diff --git a/.github/actions/checkout/action.yml b/.github/actions/checkout/action.yml
index b70749564c01..128398e5e02f 100644
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -20,6 +20,7 @@ runs:
         PIN_BUMP_SHA: ${{ inputs.untrusted-pin-bump }}
       with:
         script: |
+          const { rm, writeFile } = require('node:fs/promises')
           const { spawn } = require('node:child_process')
           const { join } = require('node:path')
 
@@ -55,10 +56,19 @@ runs:
             return pinned.pins.nixpkgs.revision
           }
 
-          const pin_bump_sha = process.env.PIN_BUMP_SHA
+          // Getting the pin-bump diff via the API avoids issues with `git fetch`
+          // thin-packs not having enough base objects to be applied locally.
+          // Returns a unified diff suitable for `git apply`.
+          async function getPinBumpDiff(ref) {
+            const { data } = await github.rest.repos.getCommit({
+              mediaType: { format: 'diff' },
+              ...context.repo,
+              ref,
+            })
+            return data
+          }
 
-          // When dealing with a pin bump commit, we need `--depth=2` to view & apply its diff
-          const depth = pin_bump_sha ? 2 : 1
+          const pin_bump_sha = process.env.PIN_BUMP_SHA
 
           const commits = [
             {
@@ -76,17 +86,14 @@ runs:
             {
               sha: await getPinnedSha(process.env.TARGET_SHA),
               path: 'trusted-pinned'
-            },
-            {
-              sha: pin_bump_sha
             }
           ].filter(({ sha }) => Boolean(sha))
 
-          console.log('Fetching the following commits:', commits)
+          console.log('Checking out the following commits:', commits)
 
           // Fetching all commits at once is much faster than doing multiple checkouts.
           // This would fail without --refetch, because the we had a partial clone before, but changed it above.
-          await run('git', 'fetch', `--depth=${depth}`, '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
+          await run('git', 'fetch', '--depth=1', '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
 
           // Checking out onto tmpfs takes 1s and is faster by at least factor 10x.
           await run('mkdir', 'nixpkgs')
@@ -101,20 +108,21 @@ runs:
 
           // Create all worktrees in parallel.
           await Promise.all(
-            commits
-              .filter(({ path }) => Boolean(path))
-              .map(async ({ sha, path }) => {
-                await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
-                await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
-                await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
-              })
+            commits.map(async ({ sha, path }) => {
+              await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
+              await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
+              await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
+            })
           )
 
           // Apply pin bump to untrusted worktree
           if (pin_bump_sha) {
-            console.log('Applying untrusted ci/pinned.json bump:', pin_bump_sha)
+            console.log('Fetching ci/pinned.json bump commit:', pin_bump_sha)
+            await writeFile('pin-bump.patch', await getPinBumpDiff(pin_bump_sha))
+
+            console.log('Applying untrusted ci/pinned.json bump to ./nixpkgs/untrusted')
             try {
-              await run('git', '-C', join('nixpkgs', 'untrusted'), 'cherry-pick', '--no-commit', pin_bump_sha)
+              await run('git', '-C', join('nixpkgs', 'untrusted'), 'apply', '--3way', join('..', '..', 'pin-bump.patch'))
             } catch {
               core.setFailed([
                 `Failed to apply ci/pinned.json bump commit ${pin_bump_sha}.`,
@@ -122,5 +130,7 @@ runs:
                 `Please rebase the PR or ensure the pin bump is standalone.`
               ].join(' '))
               return
+            } finally {
+              await rm('pin-bump.patch')
             }
           }
diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml
index 1cb675a2a57b..6bdfd28328a3 100644
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@@ -26,7 +26,7 @@
   - all:
       - changed-files:
           - any-glob-to-any-file:
-              - .github/actions/*
+              - .github/actions/**/*
               - .github/workflows/*
               - .github/labeler*.yml
               - ci/**/*.*
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 413061ab2dfa..4459836b0219 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25070,6 +25070,12 @@
     github = "stasjok";
     githubId = 1353637;
   };
+  staslyakhov = {
+    name = "Stas Lyakhov";
+    email = "nix@lyakhovs.dev";
+    github = "staslyakhov";
+    githubId = 19846456;
+  };
   staticdev = {
     email = "staticdev-support@proton.me";
     github = "staticdev";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 561af4cee0d4..981be6b3fcbe 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -20,6 +20,8 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
+- [Tailscale Serve](https://tailscale.com/kb/1552/tailscale-services), configure Tailscale Serve for exposing local services to your tailnet. Available as [services.tailscale.serve](#opt-services.tailscale.serve.enable).
+
 - [qui](https://github.com/autobrr/qui), a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as [services.qui](#opt-services.qui.enable).
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index d0672c792bf8..571f723a823f 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -9,7 +9,7 @@ let
 
   makeColor = i: lib.concatMapStringsSep "," (x: "0x" + lib.substring (2 * i) 2 x);
 
-  isUnicode = lib.hasSuffix "UTF-8" (lib.toUpper config.i18n.defaultLocale);
+  isUnicode = config.i18n.defaultCharset == "UTF-8" || cfg.useXkbConfig;
 
   optimizedKeymap =
     pkgs.runCommand "keymap"
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1098685fc73f..69e3d66046d4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1391,6 +1391,7 @@
   ./services/networking/syncthing.nix
   ./services/networking/tailscale-auth.nix
   ./services/networking/tailscale-derper.nix
+  ./services/networking/tailscale-serve.nix
   ./services/networking/tailscale.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index f166fced35e1..001193a8cd2d 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -173,9 +173,9 @@ in
           # This is required for autorotation in Plasma 6
           qtsensors
         ]
-        ++ lib.optionals config.services.flatpak.enable [
+        ++ lib.optionals (config.services.flatpak.enable || config.services.fwupd.enable) [
           # Since PackageKit Nix support is not there yet,
-          # only install discover if flatpak is enabled.
+          # only install discover if flatpak or fwupd is enabled.
           discover
         ];
       in
diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index e44053344ac3..8b7cfce32514 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -171,7 +171,7 @@ in
           a writeable configuration, such as quota tracking, enable
           this option.
         '';
-        default = lib.versionOlder config.system.stateVersion "25.11";
+        default = lib.versionOlder config.system.stateVersion "26.05";
       };
 
       settings = mkOption {
diff --git a/nixos/modules/services/networking/tailscale-serve.nix b/nixos/modules/services/networking/tailscale-serve.nix
new file mode 100644
index 000000000000..87ee4026c1c4
--- /dev/null
+++ b/nixos/modules/services/networking/tailscale-serve.nix
@@ -0,0 +1,145 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.tailscale.serve;
+  settingsFormat = pkgs.formats.json { };
+
+  # Build the serve config structure with svc: prefix on service names
+  serveConfig = {
+    version = "0.0.1";
+    services = lib.mapAttrs' (
+      name: serviceCfg:
+      lib.nameValuePair "svc:${name}" (
+        {
+          endpoints = serviceCfg.endpoints;
+        }
+        // lib.optionalAttrs (serviceCfg.advertised != null) {
+          inherit (serviceCfg) advertised;
+        }
+      )
+    ) cfg.services;
+  };
+
+  configFile =
+    if cfg.configFile != null then
+      cfg.configFile
+    else
+      settingsFormat.generate "tailscale-serve-config.json" serveConfig;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    bouk
+  ];
+
+  options.services.tailscale.serve = {
+    enable = lib.mkEnableOption "Tailscale Serve configuration";
+
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a Tailscale Serve configuration file in JSON format.
+        If set, this takes precedence over {option}`services.tailscale.serve.services`.
+
+        See <https://tailscale.com/kb/1589/tailscale-services-configuration-file> for the configuration format.
+      '';
+      example = "/run/secrets/tailscale-serve.json";
+    };
+
+    services = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            endpoints = lib.mkOption {
+              type = lib.types.attrsOf lib.types.str;
+              description = ''
+                Map of incoming traffic patterns to local targets.
+
+                Keys should be in the format `<protocol>:<port>` or `<protocol>:<port-range>`.
+                Currently only `tcp` protocol is supported.
+
+                Values should be in the format `<protocol>://<host:port>` where protocol
+                is `http`, `https`, or `tcp`.
+              '';
+              example = {
+                "tcp:443" = "https://localhost:443";
+                "tcp:8080" = "http://localhost:8080";
+              };
+            };
+
+            advertised = lib.mkOption {
+              type = lib.types.nullOr lib.types.bool;
+              default = null;
+              description = ''
+                Whether the service should accept new connections.
+                Defaults to `true` when not specified.
+              '';
+            };
+          };
+        }
+      );
+      default = { };
+      description = ''
+        Services to configure for Tailscale Serve.
+
+        Each attribute name should be the service name (without the `svc:` prefix).
+        The `svc:` prefix will be added automatically.
+
+        See <https://tailscale.com/kb/1589/tailscale-services-configuration-file> for details.
+      '';
+      example = lib.literalExpression ''
+        {
+          web-server = {
+            endpoints = {
+              "tcp:443" = "https://localhost:443";
+            };
+          };
+          api = {
+            endpoints = {
+              "tcp:8080" = "http://localhost:8080";
+            };
+            advertised = true;
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.tailscale.enable;
+        message = "services.tailscale.serve requires services.tailscale.enable to be true";
+      }
+      {
+        assertion = cfg.configFile != null || cfg.services != { };
+        message = "services.tailscale.serve requires either configFile or services to be set";
+      }
+    ];
+
+    systemd.services.tailscale-serve = {
+      description = "Tailscale Serve Configuration";
+
+      after = [
+        "tailscaled.service"
+        "tailscaled-autoconnect.service"
+        "tailscaled-set.service"
+      ];
+      wants = [ "tailscaled.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      restartTriggers = [ configFile ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${lib.getExe config.services.tailscale.package} serve set-config --all ${configFile}";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/boot/initrd-network.nix b/nixos/modules/system/boot/initrd-network.nix
index 179297619367..652815a2d6fd 100644
--- a/nixos/modules/system/boot/initrd-network.nix
+++ b/nixos/modules/system/boot/initrd-network.nix
@@ -89,7 +89,7 @@ in
 
     boot.initrd.network.udhcpc.enable = mkOption {
       default = config.networking.useDHCP && !config.boot.initrd.systemd.enable;
-      defaultText = "networking.useDHCP";
+      defaultText = lib.literalExpression "config.networking.useDHCP";
       type = types.bool;
       description = ''
         Enables the udhcpc service during stage 1 of the boot process. This
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index a64f34eaefc3..4b17e06e9051 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -291,6 +291,12 @@ def config_entry(levels: int, bootspec: BootSpec, label: str, time: str) -> str:
     entry += f'comment: {bootspec.label}, built on {time}\n'
     entry += 'kernel_path: ' + get_kernel_uri(bootspec.kernel) + '\n'
     entry += 'cmdline: ' + ' '.join(['init=' + bootspec.init] + bootspec.kernelParams).strip() + '\n'
+
+    # Set framebuffer resolution for Linux boot entries if configured
+    resolution = config('resolution')
+    if resolution is not None:
+        entry += f'resolution: {resolution}\n'
+
     if bootspec.initrd:
         entry += f'module_path: ' + get_kernel_uri(bootspec.initrd) + '\n'
 
diff --git a/nixos/modules/system/boot/loader/limine/limine.nix b/nixos/modules/system/boot/loader/limine/limine.nix
index 35e81d2afcfb..ec504a43685d 100644
--- a/nixos/modules/system/boot/loader/limine/limine.nix
+++ b/nixos/modules/system/boot/loader/limine/limine.nix
@@ -25,6 +25,7 @@ let
       force = cfg.force;
       enrollConfig = cfg.enrollConfig;
       style = cfg.style;
+      resolution = cfg.resolution;
       maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
       hostArchitecture = pkgs.stdenv.hostPlatform.parsed.cpu;
       timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else 10;
@@ -98,6 +99,27 @@ in
       '';
     };
 
+    resolution = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.str;
+      example = "1920x1080x32";
+      description = ''
+        The framebuffer resolution to set when booting Linux entries.
+        This controls the GOP mode that Limine sets before handing off to the kernel,
+        which affects early boot graphics (e.g., simpledrm, efifb).
+
+        Format: `<width>x<height>` or `<width>x<height>x<bpp>`.
+        If bpp is omitted, defaults to 32.
+
+        Note: Refresh rate is not supported because the UEFI GOP protocol only
+        defines framebuffer dimensions and pixel format, not display timing.
+        Refresh rate is determined later by the GPU driver based on EDID.
+
+        This is distinct from {option}`boot.loader.limine.style.interface.resolution`
+        which only affects the Limine bootloader's own menu interface.
+      '';
+    };
+
     additionalFiles = lib.mkOption {
       default = { };
       type = lib.types.attrsOf lib.types.path;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 512082e29494..6cd4ac9a4ecb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -386,6 +386,7 @@ in
   collectd = runTest ./collectd.nix;
   commafeed = runTest ./commafeed.nix;
   connman = runTest ./connman.nix;
+  console-xkb-and-i18n = runTest ./console-xkb-and-i18n.nix;
   consul = runTest ./consul.nix;
   consul-template = runTest ./consul-template.nix;
   containers-bridge = runTest ./containers-bridge.nix;
diff --git a/nixos/tests/console-xkb-and-i18n.nix b/nixos/tests/console-xkb-and-i18n.nix
new file mode 100644
index 000000000000..757825a785af
--- /dev/null
+++ b/nixos/tests/console-xkb-and-i18n.nix
@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  name = "console-xkb-and-i18n";
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
+
+  nodes = {
+    # Nothing to run on this node. Only verify that this configuration doesn't
+    # produce the bugs described here:
+    #
+    # - https://github.com/NixOS/nixpkgs/issues/445666
+    # - https://github.com/NixOS/nixpkgs/issues/411374
+    #
+    x = {
+      i18n.defaultLocale = "eo";
+      console.useXkbConfig = true;
+      services.xserver.xkb = {
+        layout = "us";
+        variant = "colemak";
+      };
+    };
+  };
+  testScript = { nodes, ... }: "";
+}
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
index 1e510beaa20a..e99f707d0823 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@@ -92,11 +92,7 @@ stdenv.mkDerivation rec {
     # Removing it will force it to use our version.
     rm $out/libexec/lib/bitwig-studio/libxcb-imdkit.so.1
 
-    substitute usr/share/applications/com.bitwig.BitwigStudio.desktop \
-      $out/share/applications/com.bitwig.BitwigStudio.desktop \
-      --replace-fail "Exec=bitwig-studio" "Exec=$out/bin/bitwig-studio"
-
-      runHook postInstall
+    runHook postInstall
   '';
 
   postFixup = ''
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
deleted file mode 100644
index f8b1dad22672..000000000000
--- a/pkgs/applications/audio/chuck/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-  alsa-lib,
-  bison,
-  flex,
-  libsndfile,
-  which,
-  DarwinTools,
-  xcbuild,
-}:
-
-stdenv.mkDerivation rec {
-  version = "1.5.5.5";
-  pname = "chuck";
-
-  src = fetchurl {
-    url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "sha256-fxbTW0wcKn1q6psRhhCe6pHFJTPFfZUTCmlGr7gFoRU=";
-  };
-
-  nativeBuildInputs = [
-    flex
-    bison
-    which
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    DarwinTools
-    xcbuild
-  ];
-
-  buildInputs = [ libsndfile ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib;
-
-  makeFlags = [
-    "-C src"
-    "DESTDIR=$(out)/bin"
-  ];
-  buildFlags = [ (if stdenv.hostPlatform.isDarwin then "mac" else "linux-alsa") ];
-
-  meta = {
-    description = "Programming language for real-time sound synthesis and music creation";
-    homepage = "http://chuck.cs.princeton.edu";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ftrvxmtrx ];
-    mainProgram = "chuck";
-  };
-}
diff --git a/pkgs/applications/blockchains/elements/default.nix b/pkgs/applications/blockchains/elements/default.nix
index ffe27fa9b87b..0803e814480c 100644
--- a/pkgs/applications/blockchains/elements/default.nix
+++ b/pkgs/applications/blockchains/elements/default.nix
@@ -26,23 +26,15 @@
 
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "23.2.4";
+  version = "23.3.1";
 
   src = fetchFromGitHub {
     owner = "ElementsProject";
     repo = "elements";
     rev = "elements-${version}";
-    sha256 = "sha256-UNjYkEZBjGuhkwBxSkNXjBBcLQqoan/afCLhoR2lOY4=";
+    sha256 = "sha256-hqHKH9B6EITwZ4F+YdPJI4n3Z3EeXdPYbzRoNODlThY=";
   };
 
-  patches = [
-    # upnp: fix build with miniupnpc 2.2.8
-    (fetchpatch2 {
-      url = "https://github.com/bitcoin/bitcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
-      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix
index f984fa0e52ee..53186307e380 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix
@@ -6,14 +6,14 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "zig.vim";
-  version = "0-unstable-2025-12-07";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "ziglang";
     repo = "zig.vim";
-    rev = "74bdb43c9d5da8d6b715809b79f92ef8f711df8e";
-    hash = "sha256-RmrRgJ6YdExMwmua6nGv6W7DPP98k2URIaJTm+O4uR8=";
+    rev = "fc01f73ce0636723a03b784b63a7a89f2f9a84ae";
+    hash = "sha256-bWvwb6k9jyoAqtp07UfYkyUsGo2N8Yvv7H6zq1eiwP8=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index f0dd8556189a..3131b5e1f649 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3840,8 +3840,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "26.1.0";
-          hash = "sha256-xehZZ11C2Bjee1glpnPZaJ25DpbXSCsZONWWy4YNlRo=";
+          version = "26.1.3";
+          hash = "sha256-iBAlDqi7u/srkgBBLha/JCHZnpccz37BdZ7zVJVfJYY=";
         };
         meta = {
           description = "Ansible language support";
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index a482ad680bba..74248a1b7d40 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-12-01";
+  version = "0-unstable-2026-01-20";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "492d8a3996429dbaa4a13b2e90c522e7b34fc2bb";
-    hash = "sha256-yNufp+HUzuLOiRhQfdP1ssKDTALwh28B8cRZ2rTJpis=";
+    rev = "c69ecd250eb76cdceae1dbb962116f706e4fa661";
+    hash = "sha256-cCUHTaHDNn7k5mK589RoNXiPgFvEBCxCSyp+8azUtpg=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index 05a0a5694398..991511adc86d 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-12-19";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "308255e4a3acb38a054ebb42a5e2fe5c50eebd66";
-    hash = "sha256-a75F7kfrVfIVt5yvYIu+oVmpXlOdTDTs5IX1Q5NB8WU=";
+    rev = "9fe223d9c4b615c55840170c6e85e6e9fa4bd1d2";
+    hash = "sha256-BBFT8+TLf5qbwo36BudPjeMRPLdSj2+0m4RnfeFrlOc=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index d12aeee7c7b8..f73057a79706 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2026-01-14";
+  version = "0-unstable-2026-01-19";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "48ddb5671398cd0b96901f0ba7ec2543df8548eb";
-    hash = "sha256-xZJG4Bjh3Nkb7IOGIBZmcRF92eFT3C/dNTSJ0RAFFTA=";
+    rev = "bf245b03076b97eed14abd54c79537a59ecc2bd9";
+    hash = "sha256-2Tm/CQt+LwAIEWsBRtgm/rZngSHqEohx45UlkaTCHbA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 885053e8445d..6721d21baa54 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -70,13 +70,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "6.9.13-10";
+  version = "6.9.13-38";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick6";
     rev = finalAttrs.version;
-    sha256 = "sha256-AdlJaCJOrN+NkkzzzgELtgAr5iZ9dvlVYVc7tYiM+R8=";
+    sha256 = "sha256-49o1jFFs7GrQMBvkoUvTmlI5TDnS1mVycghuaOfDrIc=";
   };
 
   outputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 91738c9f925a..a03c9a07b638 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -813,7 +813,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "144.0.7559.59",
+    "version": "144.0.7559.96",
     "deps": {
       "depot_tools": {
         "rev": "2e88a3f08bd8c4a0014eae82729beca935f7f188",
@@ -825,16 +825,16 @@
         "hash": "sha256-04h38X/hqWwMiAOVsVu4OUrt8N+S7yS/JXc5yvRGo1I="
       },
       "ungoogled-patches": {
-        "rev": "144.0.7559.59-1",
-        "hash": "sha256-u4jg04k/HilI5i8eWS2b+MDvi9RYD1UP8KNNKNWZcfQ="
+        "rev": "144.0.7559.96-1",
+        "hash": "sha256-gbEKKGGi6FBhRoCEerSdJJtn5vXaFo9G74lYHDsz0Xs="
       },
       "npmHash": "sha256-13sgV/5BD7QvDLBAEmoLN5vongw+S5v5znvZcctxhWc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "cd1d73dd77daadf4581dc29ca73482fc241e079d",
-        "hash": "sha256-K/dmiy5u+XJIpS6AOTaXDLVYp5qAtfUbfSbGCpt9Cv8=",
+        "rev": "d7b80622cfab91c265741194e7942eefd2d21811",
+        "hash": "sha256-Cz3iDS0raJHRh+byrs7GYp6sck54mJq7yzsjLUWDWqA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "a8d1e554a9bd35b0418ba7fd6b0bc005250a7703",
-        "hash": "sha256-GJuT3rqNxvKkRTMvoMi8/QYda0y0RTkZLhb5v9QkwGA="
+        "rev": "9e0e116de6735ab113349675d31a23c121254fe0",
+        "hash": "sha256-MsUmRx5fQYWbkPJ/JvaoT//qjPYy5xxZXIa3t5LDxSY="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1069,8 +1069,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "d5efa4236f8676254c9f39ccfef18bd633de5fd3",
-        "hash": "sha256-BmwsvTjgYQayFnyT9EfFzpCfbgdTt9xZlsUba0uJelg="
+        "rev": "a3064782146fc247c488d44c1ad3496b29d55ec4",
+        "hash": "sha256-vLkWH/EiDHxl/dz4soKybQF1hgud/7MlnDhVPicYJGY="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1619,8 +1619,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad25f9ae50a53bee50f459bfee25fb1e6f64adc3",
-        "hash": "sha256-vyOtnPA3tAeorNOGTDuAnwJ/UtpjeO8z+RSjx9RIFFc="
+        "rev": "6c2c296f23a5487ccb2536cf7c90d01f35d03077",
+        "hash": "sha256-gBzwGvl/tqj4Z6acdLN326I80kBLEk+Nn8oN6D193o4="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 9c353c6a01e6..eedb827b72af 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -54,11 +54,11 @@
     "vendorHash": "sha256-ogQLStDbsM0aRf4QIbITB8Z+L9DUtZwoAPK6T4xylXI="
   },
   "aminueza_minio": {
-    "hash": "sha256-G6eQeoxIeuUJK7LF8gByOrNP27i3p0OccZNxL2DxDw0=",
+    "hash": "sha256-gl1mD4Ital/xhtWZW9UbalTJqYLJ2tr8ImDFLiTyyFg=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.12.0",
+    "rev": "v3.13.0",
     "spdx": "AGPL-3.0",
     "vendorHash": "sha256-6Tw4rCOzrvN2pK83NejdJJBjljfDfHEniIX+EdfqujA="
   },
@@ -274,13 +274,13 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-xBfk4Pvu4caOOW5qxNdbaEb4NAOL9/5KMgBCpBfvghU=",
+    "hash": "sha256-AOffUquIVHmeYk3WbkekSwZQAC4FXY82+dQMgGQ8/H8=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.84.0",
+    "rev": "v3.85.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FrMa8ah8WM/XlQwwHTvK0tPaSUnCx2ArQDWXw7ULwTk="
+    "vendorHash": "sha256-0hMKqv++nheXRu8DBcGOItaVKCnr0nPv/jGtNe05cp8="
   },
   "datadrivers_nexus": {
     "hash": "sha256-Lm5CZ+eBDUNIL2KuK/iKc5dTif7P+E9II714vwvYuyU=",
@@ -706,13 +706,13 @@
     "vendorHash": null
   },
   "hetznercloud_hcloud": {
-    "hash": "sha256-p0MR+e3iSEhDJwXHSqG1spJ5rt+TV6yQVm7V18spFi0=",
+    "hash": "sha256-phAc3QHDtTt76ThmsEW4u4SDC5r2Dv7uh4cxD/HurAA=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.58.0",
+    "rev": "v1.59.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8gBaOdoUjmeomi8+H2gMypKnJdkXGzgzu8K0ATqMfxE="
+    "vendorHash": "sha256-642sABI6g4T3OoZLuOdo9YzXSxi1d35WsVkUwzxKT7I="
   },
   "huaweicloud_huaweicloud": {
     "hash": "sha256-4YCixNM2I/v8pn6CAiNQf2tXKTeNjAWpHGDF3yOwIYs=",
@@ -751,11 +751,11 @@
     "vendorHash": null
   },
   "integrations_github": {
-    "hash": "sha256-I9mQ3oNzU6+n7XPmyhbIgr/d80wcLy5s1s3v96fYbkU=",
+    "hash": "sha256-WN8G05llSdh7IE7mJelrehTkNNtWBMG8Co/YLJUNLmk=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.9.1",
+    "rev": "v6.10.2",
     "spdx": "MIT",
     "vendorHash": null
   },
@@ -1202,11 +1202,11 @@
     "vendorHash": "sha256-OJlD1P+CUEsLk2xSsQ2QQBvGewYNly1dIJh8kMi+ChE="
   },
   "siderolabs_talos": {
-    "hash": "sha256-NsIFyngT6/bU744fftNWWHU43W3sXO/0yzzAKSEH9/Q=",
+    "hash": "sha256-9VL2aa6wZFAfQ/rkfMKwWdDU9Vs6GwZzsvQpUfm7rME=",
     "homepage": "https://registry.terraform.io/providers/siderolabs/talos",
     "owner": "siderolabs",
     "repo": "terraform-provider-talos",
-    "rev": "v0.10.0",
+    "rev": "v0.10.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-i5Qi2rs1NpOlOkM80Uj0GfQRbobp9+6lAgt2iN2uEn0="
   },
@@ -1310,11 +1310,11 @@
     "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-VgmXFRmwgCkGMwcle0zop41pr+uuj4ILlNXIcHQ9n0g=",
+    "hash": "sha256-kXdu7rtGo4J9waREkVMWqFf4/Ki22fm6p/Nhtts/Ycs=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.54",
+    "rev": "v1.82.57",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1418,11 +1418,11 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-0XO19ahaRrIxg785dHb/RPBXuGWyP5y0prAN7D9w6IE=",
+    "hash": "sha256-Fjn1eNqB0Ye5MRg8+YsPwMBdkvsVELTzf2wvHluFzN8=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.42.0",
+    "rev": "v2.43.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-LAM2pzTIRdspYnXboDA+iGwt7uaI+/ItXPAgOJUELps="
   },
diff --git a/pkgs/applications/networking/instant-messengers/discord/sources.json b/pkgs/applications/networking/instant-messengers/discord/sources.json
index f714248b084c..13ce48003d48 100644
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,8 +1,8 @@
 {
   "linux-canary": {
-    "hash": "sha256-jomLXlIr+ajJspmh/seNb48alPSuCw8ybYkfc0uAziE=",
-    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.852/discord-canary-0.0.852.tar.gz",
-    "version": "0.0.852"
+    "hash": "sha256-HtcgQS8P5R57qV3pKYyVLcT9FCOtZ6UbFBQWFkvU8B0=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.854/discord-canary-0.0.854.tar.gz",
+    "version": "0.0.854"
   },
   "linux-development": {
     "hash": "sha256-EVkjWoqWl9Z+iHCLPOLu4PIUb2wC3HVcPVjOVz++IVw=",
@@ -10,19 +10,19 @@
     "version": "0.0.94"
   },
   "linux-ptb": {
-    "hash": "sha256-szmKLp+aXZjrWClTOQ+NTwenY7b5c3eONFUUmszfUSk=",
-    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.172/discord-ptb-0.0.172.tar.gz",
-    "version": "0.0.172"
+    "hash": "sha256-Y+e3HHXE5D9Q9qKE7ipaLijZ+E6yEr9NzEOy5c+Gk54=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.173/discord-ptb-0.0.173.tar.gz",
+    "version": "0.0.173"
   },
   "linux-stable": {
-    "hash": "sha256-4rJ0l0zSoOz7L65sy3Gegcsb/nJGGFu6h5TGAb0fqUI=",
-    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.120/discord-0.0.120.tar.gz",
-    "version": "0.0.120"
+    "hash": "sha256-WR9xyw3Zn/HAZQlfiKMAXqc2TueF6wCfQzvYtnXd1yM=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.121/discord-0.0.121.tar.gz",
+    "version": "0.0.121"
   },
   "osx-canary": {
-    "hash": "sha256-ZzqakVB2Rkcq5zME2WnSCw1CLzpD3VDM/pu4nQ7rRNs=",
-    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.956/DiscordCanary.dmg",
-    "version": "0.0.956"
+    "hash": "sha256-q/PAGdlOTdkQudiH/NFXSgwhz2XBL9ZwrhJXiY9Iibc=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.958/DiscordCanary.dmg",
+    "version": "0.0.958"
   },
   "osx-development": {
     "hash": "sha256-B1//zMlTv2+RWHfWZSaaU8ubVOwWob+EYjNdtFRwlgg=",
@@ -30,13 +30,13 @@
     "version": "0.0.107"
   },
   "osx-ptb": {
-    "hash": "sha256-tjWbvWOvSinVZDvJYFFcbmr+y7W5PmIr/alrS82ECBo=",
-    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.204/DiscordPTB.dmg",
-    "version": "0.0.204"
+    "hash": "sha256-QCzJsb1RH6HORk9hw9F9Xu0rE+NCFYJDTJQO9UrdBxo=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.205/DiscordPTB.dmg",
+    "version": "0.0.205"
   },
   "osx-stable": {
-    "hash": "sha256-PkZU/1GxPmfxq2qP/5gGU85EFYPI1V42iHfoy9x9fKI=",
-    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.372/Discord.dmg",
-    "version": "0.0.372"
+    "hash": "sha256-/CEN67VbRRwK64Iy7GIhs2XFwHe47njI5X6n45j5Q/E=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.373/Discord.dmg",
+    "version": "0.0.373"
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index de846c7c7c0a..ee0137e4fdd5 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -43,14 +43,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "2.3.6";
+  version = "2.4.2";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "gajim";
     tag = version;
-    hash = "sha256-Mvi69FI2zRefcCnLsurdVNMxYaqKsUCKgeFxOh6vg/o=";
+    hash = "sha256-VBo0+8lOXWbi3a9FT0qcEkyoxzVAm+QLrBtHmRjUHbg=";
   };
 
   pyproject = true;
@@ -112,6 +112,9 @@ python3.pkgs.buildPythonApplication rec {
       qrcode
       sqlalchemy
       emoji
+      httpx
+      h2
+      truststore
     ]
     ++ lib.optionals enableE2E [
       pycrypto
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index 5fd35c38ce07..7f995fc5c65f 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.11.22",
+      "version": "8.12.0",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.22.x64.tar.gz",
-          "hash": "sha256-IYwCERJyL7l5qFFvTneTciKVT2PSkoeuzQsiMfdomV8="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.0.x64.tar.gz",
+          "hash": "sha256-EiSrZHWXvBLhS+Gx519AvUmRH582P4/cF0huj+RHcMI="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.22.arm64.tar.gz",
-          "hash": "sha256-PpsKuFNRVt/eYWvlmZxo6tyMC/gUfLrIAWYPoKIntrU="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.0.arm64.tar.gz",
+          "hash": "sha256-/ykSp+//5SvLFH0BsjPNwAEapoBUTqxfaRKJw4R7eis="
         }
       }
     },
     "darwin": {
-      "version": "8.11.22",
+      "version": "8.12.0",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-x86_64.zip",
-          "hash": "sha256-jyaAUZkRJ6Rl5zd9ppVZ6AkpzAXaw11KvpLdpftC6bM="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.0-x86_64.zip",
+          "hash": "sha256-JcSNA9oEeEJk9bHxTwF08/KrJNu+UOSC5r0VJGmds+Y="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-aarch64.zip",
-          "hash": "sha256-SH3QIJrfqEgKV0GhrLCKkbLmSK9n9OyBRBaGCTm3FrI="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.0-aarch64.zip",
+          "hash": "sha256-fpu+CZ3iLXcGevWHLh/HVa2uoS/a1w/m0s4+awBzNI0="
         }
       }
     }
diff --git a/pkgs/by-name/ai/air-formatter/package.nix b/pkgs/by-name/ai/air-formatter/package.nix
index 2f081926e983..6cccc54235af 100644
--- a/pkgs/by-name/ai/air-formatter/package.nix
+++ b/pkgs/by-name/ai/air-formatter/package.nix
@@ -7,23 +7,22 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "air-formatter";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "posit-dev";
     repo = "air";
     tag = finalAttrs.version;
-    hash = "sha256-LNU//dQico54GhZdehynEuukfGuU8rQvfFO4zvRsZL0=";
+    hash = "sha256-+AsKwigWikAv8NOaIYVvrH3Pub7Q9qV5YOp2jYU2GkE=";
   };
 
-  cargoHash = "sha256-9HRDUTYzKLYuh9KCcnvPXB6gDKcht79TOZZ3ze9+gbg=";
+  cargoHash = "sha256-ndd4ps2X/+a62p3dlv8jxhr2bbBG88rytI1XBVntk+g=";
 
   useNextest = true;
 
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgram = "${placeholder "out"}/bin/air";
   doInstallCheck = true;
 
   cargoBuildFlags = [ "-p air" ];
diff --git a/pkgs/by-name/ak/akira-unstable/package.nix b/pkgs/by-name/ak/akira-unstable/package.nix
index 006315c43ef0..4af6b8f8ab8b 100644
--- a/pkgs/by-name/ak/akira-unstable/package.nix
+++ b/pkgs/by-name/ak/akira-unstable/package.nix
@@ -13,7 +13,7 @@
   wrapGAppsHook3,
   cairo,
   glib,
-  goocanvas3,
+  goocanvas_3,
   gtk3,
   gtksourceview3,
   json-glib,
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cairo
     glib
-    goocanvas3
+    goocanvas_3
     pantheon.granite
     gtk3
     gtksourceview3
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index d61e9093ac69..14f2cb2f732d 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-01-06";
+  version = "0-unstable-2026-01-20";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "c3e21cb01a909e5da2828f453ebdc375e2f514ad";
-    hash = "sha256-g/fexBzHzhckCWtzfXOwXqA6LZqTULQ7Bz3OY5fcLcA=";
+    rev = "e1f6574e77386282cbb917b981c968648fbab601";
+    hash = "sha256-TR+c6OACVrETAVAlza62JSIKBvKMrDg/G4xBdMkJJlk=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ap/apache-airflow/python-package.nix b/pkgs/by-name/ap/apache-airflow/python-package.nix
index 154886e64e0f..bce488ed44ec 100644
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -310,13 +310,13 @@ buildPythonPackage rec {
   # Updates yarn.lock and package.json
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts curl pcre "python3.withPackages (ps: with ps; [ pyyaml ])" yarn2nix
+    #!nix-shell -i bash -p common-updater-scripts curl "python3.withPackages (ps: with ps; [ pyyaml ])" yarn2nix
 
     set -euo pipefail
 
     # Get new version
     new_version="$(curl -s https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html |
-      pcregrep -o1 'Airflow ([0-9.]+).' | head -1)"
+      grep -oE 'Airflow [0-9.]+' | head -1 | grep -oE '[0-9.]+')"
     update-source-version ${pname} "$new_version"
 
     # Update frontend
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index be44ac3d4ae7..1abcceb294dd 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.0.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rUJ/znxHysPdy4AFujbisUrCW0L0cgh03jLt3YY/tis=";
+    hash = "sha256-18i2xiVDjIRG0RD5R7t2BsyB9N+hhYOOByV6snGBCkM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-ol9uJq/HPdv5E2MB+KUturqwsa8s3xqULwXu9bAWjr0=";
+  vendorHash = "sha256-P8/0VSx4JfWgbMUuvo1Z0BhtC1TgGITSHLMHSzigeEg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/au/audacity/package.nix b/pkgs/by-name/au/audacity/package.nix
index 27cc3b3628df..6d1b67a6dd2c 100644
--- a/pkgs/by-name/au/audacity/package.nix
+++ b/pkgs/by-name/au/audacity/package.nix
@@ -33,7 +33,6 @@
   libuuid,
   ffmpeg,
   soundtouch,
-  pcre,
   portaudio, # given up fighting their portaudio.patch?
   portmidi,
   linuxHeaders,
@@ -115,7 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
     lv2
     mpg123
     opusfile
-    pcre
     portmidi
     rapidjson
     serd
diff --git a/pkgs/by-name/aw/aws-sam-cli/package.nix b/pkgs/by-name/aw/aws-sam-cli/package.nix
index 8bd1cbaa289d..0b11c1ee9196 100644
--- a/pkgs/by-name/aw/aws-sam-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sam-cli/package.nix
@@ -11,14 +11,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.151.0";
+  version = "1.152.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sam-cli";
     tag = "v${version}";
-    hash = "sha256-8r/sTb6LYDGuCG46Xuh+glT9LRYR6Q8ErjFL2wPTDLI=";
+    hash = "sha256-N+x9ZNd6WvDJTFERhWJD5HsDE7dFyH+jOnEMzJ3IHSk=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/aw/awstats/package.nix b/pkgs/by-name/aw/awstats/package.nix
index b92e889ee4fa..7cbd9b9972e8 100644
--- a/pkgs/by-name/aw/awstats/package.nix
+++ b/pkgs/by-name/aw/awstats/package.nix
@@ -7,11 +7,11 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "awstats";
-  version = "7.9";
+  version = "8.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/awstats/${pname}-${version}.tar.gz";
-    sha256 = "sha256-YVF47TE9NDFfFaUi2xpdEsqcOV43hbsGKAq/+V2aBUY=";
+    sha256 = "sha256-Pvdv+WxTmEd92KERNOJm5TikhwZ/aQajrIo4v9EcEeA=";
   };
 
   postPatch = ''
@@ -27,7 +27,10 @@ perlPackages.buildPerlPackage rec {
 
   propagatedBuildOutputs = [ ]; # otherwise out propagates bin -> cycle
 
-  buildInputs = [ ]; # plugins will need some
+  buildInputs = with perlPackages; [
+    JSONXS
+    TryTiny
+  ];
 
   preConfigure = ''
     touch Makefile.PL
diff --git a/pkgs/by-name/ba/backrest/package.nix b/pkgs/by-name/ba/backrest/package.nix
index f738027fb23f..71de8e51e37b 100644
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -123,7 +123,7 @@ buildGoModule {
     homepage = "https://github.com/garethgeorge/backrest";
     changelog = "https://github.com/garethgeorge/backrest/releases/tag/v${version}";
     license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     mainProgram = "backrest";
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/bb/bbedit/package.nix b/pkgs/by-name/bb/bbedit/package.nix
index 948111ed505b..2c39f1e6ca57 100644
--- a/pkgs/by-name/bb/bbedit/package.nix
+++ b/pkgs/by-name/bb/bbedit/package.nix
@@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Powerful and full-featured professional HTML and text editor for macOS";
     homepage = "https://www.barebones.com/products/bbedit/";
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/development/tools/build-managers/build2/bdep.nix b/pkgs/by-name/bd/bdep/package.nix
similarity index 100%
rename from pkgs/development/tools/build-managers/build2/bdep.nix
rename to pkgs/by-name/bd/bdep/package.nix
diff --git a/pkgs/by-name/bo/bosh-cli/package.nix b/pkgs/by-name/bo/bosh-cli/package.nix
index 44e29be66877..9084c33ff600 100644
--- a/pkgs/by-name/bo/bosh-cli/package.nix
+++ b/pkgs/by-name/bo/bosh-cli/package.nix
@@ -9,13 +9,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.9.15";
+  version = "7.9.16";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "bosh-cli";
     rev = "v${version}";
-    sha256 = "sha256-+dkRPK4RFVainDa4SNiA9B14uz3vaIfAjv09T3dDGIw=";
+    sha256 = "sha256-yzoqtubX2IeRP4Ee/YjzRmeAo2aqvfCiqsVkfKtzGFU=";
   };
   vendorHash = null;
 
diff --git a/pkgs/development/tools/build-managers/build2/bpkg.nix b/pkgs/by-name/bp/bpkg/package.nix
similarity index 100%
rename from pkgs/development/tools/build-managers/build2/bpkg.nix
rename to pkgs/by-name/bp/bpkg/package.nix
diff --git a/pkgs/by-name/br/bridge-utils/package.nix b/pkgs/by-name/br/bridge-utils/package.nix
index 1a2acae1f3f6..07b59bcc327d 100644
--- a/pkgs/by-name/br/bridge-utils/package.nix
+++ b/pkgs/by-name/br/bridge-utils/package.nix
@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   meta = {
     description = "Userspace tool to configure linux bridges (deprecated in favour or iproute2)";
     mainProgram = "brctl";
diff --git a/pkgs/development/tools/build-managers/build2/nix-ldflags-sysdirs.patch b/pkgs/by-name/bu/build2-bootstrap/nix-ldflags-sysdirs.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/build2/nix-ldflags-sysdirs.patch
rename to pkgs/by-name/bu/build2-bootstrap/nix-ldflags-sysdirs.patch
diff --git a/pkgs/development/tools/build-managers/build2/bootstrap.nix b/pkgs/by-name/bu/build2-bootstrap/package.nix
similarity index 65%
rename from pkgs/development/tools/build-managers/build2/bootstrap.nix
rename to pkgs/by-name/bu/build2-bootstrap/package.nix
index 6ef211423641..5c5c4098e65e 100644
--- a/pkgs/development/tools/build-managers/build2/bootstrap.nix
+++ b/pkgs/by-name/bu/build2-bootstrap/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  pkgs,
   buildPackages,
   fixDarwinDylibNames,
 }:
@@ -52,5 +51,28 @@ stdenv.mkDerivation rec {
       --subst-var-by isTargetDarwin '${toString stdenv.targetPlatform.isDarwin}'
   '';
 
-  inherit (pkgs.build2) passthru;
+  passthru = {
+    configSharedStatic =
+      enableShared: enableStatic:
+      if enableShared && enableStatic then
+        "both"
+      else if enableShared then
+        "shared"
+      else if enableStatic then
+        "static"
+      else
+        throw "neither shared nor static libraries requested";
+  };
+
+  meta = {
+    homepage = "https://www.build2.org/";
+    description = "Bootstrap for the 'build2' package, you most likely want to use that one";
+    license = lib.licenses.mit;
+    changelog = "https://git.build2.org/cgit/build2/tree/NEWS";
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      hiro98
+      r-burns
+    ];
+  };
 }
diff --git a/pkgs/development/tools/build-managers/build2/setup-hook.sh b/pkgs/by-name/bu/build2-bootstrap/setup-hook.sh
similarity index 100%
rename from pkgs/development/tools/build-managers/build2/setup-hook.sh
rename to pkgs/by-name/bu/build2-bootstrap/setup-hook.sh
diff --git a/pkgs/development/tools/build-managers/build2/default.nix b/pkgs/by-name/bu/build2/package.nix
similarity index 76%
rename from pkgs/development/tools/build-managers/build2/default.nix
rename to pkgs/by-name/bu/build2/package.nix
index e8f21f173ebb..8c0391dc4f75 100644
--- a/pkgs/development/tools/build-managers/build2/default.nix
+++ b/pkgs/by-name/bu/build2/package.nix
@@ -1,7 +1,8 @@
 {
   stdenv,
   lib,
-  build2,
+  # Break cycle by using self-contained toolchain for bootstrapping
+  build2-bootstrap,
   fetchurl,
   fixDarwinDylibNames,
   libbutl,
@@ -11,18 +12,9 @@
   enableStatic ? !enableShared,
 }:
 let
-  configSharedStatic =
-    enableShared: enableStatic:
-    if enableShared && enableStatic then
-      "both"
-    else if enableShared then
-      "shared"
-    else if enableStatic then
-      "static"
-    else
-      throw "neither shared nor static libraries requested";
+  inherit (build2-bootstrap.passthru) configSharedStatic;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "build2";
   version = "0.17.0";
 
@@ -33,26 +25,25 @@ stdenv.mkDerivation rec {
     "man"
   ];
 
-  setupHook = ./setup-hook.sh;
+  setupHook = build2-bootstrap.setupHook;
 
   src = fetchurl {
-    url = "https://pkg.cppget.org/1/alpha/build2/build2-${version}.tar.gz";
+    url = "https://pkg.cppget.org/1/alpha/build2/build2-${finalAttrs.version}.tar.gz";
     hash = "sha256-Kx5X/GV3GjFSbjo1mzteiHnnm4mr6+NAKIR/mEE+IdA=";
   };
 
   patches = [
     # Remove any build/host config entries which refer to nix store paths
     ./remove-config-store-paths.patch
-    # Pick up sysdirs from NIX_LDFLAGS
-    ./nix-ldflags-sysdirs.patch
-  ];
+  ]
+  ++ build2-bootstrap.patches;
 
   strictDeps = true;
   nativeBuildInputs = [
-    build2
+    build2-bootstrap
   ];
   disallowedReferences = [
-    build2
+    build2-bootstrap
     libbutl.dev
     libpkgconf.dev
   ];
@@ -94,14 +85,19 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    bootstrap = build2;
+    bootstrap = build2-bootstrap;
     inherit configSharedStatic;
   };
 
   meta = {
-    homepage = "https://www.build2.org/";
+    inherit (build2-bootstrap.meta)
+      homepage
+      license
+      changelog
+      platforms
+      maintainers
+      ;
     description = "Build2 build system";
-    license = lib.licenses.mit;
     longDescription = ''
       build2 is an open source (MIT), cross-platform build toolchain
       that aims to approximate Rust Cargo's convenience for developing
@@ -114,12 +110,6 @@ stdenv.mkDerivation rec {
       at C/C++ projects as well as mixed-language projects involving
       one of these languages (see bash and rust modules, for example).
     '';
-    changelog = "https://git.build2.org/cgit/build2/tree/NEWS";
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [
-      hiro98
-      r-burns
-    ];
     mainProgram = "b";
   };
-}
+})
diff --git a/pkgs/development/tools/build-managers/build2/remove-config-store-paths.patch b/pkgs/by-name/bu/build2/remove-config-store-paths.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/build2/remove-config-store-paths.patch
rename to pkgs/by-name/bu/build2/remove-config-store-paths.patch
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
index dad6c229df2b..7113acc881a9 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
@@ -20,8 +20,20 @@ extraMounts:
       mountPoint: /sys/firmware/efi/efivars
       efi: true
 
-# Ensure the right fmask/dmask is set on the ESP, as it will be
-# picked up by nixos-generate-config later
+# Btrfs subvolume layout for NixOS
+# Empty subvolume for / means no subvolume (top-level) for GRUB compatibility
+btrfsSubvolumes:
+    - mountPoint: /
+      subvolume: ""
+    - mountPoint: /home
+      subvolume: /home
+    - mountPoint: /nix
+      subvolume: /nix
+
+# Mount options by filesystem type
+# nixos-generate-config picks these up for hardware-configuration.nix
 mountOptions:
     - filesystem: efi
       options: [ fmask=0077, dmask=0077 ]
+    - filesystem: btrfs
+      options: [ compress=zstd, noatime ]
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
index 3e067e8d2343..75d04cec9dfa 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
@@ -12,11 +12,29 @@ userSwapChoices:
 
 luksGeneration: luks2
 
+defaultFileSystemType: "ext4"
+
+availableFileSystemTypes:
+    - ext4
+    - btrfs
+    - xfs
+    - f2fs
+
 showNotEncryptedBootMessage: false
 
+bios:
+    mountPoint: "/boot"
+    minimumSize: 512MiB
+    recommendedSize: 1GiB
+    label: "BOOT"
+
 partitionLayout:
-    - name: "root"
+    - name: "boot"
       filesystem: "ext4"
+      mountPoint: "/boot"
+      size: 1GiB
+    - name: "root"
+      filesystem: "unknown"
       noEncrypt: false
       mountPoint: "/"
       size: 100%
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
index 5987724728f8..e9bee7a245d4 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
@@ -45,6 +45,15 @@ cfgbootbios = """  # Bootloader.
 
 """
 
+cfgbootbiosbtrfs = """  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "@@bootdev@@";
+  boot.loader.grub.useOSProber = true;
+  # Use provided UUIDs instead of blkid probing (required for btrfs subvolumes)
+  boot.loader.grub.fsIdentifier = "provided";
+
+"""
+
 cfgbootnone = """  # Disable bootloader.
   boot.loader.grub.enable = false;
 
@@ -360,6 +369,46 @@ def catenate(d, key, *values):
     d[key] = "".join(values)
 
 
+def fix_btrfs_subvolumes(hardware_config, partitions):
+    """
+    Fix btrfs subvolume configuration in hardware-configuration.nix.
+
+    nixos-generate-config generates incorrect subvol options for btrfs
+    by setting them to mount points instead of actual subvolume names.
+    This function corrects the subvol options to match what Calamares configured.
+    """
+    # Map of mount points to their correct btrfs subvolume names
+    # These match what is configured in mount.conf btrfsSubvolumes
+    # Root uses top-level (no subvolume) for GRUB compatibility
+    subvol_map = {
+        "/home": "home",
+        "/nix": "nix",
+    }
+
+    # Check if root is actually btrfs
+    root_is_btrfs = False
+    for part in partitions:
+        if part.get("mountPoint") == "/" and part.get("fs") == "btrfs":
+            root_is_btrfs = True
+            break
+
+    if not root_is_btrfs:
+        return hardware_config
+
+    libcalamares.utils.debug("Fixing btrfs subvolume configuration")
+
+    # Fix subvol options for each mount point
+    # nixos-generate-config may generate "subvol=/" instead of "subvol=@"
+    for mount_point, correct_subvol in subvol_map.items():
+        # Match any "subvol=<something>" and replace with correct subvolume
+        # This handles cases like "subvol=/" or "subvol=/home"
+        pattern = r'(fileSystems\."{}"[^;]*"subvol=)[^"]*"'.format(re.escape(mount_point))
+        replacement = r'\g<1>{}"'.format(correct_subvol)
+        hardware_config = re.sub(pattern, replacement, hardware_config, flags=re.DOTALL)
+
+    return hardware_config
+
+
 def run():
     """NixOS Configuration."""
 
