diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
index 99d7cf33fa48..2aeee55ba2cd 100644
--- a/doc/stdenv/platform-notes.chapter.md
+++ b/doc/stdenv/platform-notes.chapter.md
@@ -117,10 +117,11 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a
 Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use.
 Generally, only the last SDK release for a major version is packaged.
 
-| Xcode version      | SDK version        | Nixpkgs attribute             |
-|--------------------|--------------------|-------------------------------|
-| 15.0–15.4          | 14.4               | `apple-sdk_14` / `apple-sdk`  |
-| 16.0               | 15.0               | `apple-sdk_15`                |
+| Xcode version | SDK version | Nixpkgs attribute            |
+|---------------|-------------|------------------------------|
+| 15.0–15.4     | 14.4        | `apple-sdk_14` / `apple-sdk` |
+| 16.0          | 15.0        | `apple-sdk_15`               |
+| 26.0+         | 26.0+       | `apple-sdk_26`, etc          |
 
 
 #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}
@@ -129,7 +130,7 @@ The current default version of the SDK and deployment target (minimum supported
 Because of the ways that minimum version and SDK can be changed that are not visible to Nix, they should be treated as lower bounds.
 If you need to parameterize over a specific version, create a function that takes the version as a parameter instead of relying on these attributes.
 
-On macOS, the `darwinMinVersion` and `darwinSdkVersion` are always the same, and are currently set to 11.3.
+On macOS, the `darwinMinVersion` is 14.0, and the `darwinSdkVersion` is 14.4.
 
 
 #### `xcrun` cannot find a binary {#sec-darwin-troubleshooting-xcrun}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f5f04062ef49..250e3be16178 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -29308,6 +29308,12 @@
     github = "Zhaith-Izaliel";
     githubId = 39216756;
   };
+  zhangxy = {
+    email = "zhangxy_2023@163.com";
+    github = "zhangxy-2023";
+    githubId = 246511921;
+    name = "Xinyao Zhang";
+  };
   zhaofengli = {
     email = "hello@zhaofeng.li";
     matrix = "@zhaofeng:zhaofeng.li";
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 5ac94c0cefcc..2d0316761ab3 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -30,6 +30,10 @@ in
         ```
         set $secure_link_secret "changeme";
         ```
+
+        This file must be readable both by nginx and by the onlyoffice
+        documentserver. Since nginx is added to the onlyoffice group,
+        you may want to make the file readable to the onlyoffice group.
       '';
     };
 
diff --git a/pkgs/applications/emulators/libretro/cores/vba-m.nix b/pkgs/applications/emulators/libretro/cores/vba-m.nix
index 1a25a66478dd..6587893baed3 100644
--- a/pkgs/applications/emulators/libretro/cores/vba-m.nix
+++ b/pkgs/applications/emulators/libretro/cores/vba-m.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vbam";
-  version = "0-unstable-2025-11-05";
+  version = "0-unstable-2025-11-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vbam-libretro";
-    rev = "d0787aee43d260675da203c2f85ba9fa226c0c66";
-    hash = "sha256-WhsiKsDk7jEIklrOw1YFCcWSlAmLK4vCCji3Mnsgwmw=";
+    rev = "c3db5dc221a3038ee54572047304963cbca15cd6";
+    hash = "sha256-e+elKAcQXTVH2VtW0J4FG2p6bJTWSuxrIrnMHwjaO9I=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 805cadd5567f..09e21f04f63e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -832,13 +832,13 @@
     "vendorHash": "sha256-Y1L1nIOubhBN5vNIXY7miQgR9OzoTCS7QA55DEMwDSA="
   },
   "linode_linode": {
-    "hash": "sha256-t6vHW9t3MWsPsGUh44OXvYTfHa03qiH3lveKK0dit9Q=",
+    "hash": "sha256-AxG8N/kEu2+Yym63Ac04SxjrUyCiSp/zmIXQqscpeWM=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.5.1",
+    "rev": "v3.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8LbFq29JvQX3Trn81fr3YMjFwW+OTWAyK6OVAkh0I3A="
+    "vendorHash": "sha256-2zdUEV84CQ236ktTfMcucAb2gwDPIQ+Br5AfKncZdJA="
   },
   "loafoe_htpasswd": {
     "hash": "sha256-ALTyTTVyS2HHenmk8HVwtQenCmJX05kyXifJTzzmnHE=",
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index 2a3ae39447f9..f0bcaf973496 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -41,6 +41,8 @@ let
     ];
 
     nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++11-narrowing";
   });
 in
 telegram-desktop.override {
@@ -69,12 +71,18 @@ telegram-desktop.override {
       })
     ];
 
-    buildInputs = (old.buildInputs or [ ]) ++ [
-      alsa-lib
-      jemalloc
-      libopus
-      libpulseaudio
-    ];
+    buildInputs =
+      (old.buildInputs or [ ])
+      ++ [
+        libopus
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        alsa-lib
+        jemalloc
+        libpulseaudio
+      ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-missing-template-arg-list-after-template-kw";
 
     meta = {
       description = "Kotatogram – experimental Telegram Desktop fork";
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index 4788f5b14e25..bedfb4245a9a 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -2,10 +2,6 @@
   lib,
   fetchFromGitHub,
   telegram-desktop,
-  alsa-lib,
-  jemalloc,
-  libopus,
-  libpulseaudio,
   withWebkit ? true,
 }:
 
@@ -24,17 +20,6 @@ telegram-desktop.override {
       fetchSubmodules = true;
     };
 
-    buildInputs = (old.buildInputs or [ ]) ++ [
-      alsa-lib
-      jemalloc
-      libopus
-      libpulseaudio
-    ];
-
-    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-      (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
-    ];
-
     meta = {
       description = "Unofficial Telegram Desktop providing Windows 64bit build and extra features";
       license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/bl/blackmagic-desktop-video/package.nix b/pkgs/by-name/bl/blackmagic-desktop-video/package.nix
index f28b0e06d8c1..bc2f468de70b 100644
--- a/pkgs/by-name/bl/blackmagic-desktop-video/package.nix
+++ b/pkgs/by-name/bl/blackmagic-desktop-video/package.nix
@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "blackmagic-desktop-video";
-  version = "15.2";
+  version = "15.3";
 
   buildInputs = [
     autoPatchelfHook
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
       {
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-OCpzKmwa4HbKTGSeVxBlYXB6TNe5uqLhtowLwAQjIJQ=";
+        outputHash = "sha256-QcM/FTEYkG1Zteb2TNysQjP/mNS1B2Wa8rqkJ70m24s=";
 
         impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
diff --git a/pkgs/by-name/bo/boringssl/package.nix b/pkgs/by-name/bo/boringssl/package.nix
index 44c8bf7b5275..551727bb3aea 100644
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -11,12 +11,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20251110.0";
+  version = "0.20251124.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-ATrenftYVxaFnQwd+Ed4tnW8J5Pkfu9e+ORpaBU7ZIc=";
+    hash = "sha256-xRuerQhS2uk9eFNaSkl8krcepVwUDmAxc9nhLCI1w98=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index 97f9f4989d4c..1bcaa50ff95a 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.70";
+  version = "1.0.71";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-9KOrnHWro3ZDFl9jl2lZl9/fDUbbMfzGftsV+1HXNfQ=";
+    hash = "sha256-jJj4aXhGMU5L7Yya65wi022M6lE/nHiyjozptSJcMGg=";
   };
 
