diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fd5ff092fcc1..de9446fdeb0c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6147,6 +6147,11 @@
     githubId = 1279939;
     name = "Daniel Beckwith";
   };
+  dbeley = {
+    github = "dbeley";
+    githubId = 6568955;
+    name = "David Beley";
+  };
   dbirks = {
     email = "david@birks.dev";
     github = "dbirks";
diff --git a/nixos/modules/services/misc/languagetool.nix b/nixos/modules/services/misc/languagetool.nix
index 938a937af6c4..21ad24ed55a9 100644
--- a/nixos/modules/services/misc/languagetool.nix
+++ b/nixos/modules/services/misc/languagetool.nix
@@ -55,8 +55,6 @@ in
       '';
     };
 
-    jrePackage = lib.mkPackageOption pkgs "jre" { };
-
     jvmOptions = lib.mkOption {
       description = ''
         Extra command line options for the JVM running languagetool.
@@ -70,8 +68,15 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "languagetool"
+      "jrePackage"
+    ] "The jre is now always taken from the package's jre attribute.")
+  ];
 
+  config = lib.mkIf cfg.enable {
     systemd.services.languagetool = {
       description = "LanguageTool HTTP server";
       wantedBy = [ "multi-user.target" ];
@@ -89,7 +94,7 @@ in
         ProtectHome = "yes";
         Restart = "on-failure";
         ExecStart = ''
-          ${cfg.jrePackage}/bin/java \
+          ${lib.getExe cfg.package.jre} \
             -cp ${cfg.package}/share/languagetool-server.jar \
             ${toString cfg.jvmOptions} \
             org.languagetool.server.HTTPServer \
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 6898c8107be6..0e38fb27508f 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -101,6 +101,7 @@ let
         "node-cert"
         "nut"
         "nvidia-gpu"
+        "opnsense"
         "pgbouncer"
         "php-fpm"
         "pihole"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/opnsense.nix b/nixos/modules/services/monitoring/prometheus/exporters/opnsense.nix
new file mode 100644
index 000000000000..7f636cb7446f
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/opnsense.nix
@@ -0,0 +1,117 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.opnsense;
+  inherit (lib)
+    mkOption
+    types
+    optionalString
+    concatStringsSep
+    concatMapStringsSep
+    ;
+in
+{
+  port = 9144;
+  extraOpts = {
+    opnsenseServerAddress = mkOption {
+      type = types.str;
+      default = "192.168.1.1";
+      example = "192.168.100.254";
+      description = ''
+        Opnsense IP address of the opnsense appliance.
+        Defaults to 192.168.1.1
+      '';
+    };
+    opnsenseServerProtocol = mkOption {
+      type = types.enum [
+        "http"
+        "https"
+      ];
+      default = "https";
+      example = "http";
+      description = ''
+        Opnsense metrics scraper protocol to use.
+        Defaults to https.
+      '';
+    };
+    apiKeyFile = mkOption {
+      type = types.nullOr types.path;
+      description = ''
+        File containing the api key.
+      '';
+    };
+    apiSecretFile = mkOption {
+      type = types.nullOr types.path;
+      description = ''
+        File containing the api secret.
+      '';
+    };
+    user = mkOption {
+      type = types.str;
+      default = "opnsense";
+      description = ''
+        User name under which the opensense exporter shall be run.
+      '';
+    };
+    group = mkOption {
+      type = types.str;
+      default = "opnsense";
+      description = ''
+        Group under which the opnsense exporter shall be run.
+      '';
+    };
+    enabledExporter = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "disable-openvpn" ];
+      description = ''
+        Collectors to enable or disable.
+        All collectors are enabled by default.
+      '';
+    };
+    disabledExporter = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "disable-openvpn" ];
+      description = ''
+        Collectors to enable or disable.
+        All collectors are enabled by default.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      LoadCredential = [
+        "${optionalString (cfg.apiKeyFile != null) "opnsense.api-key=${cfg.apiKeyFile}"}"
+        "${optionalString (cfg.apiSecretFile != null) "opnsense.api-secret=${cfg.apiSecretFile}"}"
+      ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectClock = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      ExecStart = ''
+        ${lib.getExe pkgs.prometheus-opnsense-exporter} \
+          ${concatMapStringsSep " " (x: "--exporter." + x) cfg.enabledExporter} \
+          ${concatMapStringsSep " " (x: "--no-exporter." + x) cfg.disabledExporter} \
+          --opnsense.address ${cfg.opnsenseServerAddress} \
+          --opnsense.protocol ${cfg.opnsenseServerProtocol} \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " " cfg.extraFlags}
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index f04ad6e393ed..d04d02660528 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -832,7 +832,7 @@ in
     # FIXME: somehow check for unknown driver names.
     services.xserver.drivers = flip concatMap cfg.videoDrivers (
       name:
-      lib.optional (videoDrivers ? name) (
+      lib.optional (videoDrivers ? ${name}) (
         {
           inherit name;
           modules = [ ];
diff --git a/pkgs/applications/audio/deadbeef/wrapper.nix b/pkgs/applications/audio/deadbeef/wrapper.nix
index c3074e7b2e07..c5bc3de9541c 100644
--- a/pkgs/applications/audio/deadbeef/wrapper.nix
+++ b/pkgs/applications/audio/deadbeef/wrapper.nix
@@ -6,7 +6,8 @@
 }:
 
 symlinkJoin {
-  name = "deadbeef-with-plugins-${deadbeef.version}";
+  pname = "deadbeef-with-plugins";
+  inherit (deadbeef) version;
 
   paths = [ deadbeef ] ++ plugins;
 
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
index 5f785037ee68..64fc91df1753 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
@@ -10,13 +10,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.13.1";
+  version = "2.16.3";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-9pzEO5RzDTX0BVg06XA0AiD9gCmpp1eEqH3Adqptrrs=";
+    hash = "sha256-nIDjE5hf5kt3diEFgUEBz4dCxHatCYtdHY5Zc4YlHFg=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];
diff --git a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
index d69aba1d33fe..9abd54a7691d 100644
--- a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1769378769";
-    hash = "sha256-IZINJWzQ9/3YWprSYaH4IAksZtNFiTPC9+YDAOde3LU=";
+    version = "0.0.1769991964";
+    hash = "sha256-RlACEEbRZjeM1JUgAxfMlwFIo8CmrJxr1DVq1XxRdoM=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
index 6929b93500c2..12b4d9b24548 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-01-23";
+  version = "0-unstable-2026-01-30";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "3a1184d1e1c7ed15752e9fe4a0594e68b4a41e11";
-    hash = "sha256-AfqhZJT+AF814udA7K1Kja1fLSh07cHpRl+Mu8wphv0=";
+    rev = "d5e2d68065e644a5e807c14419411039c78731df";
+    hash = "sha256-MDTpYTOD1Zf1Smv+JQZARaeldYiTv2vA/buFC709ZpE=";
   };
 
   extraBuildInputs = lib.optionals withHw [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 21dfa8cdf5d8..7248a1f7dd66 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-zcYB7DEwffVzPm4OXots9Z7Gzu6k/Pcaa4ell0gT33Q=",
+    "hash": "sha256-gzjvdAuT3HDMRULa+b2u75zqei4x1ylj3NGyHh4qa+U=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v7.31.0",
+    "rev": "v7.32.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index adb295c8c682..93433662a62a 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -29,6 +29,11 @@ let
         # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
         (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
       ];
+      # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+      extraPostPatch = lib.optionalString (lib.versionAtLeast version "147") ''
+        find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+      '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -60,8 +65,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "146.0.1";
-    sha512 = "8a3b2de246c7c597574fce596836c7ef7b24bd21573feb15c308003f34b82335ad865aa0f81b24d1669c8023c0448c0e273a63019aab13356b023c2e8adc2c47";
+    version = "147.0.1";
+    sha512 = "bae9adbcb1d45a7644e4d699215a3da85b612b9d99516bdf12f84482f1a6f89153ec4d5ab6dd8bcf69dc512cb50080db4630a5bb52525f22213c7af92b4b77d7";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/ab/abduco/package.nix b/pkgs/by-name/ab/abduco/package.nix
index 6410c8d10919..51099f2aa197 100644
--- a/pkgs/by-name/ab/abduco/package.nix
+++ b/pkgs/by-name/ab/abduco/package.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation {
 
