diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 9791d26e9550..f1473367a7d9 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -161,12 +161,13 @@ let
     );
 
   inherit
-    (callPackage ./maintainers.nix { } {
+    (callPackage ./maintainers.nix {
       changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
       changedpathsjson = touchedFilesJson;
       removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
     })
-    maintainers
+    users
+    teams
     packages
     ;
 in
@@ -178,10 +179,12 @@ runCommand "compare"
       cmp-stats
       codeowners
     ];
-    maintainers = builtins.toJSON maintainers;
+    users = builtins.toJSON users;
+    teams = builtins.toJSON teams;
     packages = builtins.toJSON packages;
     passAsFile = [
-      "maintainers"
+      "users"
+      "teams"
       "packages"
     ];
   }
@@ -262,6 +265,7 @@ runCommand "compare"
 
     done
 
-    cp "$maintainersPath" "$out/maintainers.json"
+    cp "$usersPath" "$out/maintainers.json"
+    cp "$teamsPath" "$out/teams.json"
     cp "$packagesPath" "$out/packages.json"
   ''
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 6eb983c9c5f6..a0180e10f193 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,7 +1,5 @@
 {
   lib,
-}:
-{
   changedattrs,
   changedpathsjson,
   removedattrs,
@@ -51,15 +49,16 @@ let
         # updates to .json files.
         # TODO: Support by-name package sets.
         filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # TODO: Refactor this so we can ping entire teams instead of the individual members.
-        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-        maintainers = package.meta.maintainers or [ ];
+        # meta.maintainers also contains all individual team members.
+        # We only want to ping individuals if they're added individually as maintainers, not via teams.
+        users = package.meta.nonTeamMaintainers or [ ];
+        teams = package.meta.teams or [ ];
       }
     ))
     # No need to match up packages without maintainers with their files.
     # This also filters out attributes where `packge = null`, which is the
     # case for libintl, for example.
-    (lib.filter (pkg: pkg.maintainers != [ ]))
+    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
   ];
 
   relevantFilenames =
@@ -94,20 +93,44 @@ let
 
   attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
 
-  listToPing = lib.concatMap (
+  userPings =
     pkg:
     map (maintainer: {
-      id = maintainer.githubId;
-      inherit (maintainer) github;
+      type = "user";
+      userId = maintainer.githubId;
       packageName = pkg.name;
-      dueToFiles = pkg.filenames;
-    }) pkg.maintainers
+    });
+
+  teamPings =
+    pkg: team:
+    if team ? github then
+      [
+        {
+          type = "team";
+          teamId = team.githubId;
+          packageName = pkg.name;
+        }
+      ]
+    else
+      userPings pkg team.members;
+
+  maintainersToPing = lib.concatMap (
+    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
   ) attrsWithModifiedFiles;
 
-  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
+  byType = lib.groupBy (ping: ping.type) maintainersToPing;
+
+  byUser = lib.pipe (byType.user or [ ]) [
+    (lib.groupBy (ping: toString ping.userId))
+    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
+  ];
+  byTeam = lib.pipe (byType.team or [ ]) [
+    (lib.groupBy (ping: toString ping.teamId))
+    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
+  ];
 in
 {
-  maintainers = lib.mapAttrs (_: lib.catAttrs "packageName") byMaintainer;
-
-  packages = lib.catAttrs "packageName" listToPing;
+  users = byUser;
+  teams = byTeam;
+  packages = lib.catAttrs "name" attrsWithModifiedFiles;
 }
diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index efb0b1e0a11c..b360d54347f0 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -12,6 +12,12 @@ module.exports = async ({ github, context, core, dry }) => {
   // Detect if running in a fork (not NixOS/nixpkgs)
   const isFork = context.repo.owner !== 'NixOS'
 
+  const orgId = (
+    await github.rest.orgs.get({
+      org: context.repo.owner,
+    })
+  ).data.id
+
   async function downloadMaintainerMap(branch) {
     let run
 
@@ -160,6 +166,28 @@ module.exports = async ({ github, context, core, dry }) => {
     return users[id]
   }
 
+  // Same for teams
+  const teams = {}
+  function getTeam(id) {
+    if (!teams[id]) {
+      teams[id] = github
+        .request({
+          method: 'GET',
+          url: '/organizations/{orgId}/team/{id}',
+          orgId,
+          id,
+        })
+        .then((resp) => resp.data)
+        .catch((e) => {
+          // Team may have been deleted
+          if (e.status === 404) return null
+          throw e
+        })
+    }
+
+    return teams[id]
+  }
+
   async function handlePullRequest({ item, stats, events }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
@@ -192,17 +220,49 @@ module.exports = async ({ github, context, core, dry }) => {
     })
 
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    // Accounts could be deleted as well, so don't count them.
     const reviews = (
-      await github.paginate(github.rest.pulls.listReviews, {
-        ...context.repo,
-        pull_number,
-      })
-    ).filter(
+      await github.graphql(
+        `query($owner: String!, $repo: String!, $pr: Int!) {
+        repository(owner: $owner, name: $repo) {
+          pullRequest(number: $pr) {
+            # Unlikely that there's ever more than 100 reviews, so let's not bother,
+            # but once https://github.com/actions/github-script/issues/309 is resolved,
+            # it would be easy to enable pagination.
+            reviews(first: 100) {
+              nodes {
+                state
+                user: author {
+                  # Only get users, no bots
+                  ... on User {
+                    login
+                    # Set the id field in the resulting JSON to GraphQL's databaseId
+                    # databaseId in GraphQL-land is the same as id in REST-land
+                    id: databaseId
+                  }
+                }
+                onBehalfOf(first: 100) {
+                  nodes {
+                    slug
+                  }
+                }
+              }
+            }
+          }
+        }
+      }`,
+        {
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          pr: pull_number,
+        },
+      )
+    ).repository.pullRequest.reviews.nodes.filter(
       (r) =>
-        r.user &&
-        !r.user.login.endsWith('[bot]') &&
-        r.user.type !== 'Bot' &&
+        // The `... on User` makes it such that .login only exists for users,
+        // but we still need to filter the others out.
+        // Accounts could be deleted as well, so don't count them.
+        r.user?.login &&
+        // Also exclude author reviews, can't request their review in any case
         r.user.id !== pull_request.user?.id,
     )
 
@@ -402,6 +462,16 @@ module.exports = async ({ github, context, core, dry }) => {
           if (e.code !== 'ENOENT') throw e
         }
 
+        let team_maintainers = []
+        try {
+          team_maintainers = Object.keys(
+            JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')),
+          ).map((id) => parseInt(id))
+        } catch (e) {
+          // Older artifacts don't have the teams.json, yet.
+          if (e.code !== 'ENOENT') throw e
+        }
+
         // We set this label earlier already, but the current PR state can be very different
         // after handleReviewers has requested reviews, so update it in this case to prevent
         // this label from flip-flopping.
@@ -414,14 +484,15 @@ module.exports = async ({ github, context, core, dry }) => {
           pull_request,
           reviews,
           // TODO: Use maintainer map instead of the artifact.
-          maintainers: Object.keys(
+          user_maintainers: Object.keys(
             JSON.parse(
               await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
             ),
           ).map((id) => parseInt(id)),
+          team_maintainers,
           owners,
-          getTeamMembers,
           getUser,
+          getTeam,
         })
       }
     }
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 14d6fd3762ab..d4b5e4a0b826 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -171,7 +171,7 @@ async function handleMerge({
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return 'Merge completed (dry)'
+      return ['Merge completed (dry)']
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js
index d10b9f6a98e2..be458ba4eb32 100644
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -6,28 +6,29 @@ async function handleReviewers({
   dry,
   pull_request,
   reviews,
-  maintainers,
+  user_maintainers,
+  team_maintainers,
   owners,
-  getTeamMembers,
   getUser,
+  getTeam,
 }) {
   const pull_number = pull_request.number
 
-  const requested_reviewers = new Set(
-    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-  )
-  log(
-    'reviewers - requested_reviewers',
-    Array.from(requested_reviewers).join(', '),
-  )
+  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
+  const users_reached = new Set([
+    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+    ...reviews.map(({ user }) => user.login.toLowerCase()),
+  ])
+  log('reviewers - users_reached', Array.from(users_reached).join(', '))
 
-  const existing_reviewers = new Set(
-    reviews.map(({ user }) => user?.login.toLowerCase()).filter(Boolean),
-  )
-  log(
-    'reviewers - existing_reviewers',
-    Array.from(existing_reviewers).join(', '),
-  )
+  // Same for teams
+  const teams_reached = new Set([
+    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
+    ...reviews.flatMap(({ onBehalfOf }) =>
+      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
+    ),
+  ])
+  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
 
   // Early sanity check, before we start making any API requests. The list of maintainers
   // does not have duplicates so the only user to filter out from this list would be the
@@ -35,16 +36,17 @@ async function handleReviewers({
   // further down again.
   // This is to protect against huge treewides consuming all our API requests for no
   // reason.
-  if (maintainers.length > 16) {
+  if (user_maintainers.length + team_maintainers.length > 16) {
     core.warning('Too many potential reviewers, skipping review requests.')
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const users = new Set([
+  // Users that should be reached
+  var users_to_reach = new Set([
     ...(
       await Promise.all(
-        maintainers.map(async (id) => {
+        user_maintainers.map(async (id) => {
           const user = await getUser(id)
           // User may have deleted their account
           return user?.login?.toLowerCase()
@@ -55,76 +57,109 @@ async function handleReviewers({
       .filter((handle) => handle && !handle.includes('/'))
       .map((handle) => handle.toLowerCase()),
   ])
-  log('reviewers - users', Array.from(users).join(', '))
-
-  const teams = new Set(
-    owners
-      .map((handle) => handle.split('/'))
-      .filter(([org, slug]) => org === context.repo.owner && slug)
-      .map(([, slug]) => slug),
-  )
-  log('reviewers - teams', Array.from(teams).join(', '))
-
-  const team_members = new Set(
-    (await Promise.all(Array.from(teams, getTeamMembers)))
-      .flat(1)
-      .map(({ login }) => login.toLowerCase()),
-  )
-  log('reviewers - team_members', Array.from(team_members).join(', '))
-
-  const new_reviewers = users
-    .union(team_members)
     // We can't request a review from the author.
     .difference(new Set([pull_request.user?.login.toLowerCase()]))
-  log('reviewers - new_reviewers', Array.from(new_reviewers).join(', '))
 
