diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index dd8a7bfd701f..610dcb5d42bb 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -203,8 +203,6 @@
 
 - `services.openssh.settings.AcceptEnv` now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
 
-- `nodejs-slim` has a `npm` and a `corepack` outputs, and `nodejs` no longer has a `libv8` output.
-
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
 
 - `spacefm` was removed because it appeared to be unmaintained upstream.
@@ -264,6 +262,10 @@ gnuradioMinimal.override {
 
 - The `nodejs_latest` alias now points to `nodejs_25` instead of `nodejs_24`.
 
+- `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitely included.
+
+- `nodejs` is now a simple wrapper for `nodejs-slim`+`nodejs-slim.npm`+`nodejs-slim.corepack`, meaning it is no longer possible to reference or override its attributes or outputs (e.g. `nodejs.libv8` must be replaced with `nodejs-slim.libv8`, `nodejs.nativeBuildInputs` with `nodejs-slim.nativeBuildInputs`, etc.).
+
 - `mold` is now wrapped by default.
 
 - `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB.
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index cc3be74f86f8..6cec1a7229a2 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -975,6 +975,41 @@ rec {
     in
     "${cpuName}-${vendor.name}-${kernelName kernel}${optExecFormat}${optAbi}";
 
+  # This is a function from parsed platforms (like stdenv.hostPlatform.parsed)
+  # to parsed platforms.
+  makeMuslParsedPlatform =
+    parsed:
+    # The following line guarantees that the output of this function
+    # is a well-formed platform with no missing fields.
+    (
+      x:
+      lib.trivial.pipe x [
+        (x: removeAttrs x [ "_type" ])
+        mkSystem
+      ]
+    )
+      (
+        parsed
+        // {
+          abi =
+            {
+              gnu = abis.musl;
+              gnueabi = abis.musleabi;
+              gnueabihf = abis.musleabihf;
+              gnuabin32 = abis.muslabin32;
+              gnuabi64 = abis.muslabi64;
+              gnuabielfv2 = abis.musl;
+              gnuabielfv1 = abis.musl;
+              # The following entries ensure that this function is idempotent.
+              musleabi = abis.musleabi;
+              musleabihf = abis.musleabihf;
+              muslabin32 = abis.muslabin32;
+              muslabi64 = abis.muslabi64;
+            }
+            .${parsed.abi.name} or abis.musl;
+        }
+      );
+
   ################################################################################
 
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3fb6c89bf258..731e0b0c7967 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14519,6 +14519,12 @@
     github = "kulczwoj";
     githubId = 58049191;
   };
+  kumpelinus = {
+    name = "Kumpelinus";
+    email = "linus@kump.dev";
+    github = "kumpelinus";
+    githubId = 174106140;
+  };
   KunyaKud = {
     name = "KunyaKud";
     email = "wafuu@posteo.net";
@@ -16242,6 +16248,12 @@
     githubId = 115060;
     name = "Marek Maksimczyk";
   };
+  manfredmacx = {
+    email = "mfmacx@proton.me";
+    github = "manfredmacx";
+    githubId = 222261305;
+    name = "Manfred Macx";
+  };
   Mange = {
     name = "Magnus Bergmark";
     email = "me@mange.dev";
@@ -30096,6 +30108,12 @@
     githubId = 873857;
     name = "Zack Newman";
   };
+  zodman = {
+    github = "zodman";
+    githubId = 44167;
+    name = "Andres Vargas";
+    email = "zodman@gmail.com";
+  };
   zoedsoupe = {
     github = "zoedsoupe";
     githubId = 44469426;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0e98f50ab6e7..7c6e0b4e614f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -604,6 +604,7 @@
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
+  ./services/development/labgrid/coordinator.nix
   ./services/development/livebook.nix
   ./services/development/lorri.nix
   ./services/development/nixseparatedebuginfod2.nix
diff --git a/nixos/modules/services/development/labgrid/coordinator.nix b/nixos/modules/services/development/labgrid/coordinator.nix
new file mode 100644
index 000000000000..472d631b7bed
--- /dev/null
+++ b/nixos/modules/services/development/labgrid/coordinator.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.labgrid.coordinator;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.labgrid.coordinator = {
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the labgrid coordinator.";
+      };
+
+      debug = lib.mkOption {
+        default = false;
+        type = with lib.types; bool;
+        description = ''
+          Whether to enable debug mode.
+        '';
+      };
+
+      enable = lib.mkEnableOption "Labgrid Coordinator";
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = with lib.types; bool;
+        description = ''
+          Whether to automatically open the coordinator listen port in the firewall.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs [ "python3Packages" "labgrid" ] { };
+
+      port = lib.mkOption {
+        default = 20408;
+        type = lib.types.port;
+        description = "Coordinator port to bind to.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.labgrid-coordinator = {
+      after = [ "network-online.target" ];
+      description = "Labgrid Coordinator";
+      serviceConfig = {
+        Environment = ''"PYTHONUNBUFFERED=1"'';
+        ExecStart = "${lib.getBin cfg.package}/bin/labgrid-coordinator ${lib.optionalString cfg.debug "--debug"} --listen ${cfg.bindAddress}:${toString cfg.port}";
+        Restart = "on-failure";
+        DynamicUser = "yes";
+        StateDirectory = "labgrid-coordinator";
+        WorkingDirectory = "/var/lib/labgrid-coordinator";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictRealtime = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index 2d31dc92fae9..a2ee2230613b 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -580,7 +580,7 @@ in
         signNarinfo = lib.mkOption {
           type = lib.types.bool;
           default = true;
-          example = "false";
+          example = false;
           description = ''
             Whether to sign narInfo files or passthru as-is from upstream
           '';
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8985130a6f8d..c1a46aba39e2 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -853,6 +853,7 @@ in
     inherit runTest;
     inherit (pkgs) lib;
   };
+  labgrid = runTest ./labgrid.nix;
   lact = runTest ./lact.nix;
   ladybird = runTest ./ladybird.nix;
   languagetool = runTest ./languagetool.nix;
diff --git a/nixos/tests/caddy.nix b/nixos/tests/caddy.nix
index c86ce21c5919..ea59c1cf49b5 100644
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@@ -73,7 +73,7 @@
           services.caddy = {
             package = pkgs.caddy.withPlugins {
               plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
-              hash = "sha256-P6rYPJeJcKZgH/d29YQrPf68uWWuav2tQq/2+sVT3tg=";
+              hash = "sha256-Quib7+jFf2ElS4yvrJhuLiedX3lBNwxpEDskxxyVu+8=";
             };
             configFile = pkgs.writeText "Caddyfile" ''
               {
diff --git a/nixos/tests/labgrid.nix b/nixos/tests/labgrid.nix
new file mode 100644
index 000000000000..1b405dc0c51c
--- /dev/null
+++ b/nixos/tests/labgrid.nix
@@ -0,0 +1,66 @@
+{ pkgs, ... }:
+{
+  name = "Labgrid";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    aiyion
+    emantor
+  ];
+
+  nodes.coordinator =
+    { pkgs, ... }:
+    {
+      services.labgrid.coordinator.enable = true;
+      services.labgrid.coordinator.openFirewall = true;
+    };
+
+  nodes.client =
+    { pkgs, ... }:
+    {
+      environment.variables = {
+        LG_COORDINATOR = "coordinator:20408";
+      };
+      environment.systemPackages = [ pkgs.python3Packages.labgrid ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    #python
+    ''
+      def assert_contains(haystack, needle):
+          if needle not in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack)
+              print("---")
+              raise Exception(f"Expected string '{needle}' was not found")
+
+      with subtest("Wait for coordinator startup"):
+          coordinator.start()
+          coordinator.wait_for_unit("labgrid-coordinator.service")
+          coordinator.wait_for_open_port(20408)
+
+      with subtest("Connect from client"):
+          client.start()
+          out = client.succeed("labgrid-client resources")
+
+      with subtest("Create place"):
+          client.succeed("labgrid-client -p testplace create")
+          out = client.succeed("labgrid-client places")
+          assert_contains(out, "testplace")
+          # Give the coordinator enough time to persist place creation
+          coordinator.wait_until_succeeds("grep -q testplace /var/lib/labgrid-coordinator/places.yaml")
+
+      with subtest("Test coordinator persistence"):
+          coordinator.shutdown()
+          coordinator.start()
+          coordinator.wait_for_unit("labgrid-coordinator.service")
+          coordinator.wait_for_open_port(20408)
+          out = client.succeed("labgrid-client places")
+          assert_contains(out, "testplace")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 11
+          out = coordinator.fail(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold-1}")
+          out = coordinator.succeed(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold}")
+    '';
+}
diff --git a/pkgs/by-name/ap/apk-tools/package.nix b/pkgs/by-name/ap/apk-tools/package.nix
index 8dbd4be4bbe1..2a802b5983e4 100644
--- a/pkgs/by-name/ap/apk-tools/package.nix
+++ b/pkgs/by-name/ap/apk-tools/package.nix
@@ -3,6 +3,10 @@
   stdenv,
   fetchFromGitLab,
   pkg-config,
+  meson,
+  ninja,
+  python3,
+  cmocka,
   scdoc,
   openssl,
   zlib,
@@ -11,49 +15,43 @@
   lua5_3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "apk-tools";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = "apk-tools";
-    rev = "v${version}";
-    sha256 = "sha256-ydqJiLkz80TQGyf9m/l8HSXfoTAvi0av7LHETk1c0GI=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-51lBWcUSILCJZNP6LaOGyERCosNWTuEne/+xX8xHLf0=";
   };
 
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
-    scdoc
+    python3
   ]
   ++ lib.optionals luaSupport [
     lua5_3
     lua5_3.pkgs.lua-zlib
   ];
+
   buildInputs = [
     openssl
     zlib
     zstd
+    scdoc
+    cmocka
   ]
   ++ lib.optional luaSupport lua5_3;
+
   strictDeps = true;
 
-  makeFlags = [
-    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-    "SBINDIR=$(out)/bin"
-    "LIBDIR=$(out)/lib"
-    "LUA=${if luaSupport then "lua" else "no"}"
-    "LUA_LIBDIR=$(out)/lib/lua/${lib.versions.majorMinor lua5_3.version}"
-    "MANDIR=$(out)/share/man"
-    "DOCDIR=$(out)/share/doc/apk"
-    "INCLUDEDIR=$(out)/include"
-    "PKGCONFIGDIR=$(out)/lib/pkgconfig"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=unused-result"
-    "-Wno-error=deprecated-declarations"
+  mesonFlags = [
+    (lib.mesonEnable "lua" luaSupport)
+    (lib.mesonOption "lua_bin" "lua")
   ];
 
   enableParallelBuilding = true;
@@ -63,7 +61,6 @@ stdenv.mkDerivation rec {
     description = "Alpine Package Keeper";
     maintainers = [ ];
     license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.linux;
     mainProgram = "apk";
   };
-}
+})
diff --git a/pkgs/by-name/ap/app2unit/package.nix b/pkgs/by-name/ap/app2unit/package.nix
index 21879d196f59..36d6a183f0a2 100644
--- a/pkgs/by-name/ap/app2unit/package.nix
+++ b/pkgs/by-name/ap/app2unit/package.nix
@@ -2,10 +2,12 @@
   lib,
   stdenvNoCC,
   dash,
+  xdg-terminal-exec,
   scdoc,
   fetchFromGitHub,
   nix-update-script,
   installShellFiles,
+  withTerminalSupport ? true,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "app2unit";
@@ -49,6 +51,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   postFixup = ''
     substituteInPlace $out/bin/app2unit \
       --replace-fail '#!/bin/sh' '#!${lib.getExe dash}'
+  ''
+  + lib.optionalString withTerminalSupport ''
+    substituteInPlace $out/bin/app2unit \
+      --replace-fail 'A2U__TERMINAL_HANDLER=xdg-terminal-exec' \
+                     'A2U__TERMINAL_HANDLER=${lib.getExe xdg-terminal-exec}'
   '';
 
   meta = {
diff --git a/pkgs/by-name/ax/ax25-apps/glibc-2.42.patch b/pkgs/by-name/ax/ax25-apps/glibc-2.42.patch
new file mode 100644
index 000000000000..1a0c7700549e
--- /dev/null
+++ b/pkgs/by-name/ax/ax25-apps/glibc-2.42.patch
@@ -0,0 +1,26 @@
+--- a/ax25ipd/io.c
++++ b/ax25ipd/io.c
+@@ -19,20 +19,21 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <syslog.h>
+-#include <termio.h>
++#include <termios.h>
+ #include <time.h>
+ #include <unistd.h>
+ #include <arpa/inet.h>
+ #include <netinet/in.h>
+ #include <netinet/in_systm.h>
+ #include <netinet/ip.h>
++#include <sys/ioctl.h>
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <sys/socket.h>
+ 
+ #include "ax25ipd.h"
+ 
+-static struct termio nterm;
++static struct termios nterm;
+ 
+ int ttyfd = -1;
+ static int udpsock = -1;
diff --git a/pkgs/by-name/ax/ax25-apps/package.nix b/pkgs/by-name/ax/ax25-apps/package.nix
index dc71602f686f..f92d65f2051e 100644
--- a/pkgs/by-name/ax/ax25-apps/package.nix
+++ b/pkgs/by-name/ax/ax25-apps/package.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation {
     hash = "sha256-RLeFndis2OhIkJPLD+YfEUrJdZL33huVzlHq+kGq7dA=";
   };
 
+  patches = [
+    # Fix build against glibc-2.42
+    ./glibc-2.42.patch
+  ];
+
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var/lib"
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index bf90aba94d43..a14c962232d8 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -1,24 +1,24 @@
 {
-  buildGoModule,
+  buildGo126Module,
   lib,
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
   nixosTests,
 }:
-buildGoModule rec {
+buildGo126Module (finalAttrs: {
   pname = "beszel";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
-    tag = "v${version}";
-    hash = "sha256-/rFVH3kWf9OB3/iJNOARG85y1WH03hW8LvsIRzq1vnU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ugxy23bLrKIDclrYRFJc6Nq4Ak2S3OLeyMaxuRkS/tY=";
   };
 
   webui = buildNpmPackage {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
@@ -46,16 +46,16 @@ buildGoModule rec {
       runHook postInstall
     '';
 
-    sourceRoot = "${src.name}/internal/site";
+    sourceRoot = "${finalAttrs.src.name}/internal/site";
 
     npmDepsHash = "sha256-509/n5OH4z6LZH+jlmDLl2DlqKrD7M5ajtalmF/4n1o=";
   };
 
