diff --git a/lib/cli.nix b/lib/cli.nix
index 4cf97ba7a25e..37f9e270a313 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -156,15 +156,18 @@
       );
 
   /**
-    Converts the given attributes into a single shell-escaped command-line string.
-    Similar to `toCommandLineGNU`, but returns a single escaped string instead of an array of arguments.
-    For further reference see: [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
+    Converts the given attributes into a single shell-escaped command-line
+    string.
+    Similar to `toCommandLineGNU`, but returns a single escaped string instead
+    of a list of arguments.
+    For further reference see:
+    [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
   */
   toCommandLineShellGNU =
     options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
 
   /**
-    Converts an attribute set into a list of GNU-style command line options.
+    Converts an attribute set into a list of GNU-style command-line arguments.
 
     `toCommandLineGNU` returns a list of string arguments.
 
@@ -238,31 +241,77 @@
     lib.cli.toCommandLine optionFormat;
 
   /**
-    Converts the given attributes into a single shell-escaped command-line string.
-    Similar to `toCommandLine`, but returns a single escaped string instead of an array of arguments.
-    For further reference see: [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
+    Converts the given attributes into a single shell-escaped command-line
+    string.
+    Similar to `toCommandLine`, but returns a single escaped string instead of
+    a list of arguments.
+    For further reference see:
+    [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
   */
   toCommandLineShell =
     optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
 
   /**
-    Converts an attribute set into a list of command line options.
+    Converts an attribute set into a list of command-line arguments.
 
-    `toCommandLine` returns a list of string arguments.
+    This is the most general command-line construction helper in `lib.cli`.
+    It is parameterized by an `optionFormat` function, which defines how each
+    option name and its value are rendered.
+
+    All other helpers in this file are thin wrappers around this function.
+
+    `toCommandLine` returns a *flat list of strings*, suitable for use as `argv`
+    arguments or for further processing (e.g. shell escaping).
 
     # Inputs
 
     `optionFormat`
 
-    : The option format that describes how options and their arguments should be formatted.
+    : A function that takes the option name and returns an option spec, where
+      the option spec is an attribute set describing how the option should be
+      rendered.
+
+      The returned attribute set must contain:
+
+      - `option` (string):
+        The option flag itself, e.g. `"-v"` or `"--verbose"`.
+
+      - `sep` (string or null):
+        How to separate the option from its argument.
+        If `null`, the option and its argument are returned as two separate
+        list elements.
+        If a string (e.g. `"="`), the option and argument are concatenated.
+
+      - `explicitBool` (bool):
+        Controls how boolean values are handled:
+        - `false`:
+          `true` emits only the option flag, `false` emits nothing.
+        - `true`:
+          both `true` and `false` are rendered as explicit arguments via
+          `formatArg`.
+
+      Optional fields:
+
+      - `formatArg`:
+        Converts the option value to a string.
+        Defaults to `lib.generators.mkValueStringDefault { }`.
 
     `attrs`
 
-    : The attributes to transform into arguments.
+    : An attribute set mapping option names to values.
+
+      Supported value types:
+      - null: omitted entirely
+      - bool: handled according to `explicitBool`
+      - list: each element is rendered as a separate occurrence of the option
+      - any other value: rendered as a single option argument
+
+      Empty attribute names are rejected.
 
     # Examples
+
     :::{.example}
-    ## `lib.cli.toCommandLine` usage example
+    ## `lib.cli.toCommandLine` basic usage example
 
     ```nix
     let
@@ -271,14 +320,26 @@
         sep = "=";
         explicitBool = true;
       };
-    in lib.cli.toCommandLine optionFormat {
+    in
+    lib.cli.toCommandLine optionFormat {
       v = true;
-      verbose = [true true false null];
+      verbose = [
+        true
+        true
+        false
+        null
+      ];
       i = ".bak";
-      testsuite = ["unit" "integration"];
-      e = ["s/a/b/" "s/b/c/"];
+      testsuite = [
+        "unit"
+        "integration"
+      ];
+      e = [
+        "s/a/b/"
+        "s/b/c/"
+      ];
       n = false;
-      data = builtins.toJSON {id = 0;};
+      data = builtins.toJSON { id = 0; };
     }
     => [
       "-data={\"id\":0}"
@@ -294,8 +355,70 @@
       "-verbose=false"
     ]
     ```
-
     :::
+
+    :::{.example}
+    ## `lib.cli.toCommandLine` usage with a more complex option format
+
+    ```nix
+    let
+      optionFormat =
+        optionName:
+        let
+          isLong = builtins.stringLength optionName > 1;
+        in
+        {
+          option = if isLong then "--${optionName}" else "-${optionName}";
+          sep = if isLong then "=" else null;
+          explicitBool = true;
+          formatArg =
+            value:
+            if builtins.isAttrs value then
+              builtins.toJSON value
+            else
+              lib.generators.mkValueStringDefault { } value;
+        };
+    in
+    lib.cli.toCommandLine optionFormat {
+      v = true;
+      verbose = [
+        true
+        true
+        false
+        null
+      ];
+      n = false;
+      output = "result.txt";
+      testsuite = [
+        "unit"
+        "integration"
+      ];
+      data = {
+        id = 0;
+        name = "test";
+      };
+    }
+    => [
+      "--data={\"id\":0,\"name\":\"test\"}"
+      "-n"
+      "false"
+      "--output=result.txt"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "true"
+      "--verbose=true"
+      "--verbose=true"
+      "--verbose=false"
+    ]
+    ```
+    :::
+
+    # See also
+
+    - `lib.cli.toCommandLineShell`
+    - `lib.cli.toCommandLineGNU`
+    - `lib.cli.toCommandLineShellGNU`
   */
   toCommandLine =
     optionFormat: attrs:
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index 7ff4df971915..d90c503eeab7 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -173,7 +173,7 @@ These instructions are also applicable to other versions.
 