   // Filter users to repository collaborators. If they're not, they can't be requested
   // for review. In that case, they probably missed their invite to the maintainers team.
-  const reviewers = (
-    await Promise.all(
-      Array.from(new_reviewers, async (username) => {
-        // TODO: Restructure this file to only do the collaborator check for those users
-        // who were not already part of a team. Being a member of a team makes them
-        // collaborators by definition.
-        try {
-          await github.rest.repos.checkCollaborator({
-            ...context.repo,
-            username,
-          })
-          return username
-        } catch (e) {
-          if (e.status !== 404) throw e
-          core.warning(
-            `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
-          )
-        }
-      }),
-    )
-  ).filter(Boolean)
-  log('reviewers - reviewers', reviewers.join(', '))
+  users_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(users_to_reach, async (username) => {
+          // TODO: Restructure this file to only do the collaborator check for those users
+          // who were not already part of a team. Being a member of a team makes them
+          // collaborators by definition.
+          try {
+            await github.rest.repos.checkCollaborator({
+              ...context.repo,
+              username,
+            })
+            return username
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - users_to_reach', Array.from(users_to_reach).join(', '))
 
-  if (reviewers.length > 15) {
+  // Similar for teams
+  var teams_to_reach = new Set([
+    ...(
+      await Promise.all(
+        team_maintainers.map(async (id) => {
+          const team = await getTeam(id)
+          // Team may have been deleted
+          return team?.slug?.toLowerCase()
+        }),
+      )
+    ).filter(Boolean),
+    ...owners
+      .map((handle) => handle.split('/'))
+      .filter(
+        ([org, slug]) =>
+          org.toLowerCase() === context.repo.owner.toLowerCase() && slug,
+      )
+      .map(([, slug]) => slug.toLowerCase()),
+  ])
+  teams_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(teams_to_reach, async (slug) => {
+          try {
+            await github.rest.teams.checkPermissionsForRepoInOrg({
+              org: context.repo.owner,
+              team_slug: slug,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            })
+            return slug
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', '))
+
+  if (users_to_reach.size + teams_to_reach.size > 15) {
     core.warning(
-      `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`,
+      `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`,
     )
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const non_requested_reviewers = new Set(reviewers)
-    .difference(requested_reviewers)
-    // We don't want to rerequest reviews from people who already reviewed.
-    .difference(existing_reviewers)
-  log(
-    'reviewers - non_requested_reviewers',
-    Array.from(non_requested_reviewers).join(', '),
+  // We don't want to rerequest reviews from people who already reviewed or were requested
+  const users_not_yet_reached = Array.from(
+    users_to_reach.difference(users_reached),
   )
+  log('reviewers - users_not_yet_reached', users_not_yet_reached.join(', '))
+  // We don't want to rerequest reviews from teams who already reviewed or were requested
+  const teams_not_yet_reached = Array.from(
+    teams_to_reach.difference(teams_reached),
+  )
+  log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', '))
 
-  if (non_requested_reviewers.size === 0) {
+  if (
+    users_not_yet_reached.length === 0 &&
+    teams_not_yet_reached.length === 0
+  ) {
     log('Has reviewer changes', 'false (skipped)')
   } else if (dry) {
     core.info(
-      `Requesting reviewers for #${pull_number}: ${Array.from(non_requested_reviewers).join(', ')} (dry)`,
+      `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
+    )
+    core.info(
+      `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
     )
   } else {
     // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
@@ -134,15 +169,17 @@ async function handleReviewers({
     await github.rest.pulls.requestReviewers({
       ...context.repo,
       pull_number,
-      reviewers,
+      reviewers: users_not_yet_reached,
+      team_reviewers: teams_not_yet_reached,
     })
   }
 
   // Return a boolean on whether the "needs: reviewers" label should be set.
   return (
-    non_requested_reviewers.size === 0 &&
-    existing_reviewers.size === 0 &&
-    requested_reviewers.size === 0
+    users_not_yet_reached.length === 0 &&
+    teams_not_yet_reached.length === 0 &&
+    users_reached.size === 0 &&
+    teams_reached.size === 0
   )
 }
 
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index b0d55f8f5022..044ab6eefcdf 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -101,6 +101,8 @@
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
+- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
+
 - The `services.yggdrasil` module has been refactored with the following breaking changes:
   - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.
   - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).
diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json
index b074ca4207c0..4b8c7efb8566 100644
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -209,9 +209,11 @@
       "domenkozar": 126339,
       "donn": 12652988,
       "dwt": 57199,
+      "eclairevoyant": 848000,
       "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
+      "fulsomenko": 14945057,
       "gador": 1883533,
       "griff": 4368,
       "groodt": 343415,
@@ -240,7 +242,6 @@
       "mstone": 412508,
       "n8henrie": 1234956,
       "ofalvai": 1694986,
-      "pasqui23": 6931743,
       "prusnak": 42201,
       "reckenrode": 7413633,
       "ryand56": 22267679,
@@ -422,8 +423,7 @@
     "maintainers": {
       "Mic92": 96200,
       "kalbasit": 87115,
-      "katexochen": 49727155,
-      "zowoq": 59103226
+      "katexochen": 49727155
     },
     "members": {
       "mfrw": 4929861,
@@ -524,7 +524,7 @@
     "members": {
       "K900": 386765,
       "Ma27": 6025220,
-      "TredwellGit": 61860346
+      "zowoq": 59103226
     },
     "name": "Linux kernel"
   },
@@ -550,8 +550,7 @@
     "members": {
       "9999years": 15312184,
       "Qyriad": 1542224,
-      "RaitoBezarius": 314564,
-      "alois31": 36605164
+      "RaitoBezarius": 314564
     },
     "name": "Lix maintainers"
   },
@@ -691,7 +690,6 @@
       "0x4A6F": 9675338,
       "MattSturgeon": 5046562,
       "Sereja313": 112060595,
-      "dasJ": 4971975,
       "dyegoaurelio": 42411160
     },
     "name": "nix-formatting"
@@ -707,6 +705,7 @@
       "Mic92": 96200,
       "Radvendii": 1239929,
       "edolstra": 1148549,
+      "lovesegfault": 7243783,
       "xokdvium": 145775305
     },
     "name": "Nix team"
@@ -740,8 +739,7 @@
     "id": 14317027,
     "maintainers": {
       "alyssais": 2768870,
-      "emilazy": 18535642,
-      "wolfgangwalther": 9132420
+      "emilazy": 18535642
     },
     "members": {},
     "name": "Nixpkgs core"
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 6cf6e5f1c1d1..b7f3406bc32e 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -36,6 +36,8 @@
 
 - [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable).
 
+- [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable).
+
 - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
 
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index cdd258e5b176..d6725e526a32 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -843,6 +843,7 @@
   ./services/misc/dump1090-fa.nix
   ./services/misc/dwm-status.nix
   ./services/misc/dysnomia.nix
+  ./services/misc/elephant.nix
   ./services/misc/errbot.nix
   ./services/misc/ersatztv.nix
   ./services/misc/etebase-server.nix
diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix
index 15c4d6237c01..368994e8829f 100644
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@@ -142,20 +142,9 @@ in
         else if config.networking.useNetworkd then
           "${cfg.package}/bin/systemd-networkd-dns ${iface [ ]}"
         else
-          "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface [ "-i" ]} -O dns --script ${pkgs.writeShellScript "udhcp-script" ''
-            if [ "$1" = bound ]; then
-              echo "$dns"
-            fi
-          ''}"
+          throw "programs.captive-browser.dhcp-dns must be set"
       );
 
-    security.wrappers.udhcpc = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_raw+p";
-      source = "${pkgs.busybox}/bin/udhcpc";
-    };
-
     security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
       owner = "root";
       group = "root";
diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix
index 28f9dcdb365b..8fa7e6dc3db5 100644
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@@ -161,7 +161,8 @@ in
             ];
             RestrictRealtime = true;
             LockPersonality = true;
-            MemoryDenyWriteExecute = true;
+            # 0.60.0 Taglib introduces WASM JIT that requires this
+            MemoryDenyWriteExecute = false;
             UMask = "0066";
             ProtectHostname = true;
           };
diff --git a/nixos/modules/services/misc/elephant.nix b/nixos/modules/services/misc/elephant.nix
new file mode 100644
index 000000000000..bcd6a3831478
--- /dev/null
+++ b/nixos/modules/services/misc/elephant.nix
@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.elephant;
+in
+{
+  options.services.elephant = {
+    enable = lib.mkEnableOption "Elephant application launcher backend";
+
+    package = lib.mkPackageOption pkgs "elephant" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.user.services.elephant = {
+      description = "Elephant application launcher backend";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 10;
+        ExecStart = "${cfg.package}/bin/elephant";
+      };
+    };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    saadndm
+  ];
+}
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index f73622af3458..04cbe84308df 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -117,9 +117,24 @@ let
 
       path = [ pkgs.wpa_supplicant ];
       serviceConfig = {
+        RuntimeDirectory = "wpa_supplicant";
+        ExecStartPre =
+          lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [
+            # set up imperative config file
+            "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+          ]
+          ++ lib.optionals cfg.userControlled [
+            # set up client sockets directory
+            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
+          ];
+      }
+      // lib.optionalAttrs cfg.enableHardening {
         User = "wpa_supplicant";
         Group = "wpa_supplicant";
-        RuntimeDirectory = "wpa_supplicant";
         AmbientCapabilities = [
           "CAP_NET_ADMIN"
           "CAP_NET_RAW"
@@ -180,20 +195,6 @@ let
         ];
         SystemCallArchitectures = "native";
         UMask = "0077";
-
-        ExecStartPre =
-          lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [
-            # set up imperative config file
-            "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
-          ]
-          ++ lib.optionals cfg.userControlled [
-            # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
-            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
-            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
-          ];
       };
 
       script = ''
@@ -598,6 +599,22 @@ in
         '';
       };
 