   installFlags = [ "install-completion" ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   patches = [
     # https://github.com/martanne/abduco/pull/22
     (fetchpatch {
diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json
index 12440ca25616..251b88aa5dc8 100644
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.11-stable",
+  "version": "1.3.13-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.11-stable/acli_1.3.11-stable_darwin_arm64.tar.gz",
-      "sha256": "39f80d387324923f0093b455ee4d3d4bd2af44ffd52be33c1d69e8418376d0e4"
+      "url": "https://acli.atlassian.com/darwin/1.3.13-stable/acli_1.3.13-stable_darwin_arm64.tar.gz",
+      "sha256": "043c5422327610e82fd83ac79ca3ddf0c917611386f7527564db4c8bc99388b1"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.11-stable/acli_1.3.11-stable_linux_arm64.tar.gz",
-      "sha256": "43cc72aca128605f0580fc404f14efef6659bb754c9bd3343fb5f43d1f2bbf4b"
+      "url": "https://acli.atlassian.com/linux/1.3.13-stable/acli_1.3.13-stable_linux_arm64.tar.gz",
+      "sha256": "522da066d9a4bc357eaf8fcca763a0be3048fd0e5595aa433d6904065472dd56"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.11-stable/acli_1.3.11-stable_darwin_amd64.tar.gz",
-      "sha256": "84a56f7197bcdc5358a035c79bb706dbd80405255fc90f260973a268831ffe18"
+      "url": "https://acli.atlassian.com/darwin/1.3.13-stable/acli_1.3.13-stable_darwin_amd64.tar.gz",
+      "sha256": "8cd7231e951222c0b75728359844a9c76238dcad31542d66226f08498b1da9aa"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.11-stable/acli_1.3.11-stable_linux_amd64.tar.gz",
-      "sha256": "50bb48e965e48531e008923be763a7b1f74fe9e2e33cc02cd2aaf5e2f00c6dc4"
+      "url": "https://acli.atlassian.com/linux/1.3.13-stable/acli_1.3.13-stable_linux_amd64.tar.gz",
+      "sha256": "1873a8b53123aec8a9c015707c89a49f7dbd8ac995113146841f29ea06259f9a"
     }
   }
 }
diff --git a/pkgs/by-name/an/angryoxide/package.nix b/pkgs/by-name/an/angryoxide/package.nix
index e896edfbe506..f15951147eb9 100644
--- a/pkgs/by-name/an/angryoxide/package.nix
+++ b/pkgs/by-name/an/angryoxide/package.nix
@@ -19,13 +19,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "angryoxide";
-  version = "0.8.32";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "Ragnt";
     repo = "AngryOxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Sla5lvyqZho9JE4QVS9r0fx5+DVlU90c8OSfO4/f0B4=";
+    hash = "sha256-OMNpAp+SmwFlNFlsL3DVgUYja+4o26B7AbR8JMz/4JA=";
   };
 
   postPatch = ''
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s ${libwifi} libs/libwifi
   '';
 
-  cargoHash = "sha256-mry4l0a7DZOWkrChU40OVRCBjKwI39cyZtvEBA5tro0=";
+  cargoHash = "sha256-dktJEcX4IbhwDyfptA6PZaAcvF6RRC+jWTspnHaof4s=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/bi/binsider/package.nix b/pkgs/by-name/bi/binsider/package.nix
index 3f68296992a7..faf69fd81fd2 100644
--- a/pkgs/by-name/bi/binsider/package.nix
+++ b/pkgs/by-name/bi/binsider/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "binsider";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "binsider";
     rev = "v${version}";
-    hash = "sha256-ZfLFZXLnH5nBg/5ufOfwMG8c8n+BDex3j7da+Hvh1fw=";
+    hash = "sha256-Un3pKb0+5rwK0tKRp+HVl3vynPt5V8YxhPiLgshL3L0=";
   };
 
-  cargoHash = "sha256-HnJBeqZhzDT0XfZ5UDg+lWMaX8tP7Q4iXrAz84XM3QE=";
+  cargoHash = "sha256-Lcnc2fVyzip+g/mZvbMarQHkjBTNhKB5kZVTHFsR+Xo=";
 
   buildNoDefaultFeatures = !stdenv.hostPlatform.isLinux;
 
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index f032edfc7776..9a07cf8e1be0 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.36.5";
+  version = "2.37.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-cVWlqVtukRD/ojjcRM6F/4wnhrlTTqQEJqc9NoW7gFw=";
+    hash = "sha256-CxWFqrgj/oYsD3yBjR4fdh7FSAaGZnbC6OB9H1VH+m0=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix
index 70921d357fca..248976e703f3 100644
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -8,16 +8,16 @@
 
 php83.buildComposerProject2 (finalAttrs: {
   pname = "bookstack";
-  version = "25.12.1";
+  version = "25.12.3";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = "bookstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lp2qC2K2RnWgI0g/67WNPtatbLCTUau37PcLqG6dQlw=";
+    hash = "sha256-IP1IffCDPPudtgwIv3gqPud9p7WjGbXrLlnoAZ56Gu8=";
   };
 
-  vendorHash = "sha256-kbyFPDg9ev0IjvqtFoTiiYyza2oriAhMLbAU7Js9Dyc=";
+  vendorHash = "sha256-Q7Qz/LwycyKjDuD6vBQY6z7CcT4H/i+9KaC13CgS6Fc=";
 
   passthru = {
     phpPackage = php83;
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 3c54b900168e..cf5f7140ea9b 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.9.23";
+  version = "0.9.24";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-QDNfSA9DErES1QrreQyFZpgEv0tgaMao1vsle/jHYbc=";
-        aarch64-linux = "sha256-3dvzFJsoKhEgmSEqTw7aK466zexUQeTDkE0XqYVYDoY=";
-        x86_64-darwin = "sha256-N8alWOiEUVGZY3gkTEM8eQ41U+j+leKfUdv26YqBHao=";
-        aarch64-darwin = "sha256-OgpmcYrIjYdE37X3KC2iCrGKUTrLCRViVsDYsVFYsXU=";
+        x86_64-linux = "sha256-fgdc2RjELrg0RCeehZ9RnJOUdAPFsI5Ev8sCsnWEVMw=";
+        aarch64-linux = "sha256-F0f7iZihZCnTGTH7zP7jZGWtpkRkdGLdx/4+wji4T2A=";
+        x86_64-darwin = "sha256-NXsc5vFGNWOHf1Y7zYR19Tcqi0frZ3PDyCPbR7UWk2c=";
+        aarch64-darwin = "sha256-IV/lSSsN88uiI/AoySZub9b6Xdj+r0Nx1uMrE+wyvOU=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/co/coq-kernel/package.nix b/pkgs/by-name/co/coq-kernel/package.nix
index 630c95cd0f4f..cd9966c52fd6 100644
--- a/pkgs/by-name/co/coq-kernel/package.nix
+++ b/pkgs/by-name/co/coq-kernel/package.nix
@@ -52,6 +52,7 @@ let
     runCommand "coq-kernel-launcher"
       {
         nativeBuildInputs = [ makeWrapper ];
+        inherit (coq-jupyter) pname version;
       }
       ''
         mkdir -p $out/bin
diff --git a/pkgs/by-name/du/ducker/package.nix b/pkgs/by-name/du/ducker/package.nix
index 921068303a59..665e3ec3a2e6 100644
--- a/pkgs/by-name/du/ducker/package.nix
+++ b/pkgs/by-name/du/ducker/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "ducker";
-  version = "0.5.7";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "robertpsoane";
     repo = "ducker";
     tag = "v${version}";
-    sha256 = "sha256-e9L0K6dP0DjMpN0TDLkqu4wmff8cEfHmB7PRP+mQiR8=";
+    sha256 = "sha256-mC6MWVg6T8w9YQvu1UDpiDplsoKb3UN+LFgzveBgyew=";
   };
 