 Major PostgreSQL upgrades require a downtime and a few imperative steps to be called. This is the case because
 each major version has some internal changes in the databases' state. Because of that,
-NixOS places the state into {file}`/var/lib/postgresql/<version>` where each `version`
+NixOS places the state into {file}`/var/lib/postgresql/$psqlSchema` where `$psqlSchema`
 can be obtained like this:
 ```
 $ nix-instantiate --eval -A postgresql_15.psqlSchema
diff --git a/nixos/modules/services/x11/desktop-managers/phosh.nix b/nixos/modules/services/x11/desktop-managers/phosh.nix
index 299aeaea6c14..3013cc8a79e0 100644
--- a/nixos/modules/services/x11/desktop-managers/phosh.nix
+++ b/nixos/modules/services/x11/desktop-managers/phosh.nix
@@ -7,25 +7,6 @@
 let
   cfg = config.services.xserver.desktopManager.phosh;
 
-  # Based on https://source.puri.sm/Librem5/librem5-base/-/blob/4596c1056dd75ac7f043aede07887990fd46f572/default/sm.puri.OSK0.desktop
-  oskItem = pkgs.makeDesktopItem {
-    name = "sm.puri.OSK0";
-    desktopName = "On-screen keyboard";
-    exec = "${pkgs.squeekboard}/bin/squeekboard";
-    categories = [
-      "GNOME"
-      "Core"
-    ];
-    onlyShowIn = [ "GNOME" ];
-    noDisplay = true;
-    extraConfig = {
-      X-GNOME-Autostart-Phase = "Panel";
-      X-GNOME-Provides = "inputmethod";
-      X-GNOME-Autostart-Notify = "true";
-      X-GNOME-AutoRestart = "true";
-    };
-  };
-
   phocConfigType = lib.types.submodule {
     options = {
       xwayland = lib.mkOption {
@@ -245,8 +226,7 @@ in
     environment.systemPackages = [
       pkgs.phoc
       cfg.package
-      pkgs.squeekboard
-      oskItem
+      pkgs.stevia
     ];
 
     systemd.packages = [ cfg.package ];
diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index ba2cf235620e..8a43134d20d7 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -20,6 +20,8 @@
   discount,
   json-glib,
   nix-update-script,
+  libsoup_3,
+  librsvg,
 }:
 
 stdenv.mkDerivation rec {
@@ -42,22 +44,32 @@ stdenv.mkDerivation rec {
     wrapGAppsHook3
   ];
 
-  buildInputs = [
-    gtk3
-    libgee
-    poppler
-    libpthreadstubs
-    gstreamer
-    gst-plugins-base
-    (gst-plugins-good.override { gtkSupport = true; })
-    gst-libav
-    qrencode
-    webkitgtk_4_1
-    discount
-    json-glib
-  ];
-
-  cmakeFlags = lib.optional stdenv.hostPlatform.isDarwin (lib.cmakeBool "MOVIES" false);
+  cmakeFlags = lib.optional stdenv.hostPlatform.isDarwin (lib.cmakeBool "MDVIEW" false);
+  buildInputs =
+    let
+      platformBuildInputs =
+        if stdenv.hostPlatform.isDarwin then
+          [ librsvg ]
+        else
+          [
+            libpthreadstubs
+            webkitgtk_4_1
+          ];
+    in
+    [
+      (gst-plugins-good.override { gtkSupport = true; })
+      discount
+      gst-libav
+      gst-plugins-base
+      gstreamer
+      gtk3
+      json-glib
+      libgee
+      libsoup_3
+      poppler
+      qrencode
+    ]
+    ++ platformBuildInputs;
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 55647b404ea8..c4ddc1f91ee5 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -296,6 +296,11 @@ rec {
       # Since we are running in a sandbox already, the difference between seccomp and none is minimal
       ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
       ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
+
+      # Wait until virtiofsd has created these sockets to avoid race condition.
+      until [[ -e virtio-store.sock ]]; do sleep 1; done
+      until [[ -e virtio-xchg.sock ]]; do sleep 1; done
+
       ${qemuCommand}
       EOF
 
diff --git a/pkgs/by-name/an/animeko/package.nix b/pkgs/by-name/an/animeko/package.nix
index 35a4d225876c..1d6e98bc0c2f 100644
--- a/pkgs/by-name/an/animeko/package.nix
+++ b/pkgs/by-name/an/animeko/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   gradle,
   autoPatchelfHook,
   jetbrains, # Requird by upstream due to JCEF dependency
@@ -97,6 +98,16 @@ let
     cmakeFlags = (old.cmakeFlags or [ ]) ++ [
       "-DCMAKE_POLICY_VERSION_MINIMUM=3.10"
     ];
+
+    patches = (old.patches or [ ]) ++ [
+      # Fix build with gcc15
+      # https://github.com/apache/thrift/pull/3078
+      (fetchpatch {
+        name = "thrift-add-missing-cstdint-include-gcc15.patch";
+        url = "https://github.com/apache/thrift/commit/947ad66940cfbadd9b24ba31d892dfc1142dd330.patch";
+        hash = "sha256-pWcG6/BepUwc/K6cBs+6d74AWIhZ2/wXvCunb/KyB0s=";
+      })
+    ];
   });
 
 in
diff --git a/pkgs/by-name/au/august/package.nix b/pkgs/by-name/au/august/package.nix
deleted file mode 100644
index 2305dfbd2279..000000000000
--- a/pkgs/by-name/au/august/package.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "august";
-  version = "0-unstable-2023-08-13";
-
-  src = fetchFromGitHub {
-    owner = "yoav-lavi";
-    repo = "august";
-    rev = "42b8a1bf5ca079aca1769d92315f70b193a9cd4a";
-    hash = "sha256-58DZMoRH9PBbM4sok/XbUcwSXBeqUAmFZpffdMKQ+dE=";
-  };
-
-  cargoHash = "sha256-E1M/Soaz4+Gyxizc4VReZlfJB5gxrSz2ue3WI9fcNJA=";
-
-  postInstall = ''
-    mv $out/bin/{august-cli,ag}
-  '';
-
-  meta = {
-    description = "Emmet-like language that produces JSON, TOML, or YAML";
-    homepage = "https://github.com/yoav-lavi/august";
-    license = with lib.licenses; [
-      asl20
-      mit
-    ];
-    maintainers = [ ];
-    mainProgram = "ag";
-  };
-}
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 74271245837b..a856cffb16ef 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cook-cli";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${version}";
-    hash = "sha256-yNUiwMzCAj5aXuQIzfzpy2GylhB37CuSmyHsyxcmKXM=";
+    hash = "sha256-CJDWhcnY/HjaJbBJCevH9ytp7oJ734M30DxJ/vCCO/I=";
   };
 
-  cargoHash = "sha256-Kq70YgTis5e8PcIAOgAqk/fi3HmE+lbpYjaV47axGX4=";
+  cargoHash = "sha256-rI/6niK/9QgRc4cWmDLPOc70PN1mRZLXdPym1R3d/Iw=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/cr/cryfs/package.nix b/pkgs/by-name/cr/cryfs/package.nix
index d6192f2a6661..82f03fef669f 100644
--- a/pkgs/by-name/cr/cryfs/package.nix
+++ b/pkgs/by-name/cr/cryfs/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryfs";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "cryfs";
     repo = "cryfs";
     rev = version;
-    hash = "sha256-WVHCZEUca/Snij1EO1etfyvF0UGGUXMQpI3fsQ0eNkA=";
+    hash = "sha256-bBe//AjA9QmdSDlb0xiOboE5F4g6LJ03cHQZpfOk+Y4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/default.nix b/pkgs/by-name/cu/curl-impersonate/chrome/default.nix
deleted file mode 100644
index 06807d44aba7..000000000000
--- a/pkgs/by-name/cu/curl-impersonate/chrome/default.nix
+++ /dev/null
@@ -1,205 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  callPackage,
-  buildGoModule,
-  installShellFiles,
-  buildPackages,
-  zlib,
-  zstd,
-  sqlite,
-  cmake,
-  python3,
-  ninja,
-  perl,
-  pkg-config,
-  autoconf,
-  automake,
-  libtool,
-  cctools,
-  cacert,
-  unzip,
-  go,
-  p11-kit,
-}:
-stdenv.mkDerivation rec {
-  pname = "curl-impersonate-chrome";
-  version = "1.2.0";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  src = fetchFromGitHub {
-    owner = "lexiforest";
-    repo = "curl-impersonate";
-    tag = "v${version}";
-    hash = "sha256-tAQdTRGAOD2rpLZvoLQ2YL0wrohXEcmChMZBvYjsMhE=";
-  };
-
-  # Disable blanket -Werror to fix build on `gcc-13` related to minor
-  # warnings on `boringssl`.
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  strictDeps = true;
-
-  depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    buildPackages.stdenv.cc
-  ];
-
-  nativeBuildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize'
-      cctools
-    ]
-    ++ [
-      installShellFiles
-      cmake
-      python3
