diff --git a/lib/default.nix b/lib/default.nix
index af9716cb165f..1bfd5b9ac8b1 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -105,6 +105,22 @@ let
       # network
       network = callLibs ./network;
 
+      inherit (builtins)
+        getContext
+        hasContext
+        convertHash
+        hashString
+        hasFile
+        parseDrvName
+        placeholder
+        fromJSON
+        fromTOML
+        toFile
+        toJSON
+        toString
+        toXML
+        tryEval
+        ;
       inherit (self.trivial)
         id
         const
@@ -112,6 +128,8 @@ let
         concat
         "or"
         and
+        mul
+        div
         xor
         bitAnd
         bitOr
@@ -163,6 +181,8 @@ let
         pathExists
         genericClosure
         readFile
+        ceil
+        floor
         ;
       inherit (self.fixedPoints)
         fix
@@ -327,7 +347,6 @@ let
         escape
         escapeShellArg
         escapeShellArgs
-        isPath
         isStorePath
         isStringLike
         isValidPosixName
@@ -420,6 +439,9 @@ let
         pathType
         pathIsDirectory
         pathIsRegularFile
+        baseNameOf
+        dirOf
+        isPath
         packagesFromDirectoryRecursive
         ;
       inherit (self.sources)
@@ -434,6 +456,7 @@ let
         pathIsGitRepo
         revOrTag
         repoRevToName
+        filterSource
         ;
       inherit (self.modules)
         evalModules
@@ -564,6 +587,7 @@ let
         imap
         ;
       inherit (self.versions)
+        compareVersions
         splitVersion
         ;
       inherit (self.network.ipv6)
diff --git a/lib/filesystem.nix b/lib/filesystem.nix
index acc47cd5efdb..7063abfe2079 100644
--- a/lib/filesystem.nix
+++ b/lib/filesystem.nix
@@ -25,6 +25,11 @@ let
 in
 
 {
+  inherit (builtins)
+    baseNameOf
+    dirOf
+    isPath
+    ;
 
   /**
     The type of a path. The path needs to exist and be accessible.
diff --git a/lib/sources.nix b/lib/sources.nix
index 2936962c2de1..c99f2c265086 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -529,4 +529,6 @@ in
 
     trace
     ;
+
+  inherit (builtins) filterSource;
 }
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 45a8ec9169f5..f351fb572fbc 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -27,6 +27,8 @@ in
     isFloat
     add
     sub
+    mul
+    div
     lessThan
     seq
     deepSeq
@@ -34,6 +36,8 @@ in
     bitAnd
     bitOr
     bitXor
+    ceil
+    floor
     ;
 
   ## Simple (higher order) functions
diff --git a/lib/versions.nix b/lib/versions.nix
index 2355655f179a..0073c5669743 100644
--- a/lib/versions.nix
+++ b/lib/versions.nix
@@ -3,6 +3,8 @@
 
 rec {
 
+  inherit (builtins) compareVersions;
+
   /**
     Break a version string into its component parts.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7b15ab55565e..a12f4cc9b4f1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4930,6 +4930,11 @@
     githubId = 114656678;
     name = "Gabriel Hosquet";
   };
+  cizordj = {
+    github = "cizordj";
+    githubId = 32869222;
+    name = "Cézar Augusto";
+  };
   cizra = {
     email = "todurov+nix@gmail.com";
     github = "cizra";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 65290e41b983..6b7673a82df9 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -79,6 +79,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.
 
+- `services.tor` no longer bind mounts Unix sockets of onion services into its chroot
+because it was not reliable. Users should do it themselves using either `JoinsNamespaceOf=` and Unix sockets in `/tmp`
+or `BindPaths=` from a persistent parent directory of each Unix socket.
+See <https://github.com/NixOS/nixpkgs/issues/481673>.
+
 - support for `ecryptfs` in nixpkgs has been removed.
 
 - The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index 16737d63626d..2e33abd8b608 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -237,10 +237,12 @@ in
           type = lib.types.enum [
             "local"
             "redis"
+            "postgres"
           ];
           default = "local";
           description = ''
-            Lock backend to use: 'local' (single instance), 'redis' (distributed).
+            Lock backend to use: 'local' (single instance), 'redis'
+            (distributed), or 'postgres' (distributed, requires PostgreSQL).
           '';
         };
 
diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 1c2cc65862e6..359745b4060d 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -636,7 +636,31 @@ in
         };
 
         onionServices = lib.mkOption {
-          description = (descriptionGeneric "HiddenServiceDir");
+          description = descriptionGeneric "HiddenServiceDir" + ''
+            :::{.warning}
+            Because `tor.service` runs in its own `RootDirectory=`,
+            when using a onion service to reverse-proxy to a Unix socket,
+            you need to make that Unix socket available
+            within the mount namespace of `tor.service`.
+
+            When you can configure your service to create its socket in `/tmp`,
+            this can be done with:
+            ```nix
+            systemd.services.''${your-service} = {
+              unitConfig.JoinsNamespaceOf = [ "tor.service" ];`
+              serviceConfig.PrivateTmp = true;
+            };
+            ```
+            Otherwise, you can use:
+            ```nix
+            systemd.services.tor.serviceConfig.BindPaths = [ "/path/to/your-service/socket/directory" ];
+            ```
+            but you have to be sure that `/path/to/socket/directory`
+            exists before `tor.service` is started
+            and is not deleted and recreated between restarts of `your-service`,
+            or you'll need to restart `tor.service` to refresh the `BindPaths=`.
+            :::
+          '';
           default = { };
           example = {
             "example.org/www" = {
@@ -1416,22 +1440,10 @@ in
         RootDirectoryStartOnly = true;
         #InaccessiblePaths = [ "-+${runDir}/root" ];
         UMask = "0066";
-        BindPaths = [
-          stateDir
-        ]
-        ++ lib.filter (x: x != null) (
-          lib.catAttrs "unix" (
-            lib.filter (x: x != null) (
-              lib.catAttrs "target" (
-                lib.concatMap (onionService: onionService.map) (lib.attrValues cfg.relay.onionServices)
-              )
-            )
-          )
-        );
         BindReadOnlyPaths = [
-          builtins.storeDir
           "/etc"
         ]
+        ++ lib.optional (!config.systemd.services.tor.confinement.enable) builtins.storeDir
         ++ lib.optionals config.services.resolved.enable [
           "/run/systemd/resolve/stub-resolv.conf"
           "/run/systemd/resolve/resolv.conf"
@@ -1485,7 +1497,6 @@ in
           "~@timer"
         ];
         SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
       };
     };
 
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 418198375bb8..fef72c5b1392 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -7,10 +7,6 @@
 let
   cfg = config.services.nextcloud;
 
-  overridePackage = cfg.package.override {
-    inherit (config.security.pki) caBundle;
-  };
-
   fpm = config.services.phpfpm.pools.nextcloud;
 
   jsonFormat = pkgs.formats.json { };
@@ -53,13 +49,13 @@ let
   };
 
   webroot =
-    pkgs.runCommand "${overridePackage.name or "nextcloud"}-with-apps"
+    pkgs.runCommand "${cfg.package.name or "nextcloud"}-with-apps"
       {
         preferLocalBuild = true;
       }
       ''
         mkdir $out
-        ln -sfv "${overridePackage}"/* "$out"
+        ln -sfv "${cfg.package}"/* "$out"
         ${lib.concatStrings (
           lib.mapAttrsToList (
             name: store:
@@ -1221,13 +1217,13 @@ in
             If you have an existing installation with a custom table prefix, make sure it is
             set correctly in `config.php` and remove the option from your NixOS config.
           '')
-          ++ (lib.optional (lib.versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "32") (upgradeWarning 31 "25.11"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "28") (upgradeWarning 27 "24.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "29") (upgradeWarning 28 "24.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"));
 
         services.nextcloud.package = lib.mkDefault (
           if pkgs ? nextcloud then
@@ -1289,7 +1285,7 @@ in
           }
           {
             assertion =
-              lib.versionAtLeast overridePackage.version "32.0.0"
+              lib.versionAtLeast cfg.package.version "32.0.0"
               || (cfg.config.adminuser != null && cfg.config.adminpassFile != null);
             message = ''
               Disabling initial admin user creation is only available on Nextcloud >= 32.0.0.
@@ -1622,6 +1618,7 @@ in
               "upgrade.disable-web" = true;
               # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
               "integrity.check.disabled" = true;
+              "default_certificates_bundle_path" = config.security.pki.caBundle;
             }
             (lib.mkIf cfg.configureRedis {
               "memcache.distributed" = ''\OC\Memcache\Redis'';
diff --git a/nixos/tests/squid.nix b/nixos/tests/squid.nix
index 77552b237f34..188c3840178c 100644
--- a/nixos/tests/squid.nix
+++ b/nixos/tests/squid.nix
@@ -43,7 +43,6 @@ let
 in
 {
   name = "squid";
-  meta.maintainers = with lib.maintainers; [ cobalt ];
 
   node.pkgsReadOnly = false;
 
diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix
index 59fbc699961d..f136b0e8ba99 100644
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -121,7 +121,7 @@ let
 in
 runCommand "${unwrapped.name}-wrapped"
   {
-    inherit (unwrapped) meta;
+    inherit (unwrapped) meta pname version;
     paths = [ unwrapped ];
     nativeBuildInputs = [
       makeWrapper
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 74a74391bb42..b4247dda6234 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     tag = "v${version}";
-    hash = "sha256-lX891L9EPT8FQ4h69t345IuIrbagaKPnnYQogR2DjZ8=";
+    hash = "sha256-2lyjTNd4jf+wTtnFZaRT10ga0MHZondzb+0cM0ftCuY=";
   };
 