+      enableHardening = mkOption {
+        default = true;
+        description = ''
+          Whether to apply security hardening measures to wpa_supplicant.
+          These include limiting access to the filesystem, devices and network
+          capabilities.
+
+          ::: {.note}
+          Disabling this will increase the potential attack surface if the
+          wpa_supplicant daemon becomes compromised, but it may be necessary
+          for more complex enterprise networks (for example requiring
+          access to mutable files, smart cards or TPM devices).
+          :::
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 1adda72186f4..8b3321822b03 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -226,6 +226,19 @@ in
           machine.succeed(dbus_command)  # as root
           machine.succeed(f"sudo -g wpa_supplicant {dbus_command}")  # as wpa_supplicant group
 
+      with subtest("D-Bus auto-starting is working"):
+          # stop service
+          machine.systemctl("stop wpa_supplicant.service")
+          machine.require_unit_state("wpa_supplicant.service", "inactive")
+
+          # send wake up
+          dbus_command = "dbus-send --system --print-reply --dest=fi.w1.wpa_supplicant1 " \
+                         "/fi/w1/wpa_supplicant1 fi.w1.wpa_supplicant1.GetInterface string:wlan0"
+          machine.succeed(dbus_command)
+
+          # should be up again
+          machine.require_unit_state("wpa_supplicant.service", "active")
+
       # generated configuration file
       config_file = "/etc/static/wpa_supplicant/nixos.conf"
 
diff --git a/pkgs/applications/emulators/libretro/cores/np2kai.nix b/pkgs/applications/emulators/libretro/cores/np2kai.nix
index a13fe9275eed..6fbd92989010 100644
--- a/pkgs/applications/emulators/libretro/cores/np2kai.nix
+++ b/pkgs/applications/emulators/libretro/cores/np2kai.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "np2kai";
-  version = "0-unstable-2026-01-31";
+  version = "0-unstable-2026-02-01";
 
   src = fetchFromGitHub {
     owner = "AZO234";
     repo = "NP2kai";
-    rev = "696c03b5d2cc6d67450b62276fb945d791fa6be1";
-    hash = "sha256-usaQl1q9U+Qwe/ZxOyrDxTUr1ifbPljQrxRc7uoQWLA=";
+    rev = "15676585b9a370e874ea9309252bd8236df3f642";
+    hash = "sha256-Zaay3JYCjv1eohNTC/9AYD0ZrvNaz9X4A4D6CkB/n+4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 1236f7b79369..efaff0805e95 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -367,10 +367,6 @@ buildStdenv.mkDerivation {
     "-l"
   ];
 
-  # if not explicitly set, wrong cc from buildStdenv would be used
-  HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc";
-  HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++";
-
   nativeBuildInputs = [
     autoconf
     cargo
@@ -643,7 +639,12 @@ buildStdenv.mkDerivation {
   makeFlags = extraMakeFlags;
   separateDebugInfo = enableDebugSymbols;
   enableParallelBuilding = true;
-  env = lib.optionalAttrs stdenv.hostPlatform.isMusl {
+  env = {
+    # if not explicitly set, wrong cc from buildStdenv would be used
+    HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc";
+    HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isMusl {
     # Firefox relies on nonstandard behavior of the glibc dynamic linker. It re-uses
     # previously loaded libraries even though they are not in the rpath of the newly loaded binary.
     # On musl we have to explicitly set the rpath to include these libraries.
diff --git a/pkgs/by-name/al/alist/package.nix b/pkgs/by-name/al/alist/package.nix
index fa227de7d5e2..69011adfadfe 100644
--- a/pkgs/by-name/al/alist/package.nix
+++ b/pkgs/by-name/al/alist/package.nix
@@ -11,13 +11,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "alist";
-  version = "3.55.0";
+  version = "3.57.0";
 
   src = fetchFromGitHub {
     owner = "AlistGo";
     repo = "alist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/psFL/dCG82y1uWEcg45JG6S7+MD0avqU/HjrR+vklA=";
+    hash = "sha256-wwV65vxNSrGzP7TQ+nnjWS+dcCj/+67WcMPRbNqOVbQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -30,6 +30,13 @@ buildGoModule (finalAttrs: {
     '';
   };
 
+  # --- FAIL: TestSecureJoin/drive (0.00s)
+  #     securepath_test.go:29: expected error for "C:\\evil.txt", got nil
+  postPatch = lib.optionalString stdenv.hostPlatform.isUnix ''
+    substituteInPlace internal/archive/tool/securepath_test.go \
+      --replace-fail '{name: "drive", entry: "C:\\evil.txt", wantErr: true},' ""
+  '';
+
   proxyVendor = true;
   vendorHash = "sha256-aRnS3LLG25FK1ELKd7K1e5aGLmKnQ7w/3QVe4P9RRLI=";
 
@@ -87,10 +94,10 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     updateScript = lib.getExe (callPackage ./update.nix { });
-    webVersion = "3.55.0";
+    webVersion = "3.57.0";
     web = fetchzip {
       url = "https://github.com/AlistGo/alist-web/releases/download/${finalAttrs.passthru.webVersion}/dist.tar.gz";
-      hash = "sha256-v0o4G2mzd63sShJZRjijIFAUB+ocvF4jspxf841lZ8U=";
+      hash = "sha256-QP1eWlSr7XBX8jUyvXhpmEGIwWaY6wy4M2l/35AiuUg=";
     };
   };
 
diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix
index 61b15b96fdeb..1ce6bd467a7a 100644
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -28,18 +28,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.36.0";
+  version = "1.36.1";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VSx8M8W3j47xC0tPdKtEHeMcFJMpBBMHjf7ZiDiE79I=";
+    hash = "sha256-15Z1lHNeXTToDpdVc/YB5ojhoiB5qdgWs47O1aKoyFM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-o0UofdKgEe/R683TmZJlsd1QD1Iy1oMBVBSN6u2uvDM=";
+    hash = "sha256-YWsJUSgKNkK9W4Yuolix21bRRFSF01+sivoj7SJo7DY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index 4597e7b1b291..d28a4de75e5f 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -27,12 +27,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "circt";
-  version = "1.139.0";
+  version = "1.140.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
-    rev = "firtool-${finalAttrs.version}";
-    hash = "sha256-Yj9BqmmotIaTUHIUslaOmRXYC4ujQ9GNjEmaAfLgLgU=";
+    tag = "firtool-${finalAttrs.version}";
+    hash = "sha256-oitdYNGsEyraQqouOt9srfbDgVGFOAGZMdcf/rjnx5Q=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
index c417093bb664..ceb1c594508f 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2025-09-22";
+  version = "0-unstable-2026-01-29";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "ed75123192c7f45f435797bfecae9eb615298728";
-    hash = "sha256-eAhOVp1suZpGCKpvKWA0xqvVf+FOsj7dqtlnYO/FHUI=";
+    rev = "f92912ee466fbb1b9b7e59f0cc49fb14dfddbc58";
+    hash = "sha256-3p1xPOciNFlROR02hnaVwCaHPQI3mhXamy0WBD9ndWk=";
   };
 
-  cargoHash = "sha256-ehytOcMIocyHBnrPg1A73FUo3s1aOuYpI5FvrqjGpi4=";
+  cargoHash = "sha256-sLoT/p7Au5s16J08RlxK+o4ayUzKO30GfcUwr8kGFl8=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
index 5ad79d16caf4..767a0834eae9 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-01-17";
+  version = "0-unstable-2026-02-03";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-weather";
-    rev = "142666f73c702036438408758ea86ec22d63611b";
-    hash = "sha256-K4flguR6pknhFCpwHQ+4OtSAtPBjUag1g/uUnCNM3Pw=";
+    rev = "ea8a506a6ca56b6ac6c4952012880bf1d6227631";
+    hash = "sha256-DnYOOeCcf/fuNuPJ8MeolfAyGJdNWONawaF1HV8mr4k=";
   };
 
-  cargoHash = "sha256-LcTUIhAWitLFz23TasfSJt6tOAAAJDiHxfTcxBX2/Bg=";
+  cargoHash = "sha256-tj0skQNt0p6UMUnU6HXw6ZAjEkCuuF4vg1aoWytqCos=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/di/diffnav/package.nix b/pkgs/by-name/di/diffnav/package.nix
index 83e366326926..0c7c86647715 100644
--- a/pkgs/by-name/di/diffnav/package.nix
+++ b/pkgs/by-name/di/diffnav/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "diffnav";
-  version = "0.6.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "diffnav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pak1R2BmL3A8YADwFw7QZk7JsGQzBBS/xHzRhYlMKGo=";
+    hash = "sha256-2CAvZyBcWlaTHcDqKlGYjFiZJm9UcwGS3YQpeaphKTE=";
   };
 