-      python3.pythonOnBuildForHost.pkgs.gyp
-      ninja
-      perl
-      pkg-config
-      autoconf
-      automake
-      libtool
-      unzip
-      go
-    ];
-
-  buildInputs = [
-    zlib
-    zstd
-    sqlite
-  ];
-
-  configureFlags = [
-    "--with-ca-bundle=${
-      if stdenv.hostPlatform.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt"
-    }"
-    "--with-ca-path=${cacert}/etc/ssl/certs"
-  ];
-
-  buildFlags = [ "build" ];
-  checkTarget = "checkbuild";
-  installTargets = [ "install" ];
-
-  doCheck = true;
-
-  dontUseCmakeConfigure = true;
-  dontUseNinjaBuild = true;
-  dontUseNinjaInstall = true;
-  dontUseNinjaCheck = true;
-
-  postUnpack =
-    lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} ${src.name}/${name}") (
-        lib.filterAttrs (n: v: v ? outPath) passthru.deps
-      )
-    )
-    + ''
-
-      curltar=$(realpath -s ${src.name}/curl-*.tar.gz)
-
-      pushd "$(mktemp -d)"
-
-      tar -xf "$curltar"
-
-      pushd curl-curl-*/
-      patchShebangs scripts
-      popd
-
-      rm "$curltar"
-      tar -czf "$curltar" .
-
-      popd
-    '';
-
-  postPatch = ''
-    substituteInPlace Makefile.in \
-      --replace-fail "-lc++" "-lstdc++"
-  '';
-
-  preConfigure = ''
-    export GOCACHE=$TMPDIR/go-cache
-    export GOPATH=$TMPDIR/go
-    export GOPROXY=file://${passthru.boringssl-go-modules}
-    export GOSUMDB=off
-
-    # Need to get value of $out for this flag
-    configureFlagsArray+=("--with-libnssckbi=$out/lib")
-  '';
-
-  postInstall = ''
-    # Remove vestigial *-config script
-    rm $out/bin/curl-impersonate-config
-
-    # Patch all shebangs of installed scripts
-    patchShebangs $out/bin
-
-    # Install headers
-    make -C curl-*/include install
-  ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    # Patch completion names
-    substituteInPlace curl-*/scripts/Makefile \
-      --replace-fail "_curl" "_curl-impersonate" \
-      --replace-fail "curl.fish" "curl-impersonate.fish"
-
-    # Install completions
-    make -C curl-*/scripts install
-  '';
-
-  preFixup =
-    let
-      libext = stdenv.hostPlatform.extensions.sharedLibrary;
-    in
-    ''
-      # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure
-      if grep -F nssckbi $out/lib/libcurl-impersonate${libext} &>/dev/null; then
-        ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext}
-        ${lib.optionalString stdenv.hostPlatform.isElf ''
-          patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate${libext}
-        ''}
-      fi
-    '';
-
-  disallowedReferences = [ go ];
-
-  passthru = {
-    deps = callPackage ./deps.nix { };
-
-    updateScript = ./update.sh;
-
-    # Find the correct boringssl source file
-    boringssl-source = builtins.head (
-      lib.attrValues (lib.filterAttrs (name: _: lib.strings.hasPrefix "boringssl-" name) passthru.deps)
-    );
-    boringssl-go-modules =
-      (buildGoModule {
-        inherit (passthru.boringssl-source) name;
-
-        src = passthru.boringssl-source;
-        vendorHash = "sha256-HepiJhj7OsV7iQHlM2yi5BITyAM04QqWRX28Rj7sRKk=";
-
-        nativeBuildInputs = [ unzip ];
-
-        proxyVendor = true;
-      }).goModules;
-  };
-
-  meta = {
-    changelog = "https://github.com/lexiforest/curl-impersonate/releases/tag/${src.tag}";
-    description = "Special build of curl that can impersonate Chrome & Firefox";
-    homepage = "https://github.com/lexiforest/curl-impersonate";
-    license = with lib.licenses; [
-      curl
-      mit
-    ];
-    maintainers = with lib.maintainers; [ ggg ];
-    platforms = lib.platforms.unix;
-    mainProgram = "curl-impersonate";
-  };
-}
diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/deps.nix b/pkgs/by-name/cu/curl-impersonate/deps.nix
similarity index 100%
rename from pkgs/by-name/cu/curl-impersonate/chrome/deps.nix
rename to pkgs/by-name/cu/curl-impersonate/deps.nix
diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch b/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch
deleted file mode 100644
index 04ae8e93595f..000000000000
--- a/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Makefile.in b/Makefile.in
-index 877c54f..3e39ed1 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -209,6 +209,8 @@ $(NSS_VERSION).tar.gz:
- 
- $(nss_static_libs): $(NSS_VERSION).tar.gz
- 	tar xf $(NSS_VERSION).tar.gz
-+	sed -i -e "1s@#!/usr/bin/env bash@#!$$(type -p bash)@" $(NSS_VERSION)/nss/build.sh
-+	sed -i -e "s@/usr/bin/\(env \)\?grep@$$(type -p grep)@" $(NSS_VERSION)/nss/coreconf/config.gypi
- 
- ifeq ($(host),$(build))
- 	# Native build, use NSS' build script.
diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/default.nix b/pkgs/by-name/cu/curl-impersonate/firefox/default.nix
deleted file mode 100644
index afce85222f53..000000000000
--- a/pkgs/by-name/cu/curl-impersonate/firefox/default.nix
+++ /dev/null
@@ -1,197 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  callPackage,
-  buildGoModule,
-  installShellFiles,
-  buildPackages,
-  zlib,
-  sqlite,
-  cmake,
-  python3,
-  ninja,
-  perl,
-  autoconf,
-  automake,
-  libtool,
-  cctools,
-  cacert,
-  unzip,
-  go,
-  p11-kit,
-}:
-stdenv.mkDerivation rec {
-  pname = "curl-impersonate-ff";
-  version = "0.6.1";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  src = fetchFromGitHub {
-    owner = "lwthiker";
-    repo = "curl-impersonate";
-    rev = "v${version}";
-    hash = "sha256-ExmEhjJC8FPzx08RuKOhRxKgJ4Dh+ElEl+OUHzRCzZc=";
-  };
-
-  patches = [
-    # Fix shebangs and commands in the NSS build scripts
-    # (can't just patchShebangs or substituteInPlace since makefile unpacks it)
-    ./curl-impersonate-0.6.1-fix-command-paths.patch
-
-    # SOCKS5 heap buffer overflow - https://curl.se/docs/CVE-2023-38545.html
-    (fetchpatch {
-      name = "curl-impersonate-patch-cve-2023-38545.patch";
-      url = "https://github.com/lwthiker/curl-impersonate/commit/e7b90a0d9c61b6954aca27d346750240e8b6644e.diff";
-      hash = "sha256-jFrz4Q+MJGfNmwwzHhThado4c9hTd/+b/bfRsr3FW5k=";
-    })
-  ];
-
-  # Disable blanket -Werror to fix build on `gcc-13` related to minor
-  # warnings on `boringssl`.
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  strictDeps = true;
-
-  depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    buildPackages.stdenv.cc
-  ];
-
-  nativeBuildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize'
-      cctools
-    ]
-    ++ [
-      installShellFiles
-      cmake
-      python3
-      python3.pythonOnBuildForHost.pkgs.gyp
-      ninja
-      perl
-      autoconf
-      automake
-      libtool
-      unzip
-      go
-    ];
-
-  buildInputs = [
-    zlib
-    sqlite
-  ];
-
-  configureFlags = [
-    "--with-ca-bundle=${
-      if stdenv.hostPlatform.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt"
-    }"
-    "--with-ca-path=${cacert}/etc/ssl/certs"
-  ];
-
-  buildFlags = [ "firefox-build" ];
-  checkTarget = "firefox-checkbuild";
-  installTargets = [ "firefox-install" ];
-
-  doCheck = true;
-
-  dontUseCmakeConfigure = true;
-  dontUseNinjaBuild = true;
-  dontUseNinjaInstall = true;
-  dontUseNinjaCheck = true;
-
-  postUnpack = lib.concatStringsSep "\n" (
-    lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} ${src.name}/${name}") (
-      lib.filterAttrs (n: v: v ? outPath) passthru.deps
-    )
-  );
-
-  preConfigure = ''
-    export GOCACHE=$TMPDIR/go-cache
-    export GOPATH=$TMPDIR/go
-    export GOPROXY=file://${passthru.boringssl-go-modules}
-    export GOSUMDB=off
-
-    # Need to get value of $out for this flag
-    configureFlagsArray+=("--with-libnssckbi=$out/lib")
-  '';
-
-  postInstall = ''
-    # Remove vestigial *-config script
-    rm $out/bin/curl-impersonate-ff-config