-  cargoHash = "sha256-7E9KO16LdIIULzxvPMZPPKlOunktYQkVbdnCZmxwlSw=";
+  cargoHash = "sha256-GC4rYaNwTLfbSAojnhZb0vi6FmNiXL6YJ5TEVtQom6M=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";
diff --git a/pkgs/by-name/ca/casacore/package.nix b/pkgs/by-name/ca/casacore/package.nix
new file mode 100644
index 000000000000..6191fa3324d2
--- /dev/null
+++ b/pkgs/by-name/ca/casacore/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gfortran,
+  flex,
+  bison,
+  blas,
+  lapack,
+  cfitsio,
+  wcslib,
+  fftw,
+  fftwFloat,
+  readline,
+  gsl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "casacore";
+  version = "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "casacore";
+    repo = "casacore";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6zgTSGNKp2hHsh3GFl+o6ElavSNYnQvLsfb1xUrgNZI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+    flex
+    bison
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    cfitsio
+    wcslib
+    fftw
+    fftwFloat
+    readline
+    gsl
+  ];
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BUILD_PYTHON3" false) # TODO: If/when we package python-casacore, this will change
+  ];
+
+  meta = {
+    homepage = "https://casacore.github.io/casacore/";
+    changelog = "https://github.com/casacore/casacore/blob/master/CHANGES.md";
+    description = "Suite of C++ libraries for radio astronomy data processing";
+    maintainers = with lib.maintainers; [ kiranshila ];
+    license = lib.licenses.lgpl2Only;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/cr/crun/package.nix b/pkgs/by-name/cr/crun/package.nix
index 51f5560b25ba..d180b228c02e 100644
--- a/pkgs/by-name/cr/crun/package.nix
+++ b/pkgs/by-name/cr/crun/package.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.24";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
     rev = version;
-    hash = "sha256-Sdp6ZxUzK8T7zfrgevrLxhMh7SQfO+6mABBiFMLbgh0=";
+    hash = "sha256-WBAwyDODMrUDlgonRbxaNQ+aN8K6YicY2JVArXDJem8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/di/dippi/package.nix b/pkgs/by-name/di/dippi/package.nix
index 14865ba980ec..0f6dc82d5ed1 100644
--- a/pkgs/by-name/di/dippi/package.nix
+++ b/pkgs/by-name/di/dippi/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dippi";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "dippi";
     rev = version;
-    hash = "sha256-BYI3WqMDxzERlqtq7ISQ+U1FTrpKh5OJBMo/AsdmdlQ=";
+    hash = "sha256-iA7ymByLVrkOatW4Y79pGV7GhlS8G2gHY6PHpOfMq8g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index aaf31f02b2aa..286d37052b55 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2025-11-20";
+  version = "0-unstable-2025-11-27";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "dced39925955631fd320b763cfe2f0895e5ea5bd";
-    hash = "sha256-A7T4cGoRB4L1PgK+BcpR+l2AraOrKLzc8Et6XN+0q1g=";
+    rev = "25c20daf88a7d7e8d816a7deed4e2fe134bdb97d";
+    hash = "sha256-GiMBCUT9wd/6bZ1hXt9431Ax1Z7BLHOXfWiiPxKZsCs=";
   };
 
   missingHashes = ./missing-hashes.json;
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
index 2d4f4de53829..1ab775795936 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter";
-  hash = "sha256-gBYx23MC6Biz8FIIZLBW3d7SOxtpmCml4N6554Wh0Pc=";
+  hash = "sha256-01MkexYMHoHrBDkw3m+UCtzT1xNlEiHToChNTDDqQ8Q=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.12.wasm";
-  version = "0.95.12";
+  url = "https://plugins.dprint.dev/typescript-0.95.13.wasm";
+  version = "0.95.13";
 }
diff --git a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch b/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
similarity index 52%
rename from pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
rename to pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
index 09f562ad28e5..4924c0066916 100644
--- a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
@@ -1,14 +1,17 @@
-commit 3ffe2d7842b62986e2267e6542068e6356b06fdf
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Mon Oct 28 12:07:51 2024 +0100
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Mon, 28 Oct 2024 12:07:51 +0100
+Subject: [PATCH] Install fwupdplugin to out
 
-    Install fwupdplugin to out
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 3a163331e..cb66be0cc 100644
+index b711ab04b..7b065f278 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -733,7 +733,7 @@ if build_standalone
+@@ -734,7 +734,7 @@ if build_standalone
    if host_machine.system() == 'windows'
      libdir_pkg = bindir
    else
diff --git a/pkgs/by-name/fw/fwupd/installed-tests-path.patch b/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
similarity index 75%
rename from pkgs/by-name/fw/fwupd/installed-tests-path.patch
rename to pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
index f5786fe79e92..2f7600c1d87c 100644
--- a/pkgs/by-name/fw/fwupd/installed-tests-path.patch
+++ b/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
@@ -1,14 +1,20 @@
-commit 954e41500e1b409a24fca43ae3bdc1c6a890db48
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Tue Oct 15 14:49:53 2024 +0200
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Tue, 15 Oct 2024 14:49:53 +0200
+Subject: [PATCH] Add output for installed tests
 
-    Add output for installed tests
+---
+ data/tests/meson.build             | 2 +-
+ meson.build                        | 5 +++--
+ meson_options.txt                  | 5 +++++
+ src/tests/host-emulate/meson.build | 2 +-
+ 4 files changed, 10 insertions(+), 4 deletions(-)
 