-  vendorHash = "sha256-cDA5qstTRApt4DXcakNLR5nsyh9i7z2Qrvp6q/OoYhY=";
+  vendorHash = "sha256-FA58Rd+tEiyArDCeKsekpxkM+i8z/KlO3GLzkonSKVM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/el/elephant/package.nix b/pkgs/by-name/el/elephant/package.nix
new file mode 100644
index 000000000000..2d589e3d171b
--- /dev/null
+++ b/pkgs/by-name/el/elephant/package.nix
@@ -0,0 +1,131 @@
+{
+  enableArchLinuxPkgs ? false,
+  enableDnfPackages ? false,
+  enable1password ? false,
+  enableBitwarden ? true,
+  enableBluetooth ? true,
+  enableBookmarks ? true,
+  enableCalc ? true,
+  enableClipboard ? true,
+  enableDesktopApplications ? true,
+  enableFiles ? true,
+  enableMenus ? true,
+  enableNiriActions ? true,
+  enableNiriSessions ? true,
+  enableProviderList ? true,
+  enableRunner ? true,
+  enableSnippets ? true,
+  enableSymbols ? true,
+  enableTodo ? true,
+  enableUnicode ? true,
+  enableWebsearch ? true,
+  enableWindows ? true,
+
+  bluez,
+  buildGoModule,
+  fd,
+  fetchFromGitHub,
+  imagemagick,
+  lib,
+  libqalculate,
+  makeWrapper,
+  nix-update-script,
+  protobuf,
+  protoc-gen-go,
+  wl-clipboard,
+}:
+let
+  providerMap = {
+    "1password" = enable1password;
+    "archlinuxpkgs" = enableArchLinuxPkgs;
+    "bitwarden" = enableBitwarden;
+    "bluetooth" = enableBluetooth;
+    "bookmarks" = enableBookmarks;
+    "calc" = enableCalc;
+    "clipboard" = enableClipboard;
+    "desktopapplications" = enableDesktopApplications;
+    "dnfpackages" = enableDnfPackages;
+    "files" = enableFiles;
+    "menus" = enableMenus;
+    "niriactions" = enableNiriActions;
+    "nirisessions" = enableNiriSessions;
+    "providerlist" = enableProviderList;
+    "runner" = enableRunner;
+    "snippets" = enableSnippets;
+    "symbols" = enableSymbols;
+    "todo" = enableTodo;
+    "unicode" = enableUnicode;
+    "websearch" = enableWebsearch;
+    "windows" = enableWindows;
+  };
+
+  enabledProviders = lib.filterAttrs (_: enabled: enabled) providerMap;
+  enabledProvidersList = lib.concatStringsSep " " (lib.attrNames enabledProviders);
+
+  runtimeDeps =
+    lib.optionals enableFiles [ fd ]
+    ++ lib.optionals enableBluetooth [ bluez ]
+    ++ lib.optionals enableCalc [ libqalculate ]
+    ++ lib.optionals enableClipboard [
+      wl-clipboard
+      imagemagick
+    ];
+
+in
+buildGoModule (finalAttrs: {
+  pname = "elephant";
+  version = "2.19.2";
+
+  src = fetchFromGitHub {
+    owner = "abenz1267";
+    repo = "elephant";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-hs1Re7ltWYFBsiwDsK3Qb3/KgZ4E2HY7cFB/M8JWSu4=";
+  };
+
+  vendorHash = "sha256-tO+5x2FIY1UBvWl9x3ZSpHwTWUlw1VNDTi9+2uY7xdU=";
+
+  buildInputs = [ protobuf ];
+  nativeBuildInputs = [
+    makeWrapper
+    protoc-gen-go
+  ];
+
+  subPackages = [ "cmd/elephant" ];
+
+  postBuild = ''
+    echo "Building providers: ${enabledProvidersList}"
+
+    mkdir -p $out/lib/elephant/providers
+    for provider in ${enabledProvidersList}; do
+      [ -z "$provider" ] && continue
+      if [ -d "internal/providers/$provider" ]; then
+        echo "Building provider: $provider"
+        go build -buildmode=plugin -o "$out/lib/elephant/providers/$provider.so" ./internal/providers/"$provider" || exit 1
+      fi
+    done
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/elephant \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps} \
+      --set ELEPHANT_PROVIDER_DIR "$out/lib/elephant/providers"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Data provider service and backend for building custom application launchers";
+    changelog = "https://github.com/abenz1267/elephant/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/abenz1267/elephant";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      adamcstephens
+      saadndm
+    ];
+    mainProgram = "elephant";
+  };
+})
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index 09e188b689ea..c2f5b2792275 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage rec {
   pname = "flood";
-  version = "4.11.0";
+  version = "4.12.2";
 
   src = fetchFromGitHub {
     owner = "jesec";
     repo = "flood";
     rev = "v${version}";
-    hash = "sha256-RBWDEFhLEZdC7luGFGx3qY0Hk7nM44RZgRyCWXFPh1k=";
+    hash = "sha256-N+6MFxFDfrrp8MLUMjtzdUMDsJGvRPE7SdTedOlrRX4=";
   };
 
   nativeBuildInputs = [ pnpm_9 ];
@@ -31,7 +31,7 @@ buildNpmPackage rec {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-MnsUTXcLMT0Q2bQ/rRD4FfJx8XP9TLiv1oTHIgnMZCQ=";
+    hash = "sha256-m7YNBHEz5g1AjDVECrGL+xJfSXaTnUPPY679ENjR+l8=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index 6d2578e3cf39..e6e2cecfe19e 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -6,7 +6,6 @@
   php,
   brotli,
   watcher,
-  frankenphp,
   cctools,
   darwin,
   libiconv,
@@ -29,18 +28,18 @@ let
   phpConfig = "${phpUnwrapped.dev}/bin/php-config";
   pieBuild = stdenv.hostPlatform.isMusl;
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "frankenphp";
   version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "php";
     repo = "frankenphp";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-JzZXg/tkSZqLZn56RyLb8Q8SaeG/tHA8Sqxu99s5ks0=";
   };
 
-  sourceRoot = "${src.name}/caddy";
+  sourceRoot = "${finalAttrs.src.name}/caddy";
 
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
@@ -78,14 +77,14 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP ${version} PHP ${phpUnwrapped.version} Caddy'"
+    "-X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP ${finalAttrs.version} PHP ${phpUnwrapped.version} Caddy'"
     # pie mode is only available with pkgsMusl, it also automatically add -buildmode=pie to $GOFLAGS
   ]
   ++ (lib.optional pieBuild [ "-static-pie" ]);
 
   preBuild = ''
     export CGO_CFLAGS="$(${phpConfig} --includes)"
-    export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${version} \
+    export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${finalAttrs.version} \
       $(${phpConfig} --ldflags) \
       $(${phpConfig} --libs)"
   '';
@@ -115,13 +114,13 @@ buildGoModule rec {
             '';
           }
           ''
-            ${lib.getExe frankenphp} php-cli $phpScript > $out
+            ${lib.getExe finalAttrs.finalPackage} php-cli $phpScript > $out
           '';
     };
   };
 
   meta = {
-    changelog = "https://github.com/php/frankenphp/releases/tag/v${version}";
+    changelog = "https://github.com/php/frankenphp/releases/tag/v${finalAttrs.version}";
     description = "Modern PHP app server";
     homepage = "https://github.com/php/frankenphp";
     license = lib.licenses.mit;
@@ -129,4 +128,4 @@ buildGoModule rec {
     maintainers = [ lib.maintainers.piotrkwiecinski ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix
index e57161c3d9f6..89578079812b 100644
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "3.8.1";
+  version = "3.8.3";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-GLoGdZ/UWtkWt4WjjhmupQzPQTMuQI+7jb7IjSCcvo0=";
+    hash = "sha256-1oePQ33Bpt2GKEQgCIVAVjnF04rLY9fraUuodoLlx8o=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix
index 6e12c8d9b188..9b5d9c11c3a7 100644
--- a/pkgs/by-name/jj/jj-pre-push/package.nix
+++ b/pkgs/by-name/jj/jj-pre-push/package.nix
@@ -1,8 +1,12 @@
 {
   lib,
+  stdenv,
   python3Packages,
   fetchFromGitHub,
-  fetchpatch2,
+  installShellFiles,
+
+  withPrecommit ? true,
+  pre-commit,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -21,9 +25,20 @@ python3Packages.buildPythonApplication rec {
     python3Packages.uv-build
   ];
 
-  dependencies = with python3Packages; [
-    typer-slim
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      typer-slim
+    ]
+    ++ lib.optionals withPrecommit [ pre-commit ];
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd jj-pre-push \
+      --bash <($out/bin/jj-pre-push --show-completion bash) \
+      --fish <($out/bin/jj-pre-push --show-completion fish) \
+      --zsh <($out/bin/jj-pre-push --show-completion zsh)
+  '';
 
   pythonImportsCheck = [
     "jj_pre_push"
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index b531fa012254..f63dfdfe46c5 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kanban";
-  version = "0.1.16";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "fulsomenko";
     repo = "kanban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WksL0AhooBTV+W1knU+tns/qvHDd0z6mE2HkC57BAcU=";
+    hash = "sha256-w1NoWgaUBny//3t1S5z/juPOYFomwJKtTq/M4qKoNv0=";
   };
 
   GIT_COMMIT_HASH = finalAttrs.src.rev;
 
