65Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index 83549e090a50..32169198b91e 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sbt";
-  version = "1.11.7";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
-    hash = "sha256-EjKBj5HDljmpO74RCOEtlMcESmRqeEfxo5d7nkZxbNY=";
+    hash = "sha256-5K3j9L2+HnRFvprPAssbNXS+tGA2LhcofiRrfq+buVI=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
index 2a7660dad059..42b5bf0f2763 100644
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "SukramJ";
   domain = "homematicip_local";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "custom_homematic";
     tag = version;
-    hash = "sha256-lcw1N2xnM+CkzLCSVkp9R/+AEoWUQTnDkGo+q4R21ZU=";
+    hash = "sha256-lbmhC2vpHWGLweTXlpA9Bz8kO4SsxtcL7xzDfmOl4S0=";
   };
 
   postPatch = ''