-  vendorHash = "sha256-zuzepwTiYJhiqrOxPxYX0b/ffwAVhUfj0RtfXzrhG8o=";
+  vendorHash = "sha256-A9RHSM6BmcaIVHWOou50T1+N/Vh8H1+KtSKeh/ZJ2JQ=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/bi/bigpemu/package.nix b/pkgs/by-name/bi/bigpemu/package.nix
index 6a617a03e8a3..f6ca7b38f407 100644
--- a/pkgs/by-name/bi/bigpemu/package.nix
+++ b/pkgs/by-name/bi/bigpemu/package.nix
@@ -11,12 +11,12 @@
 let
   bigpemu-unwrapped = stdenv.mkDerivation rec {
     pname = "BigPEmu";
-    version = "1.19";
+    version = "1.21";
     src = fetchurl {
       url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
         builtins.replaceStrings [ "." ] [ "" ] version
       }.tar.gz";
-      hash = "sha256-kiZ9yzDRkDLzd5EtjIn32TL27Y2GG8ysG0zTM1JRyTU=";
+      hash = "sha256-DCHgGZMmi2R0PFhAgxNh/jzuT1ONjrofFgO04cgacrA=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/bs/bsh/package.nix b/pkgs/by-name/bs/bsh/package.nix
new file mode 100644
index 000000000000..c235d9323340
--- /dev/null
+++ b/pkgs/by-name/bs/bsh/package.nix
@@ -0,0 +1,9 @@
+{ fetchurl }:
+
+fetchurl (finalAttrs: {
+  name = "${finalAttrs.pname}-${finalAttrs.version}.jar";
+  pname = "bsh";
+  version = "2.0b5";
+  url = "http://www.beanshell.org/bsh-${finalAttrs.version}.jar";
+  hash = "sha256-YjIZlWOAc1SzvLWs6z3BNlAvAixrDvdDmHqD9m/uWlw=";
+})
diff --git a/pkgs/by-name/bu/buildkit/package.nix b/pkgs/by-name/bu/buildkit/package.nix
index 7af50aac8eae..8bda4eef6f89 100644
--- a/pkgs/by-name/bu/buildkit/package.nix
+++ b/pkgs/by-name/bu/buildkit/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.26.3";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-2Utxan85hHmyt+7anfbjFxBHhKzmZb7k9K025vA76Ys=";
+    hash = "sha256-v2/ODT7uwqirrWG3NrMEKYItjhm6f/IlPogCwJi23Rw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ch/chezmoi/package.nix b/pkgs/by-name/ch/chezmoi/package.nix
index 910951bb9815..2a3f4ac991a1 100644
--- a/pkgs/by-name/ch/chezmoi/package.nix
+++ b/pkgs/by-name/ch/chezmoi/package.nix
@@ -7,16 +7,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "chezmoi";
-  version = "2.68.1";
+  version = "2.69.3";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VJGT6sQhrLHqTJOcLknHj/Wz04Pj2/CBUqI5R6xPdQ4=";
+    hash = "sha256-+VEFQgUYrsjzZR9BzTFwbBuMO2OJ8tOKqCt+5jFld5A=";
   };
 
-  vendorHash = "sha256-yNEx2/Vw5kjC428SObBCQ+OI7XwLUicbCvCpmVkdOtQ=";
+  vendorHash = "sha256-WNsAOcm+pfNIU96x49xHz1sWs0CNuosJL70QZ43fVb4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index bb4756167fe9..8989e0347d04 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "12.18.0";
+  version = "12.19.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-U3nCL87fdlLkZLnRmJizGyQVGc7xCja2+hRLFGWkSUk=";
+    hash = "sha256-tP3JtuiQJeLmN5YbRgUiuzCvtE690n3O2jHCWbxcBLE=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-HwlJq48wC/c8VeUQFSH/bBVZiSq2fH9E/JXfaHjSYIM=";
+  vendorHash = "sha256-AyhnFjUzbT54JhmUEX045EiTCLuMTqXiA/ofl7HpJQM=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 982b34bd4550..dc4d4f26cefe 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-bnNpJgy54wvTST1Jtfbd1ldLJrIzTW62TL7wyHeqz28=",
+  vendorHash ? "sha256-3cY4Nd2RX5OKnJaQ7StYDsyq27qE1VY4wGaY4wiDeFQ=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.13.2";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9ggyFixdNy0t4UA8ZxU5oMUzA/8EB/k1jors4f8Q6YE=";
+    hash = "sha256-WcRX2BCWIQ8e0FYCIAzCdexz+Nl+/kKicQkhEw2AVMs=";
   };
 
   inherit vendorHash;
@@ -76,9 +76,9 @@ buildGoModule (finalAttrs: {
     }
     diff -u plugin.cfg.orig plugin.cfg || true
     for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+    go mod vendor
     CC= GOOS= GOARCH= go generate
     go mod tidy
-    go mod vendor
   '';
 
   modInstallPhase = ''
@@ -102,10 +102,21 @@ buildGoModule (finalAttrs: {
     substituteInPlace test/readme_test.go \
       --replace-fail "TestReadme" "SkipReadme"
 
+    substituteInPlace test/metrics_test.go \
+      --replace-fail "TestMetricsRewriteRequestSize" "SkipMetricsRewriteRequestSize"
+
+    substituteInPlace test/quic_test.go \
+      --replace-fail "TestQUICReloadDoesNotPanic" "SkipQUICReloadDoesNotPanic"
+
     # this test fails if any external plugins were imported.
     # it's a lint rather than a test of functionality, so it's safe to disable.
     substituteInPlace test/presubmit_test.go \
       --replace-fail "TestImportOrdering" "SkipImportOrdering"
+
+    substituteInPlace plugin/pkg/parse/transport_test.go \
+      --replace-fail \
+        "TestTransport" \
+        "SkipTransport"
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # loopback interface is lo0 on macos
diff --git a/pkgs/by-name/ec/ecs-agent/package.nix b/pkgs/by-name/ec/ecs-agent/package.nix
index 87f805d197c5..4b6f125cc833 100644
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.101.1";
+  version = "1.101.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-bD+gA9uPtHNDcg/QC+O9sQk7G4und5dViqS6f7pV0rU=";
+    hash = "sha256-J4gjkULtkU1LMHBNcm/QQ407uWMZ6jREP9MdSK0Js44=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ex/exfatprogs/package.nix b/pkgs/by-name/ex/exfatprogs/package.nix
index 26ea0b9d31c0..092a03bde873 100644
--- a/pkgs/by-name/ex/exfatprogs/package.nix
+++ b/pkgs/by-name/ex/exfatprogs/package.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
     file
   ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   meta = {
     description = "exFAT filesystem userspace utilities";
     homepage = "https://github.com/exfatprogs/exfatprogs";
diff --git a/pkgs/by-name/fi/filterpath/package.nix b/pkgs/by-name/fi/filterpath/package.nix
index 15fdd558162a..1061ff58400f 100644
--- a/pkgs/by-name/fi/filterpath/package.nix
+++ b/pkgs/by-name/fi/filterpath/package.nix
@@ -4,7 +4,7 @@
   lib,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  name = "filterpath";
+  pname = "filterpath";
   version = "1.0.4";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/fi/finamp/package.nix b/pkgs/by-name/fi/finamp/package.nix
index 11d9d6f34b18..61f0e26d507c 100644
--- a/pkgs/by-name/fi/finamp/package.nix
+++ b/pkgs/by-name/fi/finamp/package.nix
@@ -9,7 +9,7 @@
   makeDesktopItem,
 }:
 let
-  version = "0.9.21-beta";
+  version = "0.9.22-beta";
 in
 flutter338.buildFlutterApplication {
   inherit version;
@@ -18,7 +18,7 @@ flutter338.buildFlutterApplication {
     owner = "jmshrv";
     repo = "finamp";
     rev = version;
-    hash = "sha256-Mb9oC9SJnZovcqjOJzh0bpWxZhbkfQWzFG9moghCmrw=";
+    hash = "sha256-SPt1p9+uyvfSry8Ry2BJyLC7HyWZe43wfAPK9BVkcnc=";
   };
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -29,7 +29,7 @@ flutter338.buildFlutterApplication {
   buildInputs = [ mpv-unwrapped ];
 
   gitHashes = {
-    balanced_text = "sha256-lSDR5dDjZ4garRbBPI+wSxC5iScg8wVSD5kymmLbYbk=";
+    balanced_text = "sha256-U+gtC9AaUFp3gVkUzYMWAUSuUV7kYB8ZE2BsclnxwkA=";
     isar_generator = "sha256-EthUFM+YI3bnM0U0sECoNOCRXpo4qjP71VXYBuO/u+I=";
     isar_flutter_libs = "sha256-Z5IdfiaZ7348XwYSQb81z0YZEoIHWmsSZr6mYqqz4Oo=";
     media_kit_libs_windows_audio = "sha256-p3hRq79whLFJLNUgL9atXyTGvOIqCbTRKVk1ie0Euqs=";
diff --git a/pkgs/by-name/fo/forecast/package.nix b/pkgs/by-name/fo/forecast/package.nix
index eb572dde9377..1df971d8bb8d 100644
--- a/pkgs/by-name/fo/forecast/package.nix
+++ b/pkgs/by-name/fo/forecast/package.nix
@@ -16,13 +16,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "forecast";
-  version = "0-unstable-2025-11-06";
+  version = "0-unstable-2026-01-22";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "forecast";
-    rev = "51814ecac320185911743986e8ab0211140fa456";
-    hash = "sha256-XOqV9Z4l4aTgm2Abec7IE2bk8oX3RsAA8UxZuo6S5l8=";
+    rev = "c9d170dbf397d977346a61492612f2f2c5acb6a7";
+    hash = "sha256-tOp79Qx7U5q1mFZy4Wh0BOu8+G42j5zGLQ79r+U4Qx8=";
   };
 
   cargoHash = "sha256-di7zjwI0/6NB2cAih3d7iqwSb+o/607jbgJN1MtbZX8=";
diff --git a/pkgs/by-name/fo/fork-cleaner/package.nix b/pkgs/by-name/fo/fork-cleaner/package.nix
index 3ccc31f2d3e7..9df74093631d 100644
--- a/pkgs/by-name/fo/fork-cleaner/package.nix
+++ b/pkgs/by-name/fo/fork-cleaner/package.nix
@@ -7,7 +7,7 @@ let
   version = "2.3.1";
 in
 buildGoModule {
-  name = "fork-cleaner";
+  pname = "fork-cleaner";
   inherit version;
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/gc/gcsfuse/package.nix b/pkgs/by-name/gc/gcsfuse/package.nix
index e9e1b7785eb2..246b2cc04197 100644
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "3.5.6";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-lmvIj0Omq/gJoF/d2byzyYoBsaJXxlMLp3v3QULFUWU=";
+    hash = "sha256-E2xjJ0zy32fI34d/RcPNNwdQR4+V+jB45UehgJt2LpM=";
   };
 
-  vendorHash = "sha256-v+71MA4x+WUj6ROuIbuhP1S+f8UbKFjkS8XpFFM3qyk=";
+  vendorHash = "sha256-Ftkrb94g9w5o64EX4dKIw0jkinaaH5G8MFfbvCWS80k=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index f14b52073937..53a247b130fc 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.6.3";
+  version = "18.6.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-zZho0cN/ePViLo4KtBNIHIHUbpbPI8jj88zY8cCacaU=";
+      hash = "sha256-SH1NXP5OcJF2MCCSCEjCT2GXjHxy1i9QtPZZCJ92rY8=";
     };
 
     vendorHash = "sha256-+5CTncYwtGlScFvVc3QaEScfuqMqvsjnGhggM1HMhNU=";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 9f20e9bd65df..a155a7502c4d 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGo124Module rec {
   pname = "gitlab-container-registry";
-  version = "4.33.0";
+  version = "4.34.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo124Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-6FcnzlQQSeM8l2jH5dG9g0rmnEvAg2FWB8ZpKYBBhE4=";
+    hash = "sha256-KGw9kVsAePhEQ+kINgcMhGw7pSioOnqNWFnjQKu/XmY=";
   };
 
-  vendorHash = "sha256-YfpqspLh+lV+MVZtn8iHQuE+DkZrcOq6hDt20SqkKfw=";
+  vendorHash = "sha256-g4h1m7b7dkdTcSfwTZH4Z5P9RBKme441Ucg4aPIqLSY=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index f785f4714e8f..04734f79015f 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.6.3";
+  version = "18.6.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-+MxG6cWZfNN1Kfx0eLEevWR8q23pnsmS73B4aquKrSc=";
+    hash = "sha256-FMXfF/NpwivtfZh+r7gcVXKFCeshxHBKRNFnbCxSz1U=";
   };
 
   vendorHash = "sha256-AL6V2LPzCGo/7IuY8msip35OScfocp3zO2ZzM8cZfnU=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 6e808c67355e..71ef0bc847c8 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.6.3",
-  "repo_hash": "1ims6fy3zjnrappy1kkb02b8s2vldr18dz7ick176ljk042lqa5g",
+  "version": "18.6.4",
+  "repo_hash": "0jj2wfh37p92dj6fnwv098qaaph9sblqc09mjrz6f5142ijlmxj9",
   "yarn_hash": "19fhh3457mvls3g4swyzr2dh9q46z2zinjyw5v6sjjhfmrqs921d",
   "frontend_islands_yarn_hash": "0m64xhlybjlax33k5rmj9kxcj1vzqqygybyz1yzzx9pd87570k2h",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.6.3-ee",
+  "rev": "v18.6.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.6.3",
-    "GITLAB_KAS_VERSION": "18.6.3",
-    "GITLAB_PAGES_VERSION": "18.6.3",
+    "GITALY_SERVER_VERSION": "18.6.4",
+    "GITLAB_KAS_VERSION": "18.6.4",
+    "GITLAB_PAGES_VERSION": "18.6.4",
     "GITLAB_SHELL_VERSION": "14.45.3",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.10.1",
-    "GITLAB_WORKHORSE_VERSION": "18.6.3"
+    "GITLAB_WORKHORSE_VERSION": "18.6.4"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index e991e0ecb4b2..c7da31f2b288 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.6.3";
+  version = "18.6.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index d2cba968efcb..2df07ffbe95f 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.21.10";
+  version = "2.22.10";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-AvQbD+1mlAV73WJ3uM/vIwwv/aiEkovUkxatH54chNA=";
+    hash = "sha256-3FrATqUGKSYfwYmDne8mbYGgPyG7+uyZtYVn4Bx+Pl0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
index 95b5a611ead1..2b9224f1b845 100644
--- a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
+++ b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule (finalAttrs: {
   # "chatgpt-cli" is taken by another package with the same upsteam name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
-  version = "1.10.2";
+  version = "1.10.9";
 
   src = fetchFromGitHub {
     owner = "kardolus";
     repo = "chatgpt-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Oc4r2cAE2y9WH0Tii8yIsLI7qR+Bhy4iqg1w0xe1EoY=";
+    hash = "sha256-FcDFRYzr+67SoBNQJSJSrLv1DS7Gm1Zjj4wllvY+I/I=";
   };
 
   vendorHash = null;
   # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.2/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.9/test/contract/contract_test.go#L35)
   # which will not be the case in the pipeline.
   # Therefore, tests must be skipped.
   doCheck = false;
diff --git a/pkgs/by-name/li/linuxhw-edid-fetcher/package.nix b/pkgs/by-name/li/linuxhw-edid-fetcher/package.nix
index 47ed98ddba28..2a76567b1dc1 100644
--- a/pkgs/by-name/li/linuxhw-edid-fetcher/package.nix
+++ b/pkgs/by-name/li/linuxhw-edid-fetcher/package.nix
@@ -21,13 +21,13 @@
 #     "${edids}/lib/firmware/edid/PG278Q_2014.bin";
 stdenv.mkDerivation rec {
   pname = "linuxhw-edid-fetcher";
-  version = "0-unstable-2025-01-06";
+  version = "0-unstable-2026-01-08";
 
   src = fetchFromGitHub {
     owner = "linuxhw";
     repo = "EDID";
-    rev = "cc83e52221a9a6d98632f00b54be64fd0bee0394";
-    hash = "sha256-qwTHQOEeFG7SOM2JG9mNpJEoPI8M7GHuwYPWWfU/ID4=";
+    rev = "9c0c1bffc9c0f1cb2044115149a5ecb1652803f8";
+    hash = "sha256-kdGUAbdlS736iB9oGo46HLK3ne3BV4LmUv/3fliyQBA=";
   };
 
   fetch = lib.getExe (writeShellApplication {
diff --git a/pkgs/by-name/m4/m4ri/package.nix b/pkgs/by-name/m4/m4ri/package.nix
index 41c2628121f7..1d29c4554345 100644
--- a/pkgs/by-name/m4/m4ri/package.nix
+++ b/pkgs/by-name/m4/m4ri/package.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20251207";
+  version = "20260122";
   pname = "m4ri";
 
   src = fetchFromGitHub {
     owner = "malb";
     repo = "m4ri";
     rev = version;
-    hash = "sha256-8cO4mPPZj/QUnSJmsqTFQ+THdrnZnCa6wFACKOk78UQ=";
+    hash = "sha256-/M/DVl2tRXIz5l3LFwY8Bvxnzjeoluy+zVgBVpPSdZM=";
   };
 
   doCheck = true;
diff --git a/pkgs/by-name/mc/mcphost/package.nix b/pkgs/by-name/mc/mcphost/package.nix
index 6d823e8d0fad..44c15231ba31 100644
--- a/pkgs/by-name/mc/mcphost/package.nix
+++ b/pkgs/by-name/mc/mcphost/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcphost";
-  version = "0.32.0";
+  version = "0.33.2";
 
   src = fetchFromGitHub {
     owner = "mark3labs";
     repo = "mcphost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zTSU7phEvoiw64V9QQI3IrHA9seStjOZadWaYwjlY9w=";
+    hash = "sha256-AQ+qKbvi3TywDrvc2xnw3gTwEi/Qxb3EJdT+1TWjVpM=";
   };
 