-
-    # Patch all shebangs of installed scripts
-    patchShebangs $out/bin
-
-    # Install headers
-    make -C curl-*/include install
-  ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    # Build and install completions for each curl binary
-
-    # Patch in correct binary name and alias it to all scripts
-    perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-ff --shell zsh >$TMPDIR/curl-impersonate-ff.zsh
-    substituteInPlace $TMPDIR/curl-impersonate-ff.zsh \
-      --replace-fail \
-        '#compdef curl' \
-        "#compdef curl-impersonate-ff$(find $out/bin -name 'curl_*' -printf ' %f=curl-impersonate-ff')"
-
-    perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-ff --shell fish >$TMPDIR/curl-impersonate-ff.fish
-    substituteInPlace $TMPDIR/curl-impersonate-ff.fish \
-      --replace-fail \
-        '--command curl' \
-        "--command curl-impersonate-ff$(find $out/bin -name 'curl_*' -printf ' --command %f')"
-
-    # Install zsh and fish completions
-    installShellCompletion $TMPDIR/curl-impersonate-ff.{zsh,fish}
-  '';
-
-  preFixup =
-    let
-      libext = stdenv.hostPlatform.extensions.sharedLibrary;
-    in
-    ''
-      # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure
-      if grep -F nssckbi $out/lib/libcurl-impersonate-*${libext} &>/dev/null; then
-        ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext}
-        ${lib.optionalString stdenv.hostPlatform.isElf ''
-          patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate-*${libext}
-        ''}
-      fi
-    '';
-
-  disallowedReferences = [ go ];
-
-  passthru = {
-    deps = callPackage ./deps.nix { };
-
-    updateScript = ./update.sh;
-
-    boringssl-go-modules =
-      (buildGoModule {
-        inherit (passthru.deps."boringssl.zip") name;
-
-        src = passthru.deps."boringssl.zip";
-        vendorHash = "sha256-SNUsBiKOGWmkRdTVABVrlbLAVMfu0Q9IgDe+kFC5vXs=";
-
-        nativeBuildInputs = [ unzip ];
-
-        proxyVendor = true;
-      }).goModules;
-  };
-
-  meta = {
-    description = "Special build of curl that can impersonate Chrome & Firefox";
-    homepage = "https://github.com/lwthiker/curl-impersonate";
-    license = with lib.licenses; [
-      curl
-      mit
-    ];
-    maintainers = with lib.maintainers; [ deliciouslytyped ];
-    platforms = lib.platforms.unix;
-    mainProgram = "curl-impersonate-ff";
-  };
-}
diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix b/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix
deleted file mode 100644
index b8a70b935302..000000000000
--- a/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-# Generated by update.sh
-{ fetchurl }:
-{
-  "curl-8.1.1.tar.xz" = fetchurl {
-    url = "https://curl.se/download/curl-8.1.1.tar.xz";
-    hash = "sha256-CKlI4GGSlkVZfB73GU4HswiyIIT/A/p0ALRl5sBRSeU=";
-  };
-
-  "brotli-1.0.9.tar.gz" = fetchurl {
-    url = "https://github.com/google/brotli/archive/refs/tags/v1.0.9.tar.gz";
-    hash = "sha256-+ejYHQQFumbRgVKa9CozVPg4yTkJX/mZMNpqqc32/kY=";
-  };
-
-  "nss-3.92.tar.gz" = fetchurl {
-    url = "https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_92_RTM/src/nss-3.92-with-nspr-4.35.tar.gz";
-    hash = "sha256-IcF2v/+27IQLX5hcf48BRoL0ovtVsGkkc0Fy1cBIbcU=";
-  };
-
-  "boringssl.zip" = fetchurl {
-    url = "https://github.com/google/boringssl/archive/1b7fdbd9101dedc3e0aa3fcf4ff74eacddb34ecc.zip";
-    hash = "sha256-daVVQvpxkuEL/8/+QtLOJkdO+ECYZE3P4qJmDjV1GM0=";
-  };
-
-  "nghttp2-1.56.0.tar.bz2" = fetchurl {
-    url = "https://github.com/nghttp2/nghttp2/releases/download/v1.56.0/nghttp2-1.56.0.tar.bz2";
-    hash = "sha256-L13Nv1d6LfUTokZGRUhMw10uTQczZT1jGTrlHbQd70E=";
-  };
-}
diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/update.sh b/pkgs/by-name/cu/curl-impersonate/firefox/update.sh
deleted file mode 100644
index 3202ed1c9057..000000000000
--- a/pkgs/by-name/cu/curl-impersonate/firefox/update.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p git nix jq coreutils gnugrep gnused curl common-updater-scripts
-# shellcheck shell=bash
-set -euo pipefail
-
-nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
-
-stripwhitespace() {
-    sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'
-}
-
-narhash() {
-    nix --extra-experimental-features nix-command store prefetch-file --json "$1" | jq -r .hash
-}
-
-nixeval() {
-    nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1" | jq -r .
-}
-
-vendorhash() {
-    (nix --extra-experimental-features nix-command build --no-link -f "$nixpkgs" --no-link "$1" 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
-}
-
-findpath() {
-    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
-    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "fetchGit \"$nixpkgs\"")"
-
-    if [ -n "$outpath" ]; then
-        path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}"
-    fi
-
-    echo "$path"
-}
-
-getvar() {
-    echo "$2" | grep -F "$1" | sed -e 's/:=/:/g' | cut -d: -f2- | stripwhitespace
-}
-
-attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate}"
-version="$(curl -sSL "https://api.github.com/repos/lwthiker/curl-impersonate/releases/latest" | jq -r .tag_name | sed -e 's/^v//')"
-
-pkgpath="$(findpath "$attr")"
-
-updated="$(cd "$nixpkgs" && update-source-version "$attr" "$version" --file="$pkgpath" --print-changes | jq -r length)"
-
-if [ "$updated" -eq 0 ]; then
-    echo 'update.sh: Package version not updated, nothing to do.'
-    exit 0
-fi
-
-vars="$(curl -sSL "https://github.com/lwthiker/curl-impersonate/raw/v$version/Makefile.in" | grep '^ *[^ ]*_\(VERSION\|URL\|COMMIT\) *:=')"
-
-cat >"$(dirname "$pkgpath")"/deps.nix <<EOF
-# Generated by update.sh
-{ fetchurl }:
-
-{
-  "$(getvar CURL_VERSION "$vars").tar.xz" = fetchurl {
-    url = "https://curl.se/download/$(getvar CURL_VERSION "$vars").tar.xz";
-    hash = "$(narhash "https://curl.se/download/$(getvar CURL_VERSION "$vars").tar.xz")";
-  };
-
-  "brotli-$(getvar BROTLI_VERSION "$vars").tar.gz" = fetchurl {
-    url = "https://github.com/google/brotli/archive/refs/tags/v$(getvar BROTLI_VERSION "$vars").tar.gz";
-    hash = "$(narhash "https://github.com/google/brotli/archive/refs/tags/v$(getvar BROTLI_VERSION "$vars").tar.gz")";
-  };
-
-  "$(getvar NSS_VERSION "$vars").tar.gz" = fetchurl {
-    url = "$(getvar NSS_URL "$vars")";
-    hash = "$(narhash "$(getvar NSS_URL "$vars")")";
-  };
-
-  "boringssl.zip" = fetchurl {
-    url = "https://github.com/google/boringssl/archive/$(getvar BORING_SSL_COMMIT "$vars").zip";
-    hash = "$(narhash "https://github.com/google/boringssl/archive/$(getvar BORING_SSL_COMMIT "$vars").zip")";
-  };
-
-  "$(getvar NGHTTP2_VERSION "$vars").tar.bz2" = fetchurl {
-    url = "$(getvar NGHTTP2_URL "$vars")";
-    hash = "$(narhash "$(getvar NGHTTP2_URL "$vars")")";
-  };
-}
-EOF
-
-curhash="$(nixeval "$attr.curl-impersonate-chrome.boringssl-go-modules.outputHash")"
-newhash="$(vendorhash "$attr.curl-impersonate-chrome.boringssl-go-modules")"
-
-if [ -n "$newhash" ] && [ "$curhash" != "$newhash" ]; then
-    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
-else
-    echo 'update.sh: New vendorHash same as old vendorHash, nothing to do.'
-fi
diff --git a/pkgs/by-name/cu/curl-impersonate/package.nix b/pkgs/by-name/cu/curl-impersonate/package.nix
index d0c0dd1c3acd..7928c7a717a9 100644
--- a/pkgs/by-name/cu/curl-impersonate/package.nix
+++ b/pkgs/by-name/cu/curl-impersonate/package.nix
@@ -1,25 +1,210 @@
 {
-  symlinkJoin,
+  lib,
+  stdenv,
+  fetchFromGitHub,
   callPackage,
+  buildGoModule,
+  installShellFiles,
+  buildPackages,
+  zlib,
+  zstd,
+  sqlite,
+  cmake,
+  python3,
+  ninja,
+  perl,
+  pkg-config,
+  autoconf,
+  automake,