 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index 3eba65eea..cf3931bb7 100644
+index e15cab2fa..bad033dbf 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
-@@ -122,7 +122,7 @@ configure_file(
+@@ -139,7 +139,7 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'tests',
@@ -18,7 +24,7 @@ index 3eba65eea..cf3931bb7 100644
  
  if umockdev_integration_tests.allowed()
 diff --git a/meson.build b/meson.build
-index cb66be0cc..ca431980b 100644
+index 7b065f278..1a4b0ea1f 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -239,8 +239,8 @@ else
@@ -32,7 +38,7 @@ index cb66be0cc..ca431980b 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -721,6 +721,7 @@ gnome = import('gnome')
+@@ -722,6 +722,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -41,20 +47,21 @@ index cb66be0cc..ca431980b 100644
  conf.set_quoted('FWUPD_LIBDIR', libdir)
  conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index 40103c03e..63c8d288d 100644
+index 18991b983..937578f19 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -174,6 +174,10 @@ option('systemd_unit_user',
+@@ -197,6 +197,11 @@ option(
    value: 'fwupd-refresh',
    description: 'User account to use for fwupd-refresh.service (empty for DynamicUser)',
  )
-+option('installed_test_prefix',
++option(
++  'installed_test_prefix',
 +  type: 'string',
-+  description: 'Prefix for installed tests'
++  description: 'Prefix for installed tests',
 +)
- option('tests',
+ option(
+   'tests',
    type: 'boolean',
-   value: true,
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
 index c36da65cd..f0b70d4d6 100644
 --- a/src/tests/host-emulate/meson.build
diff --git a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
similarity index 87%
rename from pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
rename to pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
index 2779308ebca1..f3769e570ce1 100644
--- a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
@@ -1,8 +1,18 @@
-commit 56507892ff7a03ed283d7fd2d7ff2000fc9c17d7
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Tue Oct 15 11:46:38 2024 +0200
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Tue, 15 Oct 2024 11:46:38 +0200
+Subject: [PATCH] Add option for installation sysconfdir
 
-    Add option for installation sysconfdir
+---
+ data/bios-settings.d/meson.build |  2 +-
+ data/meson.build                 |  2 +-
+ data/pki/meson.build             |  8 ++++----
+ data/remotes.d/meson.build       |  8 ++++----
+ docs/meson.build                 | 16 ++++++++--------
+ meson.build                      |  6 ++++++
+ meson_options.txt                |  6 ++++++
+ plugins/uefi-capsule/meson.build |  4 ++--
+ 8 files changed, 32 insertions(+), 20 deletions(-)
 
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
 index 2a2a07016..99df55afb 100644
@@ -30,7 +40,7 @@ index 5716669f0..78e754f40 100644
    )
    plugin_quirks += files('cfi.quirk', 'ds20.quirk', 'power.quirk', 'vendors.quirk')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 5b962adf1..b6575f7e4 100644
+index 1072051c0..6ef9c9111 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
 @@ -12,12 +12,12 @@ if supported_gpg
@@ -50,13 +60,13 @@ index 5b962adf1..b6575f7e4 100644
  
 @@ -25,11 +25,11 @@ if supported_pkcs7
    install_data(
-     ['LVFS-CA.pem'],
+     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
    )
    install_data(
-     ['LVFS-CA.pem'],
+     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
 +    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
@@ -166,7 +176,7 @@ index 787b4387c..b3144757f 100644
    )
  endif
 diff --git a/meson.build b/meson.build
-index ca431980b..d9bab5264 100644
+index 1a4b0ea1f..16c7cad40 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -246,6 +246,12 @@ endif
@@ -183,21 +193,22 @@ index ca431980b..d9bab5264 100644
  gio = dependency(
    'gio-2.0',
 diff --git a/meson_options.txt b/meson_options.txt
-index 63c8d288d..04f6651e6 100644
+index 937578f19..08b26b3ad 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -7,6 +7,11 @@ option('bluez',
+@@ -14,6 +14,12 @@ option(
    type: 'feature',
    description: 'BlueZ support',
  )
-+option('sysconfdir_install',
++option(
++  'sysconfdir_install',
 +  type: 'string',
 +  value: '',
-+  description: 'sysconfdir to use during installation'
++  description: 'sysconfdir to use during installation',
 +)
- option('build',
+ option(
+   'build',
    type: 'combo',
-   choices: [
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
 index 647ace53e..4ee0192df 100644
 --- a/plugins/uefi-capsule/meson.build
diff --git a/pkgs/by-name/fw/fwupd/efi-app-path.patch b/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
similarity index 51%
rename from pkgs/by-name/fw/fwupd/efi-app-path.patch
rename to pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
index 5014c6c65600..9924c12b66c8 100644
--- a/pkgs/by-name/fw/fwupd/efi-app-path.patch
+++ b/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
@@ -1,14 +1,17 @@
-commit f60f2bf6dd4961bdda742f590bf2d7871db6cdab
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Mon Oct 28 12:08:49 2024 +0100
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Mon, 28 Oct 2024 12:08:49 +0100
+Subject: [PATCH] Get the efi app from fwupd-efi
 
-    Get the efi app from fwupd-efi
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index d9bab5264..ee91d34b0 100644
+index 16c7cad40..81804bf3b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -650,7 +650,7 @@ endif
+@@ -657,7 +657,7 @@ endif
  
  # EFI
  if build_standalone
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 92e6b11f9a22..1ede2215bf7a 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -3,6 +3,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
 
   # runPythonCommand
   runCommand,
@@ -134,7 +135,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.16";
+  version = "2.0.17";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -152,27 +153,33 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-fsjW3Idaqg4pNGaRP0bm2R94FcW2MVfPQwPFWrN+Qy8=";
+    hash = "sha256-PhG30TKwOqOCMI3e1D9cbNN6hKiVVyrzi9vG+CG5bY0=";
   };
 
   patches = [
     # Install plug-ins and libfwupdplugin to $out output,
     # they are not really part of the library.
-    ./install-fwupdplugin-to-out.patch
+    ./0001-Install-fwupdplugin-to-out.patch
 
     # Installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-    ./installed-tests-path.patch
+    ./0002-Add-output-for-installed-tests.patch
 
     # Since /etc is the domain of NixOS, not Nix,
     # we cannot install files there.
     # Let’s install the files to $prefix/etc
     # while still reading them from /etc.
     # NixOS module for fwupd will take take care of copying the files appropriately.
-    ./add-option-for-installation-sysconfdir.patch
+    ./0003-Add-option-for-installation-sysconfdir.patch
 
     # EFI capsule is located in fwupd-efi now.
-    ./efi-app-path.patch
+    ./0004-Get-the-efi-app-from-fwupd-efi.patch
+
+    # TODO: drop after 2.0.17
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/7ded10f22875da9b0f5f21cb41f8663049da6311.patch";
+      hash = "sha256-rEoSwcTmxJGX2ZdWAjDvsvgnP2qZp3ErnJVCIQlplhQ=";
+    })
   ];
 
   postPatch = ''
@@ -360,9 +367,11 @@ stdenv.mkDerivation (finalAttrs: {
       "fwupd/remotes.d/vendor-directory.conf"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA-2025PQ.pem"
       "pki/fwupd/LVFS-CA.pem"
       "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA-2025PQ.pem"
       "pki/fwupd-metadata/LVFS-CA.pem"
       "grub.d/35_fwupd"
     ];
diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix
index 3f7780ef1564..108053fa6894 100644
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.17.1";
+  version = "0.18.4";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-TKuI7UC9ofUzRZFqdjY2LEiagjdE2IC471iXkhUCAyw=";
+    hash = "sha256-hKtmIGysnJ2zlpfpd6W2yA2OqPwQW2xdaND6jMe7lgs=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/gi/gitleaks/package.nix b/pkgs/by-name/gi/gitleaks/package.nix
index 91a32b6de33f..5d4abc642e48 100644
--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   version = "8.28.0";
 
   src = fetchFromGitHub {
-    owner = "zricethezav";
+    owner = "gitleaks";
     repo = "gitleaks";
     tag = "v${version}";
     hash = "sha256-smh3Ge278lYVEcs6r1F43daexgjgddy1HKhU5E4CBYM=";
@@ -52,10 +52,13 @@ buildGoModule rec {
       Gitleaks is a SAST tool for detecting hardcoded secrets like passwords,
       API keys and tokens in git repos.
     '';
-    homepage = "https://github.com/zricethezav/gitleaks";
-    changelog = "https://github.com/zricethezav/gitleaks/releases/tag/v${version}";
+    homepage = "https://github.com/gitleaks/gitleaks";
+    changelog = "https://github.com/gitleaks/gitleaks/releases/tag/v${version}";
     license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      friedow
+    ];
     mainProgram = "gitleaks";
   };
 }
diff --git a/pkgs/by-name/go/goat/package.nix b/pkgs/by-name/go/goat/package.nix
index 0e364e22cfd1..f2c3bc98a6e2 100644
--- a/pkgs/by-name/go/goat/package.nix
+++ b/pkgs/by-name/go/goat/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "goat";
-  version = "0.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "blampe";
     repo = "goat";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/DR6RN7dCROp18P7dgm4DMppwdtYl0AOVNMEtXz8ldk=";
+    hash = "sha256-/m9qRTVrak+C4Df5y+36Ff7E0TdwHVbQEyrP+qfNF6E=";
   };
 
   vendorHash = "sha256-24YllmSUzRcqWbJ8NLyhsJaoGG2+yE8/eXX6teJ1nV8=";
diff --git a/pkgs/by-name/he/helix/package.nix b/pkgs/by-name/he/helix/package.nix
index aadb208723c4..c4ba2f0f3634 100644
--- a/pkgs/by-name/he/helix/package.nix
+++ b/pkgs/by-name/he/helix/package.nix
@@ -72,7 +72,6 @@ rustPlatform.buildRustPackage (final: {
     maintainers = with lib.maintainers; [
       danth
       yusdacra
-      zowoq
     ];
   };
 })
diff --git a/pkgs/by-name/hi/hifile/package.nix b/pkgs/by-name/hi/hifile/package.nix
index 075df1040c83..3e381fa8b2ca 100644
--- a/pkgs/by-name/hi/hifile/package.nix
+++ b/pkgs/by-name/hi/hifile/package.nix
@@ -2,8 +2,8 @@
   lib,
   appimageTools,
   fetchurl,
-  version ? "0.9.12.2",
-  hash ? "sha256-nhBLtsc9zz1tCFn7BWIqTVD/iTLHFUjXPmnslewoUCw=",
+  version ? "0.9.12.3",
+  hash ? "sha256-ImVZyO3ucBGtbXtHGocTap0GPt2/9x4nOLat2R4hwMQ=",
 }:
 
 let
diff --git a/pkgs/by-name/ja/jami/package.nix b/pkgs/by-name/ja/jami/package.nix
index e48cc2f146cf..05a221df4cc7 100644
--- a/pkgs/by-name/ja/jami/package.nix
+++ b/pkgs/by-name/ja/jami/package.nix
@@ -64,14 +64,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20251106.0";
+  version = "20251124.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-myL/vQrZltBGh/JRGq/GHFFoDLHYMvW4BLeLdIIzmo8=";
+    hash = "sha256-IQA6V0Sl+xhuit9kySpsSAS/a0GOsiT+ysYET91/gmc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/js/jsonschema-cli/package.nix b/pkgs/by-name/js/jsonschema-cli/package.nix
index c31c5c12ddfb..698a3533364b 100644
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.37.1";
+  version = "0.37.2";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-JjXRQ4u5ZbMO53vJJLSCqOhl4EeEH6sTyz4WTK7k55A=";
+    hash = "sha256-d/l43flElIooDs/daz7kNVumY7WophO3RwnxMsUGXzc=";
   };
 
-  cargoHash = "sha256-AP38iKce1UAwidTsakaryGOopC/BalAKfzOnvwOWg/0=";
+  cargoHash = "sha256-8fiAzUsYvWNjNhurvh6U2BXiQsBpTzsTo5DstK2MSB4=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/la/lact/package.nix b/pkgs/by-name/la/lact/package.nix
index 60057054f287..ef9cf6a8192e 100644
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -23,16 +23,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lact";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "ilya-zlobintsev";
     repo = "LACT";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZfUzsSdMLv6IaSbLkz9LBvdB4cS4oBE+R5toi9T7vR0=";
+    hash = "sha256-CbpUg+PB4Kx8AJavXY1GorNb3KfyKl8ovY2y2658UXI=";
   };
 
-  cargoHash = "sha256-K1/D5vi88Wjcvu/KZOkVr4q2MdMHTkhtyV8k8bvcGwg=";
+  cargoHash = "sha256-+3r3FXol7FzgpaasNT3uVT+PhfoRrRNS4z1iYPiwHRM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index 56da46923889..a60e23983158 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2025-11-14";
+  version = "0-unstable-2025-11-27";
 
   src = fetchFromGitHub {
     owner = "LadybirdBrowser";
     repo = "ladybird";
-    rev = "70b5496ecda0043b44ddfbbaf3ba0856c969db88";
-    hash = "sha256-98hbxfKBD9rf3AWB6fHZ57V0GgUtMfnk5dAxlAM+2e8=";
+    rev = "c790de24ddc7575a4ed2ea754d27afb6cde0ac22";
+    hash = "sha256-DZ4qj4polUH2xQvopY6ia/GyRe+L8WCGJPEryQAn/4E=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libwacom/package.nix b/pkgs/by-name/li/libwacom/package.nix
index 090986245f88..eb43c5a0148d 100644
--- a/pkgs/by-name/li/libwacom/package.nix
+++ b/pkgs/by-name/li/libwacom/package.nix
@@ -12,11 +12,12 @@
   libgudev,
   python3,
   valgrind,
+  libwacom-surface,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwacom";
-  version = "2.17.0";
+  version = "2.16.1";
 
   outputs = [
     "out"
@@ -27,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${finalAttrs.version}";
-    hash = "sha256-2JbO3B/PqsLKnaCeQcn1x9Z2pQL4kScuS39F1JlpDpc=";
+    hash = "sha256-YP6z+2HyIRmIAJIdJMbVTQA0rf3EXBZvlCdM4jrmHXM=";
   };
 
   postPatch = ''
@@ -72,7 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
     ]))
   ];
 