-  cargoHash = "sha256-K76VDSqXSNxMGFBrtv5oV49IwvMu7rglmiYaWXR3fBE=";
+  cargoHash = "sha256-DOH0fykhONoFtKZ4Mlgu8GLEQ6o5T1V9box1qG/pEQA=";
 
   meta = {
     description = "Terminal app for managing docker containers, inspired by K9s";
diff --git a/pkgs/by-name/ec/ecm/package.nix b/pkgs/by-name/ec/ecm/package.nix
index b3dda039fd12..7b0f55d2dcc9 100644
--- a/pkgs/by-name/ec/ecm/package.nix
+++ b/pkgs/by-name/ec/ecm/package.nix
@@ -6,17 +6,12 @@
   m4,
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "ecm";
   version = "7.0.6";
-  name = "${pname}-${version}";
-in
-
-stdenv.mkDerivation {
-  inherit name;
 
   src = fetchurl {
-    url = "https://gitlab.inria.fr/zimmerma/ecm/uploads/ad3e5019fef98819ceae58b78f4cce93/ecm-${version}.tar.gz";
+    url = "https://gitlab.inria.fr/zimmerma/ecm/uploads/ad3e5019fef98819ceae58b78f4cce93/ecm-${finalAttrs.version}.tar.gz";
     hash = "sha256-fSDs5hq2ogrYXywYBkyr133Eapb/iUtSINuxbkZm6KU=";
   };
 
@@ -49,4 +44,4 @@ stdenv.mkDerivation {
     maintainers = [ lib.maintainers.roconnor ];
     platforms = with lib.platforms; linux ++ darwin;
   };
-}
+})
diff --git a/pkgs/by-name/ed/edopro/package.nix b/pkgs/by-name/ed/edopro/package.nix
index 8823fdc6d7ae..82218d5097b2 100644
--- a/pkgs/by-name/ed/edopro/package.nix
+++ b/pkgs/by-name/ed/edopro/package.nix
@@ -396,7 +396,7 @@ let
   '';
 in
 symlinkJoin {
-  name = "edopro-application-${deps.edopro-version}";
+  pname = "edopro-application";
   version = deps.edopro-version;
   paths = [
     edopro-script
diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
index a4a945fa3b67..74b12d3ff4a6 100644
--- a/pkgs/by-name/fe/feishu/package.nix
+++ b/pkgs/by-name/fe/feishu/package.nix
@@ -65,12 +65,12 @@
 let
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/e91d15e2/Feishu-linux_x64-7.50.14.deb";
-      sha256 = "sha256-Ywlf3qi4q5nT3gC9r4ymtFYIrg8xmxapIfO2oQoBdC8=";
+      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/ea0aeecc/Feishu-linux_x64-7.58.14.deb";
+      sha256 = "sha256-Yg9QA/ugCPaY9yOHBOvmFuFQ8AzxvpP9+j9Gjtps900=";
     };
     aarch64-linux = fetchurl {
-      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/f247fca9/Feishu-linux_arm64-7.50.14.deb";
-      sha256 = "sha256-ecpaw0n6jRq1hdDY3rTzRiN8Ck3BTLt+K1DcxrPI4TE=";
+      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/f8addda9/Feishu-linux_arm64-7.58.14.deb";
+      sha256 = "sha256-Mx09KaZ2eIuJbUxePwzZceVj7tdiq/vZN/dwFzc1uyg=";
     };
   };
 
@@ -133,7 +133,7 @@ let
   ];
 in
 stdenv.mkDerivation {
-  version = "7.50.14";
+  version = "7.58.14";
   pname = "feishu";
 
   src =
diff --git a/pkgs/by-name/fl/fleet/package.nix b/pkgs/by-name/fl/fleet/package.nix
index 1df30e6a6ceb..10f5fd899183 100644
--- a/pkgs/by-name/fl/fleet/package.nix
+++ b/pkgs/by-name/fl/fleet/package.nix
@@ -84,6 +84,8 @@ buildGoModule (finalAttrs: {
     versionCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     inherit frontend;
   };
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index d7182013fb01..b5982a605336 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.233.0";
+  version = "2.234.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-if6mx/pjRqx9++ufkTHWVnqGScr+e3uZ0a6P6Ai9zWE=";
+    hash = "sha256-kj7KCgk4s9Ua//UPGXBh3pI91FTGC90bqMdUrvH4Bhc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-wMA8Q/cCTXwVnlpAEdEaA4iyfQOnYwwGRq+/k1Py+zg=";
+  npmDepsHash = "sha256-FA5T95nii7pk36YwQQVMSJAvKgOWKFbGwKeyCuygDIQ=";
 
   nativeBuildInputs = [
     prisma_6
diff --git a/pkgs/by-name/go/go-task/package.nix b/pkgs/by-name/go/go-task/package.nix
index f437a7340213..4ea1104549d5 100644
--- a/pkgs/by-name/go/go-task/package.nix
+++ b/pkgs/by-name/go/go-task/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-task";
-  version = "3.45.5";
+  version = "3.48.0";
 
   src = fetchFromGitHub {
     owner = "go-task";
     repo = "task";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YIsFADsGDgBR8TYrvhyz1DR1q6wZXDhjSsWi8DeijFA=";
+    hash = "sha256-t6u2SSPDh+zj8M5aJfP3mYgSgBMNDEMNhMWEkr86M0U=";
   };
 
-  vendorHash = "sha256-DQqz/GwV8SIsQsyF39Rzw+ojzhVw6Ih2j5utILEomV4=";
+  vendorHash = "sha256-v8OY4JkDaY8Xl20JvU8JbAXD43BaGrM5UmiJHnHaxek=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/go/goverlay/package.nix b/pkgs/by-name/go/goverlay/package.nix
index c149e631f6c1..408fe7b02114 100644
--- a/pkgs/by-name/go/goverlay/package.nix
+++ b/pkgs/by-name/go/goverlay/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goverlay";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "goverlay";
     tag = finalAttrs.version;
-    hash = "sha256-m1aoVC79ONVMK2TrIKFz0QsYOFUnT1PfEoAg9QfX8NQ=";
+    hash = "sha256-XZ8C556ufBI58Ai2v2sjIwjqoF0zqL8DOEQwbMuik/k=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix
index 1dacf3e39d02..f05ebfe5f357 100644
--- a/pkgs/by-name/hd/hdrhistogram_c/package.nix
+++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix
@@ -4,6 +4,9 @@
   fetchFromGitHub,
   cmake,
   zlib,
+  nix-update-script,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -18,15 +21,28 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   buildInputs = [ zlib ];
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   doCheck = true;
 
+  passthru = {
+    updateScript = nix-update-script { };
+
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+  };
+
   meta = {
     description = "C port or High Dynamic Range (HDR) Histogram";
     homepage = "https://github.com/HdrHistogram/HdrHistogram_c";
     changelog = "https://github.com/HdrHistogram/HdrHistogram_c/releases/tag/${finalAttrs.version}";
     license = lib.licenses.publicDomain;
     maintainers = with lib.maintainers; [ jherland ];
+    pkgConfigModules = [ "hdr_histogram" ];
   };
 })
diff --git a/pkgs/by-name/he/helvetica-neue-lt-std/package.nix b/pkgs/by-name/he/helvetica-neue-lt-std/package.nix
index cffa36164925..8a8d8a083523 100644
--- a/pkgs/by-name/he/helvetica-neue-lt-std/package.nix
+++ b/pkgs/by-name/he/helvetica-neue-lt-std/package.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenvNoCC.mkDerivation {
-  name = "helvetica-neue-lt-std";
+  pname = "helvetica-neue-lt-std";
   version = "2014.08.16"; # date of most recent file in distribution
 
   src = fetchzip {
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index 71a9bdef3c4e..33f017d65713 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "25.12.1-0";
+  version = "26.1.0-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-wz2CpBfLuma4CoPbBC7dROxaXZSvivdHn/TX40FakOU=";
+          hash = "sha256-ReLp+KxYzWmLWiCty/tgq9BNDF0iSDgoTHC6ExMaR2w=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-Bsn0PmmpiDbwtPq1WUsrbkn+MQ3BFZTnorukO0RpnzQ=";
+          hash = "sha256-MRDgJSHPQ4gRwKj6jOhWZRFq/opd1RPT0xPhKBYEjbI=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-kCwlQdVpCRFPp1kcVaLLa6WHrrbuMo0JcqoCMBgtUGo=";
+          hash = "sha256-v99TjjDVqALwHhQjjZW1+/3FAR+kTb7Oj7udeewK/6Y=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/ku/kubie/package.nix b/pkgs/by-name/ku/kubie/package.nix
index 2299209c1c73..7297ab98e832 100644
--- a/pkgs/by-name/ku/kubie/package.nix
+++ b/pkgs/by-name/ku/kubie/package.nix
@@ -9,18 +9,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.26.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-nNoH5523EuDt+dbeFgOpMkbGS6P+Hk6Ck0FmariSFRs=";
+    sha256 = "sha256-eSzNCH0MiGvLKHrSXFSXQq4lN5tfmr0NcuGaN96Invs=";
   };
 
   buildNoDefaultFeatures = true;
 
-  cargoHash = "sha256-G3bbAj3vo4dchq1AYoG4U/ST9JLiV2F4XjKCvYo48MI=";
+  cargoHash = "sha256-nXzIXMpCtibTN4rsPQFtSSjCQzylWWQZixwbH680ue0=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/la/languagetool/package.nix b/pkgs/by-name/la/languagetool/package.nix
index 77a82ed8187f..9d9d3ab58ed8 100644
--- a/pkgs/by-name/la/languagetool/package.nix
+++ b/pkgs/by-name/la/languagetool/package.nix
@@ -2,20 +2,34 @@
   lib,
   stdenv,
   fetchzip,
-  jre,
+  jre_minimal,
   makeWrapper,
   nixosTests,
 }:
-
+let
+  jre = jre_minimal.override {
+    modules = [
+      "java.base"
+      "java.datatransfer"
+      "java.desktop"
+      "java.naming"
+      "java.sql"
+      "java.xml"
+      "jdk.httpserver"
+    ];
+  };
+in
 stdenv.mkDerivation rec {
-  pname = "LanguageTool";
+  pname = "languagetool";
   version = "6.6";
 
   src = fetchzip {
-    url = "https://www.languagetool.org/download/${pname}-${version}.zip";
+    url = "https://www.languagetool.org/download/LanguageTool-${version}.zip";
     sha256 = "sha256-BNiUIk5h38oEM4IliHdy8rNmZY0frQ1RaFeJ7HI5nOI=";
   };
+
   nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [ jre ];
 
   installPhase = ''
@@ -35,7 +49,10 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.tests.languagetool = nixosTests.languagetool;
+  passthru = {
+    inherit jre;
+    tests.languagetool = nixosTests.languagetool;
+  };
 
   meta = {
     homepage = "https://languagetool.org";
@@ -44,5 +61,6 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ edwtjo ];
     platforms = jre.meta.platforms;
     description = "Proofreading program for English, French German, Polish, and more";
+    mainProgram = "languagetool";
   };
 }
diff --git a/pkgs/by-name/li/liblogging/package.nix b/pkgs/by-name/li/liblogging/package.nix
index 1f87948f0818..f181a01b955a 100644
--- a/pkgs/by-name/li/liblogging/package.nix
+++ b/pkgs/by-name/li/liblogging/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblogging";
-  version = "1.0.6";
+  version = "1.0.8";
 
   src = fetchurl {
     url = "http://download.rsyslog.com/liblogging/liblogging-${finalAttrs.version}.tar.gz";
-    sha256 = "14xz00mq07qmcgprlj5b2r21ljgpa4sbwmpr6jm2wrf8wms6331k";
+    hash = "sha256-ZEm3u3XcKC7GvxuYp1PJUHRupbGQ7JruCXiB5NxcS/E=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/by-name/li/libpng/package.nix
similarity index 85%
rename from pkgs/development/libraries/libpng/default.nix
rename to pkgs/by-name/li/libpng/package.nix
index c16b6d4a17a2..fa8ef30cf583 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/by-name/li/libpng/package.nix
@@ -5,6 +5,7 @@
   zlib,
   apngSupport ? true,
   testers,
+  darwin,
 }:
 
 assert zlib != null;
@@ -17,8 +18,11 @@ let
   };
   whenPatched = lib.optionalString apngSupport;
 
+  # libpng is a dependency of xcbuild. Avoid an infinite recursion by using a bootstrap stdenv
+  # that does not propagate xcrun.
+  stdenv' = if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
 in
-stdenv.mkDerivation (finalAttrs: {
+stdenv'.mkDerivation (finalAttrs: {
   pname = "libpng" + whenPatched "-apng";
   version = "1.6.53";
 
diff --git a/pkgs/development/libraries/libpng/12.nix b/pkgs/by-name/li/libpng12/package.nix
similarity index 93%
rename from pkgs/development/libraries/libpng/12.nix
rename to pkgs/by-name/li/libpng12/package.nix
index 3ab92139ab9e..62ffbf0cbdcb 100644
--- a/pkgs/development/libraries/libpng/12.nix
+++ b/pkgs/by-name/li/libpng12/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${finalAttrs.version}.tar.xz";
-    sha256 = "1izw9ybm27llk8531w6h4jp4rk2rxy2s9vil16nwik5dp0amyqxl";
+    hash = "sha256-tGNfFbitzMitCTTupIXvWcxMriTQ8DAKmpQeUZdP/Mc=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 9b84e4626044..16856faf3ed8 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "147.0.1-3";
+  version = "147.0.2-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-SPGUDTwdEi9ztH9MiFxtiY+xn3258znyu6yw5a9J/YE=";
-        aarch64-linux = "sha256-a6xFoZbBtoFgZFYGmz8IIvBsVP+qKTX32ufmQGdtMBk=";
+        x86_64-linux = "sha256-5WeLYaZuixXEFrzMXbF7GkVlSptC0Ng6QkCC8ecISXE=";
+        aarch64-linux = "sha256-xz9ApgpG8b7EgIi6n8L9lQbLmo8hxtGtfpLppYvRM1k=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };
diff --git a/pkgs/by-name/li/lief/package.nix b/pkgs/by-name/li/lief/package.nix
index 56948b0bd675..d91399f0d52e 100644
--- a/pkgs/by-name/li/lief/package.nix
+++ b/pkgs/by-name/li/lief/package.nix
@@ -6,6 +6,8 @@
   cmake,
   ninja,
   nix-update-script,
+  testers,
+  validatePkgConfig,
 }:
 
 let
@@ -35,6 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
+    validatePkgConfig
   ];
 
   # Not in propagatedBuildInputs because only the $py output needs it; $out is
@@ -73,6 +76,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+  };
+
   meta = {
     description = "Library to Instrument Executable Formats";
     homepage = "https://lief.quarkslab.com/";
@@ -81,5 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       lassulus
     ];
+    pkgConfigModules = [ "LIEF" ];
   };
 })
diff --git a/pkgs/by-name/ln/lnd/package.nix b/pkgs/by-name/ln/lnd/package.nix
index e127b5dc758c..0f40bc8f967f 100644
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,22 +23,24 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.19.3-beta";
+  version = "0.20.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-j37tLwVmAI18N0Xb3epACKRpJbs60HamZOlKDxWngFA=";
+    hash = "sha256-N8eZacu8BHMiI8RyueBv+Y1bWlaEuCQLRsfIj5WviV4=";
   };
 
-  vendorHash = "sha256-Ah5jOknXSoWEOnn0UKRuuwqT+E4eAkCg1h4qzW0rSHM=";
+  vendorHash = "sha256-3F2ERp8gosNFzsg2QqSJpmjewf6N0zho+st+pafP8F0=";
 
   subPackages = [
     "cmd/lncli"
     "cmd/lnd"
   ];
 
+  env.CGO_ENABLED = 0;
+
   inherit tags;
 
   meta = {
diff --git a/pkgs/by-name/lu/lug-helper/package.nix b/pkgs/by-name/lu/lug-helper/package.nix
index 82b22a6fdc33..77b73c7532a2 100644
--- a/pkgs/by-name/lu/lug-helper/package.nix
+++ b/pkgs/by-name/lu/lug-helper/package.nix
@@ -16,12 +16,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "lug-helper";
-  version = "4.7";
+  version = "4.9";
   src = fetchFromGitHub {
     owner = "starcitizen-lug";
     repo = "lug-helper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xgnt7ZzsrEChT9/zcwSUn7unVUEq8h/L12cQYnSrg2o=";
+    hash = "sha256-5JkVx8wlErNcdOA0oHnNxtwFyEyuJ1XRS/JeACK7bJg=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ly/lychee/package.nix b/pkgs/by-name/ly/lychee/package.nix
index 64f22e642e7e..c646a40a592f 100644
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@@ -17,12 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.21.0";
+  version = "0.22.0-unstable-2025-12-05";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = "lychee";
-    tag = "lychee-v${version}";
+    # tag = "lychee-v${version}"; # use again with next release
+    rev = "db0f8a842f594e0a879563caf7d183266c02ca95"; # one revision after 0.22.0
     leaveDotGit = true;
     postFetch = ''
       GIT_DATE=$(git -C $out/.git show -s --format=%cs)
@@ -32,10 +33,10 @@ rustPlatform.buildRustPackage rec {
           '("cargo:rustc-env=GIT_DATE={}", "'$GIT_DATE'")'
       rm -rf $out/.git
     '';
-    hash = "sha256-Nt7LsnQkWQS0f2/lS8WNYkI+XbKUSHQ6bNf9FNjfk7A=";
+    hash = "sha256-l8/llYq8rwt+UQMLnsva4/2m53cwqaJXD/XvgEfxXg4=";
   };
 
-  cargoHash = "sha256-1sqFjNil6KktpqrsXXgt3xtOz7eFQc2skkFHqmTMDg4=";
+  cargoHash = "sha256-03eahQ6GvOPxnvC82lfT1J/XfOg9V7gOZeOEBJx8IYY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -56,8 +57,6 @@ rustPlatform.buildRustPackage rec {
     "--tests"
   ];
 
-  checkType = "debug"; # compilation fails otherwise
-
   checkFlags = [
     #  Network errors for all of these tests
     # "error reading DNS system conf: No such file or directory (os error 2)" } }
diff --git a/pkgs/by-name/ma/mas/package.nix b/pkgs/by-name/ma/mas/package.nix
index 618c20bedaaf..d4893a424c0b 100644
--- a/pkgs/by-name/ma/mas/package.nix
+++ b/pkgs/by-name/ma/mas/package.nix
@@ -8,29 +8,29 @@
   testers,
   mas,
 }:
-
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mas";
-  version = "4.1.0";
+  version = "5.1.0";
 
   src =
     let
+      # nix store prefetch-file https://github.com/mas-cli/mas/releases/download/v$VERSION/mas-$VERSION-$ARCH.pkg
       sources =
         {
           x86_64-darwin = {
             arch = "x86_64";
-            hash = "sha256-9GkAV2gitqtZ7Ew/QVXDj3tDTbh5uwBxPtYdLSnucZE=";
+            hash = "sha256-G7o0nHsf6Ay2k3quMs45KH9h4yEpbvyGPm/u86naWcM=";
           };
           aarch64-darwin = {
             arch = "arm64";
-            hash = "sha256-8zaZOPOCyLHOFmHhviJXIy5SB5trqQM/MFHhB9ygilQ=";
+            hash = "sha256-XZM0YeFLHYhoEqQLaG1Jz3OWcT9DILqFEcgqI3yvDk8=";
           };
         }
         .${stdenvNoCC.hostPlatform.system}
           or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
     in
     fetchurl {
-      url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}-${sources.arch}.pkg";
+      url = "https://github.com/mas-cli/mas/releases/download/v${finalAttrs.version}/mas-${finalAttrs.version}-${sources.arch}.pkg";
       inherit (sources) hash;
     };
 
@@ -49,12 +49,14 @@ stdenvNoCC.mkDerivation rec {
     runHook postUnpack
   '';
 
+  dontConfigure = true;
   dontBuild = true;
+  strictDeps = true;
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 usr/local/opt/mas/bin/mas $out/bin/mas
+    installBin usr/local/opt/mas/bin/mas
 
     installManPage usr/local/opt/mas/share/man/man1/mas.1
     installShellCompletion --bash usr/local/opt/mas/etc/bash_completion.d/mas
@@ -83,4 +85,4 @@ stdenvNoCC.mkDerivation rec {
       "aarch64-darwin"
     ];
   };
-}
+})
diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index 814a68a7b6e2..fe55113a169b 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.10.2";
+  version = "2.10.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DS2cfu/yX+ebCn7V3FQVN8ltCJcEMD+wIjlS+ENHP8w=";
+    hash = "sha256-Ip9QcpPeojOdvUX7PMt3owSvMCy6hpsyxtAAsIWM8f4=";
   };
 
   vendorHash = "sha256-lz3cq2xL9byhLNbAwEvYOsP9WQsu0hqrWe2EDaLSeOQ=";
diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index 3a11dfe0261c..3b719e51629b 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nezha-agent";
-  version = "1.14.4";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6/1B+jBTiM3y7eg4aum3OCcIwo7fsCWctJ5NN3VVUwM=";
+    hash = "sha256-zweSBpzyh8nbiiW4RgtiKN5zC54JjGBL8v+1l8S0bA8=";
   };
 
   vendorHash = "sha256-d9FYXcVyWEA6HkHYG4mQzZXq0Btb9WgzEr+e99YofA4=";
diff --git a/pkgs/by-name/nu/nushell-plugin-skim/package.nix b/pkgs/by-name/nu/nushell-plugin-skim/package.nix
index 62529940b426..946c515efd35 100644
--- a/pkgs/by-name/nu/nushell-plugin-skim/package.nix
+++ b/pkgs/by-name/nu/nushell-plugin-skim/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_skim";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "idanarye";
     repo = "nu_plugin_skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TdsemIPbknJiglxhQwBch8iJ9GVa+Sj3fqSq4xaDqfk=";
+    hash = "sha256-my6ATIGNGCCBMOhmsp+dat+wV3oYD9ER4Iu8ln0jtMo=";
   };
 
-  cargoHash = "sha256-vpRL4oiOmhnGO+eWWTA7/RvVrtouVzqJvPGZY/cHeXY=";
+  cargoHash = "sha256-fCNpiBlqzKn7biszBSjhxvs3RgRAyd8Ze6R4P/3AfVo=";
 
   nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index 0dc776c45c5f..85eeb706d3fa 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -11,18 +11,18 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openlist-frontend";
-  version = "4.1.9";
+  version = "4.1.10";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList-Frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ckReBZleNNd2dlTxtlPaJ6R2YesD2NH7n8w4nk4uGaQ=";
+    hash = "sha256-V8nfQsGLhd7eERF0/ly3sRdGmffYa9r6GhtjciOXxMU=";
   };
 
   i18n = fetchzip {
     url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-qci63KIKVQiSk7XAsXyNQZNqnGpRcYtt5Yqkzpv7kX4=";
+    hash = "sha256-VdNqXdLXs2n/ikUDm1YQRNAXqYqFjMWRGLPRpmJVoaI=";
     stripRoot = false;
   };
 
@@ -36,7 +36,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 2;
-    hash = "sha256-Loq+ZsVWHIn/rc8dc7PCvFL/wcZG0aD1lOcI9/tu1h8=";
+    hash = "sha256-xylF+Z7Fkx/bFYPlzqfGrl051ZLKzPgdlF7U8vKtQq8=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix
index 001146f4eb23..c58851312b57 100644
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlist";
-  version = "4.1.9";
+  version = "4.1.10";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f9D/TRo7xu0KAfTp49ScKREjN6gljhE6GvFiF85ngjQ=";
+    hash = "sha256-+B3ea0LvzpRll9HpfEU6RkSgnQtVprSlrO+Tq07T0eQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
   frontend = callPackage ./frontend.nix { };
 
   proxyVendor = true;
-  vendorHash = "sha256-ySadNv+H/3/x+iUA5I3AyI2Ht5+Vn8AB2exDTudlKHE=";
+  vendorHash = "sha256-xUTTVejCDDMfzWdmtXiWcc0/hzhniZJcNzPFFFiNnJk=";
 
   buildInputs = [ fuse ];
 
diff --git a/pkgs/by-name/pi/pike/package.nix b/pkgs/by-name/pi/pike/package.nix
index 399aa6c0d4cf..fa4ae9329258 100644
--- a/pkgs/by-name/pi/pike/package.nix
+++ b/pkgs/by-name/pi/pike/package.nix
@@ -120,13 +120,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pike";
-  version = "8.0.2040";
+  version = "8.0.2042";
 
   src = fetchFromGitHub {
     owner = "pikelang";
     repo = "Pike";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rRStfD6n1BBQA36O1HkkMlYtMnDTuHXYBL2ez9A2yI4=";
+    hash = "sha256-N/hwbH8hhG9v/PJKwvGgS/ttS4TRJeeV2zAcRNDVL4k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qu/quinze/package.nix b/pkgs/by-name/qu/quinze/package.nix
index 2f1c64d82cfa..56eee3e3f70b 100644
--- a/pkgs/by-name/qu/quinze/package.nix
+++ b/pkgs/by-name/qu/quinze/package.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenvNoCC.mkDerivation {
-  name = "quinze";
+  pname = "quinze";
   version = "2018-09-22";
 
   src = fetchzip {
diff --git a/pkgs/by-name/ra/ramfetch/package.nix b/pkgs/by-name/ra/ramfetch/package.nix
index 7efd07c1022e..eda0928b261d 100644
--- a/pkgs/by-name/ra/ramfetch/package.nix
+++ b/pkgs/by-name/ra/ramfetch/package.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  name = "ramfetch";
+  pname = "ramfetch";
   version = "1.1.0a";
 
   src = fetchgit {
diff --git a/pkgs/by-name/ra/raygui/package.nix b/pkgs/by-name/ra/raygui/package.nix
index d0569b39fe8e..f008e1659bfb 100644
--- a/pkgs/by-name/ra/raygui/package.nix
+++ b/pkgs/by-name/ra/raygui/package.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
-  name = "raygui";
+  pname = "raygui";
   version = "4.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/re/regal/package.nix b/pkgs/by-name/re/regal/package.nix
index 3f312c59747f..caf8ca8e0041 100644
--- a/pkgs/by-name/re/regal/package.nix
+++ b/pkgs/by-name/re/regal/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
-  name = "regal";
+buildGoModule (finalAttrs: {
+  pname = "regal";
   version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "regal";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/WGZCwT9VJ5zjEmL4PZqPymaUJFaWzjbgq2KMBfl6uQ=";
   };
 