+  libtool,
+  cctools,
+  cacert,
+  unzip,
+  go,
+  p11-kit,
   nixosTests,
 }:
-symlinkJoin rec {
+stdenv.mkDerivation rec {
   pname = "curl-impersonate";
-  inherit (passthru.curl-impersonate-chrome) version meta;
+  version = "1.2.0";
 
-  name = "${pname}-${version}";
-
-  paths = [
-    passthru.curl-impersonate-ff
-    passthru.curl-impersonate-chrome
+  outputs = [
+    "out"
+    "dev"
   ];
 
-  passthru = {
-    curl-impersonate-ff = callPackage ./firefox { };
-    curl-impersonate-chrome = callPackage ./chrome { };
+  src = fetchFromGitHub {
+    owner = "lexiforest";
+    repo = "curl-impersonate";
+    tag = "v${version}";
+    hash = "sha256-tAQdTRGAOD2rpLZvoLQ2YL0wrohXEcmChMZBvYjsMhE=";
+  };
 
-    inherit (passthru.curl-impersonate-chrome) src;
+  # Disable blanket -Werror to fix build on `gcc-13` related to minor
+  # warnings on `boringssl`.
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  strictDeps = true;
+
+  depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    buildPackages.stdenv.cc
+  ];
+
+  nativeBuildInputs =
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize'
+      cctools
+    ]
+    ++ [
+      installShellFiles
+      cmake
+      python3
+      python3.pythonOnBuildForHost.pkgs.gyp
+      ninja
+      perl
+      pkg-config
+      autoconf
+      automake
+      libtool
+      unzip
+      go
+    ];
+
+  buildInputs = [
+    zlib
+    zstd
+    sqlite
+  ];
+
+  configureFlags = [
+    "--with-ca-bundle=${
+      if stdenv.hostPlatform.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt"
+    }"
+    "--with-ca-path=${cacert}/etc/ssl/certs"
+  ];
+
+  buildFlags = [ "build" ];
+  checkTarget = "checkbuild";
+  installTargets = [ "install" ];
+
+  doCheck = true;
+
+  dontUseCmakeConfigure = true;
+  dontUseNinjaBuild = true;
+  dontUseNinjaInstall = true;
+  dontUseNinjaCheck = true;
+
+  postUnpack =
+    lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} ${src.name}/${name}") (
+        lib.filterAttrs (n: v: v ? outPath) passthru.deps
+      )
+    )
+    + ''
+
+      curltar=$(realpath -s ${src.name}/curl-*.tar.gz)
+
+      pushd "$(mktemp -d)"
+
+      tar -xf "$curltar"
+
+      pushd curl-curl-*/
+      patchShebangs scripts
+      popd
+
+      rm "$curltar"
+      tar -czf "$curltar" .
+
+      popd
+    '';
+
+  postPatch = ''
+    substituteInPlace Makefile.in \
+      --replace-fail "-lc++" "-lstdc++"
+  '';
+
+  preConfigure = ''
+    export GOCACHE=$TMPDIR/go-cache
+    export GOPATH=$TMPDIR/go
+    export GOPROXY=file://${passthru.boringssl-go-modules}
+    export GOSUMDB=off
+
+    # Need to get value of $out for this flag
+    configureFlagsArray+=("--with-libnssckbi=$out/lib")
+  '';
+
+  postInstall = ''
+    # Remove vestigial *-config script
+    rm $out/bin/curl-impersonate-config
+
+    # Patch all shebangs of installed scripts
+    patchShebangs $out/bin
+
+    # Install headers
+    make -C curl-*/include install
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # Patch completion names
+    substituteInPlace curl-*/scripts/Makefile \
+      --replace-fail "_curl" "_curl-impersonate" \
+      --replace-fail "curl.fish" "curl-impersonate.fish"
+
+    # Install completions
+    make -C curl-*/scripts install
+  '';
+
+  preFixup =
+    let
+      libext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure
+      if grep -F nssckbi $out/lib/libcurl-impersonate${libext} &>/dev/null; then
+        ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext}
+        ${lib.optionalString stdenv.hostPlatform.isElf ''
+          patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate${libext}
+        ''}
+      fi
+    '';
+
+  disallowedReferences = [ go ];
+
+  passthru = {
+    deps = callPackage ./deps.nix { };
+
+    updateScript = ./update.sh;
+
+    # Find the correct boringssl source file
+    boringssl-source = builtins.head (
+      lib.attrValues (lib.filterAttrs (name: _: lib.strings.hasPrefix "boringssl-" name) passthru.deps)
+    );
+    boringssl-go-modules =
+      (buildGoModule {
+        inherit (passthru.boringssl-source) name;
+
+        src = passthru.boringssl-source;
+        vendorHash = "sha256-HepiJhj7OsV7iQHlM2yi5BITyAM04QqWRX28Rj7sRKk=";
+
+        nativeBuildInputs = [ unzip ];
+
+        proxyVendor = true;
+      }).goModules;
+
+    inherit src;
 
     tests = { inherit (nixosTests) curl-impersonate; };
   };
+
+  meta = {
+    changelog = "https://github.com/lexiforest/curl-impersonate/releases/tag/${src.tag}";
+    description = "Special build of curl that can impersonate Chrome & Firefox";
+    homepage = "https://github.com/lexiforest/curl-impersonate";
+    license = with lib.licenses; [
+      curl
+      mit
+    ];
+    maintainers = with lib.maintainers; [ ggg ];
+    platforms = lib.platforms.unix;
+    mainProgram = "curl-impersonate";
+  };
 }
diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/update.sh b/pkgs/by-name/cu/curl-impersonate/update.sh
similarity index 98%
rename from pkgs/by-name/cu/curl-impersonate/chrome/update.sh
rename to pkgs/by-name/cu/curl-impersonate/update.sh
index 429bc3700e11..0c0b9b2021b1 100755
--- a/pkgs/by-name/cu/curl-impersonate/chrome/update.sh
+++ b/pkgs/by-name/cu/curl-impersonate/update.sh
@@ -50,7 +50,7 @@ evalvar() {
     echo $out
 }
 
-attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate-chrome}"
+attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate}"
 version="$(curl -sSL "https://api.github.com/repos/lexiforest/curl-impersonate/releases/latest" | jq -r .tag_name | sed -e 's/^v//')"
 
 pkgpath="$(findpath "$attr")"
diff --git a/pkgs/by-name/ec/ecapture/package.nix b/pkgs/by-name/ec/ecapture/package.nix
index 72db8ed1f148..9000999343a2 100644
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@@ -24,13 +24,13 @@
 
 buildGoModule rec {
   pname = "ecapture";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "gojue";
     repo = "ecapture";
     tag = "v${version}";
-    hash = "sha256-ODs6xey90XVQ+cc5qNciWdETW1N5hDBTjxpANCHeWsg=";
+    hash = "sha256-GWz+zlaP+kNF0G3hZJ2GJXusihGgEpxVdOlgAiHIH4s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/fh/fh/package.nix b/pkgs/by-name/fh/fh/package.nix
index 9a5a993b6dd5..8483bcf437fb 100644
--- a/pkgs/by-name/fh/fh/package.nix
+++ b/pkgs/by-name/fh/fh/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fh";
-  version = "0.1.26";
+  version = "0.1.27";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "fh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cHXpTe5tAXrAwVu5+ZTb3pzHIqAk353GnNFPvComIfQ=";
+    hash = "sha256-EUCV7/J9wJRroCGW5JqonFJIqcvJEBAwB7l3eWYxiSk=";
   };
 
-  cargoHash = "sha256-HwFehxL01pwT93jjVvCU9BXhaHhCDbox50ecXpod3Mo=";
+  cargoHash = "sha256-HOQqUNd0I85lAD6YVWT9baEj31JpjIgq9Ujfn4ys/3o=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/fr/framework-tool-tui/package.nix b/pkgs/by-name/fr/framework-tool-tui/package.nix
index 07a6c9c2258c..ad2f3a107a51 100644
--- a/pkgs/by-name/fr/framework-tool-tui/package.nix
+++ b/pkgs/by-name/fr/framework-tool-tui/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "framework-tool-tui";
-  version = "0.5.8";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "grouzen";
     repo = "framework-tool-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6rphmprOTg+Zk3HbE6mdszmQsCQ8mUbs59rvLeKQkps=";
+    hash = "sha256-6JfxKoH6omqg46Y7zDIj4xQOzTGP36OW2nOS4fTsy7A=";
   };
 
-  cargoHash = "sha256-0/6b0C+uUNz03r5IEBvAGzagSyjzXFVbE74rgfGJoyM=";
+  cargoHash = "sha256-YsmGYsCLlucFq/Xg+VSrqh1tKev8T+xDEL8B2jUwH/A=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/go/go-musicfox/package.nix b/pkgs/by-name/go/go-musicfox/package.nix
index eceb2a61d268..5ebd5c6353b1 100644