-  passthru = {
+  passthru.tests = {
+    inherit libwacom-surface;
     tests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
   };
 
diff --git a/pkgs/by-name/ma/marge-bot/package.nix b/pkgs/by-name/ma/marge-bot/package.nix
index 33bf33b2083d..0e962e468dbd 100644
--- a/pkgs/by-name/ma/marge-bot/package.nix
+++ b/pkgs/by-name/ma/marge-bot/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "marge-bot";
-  version = "0.18.0";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "marge-org";
     repo = "marge-bot";
     rev = version;
-    hash = "sha256-JaxUEXBxaZIh6fmOjSAa5FZnrO2uAnY3zKoO/mBukUU=";
+    hash = "sha256-FKUWVJqkhdxlWcOvyACQo/At0qW9Li+l25+9oCnA4nM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/md/mdbook-pagetoc/package.nix b/pkgs/by-name/md/mdbook-pagetoc/package.nix
index 8df1a54e148e..e56c7f1f0f2a 100644
--- a/pkgs/by-name/md/mdbook-pagetoc/package.nix
+++ b/pkgs/by-name/md/mdbook-pagetoc/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pagetoc";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "slowsage";
     repo = "mdbook-pagetoc";
     rev = "v${version}";
-    hash = "sha256-l3CR/ax1i2SJPxIubQUUJ5Hz/8uNl383YeHs8XZ8WGI=";
+    hash = "sha256-B94lIgOJC83cIkuggmfopTDEi9CUQ3nJJpzF9LdImUA=";
   };
 
-  cargoHash = "sha256-Ktui+bA1r1M1IfqWwMRAEF4JKEWmLN7Cx3AbRmv6RVc=";
+  cargoHash = "sha256-CazBgtNh4Z2wlfh9q0SjLsn70zh+aEg957Zq0kh45Hc=";
 
   meta = with lib; {
     description = "Table of contents for mdbook (in sidebar)";
diff --git a/pkgs/by-name/mj/mjpg-streamer/fix-undefined-symbol-error.patch b/pkgs/by-name/mj/mjpg-streamer/fix-undefined-symbol-error.patch
new file mode 100644
index 000000000000..771389bfb3ea
--- /dev/null
+++ b/pkgs/by-name/mj/mjpg-streamer/fix-undefined-symbol-error.patch
@@ -0,0 +1,29 @@
+From 7b24e2a593a0029c6f555c9001be87a34eceecc6 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Tue, 6 Aug 2024 17:04:55 +0200
+Subject: [PATCH] Export all symbols of mjpg_streamer binary
+
+Fixes runtime error with stripped binary
+
+    dlopen: /usr/lib/mjpg-streamer/input_uvc.so: undefined symbol: resolutions_help
+
+Source: http://lists.busybox.net/pipermail/buildroot/2024-August/759732.html
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ mjpg-streamer-experimental/CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mjpg-streamer-experimental/CMakeLists.txt b/mjpg-streamer-experimental/CMakeLists.txt
+index cf26620e..3ff12cdf 100644
+--- a/mjpg-streamer-experimental/CMakeLists.txt
++++ b/mjpg-streamer-experimental/CMakeLists.txt
+@@ -92,6 +92,7 @@ set (CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+ add_executable(mjpg_streamer mjpg_streamer.c
+                              utils.c)
+ 
++set_property(TARGET mjpg_streamer PROPERTY ENABLE_EXPORTS ON)
+ target_link_libraries(mjpg_streamer pthread dl)
+ install(TARGETS mjpg_streamer DESTINATION bin)
+ 
+
diff --git a/pkgs/by-name/mj/mjpg-streamer/package.nix b/pkgs/by-name/mj/mjpg-streamer/package.nix
index d94775bf61dc..34f28d7bbaf0 100644
--- a/pkgs/by-name/mj/mjpg-streamer/package.nix
+++ b/pkgs/by-name/mj/mjpg-streamer/package.nix
@@ -17,14 +17,23 @@ stdenv.mkDerivation {
     sha256 = "1cl159svfs1zzzrd3zgn4x7qy6751bvlnxfwf5hn5fmg4iszajw7";
   };
 
+  patches = [
+    # https://patchwork.ozlabs.org/project/buildroot/patch/20240808192126.1767471-1-bernd@kuhls.net/#3373402
+    # https://github.com/jacksonliam/mjpg-streamer/pull/401
+    ./fix-undefined-symbol-error.patch
+  ];
+
   prePatch = ''
-    cd mjpg-streamer-experimental
-    substituteInPlace ./CMakeLists.txt --replace-fail "cmake_minimum_required(VERSION 2.8.3)" "cmake_minimum_required(VERSION 2.8.3...3.10)"
+    substituteInPlace ./mjpg-streamer-experimental/CMakeLists.txt --replace-fail "cmake_minimum_required(VERSION 2.8.3)" "cmake_minimum_required(VERSION 2.8.3...3.10)"
   '';
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libjpeg ];
 
+  preConfigure = ''
+    cd mjpg-streamer-experimental
+  '';
+
   postFixup = ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/mjpg_streamer):$out/lib/mjpg-streamer" $out/bin/mjpg_streamer
   '';
diff --git a/pkgs/by-name/mk/mklittlefs/package.nix b/pkgs/by-name/mk/mklittlefs/package.nix
new file mode 100644
index 000000000000..a1f40f0981b5
--- /dev/null
+++ b/pkgs/by-name/mk/mklittlefs/package.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mklittlefs";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "earlephilhower";
+    repo = "mklittlefs";
+    tag = finalAttrs.version;
+    fetchSubmodules = true;
+    hash = "sha256-qCL5EG5HyUjObaRReptuNqMKKxOnyP8ZQpOKdLV4F80=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '$(shell git describe --tag)' '${finalAttrs.version}' \
+      --replace-fail '$(shell git -C littlefs describe --tags || echo "unknown")' '2.11.1'
+
+      patchShebangs run_tests.sh
+      patchShebangs tests/test_create
+  '';
+
+  makeFlags = [
+    "BUILD_CONFIG_NAME=-nixos"
+  ];
+
+  env = {
+    CPPFLAGS =
+      "-DLFS_NAME_MAX=255"
+      + lib.optionalString stdenv.hostPlatform.isDarwin " -Wno-error=vla-cxx-extension";
+  };
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  checkPhase = ''
+     runHook preCheck
+
+    ./run_tests.sh tests
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mklittlefs -t $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool to build and unpack littlefs images";
+    homepage = "https://github.com/earlephilhower/mklittlefs";
+    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "mklittlefs";
+  };
+})
diff --git a/pkgs/by-name/ne/networkmanager-ssh/package.nix b/pkgs/by-name/ne/networkmanager-ssh/package.nix
new file mode 100644
index 000000000000..b889c89d714e
--- /dev/null
+++ b/pkgs/by-name/ne/networkmanager-ssh/package.nix
@@ -0,0 +1,69 @@
+{
+  stdenv,
+  lib,
+  autoreconfHook,
+  fetchFromGitHub,
+  pkg-config,
+  networkmanager,
+  libsecret,
+  gtk3,
+  gtk4,
+  libnma-gtk4,
+  intltool,
+  openssh,
+  sshpass,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "NetworkManager-ssh";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "danfruehauf";
+    repo = "NetworkManager-ssh";
+    tag = finalAttrs.version;
+    hash = "sha256-ExCU22V4fYuFXW/HqJ39+PbYykXu4rpk8+3/hg9KTMo=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/nm-ssh-service.c \
+      --replace-fail /usr/bin/sshpass ${lib.getExe sshpass} \
+      --replace-fail /usr/bin/ssh ${lib.getExe openssh}
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    intltool
+    gtk4
+  ];
+
+  buildInputs = [
+    networkmanager
+    gtk3
+    gtk4
+    libsecret
+    libnma-gtk4
+  ];
+
+  configureFlags = [
+    "--with-gtk4"
+    "--enable-absolute-paths"
+  ];
+
+  strictDeps = true;
+
+  passthru = {
+    networkManagerPlugin = "VPN/nm-ssh-service.name";
+  };
+
+  meta = {
+    description = "SSH VPN integration for NetworkManager";
+    homepage = "https://github.com/danfruehauf/NetworkManager-ssh";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      zhangxy
+    ];
+    inherit (networkmanager.meta) platforms;
+  };
+})
diff --git a/pkgs/by-name/nx/nxwitness-client/package.nix b/pkgs/by-name/nx/nxwitness-client/package.nix
index 3087b24c8ac0..e34b7081d4d9 100644
--- a/pkgs/by-name/nx/nxwitness-client/package.nix
+++ b/pkgs/by-name/nx/nxwitness-client/package.nix
@@ -23,8 +23,8 @@
   xcbutilwm,
 }:
 let
-  version = "6.0.3";
-  build = "40736";
+  version = "6.0.6";
+  build = "41837";
 
   buildInputs = [
     glib
@@ -67,7 +67,7 @@ let
 
     src = fetchurl {
       url = "https://updates.networkoptix.com/default/${build}/linux/nxwitness-client-${finalAttrs.version}-linux_x64.deb";
-      hash = "sha256-flOTNKklovpvtFDWE64clL3Jk1cmT4SVgs1NQZZaXpc=";
+      hash = "sha256-qp3frZqVr6nJonUrcyM2xIliWkwf4aSge3oyWkrzzSs=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 671c194a0f49..52ff85df8297 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.11.2";
+  version = "25.11.5";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-SkHtuS43pYHzPyCxB6tvPI074T/GONm3I/nXGzwMHns=";
+    hash = "sha256-wXPrYcIAH4X4BP3RfWtVrgHPcc+IWPZcbOFdWdV57Ec=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/rehex/package.nix b/pkgs/by-name/re/rehex/package.nix
index 8ef49c0dda68..4f3d06a33229 100644
--- a/pkgs/by-name/re/rehex/package.nix
+++ b/pkgs/by-name/re/rehex/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rehex";
-  version = "0.63.3";
+  version = "0.63.4";
 
   src = fetchFromGitHub {
     owner = "solemnwarning";
     repo = "rehex";
     tag = version;
-    hash = "sha256-o/ff0V0pMomXRu1DrD/m+M6364NisUI+8+RwryIsSLc=";
+    hash = "sha256-Iy87iEadK9fXApeYpJbG0jV437wGJxlOoiJLfaUTkVs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rp/rpm-sequoia/package.nix b/pkgs/by-name/rp/rpm-sequoia/package.nix
index cf06eeb51fb9..c0454dc67337 100644
--- a/pkgs/by-name/rp/rpm-sequoia/package.nix
+++ b/pkgs/by-name/rp/rpm-sequoia/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rpm-sequoia";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "rpm-sequoia";
     tag = "v${version}";
-    hash = "sha256-KYoxQwQTcc75VEwWXEhHd+GNowzC7JlcIf6r7WM4Els=";
+    hash = "sha256-/PdbCBpEWig+acLvrN5nhJ6ca+tAh2bpqDLTRJoFuWU=";
   };
 
-  cargoHash = "sha256-oKk768pgMYMJ3NTSlzqV1Y61fyu2DxY62JOpLKfUUY4=";
+  cargoHash = "sha256-Qi46nlgX/k2rRAvCToXkfZpjt7ERu25/4WUIIQUOC/I=";
 
   patches = [
     ./objdump.patch
diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index 6e0fc961a771..8a25c21eeec4 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "runc";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ci/2otySB7FaFoutmzWeVaTU+tO/lnluQfneFSQM1RE=";
+    hash = "sha256-XPS9qWgDyKVLYs/QqWof6ydVK1T41QD8yDpvztc3NMc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sk/skaffold/package.nix b/pkgs/by-name/sk/skaffold/package.nix
index 8ea3894fcc1f..833c5de2570e 100644
--- a/pkgs/by-name/sk/skaffold/package.nix
+++ b/pkgs/by-name/sk/skaffold/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.16.1";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    hash = "sha256-pQyudlU/nn9ZcX4RLp3RvXntxgra3Vs4+HOjvBOKrow=";
+    hash = "sha256-2IXUQo6o9HiU5/98mMp96Mzjmku2YhiZu3EROSTtG3o=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sp/spec-kit/package.nix b/pkgs/by-name/sp/spec-kit/package.nix
new file mode 100644
index 000000000000..320a61547ffc
--- /dev/null
+++ b/pkgs/by-name/sp/spec-kit/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "spec-kit";
+  version = "0.0.86";
+
+  src = fetchFromGitHub {
+    owner = "github";
+    repo = "spec-kit";
+    tag = "v${version}";
+    hash = "sha256-zgiJN7rzD5x/xpL6CMvxITy+/YTu1TKk26UhhQ/s5V8=";
+  };
+
+  pyproject = true;
+
+  build-system = with python3Packages; [
+    hatchling
+  ];
+
+  dependencies =
+    with python3Packages;
+    [
+      typer
+      rich
+      httpx
+      platformdirs
+      readchar
+      truststore
+    ]
+    ++ httpx.optional-dependencies.socks;
+
+  pythonImportsCheck = [
+    "specify_cli"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Bootstrap your projects for Spec-Driven Development (SDD)";
+    homepage = "https://github.com/github/spec-kit";
+    changelog = "https://github.com/github/spec-kit/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luochen1990 ];
+    mainProgram = "specify";
+  };
+}
diff --git a/pkgs/by-name/st/stylance-cli/package.nix b/pkgs/by-name/st/stylance-cli/package.nix
index 1dabebb06908..33af631b3b43 100644
--- a/pkgs/by-name/st/stylance-cli/package.nix
+++ b/pkgs/by-name/st/stylance-cli/package.nix
@@ -2,17 +2,25 @@
   lib,
   rustPlatform,
   fetchCrate,
+  versionCheckHook,
 }:
-rustPlatform.buildRustPackage rec {
+let
   pname = "stylance-cli";
-  version = "0.7.1";
+  version = "0.7.4";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Cdv+Lz+l0+8Jdk9stHACXDbUPedM/YryDMExdsqVvsU=";
+    hash = "sha256-lGgKmNqZ0nflVAM3GMDwGgxnXyLCqVz1bTUsvabXmj8=";
   };
 
-  cargoHash = "sha256-cwgR5AHCeS9YkaJlyFxvEOrBXg7/tXNGXgtSEPHAwm4=";
+  cargoHash = "sha256-HWZQNEKTyNnmA1twN5cfo5RY2tOeCnL6zEp+M4F+Tqg=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Library and cli tool for working with scoped CSS in rust";
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index 90229c95b91d..b513fda7ce47 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wstunnel";
-  version = "10.5.0";
+  version = "10.5.1";
 
   src = fetchFromGitHub {
     owner = "erebe";
     repo = "wstunnel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z+hlmlvVXyt6tVl4HqTLmPHYLr7CtR055L6MHe+uhnc=";
+    hash = "sha256-2KNqxhi5fFfw54iPKZrJF0G0q6I0uNWzdC81T19GyaE=";
   };
 
-  cargoHash = "sha256-n+0n+tLT0wbNXe/uVb8OJVXsgk16tL/hBIcvnW6OYzs=";
+  cargoHash = "sha256-2A3t1l8iBSufBcl/IjZBJoPv3ZfKH2bdBQjnZxLWFBE=";
 
   cargoBuildFlags = [ "--package wstunnel-cli" ];
 
diff --git a/pkgs/by-name/ya/yaydl/package.nix b/pkgs/by-name/ya/yaydl/package.nix
index ef637879a17b..06e0bb65ab4e 100644
--- a/pkgs/by-name/ya/yaydl/package.nix
+++ b/pkgs/by-name/ya/yaydl/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yaydl";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "dertuxmalwieder";
     repo = "yaydl";
     rev = "release-${version}";
-    sha256 = "sha256-PSrLjqZ38gBlTiV6qMB3LzrcaqtM6hnZMI1uto24H94=";
+    sha256 = "sha256-blnDixttkmArDQUR6r5PAqa417uh8hmFi8mia/Z0zBA=";
   };
 
-  cargoHash = "sha256-+BBB9YbYjNG7S+Lex/pwp7z06JbG+qMRI+TwSvMcYgg=";
+  cargoHash = "sha256-7thGKPBMjkC06n8qyIfx/edFaBx8VS6FUqnf7dowtWk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index c3d721e1977c..2569b5c68397 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -101,7 +101,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.214.5";
+  version = "0.214.6";
 
   outputs = [
     "out"
@@ -114,7 +114,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z22/Fbj5nu7T8vI7TECHXN5oIsEf7b2LHdBWWvDmDL4=";
+    hash = "sha256-QEhvp0/ywD6bZff0VZ1mrs2oB3UGHaZl707kWBaZJOk=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-cJSvmo6Bz+X3m9NoSVLEYNX0ezFf6AFGjs2xw0MBmpY=";
+  cargoHash = "sha256-y5hFHYoG1tM+O/64cDhjLbbQxiL0pTgSPRxVVuo0Bs4=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
index 8da9ee23c508..4b0a249de9af 100644
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonApplication rec {
   pname = "gnome-extensions-cli";
-  version = "0.10.6";
+  version = "0.10.8";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "gnome_extensions_cli";
     inherit version;
-    hash = "sha256-REsdgsHPYBms+qbOF4ogV8D/xi5fC9ogl+HOvnsXi7o=";
+    hash = "sha256-Tnf8BbW9u7d19ZtGTdMVHa6azbKekYRGOPEPNiB+y00=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/cuda-modules/packages/cuda_nvcc.nix b/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
index 27eacde61847..75c81476d109 100644
--- a/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
+++ b/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
@@ -8,6 +8,7 @@
   cuda_cccl,
   lib,
   libnvvm,
+  makeBinaryWrapper,
 }:
 buildRedist (finalAttrs: {
   redistName = "cuda";
@@ -22,6 +23,10 @@ buildRedist (finalAttrs: {
   # The nvcc and cicc binaries contain hard-coded references to /usr
   allowFHSReferences = true;
 
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
   # Entries here will be in nativeBuildInputs when cuda_nvcc is in nativeBuildInputs
   propagatedBuildInputs = [ setupCudaHook ];
 
@@ -144,13 +149,19 @@ buildRedist (finalAttrs: {
         EOF
       ''
       # Add the dependency on backendStdenv.cc to the nvcc.profile.
+      # NOTE: NVCC explodes in horrifying fashion if GCC is not on PATH -- it fails even before
+      # reading nvcc.profile!
       + ''
-        nixLog "adding backendStdenv.cc to nvcc.profile"
+        nixLog "setting compiler-bindir to backendStdenv.cc in nvcc.profile"
         cat << EOF >> "''${!outputBin:?}/bin/nvcc.profile"
-
         # Fix a compatible backend compiler
-        PATH += "${backendStdenv.cc}/bin":
+        compiler-bindir = ${backendStdenv.cc}/bin
         EOF
+
+        nixLog "wrapping nvcc to add backendStdenv.cc to its PATH"
+        wrapProgramBinary \
+          "''${!outputBin:?}/bin/nvcc" \
+          --prefix PATH : ${lib.makeBinPath [ backendStdenv.cc ]}
       ''
     );
 
diff --git a/pkgs/development/cuda-modules/packages/setupCudaHook/package.nix b/pkgs/development/cuda-modules/packages/setupCudaHook/package.nix
index d7560f132c4c..c15f9a6015aa 100644
--- a/pkgs/development/cuda-modules/packages/setupCudaHook/package.nix
+++ b/pkgs/development/cuda-modules/packages/setupCudaHook/package.nix
@@ -5,9 +5,6 @@ makeSetupHook {
 
   substitutions.setupCudaHook = placeholder "out";
 