@@ -23,16 +23,16 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/open-policy-agent/regal/pkg/version.Version=${version}"
-    "-X github.com/open-policy-agent/regal/pkg/version.Commit=${version}"
+    "-X github.com/open-policy-agent/regal/pkg/version.Version=${finalAttrs.version}"
+    "-X github.com/open-policy-agent/regal/pkg/version.Commit=${finalAttrs.version}"
   ];
 
   meta = {
     description = "Linter and language server for Rego";
     mainProgram = "regal";
     homepage = "https://github.com/open-policy-agent/regal";
-    changelog = "https://github.com/open-policy-agent/regal/releases/tag/${src.rev}";
+    changelog = "https://github.com/open-policy-agent/regal/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ rinx ];
   };
-}
+})
diff --git a/pkgs/by-name/st/stress-ng/package.nix b/pkgs/by-name/st/stress-ng/package.nix
index 16baf06751a5..7fb31b4769fa 100644
--- a/pkgs/by-name/st/stress-ng/package.nix
+++ b/pkgs/by-name/st/stress-ng/package.nix
@@ -94,7 +94,10 @@ stdenv.mkDerivation (finalAttrs: {
     downloadPage = "https://github.com/ColinIanKing/stress-ng/tags";
     changelog = "https://github.com/ColinIanKing/stress-ng/raw/V${finalAttrs.version}/debian/changelog";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ c0bw3b ];
+    maintainers = with lib.maintainers; [
+      c0bw3b
+      dbeley
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "stress-ng";
   };
diff --git a/pkgs/by-name/sw/swayosd/package.nix b/pkgs/by-name/sw/swayosd/package.nix
index f57f154898ae..25371b04f884 100644
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@@ -22,18 +22,18 @@
 }:
 stdenv.mkDerivation rec {
   pname = "swayosd";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
     rev = "v${version}";
-    hash = "sha256-O9A7+QvvhmH3LFLv8vufVCgNQJqKc3LJitCUHYaGHyE=";
+    hash = "sha256-DRJ4D+QcgkVZmlfbj2HEIUHnYldzIuSDcpsOAOuoaL0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-J2sl6/4+bRWlkvaTJtFsMqvvOxYtWLRjJcYWcu0loRE=";
+    hash = "sha256-t0IZvO7Wbx6A7v/sRZOSOLj0O/1m7vOBjZSd99TAutI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/termsonic/package.nix b/pkgs/by-name/te/termsonic/package.nix
index ff6607ccfbaf..4ebf198eb4cc 100644
--- a/pkgs/by-name/te/termsonic/package.nix
+++ b/pkgs/by-name/te/termsonic/package.nix
@@ -6,7 +6,7 @@
   alsa-lib,
 }:
 buildGoModule {
-  name = "termsonic";
+  pname = "termsonic";
   version = "0-unstable-2025-01-07";
 
   src = fetchzip {
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 2ae0fd2ad55e..433edb817268 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,18 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.6.4";
+  version = "3.6.7";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-gvKOQloDiRlBMxQ8x9eUSO6zs/IMdbHQsu4uwForrrY=";
+    hash = "sha256-tfCVNfY2qqhTBv6nhHqcoZ5GP7xoCBJNBkEfoMFH5vI=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-pK6KUXPnbHeCXS+DGoNIoCfoPkBqaMZwOLW8Y4F3eOI=";
+  vendorHash = "sha256-B6H188VR9A4SSyMDh95Z3KqhtyWTo81f0ORxdXeCZu0=";
+
+  proxyVendor = true;
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/by-name/tu/tuxguitar/fix-include.patch b/pkgs/by-name/tu/tuxguitar/fix-include.patch
new file mode 100644
index 000000000000..33d48cabde82
--- /dev/null
+++ b/pkgs/by-name/tu/tuxguitar/fix-include.patch
@@ -0,0 +1,24 @@
+diff -Naur tuxguitar/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2.h tuxguitar-patched/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2.h
+--- tuxguitar/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2.h	2025-11-03 22:30:10.315511003 +1100
++++ tuxguitar-patched/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2.h	2025-11-03 22:36:06.444389423 +1100
+@@ -1,7 +1,7 @@
+ #ifndef _Included_LV2
+ #define _Included_LV2
+ 
+-#include <lilv.h>
++#include <lilv-0/lilv/lilv.h>
+ #include <lv2/lv2plug.in/ns/extensions/ui/ui.h>
+ #include <lv2/lv2plug.in/ns/ext/state/state.h>
+ #include <lv2/lv2plug.in/ns/ext/options/options.h>
+diff -Naur tuxguitar/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2UI.h tuxguitar-patched/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2UI.h
+--- tuxguitar/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2UI.h	2025-11-03 22:30:10.315511003 +1100
++++ tuxguitar-patched/desktop/TuxGuitar-synth-lv2/src/main/cxx/LV2UI.h	2025-11-03 22:39:40.376479709 +1100
+@@ -1,7 +1,7 @@
+ #ifndef _Included_LV2UI
+ #define _Included_LV2UI
+ 
+-#include <suil.h>
++#include <suil-0/suil/suil.h>
+ 
+ void LV2UI_malloc(LV2UI **handle, LV2Feature *feature, LV2Instance *instance, LV2Lock* lock);
+ 
diff --git a/pkgs/by-name/tu/tuxguitar/package.nix b/pkgs/by-name/tu/tuxguitar/package.nix
index 6fcf73980277..d7f70aed6e93 100644
--- a/pkgs/by-name/tu/tuxguitar/package.nix
+++ b/pkgs/by-name/tu/tuxguitar/package.nix
@@ -1,70 +1,223 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  maven,
   swt,
+  jdk,
   jre,
-  makeWrapper,
+  makeBinaryWrapper,
+  pkg-config,
   alsa-lib,
   jack2,
   fluidsynth,
   libpulseaudio,
   lilv,
+  suil,
+  qt5,
   which,
   wrapGAppsHook3,
   nixosTests,
+  fetchpatch,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.6";
+let
+  swtArtifactId =
+    "org.eclipse.swt." + (if stdenv.hostPlatform.isDarwin then "cocoa.macosx" else "gtk.linux");
+  buildDir =
+    "desktop/build-scripts/tuxguitar-"
+    + (if stdenv.hostPlatform.isDarwin then "macosx-swt-cocoa" else "linux-swt");
+  buildScript = "${buildDir}/pom.xml";
+  mvnParams = lib.escapeShellArgs [
+    "-f"
+    buildScript
+    "-P"
+    "native-modules"
+    "-Dmaven.test.skip=true"
+  ];
+  ldLibVar = if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  classpath = [
+    "${swt}/jars/swt.jar"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "$out/lib/tuxguitar.jar"
+    "$out/lib/itext.jar"
+  ];
+  libraryPath = [
+    "$out/lib"
+    fluidsynth
+    lilv
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    swt
+    alsa-lib
+    jack2
+    libpulseaudio
+  ];
+  wrapperPaths = [
+    jre
+    which
+  ];
+  # FIXME: Makes hash stable across platforms and convert to a single hash.
+  mvnHashByPlatform = {
+    "x86_64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
+    "aarch64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
+    "aarch64-darwin" = "sha256-lfO2YH+yKZWzh3MeQ7baESGmmW7zPdTLs8CjZ/FtLu0=";
+  };
+  wrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath wrapperPaths)
+    "--prefix"
+    ldLibVar
+    ":"
+    (lib.makeLibraryPath libraryPath)
+    "--prefix"
+    "CLASSPATH"
+    ":"
+    (lib.concatStringsSep ":" classpath)
+  ];
+  version = "2.0.1";
+in
+maven.buildMavenPackage {
   pname = "tuxguitar";
+  inherit version;
 
-  src = fetchurl {
-    url = "https://github.com/helge17/tuxguitar/releases/download/${finalAttrs.version}/tuxguitar-${finalAttrs.version}-linux-swt-amd64.tar.gz";
-    hash = "sha256-kfPk+IIg5Q4Fc9HMS0kxxCarlbJjVKluIvz8KpDjJLM=";
+  src = fetchFromGitHub {
+    owner = "helge17";
+    repo = "tuxguitar";
+    tag = version;
+    hash = "sha256-USdYj8ebosXkiZpDqyN5J+g1kjyWm225iQlx/szXmLA=";
   };
 
+  patches = [
+    ./fix-include.patch
+    # Helps a little bit with https://github.com/helge17/tuxguitar/issues/961
+    (fetchpatch {
+      name = "create-new-file";
+      url = "https://github.com/helge17/tuxguitar/commit/3dc828a9b92e932952c2b33d8ee41db734f2fcc0.patch";
+      hash = "sha256-umZlCSCTWqj3tgR+qFcPucEDv5vpaC6zHbDJg/W5KUI=";
+    })
+  ];
+
+  buildOffline = true;
+
+  mvnJdk = jdk;
+
+  mvnHash = (
+    mvnHashByPlatform.${stdenv.system}
+      or (lib.warn "Missing mvnHash for ${stdenv.system}, using lib.fakeHash" lib.fakeHash)
+  );
+
+  mvnParameters = mvnParams;
+  mvnDepsParameters = mvnParams;
+
+  mvnFetchExtraArgs = {
+    dontWrapQtApps = true;
+    dontWrapGApps = true;
+    preBuild = ''
+      mkdir -p $out/.m2
+      mvn install:install-file \
+        -Dfile=${swt}/jars/swt.jar \
+        -DgroupId=org.eclipse.swt \
+        -DartifactId=${swtArtifactId} \
+        -Dpackaging=jar \
+        -Dversion=4.36 \
+        -Dmaven.repo.local=$out/.m2
+    '';
+    postInstall = ''
+      rm -rf $out/.m2/repository/org/eclipse/swt
+      find $out -type f -name "maven-metadata-*.xml" -delete
+    '';
+  };
+
+  afterDepsSetup = ''
+    mvn install:install-file \
+      -Dfile=${swt}/jars/swt.jar \
+      -DgroupId=org.eclipse.swt \
+      -DartifactId=${swtArtifactId} \
+      -Dpackaging=jar \
+      -Dversion=4.36 \
+      -Dmaven.repo.local=$mvnDeps/.m2
+  '';
+
   nativeBuildInputs = [
-    makeWrapper
+    makeBinaryWrapper
+    jdk
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     wrapGAppsHook3
   ];
 
+  buildInputs = [
+    swt
+    fluidsynth
+    lilv
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    jack2
+    libpulseaudio
+    suil
+    qt5.qtbase
+  ];
+
+  dontWrapQtApps = true;
+
   dontWrapGApps = true;
 
   installPhase = ''
+    runHook preInstall
+
+    cd ${buildDir}
+  ''
+  # macOS: The build creates tuxguitar-VERSION-macosx-swt-cocoa.app directly
+  # This directory name already ends with .app and IS the app bundle
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    cp -r target/tuxguitar-9.99-SNAPSHOT-macosx-swt-cocoa.app $out/Applications/TuxGuitar.app
+
+    # Fix the launch script to use the Nix JRE instead of bundled JRE
+    substituteInPlace $out/Applications/TuxGuitar.app/Contents/MacOS/tuxguitar.sh \
+      --replace-fail 'JAVA="./jre/bin/java"' 'JAVA="${jre}/bin/java"'
+
+    # Ensure the main executable has execute permissions
+    chmod +x $out/Applications/TuxGuitar.app/Contents/MacOS/tuxguitar.sh
+
+    # Symlink doesn't work. We have to create a wrapper script instead
     mkdir -p $out/bin
-    cp -r dist lib share $out/
-    cp tuxguitar.sh $out/bin/tuxguitar
+    makeWrapper "$out/Applications/TuxGuitar.app/Contents/MacOS/tuxguitar.sh" \
+      "$out/bin/tuxguitar"
+  ''
+  # Linux: Install traditional layout
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    TUXGUITAR_DIR=target/tuxguitar-9.99-SNAPSHOT-linux-swt
+    mkdir -p $out/{bin,lib}
+    cp -r $TUXGUITAR_DIR $out/lib/tuxguitar
+    ln -s $out/lib/tuxguitar/tuxguitar.sh $out/bin/tuxguitar
 
-    ln -s $out/dist $out/bin/dist
-    ln -s $out/lib $out/bin/lib
-    ln -s $out/share $out/bin/share
+    mkdir -p $out/share
+    ln -s $out/lib/tuxguitar/share/{applications,man,metainfo,mime,pixmaps} -t $out/share/
+
+    # See https://github.com/helge17/tuxguitar/issues/961
+    mkdir -p $out/share/templates/.source
+    ln -s $out/lib/tuxguitar/share/templates/ $out/share/templates/.source/tuxguitar
+    cp /build/source/desktop/build-scripts/common-resources/common-linux/share/templates/tuxguitar.desktop $out/share/templates/
+  ''
+  + ''
+
+    runHook postInstall
   '';
 
-  postFixup = ''
-    wrapProgram $out/bin/tuxguitar \
-      "''${gappsWrapperArgs[@]}" \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          jre
-          which
-        ]
-      } \
-      --prefix LD_LIBRARY_PATH : "$out/lib/:${
-        lib.makeLibraryPath [
-          swt
-          alsa-lib
-          jack2
-          fluidsynth
-          libpulseaudio
-          lilv
-        ]
-      }" \
-      --prefix CLASSPATH : "${swt}/jars/swt.jar:$out/lib/tuxguitar.jar:$out/lib/itext.jar"
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram $out/bin/tuxguitar ${lib.concatStringsSep " " wrapperArgs}
   '';
 
-  passthru.tests = {
-    nixos = nixosTests.tuxguitar;
+  passthru = {
+    tests.nixos = nixosTests.tuxguitar;
   };
 
   meta = {
@@ -74,10 +227,12 @@ stdenv.mkDerivation (finalAttrs: {
       in Java-SWT. It can open GuitarPro, PowerTab and TablEdit files.
     '';
     homepage = "https://github.com/helge17/tuxguitar";
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.lgpl21Plus;
-    maintainers = with lib.maintainers; [ ardumont ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [
+      ardumont
+      mio
+    ];
+    platforms = builtins.attrNames mvnHashByPlatform;
     mainProgram = "tuxguitar";
   };
-})
+}
diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index 9b56990d5e68..fd8cb6d189a5 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-rFR82BO5rXv+4ePx5FqXOWec7ncM5Ml0dwixtLXQFts=";
+    hash = "sha256-aUdTplLqbnDsssRrWwSVOyGwVUWcm7Bn02GrMf+1HVM=";
   };
 