@@ -388,11 +437,22 @@ def run():
 
     # Pick config parts and prepare substitution
 
+    # Check if root filesystem is btrfs
+    root_is_btrfs = False
+    for part in gs.value("partitions"):
+        if part.get("mountPoint") == "/" and part.get("fs") == "btrfs":
+            root_is_btrfs = True
+            break
+
     # Check bootloader
     if fw_type == "efi":
         cfg += cfgbootefi
     elif bootdev != "nodev":
-        cfg += cfgbootbios
+        # Use btrfs-specific config to avoid blkid issues with subvolumes
+        if root_is_btrfs:
+            cfg += cfgbootbiosbtrfs
+        else:
+            cfg += cfgbootbios
         catenate(variables, "bootdev", bootdev)
     else:
         cfg += cfgbootnone
@@ -734,9 +794,20 @@ def run():
             libcalamares.utils.error(e.output.decode("utf8"))
         return (_("nixos-generate-config failed"), _(e.output.decode("utf8")))
 
-    # Check for unfree stuff in hardware-configuration.nix
+    # Read and fix hardware-configuration.nix
     hf = open(root_mount_point + "/etc/nixos/hardware-configuration.nix", "r")
     htxt = hf.read()
+    hf.close()
+
+    hardware_modified = False
+
+    # Fix btrfs subvolume configuration if needed
+    htxt_fixed = fix_btrfs_subvolumes(htxt, gs.value("partitions"))
+    if htxt_fixed != htxt:
+        htxt = htxt_fixed
+        hardware_modified = True
+
+    # Check for unfree stuff in hardware-configuration.nix
     search = re.search(r"boot\.extraModulePackages = \[ (.*) \];", htxt)
 
     # Check if any extraModulePackages are defined, and remove if only free packages are allowed
@@ -765,14 +836,17 @@ def run():
                     )
                 )
                 expkgs.remove(pkg)
-        hardwareout = re.sub(
+        htxt = re.sub(
             r"boot\.extraModulePackages = \[ (.*) \];",
             "boot.extraModulePackages = [ {}];".format(
                 "".join(map(lambda x: x + " ", expkgs))
             ),
             htxt,
         )
-        # Write the hardware-configuration.nix file
+        hardware_modified = True
+
+    # Write the hardware-configuration.nix file if modified
+    if hardware_modified:
         libcalamares.utils.host_env_process_output(
             [
                 "cp",
@@ -780,7 +854,7 @@ def run():
                 root_mount_point + "/etc/nixos/hardware-configuration.nix",
             ],
             None,
-            hardwareout,
+            htxt,
         )
 
     # Write the configuration.nix file
@@ -789,6 +863,14 @@ def run():
     status = _("Installing NixOS")
     libcalamares.job.setprogress(0.3)
 
+    try:
+        subprocess.check_output(
+            ["pkexec", "chmod", "755", root_mount_point],
+            stderr=subprocess.STDOUT,
+        )
+    except subprocess.CalledProcessError as e:
+        libcalamares.utils.warning("Failed to set permissions on {}: {}".format(root_mount_point, e.output))
+
     # build nixos-install command
     nixosInstallCmd = [ "pkexec" ]
     nixosInstallCmd.extend(generateProxyStrings())
diff --git a/pkgs/by-name/ca/cargo-codspeed/package.nix b/pkgs/by-name/ca/cargo-codspeed/package.nix
index 61d2fdfb6143..b0a4afe6efaa 100644
--- a/pkgs/by-name/ca/cargo-codspeed/package.nix
+++ b/pkgs/by-name/ca/cargo-codspeed/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-codspeed";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ljq9d9T3Cx5hDAjP4dbhSnbCYaU1KB42aDhQvRyI7Ws=";
+    hash = "sha256-aOuKz7LEQU9hqJUw0M759A4zk8+9UhiMAnO7OwBc+T0=";
   };
 
-  cargoHash = "sha256-ryKZyl5CuxFsX1dLadJnCyorssVoD2w5kueKDJP80qU=";
+  cargoHash = "sha256-K1xm8Kw7TMspFmqvW4qRf4QXddarw3eUDTIuwbg1pGA=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/by-name/cd/cdk8s-cli/package.nix b/pkgs/by-name/cd/cdk8s-cli/package.nix
index 4532115e199b..cdc4ae59661a 100644
--- a/pkgs/by-name/cd/cdk8s-cli/package.nix
+++ b/pkgs/by-name/cd/cdk8s-cli/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.203.16";
+  version = "2.203.18";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PLdB0f7CMuvArlLfY+7G9UUUTURtiy/nHcgiSZoW01c=";
+    hash = "sha256-P/I8e7FWC4HgqPUe5839oh8sRrIQoCJqCvlw6+Wz/aw=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-GBkgzzkw5h2eajuIYO3gazDLoYYqc8Bx5NjWs8jVbaM=";
+    hash = "sha256-IefCjyrUlHAFC8563M5/UM7d+4Sx9zvW7QMLxW5pJgQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chuck/package.nix b/pkgs/by-name/ch/chuck/package.nix
new file mode 100644
index 000000000000..d1a5e7919138
--- /dev/null
+++ b/pkgs/by-name/ch/chuck/package.nix
@@ -0,0 +1,70 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  bison,
+  flex,
+  pkg-config,
+  darwin,
+  xcbuild,
+  libsndfile,
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.5.5.6";
+  pname = "chuck";
+
+  src = fetchFromGitHub {
+    owner = "ccrma";
+    repo = "chuck";
+    tag = "chuck-${finalAttrs.version}";
+    hash = "sha256-KBmMpycNCjRZJPdRR3HG5nqHQhhVOENciRpiQ7buyok=";
+  };
+
+  nativeBuildInputs = [
+    bison
+    flex
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.DarwinTools
+    xcbuild
+  ];
+
+  buildInputs = [
+    libsndfile
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    alsa-lib
+    libpulseaudio
+    libjack2
+  ];
+
+  makeFlags = [
+    "-C src"
+    "DESTDIR=$(out)/bin"
+    # fix hardcoded gcc
+    "CC=cc"
+    "CXX=c++"
+  ];
+  buildFlags = [ (if stdenv.hostPlatform.isDarwin then "mac" else "linux-all") ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=chuck-(.*)" ]; };
+
+  meta = {
+    description = "Programming language for real-time sound synthesis and music creation";
+    homepage = "http://chuck.cs.princeton.edu";
+    license = with lib.licenses; [
+      gpl2Plus
+      # or
+      mit
+    ];
+    platforms = lib.platforms.unix;
+    maintainers = [ ];
+    mainProgram = "chuck";
+  };
+})
diff --git a/pkgs/by-name/cl/clever-tools/package.nix b/pkgs/by-name/cl/clever-tools/package.nix
index d04728861fd8..6e3f05f33c33 100644
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "4.5.1";
+  version = "4.5.3";
 
   nodejs = nodejs_22;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-VzFcIcrE4pl3YZDDwlzkbd/FR1L/70fpFKg1kYjBGvo=";
+    hash = "sha256-/PVVnTzRPy4AM3OEfTdrSrvdWfbPSrP/LoenzPA0d2Q=";
   };
 
-  npmDepsHash = "sha256-lduZIevR+ZvHYD4xr4K+6OtY38Mik7mcxA5iasaftv4=";
+  npmDepsHash = "sha256-i9cZI+P363EqODlnggqKT6XxoDYTNVrg5rTYNWWHm8A=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/co/cocoon/package.nix b/pkgs/by-name/co/cocoon/package.nix
index c0503010bb92..7525b7737ff1 100644
--- a/pkgs/by-name/co/cocoon/package.nix
+++ b/pkgs/by-name/co/cocoon/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cocoon";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "haileyok";
     repo = "cocoon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ztP/Nvv9kRr4bFI8oveJ6pk3LOZ9H4pqhVnBMt1kbew=";
+    hash = "sha256-pQHltHAU5UAOtG7AvxQMI9tFeXApY4+C7+ipk4vG8zs=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/co/complgen/package.nix b/pkgs/by-name/co/complgen/package.nix
index 8ba5d924072b..077bf1f8d3e1 100644
--- a/pkgs/by-name/co/complgen/package.nix
+++ b/pkgs/by-name/co/complgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "complgen";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GUI18RFVIBUu3DA6oVs1BWcsxGzctA68z8PamqJ5aus=";
+    hash = "sha256-fHSDYrfCoLQ4tU1DbrpD3iApufBv5qAGTIFri229pyE=";
   };
 
-  cargoHash = "sha256-XbrWp1+z7VTD4ggh9+tG3fqXWOD1nYSeNzViHqmOmWg=";
+  cargoHash = "sha256-a6bGE2xxv8IdKlo98X8KNeQl8e//dc9pfaBgGHhx+5M=";
 
   meta = {
     changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";
diff --git a/pkgs/by-name/co/corrosion/package.nix b/pkgs/by-name/co/corrosion/package.nix
index cd1250ce1ad0..ab018ed8f613 100644
--- a/pkgs/by-name/co/corrosion/package.nix
+++ b/pkgs/by-name/co/corrosion/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corrosion";
-  version = "0.5.2";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "corrosion-rs";
     repo = "corrosion";
     rev = "v${version}";
-    hash = "sha256-sO2U0llrDOWYYjnfoRZE+/ofg3kb+ajFmqvaweRvT7c=";
+    hash = "sha256-ppuDNObfKhneD9AlnPAvyCRHKW3BidXKglD1j/LE9CM=";
   };
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
@@ -32,12 +32,22 @@ stdenv.mkDerivation rec {
   checkPhase =
     let
       excludedTests = [
-        "cbindgen_rust2cpp_build"
-        "cbindgen_rust2cpp_run_cpp-exe"
+        "cbindgen_install"
+        "cbindgen_manual_build"
+        "cbindgen_manual_run_cpp-exe"
+        "cbindgen_rust2cpp_auto_build"
+        "cbindgen_rust2cpp_auto_run_cpp-exe"
+        "config_discovery_build"
+        "config_discovery_run_cargo_clean"
+        "config_discovery_run_config_discovery"
+        "custom_target_build"
+        "custom_target_run_rust-bin"
+        "custom_target_run_test-exe"
         "hostbuild_build"
         "hostbuild_run_rust-host-program"
-        "parse_target_triple_build"
-        "rustup_proxy_build"
+        "install_lib_build"
+        "install_lib_run_main-shared"
+        "install_lib_run_main-static"
       ];
       excludedTestsRegex = lib.concatStringsSep "|" excludedTests;
     in
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index bfc8bc235283..daed0e15bf7b 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-o64sXCWuEIRV1KCRvKeN6iZBZfUyDYtft5yeag4jBNc=";
+    hash = "sha256-+1cqennGetcjJTgVfglq/LJ22goLQmahPCK/atdHxXU=";
   };
 
   cargoHash = "sha256-uMMrLd3s0SqYCkSA82wWUxMfiTUzuDdsmyxy/MCYIWY=";
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index cef431b4a68d..70d38b0b2521 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-uQaTSt0sgUQYopEFVmaeDCnejSc1gyGLHeHM2bGzStQ=";
+    hash = "sha256-3vIp+Vs4prsFFiTmjrUXoYqH27y6ccVlUQcP5ICFq3g=";
   };
 
   cargoHash = "sha256-I6C5PrIymU8vZ7LvmnSlFFIp0cvlP1umiFMyrAyYf4A=";
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index e2731285a3e8..7ea99d5f72c6 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-tiqJ0aXXUNyoezXSsHO9klkFZ5PO+gkVv+zXd4/Lq5A=";
+    hash = "sha256-LBIcQG3ZebK1bPVJ8WNHkHMLPsEcw77oZAkQRrd4j6o=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index b7e4cf54972b..803a2190b24c 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-PBobAoXi3p1xUbs4XmmPkQ93QlMsULEYUoTDqOlJozg=";
+    hash = "sha256-vhWZpn9FPoH+mTKqCf6ug73FdT7Odr6f8pWNNIDKwFs=";
   };
 
   cargoHash = "sha256-A0d00GdspoYI1fUic8TK9UzaQn39wbnvevD8IiPKC7w=";
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 1ba7ac72a79d..1c4bddab9839 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ZqyaCryXNljJ00qD3ZksfKszANke3HqYgHoGNCHOUqI=";
+    hash = "sha256-4+GfIAsjzo1jr+wa9JjuIUvW3P3r03avP2W5hZJYXHU=";
   };
 
   cargoHash = "sha256-ydI/DTbGlgwc9l/XsW1SbTOfSyTdcjM0i0jXLua4+f8=";
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index c96b17ccd1a1..c664e9d3bf68 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ZX7eRSrQXgc4oitjugvRicng87zVK41ecSUE80tl0Y0=";
+    hash = "sha256-aHNu6IedGWag6u+uRg2IFfcb8fTu5o4XfGwBXJBOkSM=";
   };
 
-  cargoHash = "sha256-CGFBvOWu9ZA8kYDYDBVur5uWW8Cs7fT5T96UnKMkvEo=";
+  cargoHash = "sha256-kzyyKzkuCYqEsaaKhAVH31ztbww4k8XZ5HyBQeYO/Nc=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index 2dd5577ffbc8..4555a5653838 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,14 +19,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-G9ahiwk3/nJEGtlHSaK9dUi4/zGEH90QGKeSdpNQDLU=";
+    hash = "sha256-ivFs/AOUXhzd6I9H+Zw3CS97qFQ/FeiAnlDuzRMneQI=";
   };
 
   cargoHash = "sha256-4yRBgFrH4RBpuvChTED+ynx+PyFumoT2Z+R1gXxF4Xc=";
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index b570a9335547..ba9837db6a9f 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,7 +9,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index 04f8881af359..aa03f36bf220 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index 7808c5e82634..58bc324f4fcf 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-g1FJiJSyPZTJ1G8cW8A0sxbIUeG3JcjJYo6qHp639d4=";
+    hash = "sha256-xeJfS3vXYCy3R20K5jiyPmgZI+arhkzm3Vz6YQnLe9Y=";
   };
 
   cargoHash = "sha256-co7fOPjNLi32XRXKdmCWC+bWhEljsdSc/scasghG4/8=";
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index fc3f0112c9ef..be43c37bbb9e 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-2LfoqXXYzNpWrnmmwm68IzrG63cX04tMFk0Ly7AJzDs=";
+    hash = "sha256-uKTeNTJtsDx0FS3fmvqMbXPTezMkD1dcn5dPKXvmcp4=";
   };
 
   cargoHash = "sha256-bmQ8Ni0sR9gfttsEhh9LNbWmTdOkW/JSMEzOf+kvN98=";
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index 309c2b9b3fb1..55b51602ca0b 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-notifications";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-lvqqeY/FPv+LFTmZoBUuKWCjAGZozGj/yUCphlFuk/g=";
+    hash = "sha256-BNOerRv9w0Y9Wozoc5IOouMjne7XQN/SItSy2LQrK9w=";
   };
 
   cargoHash = "sha256-zyM4iMJs2wPIKIEdji1uJF3WYpPGihFswIK5Wyf6Mns=";
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 445992943b8b..0a9ea87c0d13 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-PNFwlxAdbQpFFIe54AEteWG2YRHGRgjDDUpgDwCxXns=";
+    hash = "sha256-6GuLFy1DKXk//LhhRA62KX1P/X+QSsNCy5Eiwjxqk9M=";
   };
 
   cargoHash = "sha256-DNQvmE/2swrDybjcQfCAjMRkAttjl+ibbLG0HSlcZwU=";
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index 946990275f93..bd102f53d0c2 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,7 +11,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index 69ae94316b23..3fb9f91e3335 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,14 +18,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-wBR8KvARINQ3XO/gs5POj32cVj5Eoa3IuWyAmxajMmY=";
+    hash = "sha256-F5Phk9JgcSc3Hj+2NxVfqq1Ujz8hv3DVJqAP3aEo2Ic=";
   };
 
   cargoHash = "sha256-Z0+6jtvJ3z/ptcqrbvSuXgjH2liASNJwBIKiHbrVBT8=";
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 299d3404bdb0..41f273aa7e25 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index 6b2c0c45713e..f2aee8b9df6b 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-lW1nryM/meZjjC9MOH0fimRejdycfq8REwzH1IeV774=";
+    hash = "sha256-xNEICyR/4EYTPTMnlRTag3Ji5rM8HJl6m9MAe7FdHTk=";
   };
 
   cargoHash = "sha256-O8fFeg1TkKCg+QbTnNjsH52xln4+ophh/BW/b4zQs9o=";
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index 79ab5c4c3851..64ac86039f23 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index eda52dd48000..81306035d0be 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index e0e32d1f8669..413b376c967a 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,14 +27,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-IYuQlXkdakAbchOH2vje02eWCJMBEp7ONtls4Hm/iCo=";
+    hash = "sha256-/Zzs2b51J0v9PavMr3MuNiFBprb7oJiSC+qDVvMTwEk=";
   };
 
   cargoHash = "sha256-XY1ovI73O2jJdx1a5pUk/n6TUazklq7PA+bgva3xslo=";
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 45836f850eda..34d1096550d3 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-na9eRJ9R38wFWOoQSyZj/UlDb5lwvCZrRQ/w/aOqVfY=";
+    hash = "sha256-61O6TY41raQ1+EhCLrCC8Krzt6pWM/BFL61KHkxou2M=";
   };
 
   cargoHash = "sha256-VapIpvjtBo+oSUWtilPR0v5crjDVt0OGdHlx73Gb6Jk=";
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 400b632aaa07..690176cf44e8 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-SmwXRgYgFelVQhx03GaIRWHCm7x/9eXMdVxH06TLxLE=";
+    hash = "sha256-RYRAJhixba8i8hKpZSZLPLza+V9XZuSaZmWknoIJ3mk=";
   };
 
   cargoHash = "sha256-ImWHjEKgu9FQR52A3GjnAkxlPduKuzSUAOANYr0DzMA=";
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 0a99261a8d49..37ca95969c68 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 44225233d0d3..c3b7a8059819 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-wGhXTQujwOqDBcBesXIRkcTJdQAhs0pavsVHMH98QCw=";
+    hash = "sha256-Gg4ogMf2C3rXf3p/8GPpiZ2aG02KWTtrqby47UW7B3I=";
   };
 
   cargoHash = "sha256-ZVl09YgeH+V4X3H88rdeiBgua1IpVcfKe0y8A78wzl4=";
diff --git a/pkgs/by-name/cr/credhub-cli/package.nix b/pkgs/by-name/cr/credhub-cli/package.nix
index e5e437b6069b..33bbe003bb13 100644
--- a/pkgs/by-name/cr/credhub-cli/package.nix
+++ b/pkgs/by-name/cr/credhub-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.52";
+  version = "2.9.53";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-qTRRk7n8f5tC/uiBJgbZpd+tsoOPK5qTgZnqfwi5YlA=";
+    sha256 = "sha256-MbRk0O1WGzr7YLHSub9hLYDvJJacUcCXyg29AOqssxE=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/by-name/cr/crowdin-cli/package.nix b/pkgs/by-name/cr/crowdin-cli/package.nix
index 949730407316..e8e3e27c12da 100644
--- a/pkgs/by-name/cr/crowdin-cli/package.nix
+++ b/pkgs/by-name/cr/crowdin-cli/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crowdin-cli";
-  version = "4.12.0";
+  version = "4.13.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/crowdin-cli/releases/download/${finalAttrs.version}/crowdin-cli.zip";
-    hash = "sha256-y6JBlZ1h/1iWr8r+323sYpQNpzM3pHtC/CzQt4HL7MQ=";
+    hash = "sha256-XnRubOEtaCAH0lJHyBGi7qjLFGZA7tfOGdaaGNOsogY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ct/ctrtool/package.nix b/pkgs/by-name/ct/ctrtool/package.nix
index 0d0c545fd303..4ae0290dcbb4 100644
--- a/pkgs/by-name/ct/ctrtool/package.nix
+++ b/pkgs/by-name/ct/ctrtool/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ctrtool";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jakcron";
     repo = "Project_CTR";
     rev = "ctrtool-v${version}";
-    sha256 = "HqqeQCEUof4EBUhuUAdTruMFgYIoXhtAN3yuWW6tD+Y=";
+    sha256 = "GvEzv97DqCsaDWVqDpajQRWYe+WM8xCYmGE0D3UcSrM=";
   };
 
   sourceRoot = "${src.name}/ctrtool";
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index a00c491bc8b7..cc636e8c2d0b 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.31.0";
+  version = "4.31.1";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8Pb/njUjiyUQZA3UnZ+4INJBnmXCo+F7+BhCDt1hJGQ=";
+    hash = "sha256-c0jQF6XGg0jTMqBbTwRA/ZfD/qocCHILoSujeqJ+lp4=";
   };
 
   vendorHash = "sha256-GMzLaV3LQNa4K111P6DLG28KAAgj9AHyPua4XSih14k=";
diff --git a/pkgs/by-name/ea/eask-cli/package.nix b/pkgs/by-name/ea/eask-cli/package.nix
index 97a289fa105a..eb0cde010adc 100644
--- a/pkgs/by-name/ea/eask-cli/package.nix
+++ b/pkgs/by-name/ea/eask-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "eask-cli";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "emacs-eask";
     repo = "cli";
     rev = version;
-    hash = "sha256-GUOimlbArD1GbeBPfIgcIcGKGHx+fEp6+CMYsqHB0t8=";
+    hash = "sha256-n2NL8B6hxQLB8xdRWzclVlqp3B4K7VxgdQ3zgFC1YyI=";
   };
 
-  npmDepsHash = "sha256-69yGfQuIot0gKZIvLbMqJ0C3qxjqg3TnRDJl4qYHGrQ=";
+  npmDepsHash = "sha256-kHi/8kPTk9hg5NI4u0b+k9OoocHLX2rY3diXt9WMlRo=";
 
   dontBuild = true;
 
diff --git a/pkgs/by-name/es/esphome/dashboard.nix b/pkgs/by-name/es/esphome/dashboard.nix
index 4ca493db7b3a..d292fa9657e6 100644
--- a/pkgs/by-name/es/esphome/dashboard.nix
+++ b/pkgs/by-name/es/esphome/dashboard.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20251013.0";
+  version = "20260110.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "dashboard";
     tag = version;
-    hash = "sha256-PZf9YLtHqeR+5BRVv1yOMVt6NVlbJTj98ukGnO0RV0Q=";
+    hash = "sha256-h8g/MRfOBkiCKNTOM4I6OimsE5ljgsIMQLl1eZLfP3U=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-wWDM4ODlZAjjDonzS4czdBPBaRS0Px2KUlE4AfsqNIQ=";
+    hash = "sha256-DkK2WG7oWHvwYflNdwOMfE0OVP2ICEGAhhTH2rix9zc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 9e1dc9cd80b7..147f8c36b499 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.12.7";
+  version = "2026.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-KC3LbY5mU4xig3kftIuemSz/RAnJ7wZ8eSccr9BKz9Q=";
+    hash = "sha256-TDXOftuj0ls+1TF6LXoX2Q+PzicL0nJP+1SJHi6qvMA=";
   };
 
   patches = [
@@ -95,6 +95,7 @@ python.pkgs.buildPythonApplication rec {
     pyparsing
     pyserial
     pyyaml
+    resvg-py
     ruamel-yaml
     tornado
     tzdata
diff --git a/pkgs/by-name/ex/exoscale-cli/package.nix b/pkgs/by-name/ex/exoscale-cli/package.nix
index 47197da6b2b7..7f67c14216b8 100644
--- a/pkgs/by-name/ex/exoscale-cli/package.nix
+++ b/pkgs/by-name/ex/exoscale-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.90.0";
+  version = "1.90.1";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-dDs0pwOxdwXqYm8al1TUXoZVaBL4vE/PwCcQFhSUarE=";
+    sha256 = "sha256-mRHENBxxumb0eO74N0f04GItlI0jcsKnug45uLxuMdI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index fb8a7ea1f23d..98dee9336f1f 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.57.1";
+  version = "2.58.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-svv6JPRgiXzzjL/CjtEybo0A1B8jr1K0xRO9lCBj1J4=";
+    hash = "sha256-kWMR2qtwgzpYZmbqkpNkII6MuMFb13jkBtI/1pdgSgE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fe/fex/package.nix b/pkgs/by-name/fe/fex/package.nix
index 22c2f199c903..8e251069a1e6 100644
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@@ -95,13 +95,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "fex";
-  version = "2512";
+  version = "2601";
 
   src = fetchFromGitHub {
     owner = "FEX-Emu";
     repo = "FEX";
     tag = "FEX-${finalAttrs.version}";
-    hash = "sha256-G61FdzNctTp8jarTcnBXd+MQpMxnPqd33hblvi9UXNo=";
+    hash = "sha256-AfHOD3S3zDwe85Zr8XEMmI+LrdVEZdXJ9FWQQ+oUNik=";
 
     leaveDotGit = true;
     postFetch = ''
@@ -156,6 +156,12 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     substituteInPlace Source/Tools/FEXConfig/main.qml \
       --replace-fail "config: \"Thunk" "config: \"UnusedThunk" \
       --replace-fail "title: qsTr(\"Library forwarding:\")" "visible: false; title: qsTr(\"Library forwarding:\")"
+
+    # Temporarily disable failing tests. TODO: investigate the root cause of these failures
+    rm \
+      unittests/ASM/Primary/Primary_63_2.asm \
+      unittests/32Bit_ASM/Secondary/07_XX_04.asm \
+      unittests/ASM/Secondary/07_XX_04.asm
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 3c9bf2465022..7c4498e2ae0c 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -3,20 +3,22 @@
   fetchFromGitHub,
   buildGoModule,
   buildNpmPackage,
-  pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
+  nodejs_24,
+  pnpm_10,
   nix-update-script,
   nixosTests,
 }:
+
 let
-  version = "2.44.1";
+  version = "2.55.0";
 
   src = fetchFromGitHub {
     owner = "filebrowser";
     repo = "filebrowser";
     rev = "v${version}";
-    hash = "sha256-ln7Dst+sN99c3snPU7DrIGpwKBz/e4Lz+uOknmm6sxg=";
+    hash = "sha256-1ZzTATJEVBr76+CMk8OzxdpWGqFHPPhyC7z2MgfqN+M=";
   };
 
   frontend = buildNpmPackage rec {
@@ -25,9 +27,10 @@ let
 
     sourceRoot = "${src.name}/frontend";
 
-    nativeBuildInputs = [ pnpm_9 ];
+    nativeBuildInputs = [ pnpm_10 ];
     npmConfigHook = pnpmConfigHook;
     npmDeps = pnpmDeps;
+    nodejs = nodejs_24;
 
     pnpmDeps = fetchPnpmDeps {
       inherit
@@ -36,9 +39,9 @@ let
         src
         sourceRoot
         ;
-      pnpm = pnpm_9;
-      fetcherVersion = 2;
-      hash = "sha256-3n44BGJLdQR6uBSF09oyUzJm35/S3/ZEyZh4Wxqlfiw=";
+      fetcherVersion = 3;
+      pnpm = pnpm_10;
+      hash = "sha256-iv0LZoEyF5fASqBKNkTJhLMY0Xpa6x0i4csDoHmGU+g=";
     };
 
     installPhase = ''
@@ -50,12 +53,13 @@ let
       runHook postInstall
     '';
   };
+
 in
 buildGoModule {
   pname = "filebrowser";
   inherit version src;
 
-  vendorHash = "sha256-aVtL64Cm+nqum/qHFvplpEawgMXM2S6l8QFrJBzLVtU=";
+  vendorHash = "sha256-4WDggP5eL7IPUWTxewxV2JUZZ3kV0PwewQQothz7AC8=";
 
   excludedPackages = [ "tools" ];
 
diff --git a/pkgs/by-name/fo/forge-mtg/package.nix b/pkgs/by-name/fo/forge-mtg/package.nix
index 87e50d99a892..737261cc0e6f 100644
--- a/pkgs/by-name/fo/forge-mtg/package.nix
+++ b/pkgs/by-name/fo/forge-mtg/package.nix
@@ -16,13 +16,13 @@
 }:
 
 let
-  version = "2.0.08";
+  version = "2.0.09";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-BiBvHpEgvDp0u8g87LAt4/1FTc9t8FRAtSvPEedndEg=";
+    hash = "sha256-TRK6fUOLbI3lLdkSXvvuix0sGbpKLvMmYMx5ozViDRE=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.
diff --git a/pkgs/by-name/fr/framework-tool/package.nix b/pkgs/by-name/fr/framework-tool/package.nix
index 0a98787317a7..fec50684f259 100644
--- a/pkgs/by-name/fr/framework-tool/package.nix
+++ b/pkgs/by-name/fr/framework-tool/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "framework-tool";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "FrameworkComputer";
     repo = "framework-system";
     tag = "v${version}";
-    hash = "sha256-WhdKU6vyOm5R9RInw9Fj8gELztLn4m5rFGgHbnItguU=";
+    hash = "sha256-wgleuZ0txkmv0+tyr31PiVTNyTSc+OPy/jJwL1Ryyu4=";
   };
 
-  cargoHash = "sha256-A7/Q4p26W0AzqlLguL2OJtmm7dAsBU/Yb636ScYXrPs=";
+  cargoHash = "sha256-W+k/PAcdwl9mvajB9D4SUH4o5VqpeD/BnK6ZEJzPpmI=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/fr/freedink/package.nix b/pkgs/by-name/fr/freedink/package.nix
index 3917d5cc78ac..403987aa189c 100644
--- a/pkgs/by-name/fr/freedink/package.nix
+++ b/pkgs/by-name/fr/freedink/package.nix
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://gnu.org/software/freedink/"; # Formerly http://www.freedink.org
     license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     platforms = lib.platforms.all;
     mainProgram = "freedink";
   };
diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix
index 976a8ed25215..aa35c96df451 100644
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.24.4";
+  version = "0.25.0";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-xteIV43P5qPOamxsGjCXeCkd1zQmNNbMhvzSWc26DQU=";
+    hash = "sha256-7Co3DPZs/ZtdLfhZnOcpdFFQPnyeLkvxTZG+tv+FbBQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index d7f8e3c8f2ef..27436f623268 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.85.0";
+  version = "2.86.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-XngvPEVrUNKuNs+9/osXEagwqe0KW25xFwEjcPfMO0M=";
+    hash = "sha256-+MPhDgXIVfYGp5ALI5GjRoeLRRUtNgpzUawxoqR76iE=";
   };
 
   vendorHash = "sha256-pBHEqMgEoR3sWNbQjGBNso7WLP9Rz2gu89Bzu+7jz5c=";
diff --git a/pkgs/by-name/gn/gnome-inform7/package.nix b/pkgs/by-name/gn/gnome-inform7/package.nix
index 7641a6deb55a..3a3aaeccc1bc 100644
--- a/pkgs/by-name/gn/gnome-inform7/package.nix
+++ b/pkgs/by-name/gn/gnome-inform7/package.nix
@@ -24,7 +24,7 @@
   gtksourceview3,
   gspell,
   libxml2,
-  goocanvas2,
+  goocanvas_2,
   libplist,
   glib,
   gst_all_1,
@@ -126,7 +126,7 @@ stdenv.mkDerivation {
     gspell
     # webkitgtk_4_0
     libxml2
-    goocanvas2
+    goocanvas_2
     libplist
     ratify
     chimara
diff --git a/pkgs/development/libraries/goocanvas/default.nix b/pkgs/by-name/go/goocanvas_1/package.nix
similarity index 100%
rename from pkgs/development/libraries/goocanvas/default.nix
rename to pkgs/by-name/go/goocanvas_1/package.nix
diff --git a/pkgs/development/libraries/goocanvas/2.x.nix b/pkgs/by-name/go/goocanvas_2/package.nix
similarity index 100%
rename from pkgs/development/libraries/goocanvas/2.x.nix
rename to pkgs/by-name/go/goocanvas_2/package.nix
diff --git a/pkgs/development/libraries/goocanvas/gcc14-fix.patch b/pkgs/by-name/go/goocanvas_3/gcc14-fix.patch
similarity index 100%
rename from pkgs/development/libraries/goocanvas/gcc14-fix.patch
rename to pkgs/by-name/go/goocanvas_3/gcc14-fix.patch
diff --git a/pkgs/development/libraries/goocanvas/3.x.nix b/pkgs/by-name/go/goocanvas_3/package.nix
similarity index 100%
rename from pkgs/development/libraries/goocanvas/3.x.nix
rename to pkgs/by-name/go/goocanvas_3/package.nix
diff --git a/pkgs/by-name/go/goocanvasmm2/package.nix b/pkgs/by-name/go/goocanvasmm2/package.nix
index 61ea379b1b46..04f5476958a6 100644
--- a/pkgs/by-name/go/goocanvasmm2/package.nix
+++ b/pkgs/by-name/go/goocanvasmm2/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   pkg-config,
-  goocanvas2,
+  goocanvas_2,
   gtkmm3,
   gnome,
 }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   propagatedBuildInputs = [
     gtkmm3
-    goocanvas2
+    goocanvas_2
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/go/goodhosts/package.nix b/pkgs/by-name/go/goodhosts/package.nix
index ef9daeab99e5..b1e5d6aa86d7 100644
--- a/pkgs/by-name/go/goodhosts/package.nix
+++ b/pkgs/by-name/go/goodhosts/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "goodhosts";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "goodhosts";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-ZasS7AYGYPV+nzp9JbJC5pD0yQ+ik+QnuL+3qC1uqFk=";
+    hash = "sha256-+KlAJV+CeycQHwxrRI9kMkKlDLs8bS+/QwaYv70LEfU=";
   };
 
   ldflags = [
@@ -24,7 +24,7 @@ buildGoModule rec {
     mv $out/bin/cli $out/bin/goodhosts
   '';
 
-  vendorHash = "sha256-t/pdJWz6rLnBbH8iq9Nqy+E+DD2770UCEcowwStPdqM=";
+  vendorHash = "sha256-FsjCpwvehmRm67Tqwld+0vn4IFO6E46SJnLwRjKVAiw=";
 
   meta = {
     description = "CLI tool for managing hostfiles";
diff --git a/pkgs/by-name/go/google-clasp/package.nix b/pkgs/by-name/go/google-clasp/package.nix
index 3fd93c28c410..8c14181a2f92 100644
--- a/pkgs/by-name/go/google-clasp/package.nix
+++ b/pkgs/by-name/go/google-clasp/package.nix
@@ -2,27 +2,32 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  fetchpatch,
 }:
 
 buildNpmPackage rec {
   pname = "clasp";
-  version = "2.5.0";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "clasp";
     tag = "v${version}";
-    hash = "sha256-Wt9caSgYNSx6yVUm3eg86GNdrheqHM5IYY8QohclHkQ=";
+    hash = "sha256-Pxt3MaDDsk/qq3NSuwG3jOoPthwrL0QelaruoC37hfA=";
   };
 
-  npmDepsHash = "sha256-iRC2iLNe/4ZP2liUDjIgyMNtlmjcXAGdSmhx3qFBjsA=";
+  patches = [
+    # https://github.com/google/clasp/pull/1112
+    (fetchpatch {
+      url = "https://github.com/google/clasp/commit/b183d4b5fbdb51f7bc2e3edadf5fd3bbff28bad1.patch";
+      hash = "sha256-lnC7DfKsV4E5guxbjZ+WfkLj5wDLYwObPtH21dmFUcc=";
+    })
+  ];
+
+  npmDepsHash = "sha256-IyFcGcT3ceoaaf2sCPriEIoWPavg+YGsvkxr1MkLj5c=";
 
   # `npm run build` tries installing clasp globally
   npmBuildScript = [ "compile" ];
-  # Remove dangling symlink of a dependency
-  postInstall = ''
-    rm $out/lib/node_modules/@google/clasp/node_modules/.bin/sshpk-{verify,sign,conv}
-  '';
 
   meta = {
     description = "Develop Apps Script Projects locally";
diff --git a/pkgs/by-name/gp/gpredict-unstable/package.nix b/pkgs/by-name/gp/gpredict-unstable/package.nix
index ece1d7dbf747..c5aee98340e0 100644
--- a/pkgs/by-name/gp/gpredict-unstable/package.nix
+++ b/pkgs/by-name/gp/gpredict-unstable/package.nix
@@ -1,13 +1,13 @@
 {
   lib,
   fetchFromGitHub,
-  goocanvas3,
+  goocanvas_3,
   nix-update-script,
   gpredict,
 }:
 
 (gpredict.override {
-  goocanvas2 = goocanvas3;
+  goocanvas_2 = goocanvas_3;
 }).overrideAttrs
   (finalAttrs: {
     version = "2.2.1-unstable-2025-09-20";
diff --git a/pkgs/by-name/gp/gpredict/package.nix b/pkgs/by-name/gp/gpredict/package.nix
index b9adf285d466..c44036ffd038 100644
--- a/pkgs/by-name/gp/gpredict/package.nix
+++ b/pkgs/by-name/gp/gpredict/package.nix
@@ -9,7 +9,7 @@
   gtk3,
   glib,
   curl,
-  goocanvas2,
+  goocanvas_2,
   gpsd,
   hamlib_4,
   wrapGAppsHook3,
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     glib
     gtk3
-    goocanvas2
+    goocanvas_2
     gpsd
     hamlib_4
   ];
diff --git a/pkgs/by-name/gr/grpc-gateway/package.nix b/pkgs/by-name/gr/grpc-gateway/package.nix
index 482b1520591b..3ce546e565f6 100644
--- a/pkgs/by-name/gr/grpc-gateway/package.nix
+++ b/pkgs/by-name/gr/grpc-gateway/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "grpc-gateway";
-  version = "2.27.4";
+  version = "2.27.5";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     tag = "v${version}";
-    sha256 = "sha256-4bhEQTVV04EyX/qJGNMIAQDcMWcDVr1tFkEjBHpc2CA=";
+    sha256 = "sha256-xPm5oBxmtCfrOAIKoLMQFZA7PAp/buz6QRwQ8HFFpq4=";
   };
 
-  vendorHash = "sha256-ohZW/uPdt08Y2EpIQ2yeyGSjV9O58+QbQQqYrs6O8/g=";
+  vendorHash = "sha256-eEif65wAE06UNkkmDHz781DDuFPOTLkdvDq++XSP8XY=";
 
   ldflags = [
     "-X=main.version=${version}"
diff --git a/pkgs/development/libraries/gssdp/tools.nix b/pkgs/by-name/gs/gssdp-tools/package.nix
similarity index 100%
rename from pkgs/development/libraries/gssdp/tools.nix
rename to pkgs/by-name/gs/gssdp-tools/package.nix
diff --git a/pkgs/development/libraries/gssdp/standalone-tools.patch b/pkgs/by-name/gs/gssdp-tools/standalone-tools.patch
similarity index 100%
rename from pkgs/development/libraries/gssdp/standalone-tools.patch
rename to pkgs/by-name/gs/gssdp-tools/standalone-tools.patch
diff --git a/pkgs/development/libraries/gssdp/default.nix b/pkgs/by-name/gs/gssdp/package.nix
similarity index 100%
rename from pkgs/development/libraries/gssdp/default.nix
rename to pkgs/by-name/gs/gssdp/package.nix
diff --git a/pkgs/development/libraries/gssdp/1.6.nix b/pkgs/by-name/gs/gssdp_1_6/package.nix
similarity index 100%
rename from pkgs/development/libraries/gssdp/1.6.nix
rename to pkgs/by-name/gs/gssdp_1_6/package.nix
diff --git a/pkgs/development/libraries/gtk-sharp/builder.sh b/pkgs/by-name/gt/gtk-sharp-2_0/builder.sh
similarity index 100%
rename from pkgs/development/libraries/gtk-sharp/builder.sh
rename to pkgs/by-name/gt/gtk-sharp-2_0/builder.sh
diff --git a/pkgs/development/libraries/gtk-sharp/2.0.nix b/pkgs/by-name/gt/gtk-sharp-2_0/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtk-sharp/2.0.nix
rename to pkgs/by-name/gt/gtk-sharp-2_0/package.nix
diff --git a/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh b/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
new file mode 100644
index 000000000000..946b65d98a58
--- /dev/null
+++ b/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
@@ -0,0 +1,9 @@
+genericBuild
+
+# !!! hack
+export ALL_INPUTS="$out $pkgs"
+
+find $out -name "*.dll.config" | while read configFile; do
+    echo "modifying config file $configFile"
+    $monoDLLFixer "$configFile"
+done
diff --git a/pkgs/development/libraries/gtk-sharp/3.0.nix b/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtk-sharp/3.0.nix
rename to pkgs/by-name/gt/gtk-sharp-3_0/package.nix
diff --git a/pkgs/development/libraries/gtk/hooks/clean-immodules-cache.sh b/pkgs/by-name/gt/gtk2/hooks/clean-immodules-cache.sh
similarity index 100%
rename from pkgs/development/libraries/gtk/hooks/clean-immodules-cache.sh
rename to pkgs/by-name/gt/gtk2/hooks/clean-immodules-cache.sh
diff --git a/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh b/pkgs/by-name/gt/gtk2/hooks/drop-icon-theme-cache.sh
similarity index 100%
rename from pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
rename to pkgs/by-name/gt/gtk2/hooks/drop-icon-theme-cache.sh
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/by-name/gt/gtk2/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtk/2.x.nix
rename to pkgs/by-name/gt/gtk2/package.nix
diff --git a/pkgs/development/libraries/gtk/patches/2.0-clang.patch b/pkgs/by-name/gt/gtk2/patches/2.0-clang.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/2.0-clang.patch
rename to pkgs/by-name/gt/gtk2/patches/2.0-clang.patch
diff --git a/pkgs/development/libraries/gtk/patches/2.0-darwin-x11.patch b/pkgs/by-name/gt/gtk2/patches/2.0-darwin-x11.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/2.0-darwin-x11.patch
rename to pkgs/by-name/gt/gtk2/patches/2.0-darwin-x11.patch
diff --git a/pkgs/development/libraries/gtk/patches/2.0-gnome_bugzilla_557780_306776_freeciv_darwin.patch b/pkgs/by-name/gt/gtk2/patches/2.0-gnome_bugzilla_557780_306776_freeciv_darwin.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/2.0-gnome_bugzilla_557780_306776_freeciv_darwin.patch
rename to pkgs/by-name/gt/gtk2/patches/2.0-gnome_bugzilla_557780_306776_freeciv_darwin.patch
diff --git a/pkgs/development/libraries/gtk/patches/2.0-immodules.cache.patch b/pkgs/by-name/gt/gtk2/patches/2.0-immodules.cache.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/2.0-immodules.cache.patch
rename to pkgs/by-name/gt/gtk2/patches/2.0-immodules.cache.patch
diff --git a/pkgs/development/libraries/gtk/patches/gtk2-theme-paths.patch b/pkgs/by-name/gt/gtk2/patches/gtk2-theme-paths.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/gtk2-theme-paths.patch
rename to pkgs/by-name/gt/gtk2/patches/gtk2-theme-paths.patch
diff --git a/pkgs/by-name/gt/gtk3/hooks/clean-immodules-cache.sh b/pkgs/by-name/gt/gtk3/hooks/clean-immodules-cache.sh
new file mode 100644
index 000000000000..0868a4a39101
--- /dev/null
+++ b/pkgs/by-name/gt/gtk3/hooks/clean-immodules-cache.sh
@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+
+fixupOutputHooks+=(_gtkCleanImmodulesCache)
+
+# Clean comments that link to generator of the file
+_gtkCleanImmodulesCache() {
+    # gtk_module_path is where the modules are installed
+    # https://gitlab.gnome.org/GNOME/gtk/-/blob/3.24.24/gtk/gtkmodules.c#L68
+    # gtk_binary_version can be retrived with:
+    # pkg-config --variable=gtk_binary_version gtk+-3.0
+    local f="${prefix:?}/lib/@gtk_module_path@/@gtk_binary_version@/immodules.cache"
+    if [ -f "$f" ]; then
+        sed 's|Created by .*bin/gtk-query-|Created by bin/gtk-query-|' -i "$f"
+    fi
+}
diff --git a/pkgs/by-name/gt/gtk3/hooks/drop-icon-theme-cache.sh b/pkgs/by-name/gt/gtk3/hooks/drop-icon-theme-cache.sh
new file mode 100644
index 000000000000..0762285843eb
--- /dev/null
+++ b/pkgs/by-name/gt/gtk3/hooks/drop-icon-theme-cache.sh
@@ -0,0 +1,19 @@
+# shellcheck shell=bash
+
+# Packages often run gtk-update-icon-cache to include their icons in themes’ icon cache.
+# However, since each package is installed to its own prefix, the files will only collide.
+dropIconThemeCache() {
+    if [[ -z "${dontDropIconThemeCache:-}" ]]; then
+        local icondir="${out:?}/share/icons"
+        if [[ -d "${icondir}" ]]; then
+            # App icons are supposed to go to hicolor theme, since it is a fallback theme as per [icon-theme-spec], but some might still choose to install stylized icons to other themes.
+            find "${icondir}" -name 'icon-theme.cache' -print0 \
+              | while IFS= read -r -d '' file; do
+                echo "Removing ${file}"
+                rm -f "${file}"
+            done
+        fi
+    fi
+}
+
+appendToVar preFixupPhases dropIconThemeCache
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/by-name/gt/gtk3/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtk/3.x.nix
rename to pkgs/by-name/gt/gtk3/package.nix
diff --git a/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch b/pkgs/by-name/gt/gtk3/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
rename to pkgs/by-name/gt/gtk3/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
diff --git a/pkgs/development/libraries/gtk/patches/3.0-darwin-x11.patch b/pkgs/by-name/gt/gtk3/patches/3.0-darwin-x11.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/3.0-darwin-x11.patch
rename to pkgs/by-name/gt/gtk3/patches/3.0-darwin-x11.patch
diff --git a/pkgs/development/libraries/gtk/patches/3.0-immodules.cache.patch b/pkgs/by-name/gt/gtk3/patches/3.0-immodules.cache.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/3.0-immodules.cache.patch
rename to pkgs/by-name/gt/gtk3/patches/3.0-immodules.cache.patch
diff --git a/pkgs/development/libraries/gtk/patches/3.0-mr5531-backport.patch b/pkgs/by-name/gt/gtk3/patches/3.0-mr5531-backport.patch
similarity index 100%
rename from pkgs/development/libraries/gtk/patches/3.0-mr5531-backport.patch
rename to pkgs/by-name/gt/gtk3/patches/3.0-mr5531-backport.patch
diff --git a/pkgs/by-name/gt/gtk4/hooks/clean-immodules-cache.sh b/pkgs/by-name/gt/gtk4/hooks/clean-immodules-cache.sh
new file mode 100644
index 000000000000..0868a4a39101
--- /dev/null
+++ b/pkgs/by-name/gt/gtk4/hooks/clean-immodules-cache.sh
@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+
+fixupOutputHooks+=(_gtkCleanImmodulesCache)
+
+# Clean comments that link to generator of the file
+_gtkCleanImmodulesCache() {
+    # gtk_module_path is where the modules are installed
+    # https://gitlab.gnome.org/GNOME/gtk/-/blob/3.24.24/gtk/gtkmodules.c#L68
+    # gtk_binary_version can be retrived with:
+    # pkg-config --variable=gtk_binary_version gtk+-3.0
+    local f="${prefix:?}/lib/@gtk_module_path@/@gtk_binary_version@/immodules.cache"
+    if [ -f "$f" ]; then
+        sed 's|Created by .*bin/gtk-query-|Created by bin/gtk-query-|' -i "$f"
+    fi
+}
diff --git a/pkgs/by-name/gt/gtk4/hooks/drop-icon-theme-cache.sh b/pkgs/by-name/gt/gtk4/hooks/drop-icon-theme-cache.sh
new file mode 100644
index 000000000000..0762285843eb
--- /dev/null
+++ b/pkgs/by-name/gt/gtk4/hooks/drop-icon-theme-cache.sh
@@ -0,0 +1,19 @@
+# shellcheck shell=bash
+
+# Packages often run gtk-update-icon-cache to include their icons in themes’ icon cache.
+# However, since each package is installed to its own prefix, the files will only collide.
+dropIconThemeCache() {
+    if [[ -z "${dontDropIconThemeCache:-}" ]]; then
+        local icondir="${out:?}/share/icons"
+        if [[ -d "${icondir}" ]]; then
+            # App icons are supposed to go to hicolor theme, since it is a fallback theme as per [icon-theme-spec], but some might still choose to install stylized icons to other themes.
+            find "${icondir}" -name 'icon-theme.cache' -print0 \
+              | while IFS= read -r -d '' file; do
+                echo "Removing ${file}"
+                rm -f "${file}"
+            done
+        fi
+    fi
+}
+
+appendToVar preFixupPhases dropIconThemeCache
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/by-name/gt/gtk4/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtk/4.x.nix
rename to pkgs/by-name/gt/gtk4/package.nix
diff --git a/pkgs/development/libraries/gtkmm/2.x.nix b/pkgs/by-name/gt/gtkmm2/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtkmm/2.x.nix
rename to pkgs/by-name/gt/gtkmm2/package.nix
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/by-name/gt/gtkmm3/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtkmm/3.x.nix
rename to pkgs/by-name/gt/gtkmm3/package.nix
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/by-name/gt/gtkmm4/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtkmm/4.x.nix
rename to pkgs/by-name/gt/gtkmm4/package.nix
diff --git a/pkgs/development/libraries/gtksourceviewmm/default.nix b/pkgs/by-name/gt/gtksourceviewmm/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtksourceviewmm/default.nix
rename to pkgs/by-name/gt/gtksourceviewmm/package.nix
diff --git a/pkgs/development/libraries/gtksourceviewmm/4.x.nix b/pkgs/by-name/gt/gtksourceviewmm4/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtksourceviewmm/4.x.nix
rename to pkgs/by-name/gt/gtksourceviewmm4/package.nix
diff --git a/pkgs/development/libraries/gtkspell/gettext-0.25.patch b/pkgs/by-name/gt/gtkspell2/gettext-0.25.patch
similarity index 100%
rename from pkgs/development/libraries/gtkspell/gettext-0.25.patch
rename to pkgs/by-name/gt/gtkspell2/gettext-0.25.patch
diff --git a/pkgs/development/libraries/gtkspell/default.nix b/pkgs/by-name/gt/gtkspell2/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtkspell/default.nix
rename to pkgs/by-name/gt/gtkspell2/package.nix
diff --git a/pkgs/development/libraries/gtkspell/3.nix b/pkgs/by-name/gt/gtkspell3/package.nix
similarity index 100%
rename from pkgs/development/libraries/gtkspell/3.nix
rename to pkgs/by-name/gt/gtkspell3/package.nix
diff --git a/pkgs/development/libraries/gupnp/0001-pkg-config-Declare-header-dependencies-as-public.patch b/pkgs/by-name/gu/gupnp/0001-pkg-config-Declare-header-dependencies-as-public.patch
similarity index 100%
rename from pkgs/development/libraries/gupnp/0001-pkg-config-Declare-header-dependencies-as-public.patch
rename to pkgs/by-name/gu/gupnp/0001-pkg-config-Declare-header-dependencies-as-public.patch
diff --git a/pkgs/development/libraries/gupnp/default.nix b/pkgs/by-name/gu/gupnp/package.nix
similarity index 100%
rename from pkgs/development/libraries/gupnp/default.nix
rename to pkgs/by-name/gu/gupnp/package.nix
diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/by-name/gu/gupnp_1_6/package.nix
similarity index 100%
rename from pkgs/development/libraries/gupnp/1.6.nix
rename to pkgs/by-name/gu/gupnp_1_6/package.nix
diff --git a/pkgs/development/libraries/hamlib/default.nix b/pkgs/by-name/ha/hamlib_3/package.nix
similarity index 100%
rename from pkgs/development/libraries/hamlib/default.nix
rename to pkgs/by-name/ha/hamlib_3/package.nix
diff --git a/pkgs/development/libraries/hamlib/4.nix b/pkgs/by-name/ha/hamlib_4/package.nix
similarity index 100%
rename from pkgs/development/libraries/hamlib/4.nix
rename to pkgs/by-name/ha/hamlib_4/package.nix
diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index 4788ff4c2e85..fbfa8928552d 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -15,7 +15,7 @@ buildGoModule (finalAttrs: {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZlpOBYUQ6J3RsFHkoPo9Y039DpBlJTWRCkXFyLKXshU=";
+    hash = "sha256-bU42N2+zyOqdiJFbgaqcxsApdslQFOleythDE6hs8sY=";
   };
 
   vendorHash = "sha256-qTaXIkZ1g7jsPV4IkduIS6REIhs9JJcS2mOg3V77DTg=";
diff --git a/pkgs/by-name/ha/havn/package.nix b/pkgs/by-name/ha/havn/package.nix
index a1646b021ce8..71e6cc2151ae 100644
--- a/pkgs/by-name/ha/havn/package.nix
+++ b/pkgs/by-name/ha/havn/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "havn";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "mrjackwills";
     repo = "havn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r+HaM54JuHhlNMTxfX6Dmc5EK7zAWavE623kRhAnN7Y=";
+    hash = "sha256-1NzOEnLgfvANE4N4Kt2HxJSxV8EdI1OWTsP993kUi4U=";
   };
 
-  cargoHash = "sha256-J1RjxsChLbi5OrP+IObHq4LOEWNBCwQiwyV35EyYIuI=";
+  cargoHash = "sha256-Ja99sc28n/djr+TpO9lQRMZ+fcc3nI7iO291p2qfjDI=";
 
   checkFlags = [
     # Skip tests that require network access
diff --git a/pkgs/development/libraries/kerberos/0001-Define-HAVE_DB_185_H.patch b/pkgs/by-name/he/heimdal/0001-Define-HAVE_DB_185_H.patch
similarity index 100%
rename from pkgs/development/libraries/kerberos/0001-Define-HAVE_DB_185_H.patch
rename to pkgs/by-name/he/heimdal/0001-Define-HAVE_DB_185_H.patch
diff --git a/pkgs/development/libraries/kerberos/0001-Include-db.h-for-nbdb-compat-mode.patch b/pkgs/by-name/he/heimdal/0001-Include-db.h-for-nbdb-compat-mode.patch
similarity index 100%
rename from pkgs/development/libraries/kerberos/0001-Include-db.h-for-nbdb-compat-mode.patch
rename to pkgs/by-name/he/heimdal/0001-Include-db.h-for-nbdb-compat-mode.patch
diff --git a/pkgs/development/libraries/kerberos/0001-Link-tests-with-libresolv.patch b/pkgs/by-name/he/heimdal/0001-Link-tests-with-libresolv.patch
similarity index 100%
rename from pkgs/development/libraries/kerberos/0001-Link-tests-with-libresolv.patch
rename to pkgs/by-name/he/heimdal/0001-Link-tests-with-libresolv.patch
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/by-name/he/heimdal/package.nix
similarity index 100%
rename from pkgs/development/libraries/kerberos/heimdal.nix
rename to pkgs/by-name/he/heimdal/package.nix
diff --git a/pkgs/development/libraries/hspell/default.nix b/pkgs/by-name/hs/hspell/package.nix
similarity index 100%
rename from pkgs/development/libraries/hspell/default.nix
rename to pkgs/by-name/hs/hspell/package.nix
diff --git a/pkgs/development/libraries/hspell/remove-shared-library-checks.patch b/pkgs/by-name/hs/hspell/remove-shared-library-checks.patch
similarity index 100%
rename from pkgs/development/libraries/hspell/remove-shared-library-checks.patch
rename to pkgs/by-name/hs/hspell/remove-shared-library-checks.patch
diff --git a/pkgs/by-name/hy/hydroxide/package.nix b/pkgs/by-name/hy/hydroxide/package.nix
index d50975f1831f..75cee63d0477 100644
--- a/pkgs/by-name/hy/hydroxide/package.nix
+++ b/pkgs/by-name/hy/hydroxide/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hydroxide";
-  version = "0.2.30";
+  version = "0.2.31";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "hydroxide";
     rev = "v${version}";
-    sha256 = "sha256-PjT8kIS2k4e9Xuw6uCXiCtg5Rawvcmslzz9Qa4Wnroo=";
+    sha256 = "sha256-92eyt+s+kEXRuIXPRmbIQG5Mth7wJFCruqTN3wL5DhI=";
   };
 