-  # Point NVCC at a compatible compiler
-  substitutions.ccRoot = "${backendStdenv.cc}";
-
   # Required in addition to ccRoot as otherwise bin/gcc is looked up
   # when building CMakeCUDACompilerId.cu
   substitutions.ccFullPath = "${backendStdenv.cc}/bin/${backendStdenv.cc.targetPrefix}c++";
diff --git a/pkgs/development/cuda-modules/packages/setupCudaHook/setup-cuda-hook.sh b/pkgs/development/cuda-modules/packages/setupCudaHook/setup-cuda-hook.sh
index 1b0e6bf9c868..df43187b703d 100644
--- a/pkgs/development/cuda-modules/packages/setupCudaHook/setup-cuda-hook.sh
+++ b/pkgs/development/cuda-modules/packages/setupCudaHook/setup-cuda-hook.sh
@@ -92,8 +92,6 @@ setupCUDAToolkitCompilers() {
     export CUDAHOSTCXX="@ccFullPath@"
   fi
 
-  appendToVar NVCC_PREPEND_FLAGS "--compiler-bindir=@ccRoot@/bin"
-
   # NOTE: We set -Xfatbin=-compress-all, which reduces the size of the compiled
   #   binaries. If binaries grow over 2GB, they will fail to link. This is a problem for us, as
   #   the default set of CUDA capabilities we build can regularly cause this to occur (for
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 31b284c3cc49..ffda0f7b8092 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -217,6 +217,10 @@ stdenv.mkDerivation {
     # is ignored when freedreno is not being built.
     (lib.mesonOption "freedreno-kmds" "msm,kgsl,virtio,wsl")
 
+    # Enable virtio-gpu kernel mode driver (native context) support for amdgpu as well.
+    # This option is ignored when RadeonSI/RADV are not being built.
+    (lib.mesonBool "amdgpu-virtio" true)
+
     # Required for OpenCL
     (lib.mesonOption "clang-libdir" "${lib.getLib llvmPackages.clang-unwrapped}/lib")
 
diff --git a/pkgs/development/python-modules/bosch-alarm-mode2/default.nix b/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
index f5e833f1f844..279a3bacc00b 100644
--- a/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
+++ b/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "bosch-alarm-mode2";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mag1024";
     repo = "bosch-alarm-mode2";
     tag = "v${version}";
-    hash = "sha256-3eb9Exhu3ME++m+JRCVNpiUVIE3QSb9NRmvi+wZf/QY=";
+    hash = "sha256-UafhNafZ1qb/OYXSvMGaIzDxVGf4jVmdGyv4xrcU43g=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/typical/default.nix b/pkgs/development/python-modules/typical/default.nix
deleted file mode 100644
index 6c59fb927ef5..000000000000
--- a/pkgs/development/python-modules/typical/default.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fastjsonschema,
-  fetchFromGitHub,
-  future-typing,
-  inflection,
-  orjson,
-  pandas,
-  pendulum,
-  poetry-core,
-  pydantic,
-  pytestCheckHook,
-  pythonOlder,
-  sqlalchemy,
-  ujson,
-}:
-
-buildPythonPackage rec {
-  pname = "typical";
-  version = "2.9.0";
-  pyproject = true;
-
-  disabled = pythonOlder "3.10";
-
-  src = fetchFromGitHub {
-    owner = "seandstewart";
-    repo = "typical";
-    tag = "v${version}";
-    hash = "sha256-RS4hJ7NufClroRPRO3EyHwDaMgg0s0F7D/mqcBr8O18=";
-  };
-
-  pythonRelaxDeps = [ "pendulum" ];
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    fastjsonschema
-    future-typing
-    inflection
-    orjson
-    pendulum
-    ujson
-  ];
-
-  nativeCheckInputs = [
-    pandas
-    pydantic
-    pytestCheckHook
-    sqlalchemy
-  ];
-
-  disabledTests = [
-    # ConstraintValueError: Given value <{'key...
-    "test_tagged_union_validate"
-    # TypeError: 'NoneType' object cannot be interpreted as an integer
-    "test_ujson"
-    # Failed: DID NOT RAISE <class 'ValueError'>
-    "test_invalid_path"
-    # AssertionError
-    "test_primitive"
-    "test_tojson"
-    "test_transmute_simple"
-  ];
-
-  disabledTestPaths = [
-    # We don't care about benchmarks
-    "benchmark/"
-    # Tests are failing on Hydra
-    "tests/mypy/test_mypy.py"
-  ];
-
-  pythonImportsCheck = [ "typic" ];
-
-  meta = with lib; {
-    description = "Python library for runtime analysis, inference and validation of Python types";
-    homepage = "https://python-typical.org/";
-    changelog = "https://github.com/seandstewart/typical/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kfollesdal ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4dd70ee3e221..67a885b5bded 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -480,6 +480,7 @@ mapAliases {
   typed-ast = throw "typed-ast was removed because it went end of life in July 2023"; # added 2025-05-24
   types-typed-ast = throw "types-typed-ast was removed because so was typed-ast"; # added 2025-05-24
   typesystem = throw "'typesystem' has been removed as it was broken, unmaintained, and archived upstream"; # Added 2025-11-27
+  typical = throw "'typical' has been removed as it was broken and archived upstream"; # Added 2025-11-27
   uamqp = throw "'uamqp' has been removed because it is broken and unmaintained."; # added 2025-06-11
   ufoLib2 = throw "'ufoLib2' has been renamed to/replaced by 'ufolib2'"; # Converted to throw 2025-10-29
   unicode-slugify = throw "'unicode-slugify' has been removed becaues it was broken and unmaintained. Consider using 'python-slugify' instead."; # added 2025-10-05
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e032634101cd..46364e09c018 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19715,8 +19715,6 @@ self: super: with self; {
 
   typeshed-client = callPackage ../development/python-modules/typeshed-client { };
 
-  typical = callPackage ../development/python-modules/typical { };
-
   typing = null;
 
   typing-extensions = callPackage ../development/python-modules/typing-extensions { };