-  cargoHash = "sha256-Q/o5MHjVRrJpfhkzNNJ6j4oASV5wDg/0Zi43zPlp5p8=";
+  cargoHash = "sha256-N+c2jnJ7a+Nh2UibkaOByh4tKDX52VovYIpeHTpawXo=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index a50a2930e7e4..82d17474e4b0 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.705";
+  version = "0.707";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-M0niHRtx/Xu3H5CJXbqB2VCXFsthvPDNcr29egY3ncI=";
+    hash = "sha256-YUv40STZs5J+xFo5apbyqOpDB+PO+mYsC93pXmxhW+o=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix
index bc4a683c9c65..40150a5efb02 100644
--- a/pkgs/by-name/md/md-tui/package.nix
+++ b/pkgs/by-name/md/md-tui/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "md-tui";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "henriklovhaug";
     repo = "md-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LBt15MCv+QbjutwRfYI9zX5UAiYF2Y70EQ3DATRLaY8=";
+    hash = "sha256-9TQmCYo0ktZydRgRkNkqhFFvS+BMx+IIfvXQeKLucVk=";
   };
 
-  cargoHash = "sha256-2Qr+6y/DOQJYP5EMMI/OdqIMrHBX4tNH29fK+QCsrnQ=";
+  cargoHash = "sha256-PTJgsRaEJHu6JmPKX71sBeaSaCsS/Ws82NBsD3fjFzc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/mp/mpd-mpris/package.nix b/pkgs/by-name/mp/mpd-mpris/package.nix
index b1bc34480ba3..edaabd5af9e7 100644
--- a/pkgs/by-name/mp/mpd-mpris/package.nix
+++ b/pkgs/by-name/mp/mpd-mpris/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  fetchpatch,
 }:
 
 buildGoModule (finalAttrs: {
@@ -19,6 +20,13 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/mpd-mpris" ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/natsukagami/mpd-mpris/commit/1591f15548aed0f9741d723f24fb505cb24fafe8.patch";
+      hash = "sha256-6ZqR4woKiIjwLxyafmidTM8eBXtvBzKNXZvtS1+KKKI=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace services/mpd-mpris.service --replace-fail "ExecStart=" "ExecStart=$out/bin/"
   '';
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index cab2663d8d95..0aba55f33e3e 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -19,23 +19,23 @@
 
 buildGoModule (finalAttrs: {
   pname = "navidrome";
-  version = "0.59.0";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YXyNnjaLgu4FXvgsbbzCOZRIuN96h+KDrXmJe1607JI=";
+    hash = "sha256-K7Cen0gADYQc0jxd2keBpTJlyQyuYL02j7/yiNtjZvQ=";
   };
 
-  vendorHash = "sha256-FFtTQuXb5GYxZmUiNjZNO6K8QYF0TLH4JU2JmAzZhqQ=";
+  vendorHash = "sha256-DCz/WKZXnZy109WgStCK7NJg8VpR3IJEaQZLMDXdegk=";
 
   npmRoot = "ui";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/ui";
-    hash = "sha256-RTye1ZbxLqfkZUvV0NLN7wcRnri3sC5Lfi8RXVG1bLM=";
+    hash = "sha256-Z1kSRNSG1zeLA6rtbcTdLJnNWclsVTS5Xfc4D9M0dl4=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,10 @@ buildGoModule (finalAttrs: {
     zlib
   ];
 
+  excludedPackages = [
+    "plugins"
+  ];
+
   ldflags = [
     "-X github.com/navidrome/navidrome/consts.gitSha=${finalAttrs.src.rev}"
     "-X github.com/navidrome/navidrome/consts.gitTag=v${finalAttrs.version}"
diff --git a/pkgs/by-name/ne/nebula/package.nix b/pkgs/by-name/ne/nebula/package.nix
index b474a32fa89d..024c280c7a72 100644
--- a/pkgs/by-name/ne/nebula/package.nix
+++ b/pkgs/by-name/ne/nebula/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nebula";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "slackhq";
     repo = "nebula";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hDszl6//hFVK79dadz6mBuYMRvwDUerUkPvzD5AcvfA=";
+    hash = "sha256-sF/NZpBxbJWHTjx6Nuv7WHgUqhYbBq2/g7nB3wxNDHg=";
   };
 
-  vendorHash = "sha256-CNYBqslUXJf3Nls3Lu6PbABhT9wTbIfBZxFkiUW59Kk=";
+  vendorHash = "sha256-zzYywNbeccW4Ujig20oBUZsJBQFvCIkCNOuBMxGxaqE=";
 
   subPackages = [
     "cmd/nebula"
@@ -78,6 +78,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/slackhq/nebula/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
+      herbetom
       numinit
     ];
   };
diff --git a/pkgs/by-name/ni/nixos-container/nixos-container.pl b/pkgs/by-name/ni/nixos-container/nixos-container.pl
index 3e4d50c903db..c23a90e4f870 100755
--- a/pkgs/by-name/ni/nixos-container/nixos-container.pl
+++ b/pkgs/by-name/ni/nixos-container/nixos-container.pl
@@ -55,6 +55,7 @@ Usage: nixos-container list
          [--config-file <path>]
          [--flake <flakeref>]
          [--nixos-path <path>]
+         [--refresh]
        nixos-container login <container-name>
        nixos-container root-login <container-name>
        nixos-container run <container-name> -- args...
@@ -122,6 +123,7 @@ GetOptions(
     "no-write-lock-file" => \&copyNixFlags0,
     "no-allow-dirty" => \&copyNixFlags0,
     "recreate-lock-file" => \&copyNixFlags0,
+    "refresh" => \&copyNixFlags0,
     ) or exit 1;
 
 push @nixFlags, @nixFlags2;
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 9373549cb020..79dc42eca7a1 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -137,17 +137,16 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  # don't forget to invalidate all hashes each update
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5dkikrp7jVGnfFwiGkbsGsRnrsS0zcZzWQ7shOn3alw=";
+    hash = "sha256-VJrAUHX+BVQXsH34BDI4YqVXEqD14ERnKhSpMByAdrQ=";
   };
 
-  vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc=";
+  vendorHash = "sha256-r7bSHOYAB5f3fRz7lKLejx6thPx0dR4UXoXu0XD7kVM=";
 
   env =
     lib.optionalAttrs enableRocm {
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index b703deb83965..12f629a82d42 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "6.5.0";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-okqp0jgrAIUAkVmlWd3O1lnvSOTIXp+RJ9GJAAe5mIs=";
+    hash = "sha256-YAWSVH5cpllNz50pYbq3ceGaLOYOkwMsE5s/MfzP18A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 8b46449a7ec3..d18d83340e6b 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -42,13 +42,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "podman";
-  version = "5.7.0";
+  version = "5.7.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHIWfY8eKdimwpLfB1NtpF1DBh6qaR5KCDTU4vWAMFw=";
+    hash = "sha256-wfzkn8sv7LajwTZzlWi2gy7Uox4rWGc0i8/OjTIqi5o=";
   };
 
   patches = [
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index bf62e39f7225..36850b4d4ca1 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.1.15";
+  version = "26.2.0";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Pdv55cybpUOKI4COAg7GqJTrBrMCn1GPGT+m+TGcruo=";
+    hash = "sha256-vPrHadER77TzwFb3etVSVsnqu7cVitIsnKVDChjAbwE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 8a4c2d073d3d..d6c9e7cf691e 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.08";
+  version = "4.09";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     tag = finalAttrs.version;
-    hash = "sha256-i+CBU1aKx6ZTgtSSDZHefQ96sgqSNtqCglhj7hHH6fI=";
+    hash = "sha256-8J1eMQYATKCVwH3MCz/Hp76iRi5w+C8NsZ3eKivtYe0=";
   };
 
-  vendorHash = "sha256-77KoE0gbybWpRLiaiqD+ZC0zH3BcYuZ1TkC7aPFkAv8=";
+  vendorHash = "sha256-a8rDXJfqZwUw4yH02xj2M0+kNLa/tnFJZxZwfWzTq4c=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libredirect.hook ];
 
diff --git a/pkgs/by-name/si/signls/package.nix b/pkgs/by-name/si/signls/package.nix
new file mode 100644
index 000000000000..043d6aca1cbc
--- /dev/null
+++ b/pkgs/by-name/si/signls/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  alsa-lib,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "signls";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "emprcl";
+    repo = "signls";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fITsfMgMdv6zW4KEmteCYQdm2NfI2RLbrW44KOwtLOg=";
+  };
+
+  buildInputs = [
+    alsa-lib
+  ];
+
+  vendorHash = "sha256-reNMOb8QRJ+nMa7S2aM/f8wur0yeMDks2b6Skh6uTQQ=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.AppVersion=v${finalAttrs.version}"
+  ];
+
+  meta = {
+    description = "Non-linear, generative midi sequencer in the terminal";
+    homepage = "https://github.com/emprcl/signls";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "signls";
+  };
+})
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 9c92099562af..adae60a5104b 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.17";
+  version = "1.12.20";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3dxkoSfXSMID8GVhjyPC2n8UNqOx8IkSkGuFmWZ3TbI=";
+    hash = "sha256-HYm4DMrCCQi+OInZPfezL0imy9jOLPa45sSpSWn2xgs=";
   };
 
-  vendorHash = "sha256-p5E3tJiqhgTeE35vVt03Yo9oF3DZPO9hXuKKR6r0V+g=";
+  vendorHash = "sha256-Fw03Lf8F7fFpoHwG+/3dkFUIrY9eyd7rgvgXflaMLKw=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/by-name/sm/smug/package.nix b/pkgs/by-name/sm/smug/package.nix
index 0471a6ce3fd6..be076f6bfef1 100644
--- a/pkgs/by-name/sm/smug/package.nix
+++ b/pkgs/by-name/sm/smug/package.nix
@@ -7,15 +7,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "smug";
-  version = "0.3.13";
+  version = "0.3.14";
 
   subPackages = [ "." ];
 
   src = fetchFromGitHub {
     owner = "ivaaaan";
     repo = "smug";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-dvgbE1iKPDp8KuOuKJt5ITNDctt5Ej759qdcAIJcBkA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5MvDhG7cTbapF1mwEpuvEFvSpduwFnvv7seTh7Va5Yw=";
   };
 
   vendorHash = "sha256-N6btfKjhJ0MkXAL4enyNfnJk8vUeUDCRus5Fb7hNtug=";
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index a82cf9dbe2d4..9d7faf42d3f6 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "squawk";
-  version = "2.37.0";
+  version = "2.39.0";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = "squawk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+7cIymENIjF2fVD+qAblY4+dkENYiaTnDhCc/VuuAIk=";
+    hash = "sha256-Rox7WJG2vYL9xteZpzJvWuJNgDe6BLGaGOPvu4yavBo=";
   };
 
-  cargoHash = "sha256-2CJkwkC8/BgaYi994WoLtsykdTH5ZAyH0CpbvDTZ1GA=";
+  cargoHash = "sha256-Eqy1yQ1NU3fdyRr9qDFbE87cX0s3ijMF0ZbXKHAEEM8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/steel/package.nix b/pkgs/by-name/st/steel/package.nix
index 2184c58b3210..9d9a4172dc69 100644
--- a/pkgs/by-name/st/steel/package.nix
+++ b/pkgs/by-name/st/steel/package.nix
@@ -19,16 +19,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "steel";
-  version = "0-unstable-2026-01-28";
+  version = "0-unstable-2026-02-05";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "steel";
-    rev = "b77360e462bd43992a497ab93ee081455cd61fd9";
-    hash = "sha256-6d9bWAGECaYZz+idOzsDxq1DsPnKQ/UwlQS72sfXgpY=";
+    rev = "6a4300bdd7b4001358606a3638b7bc0759fe6b00";
+    hash = "sha256-eHKb/0rJ8yRnSeOJcmhJp+x02tOM94duJlRBLvn+p0c=";
   };
 
-  cargoHash = "sha256-1YUbAHefisaCOD1y0qITzAyk0PmEwb3ad+ZJUSmzcUs=";
+  cargoHash = "sha256-wt+Zy5j/zDuYxuLpsTTajclYs12RJTvjFA0csjaMeds=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
new file mode 100644
index 000000000000..8c3a41d32181
--- /dev/null
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -0,0 +1,115 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  nix-update-script,
+  python3Packages,
+}:
+python3Packages.buildPythonApplication {
+  pname = "tabbyapi";
+  version = "0-unstable-2026-01-20";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "theroyallab";
+    repo = "tabbyAPI";
+    rev = "54e3ea1fb30c48217f82dcb4ab1359f4784da4c8";
+    hash = "sha256-cwxpW4s8LKxS+2A2Grfhx8XaxbfT8U1LG59yhbu1lD8=";
+  };
+
+  build-system = with python3Packages; [
+    packaging
+    setuptools
+    wheel
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pydantic"
+  ];
+
+  dependencies =
+    with python3Packages;
+    [
+      fastapi # fastapi-slim
+      pydantic
+      ruamel-yaml
+      rich
+      uvicorn
+      jinja2
+      loguru
+      sse-starlette
+      packaging
+      tokenizers
+      formatron
+      kbnf
+      aiofiles
+      aiohttp
+      async-lru
+      huggingface-hub
+      psutil
+      httptools
+      pillow
+      numpy
+      setuptools
+
+      exllamav2
+      exllamav3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      uvloop
+    ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail 'fastapi-slim' 'fastapi'
+  '';
+
+  optional-dependencies = with python3Packages; {
+    amd = [
+      pytorch-triton-rocm
+      torch
+    ];
+    cu118 = [
+      torch
+    ];
+    cu121 = [
+      flash-attn
+      torch
+    ];
+    dev = [
+      ruff
+    ];
+    extras = [
+      infinity-emb
+      sentence-transformers
+    ];
+  };
+
+  postInstall = ''
+    cp *.py $out/${python3Packages.python.sitePackages}/
+    cp -r {common,endpoints,backends,templates} $out/${python3Packages.python.sitePackages}/
+  '';
+
+  postFixup = ''
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/tabbyapi \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --add-flags "$out/${python3Packages.python.sitePackages}/main.py"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Official API server for Exllama";
+    homepage = "https://github.com/theroyallab/tabbyAPI";
+    license = lib.licenses.agpl3Only;
+    platforms = [
+      "x86_64-windows"
+      "x86_64-linux"
+    ];
+    mainProgram = "tabbyapi";
+    maintainers = with lib.maintainers; [ BatteredBunny ];
+  };
+}
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 1a56818da207..216ea9e87055 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.26.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Com3Q6/xPM6fDW0rNP8QQpn8A/bUSC7cLs3xwRiTGDs=";
+    hash = "sha256-HyclcItaSsBhzyYM9sgloSG6TBWvsUkRs+oIPezvO0E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vg/vgmplay-libvgm/package.nix b/pkgs/by-name/vg/vgmplay-libvgm/package.nix
index 56579aeb4b6f..af26a0038758 100644
--- a/pkgs/by-name/vg/vgmplay-libvgm/package.nix
+++ b/pkgs/by-name/vg/vgmplay-libvgm/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation {
   pname = "vgmplay-libvgm";
-  version = "0.51.1-unstable-2025-12-31";
+  version = "0.52.0-unstable-2026-01-31";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "vgmplay-libvgm";
-    rev = "e8f07455854053cb676967112c3ddf414bb8c1ea";
-    hash = "sha256-YNaswHUFcTXncj+TKXQq5AhCLrM0SZ/EaO7hXb0OQLM=";
+    rev = "2a8f3909bcfca4c595ca71c0f762ff495a29e130";
+    hash = "sha256-TJUhE4te/nZOsckgMksWcqawsWR8r3OInJoVrv+NVAQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix
index 1d166b8de1f0..26088e2653c8 100644
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@@ -69,27 +69,36 @@
   nix-update-script,
 }:
 
+let
+  libcava =
+    let
+      version = "0.10.7-beta";
+    in
+    {
+      inherit version;
+
+      src = fetchFromGitHub {
+        owner = "LukashonakV";
+        repo = "cava";
+        tag = "v${version}";
+        hash = "sha256-IX1B375gTwVDRjpRfwKGuzTAZOV2pgDWzUd4bW2cTDU=";
+      };
+    };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "waybar";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
     tag = finalAttrs.version;
-    hash = "sha256-mGiBZjfvtZZkSHrha4UF2l1Ogbij8J//r2h4gcZAJ6w=";
-  };
-
-  libcavaSrc = fetchFromGitHub {
-    owner = "LukashonakV";
-    repo = "cava";
-    tag = "0.10.4";
-    hash = "sha256-9eTDqM+O1tA/3bEfd1apm8LbEcR9CVgELTIspSVPMKM=";
+    hash = "sha256-49ZKgK96a9uFip+svOdnw397xcEjiftXzd9gyv1H3sU=";
   };
 
   postUnpack = lib.optional cavaSupport ''
     pushd "$sourceRoot"
-    cp -R --no-preserve=mode,ownership ${finalAttrs.libcavaSrc} subprojects/cava-0.10.4
+    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-${libcava.version}
     patchShebangs .
     popd
   '';
diff --git a/pkgs/by-name/wg/wgo/package.nix b/pkgs/by-name/wg/wgo/package.nix
index f691b9cc4ee0..b0bc37aaf6b1 100644
--- a/pkgs/by-name/wg/wgo/package.nix
+++ b/pkgs/by-name/wg/wgo/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wgo";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "bokwoon95";
     repo = "wgo";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Z3adi1PQ5v0BxcjkOJZWeUxwLlLXpNuJxrQztV2pCiA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-J2mS2GIGlNHQVCIVpOMxZIZiqOFW0fu0M+qAbEuOuRo=";
   };
 
   vendorHash = "sha256-6ZJNXw/ahaIziQGVNgjbTbm53JiO3dYCqJtdB///cmo=";
diff --git a/pkgs/by-name/xf/xfd/package.nix b/pkgs/by-name/xf/xfd/package.nix
index 89457f93a8c7..4bc11cb2b2cb 100644
--- a/pkgs/by-name/xf/xfd/package.nix
+++ b/pkgs/by-name/xf/xfd/package.nix
@@ -18,7 +18,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xfd";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "app";
     repo = "xfd";
     tag = "xfd-${finalAttrs.version}";
-    hash = "sha256-8kkoJILNlVgDIV029mF3err6es5V001FQqUnTtD9/LQ=";
+    hash = "sha256-mdDnS6315po8/DafpGJDzGJTPV0HsRbSLlqSaN11d6o=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 8d7057b212e2..2e9dac81f8c2 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-od7RWHhyFQ7l3HZaqpOkUVtiWKDQj/tUsd5lGi6m34I=";
+    hash = "sha256-EEvy0UtmBlgC3b57SOwr7dI49R7PYeFqsZKyzo0zx9w=";
   };
 
-  cargoHash = "sha256-YW4Yi1gvMjTNAgsAlyX1KMlyQPHCXh/jAoO/Nkrn2Sc=";
+  cargoHash = "sha256-ihNFGlPhPLCIDvFnMqKA+flD/mv9wcKgQ1txO71xOp4=";
 
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index 5f4d907a5d8f..000182307ced 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ytdl-sub";
-  version = "2026.01.30";
+  version = "2026.02.04";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = finalAttrs.version;
-    hash = "sha256-NKK5GD5OsdSo3m//rkMtvrtiVCkCo0VOf1xWNBjFOh4=";
+    hash = "sha256-c6TQMWp7vlC5T5ZjS+uLVS2vfoSk1+g/4LS+bRYilSc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/ocaml-modules/coin/default.nix b/pkgs/development/ocaml-modules/coin/default.nix
index 50b309d26f0e..a952f45c5c10 100644
--- a/pkgs/development/ocaml-modules/coin/default.nix
+++ b/pkgs/development/ocaml-modules/coin/default.nix
@@ -1,30 +1,19 @@
 {
   buildDunePackage,
   fetchurl,
-  findlib,
   lib,
-  ocaml,
-  re,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "coin";
-  version = "0.1.4";
-  minimalOCamlVersion = "4.03";
+  version = "0.1.5";
+  minimalOCamlVersion = "4.06";
 
   src = fetchurl {
     url = "https://github.com/mirage/coin/releases/download/v${finalAttrs.version}/coin-${finalAttrs.version}.tbz";
-    sha256 = "sha256:0069qqswd1ik5ay3d5q1v1pz0ql31kblfsnv0ax0z8jwvacp3ack";
+    hash = "sha256-z2WzQ7zUFmZJTUqygTHguud6+NAcp36WubHbILXGR9g=";
   };
 
-  postPatch = ''
-    substituteInPlace src/dune --replace 'ocaml} ' \
-      'ocaml} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib '
-  '';
-
-  nativeBuildInputs = [ findlib ];
-  buildInputs = [ re ];
-
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/colombe/default.nix b/pkgs/development/ocaml-modules/colombe/default.nix
index d0ed2b870e54..8b67fc6e21d3 100644
--- a/pkgs/development/ocaml-modules/colombe/default.nix
+++ b/pkgs/development/ocaml-modules/colombe/default.nix
@@ -12,14 +12,14 @@
 
 let
   pname = "colombe";
-  version = "0.12.0";
+  version = "0.12.1";
 in
 buildDunePackage {
   inherit pname version;
   minimalOCamlVersion = "4.03";
   src = fetchurl {
     url = "https://github.com/mirage/colombe/releases/download/v${version}/colombe-${version}.tbz";
-    hash = "sha256-9g9l0wTzlXtESNeoBxhjMxlX0bRFY19T2+PN1lZ7ojE=";
+    hash = "sha256-6LHsxHUe5zGuNvgcIpJjg17gmx4QrKiO4UDIZcTB2CM=";
   };
   propagatedBuildInputs = [
     angstrom
diff --git a/pkgs/development/ocaml-modules/github/default.nix b/pkgs/development/ocaml-modules/github/default.nix
index 7c91f5a9dbcf..28a5de55978c 100644
--- a/pkgs/development/ocaml-modules/github/default.nix
+++ b/pkgs/development/ocaml-modules/github/default.nix
@@ -13,13 +13,13 @@
 
 buildDunePackage rec {
   pname = "github";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "mirage";
     repo = "ocaml-github";
     rev = version;
-    sha256 = "sha256-/IRoaGh4nYcdv4ir3LOS1d9UHLfWJ6DdPyFoFVCS+p4=";
+    sha256 = "sha256-nxHXOdZAvFe5/lKNw7tTJmY86xzfdFT+fW+lnKioyPM=";
   };
 
   duneVersion = "3";
diff --git a/pkgs/development/ocaml-modules/github/unix.nix b/pkgs/development/ocaml-modules/github/unix.nix
index 54e5dc5daa98..ae6bdb7967a8 100644
--- a/pkgs/development/ocaml-modules/github/unix.nix
+++ b/pkgs/development/ocaml-modules/github/unix.nix
@@ -13,16 +13,8 @@ buildDunePackage {
   pname = "github-unix";
   inherit (github) version src;
 
-  patches = [
-    # Compatibility with yojson 3.0
-    (fetchpatch {
-      url = "https://github.com/mirage/ocaml-github/commit/487d7d413363921a8ffbb941610c2f71c811add8.patch";
-      hash = "sha256-ThCsWRQKmlRg7rk8tlorsO87v8RWnBvocHDvgg/WWMA=";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace unix/dune --replace 'github bytes' 'github'
+    substituteInPlace unix/dune --replace-fail 'github bytes' 'github'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix
index 6b5751f22636..04bcf1aee022 100644
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@@ -12,13 +12,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "lambda-term";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchFromGitHub {
     owner = "ocaml-community";
     repo = "lambda-term";
     tag = finalAttrs.version;
-    hash = "sha256-T2DDpHqLar1sgmju0PLvhAZef5VzOpPWcFVhuZlPQmM=";
+    hash = "sha256-WAn3gTTHjfsEG5sLk3c1YHcyyzPUDzkcU+/fKBcGZFo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/lun/default.nix b/pkgs/development/ocaml-modules/lun/default.nix
index 5e1e32178f5e..4bf1820920b4 100644
--- a/pkgs/development/ocaml-modules/lun/default.nix
+++ b/pkgs/development/ocaml-modules/lun/default.nix
@@ -6,18 +6,18 @@
 
 buildDunePackage rec {
   pname = "lun";
-  version = "0.0.1";
+  version = "0.0.2";
 
   minimalOCamlVersion = "4.12.0";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/lun/releases/download/v${version}/lun-${version}.tbz";
-    hash = "sha256-zKi63/g7Rw/c+xhAEW+Oim8suGzeL0TtKM8my/aSp5M=";
+    hash = "sha256-1oqjTXY+/jJT1uQOV6iiK9qV9DAmERYsL2BtentmB8I=";
   };
 
   meta = {
     description = "Optics in OCaml";
-    homepage = "https://git.robur.coop/robur/lun";
+    homepage = "https://github.com/robur-coop/lun";
     license = lib.licenses.isc;
     maintainers = [ ];
   };
diff --git a/pkgs/development/ocaml-modules/lun/ppx.nix b/pkgs/development/ocaml-modules/lun/ppx.nix
index c54c07d8a63b..8c701e7042b9 100644
--- a/pkgs/development/ocaml-modules/lun/ppx.nix
+++ b/pkgs/development/ocaml-modules/lun/ppx.nix
@@ -22,6 +22,5 @@ buildDunePackage {
   meta = lun.meta // {
     description = "Optics with lun package and PPX";
     license = lib.licenses.mit;
-    broken = lib.versionAtLeast ppxlib.version "0.36";
   };
 }
diff --git a/pkgs/development/ocaml-modules/tezt/default.nix b/pkgs/development/ocaml-modules/tezt/default.nix
index db18468d2b81..665373b769c0 100644
--- a/pkgs/development/ocaml-modules/tezt/default.nix
+++ b/pkgs/development/ocaml-modules/tezt/default.nix
@@ -10,15 +10,15 @@
 
 buildDunePackage rec {
   pname = "tezt";
-  version = "4.2.0";
+  version = "4.3.0";
 
-  minimalOCamlVersion = "4.12";
+  minimalOCamlVersion = "4.13";
 
   src = fetchFromGitLab {
     owner = "nomadic-labs";
-    repo = pname;
-    rev = version;
-    hash = "sha256-8+q/A1JccH3CfWxfNhgJU5X+KEp+Uw7nvS72ZcPRsd8=";
+    repo = "tezt";
+    tag = version;
+    hash = "sha256-BF+hNqTm9r2S3jGjmjrw+/SHrr87WSe4YUjkc9WRgNo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/tsdl/default.nix b/pkgs/development/ocaml-modules/tsdl/default.nix
index b1de7d37ea6f..fcef54a3e94f 100644
--- a/pkgs/development/ocaml-modules/tsdl/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "tsdl";
-  version = "1.1.0";
+  version = "1.2.0";
   webpage = "https://erratique.ch/software/${pname}";
 in
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "${webpage}/releases/${pname}-${version}.tbz";
-    hash = "sha256-ZN4+trqesU1IREKcwm1Ro37jszKG8XcVigoE4BdGhzs=";
+    hash = "sha256-IhB/qCh6KVfTQNFoTdxmSRRd6uMq/9OpdGvx6uqliAY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/ocaml-modules/uuuu/default.nix b/pkgs/development/ocaml-modules/uuuu/default.nix
index 8965114543e7..5311e5731705 100644
--- a/pkgs/development/ocaml-modules/uuuu/default.nix
+++ b/pkgs/development/ocaml-modules/uuuu/default.nix
@@ -1,32 +1,18 @@
 {
-  angstrom,
   buildDunePackage,
   fetchurl,
-  findlib,
   lib,
-  ocaml,
-  re,
 }:
 
 buildDunePackage rec {
   pname = "uuuu";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/uuuu/releases/download/v${version}/uuuu-${version}.tbz";
-    sha256 = "sha256:19n39yc7spgzpk9i70r0nhkwsb0bfbvbgpf8d863p0a3wgryhzkb";
+    hash = "sha256-5+GNk9s36ZocrAjuvlDIiQTq6WF9q0M8j3h/TakrGSg=";
   };
 
-  postPatch = ''
-    substituteInPlace src/dune --replace 'ocaml} ' \
-      'ocaml} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib '
-  '';
-
-  nativeBuildInputs = [ findlib ];
-
-  buildInputs = [ angstrom ];
-
-  checkInputs = [ re ];
   doCheck = true;
 
   duneVersion = "3";
diff --git a/pkgs/development/php-packages/grumphp/default.nix b/pkgs/development/php-packages/grumphp/default.nix
index 9413e46f1f1b..558c064d2f1b 100644
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "grumphp";
-  version = "2.18.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JNpgIba+Y3qURegZFNeBKwigynSVzSfaAxM2RwcILMc=";
+    hash = "sha256-UkIIOr+FgOxBn7lK4VbEUG3AdvIG2Ij3YWr0mLzc+SM=";
   };
 