-  vendorHash = "sha256-NKWUpyS5IHBTPzjfTkov/ypoGQW6inX32Y7lpdIDOUc=";
+  vendorHash = "sha256-CjvvVFjYRlykZwEqHtuD9qc/MsHZsJtKy2G6e2N7K0M=";
 
   doCheck = false;
 
diff --git a/pkgs/development/libraries/indicator-application/gtk2.nix b/pkgs/by-name/in/indicator-application-gtk2/package.nix
similarity index 100%
rename from pkgs/development/libraries/indicator-application/gtk2.nix
rename to pkgs/by-name/in/indicator-application-gtk2/package.nix
diff --git a/pkgs/development/libraries/indicator-application/gtk3.nix b/pkgs/by-name/in/indicator-application-gtk3/package.nix
similarity index 100%
rename from pkgs/development/libraries/indicator-application/gtk3.nix
rename to pkgs/by-name/in/indicator-application-gtk3/package.nix
diff --git a/pkgs/by-name/ja/jabref/deps.json b/pkgs/by-name/ja/jabref/deps.json
index cf671cd8725e..806de87d2389 100644
--- a/pkgs/by-name/ja/jabref/deps.json
+++ b/pkgs/by-name/ja/jabref/deps.json
@@ -652,13 +652,13 @@
    "jar": "sha256-bNkZkTI917L7KMqT16wSr1qGovUyeeKzWCezAxP9C58=",
    "pom": "sha256-rECp8tDB7mMfw7CO+OLwvRS6IgEcp2/xvPZftWnq3zU="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.4.1": {
-   "jar": "sha256-JolZk48cG8O1VeIihdIEVdoPOrCAaEuSfBvK5VTZFNM=",
-   "module": "sha256-QfjCNSMXc2dWDubRXMC9a8GqRP6x2BjXihzt2+IMC40=",
-   "pom": "sha256-G9F/hR9bve0OCz16YZzBdxKrmEXqpFu8ypBxX86jEF8="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.4.2": {
+   "jar": "sha256-MwhkX0Z7Jm5YhMJkUIIktnKejtwWbm1DX1tibBTg/Rk=",
+   "module": "sha256-kxqze7wDwJHt/8RtlqYLXk+isLTV2UWLkscm4FpR0NM=",
+   "pom": "sha256-VGkK7nfKVycLvqXnhrnTPiOvYIzuIVuIDvcq45v5aU8="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.4.1": {
-   "pom": "sha256-9FhdUWKX7VtEyA0nq82/XKA0aCx1B4E+8UAHLhDYts4="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.4.2": {
+   "pom": "sha256-Xi2xvrvUHGTWc1VEsphssmofxmiX0ZCXnJC1C4fIXfo="
   },
   "org/gradle/toolchains#foojay-resolver/1.0.0": {
    "jar": "sha256-eLhqR9/fdpfJvRXaeJg/2A2nJH1uAvwQa98H4DiLYKg=",
@@ -762,146 +762,146 @@
    "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
    "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.2.20": {
-   "jar": "sha256-8chm6sXcCI8/0IEQCENAm/TxYSu7mY+6ofaFMlyuDVU=",
-   "pom": "sha256-HOL7NczYP8vJCuXFmN/bsilS0IVHgElEpbIfLEbKwL0="
+  "org/jetbrains/kotlin#abi-tools-api/2.2.21": {
+   "jar": "sha256-I5kB8xfBibS0zIvF6WaUPcGeOSWVOeZouqXX7xjrkWo=",
+   "pom": "sha256-kkkKzKD0UFgdVs4FeWHY/6mDVYfmn2bpbQpxdbrOzYU="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.20": {
-   "module": "sha256-n+aVWzf+KQtlFiXPnGgea6IKjxLEZYzOUCblk1BaMSk=",
-   "pom": "sha256-P6gmRiy9hG0YAgLyLFGTQYy5zan2lcmUEjWpsbXBQdk="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.21": {
+   "module": "sha256-SVZZs54wVUHstxLmm2IuE+OK2SQPmoJ8oFhDS9mfIR0=",
+   "pom": "sha256-JQzsmn5XTCwRF+7PBCHjIAHqDzSwqQHH+k6tb+jd7aQ="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.20/gradle813": {
-   "jar": "sha256-OmlZW2x1+/ktMgFodFxpj/cRS4YHhBBQ1ISYgjAG6HE="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.21/gradle813": {
+   "jar": "sha256-J9z0rqpbu2TYYb0p7WDUgvD/2WJEyB4kJrnaxef9xj8="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.2.20": {
-   "jar": "sha256-07TapcbMI1Zfj7k2NI84xCGgRhFjdF02rt9E096UJQo=",
-   "pom": "sha256-L/XBHfd+t6JZdmzdqed47WW6SFxYxhO7ppAoauzi3H0="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.2.21": {
+   "jar": "sha256-JmFrjhshTWLwLRUzHK/3JcToI3ziCtFPXMznJKop588=",
+   "pom": "sha256-Bhpvb0xNvpCtDeOeUeeKuvtmf+jJsJXODA3qM1aPQh8="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.2.20": {
-   "module": "sha256-xbfmG95gHQM75qCyXhkxfc9u434wVC/XRsRr/3gBj1o=",
-   "pom": "sha256-fh3mglHYFXQXuKIXn2YlW8m5zzFTPdkDukFVZlwwXGs="
+  "org/jetbrains/kotlin#kotlin-assignment/2.2.21": {
+   "module": "sha256-GNfXYm3tHJiZC9JhNVjUmrJfY7eGx360iKmdirZaxhM=",
+   "pom": "sha256-rzH4fPfA2i55da7DPjYB0T/HeWaE0VVTaX3uJJtt7tQ="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.2.20/gradle813": {
-   "jar": "sha256-MYCcvl5312WyQRFT6huuR2cQQGoXfjmhC/ZKYSOgRfI="
+  "org/jetbrains/kotlin#kotlin-assignment/2.2.21/gradle813": {
+   "jar": "sha256-hxwwVHmuFrFE1AwgTr3/AZEwBejpjasXs2XFRaJZ9R0="
   },
   "org/jetbrains/kotlin#kotlin-bom/2.0.21": {
    "pom": "sha256-1Ufg3iVCLZY+IsepRPO13pQ8akmClbUtv/49KJXNm+g="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.2.20": {
-   "jar": "sha256-+2VKT1vFY2h1kXMSnfSRB60J3FtBcrAXda+z+nJXndU=",
-   "pom": "sha256-tdU2T1fSH/FBgiBei2lf1oZNnYqleApu3EIJWEBHwRU="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.2.21": {
+   "jar": "sha256-jf37K49n/NzEzuPvkKJa9GfKKVhTsOoBnQAQrOvW8Yo=",
+   "pom": "sha256-yL9i9tym159DbECxrwnbQvRuv0vNcrMHnfjHJbXAY1g="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.20": {
-   "jar": "sha256-/ZlHs6F2Iahvq9lTr4fzS9K7f4sm2uksHte+dHL0TDs=",
-   "pom": "sha256-AtR9SHfsMktJbZMTMkXNTTSLZSMDzyfvpj44ry+zzyo="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.21": {
+   "jar": "sha256-MWRcpSI5siHr0GCgD/+NhRb/3Ii72fTkzX3bQacGjHA=",
+   "pom": "sha256-Y/3PHe0qtFrXfASZefqkTxkPe7jurE+B+Yd+nfqf2fk="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.2.20": {
-   "jar": "sha256-ZHiafwBWWSfy8/LRCfIwV009kwjtXW6Gv8qEPaZIfPc=",
-   "pom": "sha256-4vQ157rwHeL/kNCoc3r4+b+X/BUuWVuGp2C6ZOjmnfY="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.2.21": {
+   "jar": "sha256-RYtj74/FCgoxgP5ojsG5lXRZkqBcSV2sYeWNEIiSeoA=",
+   "pom": "sha256-Ln/cogFlzxDnO2L4NfZ+7PQnyCPtYPGdXwButnQ0Wv4="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.2.20": {
-   "jar": "sha256-HGw/gQv+akGry8NLOi72OfHj9K7tOpU6Swl07qT0GIk=",
-   "pom": "sha256-Bf8CX3+wky+xH6HhzK71KPdgJ9lWaA+INdQ4VCdi4go="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.2.21": {
+   "jar": "sha256-lYj6aWrFUHr3ZP1WYN9olBheEnBOwbw/XLdyr0mH8pU=",
+   "pom": "sha256-CzPGTyYiujvIKDN4vbdQXyvjMKInWAcDitVDWbM935s="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.20": {
-   "jar": "sha256-+vloNPogBNeL2ORCD1go3j1CckJ9ZHR5gCTqbpz4XN0=",
-   "pom": "sha256-kbsVJI9OqUS2Mw8xA/HrVF0TvditSuxDe3R6WG57F6k="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.21": {
+   "jar": "sha256-o6Qi4GvNNaMqeY0ZHvbrs16ms5w1U+lB05wB5jH8XHc=",
+   "pom": "sha256-HxA9i94I3dYUvZg6vfy3lJE5xgasYM2KaJQf0Pse4SQ="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.20": {
-   "jar": "sha256-cO983NwwEHe5s7ohqp6cVadq+z/73+9KtWKmd9GN+kw=",
-   "pom": "sha256-ihNtDxPrmDpr40/x4WPJznmFXkuiF09Fy0KqpnVT91Q="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.21": {
+   "jar": "sha256-POLKPF17x8h8QUmsLFk9IaeR1ndiKa4SPbZFowF96BQ=",
+   "pom": "sha256-T2/dvBDZshZ4meNPoRP8mtdcxNbOWKuE+WFLY8BfjaM="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.2.20": {
-   "jar": "sha256-fFyM0vi+rdMoMjm7nKIZoMr6GvAmgrQHsYHhF5cY8vc=",
-   "pom": "sha256-9Yhmv7yYZ8bWR1ec/3DUKHeZctvd2N5MJXh5y0N0FIk="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.2.21": {
+   "jar": "sha256-kcBnPCLkSwVK4DFNMjhg6+Hzr/Pw68dP/4LEcz3eCb4=",
+   "pom": "sha256-Fwvb7LpX/wCiuNF+8seeCLhfZ99p2FO6CiWaQYO/uSM="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.2.20": {
-   "jar": "sha256-T8MqG+ZFynQE4hskRSCI+T6OmT6v/Sbza9Ndv3XGB1I=",
-   "pom": "sha256-sbbgEXktfKkv7K+/+sSlCPdvA5yfeuijI9GJKIgl9P4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.2.21": {
+   "jar": "sha256-NZTEDHAF0ESVL4D3BBcrtv0YRCQQJRlPsWvubUXaLls=",
+   "pom": "sha256-VErpKrN3QI/B7TBOxBou7EKT4PLhObPS9v0nIF8UY38="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.20": {
-   "jar": "sha256-dgfuXHoMpT+lku58VA7oCJYqe62P7p7Xj+Z0hBRj2V0=",
-   "module": "sha256-T8vx/H5Uzr/pC5peD7RpYv7Vwi03I52iNfXi37xtUog=",
-   "pom": "sha256-C5E9oNIYhCAmOpBLtApkD9s1pTWnLwWC/llkHjoMSi4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.21": {
+   "jar": "sha256-t7/Qf18eCkSvYS60hHTfYyjuD286anNkLORz8wZF4aU=",
+   "module": "sha256-HnS0hvlEq54Rb5pKriDFL8L5rFI6VS25fdZYFID+lAs=",
+   "pom": "sha256-m9RXg5guF17un6rUX1/3QVyWrrau8ufPjjUIr7Y51hc="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.20/gradle813": {
-   "jar": "sha256-dgfuXHoMpT+lku58VA7oCJYqe62P7p7Xj+Z0hBRj2V0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.21/gradle813": {
+   "jar": "sha256-t7/Qf18eCkSvYS60hHTfYyjuD286anNkLORz8wZF4aU="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.2.20": {
-   "jar": "sha256-dtFu5ZzeHmpwVWtdQEhu+fEcFkOodJPBnE3zMWU4N9k=",
-   "pom": "sha256-xRuhScfyk1nSWk7RIS4otpNOGkdW9VLAAHvxFE0onB0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.2.21": {
+   "jar": "sha256-S0vndO+5WFrw/aGA0zkD2CcuSX33uBuwkfqTOezaRb0=",
+   "pom": "sha256-uhvOJI5HRY7tRmheuiEreT/7fTfkKd/2cKIT3dEC0MA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.2.20": {
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.2.21": {
    "jar": "sha256-7JacXwsJn4I4RiMiOPm9ZPPTdB5i6pBQrS5DL6150KA=",
-   "module": "sha256-/IW7KUlsw/X5DHjHonejkw7xFg8IQ/iu1ke3TGejtJQ=",
-   "pom": "sha256-NkQjJURfF7rCH1OGu0k4+D53K4NOWGBT1BRbGnXZ4oU="
+   "module": "sha256-kVGuIjeH8cILcLJKEXeJtNFNDMSE5GJzLLIwp5f3W88=",
+   "pom": "sha256-KKWiq7pbWCk+JKngbmqskmJr4YLGXfyLLbaUlE5wraU="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.2.20": {
-   "jar": "sha256-U6MhUoJjIGAYUgSaC291OMqLtX/QnYeszRGLxo1D+OQ=",
-   "module": "sha256-EZdKVPSOCCXpdxML9u9qyZp/216yr53iZa9iTHY2g+U=",
-   "pom": "sha256-3uDjB7pub1GQPH5DPehSZ10eMOfyLPJGWxglVSZR7fs="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.2.21": {
+   "jar": "sha256-kI5uXIkLtJ28kmbczyi9sMJYxIZHA5rtcC/p1YZkAYY=",
+   "module": "sha256-/kRucdWLn1verY7wW2i0mGFzF+G5LUe5qztnTWTydmQ=",
+   "pom": "sha256-IIRTo2pr5JsHGhwQ6bRAQQZjbJO65b8wxtrFdMQM9bE="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.20": {
-   "module": "sha256-3CS/pH4EQigykOIfBpoFYUHR8IjWy57Kouqs4bR7a4w=",
-   "pom": "sha256-ucP9Lr1UhNYMX+DbeqEIeDA+7d/JP5Qvc1wHupmBh8w="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.21": {
+   "module": "sha256-TiOAKj1TACSsRlrNJkh9ajpwLugEzWEzScUQjeq/S6I=",
+   "pom": "sha256-5bWdPJpGu38Pe0nPyI1pjaVBpL0JClwX2aAKtHIQc4w="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.20/gradle813": {
-   "jar": "sha256-XTJbXCxdS8i/RBRdJOtNS+sGDRPRHr5IiYk27VzRVk4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.21/gradle813": {
+   "jar": "sha256-t6UoZcal4WDSz2Hk1CPORKaiDeCmsj0DQEttAaKBFzc="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.2.20": {
-   "module": "sha256-P7tFda43xKd2rrhtj/k8aqEbDPLadXScUyDiWFCwIp4=",
-   "pom": "sha256-PG1GnpFfuzCWrEy4wvRsedAnw8WQ5lihBoihVx61eNg="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.2.21": {
+   "module": "sha256-3E/A81pVMqU6Qy7k/iJDEyVIVV8nX2PuaZDVAzP4zio=",
+   "pom": "sha256-JfRGZjOd7uAQanbqXvzPqzSvz9uWCnZy+4h/cboNqL0="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.2.20": {
-   "jar": "sha256-OYK+RbEpMOIYGbWJ2zcHyOhM4le/Ks5/xi/I3zaPWz4=",
-   "pom": "sha256-CzAJtJQmv6F3qtlLSBCbjKVMck6i5sUGgmo6lc9ZEOE="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.2.21": {
+   "jar": "sha256-WLxFHOYu1r79B3rBB+pfEzRD503XjPOkpI+GjmGDfos=",
+   "pom": "sha256-yJkqd6ltK5+NgTdMQL1x0y4h2f8c23mdFdSXGLEqEuE="
   },
   "org/jetbrains/kotlin#kotlin-metadata-jvm/2.2.20": {
    "jar": "sha256-hSTqyQ9+jg8TZog/LGyCDJO/ph3z12hXyNPoA89nMV0=",
    "pom": "sha256-e2qAtqLSZ2oEIvaWg4EyMVQlUfYbMgxochz7nh9ZCdA="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.2.20": {
-   "jar": "sha256-UBd3SirqQf+HEhNxFs1NgAP+mroSAMEG5lcw/rW7dEI=",
-   "pom": "sha256-U+++4FpxIhiQYPXuXspodjnOr+KfXlmW3phiopxnJyU="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.2.21": {
+   "jar": "sha256-50sUQG2uCgI4gYfGLBcxGDun0NjmBnVoLeURqQr6bFY=",
+   "pom": "sha256-1SJqfIYGn6mnIavJeuTaFaQO0WicirVQXhoa0tsg3F8="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
    "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.2.20": {
-   "jar": "sha256-ggkIOkp8TkdtmEKweDCPqWqW8Hpr2Z8F81hu4TKJqyY=",
-   "pom": "sha256-TidHQGbbg/uixZB0KJunEr6MhRV83guQUCmkRcJ19bo="
+  "org/jetbrains/kotlin#kotlin-reflect/2.2.21": {
+   "jar": "sha256-RDgKvzfSRc5cDylPQ1EtHDmllkK/pGOSLHTpaHfPSfg=",
+   "pom": "sha256-5atrEFYKWlJWLDXNvnHdvkJ9Uetb/HAdzU9rlJvZ4D8="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.2.20": {
-   "jar": "sha256-WRNzsEtDtom0HgvIYqlslEx+DDHSMIH0aooe48a6Edc=",
-   "pom": "sha256-iSompWD3bch9NVEw9Akk2ZtL1gB212R0Ff6YkYjSLA4="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.2.21": {
+   "jar": "sha256-yweF5qeHDS9eqW9kcCDigS3snXAjAzMZu9sc5+XmVUg=",
+   "pom": "sha256-CcOMhkgRKRfUMPoji0Nxz4DbE86Dgu6KK6g0EPmd0yY="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.2.20": {
-   "module": "sha256-c7Eee8xPZZeWcN8Vx1aADHOiHaH9EJL56sWfON+cVjE=",
-   "pom": "sha256-LhNnvGXeGLQPpn2H9+JGXj4dYUviuLCdOQZRZ8JwK+M="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.2.21": {
+   "module": "sha256-2iXbk8+OvwbGM1L4PnIK14e8cD/Q54DxGRjQii7JgE4=",
+   "pom": "sha256-IU7uupPxsDquZnoJfbq/6z2XRel5zU0LJGLzj+vHd2Q="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.2.20/gradle813": {
-   "jar": "sha256-YZ6b4NCK9+W0TRIkJQ0jXiLvimiKzISPO4kC+mZAQws="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.2.21/gradle813": {
+   "jar": "sha256-tHyUm4u4DOaAcj+Lw8hw8ifDZHel6wLCtz1hEY1GMKY="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.2.20": {
-   "jar": "sha256-XIvV3Xrh6i7rJ3j9vqoZpWIYSXX2yrigu2d55BkHMa4=",
-   "pom": "sha256-IpOhQenagKfpjYXtKkkuldsMAWW86rC3Klzp4tkrCAc="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.2.21": {
+   "jar": "sha256-KxUZtCe1FNFTbBtCVnSwP+kUr2N5JAKOmVnGYlRC31E=",
+   "pom": "sha256-h2elQPxdviC34Sg6lfUQKX5sDJiy6sLtxNBhKi0PLq8="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.2.20": {
-   "jar": "sha256-+5n/fwzZUtpo1UjT89ZErlB4sLlvybrwZewUZqKTuAU=",
-   "pom": "sha256-iTjGIFKXW7uW3OotqaeNS2sk2vLwnTWMGnqEHxaMtzo="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.2.21": {
+   "jar": "sha256-QU7ZHD9eRJKyPLlTeEK0ZRA44l2thBB5OfQ0wiA/KpI=",
+   "pom": "sha256-7CWpeZRRdbrSFlRqSEsLj0SoZwVZGV4kCzR/H9oXcN8="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.2.20": {
-   "jar": "sha256-2GJhDAAzQuUIjKIcRAQix9ijcA4ZnWA/ehAnjESIR2E=",
-   "pom": "sha256-PW9vFZH6P3r14jFlxowu4BclFYZFQ09eMBdF5kfHVhE="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.2.21": {
+   "jar": "sha256-2TS50MJGvAliS3Bor1itV87xHb4q3bx7GdJQzOQt4ck=",
+   "pom": "sha256-EUhmLJXzbgCYEXj7LYldBrLs59BX7YRTLdNTu9bDVlA="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.2.20": {
-   "jar": "sha256-e3kSNZL//r81xhag/xBDMscc3mN6ZX4JrbXfbD+cA84=",
-   "pom": "sha256-+l+wJ+4qSbPb/zh3VBtC+3CuzMN7oC4dOthipcZyVLc="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.2.21": {
+   "jar": "sha256-eIowYMjnmX+K4WulwCgNBQBa8KQgKfGMsQxWJbl5+sM=",
+   "pom": "sha256-DKT5XDLUrpVOF06kHlutYseNvJOmTEUHb96czISrNgk="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.2.20": {
-   "jar": "sha256-qR+5BJY0oyum09LpGgy5mD4KpOccDC4bKDg4qOBhYx8=",
-   "pom": "sha256-0df8RWSBne6v6OvdcfbyGBf/xVjr0U9HpW6NyTaW3Rk="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.2.21": {
+   "jar": "sha256-g4IMX8xdKPBF+RTs1ZALu8+BFbDXAHM03gaf5scGaeY=",
+   "pom": "sha256-nR1Dsi27irmp3yJ6bVRYNB2v/sFQ73WV12XMXsvxeQg="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.21": {
    "jar": "sha256-M9FI2w4R3r0NkGd9KCQrztkH+cd3MAAP1ZeGcIkDnYY=",
@@ -919,26 +919,26 @@
    "jar": "sha256-FcjArLMRSDwGjRaXUBllR0tw39gKx5WA7KOgPPUeSh0=",
    "pom": "sha256-MQ1tXGVBPjEQuUAr2AdfyuP0vlGdH9kHMTahj+cnvFc="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.2.20": {
-   "jar": "sha256-iDbM/9NYX63amQEkSyDUKQHS881YEFjYQ04v+rzzo+c=",
-   "module": "sha256-yRj1IU0CGnLjdn8nVul9EDpSbgTxQj2jZj79+1hH25U=",
-   "pom": "sha256-SosIbmQxvPYjY39Ssv8ZLhrbkTg4dC5cDupwqN7kKcQ="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.2.21": {
+   "jar": "sha256-ZVij0jPaVqIJNLMhWfnbX4btWBbvCY94osIj3Gq7ed0=",
+   "module": "sha256-v7xlfd06jjfkyK1BeWjV6wsLFxyfzkj5YsKtMu5DTCE=",
+   "pom": "sha256-zzH5IxlsY67ezQpXwkJpvTcCpOR8C/C9ZLWtpd5SInI="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.2.20": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.2.21": {
    "jar": "sha256-dAFOxPPveM59p+Pmlk8sUmoxIdXFj++MopeeXzRFgvQ=",
-   "pom": "sha256-jvep2QYs59w/xlVxXdAoqZRLeElhPgEYR8XWs7mSgXE="
+   "pom": "sha256-3TPmGTLBut893oXyBPY0yABL6WQnw6HKiGbMAR1xHfo="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.2.20": {
-   "jar": "sha256-1DGva+puLcmInE/iawc84VfxEchgj+laGL/gi4F8/3Q=",
-   "pom": "sha256-xqXQGEjNBAz8j3uuYjLXktcFwpOi2nJmrmJszbNdagM="
+  "org/jetbrains/kotlin#kotlin-util-io/2.2.21": {
+   "jar": "sha256-JmqkAmoQb1n878PxUXaIcK+RzvFeQBH6wKofH1Z9SfQ=",
+   "pom": "sha256-67UM9Bx0RJdvAsL5FbQXMlcsXzmUplgciOZN4LmY970="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.2.20": {
-   "jar": "sha256-vuSQHKU6WiHA22RZAdKwcK/2gkAkF91XiODjWTZFcTs=",
-   "pom": "sha256-vtAGUSIGX65328DEb/xBRqaFy7GLijApq9XaO/qhECc="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.2.21": {
+   "jar": "sha256-AiuVo9/tlJ18LkeCC82YNu4Fe3IVE/dzNh5DM/bHb4w=",
+   "pom": "sha256-87Mj0f6eM9x+nF7XfzBSg//WN4FdiMUHlFQRvXqiow8="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.2.20": {
-   "jar": "sha256-7XyAlrK75HetF8MXjeuoyDr1MourNr/iEJEL1bQZI0w=",
-   "pom": "sha256-2mwiR3qvQt2hbYWa2unj7Yq8khzLp/9RYTTMi9NZqpI="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.2.21": {
+   "jar": "sha256-VUAKkX5rmEphl+rni1tS7b3yzW4KfDhD95VEgbr7JD8=",
+   "pom": "sha256-o1Lf02Uns67w98DsZJDeydX8m+xPM02ETK6U+BdD3zA="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
    "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
@@ -1203,11 +1203,19 @@
   "com/fasterxml/jackson#jackson-parent/2.20": {
    "pom": "sha256-tDt/XGLoaxZPrnCuF9aRHF22B5mvAQVzYK/aguSEW+U="
   },
+  "com/fasterxml/jackson/core#jackson-annotations/2.17.2": {
+   "module": "sha256-KMxD6Y54gYA+HoKFIeOKt67S+XejbCVR3ReQ9DDz688=",
+   "pom": "sha256-Q3gYTWCK3Nu7BKd4vGRmhj8HpFUqcgREZckQQD+ewLs="
+  },
   "com/fasterxml/jackson/core#jackson-annotations/2.20": {
    "jar": "sha256-lZov+y1ZFDb1Hxg8alIfyJNHkS9xG/DK4AjN8EXZUxk=",
    "module": "sha256-wHDxTsg1jQlcAurootZcsAzLoOXFqnOwASlDM/5GiXE=",
    "pom": "sha256-TXQMRHjdCNCJ7NxtBjIopVoRp+jkl9pDOPhy+BFXlKQ="
   },
+  "com/fasterxml/jackson/core#jackson-core/2.17.2": {
+   "module": "sha256-OCgvt1xzPSOV3TTcC1nsy7Q6p8wxohomFrqqivy38jY=",
+   "pom": "sha256-F4IeGYjoMnB6tHGvGjBvSl7lATTyLY0nF7WNqFnrNbs="
+  },
   "com/fasterxml/jackson/core#jackson-core/2.19.2": {
    "jar": "sha256-qnfq8pKTqGjEc3IZT3xSh9d9k3CwTqJdP//B5JBLWIA=",
    "module": "sha256-Ua8uZ3g6XXJETeajB8jj7ZMAklbNJ+ghkVVZohZcCUI=",
@@ -1897,9 +1905,6 @@
   "net/java/dev/jna#jna/5.13.0": {
    "pom": "sha256-9RXCV4F49FJH7Mp6nh2xCVMbHELyQk4lPO6w9rjUI3Q="
   },
-  "net/java/dev/jna#jna/5.17.0": {
-   "pom": "sha256-UBoP8F2EpK0Q9t4lvpT0k5i3CjG+jzoO2fTGtE++/uQ="
-  },
   "net/java/dev/jna#jna/5.18.1": {
    "jar": "sha256-JgxLHiKx254RDuRBxPE84RX4QfpIxB14dQmGIUs5VVc=",
    "pom": "sha256-mLYq5v8oDXR/s1n8QuSP7RE9Rbw3Kagj3DC4MIqAZkU="
diff --git a/pkgs/by-name/ja/jabref/package.nix b/pkgs/by-name/ja/jabref/package.nix
index 2e31f41c8b30..0a38413359f9 100644
--- a/pkgs/by-name/ja/jabref/package.nix
+++ b/pkgs/by-name/ja/jabref/package.nix
@@ -54,6 +54,7 @@ let
     url = ltwaUrl;
     hash = "sha256-jnS8Y9x8eg2L3L3RPnS6INTs19mEtwzfNIjJUw6HtIY=";
   };
+  kotlinDslVersion = "6.4.2";
 in
 stdenv.mkDerivation rec {
   version = "6.0-alpha.4";
@@ -93,6 +94,9 @@ stdenv.mkDerivation rec {
 
     sed -i -e '1a //REPOS file://${mitmCache}/https/repo.maven.apache.org/maven2,file://${mitmCache}/https/plugins.gradle.org/m2' build-support/src/main/java/*.java
 
+    substituteInPlace build-logic/build.gradle.kts \
+      --replace-fail '`kotlin-dsl`' 'id("org.gradle.kotlin.kotlin-dsl") version "${kotlinDslVersion}"'
+
     pushd jablib
 
     # Disable update check
diff --git a/pkgs/by-name/ja/jasp-desktop/modules.nix b/pkgs/by-name/ja/jasp-desktop/modules.nix
index c104577ea9a6..c0d9684f40ab 100644
--- a/pkgs/by-name/ja/jasp-desktop/modules.nix
+++ b/pkgs/by-name/ja/jasp-desktop/modules.nix
@@ -7,15 +7,15 @@
 
 with rPackages;
 let
-  jaspGraphs = buildRPackage {
+  jaspGraphs = buildRPackage rec {
     pname = "jaspGraphs";
-    version = "0.19.2-unstable-2025-07-25";
+    version = "0.95.3";
 
     src = fetchFromGitHub {
       owner = "jasp-stats";
       repo = "jaspGraphs";
-      rev = "e721a631c8357d42c1371a978db7cb5765bc7044";
-      hash = "sha256-DOOKHBVTF9bVhAa/LZCH1J7A821H4mGEfy6KAEtDBNk=";
+      tag = "v${version}";
+      hash = "sha256-h2jYFtMFGbaIO1Ed75I2Q0+ut0bR8zBaZ3RZWcTpxMs=";
     };
 
     propagatedBuildInputs = [
@@ -174,7 +174,7 @@ let
     {
       pname,
       version,
-      rev ? "refs/tags/${version}",
+      rev ? "refs/tags/v${version}",
       hash,
       deps,
     }:
@@ -200,8 +200,8 @@ in
   modules = rec {
     jaspAcceptanceSampling = buildJaspModule {
       pname = "jaspAcceptanceSampling";
-      version = "0.95.0";
-      hash = "sha256-MzuijLBrCd/aIACzyEWWbQoyuYl/c7iMplsIpScbqK4=";
+      version = "0.95.3";
+      hash = "sha256-Z0NyUPAmgCYC3+w2JX2vSmkyFWdJERd5NckXfF46n5o=";
       deps = [
         abtest
         BayesFactor
@@ -218,8 +218,8 @@ in
     };
     jaspAnova = buildJaspModule {
       pname = "jaspAnova";
-      version = "0.95.0";
-      hash = "sha256-elunqlNy7krnoL31aeS4B7SkpKCD42S8Z8HsPeFTjEM=";
+      version = "0.95.3";
+      hash = "sha256-d0m/mGyRkcBlk3961lafQ+X10yTvsWvQnExVDraW28M=";
       deps = [
         afex
         BayesFactor
@@ -247,8 +247,8 @@ in
     };
     jaspAudit = buildJaspModule {
       pname = "jaspAudit";
-      version = "0.95.0";
-      hash = "sha256-CqrjrNm7DEyzOTg69TzksYczGBSCvhHfdfZ/HaNkhcI=";
+      version = "0.95.3";
+      hash = "sha256-XnQFmf5xdUqClpaJ6Qz0zJAHs1ieeYd4nffxDKX7ReE=";
       deps = [
         bstats
         extraDistr
@@ -261,8 +261,8 @@ in
     };
     jaspBain = buildJaspModule {
       pname = "jaspBain";
-      version = "0.95.0";
-      hash = "sha256-E6j7dH6jbXWhR03QVQjY30/pylrMHU6PNX13gr5KvV4=";
+      version = "0.95.3";
+      hash = "sha256-kt0s2VJQGhVeD+ALY4FTtU1+7hYw81cXM1WvJ99lnZQ=";
       deps = [
         bain
         lavaan
@@ -276,8 +276,8 @@ in
     };
     jaspBFF = buildJaspModule {
       pname = "jaspBFF";
-      version = "0.95.0";
-      hash = "sha256-fgAUdzgSNt34WL/U3/0ac1kTB5PYAvmpXeQUuNEUhuE=";
+      version = "0.95.3";
+      hash = "sha256-E+CYTFfiAM7Fng4vY39cceU2IUFcXKn+uejLufnwcOc=";
       deps = [
         BFF
         jaspBase
@@ -286,8 +286,8 @@ in
     };
     jaspBfpack = buildJaspModule {
       pname = "jaspBfpack";
-      version = "0.95.0";
-      hash = "sha256-4c7ORf0epHSdv6AB1UVMwiSEwCfVHAg0jzifBdHInoc=";
+      version = "0.95.3";
+      hash = "sha256-9biiB/m8QsSjlAheoo3hllxYyAIgoeEb1W0KXUEa5C8=";
       deps = [
         BFpack
         bain
@@ -300,8 +300,8 @@ in
     };
     jaspBsts = buildJaspModule {
       pname = "jaspBsts";
-      version = "0.95.0";
-      hash = "sha256-pClbOuA255mHJSy7/TpQE+oaYQbxJut9AqZRMqm8Rhg=";
+      version = "0.95.3";
+      hash = "sha256-TJi0fqZ3abV9mM9XyRiuQfK1tkOJ7VluyKilUdHHj0Y=";
       deps = [
         Boom
         bsts
@@ -314,8 +314,8 @@ in
     };
     jaspCircular = buildJaspModule {
       pname = "jaspCircular";
-      version = "0.95.0";
-      hash = "sha256-Sx63VGtOZvwHF1jIjnd6aPmN1WtHHf35iQ0dzCWs1eU=";
+      version = "0.95.3";
+      hash = "sha256-L3WVErysIMtRLDRzaRd+MCYL9smzWERMTiyzrPHGPjQ=";
       deps = [
         jaspBase
         jaspGraphs
@@ -325,8 +325,8 @@ in
     };
     jaspCochrane = buildJaspModule {
       pname = "jaspCochrane";
-      version = "0.95.0";
-      hash = "sha256-ZYMe1BJ0+HKKyHVY5riEcGE+6vZsAurWzHmPF5I7nk8=";
+      version = "0.95.3";
+      hash = "sha256-MAIj0ThgUdo07gHBs0a5tzEsJTrtPS3XnyW2Wj+xp3g=";
       deps = [
         jaspBase
         jaspGraphs
@@ -336,8 +336,8 @@ in
     };
     jaspDescriptives = buildJaspModule {
       pname = "jaspDescriptives";
-      version = "0.95.0";
-      hash = "sha256-gaGgSSv1D0GB8Rmzg9TYl460TjWHkK0abHDm5DHhOJg=";
+      version = "0.95.3";
+      hash = "sha256-W4LWha+GTVSrOAJLIv9Uy3wOnyHxoT0O/yxj9Zw8/Tg=";
       deps = [
         ggplot2
         ggrepel
@@ -359,8 +359,8 @@ in
 
     jaspDistributions = buildJaspModule {
       pname = "jaspDistributions";
-      version = "0.95.0";
-      hash = "sha256-jtPYx2wOAY7ItrkPqyMsKp7sTrL9M1TtTmR0IjxU1nw=";
+      version = "0.95.3";
+      hash = "sha256-EutMd5cD3jEW/3e3Ch9IClo1LaNsuvmnvh9cy8hG5Bc=";
       deps = [
         car
         fitdistrplus
@@ -377,8 +377,8 @@ in
     };
     jaspEquivalenceTTests = buildJaspModule {
       pname = "jaspEquivalenceTTests";
-      version = "0.95.0";
-      hash = "sha256-b/I6lb6I8rzOyyRgmsQTBMfHXfJDkrZPdwe5Kh2IVnc=";
+      version = "0.95.3";
+      hash = "sha256-cTVPephc/9IIJ8eUP3Ma1d215E6bI1MOWtlQDGqPN70=";
       deps = [
         BayesFactor
         ggplot2
@@ -391,8 +391,8 @@ in
     };
     jaspEsci = buildJaspModule {
       pname = "jaspEsci";
-      version = "0.95.0";
-      hash = "sha256-0YBC54VdVNuGdkfjWEIJnW3n/Wbch4E6tkauVm45/9c=";
+      version = "0.95.3";
+      hash = "sha256-wgbp1iZRWfm6dRVkVhK6iC0hHu73pFm3Hk9pN7Z6ej8=";
       deps = [
         jaspBase
         jaspGraphs
@@ -404,8 +404,8 @@ in
     };
     jaspFactor = buildJaspModule {
       pname = "jaspFactor";
-      version = "0.95.0";
-      hash = "sha256-gK4GdwADrPt2UB/UUx+2Kx5IOlFolYjNArrYpTGK9ic=";
+      version = "0.95.3";
+      hash = "sha256-1e4HYst/G5JqN7fksFR907LqysdyTCcUXLgRfiSBCd0=";
       deps = [
         ggplot2
         jaspBase
@@ -423,8 +423,8 @@ in
     };
     jaspFrequencies = buildJaspModule {
       pname = "jaspFrequencies";
-      version = "0.95.0";
-      hash = "sha256-aK4t+q6NRHGiszJa6rWx1bQddxzwynM9TOckxofdgsw";
+      version = "0.95.3";
+      hash = "sha256-3JznrmKqAJJop57gNQw7eOLjbS7B41AriUdZTttoSkM=";
       deps = [
         abtest
         BayesFactor
@@ -443,8 +443,8 @@ in
     };
     jaspJags = buildJaspModule {
       pname = "jaspJags";
-      version = "0.95.0";
-      hash = "sha256-DxLy3NgqvLIROBut30ne3hCUd67rCRutgM7zGvwkKNU=";
+      version = "0.95.3";
+      hash = "sha256-wZsc3NSiNKa35R7c/mrnp+crA8OkNk/2JRiiEW8DZq4=";
       deps = [
         coda
         ggplot2
@@ -460,8 +460,8 @@ in
     };
     jaspLearnBayes = buildJaspModule {
       pname = "jaspLearnBayes";
-      version = "0.95.0";
-      hash = "sha256-mka93YglICKxPXNO85Kv/gzSRAMuTkWcnAlwIExDpi0=";
+      version = "0.95.3";
+      hash = "sha256-YRzoF4FrPrSeDcKq7V9N8FcNtCKZ4n5e2O9u9aseAik=";
       deps = [
         extraDistr
         ggplot2
@@ -483,8 +483,8 @@ in
     };
     jaspLearnStats = buildJaspModule {
       pname = "jaspLearnStats";
-      version = "0.95.0";
-      hash = "sha256-AcdSmAGr1ITZV/OXNpyOz0wwBlho76lvEGgt5FUHnsg=";
+      version = "0.95.3";
+      hash = "sha256-PSrLmRlvd0U7hkFXRvzi5hFz7/Czj3iOSdWyGGoOHVI=";
       deps = [
         extraDistr
         ggplot2
@@ -502,8 +502,8 @@ in
     };
     jaspMachineLearning = buildJaspModule {
       pname = "jaspMachineLearning";
-      version = "0.95.0";
-      hash = "sha256-oCsXrcEAteFGfFHU65FV3jm1majA1q1w+TYCwAsvf70=";
+      version = "0.95.3";
+      hash = "sha256-ZZKEO+FMx5uycD1JBln6HG5qLqbzRCnr/B2/yDUqhYs=";
       deps = [
         kknn
         AUC
@@ -541,8 +541,8 @@ in
     };
     jaspMetaAnalysis = buildJaspModule {
       pname = "jaspMetaAnalysis";
-      version = "0.95.0";
-      hash = "sha256-5zmLCx6HuM/oBxfaAgo4y7/CYJJkiJEP9RvAsc1h/5w=";
+      version = "0.95.3";
+      hash = "sha256-JxO3jvEVcYIkOPncCYLHJFbu0i2HYx7ltqEBzSNKRjM=";
       deps = [
         dplyr
         ggplot2
@@ -575,8 +575,8 @@ in
     };
     jaspMixedModels = buildJaspModule {
       pname = "jaspMixedModels";
-      version = "0.95.0";
-      hash = "sha256-EbB7rwlfRiGPI+QIi8/SygxJgsU5nOpZ2ZEg+mETX5Y=";
+      version = "0.95.3";
+      hash = "sha256-rc0l9aYKVjpSruxutYxYHLRmDN045fBYXD3itKbzDYA=";
       deps = [
         afex
         emmeans
@@ -595,8 +595,8 @@ in
     };
     jaspNetwork = buildJaspModule {
       pname = "jaspNetwork";
-      version = "0.95.0";
-      hash = "sha256-1RDkKRgNV6cToM2pVdHwIDE41UpFV0snIU54BEesVJw=";
+      version = "0.95.3";
+      hash = "sha256-16qRhOgzFRgbImeIfTKZJyn8ZlGnohPp4/whabdDHeM=";
       deps = [
         bootnet
         easybgm
@@ -619,8 +619,8 @@ in
     };
     jaspPower = buildJaspModule {
       pname = "jaspPower";
-      version = "0.95.0";
-      hash = "sha256-sLLJ6yqKbFlXrHPlm2G7NuHp+/kBl+kPRvi6vAy32Ds=";
+      version = "0.95.3";
+      hash = "sha256-2PrPaksHMAFVYCPN+xigLDSyALarzrO4FTylMmi4+vk=";
       deps = [
         pwr
         jaspBase
@@ -630,8 +630,8 @@ in
     };
     jaspPredictiveAnalytics = buildJaspModule {
       pname = "jaspPredictiveAnalytics";
-      version = "0.95.0";
-      hash = "sha256-850PruQnCGab0g3Vdlh1LSqWYLFJUCbGNt3gWjEWP34=";
+      version = "0.95.3";
+      hash = "sha256-mQx/LsFDaD9zS2DqqiXfFNT019/J3HPdNsPzxWn2Pwc=";
       deps = [
         jaspBase
         jaspGraphs
@@ -651,8 +651,8 @@ in
     };
     jaspProcess = buildJaspModule {
       pname = "jaspProcess";
-      version = "0.95.0";
-      hash = "sha256-LUlk9Iy538Zenzy+W1oJiCr7dcrBQVrl4gzflwnJVyc=";
+      version = "0.95.3";
+      hash = "sha256-wWMpqOXOKEx3z0juBXfnfJvbKCeI+H/Wnhh24dNWJWw=";
       deps = [
         blavaan
         dagitty
@@ -666,8 +666,8 @@ in
     };
     jaspProphet = buildJaspModule {
       pname = "jaspProphet";
-      version = "0.95.0";
-      hash = "sha256-lCgqH3CfZxRImq5VndZepiy/JaXJHHh1Haj+7XhZUSE=";
+      version = "0.95.3";
+      hash = "sha256-AOm0oNqCHmkUdhC8Cqb4O9HkUoC9L8TFaSNcZ/DzoYQ=";
       deps = [
         rstan
         ggplot2
@@ -679,8 +679,8 @@ in
     };
     jaspQualityControl = buildJaspModule {
       pname = "jaspQualityControl";
-      version = "0.95.0";
-      hash = "sha256-6SvLe++9ipvHfX0Hi1xeBeoQeq+PdG9YTE5sewhqUHA=";
+      version = "0.95.3";
+      hash = "sha256-zFxC3icKd84jjilwZBCe7JRV8S1eb4AO8UyBENXsF/U=";
       deps = [
         car
         cowplot
@@ -712,7 +712,7 @@ in
     };
     jaspRegression = buildJaspModule {
       pname = "jaspRegression";
-      version = "0.95.0-unstable-2025-08-27";
+      version = "0.95.3";
       rev = "b0ecad26bb248964e778ee6d4486d671b83930b2";
       hash = "sha256-wm/Fz/wA7B96bzj8UylZjFgrrZgwOTdGnCsmfaCPGp0=";
       deps = [
@@ -742,8 +742,8 @@ in
     };
     jaspReliability = buildJaspModule {
       pname = "jaspReliability";
-      version = "0.95.0";
-      hash = "sha256-wxx1ECm7QKDvLLKQZbEVYTHfyn3ieks69HSP/cg5dDQ=";
+      version = "0.95.3";
+      hash = "sha256-80G8Z8JWxwyAer1GsQgzytEcSquCBW8Zmu92KKiHu1I=";
       deps = [
         Bayesrel
         coda
@@ -761,8 +761,8 @@ in
     };
     jaspRobustTTests = buildJaspModule {
       pname = "jaspRobustTTests";
-      version = "0.95.0";
-      hash = "sha256-nw+7eZycdJ+DHlLaTSBWdHocnaZk95PBqYj8sVFlPSg=";
+      version = "0.95.3";
+      hash = "sha256-txcItwNHq41ifdjvyY9Jhp2sfHJYA/YStTxpyk/lUPQ=";
       deps = [
         RoBTT
         ggplot2
@@ -772,8 +772,8 @@ in
     };
     jaspSem = buildJaspModule {
       pname = "jaspSem";
-      version = "0.95.0";
-      hash = "sha256-+cgP6KqSK4tXQ+Dg6OTEoXfzEJFNdnwAat6tyWyzSkU=";
+      version = "0.95.3";
+      hash = "sha256-QI1OGAfyBJ9p3Nb/sI3A5sISXc4ZpsN1sPaJL/3chP8=";
       deps = [
         forcats
         ggplot2
@@ -792,8 +792,8 @@ in
     };
     jaspSummaryStatistics = buildJaspModule {
       pname = "jaspSummaryStatistics";
-      version = "0.95.0";
-      hash = "sha256-VuBDJtkDifDeatY3eX5RBd5ix6fB0QnJ1ZoM7am9SOA=";
+      version = "0.95.3";
+      hash = "sha256-6OEnYhp4NBd8mr518Mz63F7eZ297unDRYLiOoWzlAbc=";
       deps = [
         BayesFactor
         bstats
@@ -810,8 +810,8 @@ in
     };
     jaspSurvival = buildJaspModule {
       pname = "jaspSurvival";
-      version = "0.95.0";
-      hash = "sha256-IVN3Tcd+OgD4pancwyNomQMOfOvUnKIWG/nxKdjNxcw=";
+      version = "0.95.3";
+      hash = "sha256-rrbzd8Iws7lhKPJGRtFLuFgRkqHa8B0R6ZH/HdHDk44=";
       deps = [
         survival
         ggsurvfit
@@ -822,8 +822,8 @@ in
     };
     jaspTTests = buildJaspModule {
       pname = "jaspTTests";
-      version = "0.95.0";
-      hash = "sha256-CLrfa5X/q2Ruc+y3ruHnT/NhYQ4ESvxtJCH2JM/hf4o=";
+      version = "0.95.3";
+      hash = "sha256-yuNLBi56qKCTCh/UNoYjA7YlyL/1B0QXsgN4C8SzQbs=";
       deps = [
         BayesFactor
         car
@@ -837,8 +837,8 @@ in
     };
     jaspTestModule = buildJaspModule {
       pname = "jaspTestModule";
-      version = "0.95.0";
-      hash = "sha256-r+VzUxfvWYl/Fppq/TxCw1jI8F3dohsvb6qwlQHlFDA=";
+      version = "0.95.3";
+      hash = "sha256-kzwGm4hHkO1+mzmCl792oDQimJrsw4xIhd+e91PrOMg=";
       deps = [
         jaspBase
         jaspGraphs
@@ -848,8 +848,8 @@ in
     };
     jaspTimeSeries = buildJaspModule {
       pname = "jaspTimeSeries";
-      version = "0.95.0";
-      hash = "sha256-hQh9p6mX3NlkToh4uQRbPtwpNLlVwsILxH+9D2caZXk=";
+      version = "0.95.3";
+      hash = "sha256-qOrLihjSH7cEazTiFJZIfMe9uGZ6ltZ3uMm+1fwPN7E=";
       deps = [
         jaspBase
         jaspGraphs
@@ -859,8 +859,8 @@ in
     };
     jaspVisualModeling = buildJaspModule {
       pname = "jaspVisualModeling";
-      version = "0.95.0";
-      hash = "sha256-MX3NvfVoFPp2NLWYIYIoCdWKHxpcRhfyMCWj3VdIBC0=";
+      version = "0.95.3";
+      hash = "sha256-KwFfgwBlukRmSltHt1LVzIMB/x2iCvRMc/Rrhmmxw98=";
       deps = [
         flexplot
         jaspBase
diff --git a/pkgs/by-name/ja/jasp-desktop/package.nix b/pkgs/by-name/ja/jasp-desktop/package.nix
index d26980c3bdac..12a859281212 100644
--- a/pkgs/by-name/ja/jasp-desktop/package.nix
+++ b/pkgs/by-name/ja/jasp-desktop/package.nix
@@ -3,7 +3,6 @@
   stdenv,
 
   fetchFromGitHub,
-  fetchpatch,
 
   buildEnv,
   linkFarm,
@@ -22,53 +21,18 @@
   rPackages,
 }:
 
-let
-  version = "0.95.0";
-
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jasp-desktop";
+  version = "0.95.4";
   src = fetchFromGitHub {
     owner = "jasp-stats";
     repo = "jasp-desktop";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-RR7rJJb0qKqZs7K3zP6GxlDXpmSNnGQ3WDExUgm9pKQ=";
+    hash = "sha256-n7lXedICK+sAuSW6hODy+TngAZpDIObWDhTtOjiTXgc=";
   };
 
-  moduleSet = import ./modules.nix {
-    inherit fetchFromGitHub rPackages;
-    jasp-src = src;
-    jasp-version = version;
-  };
-
-  inherit (moduleSet) jaspBase modules;
-
-  # Merges ${R}/lib/R with all used R packages (even propagated ones)
-  customREnv = buildEnv {
-    name = "jasp-${version}-env";
-    paths = [
-      "${R}/lib/R"
-      rPackages.RInside
-      jaspBase # Should already be propagated from modules, but include it again, just in case
-    ]
-    ++ lib.attrValues modules;
-  };
-
-  moduleLibs = linkFarm "jasp-${version}-module-libs" (
-    lib.mapAttrsToList (name: drv: {
-      name = name;
-      path = "${drv}/library";
-    }) modules
-  );
-in
-stdenv.mkDerivation {
-  pname = "jasp-desktop";
-  inherit version src;
-
   patches = [
-    (fetchpatch {
-      name = "readstat-use-find-library.patch";
-      url = "https://github.com/jasp-stats/jasp-desktop/commit/87c5a1f4724833aed0f7758499b917b3107ee196.patch";
-      hash = "sha256-0CrMKJkZpS97KmQFvZPyV1h3C7eKVr/IT0dARYBoKFo=";
-    })
     ./link-boost-dynamically.patch
     ./disable-module-install-logic.patch # don't try to install modules via cmake
     ./disable-renv-logic.patch
@@ -80,7 +44,7 @@ stdenv.mkDerivation {
     (lib.cmakeFeature "GITHUB_PAT_DEF" "dummy")
     (lib.cmakeBool "LINUX_LOCAL_BUILD" false)
     (lib.cmakeBool "INSTALL_R_MODULES" false)
-    (lib.cmakeFeature "CUSTOM_R_PATH" "${customREnv}")
+    (lib.cmakeFeature "CUSTOM_R_PATH" "${finalAttrs.passthru.customREnv}")
   ];
 
   nativeBuildInputs = [
@@ -91,8 +55,8 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
+    finalAttrs.passthru.customREnv
     boost
-    customREnv
     freexl
     libarchive
     librdata
@@ -115,12 +79,37 @@ stdenv.mkDerivation {
       --replace-fail "Exec=org.jaspstats.JASP" "Exec=JASP"
 
     # symlink modules from the store
-    ln -s ${moduleLibs} $out/Modules/module_libs
+    ln -s ${finalAttrs.passthru.moduleLibs} $out/Modules/module_libs
   '';
 
   passthru = {
-    inherit jaspBase modules;
-    env = customREnv;
+    inherit
+      (import ./modules.nix {
+        inherit fetchFromGitHub rPackages;
+        jasp-src = finalAttrs.src;
+        jasp-version = finalAttrs.version;
+      })
+      jaspBase
+      modules
+      ;
+
+    # Merges ${R}/lib/R with all used R packages (even propagated ones)
+    customREnv = buildEnv {
+      name = "jasp-desktop-${finalAttrs.version}-env";
+      paths = [
+        "${R}/lib/R"
+        rPackages.RInside
+        finalAttrs.passthru.jaspBase # Should already be propagated from modules, but include it again, just in case
+      ]
+      ++ lib.attrValues finalAttrs.passthru.modules;
+    };
+
+    moduleLibs = linkFarm "jasp-desktop-${finalAttrs.version}-module-libs" (
+      lib.mapAttrsToList (name: drv: {
+        name = name;
+        path = "${drv}/library";
+      }) finalAttrs.passthru.modules
+    );
   };
 
   meta = {
@@ -134,4 +123,4 @@ stdenv.mkDerivation {
     # Perhaps the Darwin-specific things could be changed to be the same as Linux
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/jemalloc/o3-to-o2.patch b/pkgs/by-name/je/jemalloc/o3-to-o2.patch
similarity index 100%
rename from pkgs/development/libraries/jemalloc/o3-to-o2.patch
rename to pkgs/by-name/je/jemalloc/o3-to-o2.patch
diff --git a/pkgs/development/libraries/jemalloc/default.nix b/pkgs/by-name/je/jemalloc/package.nix
similarity index 100%
rename from pkgs/development/libraries/jemalloc/default.nix
rename to pkgs/by-name/je/jemalloc/package.nix
diff --git a/pkgs/development/libraries/keybinder/default.nix b/pkgs/by-name/ke/keybinder/package.nix
similarity index 97%
rename from pkgs/development/libraries/keybinder/default.nix
rename to pkgs/by-name/ke/keybinder/package.nix
index 1c083b5ee98c..958d32612857 100644
--- a/pkgs/development/libraries/keybinder/default.nix
+++ b/pkgs/by-name/ke/keybinder/package.nix
@@ -9,10 +9,12 @@
   gnome-common,
   gtk-doc,
   gtk2,
-  lua,
+  lua5_1,
   gobject-introspection,
 }:
-
+let
+  lua = lua5_1;
+in
 stdenv.mkDerivation rec {
   pname = "keybinder";
   version = "0.3.1";
diff --git a/pkgs/development/libraries/keybinder3/default.nix b/pkgs/by-name/ke/keybinder3/package.nix
similarity index 92%
rename from pkgs/development/libraries/keybinder3/default.nix
rename to pkgs/by-name/ke/keybinder3/package.nix
index c1d19455c597..7399f3dc0568 100644
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/by-name/ke/keybinder3/package.nix
@@ -9,6 +9,8 @@
   gnome-common,
   gtk-doc,
   gtk3,
+  gtk3-x11,
+  gtk3' ? (if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3),
   libX11,
   libXext,
   libXrender,
@@ -37,7 +39,7 @@ stdenv.mkDerivation rec {
     gobject-introspection
   ];
   buildInputs = [
-    gtk3
+    gtk3'
     libX11
     libXext
     libXrender
diff --git a/pkgs/by-name/ki/kiro/package.nix b/pkgs/by-name/ki/kiro/package.nix
index 223487c071a7..41235eda4bc1 100644
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -15,7 +15,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = extraCommandLineArgs;
 
