diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 27ec72e63093..161b48e0498b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5968,6 +5968,11 @@
     githubId = 28738918;
     name = "Pratyush Das";
   };
+  dastarruer = {
+    name = "dastarruer";
+    github = "dastarruer";
+    githubId = 173855353;
+  };
   datafoo = {
     github = "datafoo";
     githubId = 34766150;
@@ -16813,6 +16818,11 @@
     githubId = 14259816;
     name = "Abin Simon";
   };
+  meanwhile131 = {
+    name = "meanwhile131";
+    github = "meanwhile131";
+    githubId = 51206659;
+  };
   meatcar = {
     email = "nixpkgs@denys.me";
     github = "meatcar";
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index 85bb1cd0bf41..63d35d7583de 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -494,7 +494,7 @@ in
               ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
             ''}
             ${lib.optionalString fileBackup ''
-              rm ${filesFromTmpFile}
+              rm -f ${filesFromTmpFile}
             ''}
           '';
         }
diff --git a/nixos/modules/services/databases/victorialogs.nix b/nixos/modules/services/databases/victorialogs.nix
index f9af9b89eed2..59c8d5c0390e 100644
--- a/nixos/modules/services/databases/victorialogs.nix
+++ b/nixos/modules/services/databases/victorialogs.nix
@@ -144,6 +144,7 @@ in
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "mincore"
         ];
       };
 
diff --git a/nixos/modules/services/x11/desktop-managers/xfce.nix b/nixos/modules/services/x11/desktop-managers/xfce.nix
index 57fd8d7a7c40..941f06ae6edf 100644
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@@ -244,6 +244,17 @@ in
 
     security.pam.services.xfce4-screensaver.unixAuth = cfg.enableScreensaver;
 
+    xdg.portal.enable = mkDefault true;
+    xdg.portal.extraPortals = utils.removePackagesByName (
+      with pkgs;
+      [
+        xdg-desktop-portal-gtk
+        xdg-desktop-portal-xapp
+      ]
+      ++ lib.optionals cfg.enableWaylandSession [
+        xdg-desktop-portal-wlr
+      ]
+    ) excludePackages;
     xdg.portal.configPackages = mkDefault [ pkgs.xfce4-session ];
   };
 }
diff --git a/nixos/tests/nominatim.nix b/nixos/tests/nominatim.nix
index 78106b61d778..4294d04fe880 100644
--- a/nixos/tests/nominatim.nix
+++ b/nixos/tests/nominatim.nix
@@ -59,14 +59,34 @@ in
       { config, pkgs, ... }:
       {
         # Database password
-        system.activationScripts = {
-          passwordFile.text = with config.services.nominatim.database; ''
-            mkdir -p /run/secrets
-            echo "${host}:${toString port}:${dbname}:${apiUser}:password" \
-              > /run/secrets/pgpass
-            chown nominatim-api:nominatim-api /run/secrets/pgpass
-            chmod 0600 /run/secrets/pgpass
-          '';
+        systemd.services.nominatim = {
+          serviceConfig.ExecStartPre =
+            let
+              createPasswordFile = lib.getExe (
+                pkgs.writeShellApplication {
+                  name = "nominatim-pre-start";
+                  text =
+                    let
+                      inherit (config.services.nominatim.database)
+                        host
+                        port
+                        dbname
+                        apiUser
+                        ;
+                    in
+                    ''
+                      mkdir -p /run/secrets
+                      echo "${host}:${toString port}:${dbname}:${apiUser}:password" \
+                        > /run/secrets/pgpass
+                      chown nominatim-api:nominatim-api /run/secrets/pgpass
+                      chmod 0600 /run/secrets/pgpass
+                    '';
+                }
+              );
+            in
+            [
+              "+${createPasswordFile}"
+            ];
         };
 
         # Nominatim
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 14e50e224dc1..d4c176ce9cac 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15911,6 +15911,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  treesitter-modules-nvim = buildVimPlugin {
+    pname = "treesitter-modules.nvim";
+    version = "0-unstable-2025-12-15";
+    src = fetchFromGitHub {
+      owner = "MeanderingProgrammer";
+      repo = "treesitter-modules.nvim";
+      rev = "dcb5030422732af54631083316887e512e4a79a3";
+      hash = "sha256-AkyzqsYlSuGKrBEPQahP02TGay+g5TRhYcxYIGR8+9Y=";
+    };
+    meta.homepage = "https://github.com/MeanderingProgrammer/treesitter-modules.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   treesj = buildVimPlugin {
     pname = "treesj";
     version = "0-unstable-2025-12-08";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index ddc01b565c1b..2f9fa3b91a21 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -3606,6 +3606,10 @@ assertNoAdditions {
     ];
   };
 
+  treesitter-modules-nvim = super.treesitter-modules-nvim.overrideAttrs {
+    dependencies = [ self.nvim-treesitter ];
+  };
+
   triptych-nvim = super.triptych-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 522c06fd96f1..ee1e9e3a4738 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1221,6 +1221,7 @@ https://github.com/markonm/traces.vim/,,
 https://github.com/LeonHeidelbach/trailblazer.nvim/,HEAD,
 https://github.com/tjdevries/train.nvim/,,
 https://github.com/xiyaowong/transparent.nvim/,HEAD,
+https://github.com/MeanderingProgrammer/treesitter-modules.nvim/,HEAD,
 https://github.com/Wansmer/treesj/,main,
 https://github.com/aaronik/treewalker.nvim/,HEAD,
 https://github.com/tremor-rs/tremor-vim/,,
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 5a002ac6a2aa..3e57cd06934e 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -26,11 +26,11 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-P71aeIViaqSoMpfgtKPZAsclsWdBIvM9DvAoY8cm5Ow=";
-      x86_64-darwin = "sha256-qUbfAynw5QHbWHk+8McQFICXKiWk7dfsO9jNpgBvkuc=";
-      aarch64-linux = "sha256-aUj0m6mqVyZU0MxPWXSn5YOG4jDbzIdSkZfkiVNpJR4=";
-      aarch64-darwin = "sha256-4JyPvwTILXUuwLT19Ok7q4ZEoG0rmtbAjmuOtgZ7X4U=";
-      armv7l-linux = "sha256-Cd/T6Yo6jLqQWNQmVWcNU8eZhAy6J0VyEYFTnlFOj3I=";
+      x86_64-linux = "sha256-gqBxdd6Ww1nIXovixgsuIivLXn1LoZXN5NhK4bLmSng=";
+      x86_64-darwin = "sha256-al2RcKJ3KrNywnMYbhd493kyR6I0JUbCJHy1iTk4N4s=";
+      aarch64-linux = "sha256-32WP74IJYVIKuhmsMi0EFqjTlWAO4DgC24ptm3BqSpg=";
+      aarch64-darwin = "sha256-2hYTrkCNzVy6wXT+cGWkDEAy+g/KSkWsLltMSuSSBTk=";
+      armv7l-linux = "sha256-bNjc91zjVXnQ763GHmlVTNDD5ynlJhrtGR7Xzciq7tA=";
     }
     .${system} or throwSystem;
 
@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.106.37943";
+  version = "1.107.18627";
   pname = "vscodium";
 
   executableName = "codium";
diff --git a/pkgs/applications/office/activitywatch/default.nix b/pkgs/applications/office/activitywatch/default.nix
index fb325a7b6c42..fbd26fb5d8b7 100644
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@@ -1,8 +1,6 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   makeWrapper,
   pkg-config,
@@ -233,6 +231,7 @@ rec {
     npmDepsHash = "sha256-fPk7UpKuO3nEN1w+cf9DIZIG1+XRUk6PJfVmtpC30XE=";
 
     makeCacheWritable = true;
+    npmFlags = [ "--legacy-peer-deps" ];
 
     patches = [
       # Hardcode version to avoid the need to have the Git repo available at build time.
diff --git a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
index 7082f5698594..89e5eabe2f8b 100644
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@@ -23,13 +23,13 @@ in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "21.5.13";
+  version = "21.5.18";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
     tag = "${version}-${rel}";
-    hash = "sha256-XcRg0FtoN7SXRVEBWM9gIlLOMGT3x64s9WD12UJdblw=";
+    hash = "sha256-JJaB0HlDLv5CFDE75sXW1e+vCc1BrqzZT6HyBa0LVso=";
   };
 
   extraCMakeFlags = [
diff --git a/pkgs/by-name/am/amphetype/package.nix b/pkgs/by-name/am/amphetype/package.nix
index db9b9d50f639..d276b13cd6ca 100644
--- a/pkgs/by-name/am/amphetype/package.nix
+++ b/pkgs/by-name/am/amphetype/package.nix
@@ -1,7 +1,7 @@
 {
+  lib,
   copyDesktopItems,
   fetchFromGitLab,
-  lib,
   makeDesktopItem,
   python3Packages,
   qt5,
@@ -29,7 +29,6 @@ python3Packages.buildPythonApplication {
   ];
 
   buildInputs = [
-    qt5.qtbase
     qt5.qtwayland
   ];
 
@@ -43,12 +42,11 @@ python3Packages.buildPythonApplication {
     translitcodec
   ];
 
-  dontWrapQtApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-  '';
+  makeWrapperArgs = [
+    "\${qtWrapperArgs[@]}"
+  ];
 
+  # no tests
   doCheck = false;
 
   desktopItems = [
diff --git a/pkgs/by-name/an/anki/addons/default.nix b/pkgs/by-name/an/anki/addons/default.nix
index d0ca4190fc44..f278cc2f612d 100644
--- a/pkgs/by-name/an/anki/addons/default.nix
+++ b/pkgs/by-name/an/anki/addons/default.nix
@@ -8,6 +8,8 @@
 
   anki-quizlet-importer-extended = callPackage ./anki-quizlet-importer-extended { };
 
+  image-occlusion-enhanced = callPackage ./image-occlusion-enhanced { };
+
   local-audio-yomichan = callPackage ./local-audio-yomichan { };
 
   passfail2 = callPackage ./passfail2 { };
diff --git a/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix b/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix
new file mode 100644
index 000000000000..290236b13810
--- /dev/null
+++ b/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  anki-utils,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+anki-utils.buildAnkiAddon (finalAttrs: {
+  pname = "image-occlusion-enhanced";
+  version = "1.4.0";
+  src = fetchFromGitHub {
+    owner = "glutanimate";
+    repo = "image-occlusion-enhanced";
+    sparseCheckout = [ "src/image_occlusion_enhanced" ];
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YR1hicBDb08J+1Qc+SDiJDXLo5FzLqCQGeVe7brbPME=";
+  };
+  sourceRoot = "${finalAttrs.src.name}/src/image_occlusion_enhanced";
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    description = ''
+      Adds extra features for creating image-based cloze-deletions
+    '';
+    homepage = "https://github.com/glutanimate/image-occlusion-enhanced";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ dastarruer ];
+  };
+})
diff --git a/pkgs/by-name/au/autokey/package.nix b/pkgs/by-name/au/autokey/package.nix
index 43779249f897..6856747f2aca 100644
--- a/pkgs/by-name/au/autokey/package.nix
+++ b/pkgs/by-name/au/autokey/package.nix
@@ -47,6 +47,7 @@ python3Packages.buildPythonApplication rec {
     xlib
     pygobject3
     packaging
+    standard-imghdr
   ];
 
   runtimeDeps = [
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 26e3e7bb7012..9efedea26055 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.35.3";
+  version = "2.36.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-RjtOo8+vXKeZbTtnwmUq1t8WwZUJypSUoQSJtr9xd70=";
+    hash = "sha256-Sr/xpPLrlAaNv4r4fZ1/QFbamvGWFMfsOKSbaWdlAI0=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
diff --git a/pkgs/by-name/bo/bonzomatic/package.nix b/pkgs/by-name/bo/bonzomatic/package.nix
index 7a7e4747e67e..e1ee65d74f21 100644
--- a/pkgs/by-name/bo/bonzomatic/package.nix
+++ b/pkgs/by-name/bo/bonzomatic/package.nix
@@ -10,24 +10,32 @@
   libXcursor,
   libXinerama,
   libXrandr,
-  xorg,
+  xinput,
+  libXi,
+  libXext,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bonzomatic";
   version = "2023-06-15";
 
   src = fetchFromGitHub {
     owner = "Gargaj";
     repo = "bonzomatic";
-    tag = version;
-    sha256 = "sha256-hwK3C+p1hRwnuY2/vBrA0QsJGIcJatqq+U5/hzVCXEg=";
+    tag = finalAttrs.version;
+    hash = "sha256-hwK3C+p1hRwnuY2/vBrA0QsJGIcJatqq+U5/hzVCXEg=";
   };
 
+  postPatch = ''
+    substituteInPlace {,external/glfw/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [
     cmake
     makeWrapper
   ];
+
   buildInputs = [
     alsa-lib
     fontconfig
@@ -35,13 +43,14 @@ stdenv.mkDerivation rec {
     libXcursor
     libXinerama
     libXrandr
-    xorg.xinput
-    xorg.libXi
-    xorg.libXext
+    xinput
+    libXi
+    libXext
   ];
 
   postFixup = ''
-    wrapProgram $out/bin/bonzomatic --prefix LD_LIBRARY_PATH : "${alsa-lib}/lib"
+    wrapProgram $out/bin/bonzomatic \
+      --prefix LD_LIBRARY_PATH : "${lib.getLib alsa-lib}/lib"
   '';
 
   meta = {
@@ -55,4 +64,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "bonzomatic";
   };
-}
+})
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 3b6125b61ebb..14c1bd52bb54 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   buildNpmPackage,
   nix-update-script,
+  nodejs_22,
   electron,
   makeWrapper,
   copyDesktopItems,
@@ -33,6 +34,8 @@ buildNpmPackage rec {
     '';
   };
 
+  nodejs = nodejs_22;
+
   npmDepsHash = "sha256-CXXXyDaaoAoZhUo1YNP3PUEGzlmIaDnA+JhrCqBY1H4=";
   npmFlags = [ "--legacy-peer-deps" ];
 
diff --git a/pkgs/by-name/bu/butler/package.nix b/pkgs/by-name/bu/butler/package.nix
index 53a2886aca52..946c59b51749 100644
--- a/pkgs/by-name/bu/butler/package.nix
+++ b/pkgs/by-name/bu/butler/package.nix
@@ -32,6 +32,9 @@ buildGoModule rec {
 
   vendorHash = "sha256-A6u7bKI7eoptkjBuXoQlLYHkEVtrl8aNnBb65k1bFno=";
 
+  # Needed due to vendored dependencies breaking in gnu23 mode.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   meta = {
     description = "Command-line itch.io helper";
     changelog = "https://github.com/itchio/butler/releases/tag/v${version}/CHANGELOG.md";
diff --git a/pkgs/by-name/co/coc-yank/package.nix b/pkgs/by-name/co/coc-yank/package.nix
index e6e433f48e85..f292dbb1558b 100644
--- a/pkgs/by-name/co/coc-yank/package.nix
+++ b/pkgs/by-name/co/coc-yank/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildNpmPackage,
+  nodejs_22,
   fetchFromGitHub,
   nix-update-script,
   esbuild,
@@ -43,6 +44,9 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsHash = "sha256-ISHILT/FBy2Y0UWaQkjMm5ZsYacNt3M54IJ8ckYjq3A=";
 
+  # https://github.com/NixOS/nixpkgs/issues/474535
+  nodejs = nodejs_22;
+
   nativeBuildInputs = [ esbuild' ];
 
   env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
diff --git a/pkgs/by-name/cp/cppcms/package.nix b/pkgs/by-name/cp/cppcms/package.nix
index aba0b7ceaf30..d37dce17e241 100644
--- a/pkgs/by-name/cp/cppcms/package.nix
+++ b/pkgs/by-name/cp/cppcms/package.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aXAxx9FB/dIVxr5QkLZuIQamO7PlLwnugSDo78bAiiE=";
   };
 
+  postPatch = ''
+    substituteInPlace {,booster/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [
     cmake
     python3
diff --git a/pkgs/by-name/cp/cppdb/package.nix b/pkgs/by-name/cp/cppdb/package.nix
index c3f1d70d236e..eba65aeb5cc2 100644
--- a/pkgs/by-name/cp/cppdb/package.nix
+++ b/pkgs/by-name/cp/cppdb/package.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
     sha256 = "0blr1casmxickic84dxzfmn3lm7wrsl4aa2abvpq93rdfddfy3nn";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     sqlite
diff --git a/pkgs/by-name/ct/ctpp2/package.nix b/pkgs/by-name/ct/ctpp2/package.nix
deleted file mode 100644
index 45590ddef419..000000000000
--- a/pkgs/by-name/ct/ctpp2/package.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ctpp2";
-  version = "2.8.3";
-
-  src = fetchurl {
-    url = "https://ctpp.havoc.ru/download/${pname}-${version}.tar.gz";
-    sha256 = "1z22zfw9lb86z4hcan9hlvji49c9b7vznh7gjm95gnvsh43zsgx8";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  patchPhase = ''
-    # include <unistd.h> to fix undefined getcwd
-    sed -i -e 's/<stdlib.h>/<stdlib.h>\n#include <unistd.h>/' src/CTPP2FileSourceLoader.cpp
-  '';
-
-  cmakeFlags = [
-    # RPATH of binary /nix/store/.../bin/ctpp2json contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ];
-
-  doCheck = false; # fails
-
-  meta = {
-    description = "High performance templating engine";
-    homepage = "https://ctpp.havoc.ru/";
-    maintainers = [ lib.maintainers.robbinch ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.bsd2;
-  };
-}
diff --git a/pkgs/by-name/do/dotherside/package.nix b/pkgs/by-name/do/dotherside/package.nix
index 45d3ea221f5e..436f59be6e5b 100644
--- a/pkgs/by-name/do/dotherside/package.nix
+++ b/pkgs/by-name/do/dotherside/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   cmake,
   libsForQt5,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-o6RMjJz9vtfCsm+F9UYIiYPEaQn+6EU5jOTLhNHCwo4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "bump-minimal-cmake-required-version.patch";
+      url = "https://github.com/filcuc/dotherside/commit/56cb910b368ad0f8ef1f18ef52d46ab8136ca5d6.patch?full_index=1";
+      hash = "sha256-xPMfSbTI8HWK6UYYFPATsz29lKbunm43JnaageTBZeY=";
+    })
+  ];
+
   buildInputs = [
     libsForQt5.qtbase
     libsForQt5.qtquickcontrols2
diff --git a/pkgs/by-name/ed/edmarketconnector/package.nix b/pkgs/by-name/ed/edmarketconnector/package.nix
index a69139a8f7db..dbf80a4205c8 100644
--- a/pkgs/by-name/ed/edmarketconnector/package.nix
+++ b/pkgs/by-name/ed/edmarketconnector/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "edmarketconnector";
-  version = "6.0.0";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "EDCD";
     repo = "EDMarketConnector";
     tag = "Release/${finalAttrs.version}";
-    hash = "sha256-FByD4JC/MZ++LcA6tWgvLpZs76Os8KZuv0quG8yW0kw=";
+    hash = "sha256-/Te7PTM/t+uN5v1DDa7zgQsVcy4CDMRSxvPqt1OwcW4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ef/efitools/package.nix b/pkgs/by-name/ef/efitools/package.nix
index 2264bc37113c..ff0e054f0dc5 100644
--- a/pkgs/by-name/ef/efitools/package.nix
+++ b/pkgs/by-name/ef/efitools/package.nix
@@ -30,9 +30,12 @@ stdenv.mkDerivation rec {
     sha256 = "0jabgl2pxvfl780yvghq131ylpf82k7banjz0ksjhlm66ik8gb1i";
   };
 
-  # https://github.com/ncroxon/gnu-efi/issues/7#issuecomment-2122741592
   patches = [
+    # https://github.com/ncroxon/gnu-efi/issues/7#issuecomment-2122741592
     ./aarch64.patch
+
+    # Fix build with gcc15
+    ./remove-redundant-bool.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/ef/efitools/remove-redundant-bool.patch b/pkgs/by-name/ef/efitools/remove-redundant-bool.patch
new file mode 100644
index 000000000000..386dea8eb305
--- /dev/null
+++ b/pkgs/by-name/ef/efitools/remove-redundant-bool.patch
@@ -0,0 +1,24 @@
+From 7698d2e2fdde341677907fbbec7197c8bb3a687a Mon Sep 17 00:00:00 2001
+From: Moraxyc <i@qaq.li>
+Date: Wed, 31 Dec 2025 22:12:04 +0800
+Subject: [PATCH] remove-redundant-bool
+
+---
+ lib/asn1/typedefs.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/lib/asn1/typedefs.h b/lib/asn1/typedefs.h
+index 756a629..45db045 100644
+--- a/lib/asn1/typedefs.h
++++ b/lib/asn1/typedefs.h
+@@ -52,7 +52,6 @@ typedef unsigned char u_char;
+ 
+ #endif
+ 
+-typedef unsigned char bool;
+ typedef unsigned int u_int;
+ 
+ #define DBG1(s...)
+-- 
+2.51.2
+
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index e66112303cab..42b7557c1b0c 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S8sPS0agLXih39+v7ZXk/khxrjJfoq50j3eXSGa8FQU=";
+    hash = "sha256-zsW4hBilhhkP9H0rTLDr6S0BZBGb9XqGNKcftkoivOs=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-57LIfY1qH6/y11FB22lThCPUpsyr8YxgX7uNLP1jzAQ=";
+    hash = "sha256-2nNjFdirgnciOf5kXwM4MXoBeidnnis4oi2AbYQvTHo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fa/falcon/package.nix b/pkgs/by-name/fa/falcon/package.nix
index 156aff2f6507..f511b92ae385 100644
--- a/pkgs/by-name/fa/falcon/package.nix
+++ b/pkgs/by-name/fa/falcon/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   pcre,
@@ -20,6 +21,15 @@ stdenv.mkDerivation {
     hash = "sha256-0yLhwDVFNbfiW23hNxrvItCCkyaOvEbFSg1ZQuJvhIs=";
   };
 
+  patches = [
+    # part of https://github.com/falconpl/falcon/pull/11
+    (fetchpatch {
+      name = "bump-minimum-cmake-required-version.patch";
+      url = "https://github.com/falconpl/falcon/commit/a1f4fa1607249b0356c2cd2c54134cb3dc2dc231.patch";
+      hash = "sha256-oYLB+71/oan2MOyHTr/IpgDwik+T8ToP1q7AroaBq1g=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/fc/fcppt/package.nix b/pkgs/by-name/fc/fcppt/package.nix
index bc83eafb1f7a..75b8bebddc3d 100644
--- a/pkgs/by-name/fc/fcppt/package.nix
+++ b/pkgs/by-name/fc/fcppt/package.nix
@@ -4,23 +4,23 @@
   fetchFromGitHub,
   cmake,
   boost,
-  catch2,
+  catch2_3,
 }:
 stdenv.mkDerivation rec {
   pname = "fcppt";
-  version = "4.2.1";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "freundlich";
     repo = "fcppt";
     rev = version;
-    sha256 = "1pcmi2ck12nanw1rnwf8lmyx85iq20897k6daxx3hw5f23j1kxv6";
+    hash = "sha256-8dBG6LdSngsutBboqb3WVVg3ylayoUYDOJV6p/ZFkoE=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     boost
-    catch2
+    catch2_3
   ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/fr/freepv/package.nix b/pkgs/by-name/fr/freepv/package.nix
index 82132fc3f677..61d1dfeb005a 100644
--- a/pkgs/by-name/fr/freepv/package.nix
+++ b/pkgs/by-name/fr/freepv/package.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.4.0)" "cmake_minimum_required(VERSION 3.10)"
+
     sed -i -e '/GECKO/d' CMakeLists.txt
     sed -i -e '/mozilla/d' src/CMakeLists.txt
     sed -i -e '1i \
diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix
index aa6bafb213be..f59751df35a5 100644
--- a/pkgs/by-name/ge/gemini-cli/package.nix
+++ b/pkgs/by-name/ge/gemini-cli/package.nix
@@ -14,18 +14,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.22.4";
+  version = "0.22.5";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gYh8GpuBwkowdBNCYkh7w2MFSTw8xXYO4XbQBezzFlQ=";
+    hash = "sha256-3d9Lq3IulIgp4QGNtSvkwz10kfygX6vsmVdlU3lE6Gw=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-f5s2T+826rZU8IXe4fv26JiR3laPunbKeJSRnst6upw=";
+  npmDepsHash = "sha256-6NqpkUgez7CqQAMDQW3Zdi86sF5qXseKXMw1Vw/5zWU=";
 
   nativeBuildInputs = [
     jq
diff --git a/pkgs/by-name/gh/ghw/package.nix b/pkgs/by-name/gh/ghw/package.nix
new file mode 100644
index 000000000000..4a48651f44e4
--- /dev/null
+++ b/pkgs/by-name/gh/ghw/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "ghw";
+  version = "0.21.2";
+
+  src = fetchFromGitHub {
+    owner = "jaypipes";
+    repo = "ghw";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WZGEhrgHmJ/4puvDPYLq3iU+Ddf1PnptRj0ehcDbjZQ=";
+  };
+  vendorHash = "sha256-lItNgi65HQASNQufUdhvEoNtrltkW+0hBHUlFZjfneE=";
+
+  subPackages = [ "cmd/..." ];
+  doCheck = false; # wants to read from /sys and other places not allowed
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Go HardWare discovery/inspection library";
+    mainProgram = "ghwc";
+    homepage = "https://github.com/jaypipes/ghw";
+    maintainers = [ lib.maintainers.mmlb ];
+    license = lib.licenses.asl20;
+  };
+})
diff --git a/pkgs/by-name/gn/gnome-console/package.nix b/pkgs/by-name/gn/gnome-console/package.nix
index f350b51970b9..b7cad35d66b4 100644
--- a/pkgs/by-name/gn/gnome-console/package.nix
+++ b/pkgs/by-name/gn/gnome-console/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-console";
-  version = "49.1";
+  version = "49.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-/KOf0EHgXufKbSpcggAZN9Aq4VE/PzZRvTeuDi72bj4=";
+    hash = "sha256-J7As6OiQ/49TyoXbeGsa41kD8LYyeBLwIk3AtUsQiNs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-maps/package.nix b/pkgs/by-name/gn/gnome-maps/package.nix
index f4545d544b9e..c44bb9729bfa 100644
--- a/pkgs/by-name/gn/gnome-maps/package.nix
+++ b/pkgs/by-name/gn/gnome-maps/package.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-maps";
-  version = "49.2";
+  version = "49.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-maps/${lib.versions.major finalAttrs.version}/gnome-maps-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dd4/kCjDInLTbgnbqhG/3myFz3USCGVdO6RIJo08PzA=";
+    hash = "sha256-v8jpNxGOWWNnC8Pvkcdmn6wV7b1r9rIU+K2IFxkovd8=";
   };
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/gn/gnome-remote-desktop/package.nix b/pkgs/by-name/gn/gnome-remote-desktop/package.nix
index ba5b3f8d9703..9602d1427a3a 100644
--- a/pkgs/by-name/gn/gnome-remote-desktop/package.nix
+++ b/pkgs/by-name/gn/gnome-remote-desktop/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "49.1";
+  version = "49.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-remote-desktop/${lib.versions.major version}/gnome-remote-desktop-${version}.tar.xz";
-    hash = "sha256-eADziDAe64FHsL5V6Pp8vXUhBmpIoGEVzA6tnwzqGIo=";
+    hash = "sha256-c9ROHnR04WIVgP9WEs3+HZxIr8+rRUjOkh1cpuLZFq0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gs/gspell/package.nix b/pkgs/by-name/gs/gspell/package.nix
index 636f1f8eee3a..e71f3692fc6c 100644
--- a/pkgs/by-name/gs/gspell/package.nix
+++ b/pkgs/by-name/gs/gspell/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gspell";
-  version = "1.14.0";
+  version = "1.14.2";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "ZOodjp7cHCW0WpIOgNr2dVnRhm/81/hDL+z+ptD+iJc=";
+    sha256 = "TsflrMyQEygbrNa7wAAGvnM4GLgbo/4zLB6HbH4eFHc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hi/hidrd/allocate-hex-map-with-the-trailing-null.patch b/pkgs/by-name/hi/hidrd/allocate-hex-map-with-the-trailing-null.patch
new file mode 100644
index 000000000000..2d8de279ba48
--- /dev/null
+++ b/pkgs/by-name/hi/hidrd/allocate-hex-map-with-the-trailing-null.patch
@@ -0,0 +1,36 @@
+From 73a01e5e0091f5fbf452fd85ac3632f8c0171e65 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= <jskarvad@redhat.com>
+Date: Thu, 7 Aug 2025 17:50:48 +0200
+Subject: [PATCH] Allocate hex map with the trailing NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Compilers usually warns or errors on such allocations. This would require
+special compiler parameter or attribute to silence it. Unfortunately, it is
+compiler specific, e.g. with gcc one could use "__attribute__ ((nonstring))"
+or with C23 just "[[nonstring]]" or gcc parameter
+"-Wno-error=unterminated-string-initialization". With other compilers
+it's different. So do not over-complicate things and allocate it just one
+more byte longer with the dummy NULL which should silence most of the
+compilers. It's static allocation, just one byte, the overhead should be
+negligible.
+
+Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
+---
+ lib/util/hex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/util/hex.c b/lib/util/hex.c
+index 653e733..2292bd7 100644
+--- a/lib/util/hex.c
++++ b/lib/util/hex.c
+@@ -84,7 +84,7 @@ hidrd_hex_buf_from_str(void        *buf,
+ char *
+ hidrd_hex_buf_to_str(const void *buf, size_t size)
+ {
+-    static const char   map[16] = "0123456789ABCDEF";
++    static const char   map[17] = "0123456789ABCDEF";
+     const uint8_t      *bbuf    = (const uint8_t *)buf;
+     char               *str;
+     char               *p;
diff --git a/pkgs/by-name/hi/hidrd/package.nix b/pkgs/by-name/hi/hidrd/package.nix
index 2e5c80780a04..fe59be3d2be0 100644
--- a/pkgs/by-name/hi/hidrd/package.nix
+++ b/pkgs/by-name/hi/hidrd/package.nix
@@ -16,6 +16,13 @@ stdenv.mkDerivation {
     sha256 = "1rnhq6b0nrmphdig1qrpzpbpqlg3943gzpw0v7p5rwcdynb6bb94";
   };
 
+  patches = [
+    # Fix build with gcc15
+    #   hex.c:87:35: error: initializer-string for array of 'char' truncates NUL terminator but destination lacks 'nonstring' attribute (17 chars into 16 available) [-Werror=unterminated-string-initialization]
+    # https://github.com/DIGImend/hidrd/pull/33
+    ./allocate-hex-map-with-the-trailing-null.patch
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   meta = {
diff --git a/pkgs/by-name/hy/hyprshell/package.nix b/pkgs/by-name/hy/hyprshell/package.nix
index 12ad67d1497b..7682691c9a9f 100644
--- a/pkgs/by-name/hy/hyprshell/package.nix
+++ b/pkgs/by-name/hy/hyprshell/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprshell";
-  version = "4.8.1";
+  version = "4.8.2";
 
   src = fetchFromGitHub {
     owner = "H3rmt";
     repo = "hyprshell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NsFOXepWzgbopnoqwg8EekDLbj01jr8vjaEz/F3QFKU=";
+    hash = "sha256-2DXbiHdEMAu5kkaurwj8BVjwWnIopE1sMcfLGxe1LoU=";
   };
 
-  cargoHash = "sha256-/4mC1cgQKOSOME8WT61hggyHPALj0knVPtGZTa7lO1w=";
+  cargoHash = "sha256-kcuhDM7ukk5UlemADmCJPHodp/tHQVyt1ZAbZF60vpA=";
 
   nativeBuildInputs = [
     wrapGAppsHook4
diff --git a/pkgs/by-name/ip/iptsd/package.nix b/pkgs/by-name/ip/iptsd/package.nix
index 59621b72dc00..dbbe955ef9f6 100644
--- a/pkgs/by-name/ip/iptsd/package.nix
+++ b/pkgs/by-name/ip/iptsd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iptsd";
-  version = "3";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "linux-surface";
     repo = "iptsd";
     tag = "v${version}";
-    hash = "sha256-3z3A9qywmsSW1tlJ6LePC5wudM/FITTAFyuPkbHlid0=";
+    hash = "sha256-2yYO1xb576IHaJquTrQtmAjJITGdW06I3eHD+HR88xI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/kr/krita-plugin-gmic/package.nix b/pkgs/by-name/kr/krita-plugin-gmic/package.nix
index e9ee4c173308..3240f4ce7966 100644
--- a/pkgs/by-name/kr/krita-plugin-gmic/package.nix
+++ b/pkgs/by-name/kr/krita-plugin-gmic/package.nix
@@ -5,7 +5,7 @@
   cmake,
   extra-cmake-modules,
   fftw,
-  krita,
+  krita-unwrapped,
   libsForQt5,
 }:
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     fftw
-    krita.unwrapped
+    krita-unwrapped
     libsForQt5.kcoreaddons
   ];
 
diff --git a/pkgs/by-name/kr/krita/generic.nix b/pkgs/by-name/kr/krita-unwrapped/package.nix
similarity index 86%
rename from pkgs/by-name/kr/krita/generic.nix
rename to pkgs/by-name/kr/krita-unwrapped/package.nix
index efbe92621424..5d84ecc43ffb 100644
--- a/pkgs/by-name/kr/krita/generic.nix
+++ b/pkgs/by-name/kr/krita-unwrapped/package.nix
@@ -1,70 +1,48 @@
 {
-  mkDerivation,
-  lib,
   stdenv,
-  fetchpatch,
-  fetchurl,
-  cmake,
-  extra-cmake-modules,
-  karchive,
-  kconfig,
-  kwidgetsaddons,
-  kcompletion,
-  kcoreaddons,
-  kguiaddons,
-  ki18n,
-  kitemmodels,
-  kitemviews,
-  kwindowsystem,
-  kio,
-  kcrash,
-  breeze-icons,
+  SDL2,
   boost,
-  libraw,
-  fftw,
+  cmake,
+  curl,
   eigen,
   exiv2,
+  extra-cmake-modules,
+  fetchpatch,
+  fetchurl,
+  fftw,
   fribidi,
-  libaom,
-  libheif,
-  #libkdcraw,
-  lcms2,
-  gsl,
-  openexr,
   giflib,
-  libjxl,
-  mlt,
-  openjpeg,
-  opencolorio,
-  xsimd,
-  poppler,
-  curl,
+  gsl,
   ilmbase,
   immer,
   kseexpr,
   lager,
+  lcms2,
+  lib,
+  libaom,
+  libheif,
+  libjxl,
   libmypaint,
+  libraw,
+  libsForQt5,
   libunibreak,
   libwebp,
-  qtmultimedia,
-  qtx11extras,
-  quazip,
-  SDL2,
-  zug,
+  opencolorio,
+  openexr,
+  openjpeg,
   pkg-config,
   python3Packages,
-  version,
-  kde-channel,
-  hash,
+  xsimd,
+  zug,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "krita-unwrapped";
-  inherit version;
 
+  version = "5.2.14";
   src = fetchurl {
-    url = "mirror://kde/${kde-channel}/krita/${version}/krita-${version}.tar.gz";
-    inherit hash;
+    url = "mirror://kde/stable/krita/${version}/krita-${version}.tar.gz";
+    hash = "sha256-VWkAcmwv8U5g97rB6OkVAQDyzZJmnKXcdKxYUe+sKIc=";
   };
 
   patches = [
@@ -81,22 +59,10 @@ mkDerivation rec {
     extra-cmake-modules
     pkg-config
     python3Packages.sip
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
-    karchive
-    kconfig
-    kwidgetsaddons
-    kcompletion
-    kcoreaddons
-    kguiaddons
-    ki18n
-    kitemmodels
-    kitemviews
-    kwindowsystem
-    kio
-    kcrash
-    breeze-icons
     boost
     libraw
     fftw
@@ -109,14 +75,12 @@ mkDerivation rec {
     lager
     libaom
     libheif
-    #libkdcraw
+
     giflib
     libjxl
-    mlt
     openjpeg
     opencolorio
     xsimd
-    poppler
     curl
     ilmbase
     immer
@@ -124,13 +88,33 @@ mkDerivation rec {
     libmypaint
     libunibreak
     libwebp
-    qtmultimedia
-    qtx11extras
-    quazip
     SDL2
     zug
     python3Packages.pyqt5
-  ];
+  ]
+  ++ (with libsForQt5; [
+    breeze-icons
+    karchive
+    kcompletion
+    kconfig
+    kcoreaddons
+    kcrash
+    kguiaddons
+    ki18n
+    kio
+    kitemmodels
+    kitemviews
+    kwidgetsaddons
+    kwindowsystem
+    mlt
+    poppler
+    qtmultimedia
+    qtx11extras
+    quazip
+
+    # TODO: reenable libkdcraw when migrating to Qt6, see #430298
+    # libkdcraw
+  ]);
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy");
 
diff --git a/pkgs/by-name/kr/krita/default.nix b/pkgs/by-name/kr/krita/default.nix
deleted file mode 100644
index c125d04f544f..000000000000
--- a/pkgs/by-name/kr/krita/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic.nix {
-  version = "5.2.14";
-  kde-channel = "stable";
-  hash = "sha256-VWkAcmwv8U5g97rB6OkVAQDyzZJmnKXcdKxYUe+sKIc=";
-}
diff --git a/pkgs/by-name/kr/krita/package.nix b/pkgs/by-name/kr/krita/package.nix
index 75160d027a83..cbffba055acc 100644
--- a/pkgs/by-name/kr/krita/package.nix
+++ b/pkgs/by-name/kr/krita/package.nix
@@ -2,24 +2,23 @@
   lib,
   libsForQt5,
   symlinkJoin,
-  unwrapped ? libsForQt5.callPackage ./. { },
   krita-plugin-gmic,
   binaryPlugins ? [
     # Default plugins provided by upstream appimage
     krita-plugin-gmic
   ],
+  krita-unwrapped,
 }:
-
 symlinkJoin {
-  name = lib.replaceStrings [ "-unwrapped" ] [ "" ] unwrapped.name;
-  inherit (unwrapped)
+  name = lib.replaceStrings [ "-unwrapped" ] [ "" ] krita-unwrapped.name;
+  inherit (krita-unwrapped)
     version
     buildInputs
     nativeBuildInputs
     meta
     ;
 
-  paths = [ unwrapped ] ++ binaryPlugins;
+  paths = [ krita-unwrapped ] ++ binaryPlugins;
 
   postBuild = ''
     wrapQtApp "$out/bin/krita" \
@@ -28,6 +27,7 @@ symlinkJoin {
   '';
 
   passthru = {
-    inherit unwrapped binaryPlugins;
+    inherit binaryPlugins;
+    unwrapped = krita-unwrapped;
   };
 }
diff --git a/pkgs/by-name/la/lato/package.nix b/pkgs/by-name/la/lato/package.nix
index c1fe2ae6499e..aa96b74ec288 100644
--- a/pkgs/by-name/la/lato/package.nix
+++ b/pkgs/by-name/la/lato/package.nix
@@ -9,39 +9,37 @@ stdenvNoCC.mkDerivation {
   version = "2.0";
 
   src = fetchzip {
-    url = "https://www.latofonts.com/download/Lato2OFL.zip";
-    stripRoot = false;
+    url = "https://www.latofonts.com/files/Lato2OFL.zip";
     hash = "sha256-n1TsqigCQIGqyGLGTjLtjHuBf/iCwRlnqh21IHfAuXI=";
+    stripRoot = false;
   };
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 Lato2OFL/*.ttf -t $out/share/fonts/lato
+    install -Dm644 Lato2OFL/*.ttf \
+      --target-directory=$out/share/fonts/lato
 
     runHook postInstall
   '';
 
   meta = {
-    homepage = "https://www.latofonts.com/";
-
-    description = ''
-      Sans-serif typeface family designed in Summer 2010 by Łukasz Dziedzic
-    '';
-
+    homepage = "https://www.latofonts.com";
+    description = "Sans-serif typeface family designed in Summer 2010 by Łukasz Dziedzic";
     longDescription = ''
-      Lato is a sans-serif typeface family designed in the Summer 2010 by
-      Warsaw-based designer Łukasz Dziedzic ("Lato" means "Summer" in Polish).
-      In December 2010 the Lato family was published under the open-source Open
-      Font License by his foundry tyPoland, with support from Google.
+      Lato is a sans-serif typeface family designed in the Summer 2010
+      by Warsaw-based designer Łukasz Dziedzic ("Lato" means "Summer"
+      in Polish).  In December 2010 the Lato family was published
+      under the open-source Open Font License by his foundry tyPoland,
+      with support from Google.
 
-      In 2013-2014, the family was greatly extended to cover 3000+ glyphs per
-      style. The Lato 2.010 family now supports 100+ Latin-based languages, 50+
-      Cyrillic-based languages as well as Greek and IPA phonetics. In the
-      process, the metrics and kerning of the family have been revised and four
-      additional weights were created.
+      In 2013-2014, the family was greatly extended to cover 3000+
+      glyphs per style. The Lato 2.010 family now supports 100+
+      Latin-based languages, 50+ Cyrillic-based languages as well as
+      Greek and IPA phonetics. In the process, the metrics and kerning
+      of the family have been revised and four additional weights were
+      created.
     '';
-
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ chris-martin ];
diff --git a/pkgs/by-name/li/libxfce4windowing/package.nix b/pkgs/by-name/li/libxfce4windowing/package.nix
index 8e82630e099f..6fe9f0e87a82 100644
--- a/pkgs/by-name/li/libxfce4windowing/package.nix
+++ b/pkgs/by-name/li/libxfce4windowing/package.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfce4windowing";
-  version = "4.20.4";
+  version = "4.20.5";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xfce";
     repo = "libxfce4windowing";
     tag = "libxfce4windowing-${finalAttrs.version}";
-    hash = "sha256-8iLkljuGyJ4giVN5yuOFuTZsrdr8U3avTS/1aRSpaxc=";
+    hash = "sha256-TVu6S/Cip9IqniAvrTU5uSs7Dgm0WZNxjgB4vjHvBNU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/limitcpu/package.nix b/pkgs/by-name/li/limitcpu/package.nix
index 3280d14bb892..1e434a405920 100644
--- a/pkgs/by-name/li/limitcpu/package.nix
+++ b/pkgs/by-name/li/limitcpu/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "limitcpu";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/limitcpu/cpulimit-${version}.tar.gz";
-    sha256 = "sha256-lGmU7GDznwMJW4m9dOZguJwUyCq6dUVmk5jjArx7I0w=";
+    sha256 = "sha256-Wf/rGjUXr+RZmHFL6EGSYKQ2MvfOwI8LAmwezN/1fPw=";
   };
 
   buildFlags = with stdenv; [
diff --git a/pkgs/by-name/lo/localsearch/package.nix b/pkgs/by-name/lo/localsearch/package.nix
index a234bedc5f7f..ce66abd31727 100644
--- a/pkgs/by-name/lo/localsearch/package.nix
+++ b/pkgs/by-name/lo/localsearch/package.nix
@@ -50,11 +50,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "localsearch";
-  version = "3.10.1";
+  version = "3.10.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/localsearch/${lib.versions.majorMinor finalAttrs.version}/localsearch-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XK7zgWDgSV2tj9FVWmmZ9NTVNtnX66GP1J7BdzOMXcI=";
+    hash = "sha256-tN2JyF12YXEButTsmjNnj2MexQMumIDrQj3OUuh4ooU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index ea2a2db86ae7..cfdc80dd38b0 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -5,6 +5,7 @@
   buildGoModule,
   fetchFromGitHub,
   buildNpmPackage,
+  nodejs_22,
   nix-update-script,
   npm-lockfile-fix,
   fetchNpmDeps,
@@ -220,6 +221,9 @@ buildMattermost rec {
           --replace-fail 'options: {}' 'options: { disable: true }'
       '';
 
+      # https://github.com/NixOS/nixpkgs/issues/474535
+      nodejs = nodejs_22;
+
       npmDepsHash = npmDeps.hash;
       makeCacheWritable = true;
       forceGitDeps = true;
diff --git a/pkgs/by-name/pr/promptfoo/package.nix b/pkgs/by-name/pr/promptfoo/package.nix
index d8e0ef7e37fa..e59916cc03e5 100644
--- a/pkgs/by-name/pr/promptfoo/package.nix
+++ b/pkgs/by-name/pr/promptfoo/package.nix
@@ -1,5 +1,6 @@
 {
   buildNpmPackage,
+  nodejs_22,
   fetchFromGitHub,
   lib,
 }:
@@ -17,6 +18,9 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsHash = "sha256-mpe00J5iRwaH7hJIDP3fDuJSUOKk01COpOOvF1YJMyg=";
 
+  # https://github.com/NixOS/nixpkgs/issues/474535
+  nodejs = nodejs_22;
+
   # don't fetch playwright binary
   env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
 
diff --git a/pkgs/by-name/pr/protege/enforce-plugin-versions.patch b/pkgs/by-name/pr/protege/enforce-plugin-versions.patch
index 1df4594f2c99..e778fb1010aa 100644
--- a/pkgs/by-name/pr/protege/enforce-plugin-versions.patch
+++ b/pkgs/by-name/pr/protege/enforce-plugin-versions.patch
@@ -1,43 +1,41 @@
-diff --git a/pom.xml b/pom.xml
-index 839bed04..4cb5f392 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -358,6 +358,30 @@
+@@ -347,6 +347,30 @@
  						<release>11</release>
  					</configuration>
  				</plugin>
++				
++				<plugin>
++          <groupId>org.apache.maven.plugins</groupId>
++          <artifactId>maven-install-plugin</artifactId>
++          <version>3.1.1</version>
++        </plugin>
 +
-+                                <plugin>
-+					<groupId>org.apache.maven.plugins</groupId>
-+					<artifactId>maven-install-plugin</artifactId>
-+					<version>3.1.1</version>
-+                                </plugin>
++        <plugin>
++          <groupId>org.apache.maven.plugins</groupId>
++          <artifactId>maven-site-plugin</artifactId>
++          <version>3.12.1</version>
++        </plugin>
 +
-+                                <plugin>
-+					<groupId>org.apache.maven.plugins</groupId>
-+					<artifactId>maven-site-plugin</artifactId>
-+					<version>3.12.1</version>
-+                                </plugin>
++        <plugin>
++          <groupId>org.apache.maven.plugins</groupId>
++          <artifactId>maven-deploy-plugin</artifactId>
++          <version>3.1.1</version>
++        </plugin>
 +
-+                                <plugin>
-+					<groupId>org.apache.maven.plugins</groupId>
-+					<artifactId>maven-deploy-plugin</artifactId>
-+					<version>3.1.1</version>
-+                                </plugin>
-+
-+                                <plugin>
-+					<groupId>org.apache.maven.plugins</groupId>
-+					<artifactId>maven-jar-plugin</artifactId>
-+					<version>3.3.0</version>
-+                                </plugin>
- 							
++        <plugin>
++          <groupId>org.apache.maven.plugins</groupId>
++          <artifactId>maven-jar-plugin</artifactId>
++          <version>3.3.0</version>
++        </plugin>
+ 
  				<plugin>
  					<groupId>org.apache.maven.plugins</groupId>
-@@ -476,6 +494,7 @@
+@@ -465,6 +489,7 @@
  								<requireMavenVersion>
  									<version>3.6.3</version>
  								</requireMavenVersion>
-+                                                                <requirePluginVersions/>
++								<requirePluginVersions/>
  							</rules>
  						</configuration>
  					</execution>
diff --git a/pkgs/by-name/pr/protege/package.nix b/pkgs/by-name/pr/protege/package.nix
index 45bd7081b6e9..b126923e85d7 100644
--- a/pkgs/by-name/pr/protege/package.nix
+++ b/pkgs/by-name/pr/protege/package.nix
@@ -11,17 +11,17 @@
 
 maven.buildMavenPackage rec {
   pname = "protege";
-  version = "5.6.4";
+  version = "5.6.8";
 
   src = fetchFromGitHub {
     owner = "protegeproject";
     repo = "protege";
     rev = version;
-    hash = "sha256-Q3MHa7nCeF31n7JPltcemFBc/sJwGA9Ev0ymjQhY/U0=";
+    hash = "sha256-GplMEVEBYSTTzrGzbHlbQTXqJYka6r0QfBZFVCS7wCs=";
   };
 
   mvnJdk = jdk11;
-  mvnHash = "sha256-kemP2gDv1CYuaoK0fwzBxdLTusarPasf2jCDQj/HPYE=";
+  mvnHash = "sha256-xC/zLPPLbQ8tZIkCZHOfY6FEaWXFF5ZC1LX4ovaSSqg=";
 
   patches = [
     # Pin built-in Maven plugins to avoid checksum variations on Maven updates
diff --git a/pkgs/by-name/pr/proxyman/package.nix b/pkgs/by-name/pr/proxyman/package.nix
index 0793d5e73dda..ea67f43797b6 100644
--- a/pkgs/by-name/pr/proxyman/package.nix
+++ b/pkgs/by-name/pr/proxyman/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "proxyman";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchurl {
     url = "https://github.com/ProxymanApp/proxyman-windows-linux/releases/download/${version}/Proxyman-${version}.AppImage";
-    hash = "sha256-F6IXoi2Ibqle7L18wW3yEaGvjIlAFapoPnNo1e8qdW4=";
+    hash = "sha256-uGzegB/t/9/ovgTY3F2ihBKOgLKDenZh2Ojg9SBNQos=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/qu/quadrapassel/package.nix b/pkgs/by-name/qu/quadrapassel/package.nix
index 5fc8d7db93be..d58330cf8ca7 100644
--- a/pkgs/by-name/qu/quadrapassel/package.nix
+++ b/pkgs/by-name/qu/quadrapassel/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quadrapassel";
-  version = "49.2.1";
+  version = "49.2.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/quadrapassel/${lib.versions.major finalAttrs.version}/quadrapassel-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pTIKb47ghWKkNsq6TjT3rgQP7cjXL76iJ/cCXZPExrk=";
+    hash = "sha256-+ecxK/oPg1pOC/U181ax6VNxlIQ+Xe/1YR9z3C3b85k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/rebels-in-the-sky/package.nix b/pkgs/by-name/re/rebels-in-the-sky/package.nix
index 144d25859e29..e18a155323a2 100644
--- a/pkgs/by-name/re/rebels-in-the-sky/package.nix
+++ b/pkgs/by-name/re/rebels-in-the-sky/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rebels-in-the-sky";
-  version = "1.4.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "ricott1";
     repo = "rebels-in-the-sky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uucR8P08g1tIFUcAhB0OAa975vITfcqObx7cPPRuSao=";
+    hash = "sha256-VyQfwZWvutc5BnAi6BbIfgRm5G4xBre76cyraQSvn6o=";
   };
 
-  cargoHash = "sha256-iIJBM+XjZhM/zp8PDwfIvffoNfr1ih54/gPsr4LRmxM=";
+  cargoHash = "sha256-PL5WhqCLlH482uDoWETfwHarz3e2NJ0vezDMs52QavQ=";
 
   patches = lib.optionals (!withRadio) [
     ./disable-radio.patch
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index f8e3e7991935..6c0bd88ce615 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.3.3";
+  version = "25.3.4";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-Tr2oaEYF1ierXR7/TdsHM+U4MzndC5uy39YLJGGGmEw=";
+    sha256 = "sha256-I5WtwY6CODf64x5ZjFBFQagQ3HkIBvuJil92sajSqRM=";
   };
 in
 buildGoModule rec {
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index 884c0310422c..9a7c233c308a 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.22.49";
+  version = "1.22.51";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-nz1iLggvygmHvCQWGbLTovhHaivMQSeX/sMWyypFrns=";
+    hash = "sha256-ss+gH0FRIDpAkz3dMF0X45p8XJKDnJbqrvMGpmyFldM=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/re/rewaita/package.nix b/pkgs/by-name/re/rewaita/package.nix
index 6fcf29703dea..cb461ef5680d 100644
--- a/pkgs/by-name/re/rewaita/package.nix
+++ b/pkgs/by-name/re/rewaita/package.nix
@@ -12,11 +12,12 @@
   appstream-glib,
   blueprint-compiler,
   libadwaita,
-  libportal,
+  libportal-gtk4,
+  gtksourceview5,
   nix-update-script,
 }:
 let
-  version = "1.0.8";
+  version = "1.1.0";
 in
 python3Packages.buildPythonApplication {
   pname = "rewaita";
@@ -27,7 +28,7 @@ python3Packages.buildPythonApplication {
     owner = "SwordPuffin";
     repo = "Rewaita";
     tag = "v${version}";
-    hash = "sha256-T1MrSg3DO6U/ztX4LYB1Uhpne+7xAfr8+INV5CyS0eE=";
+    hash = "sha256-B3CxtGKLvlGORae1b7vMDFbvNntVO24yrzbiHzOP28k=";
   };
 
   postPatch = ''
@@ -51,12 +52,16 @@ python3Packages.buildPythonApplication {
 
   dependencies = with python3Packages; [
     pygobject3
+    pillow
+    numpy
+    fortune
   ];
 
   buildInputs = [
     libadwaita
     gtk4
-    libportal
+    libportal-gtk4
+    gtksourceview5
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/sn/snapshot/package.nix b/pkgs/by-name/sn/snapshot/package.nix
index bf00d1a567b6..27f72987a679 100644
--- a/pkgs/by-name/sn/snapshot/package.nix
+++ b/pkgs/by-name/sn/snapshot/package.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snapshot";
-  version = "49.0";
+  version = "49.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/snapshot/${lib.versions.major finalAttrs.version}/snapshot-${finalAttrs.version}.tar.xz";
-    hash = "sha256-X5YZPSkZxzVXRdJqGwHyPDyzCpPHQtWD7EKSfEpFrhg=";
+    hash = "sha256-NVj2+ODTiylQtrrZue7COCSb7f7c5w+1iijK1pRebOk=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ti/tidal-hifi/electron.nix b/pkgs/by-name/ti/tidal-hifi/electron.nix
index 5bc5a7d87dbd..96c9a4b7491c 100644
--- a/pkgs/by-name/ti/tidal-hifi/electron.nix
+++ b/pkgs/by-name/ti/tidal-hifi/electron.nix
@@ -8,11 +8,11 @@ let
     https://github.com/Mastermindzh/tidal-hifi/blob/master/build/electron-builder.base.yml
      for the expected version
   */
-  version = "37.2.5";
+  version = "39.2.4";
 in
 (fetchzip {
   url = "https://github.com/castlabs/electron-releases/releases/download/v${version}+wvcus/electron-v${version}+wvcus-linux-x64.zip";
-  hash = "sha256-mRbweXYfsWxu7I+pqtBjgA0n+ad2iFawVbDUBT5+LZo=";
+  hash = "sha256-i2uoX8RkzHN+j0JjZxmWIP2euJMp8Lv9IUYrrmwP7ww=";
   stripRoot = false;
 
 }).overrideAttrs
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index 85ca23dbeda9..7997195c60d1 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -47,7 +47,7 @@
 }:
 
 let
-  version = "5.20.1";
+  version = "6.0.0";
 
   electronLibPath = lib.makeLibraryPath [
     alsa-lib
@@ -95,7 +95,7 @@ buildNpmPackage (self: {
     owner = "Mastermindzh";
     repo = "tidal-hifi";
     tag = version;
-    hash = "sha256-uiRvbxUztLwNSB1BHa9rGrPl2akt21VqxEV4pBgNwPo=";
+    hash = "sha256-t9sNOLIhxA2/5tpILgGkNkkg1wmX2smcEeWWh424GPA=";
   };
 
   nativeBuildInputs = [
@@ -104,7 +104,7 @@ buildNpmPackage (self: {
     copyDesktopItems
   ];
 
-  npmDepsHash = "sha256-BsHlATxdZ/5QFr2HAGSeKo+aR7udfD6X8h/qyJnBrr0=";
+  npmDepsHash = "sha256-CvqKElGYJ/sXxIz/vEWi21tyyPbRoZgQG8We1g2XNHM=";
   forceGitDeps = true;
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/to/tokei/package.nix b/pkgs/by-name/to/tokei/package.nix
index fd3614a81618..1cb2dd5dc7c2 100644
--- a/pkgs/by-name/to/tokei/package.nix
+++ b/pkgs/by-name/to/tokei/package.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tokei";
-  version = "13.0.0";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "XAMPPRocky";
     repo = "tokei";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7VyjNqwyqJhTTnaiijwXxHzWzk6GbxvQJPjIf250Kfc=";
+    hash = "sha256-BpQ+Aurx2CkFRcozUTbmLLAg7v3NkgKXm5y0TiQCfHw=";
   };
 
   patches = [
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     })
   ];
 
-  cargoHash = "sha256-aCSz4BwSk+h+LLOPoBHy2lOmLeZI35o3qXSCE0UmEBY=";
+  cargoHash = "sha256-x1Oi+B6DpbsCqnX0Lp5LsmoVHNvdibwj/IEgFvhepqY=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
diff --git a/pkgs/by-name/un/undock/package.nix b/pkgs/by-name/un/undock/package.nix
index 94fcb8d0dee4..5a0ddc6543d1 100644
--- a/pkgs/by-name/un/undock/package.nix
+++ b/pkgs/by-name/un/undock/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "undock";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "crazy-max";
     repo = "undock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p4x8SCYLErcu0ACbWUTjZVlzF+QEoC6xS7rpsOno/yw=";
+    hash = "sha256-sFH6+2Ncg8B+Vxs2IyRurwJdzKiKRwmQKIoxjKY8+JE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/uu/uutils-findutils/package.nix b/pkgs/by-name/uu/uutils-findutils/package.nix
index b072ad7ef08f..1292ced9cc60 100644
--- a/pkgs/by-name/uu/uutils-findutils/package.nix
+++ b/pkgs/by-name/uu/uutils-findutils/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   rustPlatform,
   nix-update-script,
   versionCheckHook,
@@ -17,7 +18,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-i+ryTF2hlZFbyFft/769c800FkzL26E4snUsxU79sKY=";
   };
 
-  cargoHash = "sha256-gtaD2jqnGhoJGw9FAJefnU9BSGIODi/RrhTeB3MC69U=";
+  cargoPatches = [
+    (fetchpatch2 {
+      url = "https://github.com/uutils/findutils/commit/90845d95ceb12289a1b5ee50704ed66f2f7349c3.patch";
+      hash = "sha256-sCqOzfa3R45tXTK3N4344qb8YRmiW0o/lZwqHoBvgl8=";
+    })
+  ];
+
+  cargoHash = "sha256-TQRt1eecT500JaJB2P10T1yV+z2/T8cgTNtF9r5zQpg=";
 
   postInstall = ''
     rm $out/bin/testing-commandline
@@ -42,9 +50,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/uutils/findutils";
     license = lib.licenses.mit;
     mainProgram = "find";
-    maintainers = with lib.maintainers; [
-      defelo
-    ];
+    maintainers = with lib.maintainers; [ defelo ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/va/vaultwarden/package.nix b/pkgs/by-name/va/vaultwarden/package.nix
index 59e9df325a08..76dc7a02bfbf 100644
--- a/pkgs/by-name/va/vaultwarden/package.nix
+++ b/pkgs/by-name/va/vaultwarden/package.nix
@@ -19,16 +19,16 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.35.0";
+  version = "1.35.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     tag = version;
-    hash = "sha256-Thj/I9eLngErUskKxnJ5Bd2Q9Hgp1e/6hWiiEyJ7lOQ=";
+    hash = "sha256-Lp3BDObJItscI1ifx8kFScSCaOajQMycYgGfpjVTL8I=";
   };
 
-  cargoHash = "sha256-/sKUAADlxzMOyThvYhFLK52oOePFQC1V8hF9Ay5Atis=";
+  cargoHash = "sha256-XqZOy84L6Spzd1NZf4CzZsdhDhrYNoQGToad4giFJR8=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = version;
diff --git a/pkgs/by-name/va/vaultwarden/webvault.nix b/pkgs/by-name/va/vaultwarden/webvault.nix
index 5f292537c3a7..899f2ca08578 100644
--- a/pkgs/by-name/va/vaultwarden/webvault.nix
+++ b/pkgs/by-name/va/vaultwarden/webvault.nix
@@ -11,7 +11,7 @@
 
 buildNpmPackage rec {
   pname = "vaultwarden-webvault";
-  version = "2025.12.0.0";
+  version = "2025.12.1.0";
 
   # doesn't build with newer versions
   nodejs = nodejs_22;
@@ -20,10 +20,10 @@ buildNpmPackage rec {
     owner = "vaultwarden";
     repo = "vw_web_builds";
     tag = "v${version}";
-    hash = "sha256-j31wroJKBa6pQFDTGtZBBljXVvpt8233G2oTj8oz3fo=";
+    hash = "sha256-s2PTB6ABN2qubwAjqWvO9jXndQxIHlI3qoTFBCRw8iU=";
   };
 
-  npmDepsHash = "sha256-OT9Ll+F4e/yOJVpay/zwfEHcBqRvSFOM2mtlrJ8E6fs=";
+  npmDepsHash = "sha256-tM+jAhM+/QB+o6wNJJMSZ/HTcWnPR0DyYItdhlVVyc4=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/by-name/ve/veilid/package.nix b/pkgs/by-name/ve/veilid/package.nix
index 3e6f80b4e028..d4b32d6ef24a 100644
--- a/pkgs/by-name/ve/veilid/package.nix
+++ b/pkgs/by-name/ve/veilid/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veilid";
-  version = "0.4.8";
+  version = "0.5.0";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = "veilid";
     rev = "v${version}";
-    hash = "sha256-ZhF9dMYrd+nui/tw1SuL0i6zB/niBfsd40SQzRgGF6Q=";
+    hash = "sha256-cdFC5KgdLxykXtB2YG/HKJCrEBnw1lYJ3IJkRwMC49s=";
   };
 
-  cargoHash = "sha256-Q4M6cb9xYxeH4O7YL2K8olJ9w8Iq34hYpuJEGGhVN+Y=";
+  cargoHash = "sha256-TtGXCxEEb8PngN3tzybY5P0LgeAMQoxvUp1qSLfj830=";
 
   nativeBuildInputs = [
     capnproto
diff --git a/pkgs/by-name/vi/victorialogs/package.nix b/pkgs/by-name/vi/victorialogs/package.nix
index 9f562333faaf..192b724da049 100644
--- a/pkgs/by-name/vi/victorialogs/package.nix
+++ b/pkgs/by-name/vi/victorialogs/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaLogs";
-  version = "1.38.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaLogs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UosxxeTZzM/f2rqUdMqPxHgnu57/dUc/X7gFOySy+M4=";
+    hash = "sha256-liHpejO6wVr3YEyWhBwakWlDfly7mujVhQn7Sl5Z1kE=";
   };
 
   vendorHash = null;
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {
   postPatch = ''
     # Relax go version to major.minor
     sed -i -E 's/^(go[[:space:]]+[[:digit:]]+\.[[:digit:]]+)\.[[:digit:]]+$/\1/' go.mod
-    sed -i -E 's/^(go[[:space:]]+[[:digit:]]+\.[[:digit:]]+)\.[[:digit:]]+$/\1/' vendor/modules.txt
+    sed -i -E 's/^(## explicit; go[[:space:]]+[[:digit:]]+\.[[:digit:]]+)\.[[:digit:]]+$/\1/' vendor/modules.txt
   '';
 
   ldflags = [
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index fc4276264487..0a0b60076f19 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -40,6 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    # don't fail if node version doesn't fit the constraint
+    substituteInPlace .npmrc \
+      --replace-fail "engine-strict=true" ""
+
     # unlock the overly specific pnpm package version pin
     # and also set version to a proper value
     jq "del(.packageManager) | .version = \"$version\"" package.json | sponge package.json
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index f15348cb2cce..d5b28c766726 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.13.3",
+    "version": "1.13.5",
     "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/f5d6162bf21a6caf7ad124c0ddf9cb1089034608/Windsurf-darwin-arm64-1.13.3.zip",
-    "sha256": "e2271b125a05ac8c23627d1bd77262ec3229a155b8cc0662c9e2dc186582a692"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/97d7a9c6ff229572f6154acb491d23ffeb2d932e/Windsurf-darwin-arm64-1.13.5.zip",
+    "sha256": "52219286140ceb6bf880b1de6af1cb24756244b2b550b1afe901d651feaaef3c"
   },
   "x86_64-darwin": {
-    "version": "1.13.3",
+    "version": "1.13.5",
     "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/f5d6162bf21a6caf7ad124c0ddf9cb1089034608/Windsurf-darwin-x64-1.13.3.zip",
-    "sha256": "cf0b7736e492ecfe0b1df2f801930d22348c3ff09addc29095f14e41b28227a2"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/97d7a9c6ff229572f6154acb491d23ffeb2d932e/Windsurf-darwin-x64-1.13.5.zip",
+    "sha256": "59635461c47df84c94556fa51ee7b872f7f5ef3e496bfcf2d1ac872d622cc811"
   },
   "x86_64-linux": {
-    "version": "1.13.3",
+    "version": "1.13.5",
     "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/f5d6162bf21a6caf7ad124c0ddf9cb1089034608/Windsurf-linux-x64-1.13.3.tar.gz",
-    "sha256": "f99695a40775b275d9e09dd5ce9d56d3a15c98ad58804e40e4c8a6dc060926cc"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/97d7a9c6ff229572f6154acb491d23ffeb2d932e/Windsurf-linux-x64-1.13.5.tar.gz",
+    "sha256": "0b4333e77c93d21901149ee21323653a9dbf8b5f6d37bc281ab6158569038e8f"
   }
 }
diff --git a/pkgs/by-name/wi/wiringpi/package.nix b/pkgs/by-name/wi/wiringpi/package.nix
index fa51adc7e33f..722adfaaa88e 100644
--- a/pkgs/by-name/wi/wiringpi/package.nix
+++ b/pkgs/by-name/wi/wiringpi/package.nix
@@ -25,6 +25,10 @@ let
       inherit version src;
       sourceRoot = "${src.name}/${subprj}";
       inherit buildInputs;
+
+      # Fix build with gcc 15
+      env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
       # Remove (meant for other OSs) lines from Makefiles
       preInstall = ''
         sed -i "/chown root/d" Makefile
diff --git a/pkgs/by-name/wx/wxedid/package.nix b/pkgs/by-name/wx/wxedid/package.nix
new file mode 100644
index 000000000000..61227f1564e2
--- /dev/null
+++ b/pkgs/by-name/wx/wxedid/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  wrapGAppsHook3,
+  wxwidgets_3_3,
+}:
+stdenv.mkDerivation rec {
+  pname = "wxedid";
+  version = "0.0.33";
+
+  src = fetchzip {
+    url = "https://downloads.sourceforge.net/project/wxedid/wxedid-${version}.tar.gz";
+    hash = "sha256-ShO2e5rQCVBdgyg4iiFzFEywl2m9A+jILMGI+MT8qgo=";
+  };
+  nativeBuildInputs = [
+    wrapGAppsHook3
+  ];
+  buildInputs = [
+    wxwidgets_3_3
+  ];
+  prePatch = ''
+    patchShebangs src/rcode/rcd_autogen
+  '';
+
+  meta = with lib; {
+    description = "wxWidgets-based EDID (Extended Display Identification Data) editor";
+    homepage = "https://sourceforge.net/projects/wxedid";
+    license = licenses.gpl3Only;
+    mainProgram = "wxedid";
+    maintainers = [ maintainers.meanwhile131 ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/xf/xfce4-panel/package.nix b/pkgs/by-name/xf/xfce4-panel/package.nix
index 1b9a92bd8fc0..6e44474b825d 100644
--- a/pkgs/by-name/xf/xfce4-panel/package.nix
+++ b/pkgs/by-name/xf/xfce4-panel/package.nix
@@ -31,7 +31,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-panel";
-  version = "4.20.5";
+  version = "4.20.6";
 
   outputs = [
     "out"
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xfce";
     repo = "xfce4-panel";
     tag = "xfce4-panel-${finalAttrs.version}";
-    hash = "sha256-Jftj+EmmsKfK9jk8rj5uMjpteFUHFgOpoEol8JReDNI=";
+    hash = "sha256-yfiF+ciuRNJzBt3n1rH2ywA1vNGYRVHu2ojf/EIGwyg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xf/xfce4-settings/package.nix b/pkgs/by-name/xf/xfce4-settings/package.nix
index dbc5078e6499..9694bf28f248 100644
--- a/pkgs/by-name/xf/xfce4-settings/package.nix
+++ b/pkgs/by-name/xf/xfce4-settings/package.nix
@@ -24,6 +24,7 @@
   # https://gitlab.xfce.org/xfce/xfce4-settings/-/issues/222
   withUpower ? false,
   wlr-protocols,
+  xapp,
   xfconf,
   xf86inputlibinput,
   colord,
@@ -33,14 +34,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-settings";
-  version = "4.20.2";
+  version = "4.20.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.xfce.org";
     owner = "xfce";
     repo = "xfce4-settings";
     tag = "xfce4-settings-${finalAttrs.version}";
-    hash = "sha256-hx1ilXPcwWWDwNR/k2b+9vR5aCv9UlPR0d42OE6JxEk=";
+    hash = "sha256-dQyALVooaie2vkETghddKM4HqAZQmx3E9UJ+ChKtydc=";
   };
 
   nativeBuildInputs = [
@@ -64,6 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxfce4util
     libxklavier
     wlr-protocols
+    xapp # org.x.apps.portal
     xf86inputlibinput
     xfconf
   ]
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index 03a1113b8e20..edd2c83b2d39 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "yamlscript";
-  version = "0.2.4";
+  version = "0.2.8";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${finalAttrs.version}/yamlscript.cli-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-iNkHdKPrO0dgpvxGiRdvWIhnuh9yKySgYAcVNMUVQcU=";
+    hash = "sha256-qA8j14xUWtg2988ahklawnRZl9u3pvogjjXXs8byE2g=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/libraries/cassandra-cpp-driver/default.nix b/pkgs/development/libraries/cassandra-cpp-driver/default.nix
index 59b52ecfa25c..66e868fe9692 100644
--- a/pkgs/development/libraries/cassandra-cpp-driver/default.nix
+++ b/pkgs/development/libraries/cassandra-cpp-driver/default.nix
@@ -1,5 +1,6 @@
 {
   fetchFromGitHub,
+  fetchpatch,
   lib,
   stdenv,
   cmake,
@@ -20,6 +21,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-GuvmKHJknudyn7ahrn/8+kKUA4NW5UjCfkYoX3aTE+Q=";
   };
 
+  patches = [
+    # https://github.com/apache/cassandra-cpp-driver/pull/580
+    (fetchpatch {
+      name = "fix-cmake-version.patch";
+      url = "https://github.com/apache/cassandra-cpp-driver/commit/a4061051bcdfa0a67117b546897552c38493d545.patch?full_index=1";
+      hash = "sha256-hQhm2SYLd8uPC85/iOH3sEM2KvoIGwV+9NGIJFnZJhc=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 9eecf781a3d1..f663b0fa7682 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -589,7 +589,7 @@ in
     '';
   });
 
-  luaossl = prev.luaossl.overrideAttrs (_: {
+  luaossl = prev.luaossl.overrideAttrs (old: {
     externalDeps = [
       {
         name = "CRYPTO";
@@ -600,6 +600,10 @@ in
         dep = openssl;
       }
     ];
+
+    env = old.env // {
+      NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types"; # for gcc15
+    };
   });
 
   luaposix = prev.luaposix.overrideAttrs (_: {
diff --git a/pkgs/development/ocaml-modules/lreplay/default.nix b/pkgs/development/ocaml-modules/lreplay/default.nix
new file mode 100644
index 000000000000..b7d3786365ec
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lreplay/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildDunePackage,
+  dune-site,
+  fetchzip,
+  frama-c,
+  menhir,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "lreplay";
+  version = "0.1.1";
+
+  src = fetchzip {
+    url = "https://git.frama-c.com/pub/ltest/lreplay/-/archive/${finalAttrs.version}/lreplay-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-FSICl9x/uL4hMVFz5Ef7NYKATZDdtYY9DRU0AZKSDD8=";
+  };
+
+  nativeBuildInputs = [
+    menhir
+  ];
+
+  meta = {
+    description = "Lreplay plugin of Frama-C, part of the LTest suite";
+    homepage = "https://frama-c.com/fc-plugins/ltest.html";
+    license = lib.licenses.lgpl2;
+    maintainers = with lib.maintainers; [ redianthus ];
+    mainProgram = "lreplay";
+  };
+})
diff --git a/pkgs/development/ocaml-modules/mustache/default.nix b/pkgs/development/ocaml-modules/mustache/default.nix
index cefb4d3c1b77..d2f6da48542c 100644
--- a/pkgs/development/ocaml-modules/mustache/default.nix
+++ b/pkgs/development/ocaml-modules/mustache/default.nix
@@ -5,26 +5,27 @@
   ezjsonm,
   menhir,
   menhirLib,
-  ounit,
+  ounit2,
 }:
 
 buildDunePackage rec {
   pname = "mustache";
-  version = "3.1.0";
-  duneVersion = "3";
+  version = "3.3.0";
   src = fetchFromGitHub {
     owner = "rgrinberg";
     repo = "ocaml-mustache";
-    rev = "v${version}";
-    sha256 = "19v8rk8d8lkfm2rmhdawfgadji6wa267ir5dprh4w9l1sfj8a1py";
+    tag = "v${version}";
+    hash = "sha256-7rdp7nrjc25/Nuj/cf78qxS3Qy4ufaNcKjSnYh4Ri8U=";
   };
 
   nativeBuildInputs = [ menhir ];
-  buildInputs = [ ezjsonm ];
   propagatedBuildInputs = [ menhirLib ];
 
-  doCheck = true;
-  checkInputs = [ ounit ];
+  doCheck = false; # Disabled because of "Error: Program mustache-ocaml not found in the tree or in PATH"
+  checkInputs = [
+    ezjsonm
+    ounit2
+  ];
 
   meta = {
     description = "Mustache logic-less templates in OCaml";
diff --git a/pkgs/development/python-modules/beartype/default.nix b/pkgs/development/python-modules/beartype/default.nix
index 1458225ed605..a8a1149930d6 100644
--- a/pkgs/development/python-modules/beartype/default.nix
+++ b/pkgs/development/python-modules/beartype/default.nix
@@ -20,6 +20,14 @@ buildPythonPackage rec {
     hash = "sha256-oD7LS+c+mZ8W4YnAaAYxQkbUlmO8E2TPxy0PBI7Jr7A=";
   };
 
+  # Several tests fail with:
+  # - beartype.roar.BeartypeDecorHintNonpepException
+  # - RuntimeError: There is no current event loop in thread 'MainThread'
+  # - Failed: DID NOT RAISE <class 'beartype.roar.BeartypeDecorHintNonpepException'>
+  # - AssertionError
+  # - ...
+  disabled = pythonAtLeast "3.14";
+
   build-system = [ hatchling ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/curated-tokenizers/default.nix b/pkgs/development/python-modules/curated-tokenizers/default.nix
index 991e8e720f7c..fd4a4888bca7 100644
--- a/pkgs/development/python-modules/curated-tokenizers/default.nix
+++ b/pkgs/development/python-modules/curated-tokenizers/default.nix
@@ -21,6 +21,11 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  # Fix gcc15 build failures due to missing <cstdint>
+  postPatch = ''
+    sed -i '1i #include <cstdint>' sentencepiece/src/sentencepiece_processor.h
+  '';
+
   build-system = [
     cython
     setuptools
diff --git a/pkgs/development/python-modules/datalad/default.nix b/pkgs/development/python-modules/datalad/default.nix
index 4eff6daf3a68..75fce24de6c3 100644
--- a/pkgs/development/python-modules/datalad/default.nix
+++ b/pkgs/development/python-modules/datalad/default.nix
@@ -58,7 +58,7 @@ buildPythonPackage rec {
     owner = "datalad";
     repo = "datalad";
     tag = version;
-    hash = "sha256-VkHTX0j963N2HMwHoJv8M314SykXFB9u4eqIUDeJ+tw=";
+    hash = "sha256-C3e9k4RDFfDMaimZ/7TtAJNzdlfVrKoTHVl0zKL9EjI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fipy/default.nix b/pkgs/development/python-modules/fipy/default.nix
index 995962006f9f..c2dcdd60488d 100644
--- a/pkgs/development/python-modules/fipy/default.nix
+++ b/pkgs/development/python-modules/fipy/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "usnistgov";
     repo = "fipy";
     rev = "refs/tags/${version}";
-    hash = "sha256-345YrGQgHNq0FULjJjLqHksyfm/EHl+KyGfxwS6xK9U=";
+    hash = "sha256-usuAj+bIzbCSxYuKeUDxEESbjxPCwYwdD/opaBbgl1w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-dance/default.nix b/pkgs/development/python-modules/flask-dance/default.nix
index 0171e1e2181b..e2ff59f6a75f 100644
--- a/pkgs/development/python-modules/flask-dance/default.nix
+++ b/pkgs/development/python-modules/flask-dance/default.nix
@@ -3,26 +3,19 @@
   betamax,
   blinker,
   buildPythonPackage,
-  coverage,
   fetchFromGitHub,
   flask,
   flask-caching,
   flask-login,
   flask-sqlalchemy,
-  flit,
+  flit-core,
   freezegun,
   oauthlib,
-  pallets-sphinx-themes,
-  pillow,
-  pytest,
   pytest-mock,
   pytestCheckHook,
   requests,
   requests-oauthlib,
   responses,
-  sphinx,
-  sphinxcontrib-seqdiag,
-  sphinxcontrib-spelling,
   sqlalchemy,
   urlobject,
   werkzeug,
@@ -40,7 +33,7 @@ buildPythonPackage rec {
     hash = "sha256-rKHC0G5S7l52QSrbbweMii68AZuBAgf6tYsJdPKIeUk=";
   };
 
-  build-system = [ flit ];
+  build-system = [ flit-core ];
 
   dependencies = [
     flask
@@ -52,36 +45,21 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    docs = [
-      betamax
-      pallets-sphinx-themes
-      pillow
-      sphinx
-      sphinxcontrib-seqdiag
-      sphinxcontrib-spelling
-      sqlalchemy
-    ];
-
     signals = [ blinker ];
-
     sqla = [ sqlalchemy ];
-
-    test = [
-      betamax
-      coverage
-      flask-caching
-      flask-login
-      flask-sqlalchemy
-      freezegun
-      oauthlib
-      pytest
-      pytest-mock
-      responses
-      sqlalchemy
-    ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = [
+    betamax
+    flask-caching
+    flask-login
+    flask-sqlalchemy
+    freezegun
+    pytest-mock
+    pytestCheckHook
+    responses
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   pythonImportsCheck = [ "flask_dance" ];
 
diff --git a/pkgs/development/python-modules/fortune/default.nix b/pkgs/development/python-modules/fortune/default.nix
new file mode 100644
index 000000000000..10f858de1330
--- /dev/null
+++ b/pkgs/development/python-modules/fortune/default.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitea,
+  setuptools,
+}:
+let
+  version = "1.1.2";
+in
+buildPythonPackage {
+  pname = "fortune";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "jamesansley";
+    repo = "fortune";
+    tag = "v${version}";
+    hash = "sha256-XEWO1B+o0p7mpHprvbdBgfSQrqPuUTaotulcP3FS/Mg=";
+  };
+
+  build-system = [ setuptools ];
+
+  meta = {
+    description = "A rewrite of fortune in python";
+    mainProgram = "fortune";
+    homepage = "https://codeberg.org/jamesansley/fortune";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+  };
+}
diff --git a/pkgs/development/python-modules/patator/default.nix b/pkgs/development/python-modules/patator/default.nix
deleted file mode 100644
index 12af22bc6733..000000000000
--- a/pkgs/development/python-modules/patator/default.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  lib,
-  ajpy,
-  buildPythonPackage,
-  cx-oracle,
-  dnspython,
-  fetchPypi,
-  impacket,
-  ipy,
-  mysqlclient,
-  paramiko,
-  psycopg2,
-  pyasn1,
-  pycrypto,
-  pycurl,
-  pyopenssl,
-  pysnmp,
-  pysqlcipher3,
-  pythonOlder,
-}:
-
-buildPythonPackage rec {
-  pname = "patator";
-  version = "1.1.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-BupB/s4HNk6DUxbrHB/onqeS7kL0WsGPZ2jqKUj7DJw=";
-  };
-
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace psycopg2-binary psycopg2
-  '';
-
-  propagatedBuildInputs = [
-    ajpy
-    cx-oracle
-    dnspython
-    impacket
-    ipy
-    mysqlclient
-    paramiko
-    psycopg2
-    pyasn1
-    pycrypto
-    pycurl
-    pyopenssl
-    pysnmp
-    pysqlcipher3
-  ];
-
-  # tests require docker-compose and vagrant
-  doCheck = false;
-
-  meta = {
-    description = "Multi-purpose brute-forcer";
-    homepage = "https://github.com/lanjelot/patator";
-    license = lib.licenses.gpl2Only;
-    # Still uses cx-oracle which is broken and was replaced by oracledb
-    # https://github.com/lanjelot/patator/issues/234
-    broken = true;
-  };
-}
diff --git a/pkgs/development/python-modules/pysqlcipher3/default.nix b/pkgs/development/python-modules/pysqlcipher3/default.nix
deleted file mode 100644
index 1727d1dd49c8..000000000000
--- a/pkgs/development/python-modules/pysqlcipher3/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  sqlcipher,
-}:
-
-buildPythonPackage rec {
-  pname = "pysqlcipher3";
-  version = "1.2.0";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-PIAzgSZVlH6/KagJrFEGsrxpvgJ06szva1j0WAyNBsU=";
-  };
-
-  buildInputs = [ sqlcipher ];
-
-  pythonImportsCheck = [ "pysqlcipher3" ];
-
-  meta = {
-    description = "Python 3 bindings for SQLCipher";
-    homepage = "https://github.com/rigglemania/pysqlcipher3/";
-    license = lib.licenses.zlib;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/traittypes/default.nix b/pkgs/development/python-modules/traittypes/default.nix
index bcd7ed2dfe20..13d2363b4000 100644
--- a/pkgs/development/python-modules/traittypes/default.nix
+++ b/pkgs/development/python-modules/traittypes/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  isPy27,
   pytestCheckHook,
   setuptools,
   numpy,
@@ -11,25 +10,18 @@
   traitlets,
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "traittypes";
-  version = "0.2.1-unstable-2020-07-17";
+  version = "0.2.3";
   pyproject = true;
 
-  disabled = isPy27;
-
   src = fetchFromGitHub {
     owner = "jupyter-widgets";
     repo = "traittypes";
-    rev = "af2ebeec9e58b73a12d4cf841bd506d6eadb8868";
-    hash = "sha256-q7kt8b+yDHsWML/wCeND9PrZMVjemhzG7Ih1OtHbnTw=";
+    tag = version;
+    hash = "sha256-RwEZs4QFK+IrPFPBI7+jnQSFQryQFzEbrnOF8OyExuk=";
   };
 
-  postPatch = ''
-    substituteInPlace traittypes/tests/test_traittypes.py \
-      --replace-fail "np.int" "int"
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [ traitlets ];
@@ -41,6 +33,11 @@ buildPythonPackage {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # AssertionError; see https://github.com/jupyter-widgets/traittypes/issues/55
+    "test_initial_values"
+  ];
+
   pythonImportsCheck = [ "traittypes" ];
 
   meta = {
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e944bdba59ae..7141f7c4099d 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -1869,6 +1869,15 @@ let
       };
     });
 
+    rvisidata = old.rvisidata.overrideAttrs (attrs: {
+      postPatch = ''
+        substituteInPlace R/main.r --replace-fail \
+          "system(\"vd" "system(\"${lib.getBin pkgs.visidata}/bin/vd"
+        substituteInPlace R/tmux.r --replace-fail \
+          "return(\"vd\")" "return(\"${lib.getBin pkgs.visidata}/bin/vd\")"
+      '';
+    });
+
     timeless = old.timeless.overrideAttrs (attrs: {
       preConfigure = "patchShebangs configure";
       cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 181e875e7708..3dbf40cc5018 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -483,6 +483,7 @@ mapAliases {
   crystal_1_11 = throw "'crystal_1_11' has been removed as it is obsolete and no longer used in the tree. Consider using 'crystal' instead"; # Added 2025-09-04
   csslint = throw "'csslint' has been removed as upstream considers it abandoned."; # Addeed 2025-11-07
   cstore_fdw = throw "'cstore_fdw' has been removed. Use 'postgresqlPackages.cstore_fdw' instead."; # Added 2025-07-19
+  ctpp2 = throw "'ctpp2' has been removed due to lack of maintenance."; # Added 2025-12-31
   cudaPackages_11 = throw "CUDA 11 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cudaPackages_11_0 = throw "CUDA 11.0 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cudaPackages_11_1 = throw "CUDA 11.1 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 5bcdeeae5423..db0116e80d75 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1093,6 +1093,8 @@ let
 
         logs-syslog = callPackage ../development/ocaml-modules/logs-syslog { };
 
+        lreplay = callPackage ../development/ocaml-modules/lreplay { };
+
         lru = callPackage ../development/ocaml-modules/lru { };
 
         lsp = callPackage ../development/ocaml-modules/ocaml-lsp/lsp.nix { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3faeeac9e10f..fc422f95a703 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -297,6 +297,7 @@ mapAliases {
   pam = throw "'pam' has been renamed to/replaced by 'python-pam'"; # Converted to throw 2025-10-29
   paramz = throw "'paramz' has been removed as it is incompatible with Numpy 2"; # added 2025-11-10
   PasteDeploy = throw "'PasteDeploy' has been renamed to/replaced by 'pastedeploy'"; # Converted to throw 2025-10-29
+  patator = throw "'patator' has been removed as it was dependant on removed packages and broken"; # Added 2025-12-30
   pathpy = throw "'pathpy' has been renamed to/replaced by 'path'"; # Converted to throw 2025-10-29
   pcbnew-transition = throw "'pcbnew-transition' has been renamed to/replaced by 'pcbnewtransition'"; # Converted to throw 2025-10-29
   pdfminer = throw "'pdfminer' has been renamed to/replaced by 'pdfminer-six'"; # Converted to throw 2025-10-29
@@ -370,6 +371,7 @@ mapAliases {
   pySmartDL = throw "'pySmartDL' has been renamed to/replaced by 'pysmartdl'"; # Converted to throw 2025-10-29
   pysmi-lextudio = throw "'pysmi-lextudio' has been renamed to/replaced by 'pysmi'"; # Converted to throw 2025-10-29
   pysnmp-lextudio = throw "'pysnmp-lextudio' has been renamed to/replaced by 'pysnmp'"; # Converted to throw 2025-10-29
+  pysqlcipher3 = throw "'pysqlcipher3' has been removed has it was abandonned upstream and broken"; # Added 2025-12-30
   PyStemmer = throw "'PyStemmer' has been renamed to/replaced by 'pystemmer'"; # Converted to throw 2025-10-29
   pysuez = throw "'pysuez' has been renamed to/replaced by 'pysuezv2'"; # Converted to throw 2025-10-29
   pytado = throw "'pytado' has been renamed to/replaced by 'python-tado'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3d37154edde5..de97391232de 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5747,6 +5747,8 @@ self: super: with self; {
 
   fortiosapi = callPackage ../development/python-modules/fortiosapi { };
 
+  fortune = callPackage ../development/python-modules/fortune { };
+
   foundationdb = callPackage ../development/python-modules/foundationdb {
     inherit (pkgs) foundationdb;
   };
@@ -11832,8 +11834,6 @@ self: super: with self; {
 
   pastescript = callPackage ../development/python-modules/pastescript { };
 
-  patator = callPackage ../development/python-modules/patator { };
-
   patch = callPackage ../development/python-modules/patch { };
 
   patch-ng = callPackage ../development/python-modules/patch-ng { };
@@ -14728,8 +14728,6 @@ self: super: with self; {
 
   pyspx = callPackage ../development/python-modules/pyspx { };
 
-  pysqlcipher3 = callPackage ../development/python-modules/pysqlcipher3 { inherit (pkgs) sqlcipher; };
-
   pysqlitecipher = callPackage ../development/python-modules/pysqlitecipher { };
 
   pysqueezebox = callPackage ../development/python-modules/pysqueezebox { };