-  npmDepsHash = "sha256-u5cfKgKP+n7V8gk2NRWNJz/P7hxURnPFQ7yjLE+fAlE=";
+  npmDepsHash = "sha256-D3XsvQK+qdINxsu78Jc0ovxaC0mKaRO/SiwUCI2/tC4=";
   makeCacheWritable = true;
 
   env = {
diff --git a/pkgs/by-name/we/weaviate/package.nix b/pkgs/by-name/we/weaviate/package.nix
index 56c5a4662e09..fffd05e8ec39 100644
--- a/pkgs/by-name/we/weaviate/package.nix
+++ b/pkgs/by-name/we/weaviate/package.nix
@@ -31,7 +31,7 @@ buildGoModule rec {
 
   meta = {
     description = "ML-first vector search engine";
-    homepage = "https://github.com/semi-technologies/weaviate";
+    homepage = "https://github.com/weaviate/weaviate";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ dit7ya ];
   };
diff --git a/pkgs/by-name/xf/xfsprogs/package.nix b/pkgs/by-name/xf/xfsprogs/package.nix
index d05b83e9280c..e976418c129a 100644
--- a/pkgs/by-name/xf/xfsprogs/package.nix
+++ b/pkgs/by-name/xf/xfsprogs/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     "dev"
     "out"
     "doc"
+    "man"
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index f090ca7414d9..3547aee2af9d 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.0-rc2".officialRelease.sha256 = "sha256-j0KSuTANrwLh/siEcztSqCYQQDYHmdBCgVCsPsDCQ+I=";
     "23.0.0-git".gitRelease = {
-      rev = "eae75353f70b01363bab9383da6b4dd4324d13a3";
-      rev-version = "23.0.0-unstable-2026-01-25";
-      sha256 = "sha256-04oX8cMoyXmqtwqMW2/xbtIhUQlgcM9AOO2bnhfx0zs=";
+      rev = "dc152f0d2d085dcfb7542d0e71e19ebfa1aa3794";
+      rev-version = "23.0.0-unstable-2026-02-01";
+      sha256 = "sha256-F0NXNZLTlMnZlWuAqpoBxrr1DCavQz00WdobKbuwarU=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 71421c6e5eea..a1add4055af5 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -171,11 +171,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  # Fix linker error on Darwin (see https://trac.macports.org/ticket/61865)
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lobjc";
-
-  # See https://savannah.gnu.org/bugs/?50339
-  F77_INTEGER_8_FLAG = lib.optionalString use64BitIdx "-fdefault-integer-8";
+  env =
+    lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # Fix linker error on Darwin (see https://trac.macports.org/ticket/61865)
+      NIX_LDFLAGS = "-lobjc";
+    }
+    // lib.optionalAttrs use64BitIdx {
+      # See https://savannah.gnu.org/bugs/?50339
+      F77_INTEGER_8_FLAG = "-fdefault-integer-8";
+    };
 
   configureFlags = [
     "--with-blas=blas"
diff --git a/pkgs/development/python-modules/aiocmd/default.nix b/pkgs/development/python-modules/aiocmd/default.nix
index a35a63f5f002..8bde646b16d6 100644
--- a/pkgs/development/python-modules/aiocmd/default.nix
+++ b/pkgs/development/python-modules/aiocmd/default.nix
@@ -6,7 +6,7 @@
   setuptools,
 }:
 buildPythonPackage rec {
-  name = "aiocmd";
+  pname = "aiocmd";
   version = "0.1.5";
   src = fetchFromGitHub {
     owner = "KimiNewt";
diff --git a/pkgs/development/python-modules/dsinternals/default.nix b/pkgs/development/python-modules/dsinternals/default.nix
index 2313dd9d3275..eb649e37a122 100644
--- a/pkgs/development/python-modules/dsinternals/default.nix
+++ b/pkgs/development/python-modules/dsinternals/default.nix
@@ -5,21 +5,24 @@
   pycryptodomex,
   pyopenssl,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "dsinternals";
-  version = "1.2.4";
-  format = "setuptools";
+  version = "1.2.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p0dalirius";
     repo = "pydsinternals";
-    rev = version;
-    hash = "sha256-C1ar9c4F4WI5ICX7PJe8FzVwK8bxZds+kMBpttEp9Ko=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZbYHO7It7R/Zh2dykTa4Ha4m2eyt9zkCzPyc/j79v6A=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     pyopenssl
     pycryptodomex
   ];
@@ -36,4 +39,4 @@ buildPythonPackage rec {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/hstspreload/default.nix b/pkgs/development/python-modules/hstspreload/default.nix
index a364d73d0b2c..0b06fa5e0699 100644
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@@ -5,16 +5,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hstspreload";
-  version = "2025.12.3";
+  version = "2026.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sethmlarson";
     repo = "hstspreload";
-    tag = version;
-    hash = "sha256-K44Lzom7AQMsnJGN9RYNfZuD+wbbZtTGStjJtS/4NcE=";
+    tag = finalAttrs.version;
+    hash = "sha256-sqmzV9JJy71EF1wtLlKc98KGbe8gqsKaAq+VlqXK7kg=";
   };
 
   build-system = [ setuptools ];
@@ -30,4 +30,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/marqo/default.nix b/pkgs/development/python-modules/marqo/default.nix
index a23240eeabf9..b0cfd9e454b5 100644
--- a/pkgs/development/python-modules/marqo/default.nix
+++ b/pkgs/development/python-modules/marqo/default.nix
@@ -12,7 +12,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "marqo";
+  pname = "marqo";
   version = "3.12.0";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/pynmeagps/default.nix b/pkgs/development/python-modules/pynmeagps/default.nix
index 4502d6e7dbd8..3cec2de95a8f 100644
--- a/pkgs/development/python-modules/pynmeagps/default.nix
+++ b/pkgs/development/python-modules/pynmeagps/default.nix
@@ -7,16 +7,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynmeagps";
-  version = "1.0.57";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "semuconsulting";
     repo = "pynmeagps";
-    tag = "v${version}";
-    hash = "sha256-aFB0L2d/2LzDCS5ZbY1/NetDdiuGiwrgqlDyCAv6lV0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M35rD12PQIShNvty0AqclNIySMHee9ik9sX4ytWm3EQ=";
   };
 
   build-system = [ setuptools ];
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "NMEA protocol parser and generator";
     homepage = "https://github.com/semuconsulting/pynmeagps";
-    changelog = "https://github.com/semuconsulting/pynmeagps/releases/tag/${src.tag}";
+    changelog = "https://github.com/semuconsulting/pynmeagps/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ dylan-gonzalez ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/swift/default.nix b/pkgs/development/python-modules/swift/default.nix
index dfec8dd6d471..07f00b0485b7 100644
--- a/pkgs/development/python-modules/swift/default.nix
+++ b/pkgs/development/python-modules/swift/default.nix
@@ -22,14 +22,14 @@
   xattr,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "swift";
-  version = "2.36.0";
+  version = "2.37.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-3qtd++4Xm6B9TPfKvx85s71/Hz8qFrhN+XR9TuvfHXw=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-EO50/6S6fXIZtYsCAO8VmpWotKdwgnmY48W6XKCypGU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -83,4 +83,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/kde/frameworks/kwallet/default.nix b/pkgs/kde/frameworks/kwallet/default.nix
index 6f78a1b9d4fe..e4861cbbeec0 100644
--- a/pkgs/kde/frameworks/kwallet/default.nix
+++ b/pkgs/kde/frameworks/kwallet/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  gpgme,
+  gpgmepp,
   libgcrypt,
   libsecret,
   kdoctools,
@@ -14,7 +14,7 @@ mkKdeDerivation {
   ];
 
   extraBuildInputs = [
-    gpgme
+    gpgmepp
     libgcrypt
     libsecret
     kdoctools
diff --git a/pkgs/misc/cups/drivers/brother/mfcl3770cdw/default.nix b/pkgs/misc/cups/drivers/brother/mfcl3770cdw/default.nix
index b165938d487f..a9f1900b1bc2 100644
--- a/pkgs/misc/cups/drivers/brother/mfcl3770cdw/default.nix
+++ b/pkgs/misc/cups/drivers/brother/mfcl3770cdw/default.nix
@@ -24,9 +24,9 @@ let
 
 in
 rec {
-  driver = pkgsi686Linux.stdenv.mkDerivation rec {
+  driver = pkgsi686Linux.stdenv.mkDerivation {
     inherit src version;
-    name = "${model}drv-${version}";
+    pname = "${model}drv";
 
     nativeBuildInputs = [
       dpkg
@@ -69,9 +69,9 @@ rec {
     };
   };
 
-  cupswrapper = stdenv.mkDerivation rec {
+  cupswrapper = stdenv.mkDerivation {
     inherit version src;
-    name = "${model}cupswrapper-${version}";
+    pname = "${model}cupswrapper";
 
     nativeBuildInputs = [
       dpkg
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 353c0b6dd26a..66b9024e7295 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7015,15 +7015,6 @@ with pkgs;
   libpeas = callPackage ../development/libraries/libpeas { };
   libpeas2 = callPackage ../development/libraries/libpeas/2.x.nix { };
 
-  libpng = callPackage ../development/libraries/libpng {
-    stdenv =
-      # libpng is a dependency of xcbuild. Avoid an infinite recursion by using a bootstrap stdenv
-      # that does not propagate xcrun.
-      if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
-  };
-
-  libpng12 = callPackage ../development/libraries/libpng/12.nix { };
-
   inherit
     (callPackages ../development/libraries/prometheus-client-c {
       stdenv = gccStdenv; # Required for darwin