-  version = "0.8.86";
+  version = "0.8.140";
   pname = "kiro";
 
   # You can find the current VSCode version in the About dialog:
diff --git a/pkgs/by-name/ki/kiro/sources.json b/pkgs/by-name/ki/kiro/sources.json
index d4def8e00728..83f8a860d358 100644
--- a/pkgs/by-name/ki/kiro/sources.json
+++ b/pkgs/by-name/ki/kiro/sources.json
@@ -1,14 +1,14 @@
 {
   "x86_64-linux": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.8.86/tar/kiro-ide-0.8.86-stable-linux-x64.tar.gz",
-    "hash": "sha256-Qa8Yy6pHDk2id9749HY068sEulhIV1CcQYjo3P7XRNg="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.8.140/tar/kiro-ide-0.8.140-stable-linux-x64.tar.gz",
+    "hash": "sha256-nF4i7hSRMEvDCQ9b4rfU5X2M5x76kU6tEfxbo36vBFY="
   },
   "x86_64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.8.86/kiro-ide-0.8.86-stable-darwin-x64.dmg",
-    "hash": "sha256-fyuvVj4gbAVRKwHF8qkSSV7E3HcPBIKkPGhY3C2NRlc="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.8.140/kiro-ide-0.8.140-stable-darwin-x64.dmg",
+    "hash": "sha256-1Pqos729ShVUop1BjYzYOxo3v5Qyige896qMulWmpqE="
   },
   "aarch64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.8.86/kiro-ide-0.8.86-stable-darwin-arm64.dmg",
-    "hash": "sha256-HVq0b7oe2Ly2At4emLwSQCoWNpiOBnpS0uOSlwn9BMo="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.8.140/kiro-ide-0.8.140-stable-darwin-arm64.dmg",
+    "hash": "sha256-kDcyVJIezj4ZfID2lsnMzZgfb+J8b6u0egAu6lPaiP8="
   }
 }
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/by-name/kr/krb5/package.nix
similarity index 98%
rename from pkgs/development/libraries/kerberos/krb5.nix
rename to pkgs/by-name/kr/krb5/package.nix
index 3891c13bb5b8..c4f6ac9b8ac9 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   fetchpatch,
-  bootstrap_cmds,
+  darwin,
   byacc, # can also use bison, but byacc has fewer dependencies
   keyutils,
   openssl,
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     pkg-config
   ]
   # Provides the mig command used by the build scripts
-  ++ lib.optional stdenv.hostPlatform.isDarwin bootstrap_cmds;
+  ++ lib.optional stdenv.hostPlatform.isDarwin darwin.bootstrap_cmds;
 
   buildInputs = [
     openssl
diff --git a/pkgs/by-name/la/lazyworktree/package.nix b/pkgs/by-name/la/lazyworktree/package.nix
index b86687bffbc9..7c1c5cb86ea3 100644
--- a/pkgs/by-name/la/lazyworktree/package.nix
+++ b/pkgs/by-name/la/lazyworktree/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lazyworktree";
-  version = "1.23.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "lazyworktree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qF9196fzKgU9iS7wlOBCYqxtxsauri7CWBEAPCVxo9g=";
+    hash = "sha256-NEZ8bMI7FxiHuCmFy7sjDlZv4aoX431VRQHQXigaHOM=";
   };
 
-  vendorHash = "sha256-Ch/SsuHrCIFefIuQgK0fp5qSg9JX1zPwLEDsMDYIqxE=";
+  vendorHash = "sha256-6Fxri3Ge2iaMluc5h5tL03yXeJcHT6kG3O2ewDG7Acs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/libraries/libagar/default.nix b/pkgs/by-name/li/libagar/package.nix
similarity index 100%
rename from pkgs/development/libraries/libagar/default.nix
rename to pkgs/by-name/li/libagar/package.nix
diff --git a/pkgs/development/libraries/libagar/libagar_test.nix b/pkgs/by-name/li/libagar_test/package.nix
similarity index 100%
rename from pkgs/development/libraries/libagar/libagar_test.nix
rename to pkgs/by-name/li/libagar_test/package.nix
diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/by-name/li/libao/package.nix
similarity index 92%
rename from pkgs/development/libraries/libao/default.nix
rename to pkgs/by-name/li/libao/package.nix
index 9363e18da240..7e19c4782258 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/by-name/li/libao/package.nix
@@ -8,7 +8,8 @@
   libpulseaudio,
   alsa-lib,
   libcap,
-  usePulseAudio,
+  config,
+  usePulseAudio ? config.pulseaudio or (lib.meta.availableOn stdenv.hostPlatform libpulseaudio),
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/by-name/li/libation/deps.json b/pkgs/by-name/li/libation/deps.json
index 3ff222f65471..8475769658d2 100644
--- a/pkgs/by-name/li/libation/deps.json
+++ b/pkgs/by-name/li/libation/deps.json
@@ -6,8 +6,8 @@
   },
   {
     "pname": "AAXClean.Codecs",
-    "version": "2.1.2.1",
-    "hash": "sha256-LfzCFcrV1i+4dXYUuEUIumLqiAMZcwkXwy9MlYfcBMM="
+    "version": "2.1.3.1",
+    "hash": "sha256-GeIQgSPzAhpNfulGWA9tJmnFDN1CsSnerq9rKaK8poE="
   },
   {
     "pname": "AudibleApi",
@@ -21,13 +21,13 @@
   },
   {
     "pname": "Avalonia",
-    "version": "11.3.8",
-    "hash": "sha256-0cM3VVudDUELNE/fWehuCplPKLITjw1hbg9IGtIm20g="
+    "version": "11.3.11",
+    "hash": "sha256-FSMuXVA5q5L5evwos5bIsuT81suO8FbCjEF3OvAL9p0="
   },
   {
     "pname": "Avalonia",
-    "version": "11.3.9",
-    "hash": "sha256-bjSH8REHeK19bh8IacmyllDPaWND+TJdkhKGc8LVvjE="
+    "version": "11.3.8",
+    "hash": "sha256-0cM3VVudDUELNE/fWehuCplPKLITjw1hbg9IGtIm20g="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
@@ -41,63 +41,63 @@
   },
   {
     "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.3.9",
-    "hash": "sha256-Kk3AmO7foyO5JdnGKfE9KwtVyGwe6SgUZnXCX/OuZjo="
+    "version": "11.3.11",
+    "hash": "sha256-Ki6O9HYbseQPV3DsvwmJ+ERimi/WmvzelNJDKP6loo0="
   },
   {
     "pname": "Avalonia.Controls.DataGrid",
-    "version": "11.3.9",
-    "hash": "sha256-VpJNTCaug7rtEfO2z1fFkAPXW2Y/lQSUInt6cVZC6DA="
+    "version": "11.3.11",
+    "hash": "sha256-xCRjXSd7ocHxuEzBhLokSHRrgtt4akJ7LUIC2oQ43io="
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.3.9",
-    "hash": "sha256-ib4psuecjBXKow0UC6oXvcVNhizFKokadCVqmwyQtCc="
+    "version": "11.3.11",
+    "hash": "sha256-oFivO8/0rir4BwQsTeWs3bSnb7RmldwxYmI77j5pt8k="
   },
   {
     "pname": "Avalonia.Diagnostics",
-    "version": "11.3.9",
-    "hash": "sha256-psajJAfqzLpMVx3//nezH7TixDJepN3/y6GwNn8k+TM="
+    "version": "11.3.11",
+    "hash": "sha256-p38+O0VDqZ8u5VOzImP21/U5wyP1BUp2UrLLc9HSfwE="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.9",
-    "hash": "sha256-+adR3ErHqoqTBAJ5hMiyP6efX/hCAcWWCowCqA0Bxrw="
+    "version": "11.3.11",
+    "hash": "sha256-UE2/w9cw3YDzsw3HuhI2sTPy8reH9C71ufmHOpzvlSQ="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.3.9",
-    "hash": "sha256-cQ9/MKZ03jaLqAGRDLCzws5OfP/mSOoPRr1OxXNGa3o="
+    "version": "11.3.11",
+    "hash": "sha256-vw67lp/oOt+2lqdJ5PK2FY93jqPTcgZqOAXLtSXlJ8s="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.9",
-    "hash": "sha256-HxHN91T0BbQMkcZwozuVOQwmywm1oayTLYvUozwt1J0="
+    "version": "11.3.11",
+    "hash": "sha256-l1f3rVygtI268llwbN0NvTDSfXwZE3CyRw8w5tbHBC4="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.3.9",
-    "hash": "sha256-KCL1LNUd2i+50vQpDgfI+aMkIBUWtxExyuc43QIK21o="
+    "version": "11.3.11",
+    "hash": "sha256-89TGu50JfEVFo+QZgyOR0uOagC/xoJvqfnrHep3W/cc="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "11.3.9",
-    "hash": "sha256-4HuNP/nSB7T+n9KZQgXNvbgudG3eITnDACj8Y2NV6OU="
+    "version": "11.3.11",
+    "hash": "sha256-tiJ0xAFf0UVSH7LASPtg/7ils7+vZjw2UKBMydyUR3Q="
   },
   {
     "pname": "Avalonia.Themes.Simple",
-    "version": "11.3.9",
-    "hash": "sha256-0MyHPZbkp0DduFwoOMScAOKpqQ/Zs6DOUfexVLKzSco="
+    "version": "11.3.11",
+    "hash": "sha256-AJS5Ls0tJ6PCr2mnr1PpxGWX4sII8mpe2R+VCFYRg44="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.3.9",
-    "hash": "sha256-OwWQymPLmN362vMD6kZk8dBD/+lSpvGqIW0T/AquYig="
+    "version": "11.3.11",
+    "hash": "sha256-6/NG4OrB/4YisXzJ51GPuq3uDn8oEUWyJRAqejyMCQw="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.3.9",
-    "hash": "sha256-B8P+m2VyPwXCyVWGAKewZCqO8fycgYWjWx830VbR79A="
+    "version": "11.3.11",
+    "hash": "sha256-2fiQvKxU/r71UOAQgy0zwSHVCM2uG2sdEUhObd5TrQQ="
   },
   {
     "pname": "ClosedXML",
@@ -151,8 +151,8 @@
   },
   {
     "pname": "Google.Protobuf",
-    "version": "3.33.2",
-    "hash": "sha256-iSEReaFbdV+86nnB6tfUzexzh6r06ItaaWwcRcvPwIM="
+    "version": "3.33.4",
+    "hash": "sha256-0XlseTCX3deAoElf8gicq7ZEjql1NSGYaQwgtX1+BbY="
   },
   {
     "pname": "HarfBuzzSharp",
@@ -200,45 +200,20 @@
     "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
   },
   {
-    "pname": "Microsoft.Build",
-    "version": "17.7.2",
-    "hash": "sha256-k35nFdPxC8t0zAltVSmAJtsepp/ubNIjPOsJ6k8jSqM="
+    "pname": "Microsoft.Build.Framework",
+    "version": "17.11.31",
+    "hash": "sha256-YS4oASrmC5dmZrx5JPS7SfKmUpIJErlUpVDsU3VrfFE="
   },
   {
     "pname": "Microsoft.Build.Framework",
-    "version": "17.14.28",
-    "hash": "sha256-7RzEyIipumafwLW1xN1q23114NafG6PT0+RADElNsiM="
-  },
-  {
-    "pname": "Microsoft.Build.Framework",
-    "version": "17.7.2",
-    "hash": "sha256-fNWmVQYFTJDveAGmxEdNqJRAczV6+Ep8RA8clKBJFqw="
-  },
-  {
-    "pname": "Microsoft.Build.Tasks.Core",
-    "version": "17.14.28",
-    "hash": "sha256-M9zRXYijH2HtLlRXbrUK1a1LQ9zkT+DC9ZmMiiVZwv0="
-  },
-  {
-    "pname": "Microsoft.Build.Tasks.Core",
-    "version": "17.7.2",
-    "hash": "sha256-OrV/qWgZHzGlNUmaSfX5wDBcmg1aQeF3/OUHpSH+uZU="
+    "version": "18.0.2",
+    "hash": "sha256-fO31KAdDs2J0RUYD1ov9UB3ucsbALan7K0YdWW+yg7A="
   },
   {
     "pname": "Microsoft.Build.Tasks.Git",
     "version": "8.0.0",
     "hash": "sha256-vX6/kPij8vNAu8f7rrvHHhPrNph20IcufmrBgZNxpQA="
   },
-  {
-    "pname": "Microsoft.Build.Utilities.Core",
-    "version": "17.14.28",
-    "hash": "sha256-VFfO+UpyTpw2X/qiCCOCYzvMLuu7B+XVSSpJZQLkPzU="
-  },
-  {
-    "pname": "Microsoft.Build.Utilities.Core",
-    "version": "17.7.2",
-    "hash": "sha256-oatF0KfuP1nb4+OLNKg2/R/ZLO4EiACaO5leaxMEY4A="
-  },
   {
     "pname": "Microsoft.CodeAnalysis.Analyzers",
     "version": "3.11.0",
@@ -246,94 +221,129 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.Common",
-    "version": "4.14.0",
-    "hash": "sha256-ne/zxH3GqoGB4OemnE8oJElG5mai+/67ASaKqwmL2BE="
+    "version": "5.0.0",
+    "hash": "sha256-g4ALvBSNyHEmSb1l5TFtWW7zEkiRmhqLx4XWZu9sr2U="
   },
   {
     "pname": "Microsoft.CodeAnalysis.CSharp",
-    "version": "4.14.0",
-    "hash": "sha256-5Mzj3XkYYLkwDWh17r1NEXSbXwwWYQPiOmkSMlgo1JY="
+    "version": "5.0.0",
+    "hash": "sha256-ctBCkQGFpH/xT5rRE3xibu9YxPD108RuC4a4Z25koG8="
   },
   {
     "pname": "Microsoft.CodeAnalysis.CSharp.Workspaces",
-    "version": "4.14.0",
-    "hash": "sha256-aNbV1a0yYBs0fpQawG6LXcbyoE8en+YFSpV5vcYE4J4="
+    "version": "5.0.0",
+    "hash": "sha256-yWVcLt/f2CouOfFy966glGdtSFy+RcgrU1dd9UtlL/Q="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Workspaces.Common",
-    "version": "4.14.0",
-    "hash": "sha256-0YfeaJe01WBUm9avy4a8FacQJXA1NkpnDpiXu4yz88I="
+    "version": "5.0.0",
+    "hash": "sha256-Bir5e1gEhgQQ6upQmVKQHAKLRfenAu60DAzNupNnZsQ="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Workspaces.MSBuild",
-    "version": "4.14.0",
-    "hash": "sha256-5SJfpRqzqCK0UbkmAaJpA/r1XJb0YAriMMeQHYC4d+o="
+    "version": "5.0.0",
+    "hash": "sha256-+58+iqTayTiE0pDaog1U8mjaDA8bNNDLA8gjCQZZudo="
   },
   {
     "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "10.0.0",
-    "hash": "sha256-04jYg9EbrQc+LH6wKh3ASCCNau6wZ5Gq0tDYd8oIHAs="
+    "version": "10.0.2",
+    "hash": "sha256-gpArXkjFSk62NA88ZYwWc0m4/2UsJyd9/8TCAsI8u4w="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore",
     "version": "10.0.0",
     "hash": "sha256-xfgrlxhtOkQwF5Q7j8gSm41URJiH8IuJ/T/Dh88++hE="
   },
+  {
+    "pname": "Microsoft.EntityFrameworkCore",
+    "version": "10.0.2",
+    "hash": "sha256-FS6T8EnaWCMtj4PnZhh+oF8mcM44VlM3wkTSMlpte9A="
+  },
   {
     "pname": "Microsoft.EntityFrameworkCore.Abstractions",
     "version": "10.0.0",
     "hash": "sha256-UDgZbRQcGPaKsE53EH6bvJiv+Q4KSxAbnsVhTVFGG4Q="
   },
+  {
+    "pname": "Microsoft.EntityFrameworkCore.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-qkDfIJpcPO2kk4n5OE/13hI/0mUygpTofInn95XjRZI="
+  },
   {
     "pname": "Microsoft.EntityFrameworkCore.Analyzers",
     "version": "10.0.0",
     "hash": "sha256-7Q0jYJO50cqGI+u6gLpootbB8GZvgsgtg0F9FZI1jig="
   },
+  {
+    "pname": "Microsoft.EntityFrameworkCore.Analyzers",
+    "version": "10.0.2",
+    "hash": "sha256-yOv78rgAACBz1zjitpcZbQQ3zx8huJongZTHkhN4PQ0="
+  },
   {
     "pname": "Microsoft.EntityFrameworkCore.Design",
-    "version": "10.0.0",
-    "hash": "sha256-wHIw05vHNtiv3K4xS1u+crZTn+kr7UJXoKOYwTr4SxY="
+    "version": "10.0.2",
+    "hash": "sha256-bTShsGux0y/49PIIMb/4ZX3x5+rPacvT5/NcooNCI1Y="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Relational",
     "version": "10.0.0",
     "hash": "sha256-vOP2CE5YA551BlpbOuIy6RuAiAEPEpCVS1cEE33/zN4="
   },
+  {
+    "pname": "Microsoft.EntityFrameworkCore.Relational",
+    "version": "10.0.2",
+    "hash": "sha256-Y4jPpoYhKizg5wF6QfkBX4sYlE2FU1bYhfoDN3xkhKM="
+  },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite",
-    "version": "10.0.0",
-    "hash": "sha256-tcBTibp0uApuqynWhxTintjkcC2oMfUQ8BJ2ORGWkKY="
+    "version": "10.0.2",
+    "hash": "sha256-s/bwWC9SdFKr93Oz57pImCB6hf/FYa+sCxtMYC7w+vQ="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite.Core",
-    "version": "10.0.0",
-    "hash": "sha256-Y5cM2fSh6b75L3dRdF0odXz4gKIYip/JIO1rsdkeOGM="
+    "version": "10.0.2",
+    "hash": "sha256-oIw6neqiY9JUyYg1lNi92ddDq6pWVOsn7DIBlGPOh+A="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Tools",
-    "version": "10.0.0",
-    "hash": "sha256-gqqJc38tmM3u9bbyboTxgN0nhtIH5cwwdU4ICHDgAFg="
+    "version": "10.0.2",
+    "hash": "sha256-dZCv8joGQQMrDNAgpB5c7CY+xdLeaZtOD3kt0VbQkto="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Abstractions",
-    "version": "10.0.0",
-    "hash": "sha256-IciARPnXx/S6HZc4t2ED06UyUwfZI9LKSzwKSGdpsfI="
+    "version": "10.0.2",
+    "hash": "sha256-nKmQuZTt1g5/8gBajo7wdCV64kdCucdiQR8JTt7ZZb0="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Memory",
     "version": "10.0.0",
     "hash": "sha256-AMgDSm1k6q0s17spGtyR5q8nAqUFDOxl/Fe38f9M+d4="
   },
+  {
+    "pname": "Microsoft.Extensions.Caching.Memory",
+    "version": "10.0.2",
+    "hash": "sha256-sRUF7DM0s1yzZnfjM/hF9A/IysE6Er23gZ6jST+RWh0="
+  },
   {
     "pname": "Microsoft.Extensions.Configuration",
     "version": "10.0.0",
     "hash": "sha256-MsLskVPpkCvov5+DWIaALCt1qfRRX4u228eHxvpE0dg="
   },
+  {
+    "pname": "Microsoft.Extensions.Configuration",
+    "version": "10.0.2",
+    "hash": "sha256-dBJAKDyp/sm+ZSMQfH0+4OH8Jnv1s20aHlWS6HNnH+c="
+  },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
     "version": "10.0.0",
     "hash": "sha256-GcgrnTAieCV7AVT13zyOjfwwL86e99iiO/MiMOxPGG0="
   },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-P+0kaDGO+xB9KxF9eWHDJ4hzi05sUGM/uMNEX5NdBTE="
+  },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
     "version": "9.0.0",
@@ -349,15 +359,25 @@
     "version": "10.0.0",
     "hash": "sha256-rN+3rqrHiTaBfHgP+E4dA8Qm2cFJPfbEcd93yKLsqlQ="
   },
+  {
+    "pname": "Microsoft.Extensions.Configuration.FileExtensions",
+    "version": "10.0.2",
+    "hash": "sha256-oOHg4UShuRyaflHJL1YLbkHSlwQtpZW2wONnsTKKiE4="
+  },
   {
     "pname": "Microsoft.Extensions.Configuration.Json",
     "version": "10.0.0",
     "hash": "sha256-VCFukgsxiQ2MFGE6RDMFTGopBHbcZL2t0ER7ENaFXRY="
   },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Json",
+    "version": "10.0.2",
+    "hash": "sha256-RDfVyrOP9E5kVax3VswqJzPFTHSm3MZ45gSRLO0qFWs="
+  },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.0",
-    "hash": "sha256-LYm9hVlo/R9c2aAKHsDYJ5vY9U0+3Jvclme3ou3BtvQ="
+    "version": "10.0.2",
+    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
@@ -369,6 +389,11 @@
     "version": "10.0.0",
     "hash": "sha256-9iodXP39YqgxomnOPOxd/mzbG0JfOSXzFoNU3omT2Ps="
   },
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
+  },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
     "version": "9.0.0",
@@ -376,8 +401,8 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "10.0.0",
-    "hash": "sha256-oCcIjmwH8H0n9bT3wQBWdotMvYuoiazfiKrXAs2bLiI="
+    "version": "10.0.2",
+    "hash": "sha256-w/dGIjtZiGH+KW3969BPOdQpQEV+WB7RPTa2MK2DavE="
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
@@ -389,21 +414,41 @@
     "version": "10.0.0",
     "hash": "sha256-CHDs2HCN8QcfuYQpgNVszZ5dfXFe4yS9K2GoQXecc20="
   },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-tibCkkT9WliU2E/i0ufx7/Va6H6QZX4hR/1oUp8ecgQ="
+  },
   {
     "pname": "Microsoft.Extensions.FileProviders.Physical",
     "version": "10.0.0",
     "hash": "sha256-2Rw/cwBO+/A3QY2IjN/c8Y0LhtC1qTBL7VdJiD1J2UQ="
   },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Physical",
+    "version": "10.0.2",
+    "hash": "sha256-HtzaL9KEFkyIyG31RIjj57yFBw6Ja3U6UYLP0LLesvw="
+  },
   {
     "pname": "Microsoft.Extensions.FileSystemGlobbing",
     "version": "10.0.0",
     "hash": "sha256-ETfVTdsdBtp69EggLg/AARTQW4lLQYVdVldXIQrsjZA="
   },
+  {
+    "pname": "Microsoft.Extensions.FileSystemGlobbing",
+    "version": "10.0.2",
+    "hash": "sha256-WHqwQLBlb4w+fw1KZVPvunir5cM/4jXExWRofgfVAxs="
+  },
   {
     "pname": "Microsoft.Extensions.Logging",
     "version": "10.0.0",
     "hash": "sha256-P+zPAadLL63k/GqK34/qChqQjY9aIRxZfxlB9lqsSrs="
   },
+  {
+    "pname": "Microsoft.Extensions.Logging",
+    "version": "10.0.2",
+    "hash": "sha256-9+gfQwK32JMYscW1YvyCWEzc9mRZOjCACoD9U1vVaJI="
+  },
   {
     "pname": "Microsoft.Extensions.Logging",
     "version": "9.0.0",
@@ -414,6 +459,11 @@
     "version": "10.0.0",
     "hash": "sha256-BnhgGZc01HwTSxogavq7Ueq4V7iMA3wPnbfRwQ4RhGk="
   },
+  {
+    "pname": "Microsoft.Extensions.Logging.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-ndKGzq8+2J/hvaIULwBui0L/jDyMQTAY24j+ohX5VX8="
+  },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
     "version": "9.0.0",
@@ -421,8 +471,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.0",
-    "hash": "sha256-j5MOqZSKeUtxxzmZjzZMGy0vELHdvPraqwTQQQNVsYA="
+    "version": "10.0.2",
+    "hash": "sha256-12AfUEDdta/pmZUyEyqSUfOk0YoA7JOfGmIYnZQ//qk="
   },
   {
     "pname": "Microsoft.Extensions.Options",
@@ -434,21 +484,16 @@
     "version": "10.0.0",
     "hash": "sha256-Dup08KcptLjlnpN5t5//+p4n8FUTgRAq4n/w1s6us+I="
   },
+  {
+    "pname": "Microsoft.Extensions.Primitives",
+    "version": "10.0.2",
+    "hash": "sha256-8Ccrjjv9cFVf9RyCc7GS/Byt8+DXdSNea0UX3A5BEdA="
+  },
   {
     "pname": "Microsoft.Extensions.Primitives",
     "version": "9.0.0",
     "hash": "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs="
   },
-  {
-    "pname": "Microsoft.NET.StringTools",
-    "version": "17.14.28",
-    "hash": "sha256-UzREyvDxkiOQ4cEOQ5UCjkwXGrldIDCcbefECTPGjXI="
-  },
-  {
-    "pname": "Microsoft.NET.StringTools",
-    "version": "17.7.2",
-    "hash": "sha256-hQE07TCgcQuyu9ZHVq2gPDb0+xe8ECJUdrgh17bJP4o="
-  },
   {
     "pname": "Microsoft.SourceLink.Common",
     "version": "8.0.0",
@@ -459,6 +504,11 @@
     "version": "8.0.0",
     "hash": "sha256-hNTkpKdCLY5kIuOmznD1mY+pRdJ0PKu2HypyXog9vb0="
   },
+  {
+    "pname": "Microsoft.VisualStudio.SolutionPersistence",
+    "version": "1.0.52",
+    "hash": "sha256-KZGPtOXe6Hv8RrkcsgoLKTRyaCScIpQEa2NhNB3iOXw="
+  },
   {
     "pname": "Mono.TextTemplating",
     "version": "3.0.0",
@@ -639,16 +689,6 @@
     "version": "6.0.0",
     "hash": "sha256-uPetUFZyHfxjScu5x4agjk9pIhbCkt5rG4Axj25npcQ="
   },
-  {
-    "pname": "System.CodeDom",
-    "version": "7.0.0",
-    "hash": "sha256-7IPt39cY+0j0ZcRr/J45xPtEjnSXdUJ/5ai3ebaYQiE="
-  },
-  {
-    "pname": "System.CodeDom",
-    "version": "9.0.0",
-    "hash": "sha256-578lcBgswW0eM16r0EnJzfGodPx86RxxFoZHc2PSzsw="
-  },
   {
     "pname": "System.Composition",
     "version": "9.0.0",
@@ -684,31 +724,11 @@
     "version": "10.0.0",
     "hash": "sha256-wiKDcpzYRM2Qsb9EE5luJYpjeItQXJT8LvdruqeqZtg="
   },
-  {
-    "pname": "System.Configuration.ConfigurationManager",
-    "version": "7.0.0",
-    "hash": "sha256-SgBexTTjRn23uuXvkzO0mz0qOfA23MiS4Wv+qepMLZE="
-  },
-  {
-    "pname": "System.Configuration.ConfigurationManager",
-    "version": "9.0.0",
-    "hash": "sha256-+pLnTC0YDP6Kjw5DVBiFrV/Q3x5is/+6N6vAtjvhVWk="
-  },
   {
     "pname": "System.Diagnostics.EventLog",
     "version": "10.0.0",
     "hash": "sha256-pN3tld926Fp0n5ZNjjzIJviUQrynlOAB0vhc1aoso6E="
   },
-  {
-    "pname": "System.Diagnostics.EventLog",
-    "version": "9.0.0",
-    "hash": "sha256-tPvt6yoAp56sK/fe+/ei8M65eavY2UUhRnbrREj/Ems="
-  },
-  {
-    "pname": "System.Formats.Nrbf",
-    "version": "9.0.0",
-    "hash": "sha256-c4qf6CocQUZB0ySGQd8s15PXY7xfrjQqMGXxkwytKyw="
-  },
   {
     "pname": "System.IO.Packaging",
     "version": "8.0.1",
@@ -729,76 +749,21 @@
     "version": "6.1.0",
     "hash": "sha256-zACYoZmKxHo0qKY8FOVa7jIsw7dN7WjdXdRRV95qY2Y="
   },
-  {
-    "pname": "System.Reflection.MetadataLoadContext",
-    "version": "7.0.0",
-    "hash": "sha256-VYl6SFD130K9Aw4eJH16ApJ9Sau4Xu0dcxEip2veuTI="
-  },
   {
     "pname": "System.Reflection.TypeExtensions",
     "version": "4.7.0",
     "hash": "sha256-GEtCGXwtOnkYejSV+Tfl+DqyGq5jTUaVyL9eMupMHBM="
   },
-  {
-    "pname": "System.Resources.Extensions",
-    "version": "9.0.0",
-    "hash": "sha256-y2gLEMuAy6QfEyNJxABC/ayMWGnwlpX735jsUQLktho="
-  },
-  {
-    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "7.0.0",
-    "hash": "sha256-3J3vL9hcKSuZjT2GKappa2A9p2xJm1nH2asTNAl8ZCA="
-  },
-  {
-    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "7.0.2",
-    "hash": "sha256-qS5Z/Yo8J+f3ExVX5Qkcpj1Z57oUZqz5rWa1h5bVpl8="
-  },
-  {
-    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "9.0.0",
-    "hash": "sha256-AjG14mGeSc2Ka4QSelGBM1LrGBW3VJX60lnihKyJjGY="
-  },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
     "version": "10.0.0",
     "hash": "sha256-hoR1lVXVEUXfItNzJ23/SRybLBqaf4ZYzJBjlWgHpSM="
   },
-  {
-    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.0",
-    "hash": "sha256-gPgPU7k/InTqmXoRzQfUMEKL3QuTnOKowFqmXTnWaBQ="
-  },
-  {
-    "pname": "System.Security.Cryptography.Xml",
-    "version": "7.0.1",
-    "hash": "sha256-CH8+JVC8LyCSW75/6ZQ7ecMbSOAE1c16z4dG8JTp01w="
-  },
-  {
-    "pname": "System.Security.Cryptography.Xml",
-    "version": "9.0.0",
-    "hash": "sha256-SQJWwAFrJUddEU6JiZB52FM9tGjRlJAYH8oYVzG5IJU="
-  },
-  {
-    "pname": "System.Security.Permissions",
-    "version": "7.0.0",
-    "hash": "sha256-DOFoX+AKRmrkllykHheR8FfUXYx/Ph+I/HYuReQydXI="
-  },
-  {
-    "pname": "System.Security.Permissions",
-    "version": "9.0.0",
-    "hash": "sha256-BFrA9ottmQtLIAiKiGRbfSUpzNJwuaOCeFRDN4Z0ku0="
-  },
   {
     "pname": "System.ServiceProcess.ServiceController",
     "version": "10.0.0",
     "hash": "sha256-94SnWmBG5zcg2JmzFb6H3KKBnyi7OtYhRY7imxju3d8="
   },
-  {
-    "pname": "System.Windows.Extensions",
-    "version": "9.0.0",
-    "hash": "sha256-RErD+Ju15qtnwdwB7E0SjjJGAnhXwJyC7UPcl24Z3Vs="
-  },
   {
     "pname": "Tmds.DBus.Protocol",
     "version": "0.21.2",
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 05fc502a2be5..bf5f9f89802a 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "13.1.1";
+  version = "13.1.3";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-c/K8jAWwul0FQGYxEbuhQnqXe5+R57TzOXwWUv68M1Q=";
+    hash = "sha256-gK0UZ+3EZGVEiy+O47GhU4wsHmdPIbrHWyHnUOtWrm8=";
   };
 
   sourceRoot = "${src.name}/Source";
diff --git a/pkgs/development/libraries/libbap/default.nix b/pkgs/by-name/li/libbap/package.nix
similarity index 88%
rename from pkgs/development/libraries/libbap/default.nix
rename to pkgs/by-name/li/libbap/package.nix
index 91957222f168..8b143e3c430b 100644
--- a/pkgs/development/libraries/libbap/default.nix
+++ b/pkgs/by-name/li/libbap/package.nix
@@ -2,13 +2,9 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  bap,
-  ocaml,
-  findlib,
-  ctypes,
-  ctypes-foreign,
   autoreconfHook,
   which,
+  ocaml-ng,
 }:
 
 stdenv.mkDerivation {
@@ -25,10 +21,13 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     autoreconfHook
     which
+  ]
+  ++ (with ocaml-ng.ocamlPackages_4_14; [
     ocaml
     findlib
-  ];
-  buildInputs = [
+  ]);
+
+  buildInputs = with ocaml-ng.ocamlPackages_4_14; [
     bap
     ctypes
     ctypes-foreign
diff --git a/pkgs/development/libraries/libbutl/install-h-files.patch b/pkgs/by-name/li/libbutl/install-h-files.patch
similarity index 100%
rename from pkgs/development/libraries/libbutl/install-h-files.patch
rename to pkgs/by-name/li/libbutl/install-h-files.patch
diff --git a/pkgs/development/libraries/libbutl/default.nix b/pkgs/by-name/li/libbutl/package.nix
similarity index 84%
rename from pkgs/development/libraries/libbutl/default.nix
rename to pkgs/by-name/li/libbutl/package.nix
index c653d43ea45c..5996967cef24 100644
--- a/pkgs/development/libraries/libbutl/default.nix
+++ b/pkgs/by-name/li/libbutl/package.nix
@@ -1,8 +1,9 @@
 {
   lib,
   stdenv,
-  build2,
-  DarwinTools,
+  # Dependency of build2, so we must break cycle for this
+  build2-bootstrap,
+  darwin,
   fetchurl,
   libuuid,
   enableShared ? !stdenv.hostPlatform.isStatic,
@@ -25,10 +26,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    build2
+    build2-bootstrap
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    DarwinTools
+    darwin.DarwinTools
   ];
 
   patches = [
@@ -41,7 +42,7 @@ stdenv.mkDerivation rec {
 
   # Should be true for anything built with build2,
   # but especially important when bootstrapping
-  disallowedReferences = [ build2 ];
+  disallowedReferences = [ build2-bootstrap ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace libbutl/uuid-linux.cxx \
@@ -49,7 +50,7 @@ stdenv.mkDerivation rec {
   '';
 
   build2ConfigureFlags = [
-    "config.bin.lib=${build2.configSharedStatic enableShared enableStatic}"
+    "config.bin.lib=${build2-bootstrap.configSharedStatic enableShared enableStatic}"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/by-name/li/libcdr/package.nix
similarity index 97%
rename from pkgs/development/libraries/libcdr/default.nix
rename to pkgs/by-name/li/libcdr/package.nix
index eca26ecfd7ea..bec87a9a76fa 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/by-name/li/libcdr/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
   libwpg,
   libwpd,
-  lcms,
+  lcms2,
   pkg-config,
   librevenge,
   icu,
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libwpg
     libwpd
-    lcms
+    lcms2
     librevenge
     icu
     boost
diff --git a/pkgs/development/libraries/libcec/default.nix b/pkgs/by-name/li/libcec/package.nix
similarity index 100%
rename from pkgs/development/libraries/libcec/default.nix
rename to pkgs/by-name/li/libcec/package.nix
diff --git a/pkgs/development/libraries/libcec/platform.nix b/pkgs/by-name/li/libcec_platform/package.nix
similarity index 100%
rename from pkgs/development/libraries/libcec/platform.nix
rename to pkgs/by-name/li/libcec_platform/package.nix
diff --git a/pkgs/development/libraries/libcryptui/debian-patches.nix b/pkgs/by-name/li/libcryptui/debian-patches.nix
similarity index 100%
rename from pkgs/development/libraries/libcryptui/debian-patches.nix
rename to pkgs/by-name/li/libcryptui/debian-patches.nix
diff --git a/pkgs/development/libraries/libcryptui/debian-patches.txt b/pkgs/by-name/li/libcryptui/debian-patches.txt
similarity index 100%
rename from pkgs/development/libraries/libcryptui/debian-patches.txt
rename to pkgs/by-name/li/libcryptui/debian-patches.txt
diff --git a/pkgs/development/libraries/libcryptui/default.nix b/pkgs/by-name/li/libcryptui/package.nix
similarity index 93%
rename from pkgs/development/libraries/libcryptui/default.nix
rename to pkgs/by-name/li/libcryptui/package.nix
index 5a476aeba795..5ce3f093ead0 100644
--- a/pkgs/development/libraries/libcryptui/default.nix
+++ b/pkgs/by-name/li/libcryptui/package.nix
@@ -10,6 +10,8 @@
   glib,
   gnome,
   gtk3,
+  gtk3-x11,
+  gtk3' ? if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3,
   gtk-doc,
   gnupg,
   gpgme,
@@ -37,14 +39,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     dbus-glib # dbus-binding-tool
-    gtk3 # AM_GLIB_GNU_GETTEXT
+    gtk3' # AM_GLIB_GNU_GETTEXT
     gtk-doc
     intltool
     autoreconfHook
   ];
   buildInputs = [
     glib
-    gtk3
+    gtk3'
     gnupg
     gpgme
     dbus-glib
diff --git a/pkgs/development/libraries/libcxxrt/default.nix b/pkgs/by-name/li/libcxxrt/package.nix
similarity index 78%
rename from pkgs/development/libraries/libcxxrt/default.nix
rename to pkgs/by-name/li/libcxxrt/package.nix
index 228106ac5caf..aee1dcb01ff5 100644
--- a/pkgs/development/libraries/libcxxrt/default.nix
+++ b/pkgs/by-name/li/libcxxrt/package.nix
@@ -1,12 +1,19 @@
 {
   lib,
   stdenv,
+  overrideCC,
+  buildPackages,
+  stdenv' ?
+    if stdenv.hostPlatform.useLLVM or false then
+      overrideCC stdenv buildPackages.llvmPackages.tools.clangNoLibcxx
+    else
+      stdenv,
   fetchFromGitHub,
   cmake,
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv'.mkDerivation {
   pname = "libcxxrt";
   version = "4.0.10-unstable-2025-02-25";
 
@@ -32,7 +39,7 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $dev/include $out/lib
     cp ../src/cxxabi.h $dev/include
-    cp lib/libcxxrt${stdenv.hostPlatform.extensions.library} $out/lib
+    cp lib/libcxxrt${stdenv'.hostPlatform.extensions.library} $out/lib
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/libdvdnav/default.nix b/pkgs/by-name/li/libdvdnav/package.nix
similarity index 100%
rename from pkgs/development/libraries/libdvdnav/default.nix
rename to pkgs/by-name/li/libdvdnav/package.nix
diff --git a/pkgs/development/libraries/libdvdnav/4.2.1.nix b/pkgs/by-name/li/libdvdnav_4_2_1/package.nix
similarity index 96%
rename from pkgs/development/libraries/libdvdnav/4.2.1.nix
rename to pkgs/by-name/li/libdvdnav_4_2_1/package.nix
index 6b72938f7811..2af5f90057a8 100644
--- a/pkgs/development/libraries/libdvdnav/4.2.1.nix
+++ b/pkgs/by-name/li/libdvdnav_4_2_1/package.nix
@@ -3,9 +3,11 @@
   stdenv,
   fetchurl,
   pkg-config,
-  libdvdread,
+  libdvdread_4_9_9,
 }:
-
+let
+  libdvdread = libdvdread_4_9_9;
+in
 stdenv.mkDerivation rec {
   pname = "libdvdnav";
   version = "4.2.1";
diff --git a/pkgs/development/libraries/libdvdread/default.nix b/pkgs/by-name/li/libdvdread/package.nix
similarity index 100%
rename from pkgs/development/libraries/libdvdread/default.nix
rename to pkgs/by-name/li/libdvdread/package.nix
diff --git a/pkgs/development/libraries/libdvdread/4.9.9.nix b/pkgs/by-name/li/libdvdread_4_9_9/package.nix
similarity index 100%
rename from pkgs/development/libraries/libdvdread/4.9.9.nix
rename to pkgs/by-name/li/libdvdread_4_9_9/package.nix
diff --git a/pkgs/development/libraries/libextractor/gst-hardcode-plugins.patch b/pkgs/by-name/li/libextractor/gst-hardcode-plugins.patch
similarity index 100%
rename from pkgs/development/libraries/libextractor/gst-hardcode-plugins.patch
rename to pkgs/by-name/li/libextractor/gst-hardcode-plugins.patch
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/by-name/li/libextractor/package.nix
similarity index 100%
rename from pkgs/development/libraries/libextractor/default.nix
rename to pkgs/by-name/li/libextractor/package.nix
diff --git a/pkgs/development/libraries/libffi/freebsd-tsan-pthread.patch b/pkgs/by-name/li/libffiReal/freebsd-tsan-pthread.patch
similarity index 100%
rename from pkgs/development/libraries/libffi/freebsd-tsan-pthread.patch
rename to pkgs/by-name/li/libffiReal/freebsd-tsan-pthread.patch
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/by-name/li/libffiReal/package.nix
similarity index 100%
rename from pkgs/development/libraries/libffi/default.nix
rename to pkgs/by-name/li/libffiReal/package.nix
diff --git a/pkgs/development/libraries/libffi/3.3.nix b/pkgs/by-name/li/libffi_3_3/package.nix
similarity index 100%
rename from pkgs/development/libraries/libffi/3.3.nix
rename to pkgs/by-name/li/libffi_3_3/package.nix
diff --git a/pkgs/development/libraries/libgda/0001-gcc14-fix.patch b/pkgs/by-name/li/libgda5/0001-gcc14-fix.patch
similarity index 100%
rename from pkgs/development/libraries/libgda/0001-gcc14-fix.patch
rename to pkgs/by-name/li/libgda5/0001-gcc14-fix.patch
diff --git a/pkgs/development/libraries/libgda/5.x.nix b/pkgs/by-name/li/libgda5/package.nix
similarity index 100%
rename from pkgs/development/libraries/libgda/5.x.nix
rename to pkgs/by-name/li/libgda5/package.nix
diff --git a/pkgs/development/libraries/libgda/6.x.nix b/pkgs/by-name/li/libgda6/package.nix
similarity index 100%
rename from pkgs/development/libraries/libgda/6.x.nix
rename to pkgs/by-name/li/libgda6/package.nix
diff --git a/pkgs/development/libraries/libgnome-games-support/default.nix b/pkgs/by-name/li/libgnome-games-support/package.nix
similarity index 100%
rename from pkgs/development/libraries/libgnome-games-support/default.nix
rename to pkgs/by-name/li/libgnome-games-support/package.nix
diff --git a/pkgs/development/libraries/libgnome-games-support/2.0.nix b/pkgs/by-name/li/libgnome-games-support_2_0/package.nix
similarity index 100%
rename from pkgs/development/libraries/libgnome-games-support/2.0.nix
rename to pkgs/by-name/li/libgnome-games-support_2_0/package.nix
diff --git a/pkgs/development/libraries/libhandy/default.nix b/pkgs/by-name/li/libhandy/package.nix
similarity index 100%
rename from pkgs/development/libraries/libhandy/default.nix
rename to pkgs/by-name/li/libhandy/package.nix
diff --git a/pkgs/development/libraries/libhandy/0.x.nix b/pkgs/by-name/li/libhandy_0/package.nix
similarity index 94%
rename from pkgs/development/libraries/libhandy/0.x.nix
rename to pkgs/by-name/li/libhandy_0/package.nix
index f6976ba19e0b..d1ef1ede527f 100644
--- a/pkgs/development/libraries/libhandy/0.x.nix
+++ b/pkgs/by-name/li/libhandy_0/package.nix
@@ -1,3 +1,4 @@
+# Needed for apps that still depend on the unstable version of the library (not libhandy-1)
 {
   lib,
   stdenv,
diff --git a/pkgs/by-name/li/libivykis/package.nix b/pkgs/by-name/li/libivykis/package.nix
index ecb9a03dca77..e6232dd1daed 100644
--- a/pkgs/by-name/li/libivykis/package.nix
+++ b/pkgs/by-name/li/libivykis/package.nix
@@ -27,6 +27,12 @@ stdenv.mkDerivation rec {
     protobufc
   ];
 
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
   meta = {
     homepage = "https://libivykis.sourceforge.net/";
     description = ''
diff --git a/pkgs/by-name/li/lincity-ng/package.nix b/pkgs/by-name/li/lincity-ng/package.nix
index bf18626698d7..734b8868105c 100644
--- a/pkgs/by-name/li/lincity-ng/package.nix
+++ b/pkgs/by-name/li/lincity-ng/package.nix
@@ -77,7 +77,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "City building game";
     mainProgram = "lincity-ng";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ raskin ];
+    maintainers = with lib.maintainers; [
+      raskin
+      iedame
+    ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/li/lincity/package.nix b/pkgs/by-name/li/lincity/package.nix
index 7f32ad174340..b399b8c0427c 100644
--- a/pkgs/by-name/li/lincity/package.nix
+++ b/pkgs/by-name/li/lincity/package.nix
@@ -84,6 +84,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "xlincity";
     license = lib.licenses.gpl2Plus;
     homepage = "https://sourceforge.net/projects/lincity";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
   };
 })
diff --git a/pkgs/by-name/lo/logseq/fix-yarn-lock.patch b/pkgs/by-name/lo/logseq/fix-yarn-lock.patch
new file mode 100644
index 000000000000..6264b1a0a84c
--- /dev/null
+++ b/pkgs/by-name/lo/logseq/fix-yarn-lock.patch
@@ -0,0 +1,101 @@
+diff --git a/static/yarn.lock b/static/yarn.lock
+index 36b4476..0e7c5ee 100644
+--- a/static/yarn.lock
++++ b/static/yarn.lock
+@@ -1444,11 +1444,6 @@ ansi-regex@^5.0.1:
+   resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-5.0.1.tgz#082cb2c89c9fe8659a311a53bd6a4dc5301db304"
+   integrity sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==
+ 
+-ansi-regex@^6.0.1:
+-  version "6.2.2"
+-  resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.2.2.tgz#60216eea464d864597ce2832000738a0589650c1"
+-  integrity sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==
+-
+ ansi-styles@^4.0.0, ansi-styles@^4.1.0:
+   version "4.3.0"
+   resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-4.3.0.tgz#edd803628ae71c04c85ae7a0906edad34b648937"
+@@ -1461,11 +1456,6 @@ ansi-styles@^6.0.0:
+   resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-6.2.1.tgz#0e62320cf99c21afff3b3012192546aacbfb05c5"
+   integrity sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==
+ 
+-ansi-styles@^6.2.1:
+-  version "6.2.3"
+-  resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-6.2.3.tgz#c044d5dcc521a076413472597a1acb1f103c4041"
+-  integrity sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==
+-
+ anymatch@~3.1.2:
+   version "3.1.3"
+   resolved "https://registry.yarnpkg.com/anymatch/-/anymatch-3.1.3.tgz#790c58b19ba1720a84205b57c618d5ad8524973e"
+@@ -3081,11 +3071,6 @@ get-caller-file@^2.0.5:
+   resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
+   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
+ 
+-get-east-asian-width@^1.3.0:
+-  version "1.4.0"
+-  resolved "https://registry.yarnpkg.com/get-east-asian-width/-/get-east-asian-width-1.4.0.tgz#9bc4caa131702b4b61729cb7e42735bc550c9ee6"
+-  integrity sha512-QZjmEOC+IT1uk6Rx0sX22V6uHWVwbdbxf1faPqJ1QhLdGgsRGCZoyaQBm/piRdJy/D2um6hM1UP7ZEeQ4EkP+Q==
+-
+ get-folder-size@^2.0.1:
+   version "2.0.1"
+   resolved "https://registry.yarnpkg.com/get-folder-size/-/get-folder-size-2.0.1.tgz#3fe0524dd3bad05257ef1311331417bcd020a497"
+@@ -5201,13 +5186,14 @@ stream-buffers@~2.2.0:
+     is-fullwidth-code-point "^3.0.0"
+     strip-ansi "^6.0.1"
+ 
+-string-width@8.1.0, string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3, string-width@^5.0.0, string-width@^5.1.2, string-width@^7.0.0:
+-  version "8.1.0"
+-  resolved "https://registry.yarnpkg.com/string-width/-/string-width-8.1.0.tgz#9e9fb305174947cf45c30529414b5da916e9e8d1"
+-  integrity sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==
++string-width@4.2.0, string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3, string-width@^5.0.0, string-width@^5.1.2:
++  version "4.2.0"
++  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.0.tgz#952182c46cc7b2c313d1596e623992bd163b72b5"
++  integrity sha512-zUz5JD+tgqtuDjMhwIg5uFVV3dtqZ9yQJlZVfq4I01/K5Paj5UHj7VyrQOJvzawSVlKpObApbfD0Ed6yJc+1eg==
+   dependencies:
+-    get-east-asian-width "^1.3.0"
+-    strip-ansi "^7.1.0"
++    emoji-regex "^8.0.0"
++    is-fullwidth-code-point "^3.0.0"
++    strip-ansi "^6.0.0"
+ 
+ string_decoder@^1.1.1:
+   version "1.3.0"
+@@ -5223,12 +5209,12 @@ string_decoder@^1.1.1:
+   dependencies:
+     ansi-regex "^5.0.1"
+ 
+-strip-ansi@7.1.2, strip-ansi@^6.0.0, strip-ansi@^6.0.1, strip-ansi@^7.0.1, strip-ansi@^7.1.0:
+-  version "7.1.2"
+-  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.1.2.tgz#132875abde678c7ea8d691533f2e7e22bb744dba"
+-  integrity sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==
++strip-ansi@^6.0.0, strip-ansi@^6.0.1, strip-ansi@^7.0.1:
++  version "6.0.1"
++  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
++  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
+   dependencies:
+-    ansi-regex "^6.0.1"
++    ansi-regex "^5.0.1"
+ 
+ strip-bom@^3.0.0:
+   version "3.0.0"
+@@ -5710,14 +5696,14 @@ word-wrap@^1.2.3:
+     string-width "^4.1.0"
+     strip-ansi "^6.0.0"
+ 
+-wrap-ansi@9.0.2, wrap-ansi@^6.2.0, wrap-ansi@^7.0.0, wrap-ansi@^8.0.1, wrap-ansi@^8.1.0:
+-  version "9.0.2"
+-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-9.0.2.tgz#956832dea9494306e6d209eb871643bb873d7c98"
+-  integrity sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==
++wrap-ansi@^6.2.0, wrap-ansi@^7.0.0, wrap-ansi@^8.0.1, wrap-ansi@^8.1.0:
++  version "7.0.0"
++  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
++  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
+   dependencies:
+-    ansi-styles "^6.2.1"
+-    string-width "^7.0.0"
+-    strip-ansi "^7.1.0"
++    ansi-styles "^4.0.0"
++    string-width "^4.1.0"
++    strip-ansi "^6.0.0"
+ 
+ wrappy@1:
+   version "1.0.2"
diff --git a/pkgs/by-name/lo/logseq/package.nix b/pkgs/by-name/lo/logseq/package.nix
index 49f7a2b467a3..7dd0325b6784 100644
--- a/pkgs/by-name/lo/logseq/package.nix
+++ b/pkgs/by-name/lo/logseq/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "logseq";
-  version = "0.10.14";
+  version = "0.10.15";
 
   src = fetchFromGitHub {
     owner = "logseq";
     repo = "logseq";
     tag = finalAttrs.version;
-    hash = "sha256-jIkAiSCYIO5w/jM/Bv/odTuluRi3W/w4tTaUTmaYvEA=";
+    hash = "sha256-knosNA2Gqy10Kr9HWnBdYNlV51zzgFuL8cdioVlAk0Q=";
   };
 
   patches = [
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ./electron-forge-package-instead-of-make.patch
     ./electron-forge-disable-signing.patch
+    ./fix-yarn-lock.patch
   ];
 
   mavenRepo = stdenv.mkDerivation {
@@ -98,30 +99,30 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCacheRoot = fetchYarnDeps {
     name = "logseq-${finalAttrs.version}-yarn-deps-root";
-    inherit (finalAttrs) src;
-    hash = "sha256-eSMtHA4Ob7EVb5qEzAj+WjGyyFjA0ZEvTsaoMx0bgjc=";
+    inherit (finalAttrs) src patches;
+    hash = "sha256-xfAJ38shd92KdRfh/P7BH4eolZHQmzl4raoH1aZpGRk=";
   };
 
   # ./static and ./resources are combined into ./static by the build process
   # ./static contains the lockfile and ./resources contains everything else
   yarnOfflineCacheStaticResources = fetchYarnDeps {
     name = "logseq-${finalAttrs.version}-yarn-deps-static-resources";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/static";
-    hash = "sha256-01t6lolMbBL5f6SFk4qTkTx6SQXWtHuVkBhDwW+HScc=";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd ./static";
+    hash = "sha256-zAGEQlOqKfPDrIoZQUnjBifgdYDYRsiHH7PUNrd0u+8=";
   };
 
   yarnOfflineCacheAmplify = fetchYarnDeps {
     name = "logseq-${finalAttrs.version}-yarn-deps-amplify";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/packages/amplify";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd ./packages/amplify";
     hash = "sha256-IOhSwIf5goXCBDGHCqnsvWLf3EUPqq75xfQg55snIp4=";
   };
 
   yarnOfflineCacheTldraw = fetchYarnDeps {
     name = "logseq-${finalAttrs.version}-yarn-deps-tldraw";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/tldraw";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd ./tldraw";
     hash = "sha256-CtMl3MPlyO5nWfFhCC1SLb/+1HUM3YfFATAPqJg3rUo=";
   };
 
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index 8117d0a1987c..a50a2930e7e4 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.704";
+  version = "0.705";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-4fqtp8iWOfqymikjT8uluuqK2//pZbZ236NJCmz+9WE=";
+    hash = "sha256-M0niHRtx/Xu3H5CJXbqB2VCXFsthvPDNcr29egY3ncI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/me/mediagoblin/package.nix b/pkgs/by-name/me/mediagoblin/package.nix
index f9a71182c4ca..6c6269d9ce22 100644
--- a/pkgs/by-name/me/mediagoblin/package.nix
+++ b/pkgs/by-name/me/mediagoblin/package.nix
@@ -175,6 +175,9 @@ python.pkgs.buildPythonApplication rec {
     description = "Free software media publishing platform that anyone can run";
     homepage = "https://mediagoblin.org/";
     license = lib.licenses.agpl3Plus;
-    teams = with lib.maintainers; [ SuperSandro2000 ];
+    maintainers = with lib.maintainers; [
+      # for the C3D2
+      SuperSandro2000
+    ];
   };
 }
diff --git a/pkgs/by-name/me/mediawiki/package.nix b/pkgs/by-name/me/mediawiki/package.nix
index 44d2c3a23a54..5274b8886943 100644
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@@ -40,6 +40,9 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     homepage = "https://www.mediawiki.org/";
     platforms = lib.platforms.all;
-    teams = with lib.maintainers; [ SuperSandro2000 ];
+    maintainers = with lib.maintainers; [
+      # for the C3D2
+      SuperSandro2000
+    ];
   };
 }
diff --git a/pkgs/by-name/mh/mhabit/package.nix b/pkgs/by-name/mh/mhabit/package.nix
index b1d11829cb4a..82aec6204858 100644
--- a/pkgs/by-name/mh/mhabit/package.nix
+++ b/pkgs/by-name/mh/mhabit/package.nix
@@ -12,13 +12,13 @@
 }:
 
 let
-  version = "1.23.3+142";
+  version = "1.23.6+145";
 
   src = fetchFromGitHub {
     owner = "FriesI23";
     repo = "mhabit";
     tag = "v${version}";
-    hash = "sha256-jseb1AcM+AygVLFN3O5P2LiQppxOuLWMmBON0FRqPFQ=";
+    hash = "sha256-9+UXMOogySW3f9LPaj0YSfov1cSgLb3I+jWvAV8yEsM=";
   };
 in
 flutter338.buildFlutterApplication {
diff --git a/pkgs/by-name/mv/mvoice/package.nix b/pkgs/by-name/mv/mvoice/package.nix
new file mode 100644
index 000000000000..d5d9b1edb92f
--- /dev/null
+++ b/pkgs/by-name/mv/mvoice/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  gettext,
+  fltk-minimal,
+  alsa-lib,
+  opendht,
+  msgpack-cxx,
+  fmt,
+  gnutls,
+  nlohmann_json,
+  curl,
+  copyDesktopItems,
+  makeDesktopItem,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation {
+  pname = "mvoice";
+  version = "0-unstable-2025-09-19";
+
+  src = fetchFromGitHub {
+    owner = "n7tae";
+    repo = "mvoice";
+    rev = "aef3662ee6ef86ecb10a71dd686ca41a067162c0";
+    hash = "sha256-FosfD1949shlPXq594gdqodlXM3cGKpFi68tc+/YQ4g=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    fltk-minimal
+    gettext
+  ];
+
+  buildInputs = [
+    alsa-lib
+    curl
+    fltk-minimal
+    fmt
+    gnutls
+    msgpack-cxx
+    nlohmann_json
+    opendht
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "mvoice";
+      desktopName = "MVoice";
+      comment = "MVoice by N7TAE - M17 figital voice gateway";
+      exec = "mvoice";
+      categories = [
+        "Network"
+        "X-Ham Radio"
+      ];
+    })
+  ];
+
+  postPatch = ''
+    # fix hardcoded paths in Makefile
+    substituteInPlace Makefile \
+      --replace-fail "g++" "\$(CXX)" \
+      --replace-fail "/bin/cp" "cp"
+  '';
+
+  makeFlags = [
+    "BASEDIR=$(out)"
+    "CFGDIR=.config/mvoice"
+    "DEBUG=false"
+    "USE44100=false"
+    "USE_DHT=true"
+  ];
+
+  meta = {
+    description = "M17 digital voice gateway and module for voice and data modes";
+    homepage = "https://github.com/n7tae/mvoice";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.juliabru ];
+  };
+}
diff --git a/pkgs/by-name/na/naabu/package.nix b/pkgs/by-name/na/naabu/package.nix
index 647fac2fdba7..d7d036d91c00 100644
--- a/pkgs/by-name/na/naabu/package.nix
+++ b/pkgs/by-name/na/naabu/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.3.7";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     tag = "v${version}";
-    hash = "sha256-caiUb++eaZN+v/uZ/kgBMztv0saSiBrpqQ2QMbgjLlY=";
+    hash = "sha256-Jubam5UoWYWK8AoRVxbaibzU9Qv/X7VFfGtQxoY008Y=";
   };
 
-  vendorHash = "sha256-RGDMOR65IWtkBnVX2NCIu20vvuQNi0+mBcf0Sc8EXJg=";
+  vendorHash = "sha256-h0/mTUbgCwzIAvIh9i1ZAgMa9undo8DkC0jGOZdUu20=";
 
   buildInputs = [ libpcap ];
 
diff --git a/pkgs/by-name/ne/netcoredbg/deps.json b/pkgs/by-name/ne/netcoredbg/deps.json
index 66a3323b62c1..47ee807db09c 100644
--- a/pkgs/by-name/ne/netcoredbg/deps.json
+++ b/pkgs/by-name/ne/netcoredbg/deps.json
@@ -31,63 +31,63 @@
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim",
-    "version": "9.0.621003",
-    "hash": "sha256-xdRwwLonXgqp4G+HWmFe5pEdv/x0L51/8jOqV5allZ4="
+    "version": "9.0.652701",
+    "hash": "sha256-EVWVR132N7BTBxNTlBL/EWz8hd/Rxqra0R4xnKcN0pw="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-arm",
-    "version": "9.0.621003",
-    "hash": "sha256-wcr6S8ktct8XNtXnEOCUHqA13N+7rQytgGkUsp1j4aU="
+    "version": "9.0.652701",
+    "hash": "sha256-FVr/K2CV4kLZH1dRLg7201msmYvdnVJdtdYz/m02N/Y="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-arm64",
-    "version": "9.0.621003",
-    "hash": "sha256-OGsfVeZ4LcgOb2aM/e38Kyw9YGBn0t0uH8qgFdj8SIA="
+    "version": "9.0.652701",
+    "hash": "sha256-9EsI/x61T839NH0UUoqG20nney5V365ZCFR4VJJ0jjM="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-arm",
-    "version": "9.0.621003",
-    "hash": "sha256-ZUno/Sd0UWYVVD20sJj/HleDfLcb7kf32j5NvIAYSMc="
+    "version": "9.0.652701",
+    "hash": "sha256-RLfYL/X6kpEn5oVCtbOjLAMenI2IrKDtPAInk8HCexc="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-arm64",
-    "version": "9.0.621003",
-    "hash": "sha256-SKrqZiGnDdisdCIIETozCuSgj3JCAZeWfo2Ru/sMmOw="
+    "version": "9.0.652701",
+    "hash": "sha256-TSdYOwDvdoZSm1ZamYOIIZFtuoAXTC8uT030o9x9gGQ="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-x64",
-    "version": "9.0.621003",
-    "hash": "sha256-/kEBxB4puJJHwC71W2QQlOMykKCeNGvNy2j6s91g6jc="
+    "version": "9.0.652701",
+    "hash": "sha256-8gfOZqsncJU9tu2zBW0P4leAh00hQoKr2wGFEdsGAYM="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-x64",
-    "version": "9.0.621003",
-    "hash": "sha256-rW9QGI1awjHBHWaMwFtfhgXuR3X/PBxuks0DgnT2684="
+    "version": "9.0.652701",
+    "hash": "sha256-5tGGBHkvJp1foB3fkrgKqVPR1nkiTDemPNG0FQ/2WhY="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.osx-arm64",
-    "version": "9.0.621003",
-    "hash": "sha256-BXi0IePavjClLQcSrXZXGOqkkoymdecw9ZFf5w0mpRs="
+    "version": "9.0.652701",
+    "hash": "sha256-vJNeE3v2hiAqD+joH1+ef6lmQ0hE/NQvce1z4oV3Cug="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.osx-x64",
-    "version": "9.0.621003",
-    "hash": "sha256-FXkjxK3Bq4twUJ69aqsCgv2hNpO2Lkuz7EPAtqxJWd0="
+    "version": "9.0.652701",
+    "hash": "sha256-dDtcRaRg3GoMDMYZ3MEVR1LEBbBHFZpIteZzaAo/GVs="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-arm64",
-    "version": "9.0.621003",
-    "hash": "sha256-NScEkmv6oh+wXn5D7Nb0AoNSb1PU+HgUpd8fpup+a6o="
+    "version": "9.0.652701",
+    "hash": "sha256-KMrQhEVVB7hbDgdWpm2ZmQY66QiVg62C5x2DEhJvRnE="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-x64",
-    "version": "9.0.621003",
-    "hash": "sha256-sfe0tF2D3BpktS9J0o1xsR2cWIkDGhzXaUvKsgHDqC0="
+    "version": "9.0.652701",
+    "hash": "sha256-hZCwn81P8v0Oh+PEXnzlCZIaSdDr5NvTOVf090LikKQ="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-x86",
-    "version": "9.0.621003",
-    "hash": "sha256-CRUYEGm3lqOO3FDn8kr3OUjxmIHNe1ntihN6UaFeDs8="
+    "version": "9.0.652701",
+    "hash": "sha256-zxcpC/reDAaJ4A6Bsk3tcPfgdcOVcLYBMFBUT9Eb4bI="
   },
   {
     "pname": "Microsoft.NETCore.Platforms",
diff --git a/pkgs/by-name/ne/netcoredbg/package.nix b/pkgs/by-name/ne/netcoredbg/package.nix
index 36524bec3962..cbfac3b69565 100644
--- a/pkgs/by-name/ne/netcoredbg/package.nix
+++ b/pkgs/by-name/ne/netcoredbg/package.nix
@@ -12,30 +12,39 @@
 }:
 let
   pname = "netcoredbg";
-  build = "1054";
-  release = "3.1.2";
+  build = "1062";
+  release = "3.1.3";
   version = "${release}-${build}";
-  hash = "sha256-WORGZXbq6d3sxGqyG8oZSwcBoVaD3D56t9K6PJoKFsM=";
+  hash = "sha256-Ci4GwHYTCn7BoEG73WsjxyplCCThSF5uVi39lLVZDXY=";
 
-  coreclr-version = "v8.0.16";
+  coreclr-version = "v10.0.1";
   coreclr-src = fetchFromGitHub {
     owner = "dotnet";
     repo = "runtime";
     rev = coreclr-version;
-    hash = "sha256-/fSKCIugR3UhqxBxtQRw+Bw+UpaSjB4xj0iBiXJaiR4=";
+    hash = "sha256-pVcLvew3THRqXgKMVO6jTZyPP06R46KZPMpYdiM3yXU=";
+    name = "coreclr";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
 
   src = fetchFromGitHub {
     owner = "Samsung";
     repo = "netcoredbg";
     rev = version;
+    name = pname;
     inherit hash;
   };
 
   unmanaged = clangStdenv.mkDerivation {
-    inherit src pname version;
+    inherit pname version;
+
+    srcs = [
+      src
+      coreclr-src
+    ];
+
+    sourceRoot = pname;
 
     nativeBuildInputs = [
       cmake
@@ -44,24 +53,16 @@ let
 
     hardeningDisable = [ "strictoverflow" ];
 
-    postPatch = ''
-      substituteInPlace CMakeLists.txt --replace-fail \
-        "cmake_minimum_required(VERSION 2.8.12.2)" \
-        "cmake_minimum_required(VERSION 3.10)"
-      substituteInPlace third_party/linenoise-ng/CMakeLists.txt --replace-fail \
-        "cmake_minimum_required(VERSION 2.6)" \
-        "cmake_minimum_required(VERSION 3.10)"
-    '';
-
     preConfigure = ''
       export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
-    '';
 
-    cmakeFlags = [
-      "-DCORECLR_DIR=${coreclr-src}/src/coreclr"
-      "-DDOTNET_DIR=${dotnet-sdk}/share/dotnet"
-      "-DBUILD_MANAGED=0"
-    ];
+      chmod -R u+w ../coreclr
+      cmakeFlagsArray+=(
+        "-DCORECLR_DIR=''${NIX_BUILD_TOP}/coreclr/src/coreclr"
+        "-DDOTNET_DIR=${dotnet-sdk}/share/dotnet"
+        "-DBUILD_MANAGED=0"
+      )
+    '';
   };
 
   managed = buildDotnetModule {
diff --git a/pkgs/by-name/ne/netexec/package.nix b/pkgs/by-name/ne/netexec/package.nix
index 858d52bf0e49..4f522f089b77 100644
--- a/pkgs/by-name/ne/netexec/package.nix
+++ b/pkgs/by-name/ne/netexec/package.nix
@@ -10,11 +10,11 @@ let
     self = python;
     packageOverrides = self: super: {
       impacket = super.impacket.overridePythonAttrs {
-        version = "0.12.0-unstable-2025-03-14";
+        version = "0.14.0-unstable-2025-12-03";
         src = fetchFromGitHub {
           owner = "fortra";
           repo = "impacket";
-          rev = "8b4566b12fc79acb520d045dbae8f13446a9d4d7";
+          rev = "caba5facdd3a01b5d0decc6daf5871839f22f792";
           hash = "sha256-jyn5qSSAipGYhHm2EROwDHa227mnmW+d+0H0/++i1OY=";
         };
         # Fix version to be compliant with Python packaging rules
@@ -28,14 +28,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "netexec";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Pennyw0rth";
     repo = "NetExec";
     tag = "v${version}";
-    hash = "sha256-1yNnnPntJ5aceX3Z8yYAMLv5bSFfCFVp0pgxAySlVfE=";
+    hash = "sha256-gGyaEifIveoeVdeviLiQ6ZIHku//h9Hp84ffktAgxDY=";
   };
 
   pythonRelaxDeps = true;
@@ -43,11 +43,18 @@ python.pkgs.buildPythonApplication rec {
   pythonRemoveDeps = [
     # Fail to detect dev version requirement
     "neo4j"
+    # No python package in nixpkgs; use bloodhound-py instead.
+    "bloodhound-ce"
   ];
 
   postPatch = ''
+    substituteInPlace nxc/first_run.py \
+      --replace-fail "from os import mkdir" "from os import mkdir, chmod" \
+      --replace-fail "shutil.copy(default_path, NXC_PATH)" $'shutil.copy(default_path, CONFIG_PATH)\n        chmod(CONFIG_PATH, 0o600)'
+
     substituteInPlace pyproject.toml \
-      --replace-fail " @ git+https://github.com/fortra/impacket.git" "" \
+      --replace-fail " @ git+https://github.com/Pennyw0rth/Certipy" "" \
+      --replace-fail " @ git+https://github.com/fortra/impacket" "" \
       --replace-fail " @ git+https://github.com/wbond/oscrypto" "" \
       --replace-fail " @ git+https://github.com/Pennyw0rth/NfsClient" ""
   '';
@@ -66,6 +73,7 @@ python.pkgs.buildPythonApplication rec {
     asyauth
     beautifulsoup4
     bloodhound-py
+    certipy-ad
     dploot
     dsinternals
     impacket
@@ -76,6 +84,7 @@ python.pkgs.buildPythonApplication rec {
     msldap
     neo4j
     paramiko
+    pefile
     pyasn1-modules
     pylnk3
     pynfsclient
diff --git a/pkgs/by-name/ne/netgen-vlsi/package.nix b/pkgs/by-name/ne/netgen-vlsi/package.nix
index f878476fd6cf..8992ffddc133 100644
--- a/pkgs/by-name/ne/netgen-vlsi/package.nix
+++ b/pkgs/by-name/ne/netgen-vlsi/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netgen";
-  version = "1.5.314";
+  version = "1.5.315";
 
   src = fetchFromGitHub {
     owner = "RTimothyEdwards";
     repo = "netgen";
     tag = finalAttrs.version;
-    hash = "sha256-g8d/faYjhL6WXSShqWn9n+4cUJ8qKtqyEgyIRsrHo5o=";
+    hash = "sha256-dXCZm5zVwn23y7DLPSUrTKGMcu/FjdVKsyry59lEt7U=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ne/netscanner/package.nix b/pkgs/by-name/ne/netscanner/package.nix
index ef943d5f4101..b8f771f73eb1 100644
--- a/pkgs/by-name/ne/netscanner/package.nix
+++ b/pkgs/by-name/ne/netscanner/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   pname = "netscanner";
-  version = "0.6.3";
+  version = "0.6.41";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage {
     owner = "Chleba";
     repo = "netscanner";
     tag = "v${version}";
-    hash = "sha256-z39450ebIBHwdiC1FLF6v23la45ad5h5iupF6PAAjzc=";
+    hash = "sha256-8Srsts0FDLMT01YW5Guv3r8yx5i5ua7bhAFbQ5BMN74=";
   };
 
-  cargoHash = "sha256-i+btU1ovqPGzhXi8IPZonSAdlpcbMPrWSbL7COKou9M=";
+  cargoHash = "sha256-vlV5SibQlJ/yhJJKweqg6KYinpgZmWUUnyzAS6LBBKw=";
 
   postFixup = ''
     wrapProgram $out/bin/netscanner \
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index 158e7a1bf286..0a5d2c675f01 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "4.0.4";
+  version = "4.0.5";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-BEjsIx0knmTj6kgM7fsJV5XN660cRe9DbYxeL7YHPRo=";
+    hash = "sha256-cEe1GTRFC+iGAAgddRm70uf5tXmpCat7Q7BptFEYKnE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ng/ngt/package.nix b/pkgs/by-name/ng/ngt/package.nix
index bd4bb134f750..f892bfde284b 100644
--- a/pkgs/by-name/ng/ngt/package.nix
+++ b/pkgs/by-name/ng/ngt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "NGT";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "yahoojapan";
     repo = "NGT";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2cCuVeg7y3butTIAQaYIgx+DPqIFEA2qqVe3exAoAY8=";
+    sha256 = "sha256-T+ZFmvak1ZfY7I/9QKpC7qqXLq/tBdy+KUjx/0twceg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/no/noctalia-shell/package.nix b/pkgs/by-name/no/noctalia-shell/package.nix
index ef2dfbf7bd08..8ec1219c4ab1 100644
--- a/pkgs/by-name/no/noctalia-shell/package.nix
+++ b/pkgs/by-name/no/noctalia-shell/package.nix
@@ -66,13 +66,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noctalia-shell";
-  version = "4.0.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1ByxRYrivSkD4lIQQxv88r+I/mFo+JF3ebok6375+3Q=";
+    hash = "sha256-/7yEiXC2Z/Yk/p7aNgChkAa7BgPRlV5/0z8+jZXH8e8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oa/oauth2c/package.nix b/pkgs/by-name/oa/oauth2c/package.nix
index b96bafcf07da..53024b634f28 100644
--- a/pkgs/by-name/oa/oauth2c/package.nix
+++ b/pkgs/by-name/oa/oauth2c/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oauth2c";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "cloudentity";
     repo = "oauth2c";
     rev = "v${version}";
-    hash = "sha256-1l7NtRKOCUuVsGC7K/TmSbzwGGybJ3owMDn2b4b/BeU=";
+    hash = "sha256-Bh4gWskmY2nWTckUT1FX7vRDz/gg670A77CQTZhz3mg=";
   };
 
   vendorHash = "sha256-I2pOyjKghvHHGEuVqODhysD++f2hD+BF7WJxWbrLcWA=";
diff --git a/pkgs/by-name/oc/ocrfeeder/package.nix b/pkgs/by-name/oc/ocrfeeder/package.nix
index 3554e3867424..623ae417237f 100644
--- a/pkgs/by-name/oc/ocrfeeder/package.nix
+++ b/pkgs/by-name/oc/ocrfeeder/package.nix
@@ -9,7 +9,7 @@
   libxml2,
   gobject-introspection,
   gtk3,
-  goocanvas2,
+  goocanvas_2,
   gtkspell3,
   isocodes,
   python3,
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gtk3
-    goocanvas2
+    goocanvas_2
     gtkspell3
     isocodes
     (python3.withPackages (
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index 66f1b3c9cc42..f465ee675281 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -294,26 +294,28 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
   ];
 
-  env =
-    lib.optionalAttrs rocmSupport {
-      MIOPEN_PATH = rocmPackages.miopen;
-      # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
-      # fatal error: 'rocrand/rocrand.h' file not found
-      HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
-        rocmPackages.hipblas
-        rocmPackages.hipcub
-        rocmPackages.hiprand
-        rocmPackages.hipsparse
-        rocmPackages.rocblas
-        rocmPackages.rocprim
-        rocmPackages.rocrand
-        rocmPackages.rocthrust
-      ];
-    }
-    // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
-      NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
-      GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
-    };
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  }
+  // lib.optionalAttrs rocmSupport {
+    MIOPEN_PATH = rocmPackages.miopen;
+    # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
+    # fatal error: 'rocrand/rocrand.h' file not found
+    HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
+      rocmPackages.hipblas
+      rocmPackages.hipcub
+      rocmPackages.hiprand
+      rocmPackages.hipsparse
+      rocmPackages.rocblas
+      rocmPackages.rocprim
+      rocmPackages.rocrand
+      rocmPackages.rocthrust
+    ];
+  }
+  // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
+    NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
+    GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
+  };
 
   doCheck =
     !(
diff --git a/pkgs/by-name/op/openhue-cli/package.nix b/pkgs/by-name/op/openhue-cli/package.nix
index 0edfdcfd50d1..8d0e0829f8ea 100644
--- a/pkgs/by-name/op/openhue-cli/package.nix
+++ b/pkgs/by-name/op/openhue-cli/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openhue-cli";
-  version = "0.22.1";
+  version = "0.23";
 
   src = fetchFromGitHub {
     owner = "openhue";
     repo = "openhue-cli";
     tag = finalAttrs.version;
-    hash = "sha256-2MvtE1B9dN31rnjAs+f+cAYhM0D61A+wbtcdMfAyOY8=";
+    hash = "sha256-YkTlXON31cfA4EAS3RMhplVj7mFF3hx/CyiUrcQOkqc=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-3930OjQ26n7J3XDWjCthfQjORP5wpJ3ZZK/m6/wi2X4=";
+  vendorHash = "sha256-S2CPDbgHcDYo6T2IIshmZkIatGLNMIdAMNBjowiMkwo=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/op/openrgb/package.nix b/pkgs/by-name/op/openrgb/package.nix
index a014e40cf1f7..d4f91908405a 100644
--- a/pkgs/by-name/op/openrgb/package.nix
+++ b/pkgs/by-name/op/openrgb/package.nix
@@ -11,6 +11,7 @@
   mbedtls,
   symlinkJoin,
   qt6Packages,
+  autoAddDriverRunpath,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    autoAddDriverRunpath
   ]
   ++ (with qt6Packages; [
     qmake
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index c06f7190a8b2..cc7eb976b32d 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -16,13 +16,13 @@
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.11.3";
+    version = "1.11.4";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-r5GwFWzXYXX06swmBS+yXIjKwSMArPYd5h+xJlZBdy4=";
+      hash = "sha256-Yz+T1B97s2bdJIhJmGGly9KZx1gOvsbavF+HbJh+8Tg=";
     };
 
     vendorHash = "sha256-WO5OtKwluks5nuSHJ4NO1+EKhtCrJE9MuMGmu5fYKM4=";
@@ -33,6 +33,10 @@ let
       "github.com/opentofu/opentofu/version.dev=no"
     ];
 
+    postPatch = ''
+      substituteInPlace go.mod --replace-fail 'go 1.25.6' 'go 1.25.5'
+    '';
+
     nativeBuildInputs = [ installShellFiles ];
     patches = [ ./provider-path-0_15.patch ];
 
diff --git a/pkgs/by-name/op/opkssh/package.nix b/pkgs/by-name/op/opkssh/package.nix
index dfe71e26bbbb..2911f791f417 100644
--- a/pkgs/by-name/op/opkssh/package.nix
+++ b/pkgs/by-name/op/opkssh/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "opkssh";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "openpubkey";
     repo = "opkssh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l1FizvOO4oCNHEJEClwOupnjQzthvGO/vRTq1PhJDao=";
+    hash = "sha256-DTxELj3OifKrEEzMCk7JVjVUoIKEofzUj4MdR6tYYZc=";
   };
 
   ldflags = [ "-X main.Version=${finalAttrs.version}" ];
 
-  vendorHash = "sha256-AdQtYqhwhkvvr9bbSWylACg75nC/K7hxb13bP5itusM=";
+  vendorHash = "sha256-t8BaV5DlAXcqytqiGczzSUENV4GIql3KovLAn/mRdh8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ou/outguess/package.nix b/pkgs/by-name/ou/outguess/package.nix
index 903c4754ffad..3d682afab665 100644
--- a/pkgs/by-name/ou/outguess/package.nix
+++ b/pkgs/by-name/ou/outguess/package.nix
@@ -22,6 +22,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [ "--with-generic-jconfig" ];
 
+  # Fix build with modern compilers (GCC 14+)
+  # The bundled jpeg-6b-steg library uses K&R-style function declarations
+  # that are incompatible with modern C standards
+  postPatch = ''
+    substituteInPlace src/jpeg-6b-steg/jmorecfg.h \
+      --replace-fail '#define JMETHOD(type,methodname,arglist)  type (*methodname) ()' \
+                     '#define JMETHOD(type,methodname,arglist)  type (*methodname) arglist'
+    substituteInPlace src/jpeg-6b-steg/jpeglib.h \
+      --replace-fail '#ifdef HAVE_PROTOTYPES' '#if 1  /* Force ANSI prototypes */'
+  '';
+
   meta = {
     description = "Universal steganographic tool that allows the insertion of hidden information into the redundant bits of data sources";
     homepage = "https://github.com/resurrecting-open-source-projects/outguess";
diff --git a/pkgs/by-name/pd/pdf-quench/package.nix b/pkgs/by-name/pd/pdf-quench/package.nix
index cdd8d2cc0f4f..77f7ff8a12da 100644
--- a/pkgs/by-name/pd/pdf-quench/package.nix
+++ b/pkgs/by-name/pd/pdf-quench/package.nix
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication {
   ];
   buildInputs = with pkgs; [
     gtk3
-    goocanvas2
+    goocanvas_2
     poppler_gi
   ];
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/pd/pdns-recursor/package.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index 7ea8528413d4..331bfdefd549 100644
--- a/pkgs/by-name/pd/pdns-recursor/package.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -15,29 +15,31 @@
   rustPlatform,
   cargo,
   rustc,
+  python3,
   enableProtoBuf ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.2.7";
+  version = "5.3.4";
 
   src = fetchurl {
-    url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-s7/I2M5uL94I71fMYLKl+JcOPn0TnVn74oaIKnYmObE=";
+    url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.xz";
+    hash = "sha256-+1CoWH9LPVf4jcrMImpkxRVJkrDa/SD1uwNDVeNiRSQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    sourceRoot = "pdns-recursor-${finalAttrs.version}/settings/rust";
-    hash = "sha256-A3NX1zj9+9qCLTkfca3v8Rr8oc/zL/Ruknjl3g1aMG4=";
+    sourceRoot = "pdns-recursor-${finalAttrs.version}/rec-rust-lib/rust";
+    hash = "sha256-g0Mu1+ZRQyzC4nG5ueISaDzFtmFfy+CGt063/V5lo30=";
   };
 
-  cargoRoot = "settings/rust";
+  cargoRoot = "rec-rust-lib/rust";
 
   nativeBuildInputs = [
     cargo
     rustc
+    python3
     rustPlatform.cargoSetupHook
     pkg-config
   ];
diff --git a/pkgs/by-name/ph/phpstan/package.nix b/pkgs/by-name/ph/phpstan/package.nix
index 4b80a9c2c136..eb47f69e6e59 100644
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.34";
+  version = "2.1.35";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan";
     tag = finalAttrs.version;
-    hash = "sha256-/SSOLJiZunLDoxsKmVxICjymFLLu0aOXCTn2jNklTyA=";
+    hash = "sha256-1X+Z4z7VN36DbxWCOu1mvEWQaAJL9tbh3JWMAaHnT5c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index b399bd1486f1..a457b8c8356a 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "12.5.4";
+  version = "12.5.6";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-asHHNHUBt4EO/vLQdc5JyffgUqgOeJSXSG+b5bL0IQk=";
+    hash = "sha256-F2/LMJwLzLz7YuJPq2J6ypgtY9ps5ExiHX6UGvtKh3E=";
   };
 
-  vendorHash = "sha256-ypZLrCNNh/QUa5cvA6zuh3b/eyE0YMH0Diiet7cDveI=";
+  vendorHash = "sha256-YqDdlspt9hGMzSoC41pMZLucP/luv6Fo2VGQ7pPa5pk=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/qu/QuadProgpp/package.nix b/pkgs/by-name/qu/QuadProgpp/package.nix
index 3ec83d2b3765..50861e076df6 100644
--- a/pkgs/by-name/qu/QuadProgpp/package.nix
+++ b/pkgs/by-name/qu/QuadProgpp/package.nix
@@ -7,26 +7,19 @@
 
 stdenv.mkDerivation {
   pname = "quadprogpp";
-  version = "unstable-2023-01-20";
+  version = "1.2.2-unstable-2025-12-03";
 
   src = fetchFromGitHub {
     owner = "liuq";
     repo = "QuadProgpp";
-    rev = "4c51d91deb5af251957edf9454bfb74279a4544e";
-    hash = "sha256-uozwuTAOPsRwYM9KyG3V0hwcmaPpfZPID9Wdd4olsvY=";
+    rev = "0c25447365c980876fdc395f55d60300a5e5793c";
+    hash = "sha256-yXKctOTBbUNiSM2j7hKfSvd1i7FH7kcgP990DXVkrRY=";
   };
 
   nativeBuildInputs = [
     cmake
   ];
 
-  postPatch = ''
-    # Inline https://github.com/liuq/QuadProgpp/pull/32
-    substituteInPlace CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 3.0)' \
-      'cmake_minimum_required(VERSION 3.10)'
-  '';
-
   meta = {
     description = "C++ library for Quadratic Programming";
     longDescription = ''
diff --git a/pkgs/by-name/qu/quickemu/package.nix b/pkgs/by-name/qu/quickemu/package.nix
index 7048dacba1f4..b3d89964854b 100644
--- a/pkgs/by-name/qu/quickemu/package.nix
+++ b/pkgs/by-name/qu/quickemu/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   stdenv,
   makeWrapper,
   gitUpdater,
@@ -58,23 +57,15 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quickemu";
-  version = "4.9.7";
+  version = "4.9.7-unstable-2025-12-28";
 
   src = fetchFromGitHub {
     owner = "quickemu-project";
     repo = "quickemu";
-    rev = finalAttrs.version;
-    hash = "sha256-sCoCcN6950pH33bRZsLoLc1oSs5Qfpj9Bbywn/uA6Bc=";
+    rev = "7ea4e95508a7898bc63c3b5e1588066184d4c79b";
+    hash = "sha256-pj6YQc7e4I6XvGq/uGGq2z/UhAs3ZeKrsJd8oLWjauA=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "correctly-handle-version-10.0.0-of-qemu.patch";
-      url = "https://github.com/quickemu-project/quickemu/commit/f25205f4513c4fa72be6940081c62e613d1fddc6.patch";
-      hash = "sha256-OAXGyhMVDwbUypEPj/eRnH0wZYaL9WLGjbyoobe20UY=";
-    })
-  ];
-
   postPatch = ''
     sed -i \
       -e '/OVMF_CODE_4M.secboot.fd/s|ovmfs=(|ovmfs=("${OVMFFull.firmware}","${OVMFFull.variables}" |' \
@@ -83,6 +74,9 @@ stdenv.mkDerivation (finalAttrs: {
       -e 's/Icon=.*qemu.svg/Icon=qemu/' \
       -e 's,\[ -x "\$(command -v smbd)" \],true,' \
       quickemu
+
+    substituteInPlace quickemu \
+      --replace-fail 'readonly VERSION="4.9.8"' 'readonly VERSION="${finalAttrs.version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qu/quint/package.nix b/pkgs/by-name/qu/quint/package.nix
index 64321ff81b4c..598c48f9ec7c 100644
--- a/pkgs/by-name/qu/quint/package.nix
+++ b/pkgs/by-name/qu/quint/package.nix
@@ -17,9 +17,9 @@
 }:
 
 let
-  version = "0.29.1";
+  version = "0.30.0";
   apalacheVersion = "0.51.1";
-  evaluatorVersion = "0.3.0";
+  evaluatorVersion = "0.4.0";
 
   metaCommon = {
     description = "Formal specification language with TLA+ semantics";
@@ -33,7 +33,7 @@ let
     owner = "informalsystems";
     repo = "quint";
     tag = "v${version}";
-    hash = "sha256-lnvtyL4GKOyKdBDC5vevx5LgaiB7xTkfuN1rRTxKyv4=";
+    hash = "sha256-4gZUGw5T4iVbg7IWkXXIpSib/dPVXhK6Srt1kNewPGA=";
   };
 
   # Build the Quint CLI from source
@@ -43,7 +43,7 @@ let
 
     sourceRoot = "${src.name}/quint";
 
-    npmDepsHash = "sha256-CBwovC7PTdjJHwL9lKRlJbl8rNjd9J3hVBFJz24+cbw=";
+    npmDepsHash = "sha256-qmekskqCePyI/k1AaBRVfc6q6SQNCA4K61E6GxfsAUI=";
 
     npmBuildScript = "compile";
 
diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index 908549bc7d56..75a993bf3aec 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -62,7 +62,7 @@ lib.fix (
   self:
   lib.makeOverridable (
     {
-      npmDepsHash ? "sha256-7/DH0p66FTfC0N42FhWTqehg5m/yq929ANhL4jAt7Ss=",
+      npmDepsHash ? "sha256-nVfFeJXSPO1GVkBkWflARZl2Geyt5ARTn0HVglnPlc0=",
       patches ? [ ],
     }@args:
     buildNpmPackage {
@@ -75,7 +75,7 @@ lib.fix (
       # radicle-httpd using a more limited sparse checkout we need to carry a
       # separate hash.
       src = radicle-httpd.src.override {
-        hash = "sha256-PzokSJkcyFDAaih5gekp4GCQMm0sfF7fAK7iZbX1/S4=";
+        hash = "sha256-Zt9RiuloWmb1eL6f2Gotvy+FMTUvSokOEGOIBrBeO/E=";
         sparseCheckout = [ ];
       };
 
diff --git a/pkgs/by-name/ra/radicle-httpd/package.nix b/pkgs/by-name/ra/radicle-httpd/package.nix
index ad75b7928b4b..befead34f38f 100644
--- a/pkgs/by-name/ra/radicle-httpd/package.nix
+++ b/pkgs/by-name/ra/radicle-httpd/package.nix
@@ -15,7 +15,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-httpd";
-  version = "0.22.0";
+  version = "0.23.0";
 
   env.RADICLE_VERSION = finalAttrs.version;
 
@@ -25,12 +25,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
     tag = "releases/${finalAttrs.version}";
     sparseCheckout = [ "radicle-httpd" ];
-    hash = "sha256-NA5U+Ac6imbtNabvaeYATfUbbmT48uqWAcbJ+ukJcDs=";
+    hash = "sha256-OpDW6qJOHN4f4smhc1vNO0DRzJW6114gQV4K1ZNicag=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/radicle-httpd";
 
-  cargoHash = "sha256-9xyuoOuoFWu7oItQporJuGA8EIfEMrCvPaRPnwYMzmM=";
+  cargoHash = "sha256-m/2pP1mCU4SvPXU3qWOpbh3H/ykTOGgERYcP8Iu5DDs=";
 
   nativeBuildInputs = [
     asciidoctor
@@ -78,6 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       repositories on a Radicle node via their web browser.
     '';
     homepage = "https://radicle.xyz";
+    changelog = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5/tree/radicle-httpd/CHANGELOG.md";
     # cargo.toml says MIT and asl20, LICENSE file says GPL3
     license = with lib.licenses; [
       gpl3Only
diff --git a/pkgs/by-name/ra/radicle-node/package.nix b/pkgs/by-name/ra/radicle-node/package.nix
index 71d01408459e..ff4638e104d5 100644
--- a/pkgs/by-name/ra/radicle-node/package.nix
+++ b/pkgs/by-name/ra/radicle-node/package.nix
@@ -18,13 +18,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-node";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.xyz";
     repo = "z3gqcJUoA1n9HaHKufZs5FCSGazv5";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-j7GTtx9Dq3xZeEsgIlaRq1Vbc9aJfn22WCkNTGjvH1Q=";
+    hash = "sha256-7kwtWuYdYG3MDHThCkY5OZmx4pWaQXMYoOlJszmV2rM=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse HEAD > $out/.git_head
diff --git a/pkgs/by-name/ra/rasm/package.nix b/pkgs/by-name/ra/rasm/package.nix
index 7a3bea38b97a..2a835149e323 100644
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rasm";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "EdouardBERGE";
     repo = "rasm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yQZS2aHNyUU/zNFl0uDP/MmDD1/VT7r6euu4PIELrrM=";
+    hash = "sha256-YNdm30gw2ycKTFrW+5tE0Du5m258befh17HjAWnQsbc=";
   };
 
   # by default the EXEC variable contains `rasm.exe`
diff --git a/pkgs/by-name/ra/rauthy/package.nix b/pkgs/by-name/ra/rauthy/package.nix
index c76eca31bb32..94d1928bb9cd 100644
--- a/pkgs/by-name/ra/rauthy/package.nix
+++ b/pkgs/by-name/ra/rauthy/package.nix
@@ -8,24 +8,24 @@
   pkg-config,
   perl,
   wasm-pack,
-  wasm-bindgen-cli_0_2_106,
+  wasm-bindgen-cli_0_2_108,
   binaryen,
   lld,
 }:
 let
-  version = "0.33.4";
+  version = "0.34.0";
   pname = "rauthy";
 
   src = fetchFromGitHub {
     owner = "sebadob";
     repo = "rauthy";
     tag = "v${version}";
-    hash = "sha256-MhurQyfB+ydIdnCAu5+h6EeKwPHyQix0dDYIvaV3Juk=";
+    hash = "sha256-ZYugnemiZpa8gmXCRgZc/9att/vUribC1+vpS7vhgl8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-rFJHXWr50dLHILSgAHLCzgiD543r6xctjw60MOOR7HU=";
+    hash = "sha256-ixl4mlQJw8Gr7Rrnm8B2Iz8xI7IAne8OR9Dri0k3kqY=";
   };
 
   # Wasm modules are needed to build the frontend and are part of the main Rust repo.
@@ -40,7 +40,7 @@ let
     nativeBuildInputs = [
       writableTmpDirAsHomeHook
       wasm-pack
-      wasm-bindgen-cli_0_2_106
+      wasm-bindgen-cli_0_2_108
       binaryen
       lld
     ];
@@ -77,7 +77,7 @@ let
       "-p2"
     ];
 
-    npmDepsHash = "sha256-rTN+CbwnX157qqPLpUfjoCofFiwKYJJH9Oy0MeRFWXE=";
+    npmDepsHash = "sha256-F8/zbqI7Nmm8GLtkL25QDX222yzhlg7NA32tpBa8b5o=";
 
     preBuild = ''
       mkdir -p ./src/wasm/
diff --git a/pkgs/by-name/ri/ringracers/package.nix b/pkgs/by-name/ri/ringracers/package.nix
index 9b42418ae36a..a5d6ea698c7e 100644
--- a/pkgs/by-name/ri/ringracers/package.nix
+++ b/pkgs/by-name/ri/ringracers/package.nix
@@ -114,7 +114,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://kartkrew.org";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ donovanglover ];
+    maintainers = with lib.maintainers; [
+      donovanglover
+      iedame
+    ];
     mainProgram = "ringracers";
   };
 })
diff --git a/pkgs/by-name/rk/rkbin/package.nix b/pkgs/by-name/rk/rkbin/package.nix
index 922b699b1aa6..541819239650 100644
--- a/pkgs/by-name/rk/rkbin/package.nix
+++ b/pkgs/by-name/rk/rkbin/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "rkbin";
-  version = "0-unstable-2025-01-24";
+  version = "0-unstable-2025-06-13";
 
   src = fetchFromGitHub {
     owner = "rockchip-linux";
     repo = "rkbin";
-    rev = "f43a462e7a1429a9d407ae52b4745033034a6cf9";
-    hash = "sha256-geESfZP8ynpUz/i/thpaimYo3kzqkBX95gQhMBzNbmk=";
+    rev = "74213af1e952c4683d2e35952507133b61394862";
+    hash = "sha256-gNCZwJd9pjisk6vmvtRNyGSBFfAYOADTa5Nd6Zk+qEk=";
   };
 
   installPhase = ''
@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation {
   '';
 
   passthru = {
-    BL31_RK3568 = "${rkbin}/bin/rk35/rk3568_bl31_v1.44.elf";
-    BL31_RK3588 = "${rkbin}/bin/rk35/rk3588_bl31_v1.48.elf";
+    BL31_RK3568 = "${rkbin}/bin/rk35/rk3568_bl31_v1.45.elf";
+    BL31_RK3588 = "${rkbin}/bin/rk35/rk3588_bl31_v1.51.elf";
     TPL_RK3566 = "${rkbin}/bin/rk35/rk3566_ddr_1056MHz_v1.23.bin";
     TPL_RK3568 = "${rkbin}/bin/rk35/rk3568_ddr_1056MHz_v1.23.bin";
-    TPL_RK3588 = "${rkbin}/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.18.bin";
+    TPL_RK3588 = "${rkbin}/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.19.bin";
   };
 
   meta = {
diff --git a/pkgs/by-name/ru/rust-audit-info/package.nix b/pkgs/by-name/ru/rust-audit-info/package.nix
index 12c128bbd980..79000840d662 100644
--- a/pkgs/by-name/ru/rust-audit-info/package.nix
+++ b/pkgs/by-name/ru/rust-audit-info/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-audit-info";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-g7ElNehBAVSRRlqsxkNm20C0KOMkf310bXNs3EN+/NQ=";
+    hash = "sha256-zxdF65/9cgdDLM7HA30NCEZj1S5SogH+oM3aq55K0os=";
   };
 
-  cargoHash = "sha256-TvbFhFtdQ6fBNjIMgzQDVnK+IZThUJmht7r2zSmcllE=";
+  cargoHash = "sha256-ygz9uYwuDI892kwYwJPTsTAkBfsnRN2unOgqv8VHXSA=";
 
   meta = {
     description = "Command-line tool to extract the dependency trees embedded in binaries by cargo-auditable";
diff --git a/pkgs/development/libraries/jemalloc/rust.nix b/pkgs/by-name/ru/rust-jemalloc-sys/package.nix
similarity index 100%
rename from pkgs/development/libraries/jemalloc/rust.nix
rename to pkgs/by-name/ru/rust-jemalloc-sys/package.nix
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 4aa270e9549d..a5345b62acc9 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pVN7xu0M/9S4Gq5kWTls5vOpFK8fPXf9MIXJncdvtVc=";
+    hash = "sha256-+JWpb0Hi8qyVjnwsxlYAlrqH3GhLqTFj2tbAWFIN+mg=";
   };
 
-  cargoHash = "sha256-cmjtPQd4ZvZ5HG+Cw1I4w8XRu64Q5HhR1rxhiYAC4aY=";
+  cargoHash = "sha256-TNIAdxOmAgZOGe3aBcKmeEzuGP8LuhGNDMNY/MUwiTw=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \
diff --git a/pkgs/by-name/sc/scala-cli/sources.json b/pkgs/by-name/sc/scala-cli/sources.json
index b5196be85564..3097a1892d0e 100644
--- a/pkgs/by-name/sc/scala-cli/sources.json
+++ b/pkgs/by-name/sc/scala-cli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.11.0",
+  "version": "1.12.0",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1xj5mb853qqsrrvqb3xpnh7x9yakf9vrb0xfszi5jw819ayidf4f"
+      "sha256": "1jax22azbc5v0dchw5hmv1kg3gb4aa9d886b2nlqirn96b60jayn"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "1lrwhbk0drzaq11q6jg4aszypfdsqqnwvsk50cz213jqvnzdazhc"
+      "sha256": "1hbx1vzc8x13zwv94cx0922279hcafc8aq30pvr0xc91345m5xv2"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "0hd2qhhk4ifciijdp3fsn1v9zqsmhh70mqa6b7km97lq4g1dx77r"
+      "sha256": "18p015h3v5ppcqdvh7vrkxnlyx9lbjdz27cmw0fypbdfc2p2gwqs"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1jvd5fl85lhl57wj684g1p2rhwql83lfcjpwyflzgg370v052z3r"
+      "sha256": "0cymryl1vv1vn7jqcrsy6n98gj3393q3n6mk6nxspmx94zrwdhia"
     }
   }
 }
diff --git a/pkgs/by-name/sc/scanmem/package.nix b/pkgs/by-name/sc/scanmem/package.nix
index cdfa36491f18..361bf233dd5d 100644
--- a/pkgs/by-name/sc/scanmem/package.nix
+++ b/pkgs/by-name/sc/scanmem/package.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/scanmem/scanmem";
     description = "Memory scanner for finding and poking addresses in executing processes";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3Plus;
   };
diff --git a/pkgs/by-name/so/soundtracker/package.nix b/pkgs/by-name/so/soundtracker/package.nix
index 68dee8f6eda1..ff844e72587c 100644
--- a/pkgs/by-name/so/soundtracker/package.nix
+++ b/pkgs/by-name/so/soundtracker/package.nix
@@ -9,7 +9,7 @@
   SDL,
   jack2,
   audiofile,
-  goocanvas, # graphical envelope editing
+  goocanvas_1, # graphical envelope editing
   libxml2,
   libsndfile,
   libpulseaudio,
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL # found by AM_PATH_SDL
     jack2
     audiofile
-    goocanvas
+    goocanvas_1
     libxml2 # found by PKG_CHECK_MODULES
     libsndfile
   ]
diff --git a/pkgs/by-name/sp/spirit/package.nix b/pkgs/by-name/sp/spirit/package.nix
index 83d24c9cd1c1..0ac10be250fb 100644
--- a/pkgs/by-name/sp/spirit/package.nix
+++ b/pkgs/by-name/sp/spirit/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "spirit";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "spirit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DJJWqNY5+0oL2KJwGwta55FGvEHA4ICN+vF9zZUznNQ=";
+    hash = "sha256-vGrIDXm3QXOitzIGV3Plt+SmUEih4gPJGTv6bGBwITE=";
   };
 
-  vendorHash = "sha256-AiNxpUY6zLwa8WlkjG9Em5S1xwCrzX0h4b8DaBth6YE=";
+  vendorHash = "sha256-WSMziaE6ldYa915fAAecXGmJkFhh8Sk/IHjfBqXf9FI=";
 
   subPackages = [ "cmd/spirit" ];
 
diff --git a/pkgs/by-name/sp/spotifycli/package.nix b/pkgs/by-name/sp/spotifycli/package.nix
new file mode 100644
index 000000000000..afdcb100d5dc
--- /dev/null
+++ b/pkgs/by-name/sp/spotifycli/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "spotifycli";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "doronbehar";
+    repo = "spotifycli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AJysKgk58R0LwcXO0UzpgYmflJlAIqvaiyMRP8R9xGE=";
+  };
+
+  vendorHash = "sha256-MJtOJ4ZYSspumvPnK0ANL1wvWng9Na4+IlmBCoA80Hw=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd spotifycli \
+      --bash <($out/bin/spotifycli completion bash) \
+      --zsh  <($out/bin/spotifycli completion zsh ) \
+      --fish <($out/bin/spotifycli completion fish)
+  '';
+
+  meta = {
+    description = "CLI to manage Spotify playlists";
+    homepage = "https://github.com/doronbehar/spotifycli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    mainProgram = "spotifycli";
+  };
+})
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index c4993bbd4eed..7b00c93cf007 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "stackit-cli";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${version}";
-    hash = "sha256-6fbWMgLHSTbBKqxRTSGvOdJop1xx2vAFkN+j8gsuO9U=";
+    hash = "sha256-eBNr4JuzMkO7gFNz5H9Anh1hAcBgFTWvz6jT9oNzeQ8=";
   };
 
-  vendorHash = "sha256-Xo1oQJBd093O8IKfkKq146AuGgqzupMN+PROPKsOz4E=";
+  vendorHash = "sha256-ujdLPiETHFoP+YfJUCZcAoZolB6bCtjsE7OaYWOTA1A=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 89f81f4a97cf..4be73405bd7e 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -21,16 +21,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.14.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wsk4n6jLOAFhxYb5Hw8XvQem0xccGGoD729nRz3bRF0=";
+    hash = "sha256-MIy1/8r5CMrTbVTjLFuUneoL3J38kZIgUMweoeaf3L0=";
   };
 
-  cargoHash = "sha256-LFXpv8/rHQwzdKEyS4VplQSwFUnZrgv0qDIhZUOGfpo=";
+  cargoHash = "sha256-jVD11wz9Ab1E9KdNG4kp8Jqm2rJ2aUWuFTAOBga6Fgg=";
 
   depsBuildBuild = [
     pkg-config
@@ -61,9 +61,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "postgres"
     "mysql"
     "rocks"
-    "elastic"
     "s3"
     "redis"
+    "azure"
+    "nats"
   ]
   ++ lib.optionals withFoundationdb [ "foundationdb" ]
   ++ lib.optionals stalwartEnterprise [ "enterprise" ];
@@ -87,7 +88,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mkdir -p $out/lib/systemd/system
 
     substitute resources/systemd/stalwart-mail.service $out/lib/systemd/system/stalwart-mail.service \
-      --replace "__PATH__" "$out"
+      --replace-fail "__PATH__" "$out"
   '';
 
   checkFlags = lib.forEach [
@@ -169,6 +170,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     #   left: ElementEnd
     #  right: Bytes([...])
     "responses::tests::parse_responses"
+    # thread 'store::search_tests' (912386) panicked at tests/src/store/mod.rs:116:10:
+    # Missing store type. Try running `STORE=<store_type> cargo test`: NotPresent
+    "store::search_tests"
   ] (test: "--skip=${test}");
 
   doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
diff --git a/pkgs/by-name/st/stalwart-mail/webadmin.nix b/pkgs/by-name/st/stalwart-mail/webadmin.nix
index 818314de323d..e77e8ba4c90d 100644
--- a/pkgs/by-name/st/stalwart-mail/webadmin.nix
+++ b/pkgs/by-name/st/stalwart-mail/webadmin.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "webadmin";
-  version = "0.1.32";
+  version = "0.1.37";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webadmin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HmQBMU7o0A20SY4tBw4SPVfHFfw8e0JsNQDNdZcex24=";
+    hash = "sha256-82QvuLkp6j6nJs7jX4NRcnxZ+KNv9RREpM+x8dicfGo=";
   };
 
   npmDeps = fetchNpmDeps {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-na1HEueX8w7kuDp8LEtJ0nD1Yv39cyk6sEMpS1zix2s=";
   };
 
-  cargoHash = "sha256-a2+3uNNSLfb81QXjZfftbwpgjORPRSgC056U3FINP4o=";
+  cargoHash = "sha256-qYIg1BthkpS77I6duYGGX168Y/IO8Mx4SWMQbE0BwDA=";
 
   postPatch = ''
     # Using local tailwindcss for compilation
diff --git a/pkgs/by-name/st/stylelint/package.nix b/pkgs/by-name/st/stylelint/package.nix
index b5f55aca31ce..0542002f0f6c 100644
--- a/pkgs/by-name/st/stylelint/package.nix
+++ b/pkgs/by-name/st/stylelint/package.nix
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.26.1";
+  version = "17.0.0";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     tag = version;
-    hash = "sha256-klvYUuk1U6hClSWPQWwJv+uadjaEqkjOZv33PygyrCQ=";
+    hash = "sha256-LQqKAKVdFJkIZQDwv2X6dxGDFPZ3xdTQIx+8kAlijDU=";
   };
 