-  vendorHash = "sha256-O5gFpQ90AQFSAidPTWPrODZ4LWuwrOMpzEH/8HrjBig=";
+  vendorHash = "sha256-V9P3VP4CsboaWPIt/MhtxYDsYH3pwKL4xK5YcLKgbI8=";
 
   preBuild = ''
     mkdir -p internal/site/dist
-    cp -r ${webui}/* internal/site/dist
+    cp -r ${finalAttrs.webui}/* internal/site/dist
   '';
 
   postInstall = ''
@@ -75,7 +75,7 @@ buildGoModule rec {
 
   meta = {
     homepage = "https://github.com/henrygd/beszel";
-    changelog = "https://github.com/henrygd/beszel/releases/tag/v${version}";
+    changelog = "https://github.com/henrygd/beszel/releases/tag/v${finalAttrs.version}";
     description = "Lightweight server monitoring hub with historical data, docker stats, and alerts";
     maintainers = with lib.maintainers; [
       bot-wxt1221
@@ -84,4 +84,4 @@ buildGoModule rec {
     ];
     license = lib.licenses.mit;
   };
-}
+})
diff --git a/pkgs/by-name/br/brainflow/package.nix b/pkgs/by-name/br/brainflow/package.nix
index 811748e10e8f..c308ec735302 100644
--- a/pkgs/by-name/br/brainflow/package.nix
+++ b/pkgs/by-name/br/brainflow/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.20.1";
+  version = "5.21.0";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-eQgjEFYEuJXLNB+qeWLeN3ZRmq1lR5qpcFcPgHn8Az8=";
+    hash = "sha256-AE8c2ArkNipoAJSCj3NHEM91rulfbWGyANunPESKc/E=";
   };
 
   patches = [ ];
diff --git a/pkgs/by-name/ca/caddy/package.nix b/pkgs/by-name/ca/caddy/package.nix
index a69e26e6c51e..f3a93f1b014b 100644
--- a/pkgs/by-name/ca/caddy/package.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -11,7 +11,7 @@
   versionCheckHook,
 }:
 let
-  version = "2.11.1";
+  version = "2.11.2";
   dist = fetchFromGitHub {
     owner = "caddyserver";
     repo = "dist";
@@ -27,10 +27,10 @@ buildGo125Module (finalAttrs: {
     owner = "caddyserver";
     repo = "caddy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8NvRodMtq9Yrock7QRvF6ZOjuqpiK0KS3UeJzYcIbsg=";
+    hash = "sha256-QoGq8+lhaSQuC1VwIYE8h8N/ZC1ozfmIwmsIPk29Jos=";
   };
 
-  vendorHash = "sha256-jZ/oxAVBedbFEnqXrQnya2vLQZjXubAc1vUKwpUL66M=";
+  vendorHash = "sha256-zlwVgSEr01bbgV7N9szwqa9cPjBU34Cu7vqj4/MoSuU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index 96eb7cc56491..f9b26d324c1a 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-ETquOwdYRWTbXyQChtXo1vz/xqvog3fYgOmSnWenJxE=";
+    hash = "sha256-xR653w7jiJlSHvbDcJG5pFjbgf/jZzbyx8C+pa0cPp4=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index f55428608294..433a166dbb07 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -2,13 +2,7 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  giflib,
-  python3,
-  pkg-config,
-  pixman,
   nodejs_22,
-  cairo,
-  pango,
   stdenv,
 }:
 
@@ -29,18 +23,11 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-2Lrd0jAwAH6HkwLHyivqwaEhcpFAIALuno+MchSIfxo=";
 
-  nativeBuildInputs = [
-    python3
-    pkg-config
+  # Skip rebuilding native modules since they're not needed for the web app
+  npmRebuildFlags = [
+    "--ignore-scripts"
   ];
 
-  buildInputs = [
-    pixman
-    cairo
-    pango
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ giflib ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/co/cog/package.nix b/pkgs/by-name/co/cog/package.nix
index 77cfd7fc3c0f..a09614df34a8 100644
--- a/pkgs/by-name/co/cog/package.nix
+++ b/pkgs/by-name/co/cog/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cog";
-  version = "0.0.60";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "cog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hqDqsngkFG8jhwLHxN1JhBOx7UMfArFyRD9CEEK/SMw=";
+    hash = "sha256-cx9ztZufX199jiVT4ZB5qNUR5W2bfN3jzYhUmdAi+80=";
   };
 
-  vendorHash = "sha256-IQSb7SI+x+xRbfjBhbiROBTzlY2SI91cZIz0VfQn+n0=";
+  vendorHash = "sha256-rz/qL5kEryIV2SMQKoVav4C6scIKaxIFuwtTjqBaF4g=";
 
   subPackages = [ "cmd/cli" ];
 
diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index 1470cbb89cc2..45e4eb62a74f 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -5,7 +5,7 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  lima,
+  lima-full,
   makeWrapper,
   procps,
   qemu,
@@ -62,9 +62,7 @@ buildGoModule (finalAttrs: {
       --prefix PATH : ${
         lib.makeBinPath [
           # Suppress warning on `colima start`: https://github.com/abiosoft/colima/issues/1333
-          (lima.override {
-            withAdditionalGuestAgents = true;
-          })
+          lima-full
           qemu
         ]
       }
diff --git a/pkgs/by-name/co/concessio/package.nix b/pkgs/by-name/co/concessio/package.nix
index f7b95b14a577..6a31f57378b6 100644
--- a/pkgs/by-name/co/concessio/package.nix
+++ b/pkgs/by-name/co/concessio/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "concessio";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ronniedroid";
     repo = "concessio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vPHL46mZj6idIv9VXY73jrcA2GEpPdG5hn0ZzAZjo6A=";
+    hash = "sha256-jFmGl5g54cZ9yDbcm+yi/o3htLYHMffQJL74AH271TM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index 63b4ca0d7ddd..ff4b6d705edd 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -4,7 +4,7 @@
   fetchYarnDeps,
   fetchFromGitHub,
   fixup-yarn-lock,
-  nodejs_20,
+  nodejs,
   node-gyp,
   python3,
   makeBinaryWrapper,
@@ -14,10 +14,6 @@
   docker-compose,
   nix-update-script,
 }:
-
-let
-  nodejs = nodejs_20; # does not build with 22
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
   version = "0.83.0";
diff --git a/pkgs/by-name/de/dex-oidc/package.nix b/pkgs/by-name/de/dex-oidc/package.nix
index 951b02cf731f..4fa0922bcb4a 100644
--- a/pkgs/by-name/de/dex-oidc/package.nix
+++ b/pkgs/by-name/de/dex-oidc/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dex";
-  version = "2.45.0";
+  version = "2.45.1";
 
   src = fetchFromGitHub {
     owner = "dexidp";
     repo = "dex";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qBVrOFb/Nb2CRuMwSoy5QXN5EAuKyTEGVocnEtvZdgE=";
+    sha256 = "sha256-A6PHuo3cr9m7/u/o8agOL+BiKdOKuLDvlS62O7zt/Jk=";
   };
 
   vendorHash = "sha256-1D20aZhNUi7MUPfRTmSV4CZjLr0lUzbX4TI2LFcPY3U=";
diff --git a/pkgs/by-name/dw/dwarfs/package.nix b/pkgs/by-name/dw/dwarfs/package.nix
index c0d7424775f1..657b1f05b435 100644
--- a/pkgs/by-name/dw/dwarfs/package.nix
+++ b/pkgs/by-name/dw/dwarfs/package.nix
@@ -12,7 +12,6 @@
   flac,
   glog,
   gtest,
-  howard-hinnant-date,
   jemalloc,
   libarchive,
   libevent,
@@ -34,14 +33,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dwarfs";
-  version = "0.12.4";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "mhx";
     repo = "dwarfs";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-EYNnmv0QKdWddIRFRsuwsazHep3nrJ8lInlR4S67rME=";
+    hash = "sha256-4Ec1AqumTSPZpPEi528OaO3bOU1Soc8ZHuuKXIDvCUA=";
   };
 
   cmakeFlags = [
@@ -50,6 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
     # Needs to be set so `dwarfs` does not try to download `gtest`; it is not
     # a submodule, see: https://github.com/mhx/dwarfs/issues/188#issuecomment-1907657083
     "-DPREFER_SYSTEM_GTEST=ON"
+    # Upstream composes DESTDIR + CMAKE_INSTALL_PREFIX + CMAKE_INSTALL_SBINDIR
+    # in a create_link() install script. Keep SBINDIR relative to avoid
+    # nested nix/store path creation in the output.
+    "-DCMAKE_INSTALL_SBINDIR=sbin"
     "-DWITH_LEGACY_FUSE=ON"
     "-DWITH_TESTS=ON"
   ];
@@ -57,7 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     bison
     cmake
-    howard-hinnant-date # uses only the header-only parts
     pkg-config
     range-v3 # header-only library
     ronn
@@ -106,6 +108,15 @@ stdenv.mkDerivation (finalAttrs: {
         "dwarfs/tools_test.end_to_end/*"
         "dwarfs/tools_test.mutating_and_error_ops/*"
         "dwarfs/tools_test.categorize/*"
+        # Requires a working FUSE device and fusermount3, unavailable in sandbox.
+        "tools_test.timestamps_fuse*"
+        "tools_test.dwarfs_automount*"
+        "tools_test.dwarfs_fsname_and_subtype*"
+        "sparse_files_test.random_large_files*"
+        "sparse_files_test.random_small_files_fuse*"
+        "sparse_files_test.huge_holes_fuse*"
+        # Requires xattr support unavailable in sandbox.
+        "xattr_test.portable_xattr"
       ];
     in
     "-${lib.concatStringsSep ":" disabledTests}";
@@ -113,12 +124,13 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/dwarfs";
+  dontMoveSbin = true;
 
   meta = {
     description = "Fast high compression read-only file system";
     homepage = "https://github.com/mhx/dwarfs";
     changelog = "https://github.com/mhx/dwarfs/blob/v${finalAttrs.version}/CHANGES.md";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.luftmensch-luftmensch ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/dy/dyff/package.nix b/pkgs/by-name/dy/dyff/package.nix
index fd8d7a29d9d0..6b2283b2d385 100644
--- a/pkgs/by-name/dy/dyff/package.nix
+++ b/pkgs/by-name/dy/dyff/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dyff";
-  version = "1.10.5";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "homeport";
     repo = "dyff";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6DmRNaquyAKaitmgkw6wXS4127PpMgSrFep/2d0yegY=";
+    sha256 = "sha256-+z9AaoSu7FNRI+jPwW6s0qRHz2roPXq4/CTNDOQW77Y=";
   };
 
-  vendorHash = "sha256-3aaiiT87hPa3+u3E2wQrdLDb+eM49z3VnehQoxn/tbI=";
+  vendorHash = "sha256-vpmgSQKmnvaos4ZVuk4R419doAdULjtg95y5ORRwhZg=";
 
   subPackages = [
     "cmd/dyff"
diff --git a/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
index 2b9e45dfb1c9..02d6e00454f2 100644
--- a/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
+++ b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
@@ -1,6 +1,15 @@
 --- a/kill.c
 +++ b/kill.c
-@@ -175,7 +175,7 @@ static void notify_dbus(const char* body)
+@@ -153,7 +153,7 @@ static void notify_spawn_subprocess(const char* script, char* const argv[], cons
+     }
+ 
+     debug("%s: exec %s\n", __func__, script);
+-    execv(script, argv);
++    execvp(script, argv);
+     warn("%s: exec %s failed: %s\n", __func__, script, strerror(errno));
+     exit(1);
+ }
+@@ -177,7 +177,7 @@ static void notify_dbus(const char* body)
          body2,
          NULL
      };
diff --git a/pkgs/by-name/ea/easyeffects/package.nix b/pkgs/by-name/ea/easyeffects/package.nix
index 8cedc500052b..b7cd43625e69 100644
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -35,7 +35,7 @@
   webrtc-audio-processing,
   zam-plugins,
   zita-convolver,
-  wrapGAppsNoGuiHook,
+  wrapGAppsHook3,
 }:
 
 let
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     intltool
     ninja
     pkg-config
-    wrapGAppsNoGuiHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/fr/framework-tool-tui/package.nix b/pkgs/by-name/fr/framework-tool-tui/package.nix
index fb049d3399f1..023ee486b57b 100644
--- a/pkgs/by-name/fr/framework-tool-tui/package.nix
+++ b/pkgs/by-name/fr/framework-tool-tui/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "framework-tool-tui";
-  version = "0.7.7";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "grouzen";
     repo = "framework-tool-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XzOwShPMTyQjuoJ6fGW39kOF0Cnf3n8IEOQql0cEBvc=";
+    hash = "sha256-hTNSpjY0WkyXZpDGEM1eKQLFt/bhB5l/PSGd6bbDPAo=";
   };
 
-  cargoHash = "sha256-geLxSMtSucJ5SO5u9yvbV6lT+O2a/JVbq3HxTZGYhQE=";
+  cargoHash = "sha256-SkZpYFu9yJX2qTeTNoCEFJP1jQNqfK7DQj3JlBCqDmo=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 3d9ebe3a02af..d9c4e6d121a9 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -90,6 +90,10 @@ stdenv.mkDerivation (finalAttrs: {
     CFLAGS =
       lib.optionalString stdenv.hostPlatform.isAarch32 "-std=gnu99"
       + lib.optionalString stdenv.hostPlatform.is32bit " -D_FILE_OFFSET_BITS=64";
+  }
+  // lib.optionalAttrs (!stdenv.hostPlatform.isWindows && stdenv.cc.bintools.isLLVM) {
+    # Needs to be unset when using LLVM or else it tries to include Windows headers on Linux
+    RC = "";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/gh/gh-dash/package.nix b/pkgs/by-name/gh/gh-dash/package.nix
index 9b81bd73f703..d1bb88646666 100644
--- a/pkgs/by-name/gh/gh-dash/package.nix
+++ b/pkgs/by-name/gh/gh-dash/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh-dash";
-  version = "4.22.0";
+  version = "4.23.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vfp0AUSNl11w9jo7UeYDt+AdSxPzwPdeX7bWcZUkOGc=";
+    hash = "sha256-MkZ3HfJ+lt05fNKCb6Xpi+x30ZtgapPcoXvGhq8nj6k=";
   };
 
   vendorHash = "sha256-4AbeoH0l7eIS7d0yyJxM7+woC7Q/FCh0BOJj3d1zyX4=";
diff --git a/pkgs/by-name/gr/grafana-image-renderer/package.nix b/pkgs/by-name/gr/grafana-image-renderer/package.nix
index 842ae7ababeb..7bd633ce3bbf 100644
--- a/pkgs/by-name/gr/grafana-image-renderer/package.nix
+++ b/pkgs/by-name/gr/grafana-image-renderer/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana-image-renderer";
-  version = "5.6.0";
+  version = "5.6.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-54ZW81QSsun7t0HhLTub2QVz7jA7PsueoAUeXuQXOqM=";
+    hash = "sha256-rbR+TGkTWIpHeGxOQtVQFIeTv1/p8rGfbFp6hSSXQco=";
   };
 
-  vendorHash = "sha256-kGLvstSkucM0tN5l+Vp78IP9EwDx62kukAiOwYD4Vfs=";
+  vendorHash = "sha256-nRwd1luj8AFjDM67KtinVxRd31lUO+Vv3PDnsv2BMZU=";
 
   postPatch = ''
     substituteInPlace go.mod --replace-fail 'go 1.25.6' 'go 1.25.5'
diff --git a/pkgs/by-name/gs/gsmartcontrol/fix-paths.patch b/pkgs/by-name/gs/gsmartcontrol/fix-paths.patch
deleted file mode 100644
index b8ec19eb2563..000000000000
--- a/pkgs/by-name/gs/gsmartcontrol/fix-paths.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff --git a/data/gsmartcontrol-root.in b/data/gsmartcontrol-root.in
---- a/data/gsmartcontrol-root.in
-+++ b/data/gsmartcontrol-root.in
-@@ -8,7 +8,7 @@
- # Run gsmartcontrol with root, asking for root password first.
- # export GSMARTCONTROL_SU to override a su command (e.g. "kdesu -c").
- 
--EXEC_BIN="@prefix@/sbin/gsmartcontrol";
-+EXEC_BIN="@prefix@/bin/gsmartcontrol";
- prog_name="gsmartcontrol"
- 
- 
-@@ -118,7 +118,7 @@
- # Add @prefix@/sbin as well (freebsd seems to require it).
- # Note that beesu won't show a GUI login box if /usr/sbin is before /usr/bin,
- # so add it first as well.
--EXTRA_PATHS="/usr/bin:/usr/sbin:/usr/local/sbin:@prefix@/sbin";
-+EXTRA_PATHS="/usr/bin:/usr/sbin:/usr/local/sbin:@prefix@/bin";
- export PATH="$EXTRA_PATHS:$PATH"
- 
- 
-diff --git a/src/Makefile.am b/src/Makefile.am
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -24,7 +24,7 @@
- # endif
- 
- 
--sbin_PROGRAMS = gsmartcontrol
-+bin_PROGRAMS = gsmartcontrol
- 
- gsmartcontrol_LDADD = $(top_builddir)/src/applib/libapplib.a \
- 	$(top_builddir)/src/libdebug/libdebug.a \
diff --git a/pkgs/by-name/gs/gsmartcontrol/nixos-update-drivedb-message.patch b/pkgs/by-name/gs/gsmartcontrol/nixos-update-drivedb-message.patch
new file mode 100644
index 000000000000..5163bcc56aae
--- /dev/null
+++ b/pkgs/by-name/gs/gsmartcontrol/nixos-update-drivedb-message.patch
@@ -0,0 +1,18 @@
+diff --git a/src/gui/gsc_main_window.cpp b/src/gui/gsc_main_window.cpp
+index a5a6ac9..2d7a1f7 100644
+--- a/src/gui/gsc_main_window.cpp
++++ b/src/gui/gsc_main_window.cpp
+@@ -955,8 +955,13 @@ void GscMainWindow::run_update_drivedb()
+ 		if (smartctl_binary.is_absolute()) {
+ 			update_binary_path = smartctl_binary.parent_path() / update_binary_path;
+ 		}
+-		argv = {"xterm", "-hold", "-e", hz::fs_path_to_string(update_binary_path)};
++
++		gui_show_error_dialog(
++			_("Error Updating Drive Database"),
++			_("Updating drivedb from GSmartControl is unavailable in nixpkgs because smartmontools in the Nix store is immutable. Please update your NixOS or nixpkgs channel/flake inputs to get a newer drive database."),
++			this);
++		return;
+ 	}
+ 
+ 	try {
diff --git a/pkgs/by-name/gs/gsmartcontrol/package.nix b/pkgs/by-name/gs/gsmartcontrol/package.nix
index 27bff9bb23b3..cbb3dde6c8a6 100644
--- a/pkgs/by-name/gs/gsmartcontrol/package.nix
+++ b/pkgs/by-name/gs/gsmartcontrol/package.nix
@@ -3,12 +3,12 @@
   stdenv,
   fetchFromGitHub,
   smartmontools,
+  adwaita-icon-theme,
   cmake,
   gtkmm3,
+  makeWrapper,
   pkg-config,
-  wrapGAppsHook3,
-  pcre-cpp,
-  adwaita-icon-theme,
+  # xterm,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-eLzwFZ1PYqijFTxos9Osf7A2v4C8toM+TGV4/bU82NE=";
   };
 
+  patches = [
+    ./nixos-update-drivedb-message.patch
+  ];
+
   postPatch = ''
     substituteInPlace data/gsmartcontrol.in.desktop \
       --replace-fail "@CMAKE_INSTALL_FULL_BINDIR@/" ""
@@ -30,21 +34,24 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook3
+    makeWrapper
   ];
 
   buildInputs = [
     gtkmm3
-    pcre-cpp
     adwaita-icon-theme
   ];
 
   enableParallelBuilding = true;
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PATH : "${lib.makeBinPath [ smartmontools ]}"
-    )
+  postFixup = ''
+    wrapProgram $out/bin/gsmartcontrol \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          smartmontools
+          # xterm # For `update-smart-drivedb`, which does not make sense in NixOS as it tries to overwrite /usr/share/smartmontools/drivedb.h
+        ]
+      }
   '';
 
   meta = {
diff --git a/pkgs/by-name/gu/gurk-rs/package.nix b/pkgs/by-name/gu/gurk-rs/package.nix
index 4a9318e21a8b..d3f2008b8892 100644
--- a/pkgs/by-name/gu/gurk-rs/package.nix
+++ b/pkgs/by-name/gu/gurk-rs/package.nix
@@ -14,20 +14,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gurk-rs";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "boxdot";
     repo = "gurk-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HBqKcKPsNJQhLGGQ4X+xGPWwSABiaqubn11yyqiL0xU=";
+    hash = "sha256-w9s7iZ1QPrNleVjAu7Z0ElIRJZWV8l6uCbOZsB7FL4M=";
   };
 
   postPatch = ''
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-oasGeNlY3c0iSxgLqPCo081g7d0fA3I+LyDJdRSiNaE=";
+  cargoHash = "sha256-PWeIfo5IepPr6Ug0sdXE6aFguNkBuM0/v8HkAeq8hQI=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 91e796183994..83b1fc777d83 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-01-19";
+  version = "2.3.0-rolling-2026-02-28";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "a9ba592b904684b8d12e9a825e4a579c31999c2b";
-    hash = "sha256-ZLoZgMIhBtLJ0GS6leyTegNauAczGB0Ua1pU6PE31yE=";
+    rev = "725e54bc932fbe0c6e208db4e71eb1df79ec43ff";
+    hash = "sha256-SAH7AZYy6ZRRa8zhhe8voKJCqM5CxSuZA/XwT1Nb9NI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ha/hash_extender/package.nix b/pkgs/by-name/ha/hash_extender/package.nix
index 059f8d56d596..896094f26626 100644
--- a/pkgs/by-name/ha/hash_extender/package.nix
+++ b/pkgs/by-name/ha/hash_extender/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   openssl,
 }:
 
@@ -16,10 +17,27 @@ stdenv.mkDerivation {
     sha256 = "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b";
   };
 
+  patches = [
+    # gcc-15 build fix:
+    #   https://github.com/iagox86/hash_extender/pull/15
+    (fetchpatch {
+      name = "gcc-15.patch";
+      url = "https://github.com/iagox86/hash_extender/commit/84d8d70eb10bcbe4dea2cf5a41d246d59a389e61.patch";
+      hash = "sha256-LCzv4FK+4WoJBYYUYB+zsC6358ZpTOxbE91W/1pFe6U=";
+    })
+  ];
+
   buildInputs = [ openssl ];
 
+  enableParallelBuilding = true;
   doCheck = true;
-  checkPhase = "./hash_extender --test";
+  checkPhase = ''
+    runHook preCheck
+
+    ./hash_extender --test
+
+    runHook postCheck
+  '';
 
   # https://github.com/iagox86/hash_extender/issues/26
   hardeningDisable = [ "fortify3" ];
@@ -27,8 +45,12 @@ stdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp hash_extender $out/bin
+
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/by-name/he/heptabase/package.nix b/pkgs/by-name/he/heptabase/package.nix
index aad2dc870841..97246ca0c025 100644
--- a/pkgs/by-name/he/heptabase/package.nix
+++ b/pkgs/by-name/he/heptabase/package.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "heptabase";
-  version = "1.84.0";
+  version = "1.84.3";
   src = fetchurl {
     url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-sk9YN2vNr9jiGzVQOcst+oRLEYjEaZO4nGgD8TxdfIc=";
+    hash = "sha256-ddkNmKWORgIeX7jkskP4f386Imp9CX3q7Kbe+SEGTpQ=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/ij/ijq/package.nix b/pkgs/by-name/ij/ijq/package.nix
index 92397d063ba4..3e980514f433 100644
--- a/pkgs/by-name/ij/ijq/package.nix
+++ b/pkgs/by-name/ij/ijq/package.nix
@@ -1,5 +1,5 @@
 {
-  buildGoModule,
+  buildGo126Module,
   fetchFromCodeberg,
   lib,
   jq,
@@ -9,18 +9,18 @@
   nix-update-script,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
   pname = "ijq";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromCodeberg {
     owner = "gpanders";
     repo = "ijq";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PT7WnCZL4Cfo/+VW3ImOloDOI9d0GX4UTcC8Bf3OVAU=";
+    hash = "sha256-U4UKhWI/xd7+rLa350oIFlCqbiMSZe3ztPFR0uierOo=";
   };
 
-  vendorHash = "sha256-1R3rv3FraT53dqGECRr+ulhplmmByqRW+VJ+y6nFR+Y=";
+  vendorHash = "sha256-aU/0CIbI49OwgY6ioT50uPxld/rHAve3+KoILgPpWSQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/jb/jbang/package.nix b/pkgs/by-name/jb/jbang/package.nix
index 016581c9e6f2..501f3dbc8503 100644
--- a/pkgs/by-name/jb/jbang/package.nix
+++ b/pkgs/by-name/jb/jbang/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     cp -r . $out
     wrapProgram $out/bin/jbang \
       --set JAVA_HOME ${jdk} \
-      --set PATH ${
+      --prefix PATH ${
         lib.makeBinPath [
           (placeholder "out")
           coreutils
diff --git a/pkgs/by-name/kd/kdiff3/package.nix b/pkgs/by-name/kd/kdiff3/package.nix
index c3686a36f503..460dd66312c6 100644
--- a/pkgs/by-name/kd/kdiff3/package.nix
+++ b/pkgs/by-name/kd/kdiff3/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kdiff3";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchurl {
     url = "mirror://kde/stable/kdiff3/kdiff3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-4iZUxFeIF5mAgwVSnGtZbAydw4taLswULsdtRvaHP0w=";
+    hash = "sha256-RpCjWqkzsZJ1HdWQprT1P+86qVAkY3ERKtbocvaybss=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ko/koffan/package.nix b/pkgs/by-name/ko/koffan/package.nix
new file mode 100644
index 000000000000..29f935c1ccec
--- /dev/null
+++ b/pkgs/by-name/ko/koffan/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "koffan";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "PanSalut";
+    repo = "Koffan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZFA/++iKJm7zrijDhNgvEK7rOUGfA2decG/BaK2Z8rk=";
+  };
+
+  vendorHash = "sha256-9QNqW1Cif5sNuI5rvM5JoBTdEwWWXROcmMOVP2eOc2M=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Free selfhosted groceries list for families and shared households";
+    mainProgram = "shopping-list";
+    homepage = "https://github.com/PanSalut/Koffan";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lykos153 ];
+  };
+})
diff --git a/pkgs/by-name/li/libcacard/package.nix b/pkgs/by-name/li/libcacard/package.nix
index fd58f9587186..e2dbe37f7620 100644
--- a/pkgs/by-name/li/libcacard/package.nix
+++ b/pkgs/by-name/li/libcacard/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcacard";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchurl {
     url = "https://www.spice-space.org/download/libcacard/libcacard-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-+79N6Mt9tb3/XstnL/Db5pOfufNEuQDVG6YpUymjMuc=";
+    sha256 = "sha256-Rfwopv88ejWdREgTLKGQ8KnHYFQMRF26RZeltx3kD2g=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/li/libdaq/package.nix b/pkgs/by-name/li/libdaq/package.nix
index b48f6f2cb33c..5a3c686be11b 100644
--- a/pkgs/by-name/li/libdaq/package.nix
+++ b/pkgs/by-name/li/libdaq/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdaq";
-  version = "3.0.24";
+  version = "3.0.25";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "libdaq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LIdELWQZ76bA0GZne0IMr+GHisUksBYXwzSqVB5nMsA=";
+    hash = "sha256-BG86HeprNtc3hnNPNH4AJX7Q9zy8VYvlVmsXsio9O5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libdnet/package.nix b/pkgs/by-name/li/libdnet/package.nix
index dae167de5c86..f8a092bda96f 100644
--- a/pkgs/by-name/li/libdnet/package.nix
+++ b/pkgs/by-name/li/libdnet/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdnet";
-  version = "1.18.0";
+  version = "1.18.2";
 
   enableParallelBuilding = true;
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ofalk";
     repo = "libdnet";
     tag = "libdnet-${finalAttrs.version}";
-    hash = "sha256-oPlBQB9e8vGJ/rVydMqsZqdInhrpm2sNWkDl9JkkXCI=";
+    hash = "sha256-MPNIkgsBG/ZtsGYTRO258oCYR/RVFN3xav+UizMFeV0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libgbinder/package.nix b/pkgs/by-name/li/libgbinder/package.nix
index 0736a50e1048..800d5c6a9b90 100644
--- a/pkgs/by-name/li/libgbinder/package.nix
+++ b/pkgs/by-name/li/libgbinder/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgbinder";
-  version = "1.1.43";
+  version = "1.1.44";
 
   src = fetchFromGitHub {
     owner = "mer-hybris";
     repo = "libgbinder";
     rev = finalAttrs.version;
-    sha256 = "sha256-a4lQzWOVdlXQeoJzvNaELiVXLvXsx4reigKrhsrcafM=";
+    sha256 = "sha256-6xyNbHPPN/KtyejMoVfAj0bi1dEWVO2nboj1RpqnFIA=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libnids/package.nix b/pkgs/by-name/li/libnids/package.nix
index d7603cc138a6..163bf61a4855 100644
--- a/pkgs/by-name/li/libnids/package.nix
+++ b/pkgs/by-name/li/libnids/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     this is necessary for dsniff to compile; otherwise g_thread_init is a missing
     symbol when linking (?!?)
   */
-  env.NIX_CFLAGS_COMPILE = "-Dg_thread_init= ";
+  env.NIX_CFLAGS_COMPILE = "-Dg_thread_init= -std=gnu17 ";
 
   meta = {
     description = "E-component of Network Intrusion Detection System which emulates the IP stack of Linux 2.0.x";
diff --git a/pkgs/by-name/li/lima-full/package.nix b/pkgs/by-name/li/lima-full/package.nix
new file mode 100644
index 000000000000..e72b02fd668c
--- /dev/null
+++ b/pkgs/by-name/li/lima-full/package.nix
@@ -0,0 +1,7 @@
+{
+  lima,
+}:
+
+lima.override {
+  withAdditionalGuestAgents = true;
+}
diff --git a/pkgs/by-name/li/lima/additional-guestagents.nix b/pkgs/by-name/li/lima/additional-guestagents.nix
index 8f95811f21ac..296c797a27e2 100644
--- a/pkgs/by-name/li/lima/additional-guestagents.nix
+++ b/pkgs/by-name/li/lima/additional-guestagents.nix
@@ -7,12 +7,15 @@
   findutils,
 }:
 
+let
+  source = callPackage ./source.nix { };
+in
 buildGoModule (finalAttrs: {
   pname = "lima-additional-guestagents";
 
   # Because agents must use the same version as lima, lima's updateScript should also update the shared src.
   # nixpkgs-update: no auto update
-  inherit (callPackage ./source.nix { }) version src vendorHash;
+  inherit (source) version src vendorHash;
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_15
@@ -56,8 +59,7 @@ buildGoModule (finalAttrs: {
     runHook postInstallCheck
   '';
 
-  meta = {
-    homepage = "https://github.com/lima-vm/lima";
+  meta = source.meta // {
     description = "Lima Guest Agents for emulating non-native architectures";
     longDescription = ''
       This package should only be used when your guest's architecture differs from the host's.
@@ -71,8 +73,5 @@ buildGoModule (finalAttrs: {
 
       Typically, you won't need to directly add this package to your *.nix files.
     '';
-    changelog = "https://github.com/lima-vm/lima/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.asl20;
-    maintainers = [ ];
   };
 })
diff --git a/pkgs/by-name/li/lima/package.nix b/pkgs/by-name/li/lima/package.nix
index 96b2e043dd4a..c998ae4731b6 100644
--- a/pkgs/by-name/li/lima/package.nix
+++ b/pkgs/by-name/li/lima/package.nix
@@ -20,10 +20,13 @@
   jq,
 }:
 
+let
+  source = callPackage ./source.nix { };
+in
 buildGoModule (finalAttrs: {
-  pname = "lima";
+  pname = "lima" + lib.optionalString withAdditionalGuestAgents "-full";
 
-  inherit (callPackage ./source.nix { }) version src vendorHash;
+  inherit (source) version src vendorHash;
 
   nativeBuildInputs = [
     makeWrapper
@@ -158,13 +161,7 @@ buildGoModule (finalAttrs: {
     };
   };
 
-  meta = {
-    homepage = "https://github.com/lima-vm/lima";
+  meta = source.meta // {
     description = "Linux virtual machines with automatic file sharing and port forwarding";
-    changelog = "https://github.com/lima-vm/lima/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      anhduy
-    ];
   };
 })
diff --git a/pkgs/by-name/li/lima/source.nix b/pkgs/by-name/li/lima/source.nix
index 215f72966a26..99259ed5e823 100644
--- a/pkgs/by-name/li/lima/source.nix
+++ b/pkgs/by-name/li/lima/source.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   fetchFromGitHub,
 }:
 
@@ -16,4 +17,14 @@ in
   };
 
   vendorHash = "sha256-SeLYVQI+ZIbR9qVaNyF89VUvXdfv1M5iM+Cbas6e2E0=";
+
+  meta = {
+    homepage = "https://github.com/lima-vm/lima";
+    changelog = "https://github.com/lima-vm/lima/releases/tag/v${version}";
+    knownVulnerabilities = lib.optional (lib.versionOlder version "2") "Lima version ${version} is EOL. See https://lima-vm.io/docs/releases/.";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      anhduy
+    ];
+  };
 }
diff --git a/pkgs/by-name/lu/lucky-commit/package.nix b/pkgs/by-name/lu/lucky-commit/package.nix
index 99fef8610c6a..ab5adb72164d 100644
--- a/pkgs/by-name/lu/lucky-commit/package.nix
+++ b/pkgs/by-name/lu/lucky-commit/package.nix
@@ -20,6 +20,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-zuWPkaYltxOOLaR6NTVkf1WbKzUQByml45jNL+e5UJ0=";
 
+  # LLVM Apple assembler rejects `:lo12:` combined with `@PAGEOFF`.
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+    substituteInPlace "$cargoDepsCopy"/sha1-asm-*/src/aarch64_apple.S \
+      --replace-fail "#:lo12:.K0@PAGEOFF" ".K0@PAGEOFF" \
+      --replace-fail "#:lo12:.K1@PAGEOFF" ".K1@PAGEOFF" \
+      --replace-fail "#:lo12:.K2@PAGEOFF" ".K2@PAGEOFF" \
+      --replace-fail "#:lo12:.K3@PAGEOFF" ".K3@PAGEOFF"
+  '';
+
   buildInputs = lib.optional (withOpenCL && (!stdenv.hostPlatform.isDarwin)) ocl-icd;
 
   buildNoDefaultFeatures = !withOpenCL;
diff --git a/pkgs/by-name/me/metals/package.nix b/pkgs/by-name/me/metals/package.nix
index 10f7cf4243c6..da2d7e95e762 100644
--- a/pkgs/by-name/me/metals/package.nix
+++ b/pkgs/by-name/me/metals/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "metals";
-  version = "1.6.5";
+  version = "1.6.6";
 
   deps = stdenv.mkDerivation {
     name = "metals-deps-${finalAttrs.version}";
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-NOS1HUS4TJXnleZTEji3HAHUa9WOGmJDX2yT7zwmX08=";
+    outputHash = "sha256-Snx4JvWOTkJcihVRwj25op4BJqmChz+1fZH/PrCCbt0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mighty-mike/package.nix b/pkgs/by-name/mi/mighty-mike/package.nix
index 5abe538e8424..7a9dde75e34b 100644
--- a/pkgs/by-name/mi/mighty-mike/package.nix
+++ b/pkgs/by-name/mi/mighty-mike/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   SDL2,
   cmake,
+  libGL,
   makeWrapper,
   unstableGitUpdater,
 }:
@@ -26,7 +27,10 @@ stdenv.mkDerivation {
     makeWrapper
   ];
 
-  buildInputs = [ SDL2 ];
+  buildInputs = [
+    SDL2
+    libGL
+  ];
 
   strictDeps = true;
 
@@ -40,8 +44,7 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/MightyMike --chdir "$out/share/MightyMike"
 
     install -Dm644 $src/packaging/io.jor.mightymike.desktop $out/share/applications/mightymike.desktop
-    install -Dm644 $src/packaging/io.jor.mightymike.png $out/share/pixmaps/mightymike-desktopicon.png
-
+    install -Dm644 $src/packaging/io.jor.mightymike.png -t $out/share/icons/hicolor/512x512/apps
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/mi/minijinja/package.nix b/pkgs/by-name/mi/minijinja/package.nix
index 0b7bde4c4299..1aeca54ea6f0 100644
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "minijinja";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = finalAttrs.version;
-    hash = "sha256-55Zo8mVgMhCgYzE6662oTXfn7W908LplZv6ys/aHveY=";
+    hash = "sha256-Q8s9NH2Su2IL2GlZIDUUmkwnfluMjOY/ULuLoL4+lEE=";
   };
 
-  cargoHash = "sha256-aSszdJCOdO8xvypBGXm2kItjl9HojyxC8/BeKrOAImU=";
+  cargoHash = "sha256-7uzSuBpRWIWmtCO81i7RXP9k8mp6tTe/lMHP5nKMX1I=";
 
   # The tests relies on the presence of network connection
   doCheck = false;
diff --git a/pkgs/by-name/mi/miracle-wm/package.nix b/pkgs/by-name/mi/miracle-wm/package.nix
index 13c076ccd551..0524b964ef30 100644
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   gitUpdater,
   nixosTests,
   boost,
@@ -32,24 +31,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miracle-wm";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "miracle-wm-org";
     repo = "miracle-wm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RzqF3UDC4MY85ex9TOD2L0Zd7T6mgiZ+ImJuJG+xtjo=";
+    hash = "sha256-N8FDoQDEfv0xGjtnKx+jNfRwxvJdb4ETvQnZuBvlccQ=";
   };
 
-  patches = [
-    # Fix compat with newer Mir
-    # Remove when version > 0.8.2
-    (fetchpatch {
-      url = "https://github.com/miracle-wm-org/miracle-wm/commit/3f3389bf49ad780d258d34109f87e73ef7c02344.patch";
-      hash = "sha256-dxrYfn/MhpCkgsmunMAl5TrPxY8FO0dqQf4LYcuiFGk=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
@@ -57,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   # Fix compat with newer Mir
   # https://github.com/miracle-wm-org/miracle-wm/commit/aaae6e64261d8a00c2a1df47e2eab99400382d69
-  # Remove when version > 0.8.2
+  # Remove when version > 0.8.3
   + ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'pkg_check_modules(MIRRENDERER REQUIRED mirrenderer' 'pkg_check_modules(MIRRENDERER mirrenderer'
diff --git a/pkgs/by-name/mo/moribito/package.nix b/pkgs/by-name/mo/moribito/package.nix
new file mode 100644
index 000000000000..57ef085d5b89
--- /dev/null
+++ b/pkgs/by-name/mo/moribito/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "moribito";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "ericschmar";
+    repo = "moribito";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/p7RVsz9jjPTVkEjhDsSHQmYVOsvpbb1APLGQYVjgiU=";
+  };
+
+  vendorHash = "sha256-O5OmVP5aGlc8Bz2nVAAkhCdTuonB9yXGSz5FO3FxJ1I=";
+
+  subPackages = [ "cmd/moribito" ];
+
+  # Clipboard support
+  env.CGO_ENABLED = 1;
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal LDAP explorer";
+    homepage = "https://github.com/ericschmar/moribito";
+    changelog = "https://github.com/ericschmar/moribito/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kumpelinus ];
+    mainProgram = "moribito";
+  };
+})
diff --git a/pkgs/by-name/pi/picoclaw/package.nix b/pkgs/by-name/pi/picoclaw/package.nix
new file mode 100644
index 000000000000..e67e36479e08
--- /dev/null
+++ b/pkgs/by-name/pi/picoclaw/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "picoclaw";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "sipeed";
+    repo = "picoclaw";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zCeURNN152yL3Qi1UFDvSB85xflbLAMzQUTwGThALss=";
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-CsTGC5Ajo9RV6rJPQgnFqA+bQ2TEafI4tt3iXpVwaeY=";
+
+  preBuild = ''
+    go generate ./...
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/sipeed/picoclaw/cmd/picoclaw/internal.version=${finalAttrs.version}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  checkFlags =
+    let
+      skippedTests = [
+        "TestGetVersion"
+        "TestCodexCliProvider_MockCLI_Success"
+        "TestCodexCliProvider_MockCLI_Error"
+        "TestCodexCliProvider_MockCLI_WithModel"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  meta = {
+    description = "Tiny, Fast, and Deployable anywhere - automate the mundane, unleash your creativity";
+    homepage = "https://github.com/sipeed/picoclaw";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      manfredmacx
+      drupol
+    ];
+    mainProgram = "picoclaw";
+  };
+})
diff --git a/pkgs/by-name/qu/quartz-wm/fix-picture-typedef-conflict.patch b/pkgs/by-name/qu/quartz-wm/fix-picture-typedef-conflict.patch
new file mode 100644
index 000000000000..0c1d1ee6cc0e
--- /dev/null
+++ b/pkgs/by-name/qu/quartz-wm/fix-picture-typedef-conflict.patch
@@ -0,0 +1,66 @@
+diff --git a/lib/dock-support.h b/lib/dock-support.h
+index af18b9d..82cac38 100644
+--- a/lib/dock-support.h
++++ b/lib/dock-support.h
+@@ -26,7 +26,6 @@
+ #define __DOCK_SUPPORT_H__
+ 
+ #include <Xplugin.h>
+-#include <ApplicationServices/ApplicationServices.h>
+ #include <objc/objc.h>
+ 
+ #ifdef XPLUGIN_DOCK_SUPPORT
+diff --git a/src/x-screen.m b/src/x-screen.m
+index 3d86edb..63fb094 100644
+--- a/src/x-screen.m
++++ b/src/x-screen.m
+@@ -443,7 +443,7 @@ window_level_less (const void *a, const void *b)
+ {
+     x_window *w;
+     x_list *sl;
+-    CGError err;
++    xp_error err;
+     xp_bool isVisible;
+ 
+     for(sl = _stacking_list; sl; sl = sl->next) {
+diff --git a/src/x-window.m b/src/x-window.m
+index 241541c..059ebd2 100644
+--- a/src/x-window.m
++++ b/src/x-window.m
+@@ -2127,7 +2127,7 @@ ENABLE_EVENTS (_id, X_CLIENT_WINDOW_EVENTS)
+ - (void) do_collapse
+ {
+     xp_native_window_id wid;
+-    OSStatus err;
++    xp_error err;
+     char *title_c;
+ 
+     DB ("_minimized: %s _animating: %s", _minimized ? "YES" : "NO", _animating ? "YES" : "NO");
+@@ -2145,7 +2145,7 @@ ENABLE_EVENTS (_id, X_CLIENT_WINDOW_EVENTS)
+     err = qwm_dock_minimize_item_with_title_async (wid, title_c);
+     free(title_c);
+ 
+-    if (err == noErr)
++    if (err == XP_Success)
+     {
+         _animating = YES;
+         _minimized = YES;
+@@ -2172,7 +2172,7 @@ ENABLE_EVENTS (_id, X_CLIENT_WINDOW_EVENTS)
+ 
+ - (void) do_uncollapse_and_tell_dock:(BOOL)tell_dock with_animation:(BOOL)anim
+ {
+-    OSStatus err = noErr;
++    xp_error err = XP_Success;
+     long data = 1;
+ 
+     DB ("tell_dock: %s with_animation: %s _animating: %s", tell_dock ? "YES" : "NO", anim ? "YES" : "NO", _animating ? "YES" : "NO");
+@@ -2205,7 +2205,7 @@ ENABLE_EVENTS (_id, X_CLIENT_WINDOW_EVENTS)
+             err = qwm_dock_remove_item (_minimized_osx_id);
+     }
+ 
+-    if (err == noErr) {
++    if (err == XP_Success) {
+         _animating = YES;
+         _minimized_osx_id = XP_NULL_NATIVE_WINDOW_ID;
+         [self set_wm_state:NormalState];
+
diff --git a/pkgs/by-name/qu/quartz-wm/package.nix b/pkgs/by-name/qu/quartz-wm/package.nix
index ef06bf4f0af4..68d373ba102a 100644
--- a/pkgs/by-name/qu/quartz-wm/package.nix
+++ b/pkgs/by-name/qu/quartz-wm/package.nix
@@ -23,6 +23,8 @@ clangStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1+KZNeR4Gq2uWBHTN53PTITHuly1Z4buR+grzdVNwhs=";
   };
 
+  patches = [ ./fix-picture-typedef-conflict.patch ];
+
   configureFlags = [ "--enable-xplugin-dock-support" ];
   nativeBuildInputs = [
     autoreconfHook
@@ -41,7 +43,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   meta = {
     license = lib.licenses.apple-psl20;
     platforms = lib.platforms.darwin;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.booxter ];
     mainProgram = "quartz-wm";
   };
 })
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index bcaf95a3d282..5dee8a0d0c9a 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "railway";
-  version = "4.30.4";
+  version = "4.30.5";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XzCgfjjpm79wpRGzVmXwd8cX1R9KqtjMac7EhfIpqh0=";
+    hash = "sha256-0krjgyJfQQ53ihe6FKxEGpTasCibGXe0DCxOD5IJDOI=";
   };
 
-  cargoHash = "sha256-I+fz459knRi0MNPxNpRMhYSVbe7oTRI8j9AHyTJ9Tlk=";
+  cargoHash = "sha256-dPWTtJPw71MYUeemS/DLL2Tu4V1F59LLmcpRAtjivOE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/redo-sh/package.nix b/pkgs/by-name/re/redo-sh/package.nix
index 4d9471f6a175..0ee857ea57e5 100644
--- a/pkgs/by-name/re/redo-sh/package.nix
+++ b/pkgs/by-name/re/redo-sh/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation {
   pname = "redo-sh";
-  version = "4.0.6";
+  version = "4.0.7";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20250225235353/http://news.dieweltistgarnichtso.net/bin/archives/redo-sh.tar.gz";
-    hash = "sha256-pDhCnMelCXK/Pp3jPXZog7HLBTgrsCvX4LAVapYvxl8=";
+    url = "https://web.archive.org/web/20251228095310/http://news.dieweltistgarnichtso.net/bin/archives/redo-sh.tar.gz";
+    hash = "sha256-h9C/8ti8TBRM66OLYOk+TotwmDCIZBRvJ0tJKdYAwaQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ru/rust-addr2line/package.nix b/pkgs/by-name/ru/rust-addr2line/package.nix
new file mode 100644
index 000000000000..4b0d5dce9441
--- /dev/null
+++ b/pkgs/by-name/ru/rust-addr2line/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rust-addr2line";
+  version = "0.26.0";
+
+  src = fetchFromGitHub {
+    owner = "gimli-rs";
+    repo = "addr2line";
+    tag = version;
+    hash = "sha256-+GrX5/AgKlU0rNIKkt4XAQFab6G6F4DN4Qkol8Jd5DQ=";
+  };
+
+  cargoBuildFlags = "--bin addr2line --features bin";
+
+  cargoHash = "sha256-aC69kyyMNwifIsjRPCgKxqguKtU7zSN8Mn9tChXykNo=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cross-platform `addr2line` clone written in Rust, using `gimli`";
+    homepage = "https://github.com/gimli-rs/addr2line";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = [
+      lib.maintainers.axka
+      lib.maintainers.flokli
+    ];
+    mainProgram = "addr2line";
+  };
+}
diff --git a/pkgs/by-name/ru/rustic/package.nix b/pkgs/by-name/ru/rustic/package.nix
index f2c76c47c080..6818f7ce3b91 100644
--- a/pkgs/by-name/ru/rustic/package.nix
+++ b/pkgs/by-name/ru/rustic/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustic";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2xSQ+nbP7/GsIWvj9sgG+jgIIIesfEW8T9z5Tijd90E=";
+    hash = "sha256-Iih6qZglnsD6aSQQUoCfYtGvz2CcmWeCVmwbWkgW5Hg=";
   };
 
-  cargoHash = "sha256-4yiWIlibYldr3qny0KRRIHBqHCx6R9gDiiheGkJrwEY=";
+  cargoHash = "sha256-osVyOFO+vHbcXEp44VH7XI8y4Ir8/IkCr/cF0FMPQvQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sc/screenly-cli/package.nix b/pkgs/by-name/sc/screenly-cli/package.nix
index 324affbf886d..f266522a8b02 100644
--- a/pkgs/by-name/sc/screenly-cli/package.nix
+++ b/pkgs/by-name/sc/screenly-cli/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "screenly-cli";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "screenly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Icx0Nkn0ScbNTmXllkUj6DPhGqzh8HnIQPpej4ABJac=";
+    hash = "sha256-g8qVlZVsHA0FiAK58AWH/LDyCopBBFPO4ocbz4rCivk=";
   };
 
-  cargoHash = "sha256-XYXWbwuoPqL93R8Bre26kBPxkiXpJ0Dg06cBOyDK8ok=";
+  cargoHash = "sha256-yM7ueeYvJANBOaV/j7tlp+vVke/C2FepZ5Sd1IIqYX8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/se/selene/package.nix b/pkgs/by-name/se/selene/package.nix
index b19324ca4bbb..070a5668835b 100644
--- a/pkgs/by-name/se/selene/package.nix
+++ b/pkgs/by-name/se/selene/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "selene";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = "selene";
     tag = finalAttrs.version;
-    hash = "sha256-zsqgLE9igxGGjymMJSt6JR453bw63TWeZwRVmkDm6ag=";
+    hash = "sha256-6NjEE5r9vILnWIyALN8b3aiYWJ9hGzAoYEv+lxNL32Y=";
   };
 
-  cargoHash = "sha256-RxIDFE+FGKUDvM1Fy/doSy/mf2JuklhoMGpSqoHhAV4=";
+  cargoHash = "sha256-0BZroMbaRtpfOf2p33S830T2V+/eobezX0HVsZ/qtnI=";
 
   nativeBuildInputs = lib.optionals robloxSupport [
     pkg-config
diff --git a/pkgs/by-name/sg/sgfutils/gcc-15.patch b/pkgs/by-name/sg/sgfutils/gcc-15.patch
new file mode 100644
index 000000000000..d1f74ec30596
--- /dev/null
+++ b/pkgs/by-name/sg/sgfutils/gcc-15.patch
@@ -0,0 +1,26 @@
+Generated as:
+$ curl -L https://github.com/yangboz/sgfutils/pull/3.diff > gcc-15.patch
+
+Fix `gcc-15` build failure related to `c23` changes.
+--- a/gib2sgf.c
++++ b/gib2sgf.c
+@@ -433,7 +433,7 @@ static void stoline(char *buf) {
+ 	readmove(buf);
+ }
+ 
+-static void (*inputline[])() = {
++static void (*inputline[])(char*) = {
+ 	inline0, inline1, iniline, stoline
+ };
+ 
+--- a/sgfinfo.c
++++ b/sgfinfo.c
+@@ -940,7 +940,7 @@ void report_on_single_game() {
+ 	if (optM) {
+ 		int imin, imax;
+ 		void (*fns[3])(int) = { outmove, outmovec, outmovex };
+-		void (*outmovefn)();
++		void (*outmovefn)(int);
+ 
+ 		/* 1..3 moves / 4..6 init / 7..9 both */
+ 		imin = ((optM < 4) ? initct : 0);
diff --git a/pkgs/by-name/sg/sgfutils/package.nix b/pkgs/by-name/sg/sgfutils/package.nix
index 2658be5957fd..138de47b1987 100644
--- a/pkgs/by-name/sg/sgfutils/package.nix
+++ b/pkgs/by-name/sg/sgfutils/package.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation {
     rev = "11ab171c46cc16cc71ac6fc901d38ea88d6532a4";
     hash = "sha256-KWYgTxz32WK3MKouj1WAJtZmleKt5giCpzQPwfWruZQ=";
   };
+  patches = [
+    # FIx gcc-15 build failure: https://github.com/yangboz/sgfutils/pull/3
+    ./gcc-15.patch
+  ];
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
   buildPhase = ''
diff --git a/pkgs/by-name/si/sidplayfp/package.nix b/pkgs/by-name/si/sidplayfp/package.nix
index 348defd9f2eb..32ce3435122a 100644
--- a/pkgs/by-name/si/sidplayfp/package.nix
+++ b/pkgs/by-name/si/sidplayfp/package.nix
@@ -3,6 +3,7 @@
   lib,
   fetchFromGitHub,
   gitUpdater,
+  runCommand,
   testers,
   alsaSupport ? stdenv.hostPlatform.isLinux,
   alsa-lib,
@@ -10,6 +11,7 @@
   pulseSupport ? stdenv.hostPlatform.isLinux,
   libpulseaudio,
   libsidplayfp,
+  makeWrapper,
   out123Support ? stdenv.hostPlatform.isDarwin,
   mpg123,
   perl,
@@ -18,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sidplayfp";
-  version = "2.16.1";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "sidplayfp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W9RuAUlnMMG/ihUxM5wvFDJz0x+6Syk+8ux+dx0Bnw8=";
+    hash = "sha256-zvV1BIKkJF/UAZnSgHFqNSiioUH5iB8I7SDqnWQnGj0=";
   };
 
   strictDeps = true;
@@ -56,7 +58,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
+      package =
+        # sidplayfp prints its own version + libsidplayfp version, lets isolate just the one we care about
+        runCommand "sidplayfp-print-version"
+          {
+            inherit (finalAttrs.finalPackage) pname version meta;
+            nativeBuildInputs = [ makeWrapper ];
+          }
+          ''
+            makeWrapper ${lib.getExe finalAttrs.finalPackage} $out/bin/${finalAttrs.finalPackage.meta.mainProgram} \
+              --append-flags '| head -n1'
+          '';
     };
     updateScript = gitUpdater {
       rev-prefix = "v";
diff --git a/pkgs/by-name/si/sirikali/package.nix b/pkgs/by-name/si/sirikali/package.nix
index e374f7ccdcb7..29f4d407479f 100644
--- a/pkgs/by-name/si/sirikali/package.nix
+++ b/pkgs/by-name/si/sirikali/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sirikali";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "mhogomchungu";
     repo = "sirikali";
     rev = finalAttrs.version;
-    hash = "sha256-OaZrgX6zxp1ZP72xiBl0+h0nAQb1Z1eiqaSYdtxsDzQ=";
+    hash = "sha256-x3YCnIAPAJ5mOUboo+8Wg8ePyPYKoO++aSh3nSOj00I=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index 61974e2758e8..3ba274d94136 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "snx-rs";
-  version = "5.1.0";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-whmZM6OYdHtcTJzzR4aqDMBVpFuRvJKLFVGCQNDjRw8=";
+    hash = "sha256-MGgvpFpcAkwZlFXkz5oEYarU1/9qBuUGGvFqaGi/teU=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
 
-  cargoHash = "sha256-gAOxwmsPo0XpFxNe3EObNlgiTJ0krMAlVaTDorrYUqg=";
+  cargoHash = "sha256-0tfNqRM6AwBokZ4rHhQmtAYggslEMqTKJitJ9qbid4Y=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";
diff --git a/pkgs/by-name/st/stremio/package.nix b/pkgs/by-name/st/stremio/package.nix
deleted file mode 100644
index 55b5ce50284c..000000000000
--- a/pkgs/by-name/st/stremio/package.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchurl,
-  libsForQt5,
-  ffmpeg,
-  mpv,
-  nodejs,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "stremio-shell";
-  version = "4.4.168";
-
-  src = fetchFromGitHub {
-    owner = "Stremio";
-    repo = "stremio-shell";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-pz1mie0kJov06GcyitvZu5Gg0Vz3YnigjDqFujGKqZM=";
-    fetchSubmodules = true;
-    meta.license = lib.licenses.gpl3Only;
-  };
-
-  # check server-url.txt
-  server = fetchurl rec {
-    pname = "stremio-server";
-    version = "4.20.8";
-    url = "https://dl.strem.io/server/v${version}/desktop/server.js";
-    hash = "sha256-cRMgD1d1yVj9FBvFAqgIqwDr+7U3maE8OrCsqExftHY=";
-    meta.license = lib.licenses.unfree;
-  };
-
-  buildInputs = [
-    libsForQt5.qt5.qtwebengine
-    mpv
-  ];
-
-  nativeBuildInputs = [
-    libsForQt5.qmake
-    libsForQt5.qt5.wrapQtAppsHook
-  ];
-
-  postInstall = ''
-    mkdir -p $out/{bin,share/applications}
-    ln -s $out/opt/stremio/stremio $out/bin/stremio
-    mv $out/opt/stremio/smartcode-stremio.desktop $out/share/applications
-    install -Dm 644 images/stremio_window.png $out/share/pixmaps/smartcode-stremio.png
-    ln -s ${nodejs}/bin/node $out/opt/stremio/node
-    ln -s $server $out/opt/stremio/server.js
-    wrapProgram $out/bin/stremio \
-      --suffix PATH ":" ${lib.makeBinPath [ ffmpeg ]}
-  '';
-
-  meta = {
-    mainProgram = "stremio";
-    description = "Modern media center that gives you the freedom to watch everything you want";
-    homepage = "https://www.stremio.com/";
-    # (Server-side) 4.x versions of the web UI are closed-source
-    license = with lib.licenses; [
-      gpl3Only
-      # server.js is unfree
-      unfree
-    ];
-    maintainers = with lib.maintainers; [
-      griffi-gh
-    ];
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/sw/swaybg/package.nix b/pkgs/by-name/sw/swaybg/package.nix
index 40b3455a359f..7c8cd1d8622e 100644
--- a/pkgs/by-name/sw/swaybg/package.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  buildPackages,
   fetchFromGitHub,
   meson,
   ninja,
@@ -53,8 +54,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dman-pages=enabled"
   ];
 
+  # Fortify causes header errors in ssp
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isFreeBSD [ "fortify" ];
+
   # add support for webp
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
     export GDK_PIXBUF_MODULE_FILE="${
       gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
         extraLoaders = [
@@ -79,6 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       ryan4yin
     ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.freebsd;
   };
 })
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index bfc8f4d1e490..9b6ccadb996f 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "templ";
-  version = "0.3.977";
+  version = "0.3.1001";
 
   src = fetchFromGitHub {
     owner = "a-h";
     repo = "templ";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KABEveISMy31B4kXoYY5IwFouoI4L9Jco5qMcnpeL2s=";
+    hash = "sha256-146QxN+osvlzp8NTGm5TN2yvbu3cOodXfIVeIKsS+7I=";
   };
 
   vendorHash = "sha256-pVZjZCXT/xhBCMyZdR7kEmB9jqhTwRISFp63bQf6w5A=";
diff --git a/pkgs/by-name/te/tev/package.nix b/pkgs/by-name/te/tev/package.nix
index a851e34dcb65..9479653c736f 100644
--- a/pkgs/by-name/te/tev/package.nix
+++ b/pkgs/by-name/te/tev/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = "tev";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-833iKblvIwMADXvzpJS8z2y+3b0puvyw3IFilrlylk8=";
+    hash = "sha256-o8ejMsaiplnTLiWtjaJnV9z2ZNkiOWy3DLU+x49MJrg=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux (
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index a9354e903191..e846362e50e6 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_39,
+  electron_40,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.101.3";
+  version = "0.102.0";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-+Q0RfWa9wl0SEb5hiT9q9+careuLgZh7Bgpi8HuUFyA=";
-  aarch64-linux.hash = "sha256-r8CJBBiSzgNpZ5K3FKwKR84xqm90pxgBEj1NVbRfQos=";
-  x86_64-darwin.hash = "sha256-oprNyKQs8sPPrm67SyTxvlgGuRKJ0OcVJ4OGAsOT6rQ=";
-  aarch64-darwin.hash = "sha256-1VXeU+a1tw4fhlZX0r88BkIo/wXBvWEFBzloBjVvouk=";
+  x86_64-linux.hash = "sha256-/M7Quq7tgnrp/x7845fA041snC4ybIxculA3IXah5zs=";
+  aarch64-linux.hash = "sha256-9ONccvxAhPrO3Sj1wSlb93G0zrtEiD4jD0vyr3W11X0=";
+  x86_64-darwin.hash = "sha256-yaxv5LynfCOdNMHjmV3uFDBzlxtSZCDOFnUV577z8N8=";
+  aarch64-darwin.hash = "sha256-Rr3da4R/7rT5ippGE38RWOGT+W0yXp5S43Mo1nFdzMw=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
@@ -111,7 +111,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_39} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_40} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar
diff --git a/pkgs/by-name/tr/trilium-desktop/update.sh b/pkgs/by-name/tr/trilium-desktop/update.sh
index eefaa8c308b2..13f217de8426 100755
--- a/pkgs/by-name/tr/trilium-desktop/update.sh
+++ b/pkgs/by-name/tr/trilium-desktop/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq
+#!nix-shell -i bash -p coreutils curl jq gnused
 set -euo pipefail
 
 cd $(dirname "${BASH_SOURCE[0]}")
@@ -8,7 +8,11 @@ setKV () {
     sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
 }
 
-version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
+curl_github() {
+    curl -s --show-error -L ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
+}
+
+version=$(curl_github "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
 setKV ./package.nix version $version
 
 # Update desktop application
@@ -20,6 +24,8 @@ setKV ./package.nix x86_64-linux.hash $sha256_linux64
 setKV ./package.nix aarch64-linux.hash $sha256_linux64_arm
 setKV ./package.nix x86_64-darwin.hash $sha256_darwin64
 setKV ./package.nix aarch64-darwin.hash $sha256_darwin64_arm
+electronVersion=$(curl_github "https://raw.githubusercontent.com/TriliumNext/Trilium/v$version/apps/desktop/package.json" | jq -r ".devDependencies.electron" | sed -r 's|^\^?([0-9]+).*|\1|')
+sed -r "s|(electron_)[0-9]+|\1$electronVersion|" -i ./package.nix
 
 # Update server
 sha256_linux64_server=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz | jq -r .hash)
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index a7b116f604ed..2ea9e4847a1e 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.101.3";
+  version = "0.102.0";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-WbEv3B1axs8UI7uj4JRW0hQKEfkKfiLxtQWbNgiYeos=";
+  serverSource_x64.hash = "sha256-EC4Ige8ox2+twzpsQcT0DDjZlP74zpHSk2IAK6txcJs=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-k1mtBqw6BGqe7/kwoMl8N01BShVRTxMxnTxkYkwGbCc=";
+  serverSource_arm64.hash = "sha256-uXFm5mzkYeupSTUnBgnyBa9oEP6px0ATINEN0imQbdw=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
diff --git a/pkgs/by-name/tt/ttdl/package.nix b/pkgs/by-name/tt/ttdl/package.nix
index 0767888960fb..99105ff48404 100644
--- a/pkgs/by-name/tt/ttdl/package.nix
+++ b/pkgs/by-name/tt/ttdl/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ttdl";
-  version = "4.23.0";
+  version = "4.24.1";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-a7roS7eCh6p3hoWmUaeMWinqyJe2g3iI2hQeNxJx9lc=";
+    sha256 = "sha256-tfyfFwHnIS5nCYobVu49AmjVKvxhngqD5woxyiv5FEc=";
   };
 
-  cargoHash = "sha256-gLZlzOJxGmwWzmhVggw/SyfJUR7QVIZz5rcHbQFHG3E=";
+  cargoHash = "sha256-XH/F0ffWmIvesR0sA+AdnLV3IaLWrgin4YDJtkfbVDI=";
 
   meta = {
     description = "CLI tool to manage todo lists in todo.txt format";
diff --git a/pkgs/by-name/vi/vice/package.nix b/pkgs/by-name/vi/vice/package.nix
index ac958fb50f26..0c33d3c89667 100644
--- a/pkgs/by-name/vi/vice/package.nix
+++ b/pkgs/by-name/vi/vice/package.nix
@@ -18,52 +18,55 @@
   SDL,
   SDL_image,
   dos2unix,
-  runtimeShell,
   xa,
   file,
   wrapGAppsHook3,
   xdg-utils,
   libevdev,
   pulseaudio,
+  desktop-file-utils,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vice";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/vice-emu/vice-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-QCArY0VeJrh+zGPrWlIyLG+j9XyrEqzwwifPn02uw3A=";
+    sha256 = "sha256-jlusGMvLnxkjgK0++IH4eQ9bdcQdez2mXYMZhdhk1tE=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     bison
+    desktop-file-utils
     dos2unix
     file
     flex
+    perl
     pkg-config
     wrapGAppsHook3
+    xa
+    xdg-utils
   ];
 
   buildInputs = [
     alsa-lib
     curl
     giflib
-    gtk3
     glew
+    gtk3
+    libevdev
     libGL
     libGLU
     libpng
-    perl
+    pulseaudio
     readline
     SDL
     SDL_image
-    xa
-    xdg-utils
-    libevdev
-    pulseaudio
   ];
-  dontDisableStatic = true;
+
   configureFlags = [
     "--enable-sdl2ui"
     "--enable-gtk3ui"
@@ -74,19 +77,32 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.LIBS = "-lGL";
 
-  preBuild = ''
-    sed -i -e 's|#!/usr/bin/env bash|${runtimeShell}/bin/bash|' src/arch/gtk3/novte/box_drawing_generate.sh
+  preConfigure = ''
+    patchShebangs .
+  '';
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    # env var for `desktop-file-install`
+    export DESKTOP_FILE_INSTALL_DIR=$out/share/applications
+    mkdir -p $DESKTOP_FILE_INSTALL_DIR
   '';
 
   postInstall = ''
-    mkdir -p $out/share/applications
-    cp src/arch/gtk3/data/unix/vice-org-*.desktop $out/share/applications
+    for binary in vsid x128 x64 x64dtv xcbm2 xpet xplus4 xscpu64 xvic; do
+      for size in 16 24 32 48 64 256; do
+        install -D data/common/vice-''${binary}_''${size}.png $out/share/icons/hicolor/''${size}x''${size}/apps/vice-''${binary}.png
+      done
+      install -D data/common/vice-''${binary}_1024.svg $out/share/icons/hicolor/scalable/apps/vice-''${binary}.svg
+    done
   '';
 
   meta = {
     description = "Emulators for a variety of 8-bit Commodore computers";
     homepage = "https://vice-emu.sourceforge.io/";
     license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.nekowinston ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index 9e5e9f22a94e..a333943060ac 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -19,16 +19,17 @@
   stdenv,
   wayland,
   libxml2,
+  udevCheckHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mUHV5wFbtNt00XnghklltvJ/LRi+17fluGuFebQ0HEw=";
+    hash = "sha256-9xE2izQakApB+cgibErwyY3KAlc6F26UhgCw/Tak43c=";
   };
 
   apiDeps = fetchNpmDeps {
@@ -104,6 +105,9 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "ExecStart=vicinae" "ExecStart=$out/bin/vicinae"
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ udevCheckHook ];
+
   passthru.updateScript = ./update.sh;
 
   meta = {
diff --git a/pkgs/by-name/vu/vue-language-server/package.nix b/pkgs/by-name/vu/vue-language-server/package.nix
index efaf36d47cee..8143c12ae141 100644
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -11,19 +11,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "vuejs";
     repo = "language-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GxIIqRK8wBVlo8jvCox6Fdp705EMg1YoHB46bvs5kkE=";
+    hash = "sha256-WvxZz3Rtv1AWWVJjPiUaddoyBQXUsnucg/QXCKtNXbk=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-QLey523pqhjOBn4xhN9mZTKRAC96imVka+li7C4BXQY=";
+    hash = "sha256-rc0oq+dujIhCa+axSj5RjXsHKzh5BCpNAJ6w1vnCtt8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/weechat-matrix-rs/package.nix b/pkgs/by-name/we/weechat-matrix-rs/package.nix
new file mode 100644
index 000000000000..0baaef3fe0eb
--- /dev/null
+++ b/pkgs/by-name/we/weechat-matrix-rs/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  weechat,
+  openssl,
+  sqlite,
+  runCommand,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "weechat-matrix-rs";
+  version = "0-unstable-2025-10-09";
+  src = fetchFromGitHub {
+    owner = "poljar";
+    repo = "weechat-matrix-rs";
+    rev = "4cc5777b630ba4d6a9c964248531f283178a4717";
+    hash = "sha256-CF4xDoRYey9F8/XSW/euNb8IjZXyP6k0Nj61shsmyEo=";
+  };
+  cargoHash = "sha256-jAlBCmLJfWWAUHd3ySB930iqAVXMh6ueba7xS///Rt0=";
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+  buildInputs = [
+    weechat
+    openssl
+    sqlite
+  ];
+  postInstall = ''
+    mkdir -p $out/lib/weechat/plugins
+    mv $out/lib/libmatrix${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/weechat/plugins/matrix${stdenv.hostPlatform.extensions.sharedLibrary}
+  '';
+  passthru.tests.load-plugin =
+    runCommand "${finalAttrs.pname}-test-load"
+      {
+        nativeBuildInputs = [ weechat ];
+      }
+      ''
+        weechat -t -d "$(mktemp -d)" \
+         --run-command "/plugin load ${finalAttrs.finalPackage}/lib/weechat/plugins/matrix${stdenv.hostPlatform.extensions.sharedLibrary} ; /quit" \
+         2>&1 | tee log
+        if grep -q 'Plugin "matrix" loaded' log; then
+          echo "Check passed: matrix plugin loaded into WeeChat."
+          touch $out
+        else
+          echo "Check failed: 'matrix' not found in WeeChat output."
+          exit 1
+        fi
+      '';
+  meta = {
+    description = "Rust plugin for WeeChat to communicate over Matrix";
+    homepage = "https://github.com/poljar/weechat-matrix-rs";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ zodman ];
+    platforms = lib.platforms.unix;
+  };
+
+})
diff --git a/pkgs/by-name/wi/wiki-go/package.nix b/pkgs/by-name/wi/wiki-go/package.nix
index 88f2b0c9ad69..756c21dcb0ab 100644
--- a/pkgs/by-name/wi/wiki-go/package.nix
+++ b/pkgs/by-name/wi/wiki-go/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "wiki-go";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "leomoon-studios";
     repo = "wiki-go";
     tag = "v${version}";
-    hash = "sha256-bZ1lOLjlx0wxpjM/baBiWljBonv62N7sVQjeiSc975k=";
+    hash = "sha256-6GgX2wEaQvW5ccayavbQ4FV3yQKUdcsbUfmLrO4Jxng=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xp/xpipe/package.nix b/pkgs/by-name/xp/xpipe/package.nix
index 86cced5fd073..2be8bedc99f4 100644
--- a/pkgs/by-name/xp/xpipe/package.nix
+++ b/pkgs/by-name/xp/xpipe/package.nix
@@ -39,7 +39,7 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-+sBAEtt4GFzzxQm+DH7Em+m1E89QQKKhIcuCA69FaXg=";
+      x86_64-linux = "sha256-72pXA+r9xMY1DeO9/NgvQGGI6BrQE84HfsFKqu2G6XQ=";
     }
     .${system} or throwSystem;
 
@@ -48,7 +48,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "21.3";
+  version = "21.4";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
diff --git a/pkgs/by-name/xw/xwayland-run/package.nix b/pkgs/by-name/xw/xwayland-run/package.nix
index f6fc6ff93615..aeb5c2048efb 100644
--- a/pkgs/by-name/xw/xwayland-run/package.nix
+++ b/pkgs/by-name/xw/xwayland-run/package.nix
@@ -12,9 +12,12 @@
   withKwin ? false,
   kdePackages,
   withMutter ? false,
-  gnome,
+  mutter,
   withDbus ? withMutter,
+  phoc,
+  withPhoc ? false,
   dbus, # Since 0.0.3, mutter compositors run with their own DBUS sessions
+  xwayland-run,
 }:
 let
   compositors = [
@@ -22,19 +25,20 @@ let
   ]
   ++ lib.optional withCage cage
   ++ lib.optional withKwin kdePackages.kwin
-  ++ lib.optional withMutter gnome.mutter
+  ++ lib.optional withMutter mutter
+  ++ lib.optional withPhoc phoc
   ++ lib.optional withDbus dbus;
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xwayland-run";
-  version = "0.0.4";
+  version = "0.0.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "ofourdan";
     repo = "xwayland-run";
     rev = finalAttrs.version;
-    hash = "sha256-FP/2KNPehZEGKXr+fKdVj4DXzRMpfc3x7K6vH6ZsGdo=";
+    hash = "sha256-TVoMbFQ5OIJkTX3/tuwylW+Bdx/gl1omObj0c3JjICM=";
   };
 
   pyproject = false;
@@ -71,6 +75,15 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       }
   '';
 
+  passthru.tests = {
+    build = xwayland-run.override {
+      withCage = true;
+      withKwin = true;
+      withMutter = true;
+      withPhoc = true;
+    };
+  };
+
   meta = {
     changelog = "https://gitlab.freedesktop.org/ofourdan/xwayland-run/-/releases/${finalAttrs.src.rev}";
     description = "Set of small utilities revolving around running Xwayland and various Wayland compositor headless";
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index fe3cf78432c8..2350b2972e6b 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EEvy0UtmBlgC3b57SOwr7dI49R7PYeFqsZKyzo0zx9w=";
+    hash = "sha256-gGkBmJoUa9WiIozSwhe18N8i5uSiKsSQ3J1NAT41ro4=";
   };
 
-  cargoHash = "sha256-ihNFGlPhPLCIDvFnMqKA+flD/mv9wcKgQ1txO71xOp4=";
+  cargoHash = "sha256-j+sIxYPvkI1EnAN7LcBoS4m04rYdKlK48tGO0uFa7KU=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/ze/zeroclaw/package.nix b/pkgs/by-name/ze/zeroclaw/package.nix
index 1d24f1e92816..454cf0b435ca 100644
--- a/pkgs/by-name/ze/zeroclaw/package.nix
+++ b/pkgs/by-name/ze/zeroclaw/package.nix
@@ -9,17 +9,18 @@
   writableTmpDirAsHomeHook,
   gitMinimal,
   versionCheckHook,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeroclaw";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "zeroclaw-labs";
     repo = "zeroclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D4/2h7TlOwAU4tl1xcdULRfO21KmP+zLlqQ8DzLqnjQ=";
+    hash = "sha256-6EVUk+wp3Rjhk/q2htXq41TMD+rGFO0nJbVWNbLWj5U=";
   };
 
   postPatch =
@@ -31,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ln -s ${zeroclaw-web} web/dist
     '';
 
-  cargoHash = "sha256-sbC+fdMzjrx0dF5zHBHzMgZeIPQth1oXNqilooVZF8s=";
+  cargoHash = "sha256-pJbWbqbvO2CF0jKhfD8VK9z+Gn9vY1UR4OV+XMt1n80=";
 
   nativeBuildInputs = [
     pkg-config
@@ -56,6 +57,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Fast, small, and fully autonomous AI assistant infrastructure — deploy anywhere, swap anything";
     homepage = "https://github.com/zeroclaw-labs/zeroclaw";
diff --git a/pkgs/by-name/zo/zotero-beta/package.nix b/pkgs/by-name/zo/zotero-beta/package.nix
deleted file mode 100644
index 72bbb8df0058..000000000000
--- a/pkgs/by-name/zo/zotero-beta/package.nix
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  wrapGAppsHook3,
-  makeDesktopItem,
-  alsa-lib,
-  atk,
-  cairo,
-  dbus-glib,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  libGL,
-  libxtst,
-  libxrandr,
-  libxi,
-  libxfixes,
-  libxext,
-  libxdamage,
-  libxcursor,
-  libxcomposite,
-  libx11,
-  libxcb,
-  libgbm,
-  pango,
-  pciutils,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "zotero";
-  version = "7.0.0-beta.111+b4f6c050e";
-
-  src =
-    let
-      escapedVersion = lib.replaceStrings [ "+" ] [ "%2B" ] finalAttrs.version;
-    in
-    fetchurl {
-      url = "https://download.zotero.org/client/beta/${escapedVersion}/Zotero-${escapedVersion}_linux-x86_64.tar.bz2";
-      hash = "sha256-pZsmS4gKCT8UAjz9IJg5C7n4kk7bWT/7H5ONF20CzPM=";
-    };
-
-  dontPatchELF = true;
-  nativeBuildInputs = [ wrapGAppsHook3 ];
-
-  libPath =
-    lib.makeLibraryPath [
-      alsa-lib
-      atk
-      cairo
-      dbus-glib
-      gdk-pixbuf
-      glib
-      gtk3
-      libGL
-      libx11
-      libxcomposite
-      libxcursor
-      libxdamage
-      libxext
-      libxfixes
-      libxi
-      libxrandr
-      libxtst
-      libxcb
-      libgbm
-      pango
-      pciutils
-    ]
-    + ":"
-    + lib.makeSearchPathOutput "lib" "lib" [ stdenv.cc.cc ];
-
-  desktopItem = makeDesktopItem {
-    name = "zotero";
-    exec = "zotero -url %U";
-    icon = "zotero";
-    comment = finalAttrs.meta.description;
-    desktopName = "Zotero";
-    genericName = "Reference Management";
-    categories = [
-      "Office"
-      "Database"
-    ];
-    startupNotify = true;
-    mimeTypes = [
-      "x-scheme-handler/zotero"
-      "text/plain"
-    ];
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    # Copy package contents to the output directory
-    mkdir -p "$prefix/usr/lib/zotero-bin-${finalAttrs.version}"
-    cp -r * "$prefix/usr/lib/zotero-bin-${finalAttrs.version}"
-    mkdir -p "$out/bin"
-    ln -s "$prefix/usr/lib/zotero-bin-${finalAttrs.version}/zotero" "$out/bin/"
-
-    # Install desktop file and icons
-    mkdir -p $out/share/applications
-    cp ${finalAttrs.desktopItem}/share/applications/* $out/share/applications/
-    for size in 32 64 128; do
-      install -Dm444 icons/icon''${size}.png \
-        $out/share/icons/hicolor/''${size}x''${size}/apps/zotero.png
-    done
-    install -Dm444 icons/symbolic.svg \
-      $out/share/icons/hicolor/symbolic/apps/zotero-symbolic.svg
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    for executable in \
-      zotero-bin plugin-container updater vaapitest \
-      minidump-analyzer glxtest
-    do
-      if [ -e "$out/usr/lib/zotero-bin-${finalAttrs.version}/$executable" ]; then
-        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          "$out/usr/lib/zotero-bin-${finalAttrs.version}/$executable"
-      fi
-    done
-    find . -executable -type f -exec \
-      patchelf --set-rpath "$libPath" \
-        "$out/usr/lib/zotero-bin-${finalAttrs.version}/{}" \;
-  '';
-
-  meta = {
-    homepage = "https://www.zotero.org";
-    description = "Collect, organize, cite, and share your research sources";
-    mainProgram = "zotero";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.agpl3Only;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [
-      justanotherariel
-    ];
-  };
-})
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2f97f6fbc6f0..ea11b6058949 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -47,10 +47,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "14";
+        patch = "15";
         suffix = "";
       };
-      hash = "sha256-jT7Y7FyIwclfXlWGEqclRQ0kUoE92tXlj9saU7Egm3g=";
+      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
       inherit passthruFun;
     };
 
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "12";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-+4WhNBSwKMSboYu9UjwtBVowtWsYuSzkVOosUe3GVsQ=";
+      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 798be764047c..397834bfbc6a 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -26,7 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "ncurses" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   src = fetchurl {
-    url = "https://invisible-island.net/archives/ncurses/ncurses-${finalAttrs.version}.tar.gz";
+    urls = [
+      "https://invisible-island.net/archives/ncurses/ncurses-${finalAttrs.version}.tar.gz"
+      # invisible-island.net may be firewall blocked on some networks
+      "https://invisible-mirror.net/archives/ncurses/ncurses-${finalAttrs.version}.tar.gz"
+    ];
     hash = "sha256-NVtMu+2ICwOBoExGYXt2VuNiWF1S6c+Epn4gCbdJ/xE=";
   };
 
diff --git a/pkgs/development/python-modules/coiled/default.nix b/pkgs/development/python-modules/coiled/default.nix
index 46021a130bc4..b0664b74edde 100644
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@@ -39,12 +39,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "coiled";
-  version = "1.131.0";
+  version = "1.132.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-rokc9qDfWymnuwLoLHPJHpKc4ekwO7EPbSd3WuN4Xgg=";
+    hash = "sha256-VEyXOCiKANzf34ZjPZ3JGj4rvHkninF9sG5NTUVjONI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/exllamav3/default.nix b/pkgs/development/python-modules/exllamav3/default.nix
index 51caa30ecf13..d11a44c9f0a3 100644
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -27,14 +27,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "exllamav3";
-  version = "0.0.20";
+  version = "0.0.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G3PtxKU/J4JEQQOwFmrSWuSr/hA4uyxRci3khXCwEqE=";
+    hash = "sha256-wAT+zntPxjIjrXaa2ZJpjImRt1V8vFqWfSNjgZYGGJk=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/fasthtml/default.nix b/pkgs/development/python-modules/fasthtml/default.nix
index cc939fda4141..3f47dd2ce5a7 100644
--- a/pkgs/development/python-modules/fasthtml/default.nix
+++ b/pkgs/development/python-modules/fasthtml/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fasthtml";
-  version = "0.12.47";
+  version = "0.12.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fasthtml";
     tag = finalAttrs.version;
-    hash = "sha256-dlG6pOVsd9RSmy/rgr7lUANRllND4tZDnsOecsI4bh8=";
+    hash = "sha256-lMAuIw4sMkS3XSG/0Bs0iQPSjMusbmjUKv0w4cINwas=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/inscriptis/default.nix b/pkgs/development/python-modules/inscriptis/default.nix
index 57318a912e09..3fb1e747349c 100644
--- a/pkgs/development/python-modules/inscriptis/default.nix
+++ b/pkgs/development/python-modules/inscriptis/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "inscriptis";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "weblyzard";
     repo = "inscriptis";
     tag = version;
-    hash = "sha256-m1LZiGu79I9fMQXtL1MuzHxUd6KSwuc87Edkt9sp0DE=";
+    hash = "sha256-hNNPY2/SroVQnf04SJ/2yYorBgQJk6d0X616+w41Y1c=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/monarchmoney/default.nix b/pkgs/development/python-modules/monarchmoney/default.nix
deleted file mode 100644
index aa59035ecda6..000000000000
--- a/pkgs/development/python-modules/monarchmoney/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  aiohttp,
-  gql,
-  oathtool,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "monarchmoney";
-  version = "0.1.15";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "hammem";
-    repo = "monarchmoney";
-    tag = "v${version}";
-    hash = "sha256-I5YCINwJqzdntVGn8T8Yx/cfWOtwgwvyt30swBLQHDo=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    aiohttp
-    gql
-    oathtool
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "monarchmoney" ];
-
-  meta = {
-    description = "Python API for Monarch Money";
-    homepage = "https://github.com/hammem/monarchmoney";
-    changelog = "https://github.com/hammem/monarchmoney/releases/tag/v${version}";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/development/python-modules/monarchmoneycommunity/default.nix b/pkgs/development/python-modules/monarchmoneycommunity/default.nix
new file mode 100644
index 000000000000..a24baf51897f
--- /dev/null
+++ b/pkgs/development/python-modules/monarchmoneycommunity/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  gql,
+  oathtool,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "monarchmoneycommunity";
+  version = "1.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bradleyseanf";
+    repo = "monarchmoneycommunity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xJKsA6YCcwWeqGiNYuMUjrPnj1kYtR6odB/JU1vZ/3c=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    gql
+    oathtool
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "monarchmoney" ];
+
+  meta = {
+    description = "Monarch Money API for Python";
+    homepage = "https://github.com/bradleyseanf/monarchmoneycommunity";
+    changelog = "https://github.com/bradleyseanf/monarchmoneycommunity/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/paddlepaddle/default.nix b/pkgs/development/python-modules/paddlepaddle/default.nix
index 5f29ff5330a2..b43ed3795ee3 100644
--- a/pkgs/development/python-modules/paddlepaddle/default.nix
+++ b/pkgs/development/python-modules/paddlepaddle/default.nix
@@ -74,7 +74,7 @@ buildPythonPackage {
   buildInputs = lib.optionals cudaSupport [ rdma-core ];
 
   pythonRelaxDeps = [
-    opt-einsum
+    "opt_einsum"
   ];
 
   dependencies = [
@@ -135,7 +135,6 @@ buildPythonPackage {
   passthru.updateScript = ./update.sh;
 
   meta = {
-    broken = true;
     description = "Machine Learning Framework from Industrial Practice";
     homepage = "https://github.com/PaddlePaddle/Paddle";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/pyqwikswitch/default.nix b/pkgs/development/python-modules/pyqwikswitch/default.nix
index 5f7ceb36511c..0a22ec145f06 100644
--- a/pkgs/development/python-modules/pyqwikswitch/default.nix
+++ b/pkgs/development/python-modules/pyqwikswitch/default.nix
@@ -1,56 +1,50 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchpatch,
+  fetchPypi,
   attrs,
-  aiohttp,
-  uv-build,
-  aioresponses,
-  pytest-asyncio,
-  pytest-cov-stub,
-  pytestCheckHook,
+  requests,
+  setuptools,
 }:
 
-buildPythonPackage (finalAttrs: {
+buildPythonPackage rec {
   pname = "pyqwikswitch";
-  version = "1.0.2";
+  version = "0.94";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "kellerza";
-    repo = "pyqwikswitch";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-yx3rCPVuhsemAtFuEhPvFPHOFm2UWrXmWF3d/ZtPGo8=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-IpyWz+3EMr0I+xULBJJhBgdnQHNPJIM1SqKFLpszhQc=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "uv-build>=0.8.20,<0.9" uv-build
-  '';
+  patches = [
+    # https://github.com/kellerza/pyqwikswitch/pull/7
+    (fetchpatch {
+      name = "replace-async-timeout-with-asyncio.timeout.patch";
+      url = "https://github.com/kellerza/pyqwikswitch/commit/7b3f2211962b30bb6beea9a4fe17cd04cdf8e27f.patch";
+      hash = "sha256-sdO5jzIgKdneNY5dTngIzUFtyRg7HBGaZA1BBeAJxu4=";
+    })
+  ];
 
-  build-system = [ uv-build ];
+  build-system = [ setuptools ];
 
   dependencies = [
-    aiohttp
     attrs
+    requests
   ];
 
   pythonImportsCheck = [
     "pyqwikswitch"
+    "pyqwikswitch.threaded"
   ];
 
-  nativeCheckInputs = [
-    aioresponses
-    pytest-asyncio
-    pytest-cov-stub
-    pytestCheckHook
-  ];
+  doCheck = false; # no tests in sdist
 
   meta = {
-    changelog = "https://github.com/kellerza/pyqwikswitch/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "QwikSwitch USB Modem API binding for Python";
     homepage = "https://github.com/kellerza/pyqwikswitch";
     license = lib.licenses.mit;
     teams = [ lib.teams.home-assistant ];
   };
-})
+}
diff --git a/pkgs/development/python-modules/python-tado/default.nix b/pkgs/development/python-modules/python-tado/default.nix
index 890dc22bd703..90cba957bc02 100644
--- a/pkgs/development/python-modules/python-tado/default.nix
+++ b/pkgs/development/python-modules/python-tado/default.nix
@@ -2,35 +2,33 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
   pytest-cov-stub,
   pytest-mock,
-  pytest-socket,
   pytestCheckHook,
   requests,
   responses,
+  setuptools,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "python-tado";
-  version = "0.19.2";
+  version = "0.18.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wmalgadey";
     repo = "PyTado";
     tag = finalAttrs.version;
-    hash = "sha256-me62VPjKU+vh0vo4Fl86sEse1QZYD2zDpxchSiUcxTY=";
+    hash = "sha256-jHPTu0/DYJXbSqiJXQzmiK6gmtJf88Y0BV1wj/X+qpc=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   dependencies = [ requests ];
 
   nativeCheckInputs = [
     pytest-cov-stub
     pytest-mock
-    pytest-socket
     pytestCheckHook
     responses
   ];
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 0b8ee9e6a532..fdefd6d4867a 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "22.6";
+  version = "22.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-telegram-bot";
     repo = "python-telegram-bot";
     tag = "v${version}";
-    hash = "sha256-B7tG70Nzt7HKFD1n1Aq5DGGrcTyb4Df9LF31DGN4KQc=";
+    hash = "sha256-++vDura+7AkqM7gV12O2CRRQ1H7G5G22VHGo4OdyffU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/requests-ratelimiter/default.nix b/pkgs/development/python-modules/requests-ratelimiter/default.nix
index cecee5a35e69..51936c926f3e 100644
--- a/pkgs/development/python-modules/requests-ratelimiter/default.nix
+++ b/pkgs/development/python-modules/requests-ratelimiter/default.nix
@@ -10,16 +10,16 @@
   requests-cache,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "requests-ratelimiter";
-  version = "0.9.0";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JWCook";
     repo = "requests-ratelimiter";
-    tag = "v${version}";
-    hash = "sha256-jmHXD3UJwzZSLXS7NXvCM/+lOFreSqb1QIl/jvO8lWc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6Uw6JPArOzKD7va6mthumCDW/G0Yn/C1d+1VflrJ/JY=";
   };
 
   build-system = [ hatchling ];
@@ -42,8 +42,8 @@ buildPythonPackage rec {
     broken = lib.versionOlder pyrate-limiter.version "4";
     description = "Module for rate-limiting for requests";
     homepage = "https://github.com/JWCook/requests-ratelimiter";
-    changelog = "https://github.com/JWCook/requests-ratelimiter/blob/${src.tag}/HISTORY.md";
+    changelog = "https://github.com/JWCook/requests-ratelimiter/blob/${finalAttrs.src.tag}/HISTORY.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/typedmonarchmoney/default.nix b/pkgs/development/python-modules/typedmonarchmoney/default.nix
index ebde8735c40e..6035806e06f9 100644
--- a/pkgs/development/python-modules/typedmonarchmoney/default.nix
+++ b/pkgs/development/python-modules/typedmonarchmoney/default.nix
@@ -2,28 +2,28 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
-  monarchmoney,
+  hatchling,
+  monarchmoneycommunity,
   rich,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "typedmonarchmoney";
-  version = "0.4.4";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeeftor";
     repo = "monarchmoney-typed";
-    tag = "v${version}";
-    hash = "sha256-AM6d7oecKf5aG8zO3I6BGY3/rgtrdzNabCwX8AOlEs4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pe/j6UnW9N3x/TYp4VyyVTwk2hTGHLTlnEYL6MNziuw=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
-    monarchmoney
+    monarchmoneycommunity
     rich
   ];
 
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Typed wrapper around the Monarch Money API";
     homepage = "https://github.com/jeeftor/monarchmoney-typed";
-    changelog = "https://github.com/jeeftor/monarchmoney-typed/releases/tag/v${version}";
+    changelog = "https://github.com/jeeftor/monarchmoney-typed/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.jamiemagee ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index 70f2d1ae67d7..887e1a5a602d 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -371,13 +371,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "types-aiobotocore";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit (finalAttrs) version;
-    hash = "sha256-eRmenLVkNS3J75h/ob/3U6N1f9wcxUOatCHm217pDqY=";
+    hash = "sha256-jG7VRc+KHO0zveKRKXW2Bq0MojsZYN22vPyeS/fd5ic=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tcl-modules/by-name/ya/yajl-tcl/package.nix b/pkgs/development/tcl-modules/by-name/ya/yajl-tcl/package.nix
index 8230d16119d3..9b5f71c9cc97 100644
--- a/pkgs/development/tcl-modules/by-name/ya/yajl-tcl/package.nix
+++ b/pkgs/development/tcl-modules/by-name/ya/yajl-tcl/package.nix
@@ -29,6 +29,11 @@ mkTclDerivation rec {
     yajl
   ];
 
+  buildFlags = [
+    # https://github.com/flightaware/yajl-tcl/pull/45
+    "CFLAGS=-std=gnu17"
+  ];
+
   meta = {
     description = "Tcl bindings for Yet Another JSON Library";
     homepage = "https://github.com/flightaware/yajl-tcl";
diff --git a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
index 453f27399019..aa6c83e99680 100644
--- a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "jmcollin78";
   domain = "versatile_thermostat";
-  version = "9.0.2";
+  version = "9.0.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     tag = version;
-    hash = "sha256-TPV6VfWyFsJdHfZtRhs0XvyOpnpw+utzf3eZQL4aALY=";
+    hash = "sha256-nPGxC+U2NeZ6xKNJVsTkiDZ/dMenQq0BPBfGzjVchBo=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/package.nix
index 7420d5621ae1..5762e612c9fc 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "mini-media-player";
-  version = "1.16.10";
+  version = "1.16.11";
 
   src = fetchFromGitHub {
     owner = "kalkih";
     repo = "mini-media-player";
     rev = "v${version}";
-    hash = "sha256-nUZL+zYZoWjhs0Xc/3EeuwewryEl4/g3Dv70Q/85bQc=";
+    hash = "sha256-jbT+skF/WQmfPob6TZ7ff9mgnWvC9siE+WgFONXqGbw=";
   };
 
-  npmDepsHash = "sha256-GkkrPeBADjabLiCPvehR6p4Z9LRNgSPInaESd2rLC6U=";
+  npmDepsHash = "sha256-crF/KesvY5GvH14n9KrND5O7sJxsSV2Nbcod2stesvg=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index 86e5c791a886..fd220dbc6e41 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -8,6 +8,15 @@ in
     version = "2.25.2";
     hash = "sha256-+nahWuAcGWgxBM6/a2HWwDw5DkQpUt5i/CEGzTLwNQw=";
     cargoHash = "sha256-fVD+RGU/2UGVihIktKg2+eDWmlWomDOAcrY6k2XwF1c=";
+    patches = [
+      # Fix leftover boost_system references when linking miracle-wm (library no longer exists)
+      # https://github.com/canonical/mir/pull/4721
+      (fetchpatch {
+        name = "mir-tests-mirtest.pc.in-Drop-remaining-references-to-boost_system.patch";
+        url = "https://github.com/canonical/mir/commit/14d396ecef4611e9182d78890a2d908439478799.patch";
+        hash = "sha256-IpX/7lkuYwoITzOz/gF5q7TAFUg4YH0IY2fWkorIEiM=";
+      })
+    ];
   };
 
   mir_2_15 = common {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 01ed4ae0138a..b6dcba8642a3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1846,6 +1846,7 @@ mapAliases {
   StormLib = throw "'StormLib' has been renamed to/replaced by 'stormlib'"; # Converted to throw 2025-10-27
   strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry"; # Converted to throw 2025-07-19
   strawberry-qt6 = throw "strawberry-qt6 has been replaced by strawberry"; # Added 2025-07-19
+  stremio = throw "'stremio' has been removed as it depended on the vulnerable and outdated qt5 webengine. On Linux, consider using 'stremio-linux-shell' instead."; # Added 2026-02-11
   stringsWithDeps = warnAlias "'stringsWithDeps' has been removed from pkgs, use `lib.stringsWithDeps` instead" lib.stringsWithDeps; # Added 2025-10-30
   subberthehut = throw "'subberthehut' has been removed as it was unmaintained upstream"; # Added 2025-05-17
   sublime-music = throw "`sublime-music` has been removed because upstream has announced it is no longer maintained. Upstream suggests using `supersonic` instead."; # Added 2025-09-20
@@ -2442,6 +2443,7 @@ mapAliases {
   zint = throw "'zint' has been renamed to/replaced by 'zint-qt'"; # Converted to throw 2025-10-27
   zmkBATx = warnAlias "'zmkBATx' has been renamed to 'zmkbatx'" zmkbatx; # Added 2026-02-18
   zombietrackergps = throw "'zombietrackergps' has been dropped, as it depends on KDE Gear 5 and is unmaintained"; # Added 2025-08-20
+  zotero-beta = throw "'zotero-beta' has been removed. Use 'zotero' instead."; # Added 2026-03-05
   zotero_7 = throw "'zotero_7' has been renamed to/replaced by 'zotero'"; # Added 2025-12-09
   zotify = throw "zotify has been removed due to lack of upstream maintenance"; # Added 2025-09-26
   zq = throw "zq has been replaced by zed"; # Converted to throw 2025-10-26
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 01119ba1281d..e002522ff19a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -311,6 +311,7 @@ mapAliases {
   mkdocs-minify = throw "'mkdocs-minify' has been renamed to/replaced by 'mkdocs-minify-plugin'"; # Converted to throw 2025-10-29
   mne-python = throw "'mne-python' has been renamed to/replaced by 'mne'"; # Converted to throw 2025-10-29
   modeled = "'modeled' has been removed because it is unmaintained"; # Added 2026-01-19
+  monarchmoney = throw "'monarchmoney' has been renamed to/replaced by 'monarchmoneycommunity'"; # Added 2026-03-05
   moretools = "'moretools' has been removed because it is unmaintained"; # Added 2026-01-19
   mpris-server = throw "mpris-server was removed because it is unused"; # added 2025-10-31
   msldap-bad = throw "'msldap-bad' has been renamed to/replaced by 'badldap'"; # added 2025-11-06
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d36b5f1d4d53..07f3805cb669 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10094,7 +10094,7 @@ self: super: with self; {
 
   monai-deploy = callPackage ../development/python-modules/monai-deploy { };
 
-  monarchmoney = callPackage ../development/python-modules/monarchmoney { };
+  monarchmoneycommunity = callPackage ../development/python-modules/monarchmoneycommunity { };
 
   monero = callPackage ../development/python-modules/monero { };
 
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 34edecf6d968..1576ff3dc89d 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -85,36 +85,6 @@ in
 }@args:
 
 let
-  # This is a function from parsed platforms (like
-  # stdenv.hostPlatform.parsed) to parsed platforms.
-  makeMuslParsedPlatform =
-    parsed:
-    # The following line guarantees that the output of this function
-    # is a well-formed platform with no missing fields.  It will be
-    # uncommented in a separate PR, in case it breaks the build.
-    #(x: lib.trivial.pipe x [ (x: removeAttrs x [ "_type" ]) lib.systems.parse.mkSystem ])
-    (
-      parsed
-      // {
-        abi =
-          {
-            gnu = lib.systems.parse.abis.musl;
-            gnueabi = lib.systems.parse.abis.musleabi;
-            gnueabihf = lib.systems.parse.abis.musleabihf;
-            gnuabin32 = lib.systems.parse.abis.muslabin32;
-            gnuabi64 = lib.systems.parse.abis.muslabi64;
-            gnuabielfv2 = lib.systems.parse.abis.musl;
-            gnuabielfv1 = lib.systems.parse.abis.musl;
-            # The following two entries ensure that this function is idempotent.
-            musleabi = lib.systems.parse.abis.musleabi;
-            musleabihf = lib.systems.parse.abis.musleabihf;
-            muslabin32 = lib.systems.parse.abis.muslabin32;
-            muslabi64 = lib.systems.parse.abis.muslabi64;
-          }
-          .${parsed.abi.name} or lib.systems.parse.abis.musl;
-      }
-    );
-
   stdenvAdapters =
     self: super:
     let
@@ -199,7 +169,6 @@ let
           nixpkgsFun
           stdenv
           overlays
-          makeMuslParsedPlatform
           ;
       } self super
     );
@@ -319,7 +288,7 @@ let
         isStatic = true;
         config = lib.systems.parse.tripleFromSystem (
           if stdenv.hostPlatform.isLinux then
-            makeMuslParsedPlatform stdenv.hostPlatform.parsed
+            lib.systems.parse.makeMuslParsedPlatform stdenv.hostPlatform.parsed
           else
             stdenv.hostPlatform.parsed
         );
diff --git a/pkgs/top-level/variants.nix b/pkgs/top-level/variants.nix
index 7015617c174d..9c5a60f9f003 100644
--- a/pkgs/top-level/variants.nix
+++ b/pkgs/top-level/variants.nix
@@ -10,7 +10,6 @@
   stdenv,
   nixpkgsFun,
   overlays,
-  makeMuslParsedPlatform,
 }:
 let
   makeLLVMParsedPlatform =
@@ -84,7 +83,9 @@ self: super: {
         ]
         ++ overlays;
         ${if stdenv.hostPlatform == stdenv.buildPlatform then "localSystem" else "crossSystem"} = {
-          config = lib.systems.parse.tripleFromSystem (makeMuslParsedPlatform stdenv.hostPlatform.parsed);
+          config = lib.systems.parse.tripleFromSystem (
+            lib.systems.parse.makeMuslParsedPlatform stdenv.hostPlatform.parsed
+          );
         };
       }
     else