-  vendorHash = "sha256-NBxJim9Abm9dHADXita5NHQf4hbR/IUz4VyeYpHYN2I=";
+  vendorHash = "sha256-oQEMrd1Lp9oMUCoQc674AyftMx7Tb+1rUoEGhu/ck7U=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/mo/monocraft/package.nix b/pkgs/by-name/mo/monocraft/package.nix
index 78876b6a546c..671d7c82c069 100644
--- a/pkgs/by-name/mo/monocraft/package.nix
+++ b/pkgs/by-name/mo/monocraft/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "4.0";
+  version = "4.2.1";
   relArtifact =
     name: hash:
     fetchurl {
@@ -18,9 +18,9 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   srcs = [
-    (relArtifact "Monocraft.ttc" "sha256-SBzl/X2PQOq1cY4dlqO89BDwCrP+/LYwZ9X24p2LDCs=")
-    (relArtifact "Monocraft-no-ligatures.ttc" "sha256-jFZ5Fr/cBwGVsdy7lPqLiLlKtzjF5OIWVkwZI6gR3W4=")
-    (relArtifact "Monocraft-nerd-fonts-patched.ttc" "sha256-lYAb8hgmv4VyrzeHr4LnfuSN9L+4fpDEMX/P++fq8Dc=")
+    (relArtifact "Monocraft.ttc" "sha256-DqGuoS8D1VKkafwBfxnqkntTv50h5gpBxcR2w/rzx/k=")
+    (relArtifact "Monocraft-no-ligatures.ttc" "sha256-k+55umK30KZT39kNXFGflJ461k7EgwRrQX8sxpQ4MdA=")
+    (relArtifact "Monocraft-nerd-fonts-patched.ttc" "sha256-Z/iP+efGVg9s9g+wYv01OnL2LcJlRGKVDGW2PtU9l1Q=")
   ];
 
   dontUnpack = true;
@@ -41,6 +41,9 @@ stdenvNoCC.mkDerivation {
     homepage = "https://github.com/IdreesInc/Monocraft";
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ zhaofengli ];
+    maintainers = with lib.maintainers; [
+      zhaofengli
+      coca
+    ];
   };
 }
diff --git a/pkgs/by-name/mp/mpv/scripts/videoclip.nix b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
index 44643207f144..8c7c0b2b8b51 100644
--- a/pkgs/by-name/mp/mpv/scripts/videoclip.nix
+++ b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
@@ -10,13 +10,13 @@
 }:
 buildLua {
   pname = "videoclip";
-  version = "0-unstable-2025-11-20";
+  version = "0-unstable-2026-01-19";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "videoclip";
-    rev = "1c6531b649d3ee526cc7aa360e726aeedf43beb9";
-    hash = "sha256-lBXlvFrDC1Drz5JIiI6488UoFsXz18LAxqRpQmy1G0k=";
+    rev = "d2278972a5aac714b27c65f8acd92f0aee84cc77";
+    hash = "sha256-OZLPKwBoFPo/1lHnUeGIwdLjkE3eogYLMLaFd2NqSV4=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index cd8cb50b547a..3ee8196bc726 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -33,20 +33,20 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.6.3";
+    version = "0.7.1";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-7fLtVloiTNOmPoVpESpiSUl7i+5SMLXRHbGPk9SilBc=";
+      hash = "sha256-U+97wTN7CxJZ+jOWxZHkN2IiNblb5WTPpnN5v98D2o8=";
     };
 
     ldflags = [
       "-X github.com/kalbasit/ncps/cmd.Version=v${finalAttrs.version}"
     ];
 
-    vendorHash = "sha256-GuUhJ0Zf2Zjfgstxcy6/DAs0Eq7PU4aiiJMSNcNqsqI=";
+    vendorHash = "sha256-nnt4HIG4Fs7RhHjVb7mYJ39UgvFKc46Cu42cURMmr1s=";
 
     subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index 7578c0ad78b0..a099b89fb9f7 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -25,13 +25,13 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
     tag = "v${version}";
-    hash = "sha256-oMOiZhppyUwyhLMtTofmeQINi8rHwsuQ1cD8Kr1/KwM=";
+    hash = "sha256-bbF16siqAqokXOHwLmBL61p/C7YiDGqBJhhJiF08pHk=";
   };
 
   vendorHash = "sha256-5duwAxAgbPZIbbgzZE2m574TF/0+jF/TvTKI4YBH6jM=";
diff --git a/pkgs/by-name/oa/oauth2-proxy/package.nix b/pkgs/by-name/oa/oauth2-proxy/package.nix
index adeaa6007fb3..3f36fb7fba00 100644
--- a/pkgs/by-name/oa/oauth2-proxy/package.nix
+++ b/pkgs/by-name/oa/oauth2-proxy/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "oauth2-proxy";
-  version = "7.13.0";
+  version = "7.14.0";
 
   src = fetchFromGitHub {
     repo = "oauth2-proxy";
     owner = "oauth2-proxy";
-    sha256 = "sha256-o5wJVi8TJ7Qfzn2JzoMSLNhDWSRC7HcrfrQOlMlQr/0=";
+    sha256 = "sha256-lFyEfSOJwzuLgHnVGEUbLTWauboUYxBNF6iTV06vmOw=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-35eJ+vw8V5/nSYsBjlkWvQg2xyvmT5PTDtzZA7b/KkU=";
+  vendorHash = "sha256-HMuQSpUUnMmhsawy2PD8QONLRkJ1vi2LhJnYQzj/TJ4=";
 
   # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
   ldflags = [ "-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=v${version}" ];
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 70c18efc5ec3..77ec29542281 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -169,7 +169,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "AI coding agent built for the terminal";
     homepage = "https://github.com/anomalyco/opencode";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ delafthi ];
+    maintainers = with lib.maintainers; [
+      delafthi
+      graham33
+    ];
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     platforms = [
       "aarch64-linux"
diff --git a/pkgs/by-name/op/openroad/package.nix b/pkgs/by-name/op/openroad/package.nix
index c6c251bc0053..881a512fc389 100644
--- a/pkgs/by-name/op/openroad/package.nix
+++ b/pkgs/by-name/op/openroad/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  yaml-cpp,
 
   # nativeBuildInputs
   bison,
@@ -13,12 +14,13 @@
   libsForQt5,
   pkg-config,
   swig,
+  versionCheckHook,
 
   # buildInputs
-  boost186, # 1.87.0 broken https://github.com/boostorg/asio/issues/442
-  cbc, # for clp
+  boost,
+  cbc,
   cimg,
-  clp, # for or-tools
+  clp,
   cudd,
   eigen,
   glpk,
@@ -28,7 +30,7 @@
   or-tools,
   pcre,
   python3,
-  re2, # for or-tools
+  re2,
   readline,
   spdlog,
   tcl,
@@ -39,16 +41,16 @@
   llvmPackages,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openroad";
-  version = "2.0-unstable-2025-03-01";
+  version = "26Q1";
 
   src = fetchFromGitHub {
     owner = "The-OpenROAD-Project";
     repo = "OpenROAD";
-    rev = "e794373d44ac5421f0633d8dda7e5c59e8fe79bf";
+    tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-a/X4FHkbiqHeblse2ZkLT56gYP+LCrAIZVCdsWF59jM=";
+    hash = "sha256-DMyoqDse9W6ahOajEINzFpgLsSKam/I1mQkRSSKepI8=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +66,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    boost186
+    boost
     cbc
     cimg
     clp
@@ -88,63 +90,70 @@ stdenv.mkDerivation rec {
     tclPackages.tclreadline
     yosys
     zlib
+    yaml-cpp
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
 
   postPatch = ''
-    patchShebangs --build etc/find_messages.py
-    # Disable two tests that are failing curently.
-    sed 's/^.*partition_gcd/# \0/g' -i src/par/test/CMakeLists.txt
-    # fix build with gcc15
+    patchShebangs etc/
+
+    # C++20 Fixes
     sed -e '39i #include <cstdint>' -i src/gpl/src/placerBase.h
     sed -e '37i #include <cstdint>' -i src/gpl/src/routeBase.h
+  ''
+  # Disable failing PSM tests on aarch64
+  + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+    if [ -f src/psm/test/CMakeLists.txt ]; then
+      echo "Patching PSM tests for aarch64..."
+      sed -i -E 's/^[[:space:]]+(gcd_all_vss|gcd_em_test_vdd|insert_decap1|insert_decap_with_padding1)/    # \1/' src/psm/test/CMakeLists.txt
+    fi
   '';
 
   cmakeFlags = [
-    (lib.cmakeBool "ENABLE_TESTS" true)
+    # Disable tests on Darwin to avoid discovery timeouts during build
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "USE_SYSTEM_BOOST" true)
     (lib.cmakeBool "USE_SYSTEM_ABC" false)
-    (lib.cmakeBool "ABC_SKIP_TESTS" true) # it attempts to download gtest
+    (lib.cmakeBool "ABC_SKIP_TESTS" true)
     (lib.cmakeBool "USE_SYSTEM_OPENSTA" false)
-    (lib.cmakeFeature "OPENROAD_VERSION" "${version}_${src.rev}")
+    (lib.cmakeFeature "OPENROAD_VERSION" finalAttrs.version)
     (lib.cmakeBool "CMAKE_RULE_MESSAGES" false)
     (lib.cmakeFeature "TCL_HEADER" "${tcl}/include/tcl.h")
     (lib.cmakeFeature "TCL_LIBRARY" "${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "BOOST_ROOT" "${boost}")
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED")
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED -Wno-error=deprecated-declarations")
   ];
 
-  # Resynthesis needs access to the Yosys binaries.
   qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];
 
-  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
-  # to see if there are any breaking changes in unstable that should be vendored as well.
-  doCheck = !stdenv.hostPlatform.isDarwin; # it seems to hang on darwin
+  # Some tests are unstable on Darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   checkPhase = ''
+    runHook preCheck
     make test
-    ../test/regression
+    runHook postCheck
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
   doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/openroad -version
-    $out/bin/sta -version
-
-    runHook postInstallCheck
-  '';
+  versionCheckProgramArg = "-version";
 
   meta = {
     description = "OpenROAD's unified application implementing an RTL-to-GDS flow";
     homepage = "https://theopenroadproject.org";
     license = lib.licenses.bsd3;
+    mainProgram = "openroad";
     maintainers = with lib.maintainers; [
       trepetti
       hzeller
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/op/operator-sdk/package.nix b/pkgs/by-name/op/operator-sdk/package.nix
index 6650daf86c61..231420aee5c3 100644
--- a/pkgs/by-name/op/operator-sdk/package.nix
+++ b/pkgs/by-name/op/operator-sdk/package.nix
@@ -4,27 +4,31 @@
   go,
   fetchFromGitHub,
   makeWrapper,
+  pkg-config,
+  gpgme,
 }:
 
 buildGoModule rec {
   pname = "operator-sdk";
-  version = "1.39.2";
+  version = "1.42.0";
 
   src = fetchFromGitHub {
     owner = "operator-framework";
     repo = "operator-sdk";
     tag = "v${version}";
-    hash = "sha256-2Kv6mDC1MndUgttRYODnI8DZ84RVz8jn3+RpXmOemq0=";
+    hash = "sha256-iXLAFFO7PCxA8QuQ9pMmQ/GBbVM5wBy9cVzSQRHHPrg=";
   };
 
-  vendorHash = "sha256-W+q9K2003dJfcjyoN4YMoY98cwBy+nfZCi3tHNLbm1w=";
+  vendorHash = "sha256-F2ZYEEFG8hqCcy16DUmP9ilG6e20nXBiJnB6U+wezAo=";
 
   nativeBuildInputs = [
     makeWrapper
+    pkg-config
   ];
 
   buildInputs = [
     go
+    gpgme
   ];
 
   doCheck = false;
diff --git a/pkgs/by-name/pl/plib/darwin-ssgloadflt-uint.patch b/pkgs/by-name/pl/plib/darwin-ssgloadflt-uint.patch
new file mode 100644
index 000000000000..cb9898000d9b
--- /dev/null
+++ b/pkgs/by-name/pl/plib/darwin-ssgloadflt-uint.patch
@@ -0,0 +1,14 @@
+diff --git a/src/ssg/ssgLoadFLT.cxx b/src/ssg/ssgLoadFLT.cxx
+--- a/src/ssg/ssgLoadFLT.cxx
++++ b/src/ssg/ssgLoadFLT.cxx
+@@ -112,6 +112,10 @@
+ # include <sys/stat.h>
+ # include <sys/mman.h>
+ #endif
++#if defined(__APPLE__)
++typedef unsigned int uint;
++typedef unsigned short ushort;
++#endif
+ #ifdef UL_MSVC
+ # include <io.h>
+ #endif
diff --git a/pkgs/by-name/pl/plib/package.nix b/pkgs/by-name/pl/plib/package.nix
index 50c113b5466e..2471a673c5c6 100644
--- a/pkgs/by-name/pl/plib/package.nix
+++ b/pkgs/by-name/pl/plib/package.nix
@@ -37,9 +37,15 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/p/plib/1.8.5-13/debian/patches/08_CVE-2021-38714.patch";
       sha256 = "sha256-3f1wZn0QqK/hPWCg1KEzbB95IGoxBjLZoCOFlW98t5w=";
     })
+    ./darwin-ssgloadflt-uint.patch
   ];
 
-  propagatedBuildInputs = [
+  configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "--disable-sl"
+    "--disable-pw"
+  ];
+
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     libGLU
     libGL
     libglut
@@ -70,6 +76,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl2Plus;
 
     homepage = "https://plib.sourceforge.net/";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ps/pspg/package.nix b/pkgs/by-name/ps/pspg/package.nix
index 0c54e1bb80f0..c454ab313ea3 100644
--- a/pkgs/by-name/ps/pspg/package.nix
+++ b/pkgs/by-name/ps/pspg/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.14";
+  version = "5.8.15";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "pspg";
     rev = version;
-    sha256 = "sha256-DZsMZZO5NMutlzLT+wwtPNdnzAnka32ZMqgMvEuw9ag=";
+    sha256 = "sha256-wYGU9vaAgY87RTbOXOGBVV37ZN/+NceXWgoEaY95md4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index 25565d952022..01d038ea440f 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -44,6 +44,12 @@ python3Packages.buildPythonApplication rec {
 
   postInstall = ''
     installManPage *.1
+
+    install -Dm644 $src/devel/pyradio.desktop \
+      "$out/share/applications/pyradio.desktop"
+
+    install -Dm644 "$src/pyradio/icons/pyradio.png" \
+      "$out/share/icons/hicolor/512x512/apps/pyradio.png"
   '';
 
   meta = {
@@ -54,6 +60,7 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       contrun
+      magicquark
       yayayayaka
     ];
   };
diff --git a/pkgs/by-name/qd/qdelay/package.nix b/pkgs/by-name/qd/qdelay/package.nix
index a7f27131a3a9..4d78090472f3 100644
--- a/pkgs/by-name/qd/qdelay/package.nix
+++ b/pkgs/by-name/qd/qdelay/package.nix
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qdelay";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "tiagolr";
     repo = "qdelay";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-2fu2eF1SjM1qSwKx/oEAx6EWNbNZ8VeJrtnmvxm/0yU=";
+    hash = "sha256-Pnta6KyvOPKsKp9wfofc6BnBGJdV7Of6tFeTgaCTu7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/ruqola/package.nix b/pkgs/by-name/ru/ruqola/package.nix
index 37b5cec331ed..77d202231c8d 100644
--- a/pkgs/by-name/ru/ruqola/package.nix
+++ b/pkgs/by-name/ru/ruqola/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ruqola";
-  version = "2.5.1";
+  version = "2.5.3";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "ruqola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Oeea+IX2H9UvLZnq6X4AjwH5O4VPCg/RHRwohidPalo=";
+    hash = "sha256-OX4eATqcV7k+TIHQINujT5opItDwffIxC577M9q5ef8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 39211b0f3b4a..66a33eca2d60 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2026-01-11";
+  version = "0-unstable-2026-01-22";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "e2a499f7192fa5e966dab03b7980e3240111d7b3";
-    hash = "sha256-F+CtxubdNz+B/a9sAoZW4tIvj72Mms/0bUKmvm14wHg=";
+    rev = "fd89d4e837fe2e98cb273c340ddf4762ce1eb070";
+    hash = "sha256-QMGbNCWbg6ODZHVM+A2hwm/okIXGYULCS2nZrGX2xco=";
   };
 
   patches = [
diff --git a/pkgs/by-name/so/sonarlint-ls/package.nix b/pkgs/by-name/so/sonarlint-ls/package.nix
index 41cc673a7787..11897f28aaec 100644
--- a/pkgs/by-name/so/sonarlint-ls/package.nix
+++ b/pkgs/by-name/so/sonarlint-ls/package.nix
@@ -16,17 +16,17 @@
 
 maven.buildMavenPackage rec {
   pname = "sonarlint-ls";
-  version = "3.25.0.76263";
+  version = "4.8.0.77946";
 
   src = fetchFromGitHub {
     owner = "SonarSource";
     repo = "sonarlint-language-server";
     rev = version;
-    hash = "sha256-bnR6h2NRdGwmx04ydQIlE2VMe/C23YRqNxdbbb19yzE=";
+    hash = "sha256-kwgkRCVcEFGv18zVK9y0JhIx6Cb6XBrnwGbzf2uDdZE=";
   };
 
   mvnJdk = jdk17;
-  mvnHash = "sha256-Fk6JPMmzz7YnPWOdWKOXQ8z6bdYuXSgQdWBOaIlpd4A=";
+  mvnHash = "sha256-KyA2/ABdT35DqzEhE5P+aSGJfu60o6T4+ofQNiQTPFg=";
 
   # Disables failing tests which either need network access or are flaky.
   mvnParameters = lib.escapeShellArgs [
@@ -103,6 +103,9 @@ maven.buildMavenPackage rec {
     mainProgram = "sonarlint-ls";
     homepage = "https://github.com/SonarSource/sonarlint-language-server";
     license = lib.licenses.lgpl3;
-    maintainers = with lib.maintainers; [ tricktron ];
+    maintainers = with lib.maintainers; [
+      tricktron
+      cizordj
+    ];
   };
 }
diff --git a/pkgs/by-name/sp/speed-dreams/darwin-gl-compat.patch b/pkgs/by-name/sp/speed-dreams/darwin-gl-compat.patch
new file mode 100644
index 000000000000..1df97e96d8a0
--- /dev/null
+++ b/pkgs/by-name/sp/speed-dreams/darwin-gl-compat.patch
@@ -0,0 +1,16 @@
+diff --git a/src/libs/tgfclient/guiscreen.cpp b/src/libs/tgfclient/guiscreen.cpp
+--- a/src/libs/tgfclient/guiscreen.cpp
++++ b/src/libs/tgfclient/guiscreen.cpp
+@@ -426,9 +426,9 @@ bool GfScrInitSDL2(int nWinWidth, int nWinHeight, int nFullScreen)
+ 
+ #ifdef __APPLE__
+     // Version d'OpenGL
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 3);
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MINOR_VERSION, 2);
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_PROFILE_MASK, SDL_GL_CONTEXT_PROFILE_CORE);
++    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 2);
++    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MINOR_VERSION, 1);
++    SDL_GL_SetAttribute(SDL_GL_CONTEXT_PROFILE_MASK, SDL_GL_CONTEXT_PROFILE_COMPATIBILITY);
+ #else
+     // Version d'OpenGL
+     SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 2);
diff --git a/pkgs/by-name/sp/speed-dreams/package.nix b/pkgs/by-name/sp/speed-dreams/package.nix
index f1c20be16c8b..1446841b7871 100644
--- a/pkgs/by-name/sp/speed-dreams/package.nix
+++ b/pkgs/by-name/sp/speed-dreams/package.nix
@@ -29,15 +29,52 @@
   cmake,
   pkg-config,
   libvorbis,
-  runtimeShell,
   curl,
   fetchgit,
   cjson,
   minizip,
   rhash,
   copyDesktopItems,
+  makeWrapper,
 }:
 
+let
+  glLibs = lib.optionals stdenv.isLinux [
+    libGL
+    libGLU
+    libglut
+  ];
+  runtimeLibs = glLibs ++ [
+    libX11
+    plib
+    openal
+    freealut
+    libXrandr
+    libXext
+    libSM
+    libICE
+    libXi
+    libXt
+    libXrender
+    libXxf86vm
+    openscenegraph
+    expat
+    libpng12
+    zlib
+    SDL2
+    SDL2_mixer
+    enet
+    libjpeg
+    libvorbis
+    curl
+    cjson
+    minizip
+    rhash
+    stdenv.cc.cc.lib
+  ];
+  runtimeLibPath = lib.makeLibraryPath runtimeLibs;
+  libPathVar = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+in
 stdenv.mkDerivation rec {
   version = "2.4.2";
   pname = "speed-dreams";
@@ -50,58 +87,29 @@ stdenv.mkDerivation rec {
   };
   NIX_CFLAGS_COMPILE = "-I${src}/src/libs/tgf -I${src}/src/libs/tgfdata -I${src}/src/interfaces -I${src}/src/libs/math -I${src}/src/libs/portability";
 
-  postInstall = ''
-    mkdir -p "$out/bin"
-    # Wrapper for main executable
-    cat > "$out/bin/speed-dreams" <<EOF
-    #!${runtimeShell}
-    export LD_LIBRARY_PATH="$out/lib/games/speed-dreams-2/lib:$out/lib:${
-      lib.makeLibraryPath [
-        libGL
-        libGLU
-        libglut
-        libX11
-        plib
-        openal
-        freealut
-        libXrandr
-        libXext
-        libSM
-        libICE
-        libXi
-        libXt
-        libXrender
-        libXxf86vm
-        openscenegraph
-        expat
-        libpng12
-        zlib
-        SDL2
-        SDL2_mixer
-        enet
-        libjpeg
-        libvorbis
-        curl
-        cjson
-        minizip
-        rhash
-        stdenv.cc.cc.lib
-      ]
-    }"
-    if [ -e "${libGL}/lib/libGL.so.1" ]; then
-      export LD_PRELOAD="${libGL}/lib/libGL.so.1''${LD_PRELOAD:+:$LD_PRELOAD}"
-    fi
-    export SDL_VIDEODRIVER="x11"
-    exec "$out/games/speed-dreams-2" "$@"
-    EOF
-    chmod a+x "$out/bin/speed-dreams"
+  patches = [
+    ./darwin-gl-compat.patch
+  ];
 
-    # Symlink for desktop icon
-    mkdir -p $out/share/pixmaps/
-    ln -s "$out/share/games/speed-dreams-2/data/icons/icon.png" "$out/share/pixmaps/speed-dreams-2.png"
+  postInstall = ''
     substituteInPlace "$out/share/applications/speed-dreams.desktop" \
-      --replace-fail "Exec=$out/games/speed-dreams-2" "Exec=$out/bin/speed-dreams" \
-      --replace-fail "Icon=/build/speed-dreams-code/speed-dreams-data/data/data/icons/icon.png" "Icon=$out/share/pixmaps/speed-dreams-2.png"
+      --replace-fail "Exec=$out/games/speed-dreams-2" "Exec=$out/bin/speed-dreams"
+    ${lib.optionalString stdenv.isLinux ''
+      # Symlink for desktop icon
+      mkdir -p $out/share/pixmaps/
+      ln -s "$out/share/games/speed-dreams-2/data/icons/icon.png" "$out/share/pixmaps/speed-dreams-2.png"
+      substituteInPlace "$out/share/applications/speed-dreams.desktop" \
+        --replace-fail "Icon=/build/speed-dreams-code/speed-dreams-data/data/data/icons/icon.png" "Icon=$out/share/pixmaps/speed-dreams-2.png"
+    ''}
+  '';
+
+  postFixup = ''
+    mkdir -p "$out/bin"
+    makeWrapperArgs=(
+      --prefix ${libPathVar} : "$out/lib/games/speed-dreams-2/lib:$out/lib:${runtimeLibPath}"
+    )
+    ${lib.optionalString stdenv.isLinux "makeWrapperArgs+=(--set SDL_VIDEODRIVER x11)"}
+    makeWrapper "$out/games/speed-dreams-2" "$out/bin/speed-dreams" "''${makeWrapperArgs[@]}"
   '';
 
   # RPATH of binary /nix/store/.../lib64/games/speed-dreams-2/drivers/shadow_sc/shadow_sc.so contains a forbidden reference to /build/
@@ -113,13 +121,11 @@ stdenv.mkDerivation rec {
     pkg-config
     cmake
     copyDesktopItems
+    makeWrapper
   ];
 
   buildInputs = [
     libpng12
-    libGLU
-    libGL
-    libglut
     libX11
     plib
     openal
@@ -146,6 +152,11 @@ stdenv.mkDerivation rec {
     cjson
     minizip
     rhash
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    libGL
+    libGLU
+    libglut
   ];
 
   meta = {
@@ -156,7 +167,7 @@ stdenv.mkDerivation rec {
       raskin
       mio
     ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "speed-dreams";
   };
 }
diff --git a/pkgs/by-name/te/tektoncd-cli-pac/package.nix b/pkgs/by-name/te/tektoncd-cli-pac/package.nix
index 5f76f4a8ba18..24b1fb5a78d2 100644
--- a/pkgs/by-name/te/tektoncd-cli-pac/package.nix
+++ b/pkgs/by-name/te/tektoncd-cli-pac/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tektoncd-cli-pac";
-  version = "0.40.0";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "openshift-pipelines";
     repo = "pipelines-as-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FHhJyOHaYaYvizNZ3iKsWy+CH9VWa8LXBmaawVdcaFo=";
+    hash = "sha256-j3HVaaW7fhaFK+Uv/zJXUBmylHV04QCFRr/V7cfeSNg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/to/tomat/package.nix b/pkgs/by-name/to/tomat/package.nix
index 9e9223c52a36..723301f3bda6 100644
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tomat";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "tomat";
     tag = "v${version}";
-    hash = "sha256-Jj/ObyFRvsdwxEvTQCIbkFkR3Zrs7SsU11rOZxclA7E=";
+    hash = "sha256-91/yCWjuLOpeY0APJviElhLBWDM4a8ytUEYkp0oKuRk=";
   };
 
-  cargoHash = "sha256-zmQ7Dk6a0F7XpD3BcOFU87to48j6J5+xNI2XGRx1u/E=";
+  cargoHash = "sha256-/EYSk7bsCnKNRGe/f6RH0L2h0KKU2uEQPSKgqi2a58g=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/vl/vlc-bin/package.nix b/pkgs/by-name/vl/vlc-bin/package.nix
index 85e7f1987ac7..5aaf24f97a70 100644
--- a/pkgs/by-name/vl/vlc-bin/package.nix
+++ b/pkgs/by-name/vl/vlc-bin/package.nix
@@ -20,15 +20,15 @@ assert builtins.elem variant [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "vlc-bin-${variant}";
-  version = "3.0.21";
+  version = "3.0.23";
 
   src = fetchurl {
     url = "http://get.videolan.org/vlc/${finalAttrs.version}/macosx/vlc-${finalAttrs.version}-${variant}.dmg";
     hash =
       {
-        "arm64" = "sha256-Fd1lv2SJ2p7Gpn9VhcdMQKWJk6z/QagpWKkW3XQXgEQ=";
-        "intel64" = "sha256-1DH9BRw9x68CvTE8bQXZDPYEtw7T7Fu6b9TEnvPmONk=";
-        "universal" = "sha256-UDgOVvgdYw41MUJqJlq/iz3ubAgiu3yeMLUyx9aaZcA=";
+        "arm64" = "sha256-/G+sCNh/U4UX1ErKDF56JEtnyMTLWJv0eDY6cxX9Xg0=";
+        "intel64" = "sha256-7AFTDOadhJ3QV/uoh25orDm/J53CjeTpwE5K7BH8mNs=";
+        "universal" = "sha256-Vu5lfDqvXHG0q31uT0p39uylRjPgv0KpO4EW6x0fbsk=";
       }
       .${variant};
   };
diff --git a/pkgs/by-name/xl/xlayoutdisplay/package.nix b/pkgs/by-name/xl/xlayoutdisplay/package.nix
index 5c1efac749b5..6719948ad142 100644
--- a/pkgs/by-name/xl/xlayoutdisplay/package.nix
+++ b/pkgs/by-name/xl/xlayoutdisplay/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   pkg-config,
   xorg,
   boost,
@@ -11,24 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xlayoutdisplay";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "alex-courtis";
     repo = "xlayoutdisplay";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-A37jFhVTW/3QNEf776Oi3ViRK+ebOPRTsEQqdmNhA7E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gJucWffchhTFdYEQqjbj1OdPTBSmGDDcKbOyIWdWQig=";
   };
 
-  patches = [
-    # https://github.com/alex-courtis/xlayoutdisplay/pull/34
-    (fetchpatch2 {
-      name = "cpp-version.patch";
-      url = "https://github.com/alex-courtis/xlayoutdisplay/commit/56983b45070edde78cc816d9cff4111315e94a7a.patch";
-      hash = "sha256-zd28Nkw8Kmm20zGT6wvdBHcHfE4p+RFotUO9zJwPQMc=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = with xorg; [
     libX11
@@ -47,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Detects and arranges linux display outputs, using XRandR for detection and xrandr for arrangement";
     homepage = "https://github.com/alex-courtis/xlayoutdisplay";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ stephen-huan ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux;
     mainProgram = "xlayoutdisplay";
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index ab9d84051eed..36940b91b46f 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "26.1.4";
+  version = "26.1.22";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
-  cargoHash = "sha256-P1ijZsY1AYosWVyxdmDX1SN6KZsrlUqJ9cNfyVWV6mI=";
+  cargoHash = "sha256-VcoIjPZqLimo44atXh7pnCtF+QaZA7uHtKEE6FgTL2k=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2026-1-4";
+  env.VERGEN_BUILD_DATE = "2026-01-22";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -36,13 +36,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     install -Dm444 assets/logo.png $out/share/pixmaps/yazi.png
   '';
 
+  postPatch = ''
+    substituteInPlace yazi-shared/Cargo.toml \
+      --replace-fail 'rust-version = "1.92.0"' 'rust-version = "1.91"'
+  '';
+
   passthru.updateScript.command = [ ./update.sh ];
   passthru.srcs = {
     code_src = fetchFromGitHub {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-dNDwlMM+k20c2Lnm+hqUvzu5l3Ip9GeP+nnj4WlDVdw=";
+      hash = "sha256-BZktPXn+8vyFyHapvW+9nepFsWRW/XBtdBcnLKrCNCw=";
     };
 
     man_src = fetchFromGitHub {
diff --git a/pkgs/data/misc/hackage/default.nix b/pkgs/data/misc/hackage/default.nix
index b283f2025e0d..59ad90bc350a 100644
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@@ -4,8 +4,10 @@
 let
   pin = lib.importJSON ./pin.json;
 in
-fetchurl {
+fetchurl (finalAttrs: {
   inherit (pin) url sha256;
-  name = "all-cabal-hashes-${lib.substring 0 7 pin.commit}.tar.gz";
+  name = "${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+  pname = "all-cabal-hashes";
+  version = lib.substring 0 7 pin.commit;
   passthru.updateScript = ../../../../maintainers/scripts/haskell/update-hackage.sh;
-}
+})
diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index d628399608cf..612c0c442520 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -27,13 +27,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "smtml";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "formalsec";
     repo = "smtml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s72m7N9Ovd2Vl4F+hb2MsNmnF1hFQGkf2s7TrJ9IWI8=";
+    hash = "sha256-ZS+SVmpmvUP2V3DTQ5+QNjFWgj3O3vFIST5c7CifIos=";
   };
 
   minimalOCamlVersion = "4.14";
diff --git a/pkgs/development/python-modules/lm-eval/default.nix b/pkgs/development/python-modules/lm-eval/default.nix
index 5346109286e1..3bbaae0ce9e6 100644
--- a/pkgs/development/python-modules/lm-eval/default.nix
+++ b/pkgs/development/python-modules/lm-eval/default.nix
@@ -34,6 +34,8 @@
   tenacity,
   tiktoken,
   tqdm,
+  # dscrim_eval
+  statsmodels,
   # hf_transfer
   hf-transfer,
   # ifeval
@@ -62,16 +64,16 @@
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lm-eval";
-  version = "0.4.9.1";
+  version = "0.4.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EleutherAI";
     repo = "lm-evaluation-harness";
-    tag = "v${version}";
-    hash = "sha256-N5NRRabjWxPchwOIkjqYTCKInCmVSY6T5cAmdxNbCkU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Foz49XfIIzGJkgzjBu9P1J9cwYjl3fjAAJG9GKRwfq8=";
   };
 
   build-system = [
@@ -108,6 +110,7 @@ buildPythonPackage rec {
       tiktoken
       tqdm
     ];
+    discrim_eval = [ statsmodels ];
     hf_transfer = [ hf-transfer ];
     ifeval = [
       immutabledict
@@ -144,7 +147,7 @@ buildPythonPackage rec {
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ optional-dependencies.api;
+  ++ finalAttrs.passthru.optional-dependencies.api;
 
   disabledTests = [
     "test_deepsparse" # deepsparse is not available
@@ -156,6 +159,7 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     # attempts to download models
+    "tests/models/test_bos_handling.py"
     "tests/models/test_huggingface.py"
     "tests/test_evaluator.py"
     "tests/test_include_path.py"
@@ -172,10 +176,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/EleutherAI/lm-evaluation-harness/releases/tag/${src.tag}";
+    changelog = "https://github.com/EleutherAI/lm-evaluation-harness/releases/tag/${finalAttrs.src.tag}";
     description = "Framework for few-shot evaluation of language models";
     homepage = "https://github.com/EleutherAI/lm-evaluation-harness";
     license = [ lib.licenses.mit ];
     maintainers = [ lib.maintainers.booxter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/mlx-lm/default.nix b/pkgs/development/python-modules/mlx-lm/default.nix
index 1143ebebd08f..25809fb16869 100644
--- a/pkgs/development/python-modules/mlx-lm/default.nix
+++ b/pkgs/development/python-modules/mlx-lm/default.nix
@@ -15,22 +15,23 @@
   transformers,
 