-  npmDepsHash = "sha256-S1BYJDap3kW/MWZyv7Acmx+rFdGrWLwBdKlGPgH1RsU=";
+  npmDepsHash = "sha256-FdFM1Mo/P7jw+0nY8kR4ThTLJDxG8fp/tZiYSFzRSac=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/sy/sydbox/package.nix b/pkgs/by-name/sy/sydbox/package.nix
index cc3217c09447..95e9d3dbb6ae 100644
--- a/pkgs/by-name/sy/sydbox/package.nix
+++ b/pkgs/by-name/sy/sydbox/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sydbox";
-  version = "3.48.2";
+  version = "3.48.4";
 
   outputs = [
     "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Sydbox";
     repo = "sydbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yZBH7uVU4dqbUuHZaEw2glcQtHqUhXF3cycUr4J/NZI=";
+    hash = "sha256-rDJrmwBq2OSCqBOTtN2FncGwBzAafLUbjkgmfDVPYag=";
   };
 
-  cargoHash = "sha256-zK2Z9iuJs43Qmiv/ircNF891XyfVwn6pDeYmJzfmNOU=";
+  cargoHash = "sha256-fq7XksglWJJzHBbnILVWn76xMUdR+pwc0W4S1P0SuNQ=";
 
   nativeBuildInputs = [
     mandoc
diff --git a/pkgs/by-name/ti/tig/package.nix b/pkgs/by-name/ti/tig/package.nix
index bae80381289d..360e5435f02f 100644
--- a/pkgs/by-name/ti/tig/package.nix
+++ b/pkgs/by-name/ti/tig/package.nix
@@ -77,6 +77,12 @@ stdenv.mkDerivation rec {
       --prefix PATH ':' "${git}/bin"
   '';
 
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
   meta = {
     homepage = "https://jonas.github.io/tig/";
     description = "Text-mode interface for git";
diff --git a/pkgs/by-name/tr/traefik-certs-dumper/package.nix b/pkgs/by-name/tr/traefik-certs-dumper/package.nix
index 3cd1f133d421..0f6b93476f7a 100644
--- a/pkgs/by-name/tr/traefik-certs-dumper/package.nix
+++ b/pkgs/by-name/tr/traefik-certs-dumper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "traefik-certs-dumper";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "ldez";
     repo = "traefik-certs-dumper";
     rev = "v${version}";
-    sha256 = "sha256-zXbtabh5ZziELZHzvYisXETPUmhHAVo6sMuF4O3crBY=";
+    sha256 = "sha256-rjD0zt5kJ7A4TLn3jQBLGvzvHthszP9AvmcILVo5lzk=";
   };
 
-  vendorHash = "sha256-WpYxI+7qBYibojPtYlWmDrmJYlRlVwTaqCMI5Vzh1RI=";
+  vendorHash = "sha256-hGmcE8vEJI4nZOVFbDGWpnfTyupFydwGj09gMb2Mctc=";
   excludedPackages = "integrationtest";
 
   meta = {
diff --git a/pkgs/by-name/tr/tryton/package.nix b/pkgs/by-name/tr/tryton/package.nix
index 88461e1ca578..38be9993f62a 100644
--- a/pkgs/by-name/tr/tryton/package.nix
+++ b/pkgs/by-name/tr/tryton/package.nix
@@ -10,7 +10,7 @@
   gtkspell3,
   adwaita-icon-theme,
   glib,
-  goocanvas2,
+  goocanvas_2,
   gdk-pixbuf,
   pango,
   fontconfig,
@@ -48,7 +48,7 @@ python3Packages.buildPythonApplication rec {
     gdk-pixbuf
     glib
     adwaita-icon-theme
-    goocanvas2
+    goocanvas_2
     fontconfig
     freetype
     gtk3
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index e99f9b8f2784..250c486dc1af 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.12";
+  version = "0.0.13";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-HbIntp5dhJgR3WdX3mtxhghHo5twQFiGfbHprWSsei8=";
+    hash = "sha256-2KPnFNutndxE5ap0E9BCL5w6vpnfow8GIY4/N9dgYy8=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-OerZoJcgxCMytyrdI3xZmtRj/7/SJHJsdO92N/WXWU0=";
+  cargoHash = "sha256-E/kR6AxzpIqKMM80+ute5Z6LUL5f39RYfj7BnGOg6V4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ty/typescript-go/package.nix b/pkgs/by-name/ty/typescript-go/package.nix
index 96c62a6e7090..83ae24763093 100644
--- a/pkgs/by-name/ty/typescript-go/package.nix
+++ b/pkgs/by-name/ty/typescript-go/package.nix
@@ -10,13 +10,13 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2026-01-14";
+  version = "0-unstable-2026-01-21";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "f5bcdfc02e6527b774418a26ee817c4397da8546";
-    hash = "sha256-tNpRCXj/QoYP2uw7nWaQZAnQtktYgVfZZ1/L+N+/xys=";
+    rev = "01cac67dfdfcce7262431f282e6f515861897ed0";
+    hash = "sha256-6Ukhujb0EVJr3PYVTuM3MKPMpzshMy1NphSsgXsHRgQ=";
     fetchSubmodules = false;
   };
 
diff --git a/pkgs/by-name/ty/typioca/package.nix b/pkgs/by-name/ty/typioca/package.nix
index fc428d9876ef..42be81882dc3 100644
--- a/pkgs/by-name/ty/typioca/package.nix
+++ b/pkgs/by-name/ty/typioca/package.nix
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/bloznelis/typioca";
     changelog = "https://github.com/bloznelis/typioca/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     mainProgram = "typioca";
   };
 })
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index 93e954eaf113..4d147a59f179 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -12,7 +12,7 @@
   nix-update-script,
 }:
 let
-  version = "4.18.12";
+  version = "4.19.7";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-h0Y7a/wvmYOwr+AhVjY+P7uQQQbofpqkX5/Nd8tL3Cg=";
+    hash = "sha256-wRZNfirTBNFKVwHW+Wdu2hT2GLbQQO93HC/ngYmvaTw=";
   };
 
   dontUnpack = true;
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     description = "Open-source Android/Desktop remake of Civ V";
     mainProgram = "unciv";
     homepage = "https://github.com/yairm210/Unciv";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iedame ];
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.mpl20;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/uu/uutils-hostname/package.nix b/pkgs/by-name/uu/uutils-hostname/package.nix
new file mode 100644
index 000000000000..f9de647f54b9
--- /dev/null
+++ b/pkgs/by-name/uu/uutils-hostname/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "uutils-hostname";
+  version = "0.0.1-unstable-2026-01-08";
+
+  src = fetchFromGitHub {
+    owner = "uutils";
+    repo = "hostname";
+    rev = "a5590e823e2cb488ad14f61dee92e04cb4dc2704";
+    hash = "sha256-nWRkqONxbSwhphULpM+m14H/DSPmM4XdLJ7q2D4kooo=";
+  };
+
+  cargoHash = "sha256-1H4h01IqLVZrXNjnI36lGgsmg8rxHDAn9sbuvUxqPEQ=";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Rust reimplementation of the hostname project";
+    homepage = "https://github.com/uutils/hostname";
+    license = lib.licenses.mit;
+    mainProgram = "hostname";
+    maintainers = with lib.maintainers; [ kyehn ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/uu/uutils-login/package.nix b/pkgs/by-name/uu/uutils-login/package.nix
new file mode 100644
index 000000000000..c1bb42b59a8a
--- /dev/null
+++ b/pkgs/by-name/uu/uutils-login/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "uutils-login";
+  version = "0.0.1-unstable-2026-01-08";
+
+  src = fetchFromGitHub {
+    owner = "uutils";
+    repo = "login";
+    rev = "24c158ef78ef8e769337a91c563223a1bf1b58a7";
+    hash = "sha256-1pJhFtY3zJTDIKX9SXuv3yfrvPMNCiC/b7WKdBU1Nqk=";
+  };
+
+  cargoHash = "sha256-V0Cb3Vz3MpVxqaHpIxrfYD+EAjjQ0jKI9Qc6pN13deg=";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Rust reimplemtation of the login project";
+    homepage = "https://github.com/uutils/login";
+    license = lib.licenses.mit;
+    mainProgram = "shadow";
+    maintainers = with lib.maintainers; [ kyehn ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/uu/uutils-tar/package.nix b/pkgs/by-name/uu/uutils-tar/package.nix
new file mode 100644
index 000000000000..31a8d514bc64
--- /dev/null
+++ b/pkgs/by-name/uu/uutils-tar/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "uutils-tar";
+  version = "0.0.1-unstable-2026-01-08";
+
+  src = fetchFromGitHub {
+    owner = "uutils";
+    repo = "tar";
+    rev = "a73ac381d8fd78f8cb05236d26edfdae37a80ee3";
+    hash = "sha256-b8Nzp5zZuULH5YkCexVOPxioPiuauGL4+KarBAdVAd4=";
+  };
+
+  cargoHash = "sha256-UFRe+dBQhsV91tenZY4uqw9gs4ZqbYDtvBeA98dk3po=";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Rust implementation of tar";
+    homepage = "https://github.com/uutils/tar";
+    license = lib.licenses.mit;
+    mainProgram = "tarapp";
+    maintainers = with lib.maintainers; [ kyehn ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/wo/worker-build/package.nix b/pkgs/by-name/wo/worker-build/package.nix
index fbdb8aeec39b..81ce70935c72 100644
--- a/pkgs/by-name/wo/worker-build/package.nix
+++ b/pkgs/by-name/wo/worker-build/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "worker-build";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-rs";
     tag = "v${version}";
-    hash = "sha256-OWtlW9aJwDIfwRK6y1ajx8OLL1mMhbr6RDPuk+8Pyo0=";
+    hash = "sha256-LeW0CHYBaib81AqftYpW38FFR3P7q7OJE2NmrK9oi9Q=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-dcew0BCU1NqADquJ08MWLskrNox8LP/fA2QIC6LqETQ=";
+  cargoHash = "sha256-W1m7W7LepgZ3WPjmZ7qXlu3WnvZkpGO35sHryOFqhfk=";
 
   buildAndTestSubdir = "worker-build";
 
diff --git a/pkgs/by-name/wv/wvkbd/package.nix b/pkgs/by-name/wv/wvkbd/package.nix
index 1c6dd084f69e..f7023d52f5fe 100644
--- a/pkgs/by-name/wv/wvkbd/package.nix
+++ b/pkgs/by-name/wv/wvkbd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wvkbd";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchFromGitHub {
     owner = "jjsullivan5196";
     repo = "wvkbd";
     tag = "v${version}";
-    hash = "sha256-RfZbPAaf8UB4scUZ9XSL12QZ4UkYMzXqfmNt9ObOgQ0=";
+    hash = "sha256-oaySfijJBzD+tsaNMmXQ168un9Z0IMwN+7sxAmVr3xs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wx/wxhexeditor/package.nix b/pkgs/by-name/wx/wxhexeditor/package.nix
index ed4d3b588b04..ee4c2601e1b1 100644
--- a/pkgs/by-name/wx/wxhexeditor/package.nix
+++ b/pkgs/by-name/wx/wxhexeditor/package.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
   preConfigure = "patchShebangs .";
 
   makeFlags = lib.optionals stdenv.cc.isGNU [
+    "CFLAGS=-std=c17"
     "OPTFLAGS=-fopenmp"
   ];
 
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index f6f3d4ab7a9b..034a0ed121d3 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.2";
+  version = "1.0.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Bx+tobtsevaBFB6Dqpj49Y3VUOmfEVNQJ5ll2bLk+VU=";
+    hash = "sha256-5U0xjVEGrOZzw7WnQRvoQe4VuWJ9drV3kNV/ogZQJio=";
   };
 
   cargoHash = "sha256-99MGWfZrDOav77SRI7c5V21JTfkq7ejC7x+ZiQ5J0Yw=";
diff --git a/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix b/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix
index c2d42627b270..c53d3d92ad0c 100644
--- a/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mime-ext.yazi";
-  version = "25.12.29-unstable-2026-01-07";
+  version = "0-unstable-2026-01-12";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "68f7d4898c19dcf50beda251f8143992c3e8371f";
-    hash = "sha256-6iA/C0dzbLPkEDbdEs8oAnVfG6W+L8/dYyjTuO5euOw=";
+    rev = "75f6f7276fadf306597c2d2b4e264335fa0937cf";
+    hash = "sha256-iiV6WSLdc7LPjXr+DRwVKzgJr+0Z8hO2eil5cdAgW4g=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/piper/default.nix b/pkgs/by-name/ya/yazi/plugins/piper/default.nix
index 0fadb0b7f212..e02678dea0a9 100644
--- a/pkgs/by-name/ya/yazi/plugins/piper/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/piper/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "piper.yazi";
-  version = "25.9.15-unstable-2025-12-31";
+  version = "25.9.15-unstable-2026-01-12";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "398796d88fee7bf9c99c4dc29089b865d4f47722";
-    hash = "sha256-LOQ/0LYVrXsqQjeBeERKQ2M8BwN8xo3yej1mxNHphOU=";
+    rev = "c179ea49753b3a784935986d36b077a6df24bdb3";
+    hash = "sha256-0VKoUusTmKVxW8fJkYf0lm17bMjvkN1/tmx7+pNJdWI=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix b/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
index da12b23cccaf..ab79131a3c09 100644
--- a/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "time-travel.yazi";
-  version = "0-unstable-2025-02-14";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "iynaix";
     repo = "time-travel.yazi";
-    rev = "7e0179e15a41a4a42b6d0b5fa6dd240c9b4cf0d2";
-    hash = "sha256-ZZgn5rsBzvZcnDWZfjMBPRg9QUz4FTq5UIPWfnwXHQs=";
+    rev = "aaec6e26e525bd146354a5137ec40f1f23257a4e";
+    hash = "sha256-/+KiuGUox763dMQvHl1l3+Ci3vL8NwRuKNu9pi3gjyE=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
index ca487e5bdc0b..381954efcaab 100644
--- a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "25.5.31-unstable-2025-06-12";
+  version = "25.5.31-unstable-2026-01-21";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "88bd1c58357d472fe7e8daf9904936771fc49795";
-    hash = "sha256-RkQKZQAa5U9eMWk1Q0doueJZiuP4elUJ0dM1XKLSnDo=";
+    rev = "3227a30b21f69b68df513754b5a00d6e75cece57";
+    hash = "sha256-yhptHABQ0alVab2i367D5grJyG7SrfHH8H4JuGeYFyk=";
   };
 
   meta = {
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 2b39f29ff859..9608a0daff3d 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.10.0";
+  version = "11.10.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-zp7G1oYhalGrIvR8BPs0HuoHgw4jjU1ruLxa2aqFric=";
+    hash = "sha256-H9gtrYNk4W1OjjZwVX3ugDeqhW0rTvEJyhSRuz6XrYg=";
   };
-  npmDepsHash = "sha256-VAUnOcE+C5KIkDyz9sO3PVgJFOIpQgbwLEC6oQQNvGA=";
+  npmDepsHash = "sha256-oxa9JzbvXRvm+hfHrfhp5XBzTwcvW7yHJIvrKKu54B4=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/data/fonts/source-han/default.nix b/pkgs/data/fonts/source-han/default.nix
index 4dc5c06fa11c..f68a2c75ca55 100644
--- a/pkgs/data/fonts/source-han/default.nix
+++ b/pkgs/data/fonts/source-han/default.nix
@@ -86,7 +86,7 @@ let
     };
 in
 {
-  sans = makeSuperOTC {
+  source-han-sans = makeSuperOTC {
     family = "sans";
     description = "sans-serif";
     rev = "2.005R";
@@ -95,7 +95,7 @@ in
     prefix = "01_";
   };
 
-  serif = makeSuperOTC {
+  source-han-serif = makeSuperOTC {
     family = "serif";
     description = "serif";
     rev = "2.003R";
@@ -104,35 +104,35 @@ in
     prefix = "01_";
   };
 
-  mono = makeSuperOTC {
+  source-han-mono = makeSuperOTC {
     family = "mono";
     description = "monospaced";
     rev = "1.002";
     hash = "sha256-DBkkSN6QhI8R64M2h2iDqaNtxluJZeSJYAz8x6ZzWME=";
   };
 
-  sans-vf-otf = makeVariable {
+  source-han-sans-vf-otf = makeVariable {
     family = "sans";
     version = "2.005";
     hash = "sha256-7/THncqTE6IpPezcX14eYRRC8WR/xPv0XjfOPEfF8aU=";
     format = "otf";
   };
 
-  sans-vf-ttf = makeVariable {
+  source-han-sans-vf-ttf = makeVariable {
     family = "sans";
     version = "2.005";
     hash = "sha256-CL5kjZzCiNvdcwiFflTlarINpeYxvuqZH+4ayiIQdD8=";
     format = "ttf";
   };
 
-  serif-vf-otf = makeVariable {
+  source-han-serif-vf-otf = makeVariable {
     family = "serif";
     version = "2.003";
     hash = "sha256-a6295Ukha9QY5ByMr2FUy13j5gZ1itnezvfJWmJjqt0=";
     format = "otf";
   };
 
-  serif-vf-ttf = makeVariable {
+  source-han-serif-vf-ttf = makeVariable {
     family = "serif";
     version = "2.003";
     hash = "sha256-F+FUQunfyAEBVV10lZxC3dzGTWhHgHzpTO8CjC3n4WY=";
diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index e744c5081760..669e4841618a 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -262,13 +262,19 @@
               "sha256-vtjT+TL/7sYPu4rcVV3xCqJQ+uqkyBbf9l0KIi97j/0=";
         })
       ]
-      ++ lib.optionals (lib.versionOlder version "9.14.1") [
-        (fetchpatch {
-          name = "ghc-rts-Fix-compile-on-powerpc64-elf-v1.patch";
-          url = "https://gitlab.haskell.org/ghc/ghc/-/commit/05e5785a3157c71e327a8e9bdc80fa7082918739.patch";
-          hash = "sha256-xP5v3cKhXeTRSFvRiKEn9hPxGXgVgykjTILKjh/pdDU=";
-        })
-      ]
+      ++
+        lib.optionals
+          (
+            (lib.versions.majorMinor version == "9.12" && lib.versionOlder version "9.12.3")
+            || (lib.versions.majorMinor version != "9.12" && lib.versionOlder version "9.14.1")
+          )
+          [
+            (fetchpatch {
+              name = "ghc-rts-Fix-compile-on-powerpc64-elf-v1.patch";
+              url = "https://gitlab.haskell.org/ghc/ghc/-/commit/05e5785a3157c71e327a8e9bdc80fa7082918739.patch";
+              hash = "sha256-xP5v3cKhXeTRSFvRiKEn9hPxGXgVgykjTILKjh/pdDU=";
+            })
+          ]
       # Fix build with gcc15
       # https://gitlab.haskell.org/ghc/ghc/-/issues/25662
       # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863
diff --git a/pkgs/development/compilers/openjdk/17/source.json b/pkgs/development/compilers/openjdk/17/source.json
index 110fdf3a2223..9d218e0c53f6 100644
--- a/pkgs/development/compilers/openjdk/17/source.json
+++ b/pkgs/development/compilers/openjdk/17/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-U2/ZQ9m3fi2rni2RAXyr5laDvNq0T5M2wZX+FdmCwFc=",
+  "hash": "sha256-cA9jYzz9Dp4lcQjI2UsYbojtqIo6dx025kFJOAgmV5s=",
   "owner": "openjdk",
   "repo": "jdk17u",
-  "rev": "refs/tags/jdk-17.0.17+10"
+  "rev": "refs/tags/jdk-17.0.18+8"
 }
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index c515f9569ba8..bd6ed85c39ce 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -394,6 +394,7 @@ in
     buildInputs = old.buildInputs ++ [
       gnulib
     ];
+    meta.broken = isLuaJIT;
   });
 
   lrexlib-oniguruma = prev.lrexlib-oniguruma.overrideAttrs {
@@ -422,6 +423,7 @@ in
 
   lua-cmsgpack = prev.lua-cmsgpack.overrideAttrs {
     strictDeps = false;
+    meta.broken = isLuaJIT;
   };
 
   lua-curl = prev.lua-curl.overrideAttrs (old: {
diff --git a/pkgs/development/ocaml-modules/alcotest/default.nix b/pkgs/development/ocaml-modules/alcotest/default.nix
index 305bb6a153a3..0a5cb3a78873 100644
--- a/pkgs/development/ocaml-modules/alcotest/default.nix
+++ b/pkgs/development/ocaml-modules/alcotest/default.nix
@@ -11,12 +11,12 @@
   ocaml-syntax-shims,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "alcotest";
   version = "1.9.1";
 
   src = fetchurl {
-    url = "https://github.com/mirage/alcotest/releases/download/${version}/alcotest-${version}.tbz";
+    url = "https://github.com/mirage/alcotest/releases/download/${finalAttrs.version}/alcotest-${finalAttrs.version}.tbz";
     hash = "sha256-HinDtB1DKQYhBbcj39o6/4a4zvXnx1ANDkkfxf145II=";
   };
 
@@ -39,4 +39,4 @@ buildDunePackage rec {
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.ericbmerritt ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/algaeff/default.nix b/pkgs/development/ocaml-modules/algaeff/default.nix
index 0e867f8a0838..7190900057b1 100644
--- a/pkgs/development/ocaml-modules/algaeff/default.nix
+++ b/pkgs/development/ocaml-modules/algaeff/default.nix
@@ -6,7 +6,7 @@
   qcheck-core,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "algaeff";
   version = "2.0.0";
 
@@ -14,8 +14,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "RedPRL";
-    repo = pname;
-    rev = version;
+    repo = "algaeff";
+    rev = finalAttrs.version;
     hash = "sha256-VRZfULbXKRcExU1bnEu/X1KPX+L+dzcRYZVD985rQT4=";
   };
 
@@ -31,4 +31,4 @@ buildDunePackage rec {
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/alsa/default.nix b/pkgs/development/ocaml-modules/alsa/default.nix
index bc4c994dc525..fdf08692138f 100644
--- a/pkgs/development/ocaml-modules/alsa/default.nix
+++ b/pkgs/development/ocaml-modules/alsa/default.nix
@@ -6,7 +6,7 @@
   alsa-lib,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "alsa";
   version = "0.3.0";
 
@@ -15,7 +15,7 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-alsa";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "1qy22g73qc311rmv41w005rdlj5mfnn4yj1dx1jhqzr31zixl8hj";
   };
 
@@ -28,4 +28,4 @@ buildDunePackage rec {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ dandellion ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/ancient/default.nix b/pkgs/development/ocaml-modules/ancient/default.nix
index 65743757be89..78d2f5e9a637 100644
--- a/pkgs/development/ocaml-modules/ancient/default.nix
+++ b/pkgs/development/ocaml-modules/ancient/default.nix
@@ -3,14 +3,14 @@
   buildDunePackage,
   fetchurl,
 }:
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ancient";
   version = "0.10.0";
 
   minimalOCamlVersion = "4.12";
 
   src = fetchurl {
-    url = "https://github.com/OCamlPro/ocaml-ancient/releases/download/${version}/ancient-${version}.tbz";
+    url = "https://github.com/OCamlPro/ocaml-ancient/releases/download/${finalAttrs.version}/ancient-${finalAttrs.version}.tbz";
     hash = "sha256-XeVUPrdg7QSV7V0Tz8Mkj5jvzKtYD9DON+tt9kkuCHM=";
   };
 
@@ -35,8 +35,8 @@ buildDunePackage rec {
       file in and see the structures.
     '';
     homepage = "https://github.com/OCamlPro/ocaml-ancient";
-    changelog = "https://raw.githubusercontent.com/OCamlPro/ocaml-ancient/refs/tags/${version}/CHANGES.md";
+    changelog = "https://raw.githubusercontent.com/OCamlPro/ocaml-ancient/refs/tags/${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ momeemt ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/angstrom/default.nix b/pkgs/development/ocaml-modules/angstrom/default.nix
index 423267fb2b1b..2c2dce35b4fc 100644
--- a/pkgs/development/ocaml-modules/angstrom/default.nix
+++ b/pkgs/development/ocaml-modules/angstrom/default.nix
@@ -10,7 +10,7 @@
   gitUpdater,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "angstrom";
   version = "0.16.1";
 
@@ -18,8 +18,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "inhabitedtype";
-    repo = pname;
-    rev = version;
+    repo = "angstrom";
+    rev = finalAttrs.version;
     hash = "sha256-EPqDK+7RU2vHEHvuoTXb8V2FkdXQ6tGu0ghbNPS3gZ4=";
   };
 
@@ -39,4 +39,4 @@ buildDunePackage rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/ansiterminal/default.nix b/pkgs/development/ocaml-modules/ansiterminal/default.nix
index 07652e61dd94..cc8798286914 100644
--- a/pkgs/development/ocaml-modules/ansiterminal/default.nix
+++ b/pkgs/development/ocaml-modules/ansiterminal/default.nix
@@ -4,12 +4,12 @@
   fetchurl,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ANSITerminal";
   version = "0.8.5";
 
   src = fetchurl {
-    url = "https://github.com/Chris00/ANSITerminal/releases/download/${version}/ANSITerminal-${version}.tbz";
+    url = "https://github.com/Chris00/ANSITerminal/releases/download/${finalAttrs.version}/ANSITerminal-${finalAttrs.version}.tbz";
     hash = "sha256-q3OyGLajAmfSu8QzEtzzE5gbiwvsVV2SsGuHZkst0w4=";
   };
 
@@ -33,4 +33,4 @@ buildDunePackage rec {
     ];
     maintainers = [ lib.maintainers.jirkamarsik ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/ao/default.nix b/pkgs/development/ocaml-modules/ao/default.nix
index 77cbcf271744..174fa054490e 100644
--- a/pkgs/development/ocaml-modules/ao/default.nix
+++ b/pkgs/development/ocaml-modules/ao/default.nix
@@ -6,14 +6,14 @@
   libao,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ao";
   version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-ao";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-HhJdb4i9B4gz3emgDCDT4riQuAsY4uP/47biu7EZ+sk=";
   };
 
@@ -26,4 +26,4 @@ buildDunePackage rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ dandellion ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/apron/default.nix b/pkgs/development/ocaml-modules/apron/default.nix
index f1206bab6ffb..c329f36bf345 100644
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -14,13 +14,13 @@
   pplite,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-apron";
   version = "0.9.15";
   src = fetchFromGitHub {
     owner = "antoinemine";
     repo = "apron";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-gHLCurydxX1pS66DTAWUJGl9Yqu9RWRjkZh6lXzM7YY=";
   };
 
@@ -63,4 +63,4 @@ stdenv.mkDerivation rec {
     description = "Numerical abstract domain library";
     inherit (ocaml.meta) platforms;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/arg-complete/default.nix b/pkgs/development/ocaml-modules/arg-complete/default.nix
index 341971b35e88..a981a79e8992 100644
--- a/pkgs/development/ocaml-modules/arg-complete/default.nix
+++ b/pkgs/development/ocaml-modules/arg-complete/default.nix
@@ -7,12 +7,12 @@
   ounit2,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "arg-complete";
   version = "0.2.1";
 
   src = fetchurl {
-    url = "https://github.com/sim642/ocaml-arg-complete/releases/download/${version}/arg-complete-${version}.tbz";
+    url = "https://github.com/sim642/ocaml-arg-complete/releases/download/${finalAttrs.version}/arg-complete-${finalAttrs.version}.tbz";
     hash = "sha256-SZvLaeeqY3j2LUvqxGs0Vw57JnnpdvAk1jnE3pk27QU=";
   };
 
@@ -24,8 +24,8 @@ buildDunePackage rec {
   meta = {
     description = "Bash completion support for OCaml Stdlib.Arg";
     homepage = "https://sim642.github.io/ocaml-arg-complete/";
-    changelog = "https://raw.githubusercontent.com/sim642/ocaml-arg-complete/refs/tags/${version}/CHANGELOG.md";
+    changelog = "https://raw.githubusercontent.com/sim642/ocaml-arg-complete/refs/tags/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/argon2/default.nix b/pkgs/development/ocaml-modules/argon2/default.nix
index 0690ce740d3b..689bb5e50589 100644
--- a/pkgs/development/ocaml-modules/argon2/default.nix
+++ b/pkgs/development/ocaml-modules/argon2/default.nix
@@ -9,14 +9,14 @@
   buildDunePackage,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "argon2";
   version = "1.0.2";
 
   minimalOCamlVersion = "4.02.3";
 
   src = fetchurl {
-    url = "https://github.com/Khady/ocaml-argon2/releases/download/${version}/argon2-${version}.tbz";
+    url = "https://github.com/Khady/ocaml-argon2/releases/download/${finalAttrs.version}/argon2-${finalAttrs.version}.tbz";
     hash = "sha256-NDsOV4kPT2SnSfNHDBAK+VKZgHDIKxW+dNJ/C5bQ8gU=";
   };
 
@@ -37,4 +37,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ naora ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/arp/default.nix b/pkgs/development/ocaml-modules/arp/default.nix
index c5487ab6e66b..c6a18ad87d88 100644
--- a/pkgs/development/ocaml-modules/arp/default.nix
+++ b/pkgs/development/ocaml-modules/arp/default.nix
@@ -16,12 +16,12 @@
   mirage-vnetif,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "arp";
   version = "4.0.0";
 
   src = fetchurl {
-    url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    url = "https://github.com/mirage/arp/releases/download/v${finalAttrs.version}/arp-${finalAttrs.version}.tbz";
     hash = "sha256-C2Bh/2NwZqCJEidCnkhwRMoW3AsbQtvwdFh9IiJkDaU=";
   };
 
@@ -52,4 +52,4 @@ buildDunePackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/asai/default.nix b/pkgs/development/ocaml-modules/asai/default.nix
index 2a5a59895b6e..1e656924e91b 100644
--- a/pkgs/development/ocaml-modules/asai/default.nix
+++ b/pkgs/development/ocaml-modules/asai/default.nix
@@ -6,7 +6,7 @@
   bwd,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "asai";
   version = "0.3.1";
 
@@ -14,8 +14,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "RedPRL";
-    repo = pname;
-    rev = version;
+    repo = "asai";
+    rev = finalAttrs.version;
     hash = "sha256-IpRLX7umpmlNt2uV2MB+YvjAvNk0+gl5plbBExVvcdM=";
   };
 
@@ -30,4 +30,4 @@ buildDunePackage rec {
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/asetmap/default.nix b/pkgs/development/ocaml-modules/asetmap/default.nix
index 11cecd66cc9d..0c1037e1c5ff 100644
--- a/pkgs/development/ocaml-modules/asetmap/default.nix
+++ b/pkgs/development/ocaml-modules/asetmap/default.nix
@@ -7,11 +7,11 @@
   ocaml,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "asetmap";
   version = "0.8.1";
   src = fetchurl {
-    url = "https://github.com/dbuenzli/asetmap/archive/refs/tags/v${version}.tar.gz";
+    url = "https://github.com/dbuenzli/asetmap/archive/refs/tags/v${finalAttrs.version}.tar.gz";
     sha256 = "051ky0k62xp4inwi6isif56hx5ggazv4jrl7s5lpvn9cj8329frj";
   };
 
@@ -28,4 +28,4 @@ buildDunePackage rec {
   inherit (topkg) buildPhase installPhase;
 
   meta = { inherit (ocaml.meta) platforms; };
-}
+})
diff --git a/pkgs/development/ocaml-modules/asn1-combinators/default.nix b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
index 81e26af0a8e9..c40db11752c8 100644
--- a/pkgs/development/ocaml-modules/asn1-combinators/default.nix
+++ b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
@@ -7,14 +7,14 @@
   ohex,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   minimalOCamlVersion = "4.13.0";
 
   pname = "asn1-combinators";
   version = "0.3.2";
 
   src = fetchurl {
-    url = "https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v${version}/asn1-combinators-${version}.tbz";
+    url = "https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v${finalAttrs.version}/asn1-combinators-${finalAttrs.version}.tbz";
     hash = "sha256-KyaYX24nIgc9zZ+ENVvWdX4SZDtaSOMLPAf/fPsNin8=";
   };
 
@@ -28,9 +28,9 @@ buildDunePackage rec {
 
   meta = {
     homepage = "https://github.com/mirleft/ocaml-asn1-combinators";
-    changelog = "https://github.com/mirleft/ocaml-asn1-combinators/blob/v${version}/CHANGES.md";
+    changelog = "https://github.com/mirleft/ocaml-asn1-combinators/blob/v${finalAttrs.version}/CHANGES.md";
     description = "Combinators for expressing ASN.1 grammars in OCaml";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 12380239dd06..397112faa857 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -19,12 +19,12 @@
   mirage-mtime,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "awa";
   version = "0.5.2";
 
   src = fetchurl {
-    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
+    url = "https://github.com/mirage/awa-ssh/releases/download/v${finalAttrs.version}/awa-${finalAttrs.version}.tbz";
     hash = "sha256-64gloekVN0YsBwUodrJc6QaNU3PGKMIZMPJWvBfzaj0=";
   };
 
@@ -53,8 +53,8 @@ buildDunePackage rec {
   meta = {
     description = "SSH implementation in OCaml";
     homepage = "https://github.com/mirage/awa-ssh";
-    changelog = "https://github.com/mirage/awa-ssh/raw/v${version}/CHANGES.md";
+    changelog = "https://github.com/mirage/awa-ssh/raw/v${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/b0/default.nix b/pkgs/development/ocaml-modules/b0/default.nix
index 090eeb488077..2f76da1dec9f 100644
--- a/pkgs/development/ocaml-modules/b0/default.nix
+++ b/pkgs/development/ocaml-modules/b0/default.nix
@@ -9,13 +9,13 @@
   cmdliner,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
 
   pname = "ocaml${ocaml.version}-b0";
   version = "0.0.5";
 
   src = fetchurl {
-    url = "${meta.homepage}/releases/b0-${version}.tbz";
+    url = "https://erratique.ch/software/b0/releases/b0-${finalAttrs.version}.tbz";
     sha256 = "sha256-ty04JQcP4RCme/VQw0ko2IBebWWX5cBU6nRTTeV1I/I=";
   };
 
@@ -56,4 +56,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.Julow ];
     broken = !(lib.versionAtLeast ocaml.version "4.08");
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/backoff/default.nix b/pkgs/development/ocaml-modules/backoff/default.nix
index a623ece4d230..6c0dcd488b5a 100644
--- a/pkgs/development/ocaml-modules/backoff/default.nix
+++ b/pkgs/development/ocaml-modules/backoff/default.nix
@@ -5,12 +5,12 @@
   alcotest,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "backoff";
   version = "0.1.1";
 
   src = fetchurl {
-    url = "https://github.com/ocaml-multicore/backoff/releases/download/${version}/backoff-${version}.tbz";
+    url = "https://github.com/ocaml-multicore/backoff/releases/download/${finalAttrs.version}/backoff-${finalAttrs.version}.tbz";
     hash = "sha256-AL6jEbInsbwKVYedpNzjix/YRHtOTizxk6aVNzesnwM=";
   };
 
@@ -26,4 +26,4 @@ buildDunePackage rec {
   };
 
   minimalOCamlVersion = "4.12";
-}
+})
diff --git a/pkgs/development/ocaml-modules/bap/default.nix b/pkgs/development/ocaml-modules/bap/default.nix
index 2b9672a633e9..e6d88be9cb2b 100644
--- a/pkgs/development/ocaml-modules/bap/default.nix
+++ b/pkgs/development/ocaml-modules/bap/default.nix
@@ -42,7 +42,7 @@
   z3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-bap";
   version = "2.5.0+pr1621";
   src = fetchFromGitHub {
@@ -53,15 +53,15 @@ stdenv.mkDerivation rec {
   };
 
   sigs = fetchurl {
-    url = "https://github.com/BinaryAnalysisPlatform/bap/releases/download/v${version}/sigs.zip";
+    url = "https://github.com/BinaryAnalysisPlatform/bap/releases/download/v${finalAttrs.version}/sigs.zip";
     sha256 = "0d69jd28z4g64mglq94kj5imhmk5f6sgcsh9q2nij3b0arpcliwk";
   };
 
   createFindlibDestdir = true;
 
   setupHook = writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/ocaml${ocaml.version}-bap-${version}/"
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/ocaml${ocaml.version}-bap-${version}-llvm-plugins/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/ocaml${ocaml.version}-bap-${finalAttrs.version}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/ocaml${ocaml.version}-bap-${finalAttrs.version}-llvm-plugins/"
   '';
 
   nativeBuildInputs = [
@@ -134,7 +134,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
-    "--enable-everything ${disableIda} ${disableGhidra}"
+    "--enable-everything ${finalAttrs.disableIda} ${finalAttrs.disableGhidra}"
     "--with-llvm-config=${llvm.dev}/bin/llvm-config"
   ];
 
@@ -146,4 +146,4 @@ stdenv.mkDerivation rec {
     mainProgram = "bap";
     broken = lib.versionOlder ocaml.version "4.08";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/base64/default.nix b/pkgs/development/ocaml-modules/base64/default.nix
index 08b028c874ee..0638e50566e5 100644
--- a/pkgs/development/ocaml-modules/base64/default.nix
+++ b/pkgs/development/ocaml-modules/base64/default.nix
@@ -9,14 +9,14 @@
   rresult,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "base64";
   version = "3.5.2";
 
   minimalOCamlVersion = "4.07";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-base64/releases/download/v${version}/base64-${version}.tbz";
+    url = "https://github.com/mirage/ocaml-base64/releases/download/v${finalAttrs.version}/base64-${finalAttrs.version}.tbz";
     hash = "sha256-s/XOMBqnLHAy75C+IzLXL/OWKSLADuKuxryt4Yei9Zs=";
   };
 
@@ -36,4 +36,4 @@ buildDunePackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bdd/default.nix b/pkgs/development/ocaml-modules/bdd/default.nix
index b622de57ce99..1bf495d2223b 100644
--- a/pkgs/development/ocaml-modules/bdd/default.nix
+++ b/pkgs/development/ocaml-modules/bdd/default.nix
@@ -5,14 +5,14 @@
   stdlib-shims,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bdd";
   version = "0.5";
 
   src = fetchFromGitHub {
     owner = "backtracking";
     repo = "ocaml-bdd";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-bhgKpo7gGkjbI75pzckfQulZnTstj6G5QcErLgIGneU=";
   };
 
@@ -32,4 +32,4 @@ buildDunePackage rec {
     license = lib.licenses.lgpl21Only;
     maintainers = with lib.maintainers; [ wegank ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/benchmark/default.nix b/pkgs/development/ocaml-modules/benchmark/default.nix
index c039fe966f81..e3bce24b52fb 100644
--- a/pkgs/development/ocaml-modules/benchmark/default.nix
+++ b/pkgs/development/ocaml-modules/benchmark/default.nix
@@ -4,14 +4,14 @@
   buildDunePackage,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "benchmark";
   version = "1.7";
 
   minimalOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/Chris00/ocaml-benchmark/releases/download/v${version}/benchmark-${version}.tbz";
+    url = "https://github.com/Chris00/ocaml-benchmark/releases/download/v${finalAttrs.version}/benchmark-${finalAttrs.version}.tbz";
     hash = "sha256-Aij7vJzamNWQfjLeGgENlIp6Il8+Wc9hsahr4eDGs68=";
   };
 
@@ -23,8 +23,8 @@ buildDunePackage rec {
       your functions and to easily compare the results.  A statistical test
       is used to determine whether the results truly differ.
     '';
-    changelog = "https://raw.githubusercontent.com/Chris00/ocaml-benchmark/refs/tags/v${version}/CHANGES.md";
+    changelog = "https://raw.githubusercontent.com/Chris00/ocaml-benchmark/refs/tags/v${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ momeemt ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bencode/default.nix b/pkgs/development/ocaml-modules/bencode/default.nix
index 310d7f24d006..91c74c511cf3 100644
--- a/pkgs/development/ocaml-modules/bencode/default.nix
+++ b/pkgs/development/ocaml-modules/bencode/default.nix
@@ -6,7 +6,7 @@
   qcheck,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bencode";
   version = "2.0";
   minimalOCamlVersion = "4.02.0";
@@ -14,7 +14,7 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "rgrinberg";
     repo = "bencode";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-sEMS9oBOPeFX1x7cHjbQhCD2QI5yqC+550pPqqMsVws=";
   };
 
@@ -27,8 +27,8 @@ buildDunePackage rec {
   meta = {
     description = "Bencode (.torrent file format) reader/writer in OCaml ";
     homepage = "https://github.com/rgrinberg/bencode";
-    changelog = "https://github.com/rgrinberg/bencode/blob/${version}/Changelog.md";
+    changelog = "https://github.com/rgrinberg/bencode/blob/${finalAttrs.version}/Changelog.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ infinidoge ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bigarray-overlap/default.nix b/pkgs/development/ocaml-modules/bigarray-overlap/default.nix
index a1610e3b6e04..f8b5c320a598 100644
--- a/pkgs/development/ocaml-modules/bigarray-overlap/default.nix
+++ b/pkgs/development/ocaml-modules/bigarray-overlap/default.nix
@@ -6,12 +6,12 @@
   pkg-config,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bigarray-overlap";
   version = "0.2.1";
 
   src = fetchurl {
-    url = "https://github.com/dinosaure/overlap/releases/download/v${version}/bigarray-overlap-${version}.tbz";
+    url = "https://github.com/dinosaure/overlap/releases/download/v${finalAttrs.version}/bigarray-overlap-${finalAttrs.version}.tbz";
     hash = "sha256-L1IKxHAFTjNYg+upJUvyi2Z23bV3U8+1iyLPhK4aZuA=";
   };
 
@@ -28,4 +28,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bigstring/default.nix b/pkgs/development/ocaml-modules/bigstring/default.nix
index 6f976aeb544b..f7e3ee06b9ef 100644
--- a/pkgs/development/ocaml-modules/bigstring/default.nix
+++ b/pkgs/development/ocaml-modules/bigstring/default.nix
@@ -5,7 +5,7 @@
   ocaml,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bigstring";
   version = "0.3";
 
@@ -20,7 +20,7 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "ocaml-bigstring";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "0bkxwdcswy80f6rmx5wjza92xzq4rdqsb4a9fm8aav8bdqx021n8";
   };
 
@@ -33,4 +33,4 @@ buildDunePackage rec {
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.alexfmpe ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bigstringaf/default.nix b/pkgs/development/ocaml-modules/bigstringaf/default.nix
index 1de4d8312dfb..fd2fd76ff304 100644
--- a/pkgs/development/ocaml-modules/bigstringaf/default.nix
+++ b/pkgs/development/ocaml-modules/bigstringaf/default.nix
@@ -7,7 +7,7 @@
   dune-configurator,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bigstringaf";
   version = "0.10.0";
 
@@ -15,8 +15,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "inhabitedtype";
-    repo = pname;
-    tag = version;
+    repo = "bigstringaf";
+    tag = finalAttrs.version;
     hash = "sha256-p1hdB3ArOd2UX7S6YvXCFbYjEiXdMDmBaC/lFQgua7Q=";
   };
 
@@ -39,9 +39,9 @@ buildDunePackage rec {
 
       So here they are. Go crazy.
     '';
-    changelog = "https://github.com/inhabitedtype/bigstringaf/releases/tag/${version}";
+    changelog = "https://github.com/inhabitedtype/bigstringaf/releases/tag/${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.vbgl ];
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bindlib/default.nix b/pkgs/development/ocaml-modules/bindlib/default.nix
index 5adbc9e31070..bf0efa0ae9a9 100644
--- a/pkgs/development/ocaml-modules/bindlib/default.nix
+++ b/pkgs/development/ocaml-modules/bindlib/default.nix
@@ -6,7 +6,7 @@
   timed,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bindlib";
   version = "6.0.0";
 
@@ -14,8 +14,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "rlepigre";
-    repo = "ocaml-${pname}";
-    rev = version;
+    repo = "ocaml-bindlib";
+    rev = finalAttrs.version;
     hash = "sha256-058yMbz9ExvgNG/kY9tPk70XSeVRSSKVg4n4F4fmPu4=";
   };
 
@@ -29,7 +29,7 @@ buildDunePackage rec {
     homepage = "https://rlepigre.github.io/ocaml-bindlib";
     description = "Efficient binder representation in Ocaml";
     license = lib.licenses.gpl3;
-    changelog = "https://github.com/rlepigre/ocaml-bindlib/raw/${version}/CHANGELOG.md";
+    changelog = "https://github.com/rlepigre/ocaml-bindlib/raw/${finalAttrs.version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/biniou/default.nix b/pkgs/development/ocaml-modules/biniou/default.nix
index 4dfc9496fb8a..6611099893e9 100644
--- a/pkgs/development/ocaml-modules/biniou/default.nix
+++ b/pkgs/development/ocaml-modules/biniou/default.nix
@@ -6,12 +6,12 @@
   easy-format,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "biniou";
   version = "1.2.2";
 
   src = fetchurl {
-    url = "https://github.com/ocaml-community/biniou/releases/download/${version}/biniou-${version}.tbz";
+    url = "https://github.com/ocaml-community/biniou/releases/download/${finalAttrs.version}/biniou-${finalAttrs.version}.tbz";
     hash = "sha256-i/P/F80Oyy1rbR2UywjvCJ1Eyu+W6brmvmg51Cj6MY8=";
   };
 
@@ -27,4 +27,4 @@ buildDunePackage rec {
     maintainers = [ lib.maintainers.vbgl ];
     mainProgram = "bdump";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/binning/default.nix b/pkgs/development/ocaml-modules/binning/default.nix
index e97db4daddae..90eafe19b1e8 100644
--- a/pkgs/development/ocaml-modules/binning/default.nix
+++ b/pkgs/development/ocaml-modules/binning/default.nix
@@ -4,14 +4,14 @@
   fetchurl,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "binning";
   version = "0.0.0";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
-    url = "https://github.com/pveber/binning/releases/download/v${version}/binning-v${version}.tbz";
+    url = "https://github.com/pveber/binning/releases/download/v${finalAttrs.version}/binning-v${finalAttrs.version}.tbz";
     hash = "sha256-eG+xctsbc7lQ5pFOUtJ8rjNW/06gygwLADq7yc8Yf/c=";
   };
 
@@ -21,4 +21,4 @@ buildDunePackage rec {
     homepage = "https://github.com/pveber/binning/";
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/biotk/default.nix b/pkgs/development/ocaml-modules/biotk/default.nix
index da97a0df3554..991cc0d35c5d 100644
--- a/pkgs/development/ocaml-modules/biotk/default.nix
+++ b/pkgs/development/ocaml-modules/biotk/default.nix
@@ -19,14 +19,14 @@
   vg,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "biotk";
   version = "0.3";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
-    url = "https://github.com/pveber/biotk/releases/download/v${version}/biotk-${version}.tbz";
+    url = "https://github.com/pveber/biotk/releases/download/v${finalAttrs.version}/biotk-${finalAttrs.version}.tbz";
     hash = "sha256-9eRd3qYteUxu/xNEUER/DHodr6cTCuPtSKr38x32gig=";
   };
 
@@ -54,4 +54,4 @@ buildDunePackage rec {
     description = "Toolkit for bioinformatics in OCaml";
     license = lib.licenses.cecill-c;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bisect_ppx/default.nix b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
index e3a8518b7260..62356c085733 100644
--- a/pkgs/development/ocaml-modules/bisect_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
@@ -7,14 +7,14 @@
   ppxlib,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bisect_ppx";
   version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "aantron";
     repo = "bisect_ppx";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-3qXobZLPivFDtls/3WNqDuAgWgO+tslJV47kjQPoi6o=";
   };
 
@@ -48,4 +48,4 @@ buildDunePackage rec {
     maintainers = with lib.maintainers; [ momeemt ];
     mainProgram = "bisect-ppx-report";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bistro/default.nix b/pkgs/development/ocaml-modules/bistro/default.nix
index e717ae737d51..62ae1e930232 100644
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@@ -16,13 +16,13 @@
   ppxlib,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bistro";
   version = "unstable-2024-05-17";
 
   src = fetchFromGitHub {
     owner = "pveber";
-    repo = pname;
+    repo = "bistro";
     rev = "d44c44b52148e58ca3842c3efedf3115e376d800";
     sha256 = "sha256-naoCEVBfydqSeGGbXYBXfg0PP+Fzk05jFoul7XAz/tM=";
   };
@@ -44,10 +44,10 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.14";
 
   meta = {
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     description = "Build and execute typed scientific workflows";
     maintainers = [ lib.maintainers.vbgl ];
     license = lib.licenses.gpl2;
     broken = lib.versionAtLeast ppxlib.version "0.36";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bitstring/default.nix b/pkgs/development/ocaml-modules/bitstring/default.nix
index 106edfd31864..4c612b177a7c 100644
--- a/pkgs/development/ocaml-modules/bitstring/default.nix
+++ b/pkgs/development/ocaml-modules/bitstring/default.nix
@@ -5,7 +5,7 @@
   stdlib-shims,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bitstring";
   version = "4.1.1";
 
@@ -13,8 +13,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "xguerin";
-    repo = pname;
-    rev = "v${version}";
+    repo = "bitstring";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-eO7/S9PoMybZPnQQ+q9qbqKpYO4Foc9OjW4uiwwNds8=";
   };
 
@@ -26,4 +26,4 @@ buildDunePackage rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = [ lib.maintainers.maurer ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bitv/default.nix b/pkgs/development/ocaml-modules/bitv/default.nix
index 1fcc54f753ed..1f6debef31ef 100644
--- a/pkgs/development/ocaml-modules/bitv/default.nix
+++ b/pkgs/development/ocaml-modules/bitv/default.nix
@@ -4,7 +4,7 @@
   buildDunePackage,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bitv";
   version = "2.1";
   minimalOCamlVersion = "4.08";
@@ -12,7 +12,7 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "backtracking";
     repo = "bitv";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-jlpVMqYOiKxoU6wuVeYlOC5wRtF4aakljKpop6dfu8w=";
   };
 
@@ -20,7 +20,7 @@ buildDunePackage rec {
     description = "Bit vector library for OCaml";
     license = lib.licenses.lgpl21;
     homepage = "https://github.com/backtracking/bitv";
-    changelog = "https://github.com/backtracking/bitv/releases/tag/${version}";
+    changelog = "https://github.com/backtracking/bitv/releases/tag/${finalAttrs.version}";
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bjack/default.nix b/pkgs/development/ocaml-modules/bjack/default.nix
index 58a3a9dc1989..0e489d760693 100644
--- a/pkgs/development/ocaml-modules/bjack/default.nix
+++ b/pkgs/development/ocaml-modules/bjack/default.nix
@@ -7,14 +7,14 @@
   libjack2,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bjack";
   version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-bjack";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-jIxxqBVWphWYyLh+24rTxk4WWfPPdGCvNdevFJEKw70=";
   };
 
@@ -30,4 +30,4 @@ buildDunePackage rec {
     license = lib.licenses.lgpl21Only;
     maintainers = with lib.maintainers; [ dandellion ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bls12-381-signature/default.nix b/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
index cfb03c5e6d0b..1ba61c1c35a5 100644
--- a/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
+++ b/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
@@ -8,11 +8,11 @@
   integers_stubs_js,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bls12-381-signature";
   version = "1.0.0";
   src = fetchzip {
-    url = "https://gitlab.com/nomadic-labs/cryptography/ocaml-${pname}/-/archive/${version}/ocaml-bls12-381-signature-${version}.tar.bz2";
+    url = "https://gitlab.com/nomadic-labs/cryptography/ocaml-bls12-381-signature/-/archive/${finalAttrs.version}/ocaml-bls12-381-signature-${finalAttrs.version}.tar.bz2";
     sha256 = "sha256-KaUpAT+BWxmUP5obi4loR9vVUeQmz3p3zG3CBolUuL4=";
   };
 
@@ -36,4 +36,4 @@ buildDunePackage rec {
     homepage = "https://gitlab.com/nomadic-labs/cryptography/ocaml-bls12-381-signature";
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bls12-381/default.nix b/pkgs/development/ocaml-modules/bls12-381/default.nix
index 4f7db59d9adf..a31660575fe1 100644
--- a/pkgs/development/ocaml-modules/bls12-381/default.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/default.nix
@@ -10,13 +10,13 @@
   alcotest,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bls12-381";
   version = "6.1.0";
   src = fetchFromGitLab {
     owner = "nomadic-labs";
     repo = "cryptography/ocaml-bls12-381";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-z2ZSOrXgm+XjdrY91vqxXSKhA0DyJz6JkkNljDZznX8=";
   };
 
@@ -46,4 +46,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bls12-381/gen.nix b/pkgs/development/ocaml-modules/bls12-381/gen.nix
index 36bc1c1e2e6d..d5d5dd8d9c8c 100644
--- a/pkgs/development/ocaml-modules/bls12-381/gen.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/gen.nix
@@ -6,14 +6,14 @@
   zarith,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bls12-381-gen";
   version = "0.4.4";
 
   src = fetchFromGitLab {
     owner = "dannywillems";
     repo = "ocaml-bls12-381";
-    rev = "${version}-legacy";
+    rev = "${finalAttrs.version}-legacy";
     sha256 = "qocIfQdv9rniOUykRulu2zWsqkzT0OrsGczgVKALRuk=";
   };
 
@@ -34,4 +34,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bos/default.nix b/pkgs/development/ocaml-modules/bos/default.nix
index 810e4d35f89c..9cc68872f68a 100644
--- a/pkgs/development/ocaml-modules/bos/default.nix
+++ b/pkgs/development/ocaml-modules/bos/default.nix
@@ -13,12 +13,12 @@
   rresult,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-bos";
   version = "0.2.1";
 
   src = fetchurl {
-    url = "https://erratique.ch/software/bos/releases/bos-${version}.tbz";
+    url = "https://erratique.ch/software/bos/releases/bos-${finalAttrs.version}.tbz";
     sha256 = "sha256-2NYueGsQ1pfgRXIFqO7eqifrzJDxhV8Y3xkMrC49jzc=";
   };
 
@@ -48,4 +48,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.vbgl ];
     inherit (ocaml.meta) platforms;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/brr/default.nix b/pkgs/development/ocaml-modules/brr/default.nix
index 12a8a1635fd9..d16508db6303 100644
--- a/pkgs/development/ocaml-modules/brr/default.nix
+++ b/pkgs/development/ocaml-modules/brr/default.nix
@@ -10,11 +10,11 @@
   js_of_ocaml-toplevel,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-brr";
   version = "0.0.8";
   src = fetchurl {
-    url = "https://erratique.ch/software/brr/releases/brr-${version}.tbz";
+    url = "https://erratique.ch/software/brr/releases/brr-${finalAttrs.version}.tbz";
     hash = "sha256-g4ROHy9rHlaEFi5+euyRuEKK5HwKJWPmFkdvFhdIYgg=";
   };
   buildInputs = [
@@ -36,4 +36,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.vbgl ];
     inherit (ocaml.meta) platforms;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bstr/default.nix b/pkgs/development/ocaml-modules/bstr/default.nix
index 37e342db4400..c6f7b2b44d28 100644
--- a/pkgs/development/ocaml-modules/bstr/default.nix
+++ b/pkgs/development/ocaml-modules/bstr/default.nix
@@ -4,14 +4,14 @@
   lib,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bstr";
   version = "0.0.2";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
-    url = "https://github.com/robur-coop/bstr/releases/download/v${version}/bstr-${version}.tbz";
+    url = "https://github.com/robur-coop/bstr/releases/download/v${finalAttrs.version}/bstr-${finalAttrs.version}.tbz";
     hash = "sha256-/zvzCBzT014OesTmxGBDB98ZRU++YNDLUZ8uaDK3keM=";
   };
 
@@ -21,4 +21,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bwd/default.nix b/pkgs/development/ocaml-modules/bwd/default.nix
index c6179b4f31e3..837802bf25d2 100644
--- a/pkgs/development/ocaml-modules/bwd/default.nix
+++ b/pkgs/development/ocaml-modules/bwd/default.nix
@@ -5,7 +5,7 @@
   qcheck-core,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bwd";
   version = "2.3.0";
 
@@ -15,7 +15,7 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "RedPRL";
     repo = "ocaml-bwd";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-rzn0U/D6kPNsH5hBTElc3d1jfKbgKbjA2JHicpaJtu4=";
   };
 
@@ -25,8 +25,8 @@ buildDunePackage rec {
   meta = {
     description = "Backward Lists";
     homepage = "https://github.com/RedPRL/ocaml-bwd";
-    changelog = "https://github.com/RedPRL/ocaml-bwd/blob/${version}/CHANGELOG.markdown";
+    changelog = "https://github.com/RedPRL/ocaml-bwd/blob/${finalAttrs.version}/CHANGELOG.markdown";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/bytestring/default.nix b/pkgs/development/ocaml-modules/bytestring/default.nix
index ddf130ac8e28..49a4750b0d01 100644
--- a/pkgs/development/ocaml-modules/bytestring/default.nix
+++ b/pkgs/development/ocaml-modules/bytestring/default.nix
@@ -10,14 +10,14 @@
   qcheck,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "bytestring";
   version = "0.0.8";
 
   minimalOCamlVersion = "5.1";
 
   src = fetchurl {
-    url = "https://github.com/riot-ml/riot/releases/download/${version}/riot-${version}.tbz";
+    url = "https://github.com/riot-ml/riot/releases/download/${finalAttrs.version}/riot-${finalAttrs.version}.tbz";
     hash = "sha256-SsiDz53b9bMIT9Q3IwDdB3WKy98WSd9fiieU41qZpeE=";
   };
 
@@ -42,4 +42,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 1b30fcfef973..004d6c43e0b9 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -12,14 +12,14 @@
   alcotest,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ca-certs-nss";
   version = "3.118";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
+    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${finalAttrs.version}/ca-certs-nss-${finalAttrs.version}.tbz";
     hash = "sha256-BthKUUeuf3jFRmQzw0U9SEbvRqcVc1UKHmb4+YePRio=";
   };
 
@@ -46,4 +46,4 @@ buildDunePackage rec {
     maintainers = [ lib.maintainers.sternenseemann ];
     mainProgram = "extract-from-certdata";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/coin/default.nix b/pkgs/development/ocaml-modules/coin/default.nix
index 487c9f6c8c15..50b309d26f0e 100644
--- a/pkgs/development/ocaml-modules/coin/default.nix
+++ b/pkgs/development/ocaml-modules/coin/default.nix
@@ -7,13 +7,13 @@
   re,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "coin";
   version = "0.1.4";
   minimalOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/mirage/coin/releases/download/v${version}/coin-${version}.tbz";
+    url = "https://github.com/mirage/coin/releases/download/v${finalAttrs.version}/coin-${finalAttrs.version}.tbz";
     sha256 = "sha256:0069qqswd1ik5ay3d5q1v1pz0ql31kblfsnv0ax0z8jwvacp3ack";
   };
 
@@ -34,4 +34,4 @@ buildDunePackage rec {
     maintainers = [ ];
     mainProgram = "coin.generate";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/frontc/default.nix b/pkgs/development/ocaml-modules/frontc/default.nix
index 3f204ad06b68..2f6ee7529693 100644
--- a/pkgs/development/ocaml-modules/frontc/default.nix
+++ b/pkgs/development/ocaml-modules/frontc/default.nix
@@ -6,14 +6,14 @@
   menhir,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "FrontC";
   version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "BinaryAnalysisPlatform";
     repo = "FrontC";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "1mi1vh4qgscnb470qwidccaqd068j1bqlz6pf6wddk21paliwnqb";
   };
 
@@ -22,10 +22,10 @@ buildDunePackage rec {
   nativeBuildInputs = [ menhir ];
 
   meta = {
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     inherit (ocaml.meta) platforms;
     description = "C Parsing Library";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.maurer ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 9a774afcedde..ddfd916532f7 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -10,14 +10,14 @@
   ocaml-freestanding,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   minimalOCamlVersion = "4.13";
 
   pname = "mirage-crypto";
   version = "2.0.2";
 
   src = fetchurl {
-    url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-${version}.tbz";
+    url = "https://github.com/mirage/mirage-crypto/releases/download/v${finalAttrs.version}/mirage-crypto-${finalAttrs.version}.tbz";
     hash = "sha256-c5qdOfNAJ/vJNVf4fFysQZClK92t/3LyEvqoA9YhWHQ=";
   };
 
@@ -38,7 +38,7 @@ buildDunePackage rec {
   meta = {
     homepage = "https://github.com/mirage/mirage-crypto";
     description = "Simple symmetric cryptography for the modern age";
-    changelog = "https://raw.githubusercontent.com/mirage/mirage-crypto/refs/tags/v${version}/CHANGES.md";
+    changelog = "https://raw.githubusercontent.com/mirage/mirage-crypto/refs/tags/v${finalAttrs.version}/CHANGES.md";
     license = with lib.licenses; [
       isc # default license
       bsd2 # mirage-crypto-rng-mirage
@@ -49,4 +49,4 @@ buildDunePackage rec {
       momeemt
     ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/mirage/default.nix b/pkgs/development/ocaml-modules/mirage/default.nix
index 090df1651e9c..e0fb7af26d94 100644
--- a/pkgs/development/ocaml-modules/mirage/default.nix
+++ b/pkgs/development/ocaml-modules/mirage/default.nix
@@ -14,7 +14,7 @@
   uri,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "mirage";
   inherit (mirage-runtime) version src;
 
@@ -43,11 +43,11 @@ buildDunePackage rec {
 
   installPhase = ''
     runHook preInstall
-    dune install --prefix=$out --libdir=$dev/lib/ocaml/${ocaml.version}/site-lib/ ${pname}
+    dune install --prefix=$out --libdir=$dev/lib/ocaml/${ocaml.version}/site-lib/ mirage
     runHook postInstall
   '';
 
   meta = mirage-runtime.meta // {
     description = "MirageOS library operating system";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/poll/default.nix b/pkgs/development/ocaml-modules/poll/default.nix
index 0f0e616da1ba..0f17fc17c22b 100644
--- a/pkgs/development/ocaml-modules/poll/default.nix
+++ b/pkgs/development/ocaml-modules/poll/default.nix
@@ -8,14 +8,14 @@
   ppx_optcomp,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "poll";
   version = "0.3.1";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
-    url = "https://github.com/anuragsoni/poll/releases/download/${version}/poll-${version}.tbz";
+    url = "https://github.com/anuragsoni/poll/releases/download/${finalAttrs.version}/poll-${finalAttrs.version}.tbz";
     hash = "sha256-IX6SivK/IMQaGgMgWiIsNgUSMHP6z1E/TSB0miaQ8pw=";
   };
 
@@ -37,8 +37,8 @@ buildDunePackage rec {
   meta = {
     description = "Portable OCaml interface to macOS/Linux/Windows native IO event notification mechanisms";
     homepage = "https://github.com/anuragsoni/poll";
-    changelog = "https://github.com/anuragsoni/poll/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/anuragsoni/poll/blob/${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sixstring982 ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/spelll/default.nix b/pkgs/development/ocaml-modules/spelll/default.nix
index ec59977d333e..f68ac91ae474 100644
--- a/pkgs/development/ocaml-modules/spelll/default.nix
+++ b/pkgs/development/ocaml-modules/spelll/default.nix
@@ -6,7 +6,7 @@
   stdlib-shims,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "spelll";
   version = "0.4";
 
@@ -14,8 +14,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "c-cube";
-    repo = pname;
-    rev = "v${version}";
+    repo = "spelll";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-nI8fdArYynR70PUJIgyogGBCe4gFhfVzuRdZzFGKqOc=";
   };
 
@@ -25,9 +25,9 @@ buildDunePackage rec {
   ];
 
   meta = {
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     description = "Fuzzy string searching, using Levenshtein automaton";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index dc05187b4efb..cab170d1ae81 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -13,13 +13,13 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "composer";
-  version = "2.9.2";
+  version = "2.9.3";
 
   src = fetchFromGitHub {
     owner = "composer";
     repo = "composer";
     tag = finalAttrs.version;
-    hash = "sha256-Ke+QGcKPqm1wEVVYgUCL0K3nT+qmzWpRX6HcZnzdhgA=";
+    hash = "sha256-H5/YY0CKFlLdvEMzj3fr5QsEro0Y2/8gZInLQDbGR30=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +33,7 @@ php.buildComposerProject2 (finalAttrs: {
     inherit (finalAttrs.passthru) pharHash;
   };
 
-  vendorHash = "sha256-cqELlLH7d5KR62uVn7VtpQhVjkhXZkclXfc5d8RAG5Y=";
+  vendorHash = "sha256-4RFIegm7NFTpEbW11BtKB2BV+5VrSAhNrk125PcrBTw=";
 
   postInstall = ''
     wrapProgram $out/bin/composer \
@@ -55,7 +55,7 @@ php.buildComposerProject2 (finalAttrs: {
   # use together with the version from this package to keep the
   # bootstrap phar file up-to-date together with the end user composer
   # package.
-  passthru.pharHash = "sha256-Rx8thXq/DsGK97BV5hRyIU2RrbJPm9u7hkwcZPqtfdY=";
+  passthru.pharHash = "sha256-Oz+VA6LUZZAXDkXt0pc0GX55fOpUWzltCygjysjvRkM=";
 
   meta = {
     changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
index c9b661eee919..cbce1c8e2635 100644
--- a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
+++ b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
@@ -5,23 +5,25 @@
   setuptools,
   click,
   jinja2,
+  python-dotenv,
   pyyaml,
   rich,
   pytest-cov-stub,
   pytestCheckHook,
   scikit-learn,
+  requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "agentic-threat-hunting-framework";
-  version = "0.2.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Nebulock-Inc";
     repo = "agentic-threat-hunting-framework";
-    tag = "v${version}";
-    hash = "sha256-rt7WmBCbSqoZBpwGi7dzh8QDw8Iby3LSdavnCot1Hr0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WU58wQGlUgbOqcIE7EKtABNvTKtvTiRO9iJLW4gXDlI=";
   };
 
   build-system = [ setuptools ];
@@ -29,6 +31,7 @@ buildPythonPackage rec {
   dependencies = [
     click
     jinja2
+    python-dotenv
     pyyaml
     rich
   ];
@@ -40,6 +43,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-cov-stub
     pytestCheckHook
+    requests
   ];
 
   pythonImportsCheck = [ "athf" ];
@@ -47,8 +51,8 @@ buildPythonPackage rec {
   meta = {
     description = "Framework for agentic threat hunting";
     homepage = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework";
-    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${src.tag}";
+    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index 018bda2a0d44..93afe50e7fcd 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -10,7 +10,8 @@
   fastapi,
   fetchPypi,
   logging-journald,
-  poetry-core,
+  setuptools,
+  setuptools-scm,
   pytestCheckHook,
   raven,
   rich,
@@ -18,17 +19,20 @@
   uvloop,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiomisc";
-  version = "17.9.9";
+  version = "17.10.3";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-c9dlFc6XFahTbg6EEBb1OiKpFJ/zlzIp34UQJc8CXKY=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-24ka982Wx4Bk2TlWuw6pvfRLh47l8QJvHD+sc+LOxVY=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     colorlog
@@ -42,7 +46,7 @@ buildPythonPackage rec {
     pytestCheckHook
     setproctitle
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   optional-dependencies = {
     aiohttp = [ aiohttp ];
@@ -75,4 +79,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index 667c6d864d89..1313322c5a1f 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "alexapy";
-  version = "1.29.14";
+  version = "1.29.15";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "keatontaylor";
     repo = "alexapy";
     tag = "v${version}";
-    hash = "sha256-ZbdaiPyrF7EiigFHHFEQom+LsQKITD7FO9PdUVnoDvE=";
+    hash = "sha256-vdjqpkTnGY3THqekJ6fJ2Gb9Y0bVO/VtoAAXiV1Q45k=";
   };
 
   pythonRelaxDeps = [ "aiofiles" ];
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 29d5d3e2a142..8f0a36b3ce13 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -12,16 +12,16 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "app-model";
-  version = "0.4.0";
+  version = "0.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyapp-kit";
     repo = "app-model";
-    tag = "v${version}";
-    hash = "sha256-T7aUwdne1rUzhVRotlxDvEBm3mi/frUQziZdLo53Lsg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zKaCxozT6OOPfrXMDic5d5DMb/I9tTiJFlX21Cc1yjY=";
   };
 
   build-system = [
@@ -44,8 +44,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module to implement generic application schema";
     homepage = "https://github.com/pyapp-kit/app-model";
-    changelog = "https://github.com/pyapp-kit/app-model/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/pyapp-kit/app-model/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/asyncmy/default.nix b/pkgs/development/python-modules/asyncmy/default.nix
index d1d1d6e6261e..fa0716d08b78 100644
--- a/pkgs/development/python-modules/asyncmy/default.nix
+++ b/pkgs/development/python-modules/asyncmy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "asyncmy";
-  version = "0.2.10";
+  version = "0.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "long2ice";
     repo = "asyncmy";
     tag = "v${version}";
-    hash = "sha256-pWAUvHWtmpPlKh6YGJqhubQzIUSB0LeVanqfziOMWIM=";
+    hash = "sha256-+6sXXlSAZr09nPuJtZH8S2UfijFthDpRA/AdGOyIfxU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/banks/default.nix b/pkgs/development/python-modules/banks/default.nix
index 83db9ac6b498..213b90d4e75d 100644
--- a/pkgs/development/python-modules/banks/default.nix
+++ b/pkgs/development/python-modules/banks/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "banks";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "masci";
     repo = "banks";
     tag = "v${version}";
-    hash = "sha256-lzU1SwgZ7EKCmpDtCp4jKDBIdZVB+S1s/Oh3GfZCmtg=";
+    hash = "sha256-6+BQS9srj2VT2XcGe9g5Ios6g/vk3GcOXgCWEKq6YHI=";
   };
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
diff --git a/pkgs/development/python-modules/beets-audible/default.nix b/pkgs/development/python-modules/beets-audible/default.nix
index 92bebc0c3142..42ec73c8f274 100644
--- a/pkgs/development/python-modules/beets-audible/default.nix
+++ b/pkgs/development/python-modules/beets-audible/default.nix
@@ -7,7 +7,7 @@
   hatchling,
 
   # native
-  beets,
+  beets-minimal,
 
   # dependencies
   markdownify,
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    beets
+    beets-minimal
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/beets/default.nix b/pkgs/development/python-modules/beets/default.nix
index a390d64fe7f6..4fe0608dc154 100644
--- a/pkgs/development/python-modules/beets/default.nix
+++ b/pkgs/development/python-modules/beets/default.nix
@@ -19,13 +19,15 @@
   **     };
   **   };
   ** }
+  **
+  ** For an example adding a builtin plugin, see
+  ** passthru.tests.with-new-builtin-plugin below
 */
 {
   lib,
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  beets,
 
   # build-system
   poetry-core,
@@ -104,24 +106,16 @@
 
   # passthru.tests
   runCommand,
+  beets,
 }:
 
-let
-  # Avoid using `rec`, so that using e.g `passthru` or any other attributes
-  # defined inside, will have to be done via the beets argument, which can be
-  # overriden. Until `finalAttrs` support reaches `buildPythonPackage`, there
-  # is no way to avoid this. See:
-  #
-  # https://github.com/NixOS/nixpkgs/issues/258246
-  version = "2.5.1";
-in
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "beets";
   version = "2.5.1";
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-H3jcEHyK13+RHVlV4zp+8M3LZ0Jc2FdmAbLpekGozLA=";
   };
   pyproject = true;
@@ -154,7 +148,9 @@ buildPythonPackage {
     typing-extensions
     lap
   ]
-  ++ (lib.concatMap (p: p.propagatedBuildInputs) (lib.attrValues beets.passthru.plugins.enabled));
+  ++ (lib.concatMap (p: p.propagatedBuildInputs) (
+    lib.attrValues finalAttrs.finalPackage.passthru.plugins.enabled
+  ));
 
   nativeBuildInputs = [
     gobject-introspection
@@ -195,7 +191,7 @@ buildPythonPackage {
   makeWrapperArgs = [
     "--set GI_TYPELIB_PATH \"$GI_TYPELIB_PATH\""
     "--set GST_PLUGIN_SYSTEM_PATH_1_0 \"$GST_PLUGIN_SYSTEM_PATH_1_0\""
-    "--prefix PATH : ${lib.makeBinPath beets.passthru.plugins.wrapperBins}"
+    "--prefix PATH : ${lib.makeBinPath finalAttrs.finalPackage.passthru.plugins.wrapperBins}"
   ];
 
   nativeCheckInputs = [
@@ -208,12 +204,12 @@ buildPythonPackage {
     pillow
     writableTmpDirAsHomeHook
   ]
-  ++ beets.passthru.plugins.wrapperBins;
+  ++ finalAttrs.finalPackage.passthru.plugins.wrapperBins;
 
   __darwinAllowLocalNetworking = true;
 
   disabledTestPaths =
-    beets.passthru.plugins.disabledTestPaths
+    finalAttrs.finalPackage.passthru.plugins.disabledTestPaths
     ++ [
       # touches network
       "test/plugins/test_aura.py"
@@ -255,14 +251,14 @@ buildPythonPackage {
       \( -name '*.py' -o -path 'beetsplug/*/__init__.py' \) -print \
       | sed -n -re 's|^beetsplug/([^/.]+).*|\1|p' \
       | sort -u > plugins_available
-    ${diffPlugins (lib.attrNames beets.passthru.plugins.builtins) "plugins_available"}
+    ${diffPlugins (lib.attrNames finalAttrs.finalPackage.passthru.plugins.builtins) "plugins_available"}
 
     export BEETS_TEST_SHELL="${lib.getExe bashInteractive} --norc"
 
     env EDITOR="${writeScript "beetconfig.sh" ''
       #!${runtimeShell}
       cat > "$1" <<CFG
-      plugins: ${lib.concatStringsSep " " (lib.attrNames beets.passthru.plugins.enabled)}
+      plugins: ${lib.concatStringsSep " " (lib.attrNames finalAttrs.finalPackage.passthru.plugins.enabled)}
       CFG
     ''}" "$out/bin/beet" config -e
     env EDITOR=true "$out/bin/beet" config -e
@@ -442,30 +438,39 @@ buildPythonPackage {
           testPaths = [ ];
         };
       };
-      base = lib.mapAttrs (_: a: { builtin = true; } // a) beets.passthru.plugins.builtins;
+      base = lib.mapAttrs (
+        _: a: { builtin = true; } // a
+      ) finalAttrs.finalPackage.passthru.plugins.builtins;
       overrides = lib.mapAttrs (
         plugName:
-        lib.throwIf (beets.passthru.plugins.builtins.${plugName}.deprecated or false)
+        lib.throwIf (finalAttrs.finalPackage.passthru.plugins.builtins.${plugName}.deprecated or false)
           "beets evaluation error: Plugin ${plugName} was enabled in pluginOverrides, but it has been removed. Remove the override to fix evaluation."
       ) pluginOverrides;
-      all = lib.mapAttrs (
-        n: a:
-        {
-          name = n;
-          enable = !disableAllPlugins;
-          builtin = false;
-          propagatedBuildInputs = [ ];
-          testPaths = [ "test/plugins/test_${n}.py" ];
-          wrapperBins = [ ];
-        }
-        // a
-      ) (lib.recursiveUpdate beets.passthru.plugins.base beets.passthru.plugins.overrides);
-      enabled = lib.filterAttrs (_: p: p.enable) beets.passthru.plugins.all;
-      disabled = lib.filterAttrs (_: p: !p.enable) beets.passthru.plugins.all;
+      all =
+        lib.mapAttrs
+          (
+            n: a:
+            {
+              name = n;
+              enable = !disableAllPlugins;
+              builtin = false;
+              propagatedBuildInputs = [ ];
+              testPaths = [ "test/plugins/test_${n}.py" ];
+              wrapperBins = [ ];
+            }
+            // a
+          )
+          (
+            lib.recursiveUpdate finalAttrs.finalPackage.passthru.plugins.base finalAttrs.finalPackage.passthru.plugins.overrides
+          );
+      enabled = lib.filterAttrs (_: p: p.enable) finalAttrs.finalPackage.passthru.plugins.all;
+      disabled = lib.filterAttrs (_: p: !p.enable) finalAttrs.finalPackage.passthru.plugins.all;
       disabledTestPaths = lib.flatten (
-        lib.attrValues (lib.mapAttrs (_: v: v.testPaths) beets.passthru.plugins.disabled)
+        lib.attrValues (lib.mapAttrs (_: v: v.testPaths) finalAttrs.finalPackage.passthru.plugins.disabled)
+      );
+      wrapperBins = lib.concatMap (p: p.wrapperBins) (
+        lib.attrValues finalAttrs.finalPackage.passthru.plugins.enabled
       );
-      wrapperBins = lib.concatMap (p: p.wrapperBins) (lib.attrValues beets.passthru.plugins.enabled);
     };
     tests = {
       gstreamer =
@@ -483,8 +488,45 @@ buildPythonPackage {
               backend: gstreamer
             EOF
 
-            ${beets}/bin/beet -c $out/config.yaml > /dev/null
+            ${finalAttrs.finalPackage}/bin/beet -c $out/config.yaml > /dev/null
           '';
+      with-new-builtin-plugin = finalAttrs.finalPackage.overrideAttrs (
+        newAttrs: oldAttrs: {
+          postPatch = (oldAttrs.postPatch or "") + ''
+            mkdir -p beetsplug/my_special_plugin
+            touch beetsplug/my_special_plugin/__init__.py
+          '';
+          passthru = lib.recursiveUpdate oldAttrs.passthru {
+            plugins.builtins.my_special_plugin = { };
+          };
+        }
+      );
+      # Test that disabling
+      with-mpd-plugins-disabled = beets.override {
+        pluginOverrides = {
+          # These two plugins require mpd2 Python dependency. If they are
+          # disabled, this dependency shouldn't be pulled, and the `runCommand`
+          # test below should fail with a `ModuleNotFoundError`
+          mpdstats.enable = false;
+          mpdupdate.enable = false;
+        };
+      };
+      mpd-plugins-really-disabled = runCommand "beets-mpd-plugins-disabled-test" { } ''
+        set -euo pipefail
+        export HOME=$(mktemp -d)
+        mkdir $out
+
+        cat << EOF > $out/config.yaml
+        plugins:
+          - mpdstats
+        EOF
+        ${finalAttrs.finalPackage.passthru.tests.with-mpd-plugins-disabled}/bin/beet \
+          -c $out/config.yaml \
+          --help 2> $out/help-stderr || true
+        ${finalAttrs.finalPackage.passthru.tests.with-mpd-plugins-disabled}/bin/beet \
+          -c $out/config.yaml \
+          mpdstats --help 2> $out/mpdstats-help-stderr || true
+      '';
     };
   };
 
@@ -501,4 +543,4 @@ buildPythonPackage {
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "beet";
   };
-}
+})
diff --git a/pkgs/development/python-modules/bloodyad/default.nix b/pkgs/development/python-modules/bloodyad/default.nix
index 08444aa02e8e..34149bf73584 100644
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "bloodyad";
-  version = "2.5.2";
+  version = "2.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CravateRouge";
     repo = "bloodyAD";
     tag = "v${version}";
-    hash = "sha256-RWh73ZlzvTn1nGjQm9Keacvgm0AP0MGCYo/fM45nsmk=";
+    hash = "sha256-xevh8bPTyroZEiYqG5tbcjhhxjjQWencZTV4Iy/0U28=";
   };
 
   pythonRelaxDeps = [ "cryptography" ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 40a66161fa56..bce1625c929f 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.30";
+  version = "1.42.31";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-aKLKdUaGyYDXnRxn8tTV643D2J9Oxi1AgLlfva0+4Bs=";
+    hash = "sha256-uw2Mk24pOB04y3JL9SGXsf22OBFwfgUuhCwSI1RaDfc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 7f568655bc4b..cc2a218f88c9 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "botocore-stubs";
-  version = "1.42.30";
+  version = "1.42.31";
   pyproject = true;
 
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-xNEWeOsXImP+sd6AVFLDdtnBHlTxkDp8+hMrp2XVe30=";
+    hash = "sha256-5+di43sgXHunl4LGfMXDUVF0jOJnRwpwrJwCYINlXZ8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cogapp/default.nix b/pkgs/development/python-modules/cogapp/default.nix
index 76b48aec073f..bd737273ca99 100644
--- a/pkgs/development/python-modules/cogapp/default.nix
+++ b/pkgs/development/python-modules/cogapp/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "cogapp";
-  version = "3.5.1";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nedbat";
     repo = "cog";
     tag = "v${version}";
-    hash = "sha256-tUFqvG1SzoMc/cWAIOpNaf161KbRqscjNnxThg9slu8=";
+    hash = "sha256-46ojLTu1elNcjmWSKJuGKDG4XETLLnJDIpL2Al6/aX0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/datalad/default.nix b/pkgs/development/python-modules/datalad/default.nix
index 864870560936..73797b37af1e 100644
--- a/pkgs/development/python-modules/datalad/default.nix
+++ b/pkgs/development/python-modules/datalad/default.nix
@@ -41,6 +41,7 @@
   pythonOlder,
   typing-extensions,
   # tests
+  pytest-retry,
   pytest-xdist,
   pytestCheckHook,
   p7zip,
@@ -48,16 +49,16 @@
   httpretty,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "datalad";
-  version = "1.2.3";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "datalad";
     repo = "datalad";
-    tag = version;
-    hash = "sha256-C3e9k4RDFfDMaimZ/7TtAJNzdlfVrKoTHVl0zKL9EjI=";
+    tag = finalAttrs.version;
+    hash = "sha256-aTpiwcwRJyUF68+OsT+u9j/cibZEDhmL45I1MSY3Q7E=";
   };
 
   postPatch = ''
@@ -76,7 +77,9 @@ buildPythonPackage rec {
   ];
 
   dependencies =
-    optional-dependencies.core ++ optional-dependencies.downloaders ++ optional-dependencies.publish;
+    finalAttrs.passthru.optional-dependencies.core
+    ++ finalAttrs.passthru.optional-dependencies.downloaders
+    ++ finalAttrs.passthru.optional-dependencies.publish;
 
   optional-dependencies = {
     core = [
@@ -124,113 +127,43 @@ buildPythonPackage rec {
 
   preCheck = ''
     export HOME=$TMPDIR
+    export DATALAD_TESTS_NONETWORK=1
+    export PATH="$PATH:$out/bin"
   '';
 
-  # tests depend on apps in $PATH which only will get installed after the test
+  disabledTestMarks = [
+    "flaky"
+  ];
+
   disabledTests = [
-    # No such file or directory: 'datalad'
-    "test_script_shims"
-    "test_cfg_override"
-    "test_completion"
-    "test_nested_pushclone_cycle_allplatforms"
-    "test_create_sub_gh3463"
-    "test_create_sub_dataset_dot_no_path"
-    "test_cfg_passthrough"
-    "test_addurls_stdin_input_command_line"
-    "test_run_datalad_help"
-    "test_status_custom_summary_no_repeats"
-    "test_quoting"
-
-    #  No such file or directory: 'git-annex-remote-[...]"
-    "test_create"
-    "test_ensure_datalad_remote_maybe_enable"
-
-    # "git-annex: unable to use external special remote git-annex-remote-datalad"
-    "test_ria_postclonecfg"
-    "test_ria_postclone_noannex"
-    "test_ria_push"
-    "test_basic_scenario"
-    "test_annex_get_from_subdir"
-    "test_ensure_datalad_remote_init_and_enable_needed"
-    "test_ensure_datalad_remote_maybe_enable[False]"
-    "test_ensure_datalad_remote_maybe_enable[True]"
-    "test_create_simple"
-    "test_create_alias"
-    "test_storage_only"
-    "test_initremote"
-    "test_read_access"
-    "test_ephemeral"
-    "test_initremote_basic_fileurl"
-    "test_initremote_basic_httpurl"
-    "test_remote_layout"
-    "test_version_check"
-    "test_gitannex_local"
-    "test_push_url"
-    "test_url_keys"
-    "test_obtain_permission_root"
-    "test_source_candidate_subdataset"
-    "test_update_fetch_all"
-    "test_add_archive_dirs"
-    "test_add_archive_content"
-    "test_add_archive_content_strip_leading"
-    "test_add_archive_content_zip"
-    "test_add_archive_content_absolute_path"
-    "test_add_archive_use_archive_dir"
-    "test_add_archive_single_file"
-    "test_add_delete"
-    "test_add_archive_leading_dir"
-    "test_add_delete_after_and_drop"
-    "test_add_delete_after_and_drop_subdir"
-    "test_override_existing_under_git"
-    "test_copy_file_datalad_specialremote"
-    "test_download_url_archive"
-    "test_download_url_archive_from_subdir"
-    "test_download_url_archive_trailing_separator"
-    "test_download_url_need_datalad_remote"
-    "test_datalad_credential_helper - assert False"
-
-    # need internet access
-    "test_clone_crcns"
-    "test_clone_datasets_root"
+    # Tries to run `git` and fails
     "test_reckless"
-    "test_autoenabled_remote_msg"
-    "test_ria_http_storedataladorg"
-    "test_gin_cloning"
-    "test_nonuniform_adjusted_subdataset"
-    "test_install_datasets_root"
-    "test_install_simple_local"
-    "test_install_dataset_from_just_source"
-    "test_install_dataset_from_just_source_via_path"
-    "test_datasets_datalad_org"
-    "test_get_cached_dataset"
-    "test_cached_dataset"
-    "test_cached_url"
-    "test_anonymous_s3"
-    "test_protocols"
-    "test_get_versioned_url_anon"
-    "test_install_recursive_github"
-    "test_failed_install_multiple"
+    "test_create"
+    "test_subsuperdataset_save"
 
+    # Tries to spawn a subshell and fails
+    "test_shell_completion_source"
+
+    # Times out
+    "test_rerun_unrelated_nonrun_left_run_right"
+
+    # Top five slowest (2/3 of total runtime)
+    "test_files_split"
+    "test_gitannex_local"
+    "test_save_hierarchy"
+    "test_recurse_existing"
+    "test_source_candidate_subdataset"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # pbcopy not found
     "test_wtf"
-
-    # CommandError: 'git -c diff.ignoreSubmodules=none -c core.quotepath=false ls-files -z -m -d' failed with exitcode 128
-    "test_subsuperdataset_save"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    # For all: https://github.com/datalad/datalad/issues/7781
-    # AssertionError: `assert 1 == 0` (refcount error)
-    "test_GitRepo_flyweight"
-    "test_Dataset_flyweight"
-    "test_AnnexRepo_flyweight"
-    # TypeError: cannot pickle '_thread.lock' object
-    "test_popen_invocation"
-    # datalad.runner.exception.CommandError: '/python3.14 -i -u -q -']' timed out after 0.5 seconds
-    "test_asyncio_loop_noninterference1"
+    # hangs
+    "test_keyring"
   ];
 
   nativeCheckInputs = [
     p7zip
+    pytest-retry
     pytest-xdist
     pytestCheckHook
     git-annex
@@ -243,15 +176,20 @@ buildPythonPackage rec {
     "-Wignore::DeprecationWarning"
   ];
 
+  # Tests use ports on localhost
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "datalad" ];
 
   meta = {
     description = "Keep code, data, containers under control with git and git-annex";
     homepage = "https://www.datalad.org";
+    changelog = "https://github.com/datalad/datalad/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       renesat
       malik
+      sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
index 0cf7b916d11a..2fd8298b5a9e 100644
--- a/pkgs/development/python-modules/dbt-common/default.nix
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-common";
-  version = "1.37.2-unstable-2026-01-07";
+  version = "1.37.2-unstable-2026-01-20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-common";
-    rev = "c152c995e77eed72bc6b488f34728221aaa7fb0e"; # They don't tag releases
-    hash = "sha256-hdmW4jZMxJIZaffLD67QB7oRq7qxXMWjWIzkewb2CF4=";
+    rev = "84492782606974ecb52eecfcae0aa706cde8e270"; # They don't tag releases
+    hash = "sha256-QOWztrXeRJqGccsabzse5FWxwlxSdsgEjZ2W40mwAqE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/executorch/default.nix b/pkgs/development/python-modules/executorch/default.nix
index 9013410fb89d..95d8a94df950 100644
--- a/pkgs/development/python-modules/executorch/default.nix
+++ b/pkgs/development/python-modules/executorch/default.nix
@@ -46,7 +46,7 @@
   writableTmpDirAsHomeHook,
   yaspin,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "executorch";
   version = "1.0.1";
   pyproject = true;
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "executorch";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
 
     # The ExecuTorch repo must be cloned into a directory named exactly `executorch`.
     # See https://github.com/pytorch/executorch/issues/6475 for progress on a fix for this restriction.
@@ -63,7 +63,6 @@ buildPythonPackage rec {
     fetchSubmodules = true;
     hash = "sha256-h+nmipFDO/cdPTQXrjM5EkH//wHKBAvlDIp6SBbGN/8=";
   };
-  # src = /home/gaetan/nix/nixpkgs-packages/executorch;
 
   postPatch =
     # Hardcode the default flatc binary path to the nixpkgs flatc
@@ -86,10 +85,19 @@ buildPythonPackage rec {
         --replace-fail \
           "CMAKE_MINIMUM_REQUIRED(VERSION 3.5 FATAL_ERROR)" \
           "CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)"
+    ''
+    # Fix build with GCC>=15
+    + ''
+      substituteInPlace third-party/flatcc/include/flatcc/portable/grisu3_print.h \
+        --replace-fail \
+          'static char hexdigits[16] = "0123456789ABCDEF";' \
+          'static char hexdigits[17] = "0123456789ABCDEF";'
+
+      sed -i "1i #include <cstdint>" backends/apple/coreml/runtime/inmemoryfs/memory_buffer.hpp
     '';
 
   env = {
-    BUILD_VERSION = version;
+    BUILD_VERSION = finalAttrs.version;
   };
 
   build-system = [
@@ -117,6 +125,7 @@ buildPythonPackage rec {
     "pytest-xdist"
   ];
   pythonRelaxDeps = [
+    "scikit-learn"
     "torchao"
   ];
   dependencies = [
@@ -194,7 +203,7 @@ buildPythonPackage rec {
   meta = {
     description = "On-device AI across mobile, embedded and edge for PyTorch";
     homepage = "https://github.com/pytorch/executorch";
-    changelog = "https://github.com/pytorch/executorch/releases/tag/v${version}";
+    changelog = "https://github.com/pytorch/executorch/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     badPlatforms = [
@@ -204,4 +213,4 @@ buildPythonPackage rec {
       lib.systems.inspect.patterns.isDarwin
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/fastapi-mail/default.nix b/pkgs/development/python-modules/fastapi-mail/default.nix
index a1eb8bfdf16a..0408a8995a7e 100644
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -19,22 +19,23 @@
   starlette,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fastapi-mail";
-  version = "1.5.8";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sabuhish";
     repo = "fastapi-mail";
-    tag = version;
-    hash = "sha256-xxArFytTJKLTlBjR3T+c1OTpK3vSgIrpRJqQEcFs4J4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ruiUf+wGJRMLzmimb9oLi/tGV6UF9aa9G/iMgptSa9w=";
   };
 
   pythonRelaxDeps = [
     "aiosmtplib"
     "cryptography"
     "email-validator"
+    "regex"
     "pydantic"
   ];
 
@@ -75,8 +76,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module for sending emails and attachments";
     homepage = "https://github.com/sabuhish/fastapi-mail";
-    changelog = "https://github.com/sabuhish/fastapi-mail/releases/tag/${src.tag}";
+    changelog = "https://github.com/sabuhish/fastapi-mail/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/glymur/default.nix b/pkgs/development/python-modules/glymur/default.nix
index 10dac7a8050a..8014d12938aa 100644
--- a/pkgs/development/python-modules/glymur/default.nix
+++ b/pkgs/development/python-modules/glymur/default.nix
@@ -3,37 +3,39 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  glibc,
+  replaceVars,
+  openjpeg,
   libtiff,
+  glibc,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
   lxml,
   numpy,
-  openjpeg,
+  pillow,
+
+  # tests
+  addBinToPathHook,
   pytestCheckHook,
   scikit-image,
-  setuptools,
-  replaceVars,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "glymur";
-  version = "0.13.6";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quintusdias";
     repo = "glymur";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tIvDhlFPpDxC3CgBDT0RN9MM8ycY+J1hjcLXzx14Zhs=";
+    hash = "sha256-9CvsknpvBIHe2HEqwN43RRhRxh8D0eHQ/T9W3/eVJlQ=";
   };
 
   patches = [
-    # Numpy 2.x compatibility, https://github.com/quintusdias/glymur/pull/675
-    (fetchpatch {
-      name = "numpy2-compat.patch";
-      url = "https://github.com/quintusdias/glymur/commit/89b159299035ebb05776c3b90278f410ca6dba64.patch";
-      hash = "sha256-C/Q5WZmW5YtN3U8fxKljfqwKHtFLfR2LQ69Tj8SuIWg=";
-    })
     (replaceVars ./set-lib-paths.patch {
       openjp2_lib = "${lib.getLib openjpeg}/lib/libopenjp2${stdenv.hostPlatform.extensions.sharedLibrary}";
       tiff_lib = "${lib.getLib libtiff}/lib/libtiff${stdenv.hostPlatform.extensions.sharedLibrary}";
@@ -41,28 +43,31 @@ buildPythonPackage (finalAttrs: {
   ];
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    substituteInPlace glymur/lib/tiff.py \
-        --replace-fail "glymur_config('c')" "ctypes.CDLL('${lib.getLib glibc}/lib/libc.so.6')"
+    substituteInPlace glymur/lib/_tiff.py \
+        --replace-fail \
+          'glymur_config("c")' \
+          'ctypes.CDLL("${lib.getLib glibc}/lib/libc.so.6")'
   '';
 
   __propagatedImpureHostDeps = lib.optional stdenv.hostPlatform.isDarwin "/usr/lib/libc.dylib";
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     lxml
     numpy
+    pillow
   ];
 
   nativeCheckInputs = [
+    addBinToPathHook
     pytestCheckHook
     scikit-image
   ];
 
-  preCheck = ''
-    export PATH="$out/bin:$PATH"
-  '';
-
   disabledTestPaths = [
     # this test involves glymur's different ways of finding the openjpeg path on
     # fsh systems by reading an .rc file and such, and is obviated by the patch
@@ -74,7 +79,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Tools for accessing JPEG2000 files";
     homepage = "https://github.com/quintusdias/glymur";
-    changelog = "https://github.com/quintusdias/glymur/blob/${finalAttrs.src.rev}/CHANGES.txt";
+    changelog = "https://github.com/quintusdias/glymur/blob/${finalAttrs.src.tag}/CHANGES.txt";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ tomasajt ];
   };
diff --git a/pkgs/development/python-modules/goocalendar/default.nix b/pkgs/development/python-modules/goocalendar/default.nix
index ffa6f7c57c6b..691e82319091 100644
--- a/pkgs/development/python-modules/goocalendar/default.nix
+++ b/pkgs/development/python-modules/goocalendar/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   gobject-introspection,
-  goocanvas2,
+  goocanvas_2,
   gtk3,
   pkg-config,
   pygobject3,
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   buildInputs = [
     gtk3
-    goocanvas2
+    goocanvas_2
   ];
 
   # No upstream tests available
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index 5de111ad5b8d..7b3539a3de72 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -4,7 +4,6 @@
   aiohttp,
   aioresponses,
   buildPythonPackage,
-  cachetools,
   cryptography,
   flask,
   freezegun,
@@ -25,20 +24,19 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.45.0";
+  version = "2.47.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-auth-library-python";
     tag = "v${version}";
-    hash = "sha256-CONPYm88g8AvGlb7HBMKyWFTGntkgEkDZ2RHKyqoYhw=";
+    hash = "sha256-kgiqKeS8NTlz56yYKE8U/eKFQjHD6CJHOH5IKLgOeDk=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
-    cachetools
     pyasn1-modules
     rsa
   ];
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 444470ae045b..a509359872e7 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_iam_logging";
     inherit version;
-    hash = "sha256-CmUvHm1DVA/bRejKm+T8VonVlHy6Dmk1uytz3tfAVGk=";
+    hash = "sha256-/D0OLN0NsthrbamI9Sc0SOoCenSEHdezVNjn1OFenIA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 6e98b77e95aa..359a05c07da6 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -10,15 +10,15 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-org-policy";
-  version = "1.15.0";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_org_policy";
-    inherit version;
-    hash = "sha256-Jx0WoQ51NH6s5g0CzeMisrG2E7zJmRcQng6/KkECJTo=";
+    inherit (finalAttrs) version;
+    hash = "sha256-xyFHEn2I2YCa+HOLKr40gG6sUpw83FeqkVzAihuEKhM=";
   };
 
   build-system = [ setuptools ];
@@ -45,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Protobufs for Google Cloud Organization Policy";
     homepage = "https://github.com/googleapis/python-org-policy";
-    changelog = "https://github.com/googleapis/python-org-policy/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/python-org-policy/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ austinbutler ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 00b82e82dbea..07bbce5f9b75 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.41.0";
+  version = "1.42.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_securitycenter";
     inherit version;
-    hash = "sha256-JHbPkOVw19KQok3NV0j6AecKRw7NMH9WjsbAapISDiM=";
+    hash = "sha256-zwCV0I0vBIgvVRXG31JX8M00u8mzXGMCw/5QpEMKa+Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-shell/default.nix b/pkgs/development/python-modules/google-cloud-shell/default.nix
index 48f3e4100abf..2de83610d898 100644
--- a/pkgs/development/python-modules/google-cloud-shell/default.nix
+++ b/pkgs/development/python-modules/google-cloud-shell/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-shell";
-  version = "1.13.0";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_shell";
     inherit version;
-    hash = "sha256-B6SZJm7rGZDIFbF0kHPcBidBF0d+ONIKtUcpjwslkgE=";
+    hash = "sha256-hnlYocYjIiPjO4HparvKTC0pFtRXAkRVB9O9TYHOjFU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 6ef348d8187e..f5a80b6b8b93 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.23.0";
+  version = "3.24.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_translate";
     inherit version;
-    hash = "sha256-KKMSMN6AoP74etT8Y+o32Sbuhln3LVW51wnpCPATlag=";
+    hash = "sha256-LzuLkPjNr2OkNdGOY7IcNlDeMfxPhYYj8tDWm+DNPpo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 9d29bd3616dd..9cfa53b6a7d4 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_videointelligence";
     inherit version;
-    hash = "sha256-AAi05hjj6oNYg+Ay2GYMhsa5M8mP4L+t2gNghv8DcoQ=";
+    hash = "sha256-sq45vSLRhiGGhKKXwvovpjblh05p059xlQTXKfRGOf0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/http-message-signatures/default.nix b/pkgs/development/python-modules/http-message-signatures/default.nix
index 13b18a5a0e25..0a2dc0cc623c 100644
--- a/pkgs/development/python-modules/http-message-signatures/default.nix
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "http-message-signatures";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyauth";
     repo = "http-message-signatures";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uHsH/kYph50cpLcy4lnu466odexUVvQAYk0ydgtcsM8=";
+    hash = "sha256-GFOdefqcAia4ZHqt1XMS2dw2bQ3AzbY0AQm7b8niYRI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/hy/default.nix b/pkgs/development/python-modules/hy/default.nix
index 368f4b550f58..5e994c93ca33 100644
--- a/pkgs/development/python-modules/hy/default.nix
+++ b/pkgs/development/python-modules/hy/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "hy";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hylang";
     repo = "hy";
     tag = version;
-    hash = "sha256-zaTe9sRmW+lzpbNVrnj5ccp1xIbN10FD1Jst/hM78Lw=";
+    hash = "sha256-uKkTH5vywJ5OrbbHIpHGLbTA/Px0/02JEXI8NIUvt/w=";
   };
 
   # https://github.com/hylang/hy/blob/1.0a4/get_version.py#L9-L10
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 89426c8b90e1..421e16fbe59d 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -12,8 +12,8 @@
   pytestCheckHook,
 
   # tests
+  pycrdt-websocket,
   websockets,
-  ypy-websocket,
 }:
 
 buildPythonPackage rec {
@@ -39,8 +39,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pycrdt-websocket
     websockets
-    ypy-websocket
   ];
 
   # requires a Node.js environment
@@ -48,7 +48,7 @@ buildPythonPackage rec {
 
   meta = {
     changelog = "https://github.com/jupyter-server/jupyter_ydoc/blob/${src.tag}/CHANGELOG.md";
-    description = "Document structures for collaborative editing using Ypy";
+    description = "Document structures for collaborative editing using Yjs/pycrdt";
     homepage = "https://github.com/jupyter-server/jupyter_ydoc";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
diff --git a/pkgs/development/python-modules/lerobot/default.nix b/pkgs/development/python-modules/lerobot/default.nix
index a49cb26b1ec1..4a3783819b24 100644
--- a/pkgs/development/python-modules/lerobot/default.nix
+++ b/pkgs/development/python-modules/lerobot/default.nix
@@ -34,18 +34,19 @@
   # tests
   pytestCheckHook,
   writableTmpDirAsHomeHook,
+  pytest-timeout,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lerobot";
-  version = "0.4.0";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "lerobot";
-    tag = "v${version}";
-    hash = "sha256-RVe1X0qBPm+okO3Gi/UdkuvuX0m4RlbhIs+NJLlC9wU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qBbXFvVQ+cESBrNy8NIoT6GR6dqzeLbRNe3JmcpiiTw=";
   };
 
   # ValueError: mutable default <class 'lerobot.configs.types.PolicyFeature'> for field value is not allowed: use default_factory
@@ -67,12 +68,12 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "av"
-    "datasets"
     "draccus"
     "gymnasium"
     "rerun-sdk"
     "torch"
     "torchvision"
+    "wandb"
   ];
 
   dependencies = [
@@ -109,6 +110,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     writableTmpDirAsHomeHook
+    pytest-timeout
   ];
 
   disabledTests = [
@@ -124,6 +126,9 @@ buildPythonPackage rec {
     "test_dataset_initialization"
     "test_factory"
     "test_from_pretrained_nonexistent_path"
+    "test_load_config_nonexistent_path_tries_hub"
+    "test_make_env_from_hub_async"
+    "test_make_env_from_hub_with_trust"
     "test_policy_defaults"
     "test_save_and_load_pretrained"
 
@@ -149,18 +154,24 @@ buildPythonPackage rec {
     #  Regex: "Can't instantiate abstract class NonCallableStep with abstract method __call_"
     #  Input: "Can't instantiate abstract class NonCallableStep without an implementation for abstract method '__call__'"
     "test_construction_rejects_step_without_call"
+
+    # TypeError: 'NoneType' object is not subscriptable
+    "test_pi0_rtc_inference_with_prev_chunk"
   ];
 
   disabledTestPaths = [
     # Sometimes hang forever on some CPU models
     "tests/policies/test_sac_policy.py"
+
+    # Sometimes hang forever
+    "tests/policies/rtc/test_modeling_rtc.py"
   ];
 
   meta = {
     description = "Making AI for Robotics more accessible with end-to-end learning";
     homepage = "https://github.com/huggingface/lerobot";
-    changelog = "https://github.com/huggingface/lerobot/releases/tag/v${version}";
+    changelog = "https://github.com/huggingface/lerobot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/magika/default.nix b/pkgs/development/python-modules/magika/default.nix
index 504063f6e12c..a1846e289f69 100644
--- a/pkgs/development/python-modules/magika/default.nix
+++ b/pkgs/development/python-modules/magika/default.nix
@@ -1,20 +1,30 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
-  click,
   fetchPypi,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  click,
   numpy,
   onnxruntime,
-  hatchling,
   python-dotenv,
   tabulate,
   tqdm,
+
+  # tests
   pytestCheckHook,
   dacite,
   versionCheckHook,
 }:
 
-buildPythonPackage rec {
+let
+  isNotAarch64Linux = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
+in
+buildPythonPackage (finalAttrs: {
   pname = "magika";
   version = "1.0.1";
   pyproject = true;
@@ -23,7 +33,7 @@ buildPythonPackage rec {
   # Pypi tarball contains a pure python implementation of magika
   # while GitHub source requires compiling magika-cli
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-MT+Mv83Jp+VcJChicyMKJzK4mCXlipPeK1dlMTk7g5g=";
   };
 
@@ -63,14 +73,19 @@ buildPythonPackage rec {
     "test_magika_module_with_previously_missdetected_samples"
   ];
 
-  pythonImportsCheck = [ "magika" ];
+  # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+  # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
+  #
+  # -> Skip all tests that require importing magika
+  pythonImportsCheck = lib.optionals isNotAarch64Linux [ "magika" ];
+  doCheck = isNotAarch64Linux;
 
   meta = {
     description = "Detect file content types with deep learning";
     homepage = "https://github.com/google/magika";
-    changelog = "https://github.com/google/magika/blob/python-v${version}/python/CHANGELOG.md";
+    changelog = "https://github.com/google/magika/blob/python-v${finalAttrs.version}/python/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mihaimaruseac ];
     mainProgram = "magika-python-client";
   };
-}
+})
diff --git a/pkgs/development/python-modules/markitdown/default.nix b/pkgs/development/python-modules/markitdown/default.nix
index c47f7361a2ef..cffa8aa21a21 100644
--- a/pkgs/development/python-modules/markitdown/default.nix
+++ b/pkgs/development/python-modules/markitdown/default.nix
@@ -1,15 +1,22 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatchling,
+
+  # dependencies
   beautifulsoup4,
   defusedxml,
   ffmpeg-headless,
+  lxml,
   magika,
   mammoth,
   markdownify,
   numpy,
+  olefile,
   openai,
   openpyxl,
   pandas,
@@ -20,15 +27,20 @@
   python-pptx,
   requests,
   speechrecognition,
-  youtube-transcript-api,
-  olefile,
   xlrd,
-  lxml,
+  youtube-transcript-api,
+
+  # tests
   pytestCheckHook,
+
+  # passthru
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+let
+  isNotAarch64Linux = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
+in
+buildPythonPackage (finalAttrs: {
   pname = "markitdown";
   version = "0.1.4";
   pyproject = true;
@@ -36,11 +48,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "markitdown";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-WKA2eY8wY3SM9xZ7Cek5eUcJbO5q6eMDx2aTKfQnFvE=";
   };
 
-  sourceRoot = "${src.name}/packages/markitdown";
+  sourceRoot = "${finalAttrs.src.name}/packages/markitdown";
 
   build-system = [ hatchling ];
 
@@ -71,7 +83,12 @@ buildPythonPackage rec {
     youtube-transcript-api
   ];
 
-  pythonImportsCheck = [ "markitdown" ];
+  # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+  # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
+  #
+  # -> Skip all tests that require importing markitdown
+  pythonImportsCheck = lib.optionals isNotAarch64Linux [ "markitdown" ];
+  doCheck = isNotAarch64Linux;
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -88,8 +105,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python tool for converting files and office documents to Markdown";
     homepage = "https://github.com/microsoft/markitdown";
-    changelog = "https://github.com/microsoft/markitdown/releases/tag/${src.tag}";
+    changelog = "https://github.com/microsoft/markitdown/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/mkdocstrings/default.nix b/pkgs/development/python-modules/mkdocstrings/default.nix
index d79454834553..03f5472230c2 100644
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "mkdocstrings";
     tag = version;
-    hash = "sha256-PQ8TL/eMYNX0gXvWhq/Rop2bv1oCoO7o3dxlCK9tbGE=";
+    hash = "sha256-dRDelPj2zO31gZzPDh7BxdBemGNaTPbzhlmWH1JYmaM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 6fb5fb1850f4..0ed2b2b23342 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -147,8 +147,8 @@ in
       "sha256-jW+LgaUpdeCSJLnpNE13DSio9nFmp0icoLEMwxX44KU=";
 
   mypy-boto3-autoscaling =
-    buildMypyBoto3Package "autoscaling" "1.42.3"
-      "sha256-WUD99NFy2KrOG5M1kP8J1B9tRDNZcvOu6J8zw534r6k=";
+    buildMypyBoto3Package "autoscaling" "1.42.31"
+      "sha256-0EfPmOIE5w8S2XNGvZePztWAyDJ7tTdkXPBbFyEo+KQ=";
 
   mypy-boto3-autoscaling-plans =
     buildMypyBoto3Package "autoscaling-plans" "1.42.3"
@@ -722,8 +722,8 @@ in
       "sha256-rIkIFitznxD9ytbq4cdAbiPTJFZRwZywQ50HVo7D+VU=";
 
   mypy-boto3-keyspaces =
-    buildMypyBoto3Package "keyspaces" "1.42.3"
-      "sha256-gDJBAmI5yeGgILOhLwSc7tk3rgKxeE575ZcrY+lptPA=";
+    buildMypyBoto3Package "keyspaces" "1.42.31"
+      "sha256-isLoakoBigys+KBGRoFryEqtKT2g+Wv2D/+ttlxOlfk=";
 
   mypy-boto3-kinesis =
     buildMypyBoto3Package "kinesis" "1.42.3"
@@ -1374,8 +1374,8 @@ in
       "sha256-olIHhtYBAz8+avIUNnLoD2pdMq+TLrB8Mn+haKeUl/0=";
 
   mypy-boto3-verifiedpermissions =
-    buildMypyBoto3Package "verifiedpermissions" "1.42.3"
-      "sha256-2fA+3Ddfeetmh2vBpnIAWO7ILfTLBTxZtjJ18Yn+mHA=";
+    buildMypyBoto3Package "verifiedpermissions" "1.42.31"
+      "sha256-YIAxvp/geIyDsfhdEqc2UtIjFp12y6Tjq7SjmzpESfk=";
 
   mypy-boto3-voice-id =
     buildMypyBoto3Package "voice-id" "1.42.3"
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index ad9be9312a9b..6de2732e7a3c 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "6.4.0";
+  version = "7.0.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "gajim";
     repo = "python-nbxmpp";
     tag = version;
-    hash = "sha256-q910WbBp0TBqXw8WfYniliVGnr4Hi6dDhVDqZszSL0c=";
+    hash = "sha256-NzSXvuPf7PZbMPgD3nhPgTH4Vd8DVx49fjf7cPcvywc=";
   };
 
   nativeBuildInputs = [
@@ -40,12 +40,7 @@ buildPythonPackage rec {
     idna
     libsoup_3
     packaging
-    (pygobject3.overrideAttrs (o: {
-      src = fetchurl {
-        url = "mirror://gnome/sources/pygobject/3.52/pygobject-3.52.3.tar.gz";
-        hash = "sha256-AOQn0pHpV0Yqj61lmp+ci+d2/4Kot2vfQC8eruwIbYI=";
-      };
-    }))
+    pygobject3
     pyopenssl
   ];
 
diff --git a/pkgs/development/python-modules/omemo-dr/default.nix b/pkgs/development/python-modules/omemo-dr/default.nix
index 12acd1cbb7e7..7c33e56c1dd5 100644
--- a/pkgs/development/python-modules/omemo-dr/default.nix
+++ b/pkgs/development/python-modules/omemo-dr/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   cryptography,
-  fetchPypi,
+  fetchFromGitLab,
   protobuf,
   pytestCheckHook,
   setuptools,
@@ -10,12 +10,15 @@
 
 buildPythonPackage rec {
   pname = "omemo-dr";
-  version = "1.0.1";
+  version = "1.2.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-KoqMdyMdc5Sb3TdSeNTVomElK9ruUstiQayyUcIC02E=";
+  src = fetchFromGitLab {
+    domain = "dev.gajim.org";
+    owner = "gajim";
+    repo = "omemo-dr";
+    tag = "v${version}";
+    hash = "sha256-8+uBO7Nl6YcEwthWmChqCTLvUelF8QJl+dHzkqbPVqM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/onnxruntime/default.nix b/pkgs/development/python-modules/onnxruntime/default.nix
index 9685d85a72a3..ebd0e28cd243 100644
--- a/pkgs/development/python-modules/onnxruntime/default.nix
+++ b/pkgs/development/python-modules/onnxruntime/default.nix
@@ -38,6 +38,10 @@ buildPythonPackage {
     chmod +w dist
   '';
 
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  };
+
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   # This project requires fairly large dependencies such as sympy which we really don't always need.
diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index 031645894afc..b09352d3cf3b 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "17.4.0";
+  version = "18.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_db";
     inherit version;
-    hash = "sha256-FLYvWMQWMwy7GIpTKbFNlQF2Ye+K6h1yoP+STuz5EKk=";
+    hash = "sha256-lL/zJBrTie9YZsFpGd4AWuDlud8YFO65TUAnxXUnCSM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/parfive/default.nix b/pkgs/development/python-modules/parfive/default.nix
index 7c506fb134d7..5c2dbb3dab69 100644
--- a/pkgs/development/python-modules/parfive/default.nix
+++ b/pkgs/development/python-modules/parfive/default.nix
@@ -21,18 +21,22 @@
   tqdm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "parfive";
   version = "2.2.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Cadair";
     repo = "parfive";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DIjS2q/SOrnLspomLHk8ZJ+krdzMyQfbIpXxad30s1k=";
   };
 
-  pyproject = true;
+  patches = [
+    # SyntaxError: 'return' in a 'finally' block
+    ./fix-python-3-14-compat.patch
+  ];
 
   build-system = [ setuptools-scm ];
 
@@ -72,8 +76,8 @@ buildPythonPackage rec {
     description = "HTTP and FTP parallel file downloader";
     mainProgram = "parfive";
     homepage = "https://parfive.readthedocs.io/";
-    changelog = "https://github.com/Cadair/parfive/releases/tag/${src.tag}";
+    changelog = "https://github.com/Cadair/parfive/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/parfive/fix-python-3-14-compat.patch b/pkgs/development/python-modules/parfive/fix-python-3-14-compat.patch
new file mode 100644
index 000000000000..c4be169bf6dd
--- /dev/null
+++ b/pkgs/development/python-modules/parfive/fix-python-3-14-compat.patch
@@ -0,0 +1,14 @@
+diff --git a/parfive/downloader.py b/parfive/downloader.py
+index 7a4116b..370ea78 100644
+--- a/parfive/downloader.py
++++ b/parfive/downloader.py
+@@ -317,8 +317,7 @@ class Downloader:
+                     task.cancel()
+                 dl_results = await asyncio.gather(*tasks, return_exceptions=True)
+ 
+-            finally:
+-                return self._format_results(dl_results, main_pb)
++            return self._format_results(dl_results, main_pb)
+ 
+     def _format_results(self, retvals, main_pb):
+         # Squash all nested lists into a single flat list
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index 617091524324..00823daa9188 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.36.1";
+  version = "1.36.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     tag = "v${version}";
-    hash = "sha256-EXF4X+KM7AvwvxkU9KFUM4pc1q8IGLo8fpycdVmTnuY=";
+    hash = "sha256-/lXoubcwV/Lt/qg17BhMM6p+0XUgAe2pMtowobs3MA8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index 34c0484ee440..da505140c3e4 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -12,7 +12,6 @@
   pydantic,
   pytestCheckHook,
   trio,
-  y-py,
 
   nix-update-script,
 }:
@@ -50,7 +49,6 @@ buildPythonPackage rec {
     pydantic
     pytestCheckHook
     trio
-    y-py
   ];
 
   pytestFlags = [
diff --git a/pkgs/development/python-modules/pydantic-compat/default.nix b/pkgs/development/python-modules/pydantic-compat/default.nix
index db5ef91c20bb..79dbb49fe927 100644
--- a/pkgs/development/python-modules/pydantic-compat/default.nix
+++ b/pkgs/development/python-modules/pydantic-compat/default.nix
@@ -46,6 +46,7 @@ buildPythonPackage rec {
     # deprecated, and will be removed in Pydantic V3. Instead, you should access this attribute from
     # the model class. Deprecated in Pydantic V2.11 to be removed in V3.0.
     "-Wignore::pydantic.warnings.PydanticDeprecatedSince211"
+    "-Wignore::pydantic.warnings.PydanticDeprecatedSince212"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pyhik/default.nix b/pkgs/development/python-modules/pyhik/default.nix
index 5abab393de81..1b5944bb259a 100644
--- a/pkgs/development/python-modules/pyhik/default.nix
+++ b/pkgs/development/python-modules/pyhik/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyhik";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mezz64";
     repo = "pyHik";
     tag = version;
-    hash = "sha256-ayjpIsUX/PVNOTuOm/3pwLfnypEpMWQAJAf1JzFocu4=";
+    hash = "sha256-dDUaNeE0wjKsojeezKVWfMBPO+7O5e2QFOHnh3UoFbY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/readability-lxml/default.nix b/pkgs/development/python-modules/readability-lxml/default.nix
index 1d426588e4e1..e016767db614 100644
--- a/pkgs/development/python-modules/readability-lxml/default.nix
+++ b/pkgs/development/python-modules/readability-lxml/default.nix
@@ -1,8 +1,8 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  poetry-core,
   pytestCheckHook,
   chardet,
   cssselect,
@@ -13,37 +13,32 @@
 
 buildPythonPackage rec {
   pname = "readability-lxml";
-  version = "0.8.4";
-  format = "setuptools";
+  version = "0.8.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "buriy";
     repo = "python-readability";
-    rev = "v${version}";
-    hash = "sha256-6A4zpe3GvHHf235Ovr2RT/cJgj7bWasn96yqy73pVgY=";
+    rev = "${version}";
+    hash = "sha256-tL0OnvCrbrpBvcy+6RJ+u/BDdra+MnVT51DSAeYxJbc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [ "lxml" ];
+
+  dependencies = [
     chardet
     cssselect
     lxml
     lxml-html-clean
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py --replace 'sys.platform == "darwin"' "False"
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
     timeout-decorator
   ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Test is broken on darwin. Fix in master from https://github.com/buriy/python-readability/pull/178
-    "test_many_repeated_spaces"
-  ];
-
   meta = {
     description = "Fast python port of arc90's readability tool";
     homepage = "https://github.com/buriy/python-readability";
diff --git a/pkgs/development/python-modules/reflex/default.nix b/pkgs/development/python-modules/reflex/default.nix
index 49f29978690d..9ee405aa9985 100644
--- a/pkgs/development/python-modules/reflex/default.nix
+++ b/pkgs/development/python-modules/reflex/default.nix
@@ -49,14 +49,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "reflex";
-  version = "0.8.25";
+  version = "0.8.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "reflex-dev";
     repo = "reflex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pp4onogav+kad0JpBRPnar30elP1aYuhA9AMoSjjRss=";
+    hash = "sha256-pV7J+O7WaD7hzrjvqOFtrj8CKT+SX6KWHot/VxEMtZQ=";
   };
 
   # For some reason, pre_commit is supposedly missing when python>=3.14
diff --git a/pkgs/development/python-modules/rembg/default.nix b/pkgs/development/python-modules/rembg/default.nix
index 58652d3d6d0f..209a1df7c07f 100644
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -36,6 +37,9 @@
   withCli ? false,
 }:
 
+let
+  isNotAarch64Linux = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
+in
 buildPythonPackage (finalAttrs: {
   pname = "rembg";
   version = "2.0.72";
@@ -106,7 +110,12 @@ buildPythonPackage (finalAttrs: {
     "NUMBA_CACHE_DIR"
   ];
 
-  pythonImportsCheck = [ "rembg" ];
+  # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+  # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
+  #
+  # -> Skip all tests that require importing rembg
+  pythonImportsCheck = lib.optionals isNotAarch64Linux [ "rembg" ];
+  doCheck = isNotAarch64Linux;
 
   meta = {
     description = "Tool to remove background from images";
diff --git a/pkgs/development/python-modules/resvg-py/default.nix b/pkgs/development/python-modules/resvg-py/default.nix
new file mode 100644
index 000000000000..ce60f88d0455
--- /dev/null
+++ b/pkgs/development/python-modules/resvg-py/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  pytest,
+  pyperclip,
+  xvfb-run,
+  xclip,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "resvg-py";
+  version = "0.2.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "baseplate-admin";
+    repo = "resvg-py";
+    tag = finalAttrs.version;
+    hash = "sha256-lNNAIEEzwPEs/Qup6PXkMWezGHEAVs4VxuwBv5DgjWE=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-OrXWiMIgqZ2opl3XfC2zVwN9w0xz2u08mRA883tN6pM=";
+  };
+
+  build-system = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  nativeCheckInputs = [
+    pytest
+    pyperclip
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    xclip
+    xvfb-run
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${lib.optionalString stdenv.hostPlatform.isLinux "xvfb-run"} python -m pytest ${lib.optionalString stdenv.hostPlatform.isDarwin "-k \"not test_multiple_layer_svg\""}
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "resvg_py"
+  ];
+
+  meta = {
+    changelog = "https://github.com/baseplate-admin/resvg-py/releases/tag/${finalAttrs.src.tag}";
+    description = "High level wrapper of resvg for python";
+    homepage = "https://github.com/baseplate-admin/resvg-py";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/development/python-modules/rucio/default.nix b/pkgs/development/python-modules/rucio/default.nix
index becc4d8ac713..b82b661370a3 100644
--- a/pkgs/development/python-modules/rucio/default.nix
+++ b/pkgs/development/python-modules/rucio/default.nix
@@ -40,13 +40,13 @@
 }:
 
 let
-  version = "39.0.0";
+  version = "39.1.0";
 
   src = fetchFromGitHub {
     owner = "rucio";
     repo = "rucio";
     tag = version;
-    hash = "sha256-3KRcoS1VwjRynBgDIvCRu1dOIVF8mlAG7P17ROLE1ZY=";
+    hash = "sha256-ef8rVRDVkkEcsQ5AKz1W2L21abyY2dfHMWh2Rv0oxPA=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index 072e4f14ea03..2c2b74e3c47b 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "sabctools";
-  version = "9.3.0";
+  version = "9.3.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CE11hjSkZFSmeUh3V3U4y/z77wS/hBUHRo40Y19YnX4=";
+    hash = "sha256-oZMYxukDhEbE0ybCbGcD40PNy4ktBei4bk0rccb3B4k=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/spacy-loggers/default.nix b/pkgs/development/python-modules/spacy-loggers/default.nix
index b111a608cbcd..6d26d06df22f 100644
--- a/pkgs/development/python-modules/spacy-loggers/default.nix
+++ b/pkgs/development/python-modules/spacy-loggers/default.nix
@@ -1,35 +1,62 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   buildPythonPackage,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   wandb,
   wasabi,
+
+  # tests
+  pytestCheckHook,
+  spacy,
+  spacy-loggers,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spacy-loggers";
   version = "1.0.5";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-1gsL2/kVpg5RbMLmU7rv+Ubwz8RhtFLRGk1UWMb+XyQ=";
+  src = fetchFromGitHub {
+    owner = "explosion";
+    repo = "spacy-loggers";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Kl8FSs+sbIF2Ml5AJhP5aY7lWnDLqUr7QBAq+63SW5Q=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     wandb
     wasabi
   ];
 
   pythonImportsCheck = [ "spacy_loggers" ];
 
+  nativeCheckInputs = [
+    spacy
+    pytestCheckHook
+  ];
   # skipping the checks, because it requires a cycle dependency to spacy as well.
   doCheck = false;
 
+  passthru = {
+    tests.pytest = spacy-loggers.overridePythonAttrs {
+      doCheck = true;
+    };
+  };
+
   meta = {
     description = "Logging utilities for spaCy";
     homepage = "https://github.com/explosion/spacy-loggers";
+    changelog = "https://github.com/explosion/spacy-loggers/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ stunkymonkey ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 32c14b3dcc01..53e83a5e27e8 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -1,74 +1,80 @@
 {
   lib,
-  asdf,
-  asdf-astropy,
-  astropy,
-  beautifulsoup4,
   buildPythonPackage,
-  contourpy,
-  dask,
-  drms,
-  extension-helpers,
   fetchFromGitHub,
-  fsspec,
-  glymur,
-  h5netcdf,
-  h5py,
-  hypothesis,
-  lxml,
-  matplotlib,
+
+  # build-system
+  extension-helpers,
   numpy,
-  opencv-python,
-  packaging,
-  pandas,
-  parfive,
-  pyerfa,
-  pytest-astropy,
-  pytestCheckHook,
-  pytest-mock,
-  python-dateutil,
-  pythonOlder,
-  reproject,
-  requests,
-  scikit-image,
-  scipy,
   setuptools,
   setuptools-scm,
+
+  # dependencies
+  astropy,
+  fsspec,
+  packaging,
+  parfive,
+  pyerfa,
+  requests,
+
+  # optional-dependencies
+  # asdf
+  asdf,
+  asdf-astropy,
+  # dask
+  dask,
+  # image
+  scipy,
+  # jpeg
+  glymur,
+  lxml,
+  # jupyter
+  itables,
+  ipywidgets,
+  # map
+  contourpy,
+  matplotlib,
+  reproject,
+  # net
+  beautifulsoup4,
+  drms,
+  python-dateutil,
   tqdm,
-  writableTmpDirAsHomeHook,
   zeep,
+  # opencv
+  opencv-python,
+  # scikit-image
+  scikit-image,
+  # timeseries
+  h5netcdf,
+  h5py,
+  pandas,
+
+  # tests
+  hypothesis,
+  pytest-astropy,
+  pytest-mock,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "sunpy";
-  version = "7.0.2";
+  version = "7.1.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "sunpy";
     repo = "sunpy";
-    tag = "v${version}";
-    hash = "sha256-1LT6Dr9OZYIZkOICSYD8lt5v3Gn1gZGN4GWeJL6IH5w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FeKmg3dZfbbjt1lDliF4uXf8PvM3J5HWtYqKRriJ4l0=";
   };
 
-  # As of 2025-10-15, this requires numpy >=1.25.0,<2.3.
-  # (The >=1.25.0 constraint is in dependencies, the <2.3 in build-system)
-  # We can't use 1.x because it's not supported on Python 3.13+.
-  # And since numpy 2.x is at 2.3.2, it's not supported.
-  # However, the upper bound is "for matching the numpy deprecation policy",
-  # so relaxing it should be OK. (It silently was overridden previously,
-  # due to the use of `format = "setuptools"` instead of `pyproject = true`)
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace-fail "numpy>=2.0.0rc1,<2.3" "numpy"
-  '';
-
   build-system = [
     extension-helpers
+    numpy
     setuptools
     setuptools-scm # Technically needs setuptools-scm[toml], but that's our default.
-    numpy
   ];
 
   dependencies = [
@@ -82,7 +88,7 @@ buildPythonPackage rec {
   ]
   ++ parfive.optional-dependencies.ftp;
 
-  optional-dependencies = {
+  optional-dependencies = lib.fix (self: {
     asdf = [
       asdf
       asdf-astropy
@@ -93,6 +99,10 @@ buildPythonPackage rec {
       glymur
       lxml
     ];
+    jupyter = [
+      itables
+      ipywidgets
+    ];
     map = [
       contourpy
       matplotlib
@@ -125,30 +135,30 @@ buildPythonPackage rec {
     # We can't use `with` here because "map" would still be the builtin, and
     # we can't below because scikit-image would still be this package's argument.
     core = lib.concatLists [
-      optional-dependencies.image
-      optional-dependencies.map
-      optional-dependencies.net
-      optional-dependencies.timeseries
-      optional-dependencies.visualization
+      self.image
+      self.map
+      self.net
+      self.timeseries
+      self.visualization
     ];
     all = lib.concatLists [
-      optional-dependencies.core
-      optional-dependencies.asdf
-      optional-dependencies.jpeg2000
-      optional-dependencies.opencv
+      self.core
+      self.asdf
+      self.jpeg2000
+      self.opencv
       # optional-dependencies.spice
-      optional-dependencies.scikit-image
+      self.scikit-image
     ];
-  };
+  });
 
   nativeCheckInputs = [
     hypothesis
     pytest-astropy
-    pytestCheckHook
     pytest-mock
+    pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ optional-dependencies.all;
+  ++ finalAttrs.passthru.optional-dependencies.all;
 
   disabledTests = [
     "rst" # Docs
@@ -156,6 +166,7 @@ buildPythonPackage rec {
     "test_find_dependencies" # Needs cdflib
     # Needs mpl-animators
     "sunpy.coordinates.utils.GreatArc"
+    "test_cutout_not_on_disk_when_tracking"
     "test_expand_list_generator_map"
     "test_great_arc_different_observer"
     "test_great_arc_points_differentiates"
@@ -196,14 +207,14 @@ buildPythonPackage rec {
     "sunpy/coordinates/tests/test_spice.py"
   ];
 
-  pytestFlags = [ "-Wignore::DeprecationWarning" ];
-
   pythonImportsCheck = [ "sunpy" ];
 
   meta = {
     description = "Python for Solar Physics";
     homepage = "https://sunpy.org";
+    downloadPage = "github.com/sunpy/sunpy";
+    changelog = "https://docs.sunpy.org/en/stable/whatsnew/changelog.html";
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index f74d9e159970..0466f6b68e00 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -19,9 +19,10 @@
   parameterized,
   pytest-xdist,
   pytestCheckHook,
+  pythonAtLeast,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "torchdata";
   version = "0.11.0";
   pyproject = true;
@@ -29,7 +30,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "data";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-TSkZLL4WDSacuX4tl0+1bKSJCRI3LEhAyU3ztdlUvgk=";
   };
 
@@ -55,16 +56,24 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-    # RuntimeError: DataLoader timed out after 5 seconds
-    "test_ind_worker_queue"
-  ];
+  disabledTests =
+    lib.optionals (pythonAtLeast "3.14") [
+      # _pickle.PicklingError: Can't pickle local object <...worker_set_affinity at 0x7ffbcfa1ba00>
+      "test_set_affinity_in_worker_init"
+
+      # RuntimeError: DataLoader timed out after 5 seconds
+      "test_ind_worker_queue"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # RuntimeError: DataLoader timed out after 5 seconds
+      "test_ind_worker_queue"
+    ];
 
   meta = {
     description = "Iterative enhancement to the PyTorch torch.utils.data.DataLoader and torch.utils.data.Dataset/IterableDataset";
     homepage = "https://github.com/meta-pytorch/data";
-    changelog = "https://github.com/meta-pytorch/data/releases/tag/${src.tag}";
+    changelog = "https://github.com/meta-pytorch/data/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index 1fac454501f0..ce757924e984 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -35,7 +35,7 @@
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "torchtune";
   version = "0.6.1";
   pyproject = true;
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "torchtune";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-evhQBpZiUXriL0PAYkEzGypH21iRs37Ix6Nl5YAyeQ0=";
   };
 
@@ -134,11 +134,11 @@ buildPythonPackage rec {
   meta = {
     description = "PyTorch native post-training library";
     homepage = "https://github.com/meta-pytorch/torchtune";
-    changelog = "https://github.com/meta-pytorch/torchtune/releases/tag/${src.tag}";
+    changelog = "https://github.com/meta-pytorch/torchtune/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       GaetanLepage
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/translate-toolkit/default.nix b/pkgs/development/python-modules/translate-toolkit/default.nix
index 61aef0c3ec6d..031f52ab1385 100644
--- a/pkgs/development/python-modules/translate-toolkit/default.nix
+++ b/pkgs/development/python-modules/translate-toolkit/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "translate-toolkit";
-  version = "3.18.0";
+  version = "3.18.1";
 
   pyproject = true;
 
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "translate";
     repo = "translate";
     tag = version;
-    hash = "sha256-wc8bSXdFHVSzm4CWZ9b27zEYNH0rbEXf0i947VNTg/8=";
+    hash = "sha256-T7Zo2/jx9P+Tz8jwRKRCV1lVv7XIaIoQTIjIVdEj/ZQ=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index ef8136422c3e..a26c671f8831 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -371,13 +371,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "types-aiobotocore";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit (finalAttrs) version;
-    hash = "sha256-nDbZ0pBEtCRleQD6mejAWPc9WnVek9IeS76w7qjxk5I=";
+    hash = "sha256-eXRYXhlJOdoscKe2KPbtsiZCdpqE5PbBqlMij/O4rnE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index e7b2ef517b11..56aa5a429995 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -2,10 +2,12 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  pythonAtLeast,
 
   ## wandb-core
-  buildGo125Module,
+  buildGoModule,
   gitMinimal,
+  writableTmpDirAsHomeHook,
   versionCheckHook,
 
   ## gpu-stats
@@ -20,11 +22,9 @@
 
   # dependencies
   click,
-  docker-pycreds,
   gitpython,
   platformdirs,
   protobuf,
-  psutil,
   pydantic,
   pyyaml,
   requests,
@@ -72,16 +72,15 @@
   torch,
   torchvision,
   tqdm,
-  writableTmpDirAsHomeHook,
 }:
 
 let
-  version = "0.21.4";
+  version = "0.24.0";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-1l68nU/rmYg/Npg1EVraGr2tu/lkNAo9M7Q0IyckEoc=";
+    hash = "sha256-dICa/sIFEHI59gJxrvWyI9Uc3rbwXi+Xh60O/hElZh0=";
   };
 
   gpu-stats = rustPlatform.buildRustPackage {
@@ -108,7 +107,7 @@ let
     };
   };
 
-  wandb-core = buildGo125Module rec {
+  wandb-core = buildGoModule rec {
     pname = "wandb-core";
     inherit src version;
 
@@ -126,6 +125,7 @@ let
 
     nativeBuildInputs = [
       gitMinimal
+      writableTmpDirAsHomeHook
     ];
 
     nativeInstallCheckInputs = [
@@ -151,7 +151,7 @@ let
   };
 in
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wandb";
   pyproject = true;
 
@@ -193,11 +193,9 @@ buildPythonPackage rec {
 
   dependencies = [
     click
-    docker-pycreds
     gitpython
     platformdirs
     protobuf
-    psutil
     pydantic
     pyyaml
     requests
@@ -382,16 +380,19 @@ buildPythonPackage rec {
 
     # Breaks in sandbox: "Timed out waiting for wandb service to start"
     "test_setup_offline"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # AttributeError: '...' object has no attribute '__annotations__'
+    "test_watch_graph_torch_jit"
+    "test_watch_parameters_torch_jit"
   ];
 
-  pythonImportsCheck = [ "wandb" ];
-
   meta = {
     description = "CLI and library for interacting with the Weights and Biases API";
     homepage = "https://github.com/wandb/wandb";
-    changelog = "https://github.com/wandb/wandb/raw/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/wandb/wandb/raw/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ samuela ];
     broken = gpu-stats.meta.broken || wandb-core.meta.broken;
   };
-}
+})
diff --git a/pkgs/development/python-modules/y-py/default.nix b/pkgs/development/python-modules/y-py/default.nix
deleted file mode 100644
index 872ec058b9cf..000000000000
--- a/pkgs/development/python-modules/y-py/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchPypi,
-  rustPlatform,
-  cargo,
-  rustc,
-  libiconv,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "y-py";
-  version = "0.6.2";
-  pyproject = true;
-
-  src = fetchPypi {
-    pname = "y_py";
-    inherit version;
-    hash = "sha256-R1eoKlBAags6MzqgEiAZozG9bxbkn+1n3KQj+Siz/U0=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-Wh25tLOVhAYFLqjOrKSu4klB1hGSOMconC1xZG31Dbw=";
-  };
-
-  nativeBuildInputs = [
-    rustPlatform.cargoSetupHook
-    rustPlatform.maturinBuildHook
-    cargo
-    rustc
-  ];
-
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
-
-  pythonImportsCheck = [ "y_py" ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  meta = {
-    description = "Python bindings for Y-CRDT";
-    homepage = "https://github.com/y-crdt/ypy";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/development/python-modules/ypy-websocket/default.nix b/pkgs/development/python-modules/ypy-websocket/default.nix
deleted file mode 100644
index 13cf2bbe3d17..000000000000
--- a/pkgs/development/python-modules/ypy-websocket/default.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  hatchling,
-
-  # dependencies
-  aiosqlite,
-  anyio,
-  y-py,
-
-  # testing
-  pytest-asyncio,
-  pytestCheckHook,
-  uvicorn,
-  websockets,
-}:
-
-buildPythonPackage rec {
-  pname = "ypy-websocket";
-  version = "0.12.4";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "y-crdt";
-    repo = "ypy-websocket";
-    tag = "v${version}";
-    hash = "sha256-48x+MUhev9dErC003XOP3oGKd5uOghlBFgcR8Nm/0xs=";
-  };
-
-  build-system = [ hatchling ];
-
-  pythonRelaxDeps = [ "aiofiles" ];
-
-  dependencies = [
-    aiosqlite
-    anyio
-    y-py
-  ];
-
-  pythonImportsCheck = [ "ypy_websocket" ];
-
-  __darwinAllowLocalNetworking = true;
-
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-    uvicorn
-    websockets
-  ];
-
-  disabledTestPaths = [
-    # requires installing yjs Node.js module
-    "tests/test_ypy_yjs.py"
-    # Depends on no longer maintained ypy
-    "tests/test_asgi.py"
-  ];
-
-  meta = {
-    changelog = "https://github.com/y-crdt/ypy-websocket/blob/${src.rev}/CHANGELOG.md";
-    description = "WebSocket Connector for Ypy";
-    homepage = "https://github.com/y-crdt/ypy-websocket";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
index f2897b10053a..e62f8cf5d07e 100644
--- a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "jmcollin78";
   domain = "versatile_thermostat";
-  version = "8.5.1";
+  version = "8.6.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     tag = version;
-    hash = "sha256-zSpeiSK8FyXlM1U8jjSVl1nLQX/IplvKHfS6XZUNxo4=";
+    hash = "sha256-rzNznV2YfBUxgYdc+qZeDIBVeMfwPwvDyYVON980SCg=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
index b443e16cc6fa..8b6814a737fb 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-exploretraces-app";
-  version = "1.2.2";
-  zipHash = "sha256-vQSnjSPiYvgwpbO7VvmG77DfP85+R6fRoGGpr+xslTc=";
+  version = "1.3.0";
+  zipHash = "sha256-7dSaO+m67oQ3WlL+SC+IsuzFeZ2GtSBJORggd4YENxU=";
   meta = {
     description = "Opinionated traces app";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 62aa85f9b7aa..cdfeb34a2411 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -5,10 +5,8 @@ stdenv:
 let
   # Lib attributes are inherited to the lexical scope for performance reasons.
   inherit (lib)
-    any
     assertMsg
     attrNames
-    boolToString
     concatLists
     concatMap
     concatMapStrings
@@ -17,7 +15,6 @@ let
     elemAt
     extendDerivation
     filter
-    findFirst
     getDev
     head
     imap1
@@ -199,10 +196,8 @@ let
 
   inherit (hostPlatform)
     isLinux
-    isDarwin
     isWindows
     isCygwin
-    isOpenBSD
     isStatic
     isMusl
     ;
diff --git a/pkgs/tools/security/bitwarden-directory-connector/default.nix b/pkgs/tools/security/bitwarden-directory-connector/default.nix
index e08725cc3718..e0e33ff96a39 100644
--- a/pkgs/tools/security/bitwarden-directory-connector/default.nix
+++ b/pkgs/tools/security/bitwarden-directory-connector/default.nix
@@ -19,14 +19,14 @@ let
     }:
     buildNpmPackage rec {
       pname = name;
-      version = "2025.12.0";
+      version = "2026.1.0";
       nodejs = nodejs_22;
 
       src = fetchFromGitHub {
         owner = "bitwarden";
         repo = "directory-connector";
         rev = "v${version}";
-        hash = "sha256-kf4ky/dsZJJiShVJ2uYp1DsH5BP/RAeEnbjUQxjoxkk=";
+        hash = "sha256-UC4m+jUKYD6NYQ62l18+UCZYONFQyUgyqbonNj4iGjg=";
       };
 
       postPatch = ''
@@ -38,7 +38,7 @@ let
           --replace-fail "AppImage" "dir"
       '';
 
-      npmDepsHash = "sha256-j90y6R3MCcUmEuoI3clNz5WqVyTNH5x6xyg3Je+krL0=";
+      npmDepsHash = "sha256-4tqcrJuMSxqqVmB8K32vts6LbAWFCPMw7+hvmblV/m4=";
 
       env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index e9693fd06ac5..d5e53541d06f 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -81,6 +81,7 @@ python3.pkgs.buildPythonApplication rec {
     maintainers = with lib.maintainers; [
       johnazoidberg
       erdnaxe
+      staslyakhov
     ];
     platforms = if withDriver then [ "x86_64-linux" ] else with lib.platforms; linux ++ darwin;
     # https://github.com/chipsec/chipsec/issues/1793
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ba71c0a1d2a5..a593630b0f1b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -756,6 +756,9 @@ mapAliases {
   godot_4_3-export-templates = throw "'godot_4_3-export-templates' has been renamed to/replaced by 'godot_4_3-export-templates-bin'"; # Converted to throw 2025-10-27
   godot_4_4-export-templates = throw "'godot_4_4-export-templates' has been renamed to/replaced by 'godot_4_4-export-templates-bin'"; # Converted to throw 2025-10-27
   goldwarden = throw "'goldwarden' has been removed, as it no longer works with new Bitwarden versions and is abandoned upstream"; # Added 2025-09-16
+  goocanvas2 = warnAlias "'goocanvas2' has been renamed to goocanvas_2" goocanvas_2; # Added 2026-01-17
+  goocanvas3 = warnAlias "'goocanvas3' has been renamed to goocanvas_3" goocanvas_3; # Added 2026-01-17
+  goocanvas = warnAlias "'goocanvas' has been renamed to goocanvas_1" goocanvas_1; # Added 2026-01-17
   gphotos-sync = throw "'gphotos-sync' has been removed, as it was archived upstream due to API changes that ceased its functions"; # Added 2025-11-06
   gprbuild-boot = throw "'gprbuild-boot' has been renamed to/replaced by 'gnatPackages.gprbuild-boot'"; # Converted to throw 2025-10-27
   gpxsee-qt5 = throw "gpxsee-qt5 was removed, use gpxsee instead"; # Added 2025-09-09
@@ -1579,6 +1582,13 @@ mapAliases {
   source-han-serif-korean = throw "'source-han-serif-korean' has been renamed to/replaced by 'source-han-serif'"; # Converted to throw 2025-10-27
   source-han-serif-simplified-chinese = throw "'source-han-serif-simplified-chinese' has been renamed to/replaced by 'source-han-serif'"; # Converted to throw 2025-10-27
   source-han-serif-traditional-chinese = throw "'source-han-serif-traditional-chinese' has been renamed to/replaced by 'source-han-serif'"; # Converted to throw 2025-10-27
+  sourceHanPackages.mono = warnAlias "'sourceHanPackages.mono' has been renamed to ''source-han-mono" source-han-mono; # Added 2025-11-03
+  sourceHanPackages.sans = warnAlias "'sourceHanPackages.sans' has been renamed to ''source-han-sans" source-han-sans; # Added 2025-11-03
+  sourceHanPackages.sans-vf-otf = warnAlias "'sourceHanPackages.sans-vf-otf' has been renamed to ''source-han-sans-vf-otf" source-han-sans-vf-otf; # Added 2025-11-03
+  sourceHanPackages.sans-vf-ttf = warnAlias "'sourceHanPackages.sans-vf-ttf' has been renamed to ''source-han-sans-vf-ttf" source-han-sans-vf-ttf; # Added 2025-11-03
+  sourceHanPackages.serif = warnAlias "'sourceHanPackages.serif' has been renamed to ''source-han-serif" source-han-serif; # Added 2025-11-03
+  sourceHanPackages.serif-vf-otf = warnAlias "'sourceHanPackages.serif-vf-otf' has been renamed to ''source-han-serif-vf-otf" source-han-serif-vf-otf; # Added 2025-11-03
+  sourceHanPackages.serif-vf-ttf = warnAlias "'sourceHanPackages.serif-vf-ttf' has been renamed to ''source-han-serif-vf-ttf" source-han-serif-vf-ttf; # Added 2025-11-03
   sourceHanSansPackages.japanese = throw "'sourceHanSansPackages.japanese' has been renamed to/replaced by 'source-han-sans'"; # Converted to throw 2025-10-27
   sourceHanSansPackages.korean = throw "'sourceHanSansPackages.korean' has been renamed to/replaced by 'source-han-sans'"; # Converted to throw 2025-10-27
   sourceHanSansPackages.simplified-chinese = throw "'sourceHanSansPackages.simplified-chinese' has been renamed to/replaced by 'source-han-sans'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1d8ebe1e1cdd..107423dc9d20 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2756,18 +2756,8 @@ with pkgs;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
 
-  gssdp = callPackage ../development/libraries/gssdp { };
-
-  gssdp_1_6 = callPackage ../development/libraries/gssdp/1.6.nix { };
-
-  gssdp-tools = callPackage ../development/libraries/gssdp/tools.nix { };
-
   gup = callPackage ../development/tools/build-managers/gup { };
 
-  gupnp = callPackage ../development/libraries/gupnp { };
-
-  gupnp_1_6 = callPackage ../development/libraries/gupnp/1.6.nix { };
-
   gvm-tools = with python3.pkgs; toPythonApplication gvm-tools;
 
   gzip = callPackage ../tools/compression/gzip { };
@@ -2960,10 +2950,6 @@ with pkgs;
 
   ksmoothdock = libsForQt5.callPackage ../applications/misc/ksmoothdock { };
 
-  libcryptui = callPackage ../development/libraries/libcryptui {
-    gtk3 = if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3;
-  };
-
   limine-full = limine.override { enableAll = true; };
 
   liquidsoap = callPackage ../tools/audio/liquidsoap/full.nix {
@@ -3092,11 +3078,6 @@ with pkgs;
     ;
   lerna = lerna_8;
 
-  libhandy = callPackage ../development/libraries/libhandy { };
-
-  # Needed for apps that still depend on the unstable version of the library (not libhandy-1)
-  libhandy_0 = callPackage ../development/libraries/libhandy/0.x.nix { };
-
   libint = callPackage ../development/libraries/libint { };
   libintPsi4 = callPackage ../development/libraries/libint {
     enableFortran = false;
@@ -5943,21 +5924,6 @@ with pkgs;
 
   black-macchiato = with python3Packages; toPythonApplication black-macchiato;
 
-  build2 = callPackage ../development/tools/build-managers/build2 {
-    # Break cycle by using self-contained toolchain for bootstrapping
-    build2 = buildPackages.callPackage ../development/tools/build-managers/build2/bootstrap.nix { };
-  };
-
-  # Dependency of build2, must also break cycle for this
-  libbutl = callPackage ../development/libraries/libbutl {
-    build2 = build2.bootstrap;
-    inherit (darwin) DarwinTools;
-  };
-
-  bdep = callPackage ../development/tools/build-managers/build2/bdep.nix { };
-
-  bpkg = callPackage ../development/tools/build-managers/build2/bpkg.nix { };
-
   buildkite-test-collector-rust =
     callPackage ../development/tools/continuous-integration/buildkite-test-collector-rust
       {
@@ -6956,10 +6922,6 @@ with pkgs;
     nixStoreDir = config.nix.storeDir or builtins.storeDir;
   };
 
-  goocanvas = callPackage ../development/libraries/goocanvas { };
-  goocanvas2 = callPackage ../development/libraries/goocanvas/2.x.nix { };
-  goocanvas3 = callPackage ../development/libraries/goocanvas/3.x.nix { };
-
   gst_all_1 = recurseIntoAttrs (callPackage ../development/libraries/gstreamer { });
 
   grantlee = libsForQt5.callPackage ../development/libraries/grantlee { };
@@ -6988,8 +6950,6 @@ with pkgs;
 
   pangomm_2_42 = callPackage ../development/libraries/pangomm/2.42.nix { };
 
-  gtk2 = callPackage ../development/libraries/gtk/2.x.nix { };
-
   gtk2-x11 = gtk2.override {
     cairo = cairo.override { x11Support = true; };
     pango = pango.override {
@@ -6999,10 +6959,6 @@ with pkgs;
     gdktarget = "x11";
   };
 
-  gtk3 = callPackage ../development/libraries/gtk/3.x.nix { };
-
-  gtk4 = callPackage ../development/libraries/gtk/4.x.nix { };
-
   # On darwin gtk uses cocoa by default instead of x11.
   gtk3-x11 = gtk3.override {
     cairo = cairo.override { x11Support = true; };
@@ -7013,14 +6969,6 @@ with pkgs;
     x11Support = true;
   };
 
-  gtkmm2 = callPackage ../development/libraries/gtkmm/2.x.nix { };
-  gtkmm3 = callPackage ../development/libraries/gtkmm/3.x.nix { };
-  gtkmm4 = callPackage ../development/libraries/gtkmm/4.x.nix { };
-
-  gtk-sharp-2_0 = callPackage ../development/libraries/gtk-sharp/2.0.nix { };
-
-  gtk-sharp-3_0 = callPackage ../development/libraries/gtk-sharp/3.0.nix { };
-
   gtk-mac-integration-gtk2 = gtk-mac-integration.override {
     gtk = gtk2;
   };
@@ -7035,21 +6983,9 @@ with pkgs;
 
   gtksourceview5 = callPackage ../development/libraries/gtksourceview/5.x.nix { };
 
-  gtksourceviewmm = callPackage ../development/libraries/gtksourceviewmm { };
-
-  gtksourceviewmm4 = callPackage ../development/libraries/gtksourceviewmm/4.x.nix { };
-
-  gtkspell2 = callPackage ../development/libraries/gtkspell { };
-
-  gtkspell3 = callPackage ../development/libraries/gtkspell/3.nix { };
-
   gwenhywfar = callPackage ../development/libraries/aqbanking/gwenhywfar.nix { };
 
   hamlib = hamlib_3;
-  hamlib_3 = callPackage ../development/libraries/hamlib { };
-  hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };
-
-  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix { };
 
   harfbuzzFull = harfbuzz.override {
     withGraphite2 = true;
@@ -7060,8 +6996,6 @@ with pkgs;
 
   highfive-mpi = highfive.override { hdf5 = hdf5-mpi; };
 
-  hspell = callPackage ../development/libraries/hspell { };
-
   hspellDicts = callPackage ../development/libraries/hspell/dicts.nix { };
 
   hunspellDicts = recurseIntoAttrs (callPackages ../by-name/hu/hunspell/dictionaries.nix { });
@@ -7116,13 +7050,6 @@ with pkgs;
     libXinerama = xorg.libXinerama;
   };
 
-  indicator-application-gtk2 =
-    callPackage ../development/libraries/indicator-application/gtk2.nix
-      { };
-  indicator-application-gtk3 =
-    callPackage ../development/libraries/indicator-application/gtk3.nix
-      { };
-
   indilib = callPackage ../development/libraries/science/astronomy/indilib { };
   indi-3rdparty = recurseIntoAttrs (
     callPackages ../development/libraries/science/astronomy/indilib/indi-3rdparty.nix { }
@@ -7158,24 +7085,10 @@ with pkgs;
 
   itk = itk_5;
 
-  jemalloc = callPackage ../development/libraries/jemalloc { };
-
-  rust-jemalloc-sys = callPackage ../development/libraries/jemalloc/rust.nix { };
   rust-jemalloc-sys-unprefixed = rust-jemalloc-sys.override { unprefixed = true; };
 
   json2yaml = haskell.lib.compose.justStaticExecutables haskellPackages.json2yaml;
 
-  keybinder = callPackage ../development/libraries/keybinder {
-    lua = lua5_1;
-  };
-
-  keybinder3 = callPackage ../development/libraries/keybinder3 {
-    gtk3 = if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3;
-  };
-
-  krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
-    inherit (buildPackages.darwin) bootstrap_cmds;
-  };
   libkrb5 = krb5; # TODO(de11n) Try to make krb5 reuse libkrb5 as a dependency
 
   l-smash = callPackage ../development/libraries/l-smash {
@@ -7184,27 +7097,10 @@ with pkgs;
 
   lcms = lcms2;
 
-  libagar = callPackage ../development/libraries/libagar { };
-  libagar_test = callPackage ../development/libraries/libagar/libagar_test.nix { };
-
-  libao = callPackage ../development/libraries/libao {
-    usePulseAudio = config.pulseaudio or (lib.meta.availableOn stdenv.hostPlatform libpulseaudio);
-  };
-
   libappindicator-gtk2 = libappindicator.override { gtkVersion = "2"; };
   libappindicator-gtk3 = libappindicator.override { gtkVersion = "3"; };
   libasn1c = callPackage ../servers/osmocom/libasn1c/default.nix { };
 
-  libbap = callPackage ../development/libraries/libbap {
-    inherit (ocaml-ng.ocamlPackages_4_14)
-      bap
-      ocaml
-      findlib
-      ctypes
-      ctypes-foreign
-      ;
-  };
-
   libbass = (callPackage ../development/libraries/audio/libbass { }).bass;
   libbass_fx = (callPackage ../development/libraries/audio/libbass { }).bass_fx;
   libbassmidi = (callPackage ../development/libraries/audio/libbass { }).bassmidi;
@@ -7225,24 +7121,10 @@ with pkgs;
     else
       pkgs.libcanberra-gtk2;
 
-  libcec = callPackage ../development/libraries/libcec { };
-
-  libcec_platform = callPackage ../development/libraries/libcec/platform.nix { };
-
-  libcdr = callPackage ../development/libraries/libcdr { lcms = lcms2; };
-
   libchamplain_libsoup3 = libchamplain.override { withLibsoup3 = true; };
 
   libchipcard = callPackage ../development/libraries/aqbanking/libchipcard.nix { };
 
-  libcxxrt = callPackage ../development/libraries/libcxxrt {
-    stdenv =
-      if stdenv.hostPlatform.useLLVM or false then
-        overrideCC stdenv buildPackages.llvmPackages.tools.clangNoLibcxx
-      else
-        stdenv;
-  };
-
   libdbiDriversBase = libdbiDrivers.override {
     libmysqlclient = null;
     sqlite = null;
@@ -7251,42 +7133,19 @@ with pkgs;
   libdbusmenu-gtk2 = libdbusmenu.override { gtkVersion = "2"; };
   libdbusmenu-gtk3 = libdbusmenu.override { gtkVersion = "3"; };
 
-  libdvdnav = callPackage ../development/libraries/libdvdnav { };
-  libdvdnav_4_2_1 = callPackage ../development/libraries/libdvdnav/4.2.1.nix {
-    libdvdread = libdvdread_4_9_9;
-  };
-
-  libdvdread = callPackage ../development/libraries/libdvdread { };
-  libdvdread_4_9_9 = callPackage ../development/libraries/libdvdread/4.9.9.nix { };
-
   dwarfdump = libdwarf.bin;
 
   libfm-extra = libfm.override {
     extraOnly = true;
   };
 
-  libgda5 = callPackage ../development/libraries/libgda/5.x.nix { };
-
-  libgda6 = callPackage ../development/libraries/libgda/6.x.nix { };
-
-  libgnome-games-support = callPackage ../development/libraries/libgnome-games-support { };
-  libgnome-games-support_2_0 =
-    callPackage ../development/libraries/libgnome-games-support/2.0.nix
-      { };
-
-  libextractor = callPackage ../development/libraries/libextractor {
-    libmpeg2 = mpeg2dec;
-  };
-
   libfive = libsForQt5.callPackage ../development/libraries/libfive { };
 
   # Use Apple’s fork of libffi by default, which provides APIs and trampoline functionality that is not yet
   # merged upstream. This is needed by some packages (such as cffi).
   #
   # `libffiReal` is provided in case the upstream libffi package is needed on Darwin instead of the fork.
-  libffiReal = callPackage ../development/libraries/libffi { };
   libffi = if stdenv.hostPlatform.isDarwin then darwin.libffi else libffiReal;
-  libffi_3_3 = callPackage ../development/libraries/libffi/3.3.nix { };
 
   # https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=README;h=fd6e1a83f55696c1f7a08f6dfca08b2d6b7617ec;hb=70058cd9f944d620764e57c838209afae8a58c78#l118
   libgpg-error-gen-posix-lock-obj = libgpg-error.override {
@@ -10029,14 +9888,15 @@ with pkgs;
     pretendard-std
     ;
 
-  sourceHanPackages = dontRecurseIntoAttrs (callPackage ../data/fonts/source-han { });
-  source-han-sans = sourceHanPackages.sans;
-  source-han-serif = sourceHanPackages.serif;
-  source-han-mono = sourceHanPackages.mono;
-  source-han-sans-vf-otf = sourceHanPackages.sans-vf-otf;
-  source-han-sans-vf-ttf = sourceHanPackages.sans-vf-ttf;
-  source-han-serif-vf-otf = sourceHanPackages.serif-vf-otf;
-  source-han-serif-vf-ttf = sourceHanPackages.serif-vf-ttf;
+  inherit (callPackage ../data/fonts/source-han { })
+    source-han-sans
+    source-han-serif
+    source-han-mono
+    source-han-sans-vf-otf
+    source-han-sans-vf-ttf
+    source-han-serif-vf-otf
+    source-han-serif-vf-ttf
+    ;
 
   themes = name: callPackage (../data/misc/themes + ("/" + name + ".nix")) { };
 
@@ -10190,10 +10050,6 @@ with pkgs;
 
   chromium = callPackage ../applications/networking/browsers/chromium (config.chromium or { });
 
-  chuck = callPackage ../applications/audio/chuck {
-    inherit (darwin) DarwinTools;
-  };
-
   clipgrab = libsForQt5.callPackage ../applications/video/clipgrab { };
 
   cni = callPackage ../applications/networking/cluster/cni { };
diff --git a/pkgs/top-level/packages-config.nix b/pkgs/top-level/packages-config.nix
index afa74ac4eec1..f35ec01ceb09 100644
--- a/pkgs/top-level/packages-config.nix
+++ b/pkgs/top-level/packages-config.nix
@@ -13,7 +13,6 @@
     lib.mapAttrs (_: set: lib.recurseIntoAttrs set) {
       inherit (super)
         rPackages
-        sourceHanPackages
         ;
 
       # emacsPackages is an alias for emacs.pkgs
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 112db2c2d0be..0110bcdeb1b1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14975,7 +14975,7 @@ with self;
       hash = "sha256-DFiMUH7tXmLRLtHMHkkcb/Oh9ZxPs9Q14UIUs3qzklE=";
     };
     propagatedBuildInputs = [
-      pkgs.goocanvas
+      pkgs.goocanvas_1
       pkgs.gtk2
       Gtk2
     ];
@@ -14998,7 +14998,7 @@ with self;
     };
     buildInputs = [ pkgs.gtk3 ];
     propagatedBuildInputs = [
-      pkgs.goocanvas2
+      pkgs.goocanvas_2
       Gtk3
     ];
     meta = {
@@ -15018,7 +15018,7 @@ with self;
       hash = "sha256-uoBnNuvMnePYFBp2Omgr3quxy4cCveKZrf1XSs6HUFI=";
     };
     propagatedBuildInputs = [
-      pkgs.goocanvas2
+      pkgs.goocanvas_2
       Gtk3
     ];
     meta = {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 756c28ec3492..76cc374d42c7 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -537,7 +537,9 @@ mapAliases {
   xapp = throw "'xapp' has been renamed to/replaced by 'python-xapp'"; # Converted to throw 2025-10-29
   xbox-webapi = throw "xbox-webapi was removed because Home Assistant switched to python-xbox"; # added 2025-12-03
   XlsxWriter = throw "'XlsxWriter' has been renamed to/replaced by 'xlsxwriter'"; # Converted to throw 2025-10-29
+  y-py = throw "'y-py' has been removed as it was archived upstream; consider using 'pycrdt' instead"; # Added 2026-01-21
   Yapsy = throw "'Yapsy' has been renamed to/replaced by 'yapsy'"; # Converted to throw 2025-10-29
+  ypy-websocket = throw "'ypy-websocket' has been removed as it was archived upstream; consider using 'pycrdt-websocket' instead"; # Added 2026-01-21
   z3 = throw "'z3' has been renamed to/replaced by 'z3-solver'"; # Converted to throw 2025-10-29
   zc-buildout221 = throw "'zc-buildout221' has been renamed to/replaced by 'zc-buildout'"; # Converted to throw 2025-10-29
   zc_lockfile = throw "'zc_lockfile' has been renamed to/replaced by 'zc-lockfile'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 631ba7545e53..99529a517c59 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16468,6 +16468,8 @@ self: super: with self; {
 
   result = callPackage ../development/python-modules/result { };
 
+  resvg-py = callPackage ../development/python-modules/resvg-py { };
+
   rethinkdb = callPackage ../development/python-modules/rethinkdb { };
 
   retinaface = callPackage ../development/python-modules/retinaface { };
@@ -20956,8 +20958,6 @@ self: super: with self; {
 
   xyzservices = callPackage ../development/python-modules/xyzservices { };
 
-  y-py = callPackage ../development/python-modules/y-py { };
-
   yabadaba = callPackage ../development/python-modules/yabadaba { };
 
   yacs = callPackage ../development/python-modules/yacs { };
@@ -21056,8 +21056,6 @@ self: super: with self; {
 
   yoyo-migrations = callPackage ../development/python-modules/yoyo-migrations { };
 
-  ypy-websocket = callPackage ../development/python-modules/ypy-websocket { };
-
   yq = callPackage ../development/python-modules/yq { inherit (pkgs) jq; };
 
   yt-dlp = toPythonModule (pkgs.yt-dlp.override { python3Packages = self; });