--- a/pkgs/by-name/go/go-musicfox/package.nix
+++ b/pkgs/by-name/go/go-musicfox/package.nix
@@ -11,18 +11,18 @@
 
 buildGoModule rec {
   pname = "go-musicfox";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "go-musicfox";
     repo = "go-musicfox";
     rev = "v${version}";
-    hash = "sha256-jrrxG26OKOUiUzv12Td8Vy12gnj9+mHog/vZSaTwqmw=";
+    hash = "sha256-RJPb+aZawU22HBXTfr7+TP0ocFsNrP1mOHvHPRm2RnA=";
   };
 
   deleteVendor = true;
 
-  vendorHash = "sha256-TjPJBP1p2j9K10I87RB7KnwKfO3h2K6WFMZqveMUMkw=";
+  vendorHash = "sha256-KQp22eF48jhhCSZA/1weWVavyP3be4j4mOPM5EPssGs=";
 
   subPackages = [ "cmd/musicfox.go" ];
 
diff --git a/pkgs/by-name/he/helmsman/package.nix b/pkgs/by-name/he/helmsman/package.nix
index 5ebc69b14c4a..20a0795d7d9c 100644
--- a/pkgs/by-name/he/helmsman/package.nix
+++ b/pkgs/by-name/he/helmsman/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "helmsman";
-  version = "4.0.2";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "mkubaczyk";
     repo = "helmsman";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-URIJLt2LshtNwZ7xA/YAtYovL5FQJIIBs//P3JHSpA4=";
+    sha256 = "sha256-I2QBATunHjNwf4weHjYczpLNMX/8QsPe/ok0LTgZpmA=";
   };
 
   subPackages = [ "cmd/helmsman" ];
 
-  vendorHash = "sha256-ToSZQ5sv7z7O8tyDFmEY+KWzAAvv8MXvacoem5K+0Fg=";
+  vendorHash = "sha256-i3qZ0OSV40oB8X3seixXMeji6CpcSiNK5wTbxF+TFpI=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/is/ispc/package.nix b/pkgs/by-name/is/ispc/package.nix
index d4e1fa69c181..3ea8c890954e 100644
--- a/pkgs/by-name/is/ispc/package.nix
+++ b/pkgs/by-name/is/ispc/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ispc";
-  version = "1.29.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "ispc";
     repo = "ispc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VAg1rCMXGyCs497qB+gCHjcjwvqmFT6QMxdXgOzD1+E=";
+    hash = "sha256-4kYyUBGhTS9XurRjxXnEv12+UzZvSnu7DndhS5AhwQo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ki/kiro/package.nix b/pkgs/by-name/ki/kiro/package.nix
index 5a0ae78c2e51..6873b09b8d85 100644
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -15,7 +15,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = extraCommandLineArgs;
 
-  version = "0.7.21";
+  version = "0.8.0";
   pname = "kiro";
 
   # You can find the current VSCode version in the About dialog:
diff --git a/pkgs/by-name/ki/kiro/sources.json b/pkgs/by-name/ki/kiro/sources.json
index ac91bc6ab4df..e55bff8cb668 100644
--- a/pkgs/by-name/ki/kiro/sources.json
+++ b/pkgs/by-name/ki/kiro/sources.json
@@ -1,14 +1,14 @@
 {
   "x86_64-linux": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.7.21/tar/kiro-ide-0.7.21-stable-linux-x64.tar.gz",
-    "hash": "sha256-mCNcuGutI7i8oENKjpYTHXndFH6g9bWI5ZgrgEHqK44="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.8.0/tar/kiro-ide-0.8.0-stable-linux-x64.tar.gz",
+    "hash": "sha256-4sEy0cnn0cALGX7zBgGg0SUakh5CIscgSE98lrbPKGM="
   },
   "x86_64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.7.21/kiro-ide-0.7.21-stable-darwin-x64.dmg",
-    "hash": "sha256-uqO4MU5lzyNRPkFZxk2NeTrs9eyTWi2b8qpcf4/ZFds="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.8.0/kiro-ide-0.8.0-stable-darwin-x64.dmg",
+    "hash": "sha256-cAs91Mq8HSdAuAi9KeUFddbyE824iFWFbVkuRiyNBbc="
   },
   "aarch64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.7.21/kiro-ide-0.7.21-stable-darwin-arm64.dmg",
-    "hash": "sha256-3OhxVIBlgrS6y0xq4yU5VFCCgJXOT6is8gq+0D7dTME="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.8.0/kiro-ide-0.8.0-stable-darwin-arm64.dmg",
+    "hash": "sha256-+wyZ3ar3Kp41xREMQsdd06nqr9+ep5i/g/xWbAytDOE="
   }
 }
diff --git a/pkgs/by-name/li/libre/package.nix b/pkgs/by-name/li/libre/package.nix
index 0580ac1d18bd..81af959b57df 100644
--- a/pkgs/by-name/li/libre/package.nix
+++ b/pkgs/by-name/li/libre/package.nix
@@ -8,13 +8,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.3.0";
+  version = "4.4.0";
   pname = "libre";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "re";
     rev = "v${version}";
-    sha256 = "sha256-IOC6TRgxScLBCarECuUAfRoRweh5Q22JKsOUu9l7zWI=";
+    sha256 = "sha256-z/rDpjq483f3xFxZmf6neIQTls0xhn70JrWMlQatasw=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ma/mangowc/package.nix b/pkgs/by-name/ma/mangowc/package.nix
index 66da3212cad5..88e87d30d75e 100644
--- a/pkgs/by-name/ma/mangowc/package.nix
+++ b/pkgs/by-name/ma/mangowc/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangowc";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "DreamMaoMao";
     repo = "mangowc";
     tag = finalAttrs.version;
-    hash = "sha256-WYDatin9vLiFWr7PU2n4JxoXEzyX/Wdu7w5RRFTnkoA=";
+    hash = "sha256-Vszn4Zp0pojvvKkyP7M7V5iqNRB0kUvwd9iez+KzOyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/minder/package.nix b/pkgs/by-name/mi/minder/package.nix
index f1a0a843ef46..fb1a18f5551b 100644
--- a/pkgs/by-name/mi/minder/package.nix
+++ b/pkgs/by-name/mi/minder/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = "minder";
     tag = version;
-    hash = "sha256-+aAzM+OOOLwF4PJotdYSfFJu8gYp3I2E2r9fNTjJOs4=";
+    hash = "sha256-gqTVRICPI6XlJmrBT6b5cONmBQ9LhsEuHUf/19NmXPo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/networkmanager-iodine/package.nix b/pkgs/by-name/ne/networkmanager-iodine/package.nix
index a4cd0d76a2b0..0dafad3b66af 100644
--- a/pkgs/by-name/ne/networkmanager-iodine/package.nix
+++ b/pkgs/by-name/ne/networkmanager-iodine/package.nix
@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation {
   pname = "NetworkManager-iodine${lib.optionalString withGnome "-gnome"}";
-  version = "1.2.0-unstable-2025-10-11";
+  version = "1.2.0-unstable-2025-12-22";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "network-manager-iodine";
-    rev = "ad266003aa74ddba1d22259b213a7f9c996e1cd4";
-    sha256 = "OoJRkU4POW9RajwW05xYPlkodXqytq89GTbJuoLxebY=";
+    rev = "c329a1fc2be59a6094ef7f7b1fe5fd92f73947a4";
+    sha256 = "mE7Hzvh3mZKwcVPeVlB8jWcTRp3sDLe0zr0l6kaUEo8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pe/performous/package.nix b/pkgs/by-name/pe/performous/package.nix
index ef77e756f91b..9256a64c627a 100644
--- a/pkgs/by-name/pe/performous/package.nix
+++ b/pkgs/by-name/pe/performous/package.nix
@@ -7,7 +7,7 @@
   aubio,
   boost,
   cmake,
-  ffmpeg,
+  ffmpeg_7,
   fmt,
   gettext,
   glew,
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     SDL2
     aubio
     boost
-    ffmpeg
+    ffmpeg_7
     fmt
     glew
     glibmm
diff --git a/pkgs/by-name/py/pytr/package.nix b/pkgs/by-name/py/pytr/package.nix
index f909e3d0563d..d79ac9089f77 100644
--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pytr";
-  version = "0.4.4";
+  version = "0.4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytr-org";
     repo = "pytr";
     tag = "v${version}";
-    hash = "sha256-MWT0BrtzY7+/VXGT73Zmvlg761ppckYNb+w/rKnOyyI=";
+    hash = "sha256-VfNoovNGvu1tNbYYiIX8KTOfll0WrHxJsLk/Yoyhu6s=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/re/redis/package.nix b/pkgs/by-name/re/redis/package.nix
index a84bce1e2a02..b4a0ab80ef87 100644
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "8.2.2";
+  version = "8.2.3";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis";
     tag = finalAttrs.version;
-    hash = "sha256-0TMUSNCrDEtOkojcmFFhmLQ0ghyLAn+OS4xl4Sbr76c=";
+    hash = "sha256-PsTAo92Vz+LNxOsbI9VVnx+rHFm67a3bBMeDcLdhXFA=";
   };
 
   patches = lib.optional useSystemJemalloc (fetchpatch2 {
diff --git a/pkgs/by-name/sh/shogihome/package.nix b/pkgs/by-name/sh/shogihome/package.nix
index 71e9ce12297d..dc8a376698d7 100644
--- a/pkgs/by-name/sh/shogihome/package.nix
+++ b/pkgs/by-name/sh/shogihome/package.nix
@@ -4,7 +4,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   makeWrapper,