-  vendorHash = "sha256-Abi+NIXqD8HVTI1OVimeYmzybKXGGNA+l2MHUkx7CpQ=";
+  vendorHash = "sha256-DJJ3y1Rm9wFmrVz7H1M5fTxrMGiU12SXJydTqXcSZQA=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix
index 096746005ca5..2fbcfdb340c6 100644
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "3.5.0";
+  version = "3.5.1";
 in
 buildPecl {
   inherit version;
@@ -16,7 +16,7 @@ buildPecl {
     owner = "xdebug";
     repo = "xdebug";
     rev = version;
-    hash = "sha256-RrT79o0eFKwGFq3gIfBWCUy5gFy6odj2AWfsfcGN2R4=";
+    hash = "sha256-GOlWCKDLwptsHV9SvOOlR4uScvcw8V/DjwXIpfWjSkM=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/django-axes/default.nix b/pkgs/development/python-modules/django-axes/default.nix
index 05e498df22e6..c3684c35b08b 100644
--- a/pkgs/development/python-modules/django-axes/default.nix
+++ b/pkgs/development/python-modules/django-axes/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-axes";
-  version = "8.1.0";
+  version = "8.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-axes";
     tag = version;
-    hash = "sha256-yiXj0Wmn9AVKDilmGVTIE+MICmKeO76j2P6jtlt5CFY=";
+    hash = "sha256-obh137DbFkkSodR67hWRzQg8wHXsFdT3NDnxDg/jmR0=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 70bfb566f7ff..bc5acea0f5c4 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.8.0";
+  version = "7.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7ZM+vmI/9I1eaexVffl76BO5ctxKN51xoaOmP6lFYCU=";
+    hash = "sha256-JDt4lLocX+i1WAuY1SUqzmGX5Mt0CcktAsyuGSsTs6Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index eb0dfd430f97..2c1fbf47e988 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1146,7 +1146,7 @@
   };
 
   vim = {
-    version = "0-unstable-2023-05-05";
+    version = "0.2.0-unstable-2023-05-05";
     url = "github:vigoux/tree-sitter-viml/7c317fbade4b40baa7babcd6c9097c157d148e60";
     hash = "sha256-/TyPUBsKRcF9Ig8psqd4so2IMbHtTu4weJXgfd96Vrs=";
     meta = {
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index 0aef6baf61ae..565a760563b6 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -11,27 +11,19 @@
   libseccomp,
   nix-update-script,
   nixosTests,
-  fetchpatch,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scx_rustscheds";
-  version = "1.0.19";
+  version = "1.0.20";
 
   src = fetchFromGitHub {
     owner = "sched-ext";
     repo = "scx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bOldw2Sob5aANmVzw6VwCgJ4+VzEsohKUxOxntow7VY=";
+    hash = "sha256-MUWbNsxmbCRCOWB2dHpi5dEY2rNRrINxJSyl5SNSO9Y=";
   };
 
-  cargoHash = "sha256-ik05X+5jIdxtXYhN6fb1URW8TKKzgFuevi5+Wm2j15Y=";
-
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/sched-ext/scx/pull/3127.patch";
-      hash = "sha256-HpGJR3eBZKE+VsqGivjJp1n7JIORhZUxG87AsP1WWi0=";
-    })
-  ];
+  cargoHash = "sha256-H58wschck+l41fQh9W5SNVb5g9lAnw90SOSd/RtGXyw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch b/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch
index e7105017b7c8..8df587722b79 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch
+++ b/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch
@@ -1,22 +1,22 @@
-commit 4608dab78e6ac78be7ab625fb066861549daa37f
+commit 47cc80d3056f8a783ce1caabeb0a8b5379cba3d1
 Author: rnhmjoj <rnhmjoj@inventati.org>
-Date:   Wed Dec 31 01:43:26 2025 +0100
+Date:   Mon Feb 2 08:24:24 2026 +0100
 
     Fixes for running wpa_supplicant unprivileged
     
-    1. Change the dbus service user to "wpa_supplicant"
-    
-    2. Ensure appropriate group ownership and permissions on the client sockets.
+    1. Ensure appropriate group ownership and permissions on the client sockets.
        Motivation: clients communicate with the daemon by creating "client"
        sockets; by default this is owned by the user running the client,
        so it may be inaccessible by the daemon.
     
-    3. Move the "control" sockets under a subdirectory of /run/wpa_supplicant.
+    2. Move the "control" sockets under a subdirectory of /run/wpa_supplicant.
        Motivation: wpa_supplicant will try to adjust the ownership of the
        sockets directory, even if they are fine, and fail.
     
-    4. Move the "client" under a subdirectory of /run/wpa_supplicant instead
-       of tmp. Motivation: this allows to unshare /tmp
+    3. Move the "client" under a subdirectory of /run/wpa_supplicant instead
+       of tmp. Motivation: this allows to unshare /tmp.
+    
+    4. Extend the dbus policy to allow the wpa_supplicant user/group.
 
 diff --git a/src/common/wpa_ctrl.c b/src/common/wpa_ctrl.c
 index 7e197f094..6bfb09111 100644
@@ -47,38 +47,23 @@ index 7e197f094..6bfb09111 100644
  	/* Set group even if we do not have privileges to change owner */
  	lchown(ctrl->local.sun_path, -1, AID_WIFI);
 diff --git a/wpa_supplicant/dbus/dbus-wpa_supplicant.conf b/wpa_supplicant/dbus/dbus-wpa_supplicant.conf
-index e81b495f4..1ee5bc19a 100644
+index e81b495f4..c371dd11f 100644
 --- a/wpa_supplicant/dbus/dbus-wpa_supplicant.conf
 +++ b/wpa_supplicant/dbus/dbus-wpa_supplicant.conf
-@@ -2,9 +2,15 @@
-  "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
-  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+@@ -4,7 +4,12 @@
  <busconfig>
--        <policy user="root">
-+        <policy user="wpa_supplicant">
+         <policy user="root">
                  <allow own="fi.w1.wpa_supplicant1"/>
 -
-+        </policy>
-+        <policy user="root">
 +                <allow send_destination="fi.w1.wpa_supplicant1"/>
 +                <allow send_interface="fi.w1.wpa_supplicant1"/>
 +                <allow receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
 +        </policy>
 +        <policy group="wpa_supplicant">
++                <allow own="fi.w1.wpa_supplicant1"/>
                  <allow send_destination="fi.w1.wpa_supplicant1"/>
                  <allow send_interface="fi.w1.wpa_supplicant1"/>
                  <allow receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
-diff --git a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
-index d97ff3921..367a7c670 100644
---- a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
-+++ b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
-@@ -1,5 +1,5 @@
- [D-BUS Service]
- Name=fi.w1.wpa_supplicant1
- Exec=@BINDIR@/wpa_supplicant -u
--User=root
-+User=wpa_supplicant
- SystemdService=wpa_supplicant.service
 diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
 index 03180a316..f5e22dee1 100644
 --- a/wpa_supplicant/wpa_cli.c
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 4f314801a749..cfc08ba9847f 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -364,6 +364,7 @@ let
         ];
       sourceProvenance = listOf attrs;
       maintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
+      nonTeamMaintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
       teams = listOf (attrsOf any); # TODO similar to maintainers, use a teams type
       priority = int;
       pkgConfigModules = listOf str;
@@ -629,6 +630,10 @@ let
         attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ]
       );
 
+      # Needed for CI to be able to avoid requesting reviews from individual
+      # team members
+      nonTeamMaintainers = attrs.meta.maintainers or [ ];
+
       identifiers =
         let
           # nix-env writes a warning for each derivation that has null in its meta values, so
diff --git a/pkgs/tools/system/nvtop/build-nvtop.nix b/pkgs/tools/system/nvtop/build-nvtop.nix
index cde5f844929e..9a0673e4a71d 100644
--- a/pkgs/tools/system/nvtop/build-nvtop.nix
+++ b/pkgs/tools/system/nvtop/build-nvtop.nix
@@ -20,6 +20,9 @@
   ascend ? false,
   v3d ? false,
   tpu ? false,
+  rockchip ? false,
+  metax ? false,
+  enflame ? false,
 }:
 
 let
@@ -39,7 +42,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nvtop";
-  version = "3.2.0";
+  version = "3.3.1";
 
   # between generation of multiple update PRs for each package flavor and manual updates I choose manual updates
   # nixpkgs-update: no auto update
@@ -47,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Syllo";
     repo = "nvtop";
     rev = finalAttrs.version;
-    hash = "sha256-8iChT55L2NSnHg8tLIry0rgi/4966MffShE0ib+2ywc=";
+    hash = "sha256-+SvEp8pbauSLbDuPZqGMTyL2EZecz1VKCJgC+xjV/vQ=";
   };
 
   cmakeFlags = with lib.strings; [
@@ -63,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "ASCEND_SUPPORT" ascend)
     (cmakeBool "V3D_SUPPORT" v3d)
     (cmakeBool "TPU_SUPPORT" tpu) # requires libtpuinfo which is not packaged yet
+    (cmakeBool "ROCKCHIP_SUPPORT" rockchip)
+    (cmakeBool "METAX_SUPPORT" metax)
+    (cmakeBool "ENFLAME_SUPPORT" enflame)
   ];
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/tools/system/nvtop/default.nix b/pkgs/tools/system/nvtop/default.nix
index 767ae8206452..439c25c9d95e 100644
--- a/pkgs/tools/system/nvtop/default.nix
+++ b/pkgs/tools/system/nvtop/default.nix
@@ -11,6 +11,9 @@ let
     "panfrost"
     "panthor"
     "v3d"
+    "rockchip"
+    "metax"
+    "enflame"
   ];
   # these GPU families are partially supported upstream, they are also tricky to build in nixpkgs
   # volunteers with specific hardware needed to build and test these package variants