   # tests
+  aiohttp,
   lm-eval,
-  sentencepiece,
   pytestCheckHook,
+  sentencepiece,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "mlx-lm";
-  version = "0.30.2";
+  version = "0.30.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx-lm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WlKAchze5B724XYwzpVHy+17HlMcGSYjJw0aOdm5yw=";
+    hash = "sha256-ncDg7C84d1tAgk1300N7wY6kD1BocNNIqDUl0xBLhqY=";
   };
 
   build-system = [
@@ -50,6 +51,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeCheckInputs = [
+    aiohttp
     lm-eval
     pytestCheckHook
     sentencepiece
@@ -82,5 +84,9 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://github.com/ml-explore/mlx-lm";
     changelog = "https://github.com/ml-explore/mlx-lm/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
+    badPlatforms = [
+      # Building for x86_64 on macOS is not supported by mlx (dependency)
+      "x86_64-darwin"
+    ];
   };
 })
diff --git a/pkgs/development/python-modules/mlx/default.nix b/pkgs/development/python-modules/mlx/default.nix
index 054bd57dcfbd..f146911a9974 100644
--- a/pkgs/development/python-modules/mlx/default.nix
+++ b/pkgs/development/python-modules/mlx/default.nix
@@ -4,17 +4,16 @@
   buildPythonPackage,
   fetchFromGitHub,
   replaceVars,
+  nanobind,
 
   # build-system
-  setuptools,
-
-  # nativeBuildInputs
   cmake,
+  setuptools,
+  typing-extensions,
 
   # buildInputs
   apple-sdk,
   fmt,
-  nanobind,
   nlohmann_json,
   pybind11,
   # linux-only
@@ -42,26 +41,27 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "mlx";
-  version = "0.30.1";
+  version = "0.30.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vt0RH+70VBwUjXSfPTsNdRS3g0ookJHhzf2kvgEtgH8=";
+    hash = "sha256-Y4RTkGcDCZ9HLyflN0qYhPt/oVOsBhF1mHnKM4n1/ys=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+  patches = [
+    # Use system nanobind instead of fetching its sources
+    ./dont-fetch-nanobind.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (replaceVars ./darwin-build-fixes.patch {
       sdkVersion = apple-sdk.version;
     })
   ];
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "nanobind==2.10.2" "nanobind"
-
     substituteInPlace mlx/backend/cpu/jit_compiler.cpp \
       --replace-fail "g++" "${lib.getExe' stdenv.cc "c++"}"
   '';
@@ -79,7 +79,7 @@ buildPythonPackage (finalAttrs: {
   passthru.skipBulkUpdate = true;
 
   env = {
-    DEV_RELEASE = 1;
+    PYPI_RELEASE = 1;
     CMAKE_ARGS = toString [
       # NOTE The `metal` command-line utility used to build the Metal kernels is not open-source.
       # To build mlx with Metal support in Nix, you'd need to use one of the sandbox escape
@@ -89,21 +89,21 @@ buildPythonPackage (finalAttrs: {
       (lib.cmakeBool "USE_SYSTEM_FMT" true)
       (lib.cmakeOptionType "filepath" "FETCHCONTENT_SOURCE_DIR_GGUFLIB" "${gguf-tools}")
       (lib.cmakeOptionType "filepath" "FETCHCONTENT_SOURCE_DIR_JSON" "${nlohmann_json.src}")
+
+      # Cmake cannot find nanobind-config.cmake by itself
+      (lib.cmakeFeature "nanobind_DIR" "${nanobind}/${python.sitePackages}/nanobind/cmake")
     ];
   };
 
   build-system = [
-    setuptools
-  ];
-
-  nativeBuildInputs = [
     cmake
+    setuptools
+    typing-extensions
   ];
 
   buildInputs = [
     fmt
     gguf-tools
-    nanobind
     nlohmann_json
     pybind11
   ]
diff --git a/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch b/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch
new file mode 100644
index 000000000000..f2858448a93b
--- /dev/null
+++ b/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch
@@ -0,0 +1,19 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0ed30932..e5842707 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -339,13 +339,7 @@ if(MLX_BUILD_PYTHON_BINDINGS)
+     Python 3.10
+     COMPONENTS Interpreter Development.Module
+     REQUIRED)
+-  FetchContent_Declare(
+-    nanobind
+-    GIT_REPOSITORY https://github.com/wjakob/nanobind.git
+-    GIT_TAG v2.10.2
+-    GIT_SHALLOW TRUE
+-    EXCLUDE_FROM_ALL)
+-  FetchContent_MakeAvailable(nanobind)
++  find_package(nanobind CONFIG REQUIRED)
+   add_subdirectory(${CMAKE_CURRENT_LIST_DIR}/python/src)
+ endif()
+ 
diff --git a/pkgs/development/web/nodejs/npm-patches.nix b/pkgs/development/web/nodejs/npm-patches.nix
deleted file mode 100644
index 28432f806dc6..000000000000
--- a/pkgs/development/web/nodejs/npm-patches.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ fetchpatch }:
-
-[
-  # Makes `npm pack` obey `--foreground-scripts`
-  (fetchpatch {
-    name = "libnpmpack-obey-foreground-scripts.patch";
-    url = "https://github.com/npm/cli/commit/e4e8ae20aef9e27e57282e87e8757d5b364abb39.patch";
-    hash = "sha256-NQ8CZBfRqAOMe0Ysg3cq1FiferWKTzXC1QXgzX+f8OU=";
-    stripLen = 2;
-    extraPrefix = "deps/npm/node_modules/";
-    includes = [ "deps/npm/node_modules/libnpmpack/lib/index.js" ];
-  })
-
-  # Makes `npm pack` obey `--ignore-scripts`
-  (fetchpatch {
-    name = "libnpmpack-obey-ignore-scripts.patch";
-    url = "https://github.com/npm/cli/commit/a990c3c9a0e67f0a8b6454213675e159fe49432d.patch";
-    hash = "sha256-eA5YST9RxMMjk5FCwEbl1HQUpXZuwWZkx5WC4yJium8=";
-    stripLen = 2;
-    extraPrefix = "deps/npm/node_modules/";
-    includes = [ "deps/npm/node_modules/libnpmpack/lib/index.js" ];
-  })
-]
diff --git a/pkgs/kde/misc/ktextaddons/default.nix b/pkgs/kde/misc/ktextaddons/default.nix
index 4559f20ec6c5..39e467fad836 100644
--- a/pkgs/kde/misc/ktextaddons/default.nix
+++ b/pkgs/kde/misc/ktextaddons/default.nix
@@ -8,11 +8,11 @@
 }:
 mkKdeDerivation rec {
   pname = "ktextaddons";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/ktextaddons/ktextaddons-${version}.tar.xz";
-    hash = "sha256-BTvPhORcFBBCGGqRFajdUacmKAL+lUd0XkS0GQFblpQ=";
+    hash = "sha256-Nm1alMdAVILDptJhNHwbmV3nOghwWZlrEX1hK/wSkcI=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/kde/misc/marknote/default.nix b/pkgs/kde/misc/marknote/default.nix
index 13043d6adffc..33927acd668a 100644
--- a/pkgs/kde/misc/marknote/default.nix
+++ b/pkgs/kde/misc/marknote/default.nix
@@ -8,11 +8,11 @@
 }:
 mkKdeDerivation rec {
   pname = "marknote";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/marknote/marknote-${version}.tar.xz";
-    hash = "sha256-/5lZhBWmzKWQDLTRDStypvOS6v4Hh0tuLrQun3qzvSg=";
+    hash = "sha256-lsL1UcPZoJzbwtbMJC5ks6nIEd9/KUENW4WHHsKtJ5k=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
index 96a1d4e2a1fe..ad46b902a980 100644
--- a/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "ventura-psychrometric-panel";
-  version = "5.0.4";
-  zipHash = "sha256-bBPESByCux0X711UjmT5bQrJDz1BC9+9EGOOJ4jqcj0=";
+  version = "5.1.0";
+  zipHash = "sha256-FMoWOXyMZoVU9b2iG81RbEldrr5Hb3WaWIwzXn7qn4A=";
   meta = {
     description = "Grafana plugin to display air conditions on a psychrometric chart";
     license = lib.licenses.bsd3Lbnl;
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index be82ae1d9227..6dcffd02e67f 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -3,8 +3,6 @@
   stdenvNoCC,
   fetchurl,
   nixosTests,
-  cacert,
-  caBundle ? "${cacert}/etc/ssl/certs/ca-bundle.crt",
   nextcloud31Packages,
   nextcloud32Packages,
 }:
@@ -34,10 +32,6 @@ let
         inherit packages;
       };
 
-      postPatch = ''
-        cp ${caBundle} resources/config/ca-bundle.crt
-      '';
-
       installPhase = ''
         runHook preInstall
         mkdir -p $out/
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a531b957dd88..3644df80eec7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1675,11 +1675,6 @@ with pkgs;
 
   bozohttpd-minimal = bozohttpd.override { minimal = true; };
 
-  bsh = fetchurl {
-    url = "http://www.beanshell.org/bsh-2.0b5.jar";
-    hash = "sha256-YjIZlWOAc1SzvLWs6z3BNlAvAixrDvdDmHqD9m/uWlw=";
-  };
-
   cabal2nix-unwrapped = haskell.lib.compose.justStaticExecutables (
     haskellPackages.generateOptparseApplicativeCompletions [ "cabal2nix" ] haskellPackages.cabal2nix
   );