-  electron_37,
+  electron_39,
   vulkan-loader,
   makeDesktopItem,
   copyDesktopItems,
@@ -18,20 +18,20 @@
 }:
 
 let
-  electron = electron_37;
+  electron = electron_39;
 in
 buildNpmPackage (finalAttrs: {
   pname = "shogihome";
-  version = "1.25.1";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "sunfish-shogi";
     repo = "shogihome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CRPZmycYaKtqjjiISKVGLf2jUvM6Xk6cUryKZcFX3tc=";
+    hash = "sha256-Mq5fmxecPqb0YH4vgzAKiZ+5f77acQRoodJaqJqjjQI=";
   };
 
-  npmDepsHash = "sha256-8v6r3DAUzNeMQqLl99mp5rUytbUe7wFj3jkHb6lbwFI=";
+  npmDepsHash = "sha256-iFAIwvM0SjZiLfY0Ejdk1TlKEJDh/bx3fdzkzNBOkkE=";
 
   postPatch = ''
     substituteInPlace package.json \
@@ -39,11 +39,12 @@ buildNpmPackage (finalAttrs: {
       --replace-fail 'npm run install:electron && ' ""
 
     substituteInPlace .electron-builder.config.mjs \
-      --replace-fail 'AppImage' 'dir'
+      --replace-fail 'AppImage' 'dir' \
+      --replace-fail 'await signMacApp' '// await signMacApp'
   ''
   # Workaround for https://github.com/electron/electron/issues/31121
   + lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace src/background/window/path.ts \
+    substituteInPlace src/background/proc/env.ts \
       --replace-fail 'process.resourcesPath' "'$out/share/lib/shogihome/resources'"
   '';
 
diff --git a/pkgs/by-name/st/stevia/package.nix b/pkgs/by-name/st/stevia/package.nix
new file mode 100644
index 000000000000..1cd8ace2671c
--- /dev/null
+++ b/pkgs/by-name/st/stevia/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  wayland-scanner,
+  wrapGAppsHook3,
+  appstream,
+  cmake,
+  feedbackd,
+  fzf,
+  glib,
+  gmobile,
+  gnome-desktop,
+  gtk3,
+  hunspell,
+  json-glib,
+  libhandy,
+  libxkbcommon,
+  systemd,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "stevia";
+  version = "0.51.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World/Phosh";
+    repo = "stevia";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dRygDUHXpXjEuwNNfgVy742jfIhT9erN7IcmaMImuYw=";
+  };
+
+  mesonFlags = [
+    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
+    "-Dsystemd_user_unit_dir=${placeholder "out"}/lib/systemd/user"
+  ];
+
+  postPatch = ''
+    patchShebangs --build tools/write-layout-info.py
+  '';
+
+  nativeBuildInputs = [
+    meson
+    cmake
+    ninja
+    pkg-config
+    python3
+    wayland-scanner
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    appstream
+    feedbackd
+    fzf
+    glib.dev
+    gmobile
+    gnome-desktop
+    gtk3
+    hunspell
+    json-glib
+    libhandy
+    libxkbcommon
+    systemd
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "User friendly on screen keyboard for Phosh";
+    homepage = "https://gitlab.gnome.org/World/Phosh/stevia";
+    changelog = "https://gitlab.gnome.org/World/Phosh/stevia/-/releases/v${finalAttrs.version}";
+    license = with lib.licenses; [ gpl3Plus ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      ungeskriptet
+      armelclo
+    ];
+    mainProgram = "phosh-osk-stevia";
+  };
+})
diff --git a/pkgs/by-name/sv/svox/fix-compilation-darwin.patch b/pkgs/by-name/sv/svox/fix-compilation-darwin.patch
new file mode 100644
index 000000000000..84f1aa3e7e65
--- /dev/null
+++ b/pkgs/by-name/sv/svox/fix-compilation-darwin.patch
@@ -0,0 +1,15 @@
+diff --git a/pico/lib/picopltf.h b/pico/lib/picopltf.h
+index 9b7cffd..f0f129b 100644
+--- a/pico/lib/picopltf.h
++++ b/pico/lib/picopltf.h
+@@ -70,6 +70,10 @@
+ #define __BYTE_ORDER _BYTE_ORDER
+ #define __BIG_ENDIAN _BIG_ENDIAN
+ #include <sys/endian.h>
++#elif (PICO_PLATFORM == PICO_MacOSX)
++#define __BYTE_ORDER BYTE_ORDER
++#define __BIG_ENDIAN BIG_ENDIAN
++#include <machine/endian.h>
+ #else
+ #include <endian.h>
+ #endif
diff --git a/pkgs/by-name/sv/svox/package.nix b/pkgs/by-name/sv/svox/package.nix
index dcd3e554d653..6c329a30c110 100644
--- a/pkgs/by-name/sv/svox/package.nix
+++ b/pkgs/by-name/sv/svox/package.nix
@@ -8,16 +8,21 @@
 
 stdenv.mkDerivation {
   pname = "svox";
-  version = "2018-02-14";
+  version = "0-unstable-2021-05-06";
 
   # basically took the source code from android and borrowed autotool patches from debian
   src = fetchFromGitHub {
     owner = "naggety";
     repo = "picotts";
-    rev = "e3ba46009ee868911fa0b53db672a55f9cc13b1c";
-    sha256 = "0k3m7vh1ak9gmxd83x29cvhzfkybgz5hnlhd9xj19l1bjyx84s8v";
+    rev = "21089d223e177ba3cb7e385db8613a093dff74b5";
+    hash = "sha256-NmmYa3mVUSMsLC1blFAET3zLY66anGY2ff6ZQ424h1s=";
   };
 
+  patches = [
+    # upstream PR: https://github.com/ihuguet/picotts/pull/14
+    ./fix-compilation-darwin.patch
+  ];
+
   postPatch = ''
     cd pico
   '';
@@ -29,7 +34,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Text-to-speech engine";
     homepage = "https://android.googlesource.com/platform/external/svox";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "pico2wave";
diff --git a/pkgs/by-name/ur/uriparser/package.nix b/pkgs/by-name/ur/uriparser/package.nix
index fcc368f0a788..040a551f1b5f 100644
--- a/pkgs/by-name/ur/uriparser/package.nix
+++ b/pkgs/by-name/ur/uriparser/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uriparser";
-  version = "0.9.9";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "uriparser";
     repo = "uriparser";
     tag = "uriparser-${finalAttrs.version}";
-    hash = "sha256-fICEX/Hf6Shzwt1mY0SOwaYceXWf203yjUWXq874p7E=";
+    hash = "sha256-k4hRy4kfsaxUNIITPNxzqVgl+AwiR1NpKcE9DtAbwxc=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -24,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "URIPARSER_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
+  doCheck = true;
+
   nativeCheckInputs = [ gtest ];
 
   meta = {
diff --git a/pkgs/by-name/vi/video-downloader/package.nix b/pkgs/by-name/vi/video-downloader/package.nix
index 5a0492537886..d818fbd6b22c 100644
--- a/pkgs/by-name/vi/video-downloader/package.nix
+++ b/pkgs/by-name/vi/video-downloader/package.nix
@@ -18,14 +18,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "video-downloader";
-  version = "0.12.28";
+  version = "0.12.30";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Unrud";
     repo = "video-downloader";
     tag = "v${version}";
-    hash = "sha256-8BEKlg0k4vqgnbG737waKcEqWAnxeL+Vr6bD/1zFVdg=";
+    hash = "sha256-OQJq+3HR0BwuhQbh2HSH6DS3Mu84/FXqdXjQ8tdDEEM=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/development/compilers/idris2/pack.nix b/pkgs/development/compilers/idris2/pack.nix
index ed89dd30d7a3..5289b6a817e7 100644
--- a/pkgs/development/compilers/idris2/pack.nix
+++ b/pkgs/development/compilers/idris2/pack.nix
@@ -169,12 +169,12 @@ let
 
   packPkg = buildIdris {
     ipkgName = "pack";
-    version = "2025-11-06";
+    version = "2025-12-27";
     src = fetchFromGitHub {
       owner = "stefan-hoeck";
       repo = "idris2-pack";
-      rev = "37787fa16550ef761d3242bf8ccb8ab672d9f2d1";
-      hash = "sha256-pvunaZSXj5Ee0utBFZfagxRKFuoSBxeU0IN7VTc56rY=";
+      rev = "cd512a0bf61a6effacc24060bb04106a849df0fe";
+      hash = "sha256-309k3ALAnCno8C09Fy7zz/oiSCzKI2ZbH5WFn6QIwF0=";
     };
     idrisLibraries = [
       idris2Api
diff --git a/pkgs/development/libraries/libcryptui/debian-patches.nix b/pkgs/development/libraries/libcryptui/debian-patches.nix
new file mode 100644
index 000000000000..d9114aecc770
--- /dev/null
+++ b/pkgs/development/libraries/libcryptui/debian-patches.nix
@@ -0,0 +1,26 @@
+# Generated by debian-patches.sh from debian-patches.txt
+let
+  prefix = "https://sources.debian.org/data/main/libc/libcryptui/3.12.2-8/debian/patches";
+in
+[
+  {
+    url = "${prefix}/build-use-pkg-config-to-detect-gpgme.patch";
+    sha256 = "1kvp30qrnnhnjma8vgi3acvjn74fzig1mdmkxn6xbdz2vj12wwns";
+  }
+  {
+    url = "${prefix}/daemon-fix-conflicting-return-types.patch";
+    sha256 = "1iqr58v1rmykq2z48sniixfvq2v0qaifdfihkq6is2a711fkigxp";
+  }
+  {
+    url = "${prefix}/daemon-port-to-gcr-3.patch";
+    sha256 = "1j1nbh03m4cqymhqiamndn3gmi7bdzv0srr90nhlgjhszmyg150g";
+  }
+  {
+    url = "${prefix}/git_allow-gpg2-2.1.patch";
+    sha256 = "1g93psg0cki4wnyymc59wchzhas3qqja7y46rbzdksp5wmfl51ap";
+  }
+  {
+    url = "${prefix}/libcryptui-fix-logic-flaw-in-the-prompt-recipients-d.patch";
+    sha256 = "1qnd6j2zk8gssj2fgrgikc05ccdv7sqabprykzxix7v8827sa56j";
+  }
+]
diff --git a/pkgs/development/libraries/libcryptui/debian-patches.txt b/pkgs/development/libraries/libcryptui/debian-patches.txt
new file mode 100644
index 000000000000..575274ebf425
--- /dev/null
+++ b/pkgs/development/libraries/libcryptui/debian-patches.txt
@@ -0,0 +1,6 @@
+libcryptui/3.12.2-8
+build-use-pkg-config-to-detect-gpgme.patch
+daemon-fix-conflicting-return-types.patch
+daemon-port-to-gcr-3.patch
+git_allow-gpg2-2.1.patch
+libcryptui-fix-logic-flaw-in-the-prompt-recipients-d.patch
diff --git a/pkgs/development/libraries/libcryptui/default.nix b/pkgs/development/libraries/libcryptui/default.nix
index a32a03de103c..5a476aeba795 100644
--- a/pkgs/development/libraries/libcryptui/default.nix
+++ b/pkgs/development/libraries/libcryptui/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
   gettext,
   pkg-config,
@@ -13,7 +14,7 @@
   gnupg,
   gpgme,
   dbus-glib,
-  libgnome-keyring,
+  gcr,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,10 +26,12 @@ stdenv.mkDerivation rec {
     sha256 = "0rh8wa5k2iwbwppyvij2jdxmnlfjbna7kbh2a5n7zw4nnjkx3ski";
   };
 
-  patches = [
-    # based on https://gitlab.gnome.org/GNOME/libcryptui/-/commit/b05e301d1b264a5d8f07cb96e5edc243d99bff79.patch
-    # https://gitlab.gnome.org/GNOME/libcryptui/-/merge_requests/1
-    ./fix-latest-gnupg.patch
+  patches = (lib.map fetchurl (import ./debian-patches.nix)) ++ [
+    # Fix build with gpgme 2.0
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libcryptui/-/raw/1-3.12.2+r71+ged4f890e-2/gpgme-2.0.patch";
+      hash = "sha256-yftIixqVGUqn/VP0tfzPnhLPI7A/m61kVY5P1NDTIqQ=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -45,7 +48,7 @@ stdenv.mkDerivation rec {
     gnupg
     gpgme
     dbus-glib
-    libgnome-keyring
+    gcr
   ];
   propagatedBuildInputs = [ dbus-glib ];
 
diff --git a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
deleted file mode 100644
index 19aa27b549c2..000000000000
--- a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From b05e301d1b264a5d8f07cb96e5edc243d99bff79 Mon Sep 17 00:00:00 2001
-From: Antoine Jacoutot <ajacoutot@gnome.org>
-Date: Fri, 10 Nov 2017 08:55:55 +0100
-Subject: [PATCH] Accept GnuPG 2.2.x as supported version
-
-https://bugzilla.gnome.org/show_bug.cgi?id=790152
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 4486e7b2..be5b28b4 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -95,7 +95,7 @@ AC_ARG_ENABLE(gpg-check,
- 	DO_CHECK=$enableval, DO_CHECK=yes)
- 
- if test	"$DO_CHECK" = "yes"; then
--	accepted_versions="1.2 1.4 2.0"
-+	accepted_versions="1.2 1.4 2.0 2.2 2.3 2.4"
- 	AC_PATH_PROGS(GNUPG, [gpg gpg2], no)
- 	AC_DEFINE_UNQUOTED(GNUPG, "$GNUPG", [Path to gpg executable.])
- 	ok="no"
--- 
-GitLab
-
diff --git a/pkgs/development/python-modules/curl-cffi/default.nix b/pkgs/development/python-modules/curl-cffi/default.nix
index 05ee0ca89e60..223cfb0c1918 100644
--- a/pkgs/development/python-modules/curl-cffi/default.nix
+++ b/pkgs/development/python-modules/curl-cffi/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   setuptools,
   addBinToPathHook,
-  curl-impersonate-chrome,
+  curl-impersonate,
   cffi,
   certifi,
   charset-normalizer,
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   patches = [ ./use-system-libs.patch ];
 
-  buildInputs = [ curl-impersonate-chrome ];
+  buildInputs = [ curl-impersonate ];
 
   build-system = [
     cffi
diff --git a/pkgs/development/tools/language-servers/nixd/default.nix b/pkgs/development/tools/language-servers/nixd/default.nix
index 00b99efdf3c2..f1b9faef3ff9 100644
--- a/pkgs/development/tools/language-servers/nixd/default.nix
+++ b/pkgs/development/tools/language-servers/nixd/default.nix
@@ -7,6 +7,7 @@
   gtest,
   llvmPackages,
   meson,
+  mesonEmulatorHook,
   ninja,
   nixVersions,
   nix-update-script,
@@ -72,6 +73,10 @@ in
         "dev"
       ];
 
+      nativeBuildInputs =
+        common.nativeBuildInputs
+        ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
+
       buildInputs = [
         nixComponents.nix-expr
         gtest
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index de0d76316dc0..13968e41d98c 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2025-10-09";
+  version = "${kernel.version}-unstable-2025-12-15";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "3d1fcf4bc838542ceb03b0b4e9e40600720cf6ae";
-    hash = "sha256-N22f4TOPyGIROcmkiUtPgOASVEbbSqsyOKMZTQpqjLs=";
+    rev = "7f63a9da2e8ed83403f6f920e9b1628a37b38ef4";
+    hash = "sha256-RgGO6r2mx6MiDOWpPJIC0MvX7rejWu+TdHWtsW1PNOY=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index 5f4d61819834..f5bfc812df94 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.11";
+  version = "5.1.12";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-Nr8WnEm6z16NrXxuGEP4uQ6mxe8sUYtOxVgWMmFrWVE=";
+    hash = "sha256-Nrt49TltV3Us93MWUX4tBs0576jEC1kRX+T9IddVgZk=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 95632aef9c9f..f152e7fa10c5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -319,6 +319,7 @@ mapAliases {
   asterisk_18 = throw "asterisk_18: Asterisk 18 is end of life and has been removed"; # Added 2025-10-19
   atlassian-cli = appfire-cli; # Added 2025-09-29
   ats = throw "'ats' has been removed as it is unmaintained for 10 years and broken"; # Added 2025-05-17
+  august = throw "'august' has been removed, as it has been unmaintained since august 2023"; # Added 2025-12-25
   AusweisApp2 = throw "'AusweisApp2' has been renamed to/replaced by 'ausweisapp'"; # Converted to throw 2025-10-27
   autoconf213 = throw "'autoconf213' has been removed in favor of 'autoconf'"; # Added 2025-07-21
   autoconf264 = throw "'autoconf264' has been removed in favor of 'autoconf'"; # Added 2025-07-21
@@ -497,6 +498,8 @@ mapAliases {
   cudaPackages_12_4 = throw "CUDA 12.4 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cudaPackages_12_5 = throw "CUDA 12.5 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cups-kyodialog3 = throw "'cups-kyodialog3' has been renamed to/replaced by 'cups-kyodialog'"; # Converted to throw 2025-10-27
+  curl-impersonate-chrome = warnAlias "curl-impersonate-chrome has been renamed to curl-impersonate" curl-impersonate; # Added 2025-11-02
+  curl-impersonate-ff = throw "curl-impersonate-ff has been removed because it is unmaintained upstream and has vulnerable dependencies. Use curl-impersonate instead."; # Added 2025-11-02
   curlHTTP3 = warnAlias "'curlHTTP3' has been removed, as 'curl' now has HTTP/3 support enabled by default" curl; # Added 2025-08-22
   cyber = throw "cyber has been removed, as it does not build with supported Zig versions"; # Added 2025-08-09
   dale = throw "dale has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c86973d16bef..6d9e195c8f9c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2425,9 +2425,6 @@ with pkgs;
     ngtcp2 = ngtcp2-gnutls;
   };
 
-  curl-impersonate-ff = curl-impersonate.curl-impersonate-ff;
-  curl-impersonate-chrome = curl-impersonate.curl-impersonate-chrome;
-
   cve-bin-tool = python3Packages.callPackage ../tools/security/cve-bin-tool { };
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };