diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index f7a0ba9e4ba9..ce7ac04dd9b1 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -2136,7 +2136,7 @@ The following rules are desired to be respected:
 * `pythonImportsCheck` is set. This is still a good smoke test even if `pytestCheckHook` is set.
 * `meta.platforms` takes the default value in many cases.
   It does not need to be set explicitly unless the package requires a specific platform.
-* The file is formatted with `nixfmt-rfc-style`.
+* The file is formatted correctly (e.g., `nix-shell --run treefmt`).
 * Commit names of Python libraries must reflect that they are Python
   libraries (e.g. `python3Packages.numpy: 1.11 -> 1.12` rather than `numpy: 1.11 -> 1.12`).
   See also [`pkgs/README.md`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#commit-conventions).
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 7ab1f66e96c7..d94a598759ec 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -169,6 +169,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `balatro` now supports the Google Play and Xbox PC versions of the game.  Pass the `apk` or `Assets.zip` as `balatro.override { src = "…" }`.
+
 - `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
   If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
   See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 488b817946d4..3f4cf2af05b2 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -144,7 +144,7 @@ in
 
           Enabling system-wide PipeWire is however not recommended and disabled
           by default according to
-          https://github.com/PipeWire/pipewire/blob/master/NEWS
+          https://github.com/PipeWire/pipewire/blob/0.3.11/NEWS#L14-L16
         '';
       };
 
diff --git a/nixos/modules/services/matrix/tuwunel.nix b/nixos/modules/services/matrix/tuwunel.nix
index b3a66017734c..1c760c6293cb 100644
--- a/nixos/modules/services/matrix/tuwunel.nix
+++ b/nixos/modules/services/matrix/tuwunel.nix
@@ -216,6 +216,8 @@ in
       startLimitBurst = 5;
       startLimitIntervalSec = 60;
       serviceConfig = {
+        Type = "notify";
+
         DynamicUser = true;
         User = cfg.user;
         Group = cfg.group;
diff --git a/nixos/modules/services/misc/dysnomia.nix b/nixos/modules/services/misc/dysnomia.nix
index acdc9c55555f..2d25c974296b 100644
--- a/nixos/modules/services/misc/dysnomia.nix
+++ b/nixos/modules/services/misc/dysnomia.nix
@@ -288,15 +288,9 @@ in
 
     boot.extraSystemdUnitPaths = [ "/etc/systemd-mutable/system" ];
 
-    system.activationScripts.dysnomia = ''
-      mkdir -p /etc/systemd-mutable/system
-      if [ ! -f /etc/systemd-mutable/system/dysnomia.target ]
-      then
-          ( echo "[Unit]"
-            echo "Description=Services that are activated and deactivated by Dysnomia"
-            echo "After=final.target"
-          ) > /etc/systemd-mutable/system/dysnomia.target
-      fi
-    '';
+    systemd.targets.dysnomia = {
+      description = "Services that are activated and deactivated by Dysnomia";
+      after = "final.target";
+    };
   };
 }
diff --git a/nixos/modules/services/system/bpftune.nix b/nixos/modules/services/system/bpftune.nix
index c69a53b6d554..6b91e9efab79 100644
--- a/nixos/modules/services/system/bpftune.nix
+++ b/nixos/modules/services/system/bpftune.nix
@@ -22,6 +22,9 @@ in
 
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
-    systemd.services.bpftune.wantedBy = [ "multi-user.target" ];
+    systemd.services.bpftune = {
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.kmod ]; # bpftune calls modprobe
+    };
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/README.md b/pkgs/applications/editors/vscode/extensions/README.md
index 9cbbd2b8f94d..2b36a38de2bb 100644
--- a/pkgs/applications/editors/vscode/extensions/README.md
+++ b/pkgs/applications/editors/vscode/extensions/README.md
@@ -7,7 +7,7 @@
 
 * When adding a new extension, place its definition in a `default.nix` file in a directory with the extension's ID (e.g. `publisher.extension-name/default.nix`) and refer to it in `./default.nix`, e.g. `publisher.extension-name = callPackage ./publisher.extension-name { };`.
 
-* Currently `nixfmt-rfc-style` formatter is being used to format the VSCode extensions.
+* Use `nix-shell --run treefmt` to format the VSCode extensions.
 
 * Respect `alphabetical order` whenever adding extensions. If out of order, please kindly open a PR re-establishing the order.
 
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index f9c2b3006210..8a6faa45e21b 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.37";
-    hash = "sha256-Lc3TNj74BW/M1sK+bz/xw4L5B6KKBUh2uzXckScwPr8=";
+    version = "2.1.39";
+    hash = "sha256-8OaNOwG9lRHca/hjqGpmcuY+2OGkv7rPSt0faO72vIc=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix b/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
index 00c61c3b9020..6410adb3f6de 100644
--- a/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.33.1";
-    hash = "sha256-qiWuoxd/CXTxYtlOcj1Aww16wLvTZbQ7qJYhPPEndqk=";
+    version = "0.37.4";
+    hash = "sha256-as8aU8NIAe60qV2VihBa4ueOm23nBAos3AAyLA0Smhs=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f8ef62eadf8a..a4e9e1610f35 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -200,13 +200,13 @@
     "vendorHash": "sha256-1kuzWw7OhzruRT572pTR3zpE9jPGEuKRdwReWxte3/E="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-N594aLeErFeO7n6M+D1JcC8FlTmTrfaaMa71kFqv0vs=",
+    "hash": "sha256-RuHAVcDK3KPO4I4FG/DodhNiWe63AexTo9IcyTZ360Q=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.16.0",
+    "rev": "v5.17.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-mM2Vlh3TZt2hq8XW7tTNTyK/nLAe3SLj8LQw52P4Ye8="
+    "vendorHash": "sha256-Z3qSDIkzD4hs2WREuV06q4GC+qwMvfHvsnze/8c7f20="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index 95650f52160f..98594f6bc78a 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   pkg-config,
   python3,
@@ -13,13 +12,17 @@
   systemd,
   zlib,
   pcre,
+  rapidjson,
+  small,
   libb64,
   libutp,
   libdeflate,
   utf8cpp,
+  fast-float,
   fmt,
   libpsl,
   miniupnpc,
+  crc32c,
   dht,
   libnatpmp,
   libiconv,
@@ -62,30 +65,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "transmission";
-  version = "4.0.6";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "transmission";
     repo = "transmission";
-    rev = finalAttrs.version;
-    hash = "sha256-KBXvBFgrJ3njIoXrxHbHHLsiocwfd7Eba/GNI8uZA38=";
+    tag = finalAttrs.version;
+    hash = "sha256-glmwa06+jCyL9G2Rc58Yrvzo+/6Qu3bqwqy02RWgG64=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/transmission/transmission/commit/febfe49ca3ecab1a7142ecb34012c1f0b2bcdee8.patch?full_index=1";
-      hash = "sha256-Ge0+AXf/ilfMieGBAdvvImY7JOb0gGIdeKprC37AROs=";
-      excludes = [
-        # The submodule that we don't use (we use our miniupnp)
-        "third-party/miniupnp"
-        # Hunk fails for this one, but we don't care because we don't rely upon
-        # xcode definitions even for the Darwin build.
-        "Transmission.xcodeproj/project.pbxproj"
-      ];
-    })
-  ];
-
   outputs = [
     "out"
     "apparmor"
@@ -109,20 +98,20 @@ stdenv.mkDerivation (finalAttrs: {
     # Excluding gtest since it is hardcoded to vendored version. The rest of the listed libraries are not packaged.
     pushd third-party
     for f in *; do
-        if [[ ! $f =~ googletest|wildmat|fast_float|wide-integer|jsonsl ]]; then
+        if [[ ! $f =~ googletest|wildmat|wide-integer|jsonsl ]]; then
             rm -r "$f"
         fi
     done
     popd
     rm \
+      cmake/FindFastFloat.cmake \
       cmake/FindFmt.cmake \
+      cmake/FindRapidJSON.cmake \
+      cmake/FindSmall.cmake \
       cmake/FindUtfCpp.cmake
     # Upstream uses different config file name.
-    substituteInPlace CMakeLists.txt --replace 'find_package(UtfCpp)' 'find_package(utf8cpp)'
-
-    # Use gettext even on Darwin
-    substituteInPlace libtransmission/utils.h \
-      --replace-fail '#if defined(HAVE_GETTEXT) && !defined(__APPLE__)' '#if defined(HAVE_GETTEXT)'
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_package(UtfCpp)' 'find_package(utf8cpp)'
   '';
 
   nativeBuildInputs = [
@@ -136,7 +125,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     curl
+    crc32c
     dht
+    fast-float
     fmt
     libb64
     libdeflate
@@ -147,6 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
     miniupnpc
     openssl
     pcre
+    rapidjson
+    small
     utf8cpp
     zlib
   ]
@@ -193,7 +186,7 @@ stdenv.mkDerivation (finalAttrs: {
       include if exists <local/bin.transmission-daemon>
     }
     EOF
-    install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg
+    install -Dm0444 -t $out/share/icons ../icons/hicolor_apps_scalable_transmission.svg
   '';
 
   passthru.tests = {
diff --git a/pkgs/applications/science/electronics/gerbv/0001-fix-invalid-function-signatures.patch b/pkgs/applications/science/electronics/gerbv/0001-fix-invalid-function-signatures.patch
new file mode 100644
index 000000000000..4bd435a9fa9b
--- /dev/null
+++ b/pkgs/applications/science/electronics/gerbv/0001-fix-invalid-function-signatures.patch
@@ -0,0 +1,93 @@
+From ef744d7b8a663f5b9a3e40233eccf8243773e864 Mon Sep 17 00:00:00 2001
+From: Samuel Rounce <me@samuelrounce.co.uk>
+Date: Fri, 23 Jan 2026 01:55:55 +0000
+Subject: [PATCH] fix invalid function signatures
+
+---
+ src/attribute.c |  4 ++--
+ src/callbacks.c | 12 ++++++------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/attribute.c b/src/attribute.c
+index 67a622d..6d207bb 100644
+--- a/src/attribute.c
++++ b/src/attribute.c
+@@ -193,7 +193,7 @@ static void
+ ghid_spin_button (GtkWidget * box, GtkWidget ** spin_button, gfloat value,
+ 		  gfloat low, gfloat high, gfloat step0, gfloat step1,
+ 		  gint digits, gint width,
+-		  void (*cb_func) (), gpointer data, gboolean right_align,
++		  void (*cb_func) (GtkWidget *, void *), gpointer data, gboolean right_align,
+ 		  gchar * string)
+ {
+   GtkWidget *hbox = NULL, *label, *spin_but;
+@@ -248,7 +248,7 @@ ghid_check_button_connected (GtkWidget * box,
+ 			     gboolean expand,
+ 			     gboolean fill,
+ 			     gint pad,
+-			     void (*cb_func) (),
++			     void (*cb_func) (GtkToggleButton *, gboolean *),
+ 			     gpointer data, gchar * string)
+ {
+   GtkWidget *b;
+diff --git a/src/callbacks.c b/src/callbacks.c
+index 6b4c90e..9428bde 100644
+--- a/src/callbacks.c
++++ b/src/callbacks.c
+@@ -1066,7 +1066,7 @@ callbacks_toggle_layer_visibility_activate (GtkMenuItem *menuitem, gpointer user
+ 	if (screenRenderInfo.renderType <= GERBV_RENDER_TYPE_GDK_XOR) {
+ 		render_refresh_rendered_image_on_screen ();
+ 	} else {
+-		render_recreate_composite_surface (screen.drawing_area);
++		render_recreate_composite_surface ();
+ 		callbacks_force_expose_event_for_screen ();
+ 	}
+ }
+@@ -2185,7 +2185,7 @@ callbacks_layer_tree_visibility_toggled (gint index)
+ 	if (screenRenderInfo.renderType <= GERBV_RENDER_TYPE_GDK_XOR) {
+ 		render_refresh_rendered_image_on_screen ();
+ 	} else {
+-		render_recreate_composite_surface (screen.drawing_area);
++		render_recreate_composite_surface ();
+ 		callbacks_force_expose_event_for_screen ();
+ 	}
+ }
+@@ -2437,7 +2437,7 @@ callbacks_remove_layer_button_clicked (GtkButton *button, gpointer user_data)
+ 		if (screenRenderInfo.renderType <= GERBV_RENDER_TYPE_GDK_XOR) {
+ 			render_refresh_rendered_image_on_screen ();
+ 		} else {
+-			render_recreate_composite_surface (screen.drawing_area);
++			render_recreate_composite_surface ();
+ 			callbacks_force_expose_event_for_screen ();
+ 		}
+ 	}
+@@ -2468,7 +2468,7 @@ callbacks_move_layer_down_button_clicked  (GtkButton *button, gpointer   user_da
+ 			render_refresh_rendered_image_on_screen ();
+ 		}
+ 		else {
+-			render_recreate_composite_surface (screen.drawing_area);
++			render_recreate_composite_surface ();
+ 			callbacks_force_expose_event_for_screen ();
+ 		}
+ 	}
+@@ -2497,7 +2497,7 @@ callbacks_move_layer_up_button_clicked  (GtkButton *button, gpointer   user_data
+ 			render_refresh_rendered_image_on_screen();
+ 		}
+ 		else {
+-			render_recreate_composite_surface (screen.drawing_area);
++			render_recreate_composite_surface ();
+ 			callbacks_force_expose_event_for_screen ();
+ 		}
+ 	}
+@@ -2525,7 +2525,7 @@ void callbacks_layer_tree_row_inserted (GtkTreeModel *tree_model, GtkTreePath  *
+ 				render_refresh_rendered_image_on_screen();
+ 			}
+ 			else {
+-				render_recreate_composite_surface (screen.drawing_area);
++				render_recreate_composite_surface ();
+ 				callbacks_force_expose_event_for_screen ();
+ 			}
+ 			/* select the new line */
+-- 
+2.52.0
+
diff --git a/pkgs/applications/science/electronics/gerbv/default.nix b/pkgs/applications/science/electronics/gerbv/default.nix
index 2865286b8d19..46a51950cda4 100644
--- a/pkgs/applications/science/electronics/gerbv/default.nix
+++ b/pkgs/applications/science/electronics/gerbv/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-sr48RGLYcMKuyH9p+5BhnR6QpKBvNOqqtRryw3+pbBk=";
   };
 
+  patches = [
+    ./0001-fix-invalid-function-signatures.patch
+  ];
+
   postPatch = ''
     sed -i '/AC_INIT/s/m4_esyscmd.*/${version}])/' configure.ac
   '';
diff --git a/pkgs/build-support/fetchfossil/nix-prefetch-fossil b/pkgs/build-support/fetchfossil/nix-prefetch-fossil
index 1f3c2636355e..0e1ce4d9c060 100755
--- a/pkgs/build-support/fetchfossil/nix-prefetch-fossil
+++ b/pkgs/build-support/fetchfossil/nix-prefetch-fossil
@@ -89,10 +89,15 @@ fossil open "$tmpPath/fossil-clone.fossil" "$rev" >&2
 
 # Get the actual commit hash and date
 checkoutLine=$(fossil info | grep ^checkout:)
-# Remove 'checkout:' prefix and squeeze multiple spaces, then extract fields
-actualRev=$(echo "$checkoutLine" | sed 's/^checkout:[[:space:]]*//' | tr -s ' ' | cut -d' ' -f1)
-# Extract date (format: checkout:     HASH YYYY-MM-DD HH:MM:SS UTC)
-actualDate=$(echo "$checkoutLine" | sed 's/^checkout:[[:space:]]*//' | tr -s ' ' | cut -d' ' -f2)
+# Remove 'checkout:' prefix & remove whitespace
+checkoutData=$(echo "$checkoutLine" | sed 's/^checkout:[[:space:]]*//' | tr -s ' ')
+# Extract fields: HASH YYYY-MM-DD HH:MM:SS UTC
+actualRev=$(echo "$checkoutData" | cut -d' ' -f1)
+# Get datetime parts
+rawDate=$(echo "$checkoutData" | cut -d' ' -f2)
+rawTime=$(echo "$checkoutData" | cut -d' ' -f3)
+# Combine into ISO 8601 RFC 3339 format
+actualDatetime="${rawDate}T${rawTime}Z"
 cd - >/dev/null
 
 # Remove the fossil checkout file
@@ -118,7 +123,8 @@ cat <<EOF
 {
   "url": "$url",
   "rev": "$actualRev",
-  "date": "$actualDate",
+  "date": "$actualDatetime",
+  "path": "$finalPath",
   "$hashType": "$hash",
   "hash": "$(nix-hash --to-sri --type $hashType $hash)"
 }
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 165471e9e748..57a83b8234fc 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -111,7 +111,7 @@ rec {
       allowSubstitutes ? false,
       preferLocalBuild ? true,
       derivationArgs ? { },
-    }:
+    }@args:
     assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
       destination must be an absolute path, relative to the derivation's out path,
       got '${destination}' instead.
@@ -125,6 +125,7 @@ rec {
     runCommand name
       (
         {
+          pos = builtins.unsafeGetAttrPos "name" args;
           inherit
             text
             executable
@@ -333,7 +334,7 @@ rec {
          Type: Bool
       */
       inheritPath ? true,
-    }:
+    }@args:
     writeTextFile {
       inherit
         name
@@ -613,6 +614,13 @@ rec {
           "failOnMissing"
         ]
         // {
+          # Allow getting the proper position of the output derivation.
+          # Since one of these are required, it should be fairly accurate.
+          pos =
+            if args_ ? pname then
+              builtins.unsafeGetAttrPos "pname" args_
+            else
+              builtins.unsafeGetAttrPos "name" args_;
           inherit preferLocalBuild allowSubstitutes;
           paths = mapPaths (path: "${path}${stripPrefix}") paths;
           passAsFile = [ "paths" ];
@@ -675,6 +683,14 @@ rec {
     in
     runCommand name
       {
+        # Get the position from the `entries` attrset if it exists.
+        # This is the best we can do since the other attrs are either defined here, or curried values that
+        # we cannot extract a position from
+        pos =
+          if lib.isAttrs entries then
+            builtins.unsafeGetAttrPos (builtins.head (builtins.attrNames entries)) entries
+          else
+            null;
         preferLocalBuild = true;
         allowSubstitutes = false;
         passthru.entries = entries';
@@ -744,12 +760,15 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-    }:
+    }@args:
     script:
     runCommand name
       (
         substitutions
         // {
+          # Make the position of the derivation accurate.
+          # Since not having `name` is deprecated, this should be fairly accurate.
+          pos = lib.unsafeGetAttrPos "name" args;
           # TODO(@Artturin:) substitutions should be inside the env attrset
           # but users are likely passing non-substitution arguments through substitutions
           # turn off __structuredAttrs to unbreak substituteAll
@@ -1002,76 +1021,70 @@ rec {
       ];
     }
   */
-  applyPatches =
-    {
-      src,
-      name ?
-        (
-          if builtins.typeOf src == "path" then
-            baseNameOf src
-          else if builtins.isAttrs src && builtins.hasAttr "name" src then
-            src.name
-          else
-            throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
-        )
-        + "-patched",
-      patches ? [ ],
-      prePatch ? "",
-      postPatch ? "",
-      ...
-    }@args:
-    assert lib.assertMsg (
-      !args ? meta
-    ) "applyPatches will not merge 'meta', change it in 'src' instead";
-    assert lib.assertMsg (
-      !args ? passthru
-    ) "applyPatches will not merge 'passthru', change it in 'src' instead";
-    if patches == [ ] && prePatch == "" && postPatch == "" then
-      src # nothing to do, so use original src to avoid additional drv
-    else
+  applyPatches = lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
+
+    extendDrvArgs =
+      finalAttrs:
+      {
+        src,
+        ...
+      }@args:
+      assert lib.assertMsg (
+        !args ? meta
+      ) "applyPatches will not merge 'meta', change it in 'src' instead";
+      assert lib.assertMsg (
+        !args ? passthru
+      ) "applyPatches will not merge 'passthru', change it in 'src' instead";
       let
         keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
         # enables tools like nix-update to determine what src attributes to replace
-        extraPassthru = lib.optionalAttrs (lib.isAttrs src) (
+        extraPassthru = lib.optionalAttrs (lib.isAttrs finalAttrs.src) (
           keepAttrs [
             "rev"
             "tag"
             "url"
             "outputHash"
             "outputHashAlgo"
-          ] src
+          ] finalAttrs.src
         );
       in
-      stdenvNoCC.mkDerivation (
-        {
-          inherit
-            name
-            src
-            patches
-            prePatch
-            postPatch
-            ;
-          preferLocalBuild = true;
-          allowSubstitutes = false;
-          phases = "unpackPhase patchPhase installPhase";
-          installPhase = "cp -R ./ $out";
-        }
+      {
+        name =
+          args.name or (
+            if builtins.isPath finalAttrs.src then
+              baseNameOf finalAttrs.src + "-patched"
+            else if builtins.isAttrs finalAttrs.src && (finalAttrs.src ? name) then
+              let
+                srcName = builtins.parseDrvName finalAttrs.src.name;
+              in
+              "${srcName.name}-patched${lib.optionalString (srcName.version != "") "-${srcName.version}"}"
+            else
+              throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
+          );
+
+        # Manually setting `name` can mess up positioning.
+        # This should fix it.
+        pos = builtins.unsafeGetAttrPos "src" args;
+
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+
+        dontConfigure = true;
+        dontBuild = true;
+        doCheck = false;
+
+        installPhase = "cp -R ./ $out";
+
+        # passthru the git and hash info for nix-update, as well
+        # as all the src's passthru attrs.
+        passthru = extraPassthru // finalAttrs.src.passthru or { };
+
         # Carry (and merge) information from the underlying `src` if present.
-        // (optionalAttrs (src ? meta) {
-          inherit (src) meta;
-        })
-        // (optionalAttrs (extraPassthru != { } || src ? passthru) {
-          passthru = extraPassthru // src.passthru or { };
-        })
-        # Forward any additional arguments to the derivation
-        // (removeAttrs args [
-          "src"
-          "name"
-          "patches"
-          "prePatch"
-          "postPatch"
-        ])
-      );
+        # If there is not src.meta, this meta block will be blank regardless.
+        meta = lib.optionalAttrs (finalAttrs.src ? meta) (removeAttrs finalAttrs.src.meta [ "position" ]);
+      };
+  };
 
   # TODO: move docs to Nixpkgs manual
   # An immutable file in the store with a length of 0 bytes.
diff --git a/pkgs/by-name/_1/_1fps/package.nix b/pkgs/by-name/_1/_1fps/package.nix
index bd2dda9dd807..2364310ad447 100644
--- a/pkgs/by-name/_1/_1fps/package.nix
+++ b/pkgs/by-name/_1/_1fps/package.nix
@@ -7,14 +7,14 @@
   libx11,
   stdenv,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "1fps";
   version = "0.1.17";
 
   src = fetchFromGitHub {
     owner = "1fpsvideo";
     repo = "1fps";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-8dtcW/niwmhVXB2kZdR/RjNg2ArSClL1w4nGI5rP3+Y=";
   };
 
@@ -35,4 +35,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ renesat ];
     mainProgram = "1fps";
   };
-}
+})
diff --git a/pkgs/by-name/ad/adreaper/package.nix b/pkgs/by-name/ad/adreaper/package.nix
index 02900efa7390..796de3c530e4 100644
--- a/pkgs/by-name/ad/adreaper/package.nix
+++ b/pkgs/by-name/ad/adreaper/package.nix
@@ -5,14 +5,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adreaper";
   version = "1.1";
 
   src = fetchFromGitHub {
     owner = "AidenPearce369";
     repo = "ADReaper";
-    rev = "ADReaperv${version}";
+    rev = "ADReaperv${finalAttrs.version}";
     sha256 = "sha256-+FCb5TV9MUcRyex2M4rn2RhcIsXQFbtm1T4r7MpcRQs=";
   };
 
@@ -25,11 +25,11 @@ buildGoModule rec {
   meta = {
     description = "Enumeration tool for Windows Active Directories";
     homepage = "https://github.com/AidenPearce369/ADReaper";
-    changelog = "https://github.com/AidenPearce369/ADReaper/releases/tag/ADReaperv${version}";
+    changelog = "https://github.com/AidenPearce369/ADReaper/releases/tag/ADReaperv${finalAttrs.version}";
     # Upstream doesn't have a license yet
     # https://github.com/AidenPearce369/ADReaper/issues/2
     license = with lib.licenses; [ unfree ];
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "ADReaper";
   };
-}
+})
diff --git a/pkgs/by-name/ag/ags/package.nix b/pkgs/by-name/ag/ags/package.nix
index 55a8af279831..db7d52b8fdfe 100644
--- a/pkgs/by-name/ag/ags/package.nix
+++ b/pkgs/by-name/ag/ags/package.nix
@@ -19,14 +19,14 @@
 
   extraPackages ? [ ],
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "ags";
   version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "Aylur";
     repo = "ags";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-GLyNtU9A2VN22jNRHZ2OXuFfTJLh8uEVVt+ftsKUX0c=";
   };
 
@@ -62,7 +62,7 @@ buildGoModule rec {
       depsOf = pkg: [ (pkg.dev or pkg) ] ++ (map depsOf (pkg.propagatedBuildInputs or [ ]));
       girDirs = symlinkJoin {
         name = "gir-dirs";
-        paths = lib.flatten (map depsOf buildInputs);
+        paths = lib.flatten (map depsOf finalAttrs.buildInputs);
       };
     in
     ''
@@ -102,7 +102,7 @@ buildGoModule rec {
   meta = {
     description = "Scaffolding CLI for Astal widget system";
     homepage = "https://github.com/Aylur/ags";
-    changelog = "https://github.com/Aylur/ags/releases/tag/v${version}";
+    changelog = "https://github.com/Aylur/ags/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       PerchunPak
@@ -111,4 +111,4 @@ buildGoModule rec {
     mainProgram = "ags";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/al/alertmanager-webhook-logger/package.nix b/pkgs/by-name/al/alertmanager-webhook-logger/package.nix
index afe5ce08943b..dfb723b8d8e2 100644
--- a/pkgs/by-name/al/alertmanager-webhook-logger/package.nix
+++ b/pkgs/by-name/al/alertmanager-webhook-logger/package.nix
@@ -5,13 +5,13 @@
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "alertmanager-webhook-logger";
   version = "1.0";
-  rev = "${version}";
+  rev = "${finalAttrs.version}";
 
   src = fetchFromGitHub {
-    inherit rev;
+    inherit (finalAttrs) rev;
     owner = "tomtom-international";
     repo = "alertmanager-webhook-logger";
     hash = "sha256-mJbpDiTwUsFm0lDKz8UE/YF6sBvcSSR6WWLrfKvtri4=";
@@ -30,4 +30,4 @@ buildGoModule rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jpds ];
   };
-}
+})
diff --git a/pkgs/by-name/al/algia/package.nix b/pkgs/by-name/al/algia/package.nix
index 82e909dacdfa..2e8dae0d4d91 100644
--- a/pkgs/by-name/al/algia/package.nix
+++ b/pkgs/by-name/al/algia/package.nix
@@ -5,14 +5,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "algia";
   version = "0.0.102";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "algia";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-vpZL4UNDtcJRsBA0th6/YccE/3GG7kzHrgJ3RWpgSk8=";
   };
 
@@ -25,4 +25,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ haruki7049 ];
     mainProgram = "algia";
   };
-}
+})
diff --git a/pkgs/by-name/al/alice-lg/package.nix b/pkgs/by-name/al/alice-lg/package.nix
index 18f94a435d8e..cd9cee4c946e 100644
--- a/pkgs/by-name/al/alice-lg/package.nix
+++ b/pkgs/by-name/al/alice-lg/package.nix
@@ -11,14 +11,14 @@
   fixup-yarn-lock,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "alice-lg";
   version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "alice-lg";
     repo = "alice-lg";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-DlmUurpu/bs/91fLsSQ3xJ8I8NWJweynMgV6Svkf0Uo=";
   };
 
@@ -26,11 +26,11 @@ buildGoModule rec {
 
   passthru.ui = stdenv.mkDerivation {
     pname = "alice-lg-ui";
-    src = "${src}/ui";
-    inherit version;
+    src = "${finalAttrs.src}/ui";
+    inherit (finalAttrs) version;
 
     yarnOfflineCache = fetchYarnDeps {
-      yarnLock = src + "/ui/yarn.lock";
+      yarnLock = finalAttrs.src + "/ui/yarn.lock";
       hash = "sha256-PwByNIegKYTOT8Yg3nDMDFZiLRVkbX07z99YaDiBsIY=";
     };
 
@@ -75,7 +75,7 @@ buildGoModule rec {
   };
 
   preBuild = ''
-    cp -R ${passthru.ui}/ ui/build/
+    cp -R ${finalAttrs.passthru.ui}/ ui/build/
   '';
 
   subPackages = [ "cmd/alice-lg" ];
@@ -94,4 +94,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ stv0g ];
     mainProgram = "alice-lg";
   };
-}
+})
diff --git a/pkgs/by-name/al/alp/package.nix b/pkgs/by-name/al/alp/package.nix
index ecf122ef7e00..12d9abb43802 100644
--- a/pkgs/by-name/al/alp/package.nix
+++ b/pkgs/by-name/al/alp/package.nix
@@ -6,19 +6,19 @@
   alp,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "alp";
   version = "1.1.18";
 
   src = fetchFromGitHub {
     owner = "gernotfeichter";
     repo = "alp";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-tE8qKNXLKvFcnDULVkJJ/EJyEsvATCk/3YFkZCmpHSo=";
   };
   vendorHash = "sha256-AHPVhtm6La7HWuxJfpxTsS5wFTUZUJoVyebLGYhNKTg=";
 
-  sourceRoot = "${src.name}/linux";
+  sourceRoot = "${finalAttrs.src.name}/linux";
 
   # Executing Go commands directly in checkPhase and buildPhase below,
   # because the default testsuite runs all go tests, some of which require docker.
@@ -40,9 +40,9 @@ buildGoModule rec {
   '';
 
   passthru.tests = {
-    test-version = runCommand "${pname}-test" { } ''
+    test-version = runCommand "alp-test" { } ''
       ${alp}/bin/alp version > $out
-      cat $out | grep '${version}'
+      cat $out | grep '${finalAttrs.version}'
     '';
   };
 
@@ -53,4 +53,4 @@ buildGoModule rec {
     mainProgram = "alp";
     maintainers = with lib.maintainers; [ gernotfeichter ];
   };
-}
+})
diff --git a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
index 0c04c40e397e..ec7bfdb2e59d 100644
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@@ -9,14 +9,14 @@
   versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "amazon-cloudwatch-agent";
   version = "1.300064.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-998kXLAwhSepDOrKGXRrOfrw9SU8tfxtYmPQNUQWhlI=";
   };
 
@@ -36,7 +36,7 @@ buildGoModule rec {
   #
   # Needed for "amazon-cloudwatch-agent -version" to not show "Unknown".
   postInstall = ''
-    echo v${version} > $out/bin/CWAGENT_VERSION
+    echo v${finalAttrs.version} > $out/bin/CWAGENT_VERSION
   '';
 
   doInstallCheck = true;
@@ -62,4 +62,4 @@ buildGoModule rec {
     mainProgram = "amazon-cloudwatch-agent";
     maintainers = with lib.maintainers; [ pmw ];
   };
-}
+})
diff --git a/pkgs/by-name/ap/apache-answer/package.nix b/pkgs/by-name/ap/apache-answer/package.nix
index 5bfc98304ab7..079f8b4857b3 100644
--- a/pkgs/by-name/ap/apache-answer/package.nix
+++ b/pkgs/by-name/ap/apache-answer/package.nix
@@ -6,30 +6,29 @@
   pnpmConfigHook,
   pnpm,
   nodejs,
-  fetchpatch,
   stdenv,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "apache-answer";
   version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "answer";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QTm/6srSn4oF78795ADpW10bZmyEmqTNezB6JSkS2I4=";
   };
 
   webui = stdenv.mkDerivation {
-    pname = pname + "-webui";
-    inherit version src;
+    pname = "apache-answer" + "-webui";
+    inherit (finalAttrs) version src;
 
-    sourceRoot = "${src.name}/ui";
+    sourceRoot = "${finalAttrs.src.name}/ui";
 
     pnpmDeps = fetchPnpmDeps {
-      inherit src version pname;
-      sourceRoot = "${src.name}/ui";
+      inherit (finalAttrs) src version pname;
+      sourceRoot = "${finalAttrs.src.name}/ui";
       fetcherVersion = 1;
       hash = "sha256-6IeLOwsEqchCwe0GGj/4v9Q4/Hm16K+ve2X+8QHztQM=";
     };
@@ -63,12 +62,12 @@ buildGoModule rec {
   doCheck = false; # TODO checks are currently broken upstream
 
   ldflags = [
-    "-X main.Version=${version}"
-    "-X main.Commit=${version}"
+    "-X main.Version=${finalAttrs.version}"
+    "-X main.Commit=${finalAttrs.version}"
   ];
 
   preBuild = ''
-    cp -r ${webui}/* ui/build/
+    cp -r ${finalAttrs.webui}/* ui/build/
   '';
 
   meta = {
@@ -79,7 +78,7 @@ buildGoModule rec {
     ];
     platforms = lib.platforms.unix;
     mainProgram = "answer";
-    changelog = "https://github.com/apache/answer/releases/tag/v${version}";
+    changelog = "https://github.com/apache/answer/releases/tag/v${finalAttrs.version}";
     description = "Q&A platform software for teams at any scales";
   };
-}
+})
diff --git a/pkgs/by-name/ap/app2unit/package.nix b/pkgs/by-name/ap/app2unit/package.nix
index 904eb912f24d..21879d196f59 100644
--- a/pkgs/by-name/ap/app2unit/package.nix
+++ b/pkgs/by-name/ap/app2unit/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "app2unit";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "app2unit";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-DZ0W7SygOUmjIO0+K8hS9K1U+gSp1gA6Q15eXr6rOmo=";
+    sha256 = "sha256-HkwcYYGNReDtPxZumnz3ZDb1sr1JcngAOqs/inO/350=";
   };
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ap/apx/package.nix b/pkgs/by-name/ap/apx/package.nix
index 1c0d2a083888..96fd4b3a557b 100644
--- a/pkgs/by-name/ap/apx/package.nix
+++ b/pkgs/by-name/ap/apx/package.nix
@@ -12,7 +12,7 @@
   writeShellScript,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "apx";
   version = "2.4.5";
   versionConfig = "1.0.0";
@@ -20,7 +20,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "apx";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-0Rfj7hrH26R9GHOPPVdCaeb1bfAw9KnPpJYXyiei90U=";
   };
 
@@ -28,7 +28,7 @@ buildGoModule rec {
   configsSrc = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "vanilla-apx-configs";
-    tag = "v${versionConfig}";
+    tag = "v${finalAttrs.versionConfig}";
     hash = "sha256-cCXmHkRjcWcpMtgPVtQF5Q76jr1Qt2RHSLtWLQdq+aE=";
   };
 
@@ -47,7 +47,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X 'main.Version=v${version}'"
+    "-X 'main.Version=v${finalAttrs.version}'"
   ];
 
   postPatch = ''
@@ -64,8 +64,8 @@ buildGoModule rec {
 
     # Install official Vanilla configs (same as install script)
     install -d $out/share/apx
-    cp -r ${configsSrc}/stacks $out/share/apx/
-    cp -r ${configsSrc}/package-managers $out/share/apx/
+    cp -r ${finalAttrs.configsSrc}/stacks $out/share/apx/
+    cp -r ${finalAttrs.configsSrc}/package-managers $out/share/apx/
 
     # Man pages, documentation, license
     installManPage man/man1/*
@@ -113,7 +113,7 @@ buildGoModule rec {
         environment.systemPackages = with pkgs; [ apx ];
     '';
     homepage = "https://github.com/Vanilla-OS/apx";
-    changelog = "https://github.com/Vanilla-OS/apx/releases/tag/v${version}";
+    changelog = "https://github.com/Vanilla-OS/apx/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       dit7ya
@@ -122,4 +122,4 @@ buildGoModule rec {
     ];
     mainProgram = "apx";
   };
-}
+})
diff --git a/pkgs/by-name/ar/argocd-autopilot/package.nix b/pkgs/by-name/ar/argocd-autopilot/package.nix
index 586b05e119db..ce557583d388 100644
--- a/pkgs/by-name/ar/argocd-autopilot/package.nix
+++ b/pkgs/by-name/ar/argocd-autopilot/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "argocd-autopilot";
   version = "0.4.20";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-JLh41ZWiDcDrUtd8d+Ak5TFca4L6VHzUguS55P9lmj0=";
   };
 
@@ -26,19 +26,19 @@ buildGoModule rec {
     [
       "-s"
       "-w"
-      "-X ${package_url}.binaryName=${pname}"
-      "-X ${package_url}.version=${src.rev}"
+      "-X ${package_url}.binaryName=argocd-autopilot"
+      "-X ${package_url}.version=${finalAttrs.src.rev}"
       "-X ${package_url}.buildDate=unknown"
-      "-X ${package_url}.gitCommit=${src.rev}"
-      "-X ${package_url}.installationManifestsURL=github.com/argoproj-labs/argocd-autopilot/manifests/base?ref=${src.rev}"
-      "-X ${package_url}.installationManifestsNamespacedURL=github.com/argoproj-labs/argocd-autopilot/manifests/insecure?ref=${src.rev}"
+      "-X ${package_url}.gitCommit=${finalAttrs.src.rev}"
+      "-X ${package_url}.installationManifestsURL=github.com/argoproj-labs/argocd-autopilot/manifests/base?ref=${finalAttrs.src.rev}"
+      "-X ${package_url}.installationManifestsNamespacedURL=github.com/argoproj-labs/argocd-autopilot/manifests/insecure?ref=${finalAttrs.src.rev}"
     ];
 
   subPackages = [ "cmd" ];
 
   doInstallCheck = true;
   installCheckPhase = ''
-    $out/bin/argocd-autopilot version | grep ${src.rev} > /dev/null
+    $out/bin/argocd-autopilot version | grep ${finalAttrs.src.rev} > /dev/null
   '';
 
   installPhase = ''
@@ -60,4 +60,4 @@ buildGoModule rec {
       sagikazarmark
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ar/argocd/package.nix b/pkgs/by-name/ar/argocd/package.nix
index bd4a5d5608fc..da86620b8d7b 100644
--- a/pkgs/by-name/ar/argocd/package.nix
+++ b/pkgs/by-name/ar/argocd/package.nix
@@ -11,25 +11,25 @@
   nodejs,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "argocd";
   version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-FvN4JCG/5SxpnmdEH9X1sMX5dNlp/x0ALNysv+LWroU=";
   };
 
   ui = stdenv.mkDerivation {
-    pname = "${pname}-ui";
-    inherit version;
-    src = src + "/ui";
+    pname = "argocd-ui";
+    inherit (finalAttrs) version;
+    src = finalAttrs.src + "/ui";
 
     offlineCache = fetchYarnDeps {
-      yarnLock = "${src}/ui/yarn.lock";
-      hash = "sha256-kqBolkQiwZUBic0f+Ek5HwYsOmro1+FStkDLXAre79o=";
+      yarnLock = "${finalAttrs.src}/ui/yarn.lock";
+      hash = "sha256-ekhSPWzIgFhwSw0bIlBqu8LTYk3vuJ9VM8eHc3mnHGM=";
     };
 
     nativeBuildInputs = [
@@ -58,17 +58,17 @@ buildGoModule rec {
     [
       "-s"
       "-w"
-      "-X ${packageUrl}.version=${version}"
+      "-X ${packageUrl}.version=${finalAttrs.version}"
       "-X ${packageUrl}.buildDate=unknown"
-      "-X ${packageUrl}.gitCommit=${src.rev}"
-      "-X ${packageUrl}.gitTag=${src.rev}"
+      "-X ${packageUrl}.gitCommit=${finalAttrs.src.rev}"
+      "-X ${packageUrl}.gitTag=${finalAttrs.src.rev}"
       "-X ${packageUrl}.gitTreeState=clean"
     ];
 
   nativeBuildInputs = [ installShellFiles ];
 
   preBuild = ''
-    cp -r ${ui}/dist ./ui
+    cp -r ${finalAttrs.ui}/dist ./ui
     stat ./ui/dist/app/index.html # Sanity check
   '';
 
@@ -88,7 +88,7 @@ buildGoModule rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    $out/bin/argocd version --client | grep ${src.rev} > /dev/null
+    $out/bin/argocd version --client | grep ${finalAttrs.src.rev} > /dev/null
   '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -112,4 +112,4 @@ buildGoModule rec {
       FKouhai
     ];
   };
-}
+})
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index c0138460bccb..c91eafa9d865 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -57,7 +57,7 @@ let
     '';
   };
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   inherit
     autobrr-web
     pname
@@ -72,7 +72,7 @@ buildGoModule rec {
   '';
 
   ldflags = [
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
     "-X main.commit=${src.tag}"
   ];
 
@@ -97,9 +97,9 @@ buildGoModule rec {
     description = "Modern, easy to use download automation for torrents and usenet";
     license = lib.licenses.gpl2Plus;
     homepage = "https://autobrr.com/";
-    changelog = "https://autobrr.com/release-notes/v${version}";
+    changelog = "https://autobrr.com/release-notes/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ av-gal ];
     mainProgram = "autobrr";
     platforms = with lib.platforms; darwin ++ freebsd ++ linux;
   };
-}
+})
diff --git a/pkgs/by-name/ba/balatro/bridge_detour.lua b/pkgs/by-name/ba/balatro/bridge_detour.lua
new file mode 100644
index 000000000000..a60126b34a36
--- /dev/null
+++ b/pkgs/by-name/ba/balatro/bridge_detour.lua
@@ -0,0 +1,229 @@
+--[[
+The game Balatro is implemented in Lua, with the standard LÖVE SDK.  However,
+each store that it's sold on (Steam, Google Play, Xbox PC, etc.) has its own SDK
+to provide features like cloud saving and achievement unlocking.
+
+To allow the same platform-agnostic Lua codebase to be deployed in all these
+contexts, each one has a custom bridge - `love.platform`.  This allows the game
+to call `writeSaveFile` and trust that it will be handled appropriately for
+whatever platform the player has available.  Unfortunately, that bridge is not
+supplied by LÖVE, and is therefore missing from Nix's `pkgs.love`.
+
+This file implements the functions that would otherwise utilize that missing
+bridge.  It was created by finding all of the `love.platform` callsites in the
+Balatro codebase, putting them in this file, and asking Gemini to implement a
+Linux version.
+]]
+
+love.platform = love.platform or {}
+package.loaded["love.platform"] = love.platform
+
+local FileOperationStatus = {
+  SUCCESS = 0,
+  FETCH_ERROR = 1,
+  CLOUD_SAVE_ERROR = 2,
+  CONFLICT = 3,
+  OFFLINE = 4,
+  LOAD_ERROR = 5,
+  NOT_FOUND = 6
+}
+
+function love.platform.init(onInitSuccess, onInitFailure)
+  love.filesystem.setIdentity("balatro")
+
+  if onInitSuccess then
+    onInitSuccess(love.system.getOS(), love.platform.getLocalPlayerName())
+  end
+  return true
+end
+
+function love.platform.setOnPlatformStatusChangedCallback(callback)
+  if callback then
+    callback(false, "Cloud unavailable.")
+  end
+end
+
+function love.platform.earlyInit() end
+function love.platform.update(dt) end
+function love.platform.shutdown() end
+
+
+function love.platform.getPlatformId()
+  return love.system.getOS()
+end
+
+function love.platform.getLocalPlayerName()
+  return os.getenv("USER") or os.getenv("LOGNAME") or "Player"
+end
+
+function love.platform.getLocalPlayerAvatar()
+  return nil
+end
+
+function love.platform.isPremium()
+  return true
+end
+
+function love.platform.isArcade()
+  return false
+end
+
+function love.platform.isFirstTimePlaying()
+  return not love.platform.saveGameExists("1", "profile.jkr")
+end
+
+function love.platform.isOffline()
+  -- If the game ever uses this for more than showing the offline warning, we
+  -- should set this back to true
+  return false
+end
+
+function love.platform.getNotchPosition()
+  return nil
+end
+
+
+-- Different builds use different file APIs; therefore, we implement both the
+-- thin wrapper around the framework's filesystem module and the more complex
+-- signatures with individual save slots.
+love.platform.localGetInfo = love.filesystem.getInfo
+love.platform.localRead = love.filesystem.read
+love.platform.localWrite = love.filesystem.write
+love.platform.localRemove = love.filesystem.remove
+love.platform.localCreateDirectory = love.filesystem.createDirectory
+
+
+-- some versions store their settings files in `common/`
+function love.filesystem.getInfo(filename, ...)
+  local info = love.platform.localGetInfo(filename, ...)
+
+  if not info then
+    info = love.platform.localGetInfo("common/" .. filename, ...)
+  end
+
+  return info
+end
+
+function love.filesystem.read(filename, ...)
+  local content, size = love.platform.localRead(filename, ...)
+
+  if not content then
+    content, size = love.platform.localRead("common/" .. filename, ...)
+  end
+
+  return content, size
+end
+
+
+function love.platform.writeSaveGame(profile, filename, data)
+  local parent = tostring(profile)
+
+  if not love.platform.localGetInfo(parent) then
+    love.platform.localCreateDirectory(parent)
+  end
+
+  return love.platform.localWrite(parent .. "/" .. filename, data)
+end
+
+function love.platform.loadSaveGame(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localRead(parent .. "/" .. filename)
+end
+
+function love.platform.saveGameExists(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localGetInfo(parent .. "/" .. filename) ~= nil
+end
+
+function love.platform.deleteSaveGameFile(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localRemove(parent .. "/" .. filename)
+end
+
+function love.platform.deleteSaveGame(profile)
+  local parent = tostring(profile)
+  return love.platform.localRemove(parent)
+end
+
+local load_game_callback
+local save_game_callback
+
+function love.platform.setLoadGameCallback(callback)
+  load_game_callback = callback
+end
+
+function love.platform.loadGameFile(filename)
+  local content, size = love.filesystem.read(filename)
+
+  if load_game_callback then
+    if content then
+      load_game_callback(filename, FileOperationStatus.SUCCESS, "", content, nil, nil)
+    else
+      load_game_callback(filename, FileOperationStatus.NOT_FOUND, "File not found", nil, nil, nil)
+    end
+  end
+end
+
+
+function love.platform.setOnSaveInitializedCallback(callback)
+  if callback then
+    callback()
+  end
+end
+
+function love.platform.setSaveGameCallback(callback)
+  save_game_callback = callback
+end
+
+function love.platform.saveGameFile(filename, data)
+  local success, msg = love.filesystem.write(filename, data)
+  if save_game_callback then
+    if success then
+      save_game_callback(filename, FileOperationStatus.SUCCESS, "", data, nil, nil)
+    else
+      save_game_callback(filename, FileOperationStatus.CLOUD_SAVE_ERROR, msg, nil, nil, nil)
+    end
+  end
+end
+
+
+-- no-ops when there's no cloud saving
+function love.platform.runLoadGameCallbacks() end
+function love.platform.runSaveGameCallbacks() end
+function love.platform.resolveConflict(file, content, conflictId) end
+
+
+function love.platform.unlockAchievement(achievementId)
+  love.filesystem.append(
+    "unlock_awards.lua",
+    string.format("love.platform.unlockAchievement(%q)\n", achievementId)
+  )
+end
+
+function love.platform.unlockAward(awardName)
+  love.filesystem.append(
+    "unlock_awards.lua",
+    string.format("love.platform.unlockAward(%q)\n", awardName)
+  )
+end
+
+
+function love.platform.event(name, ...) end
+function love.platform.hideSplashScreen() end
+function love.platform.anyButtonPressed() return false end
+
+--[[ these are checked before they're used by the game, so we don't have to
+--   support them
+function love.platform.requestReview() end
+function love.platform.requestTrackingPermission() end
+function love.platform.setProfileButtonActive(active) end
+function love.platform.authenticateLocalPlayer() end
+]]
+
+if love.graphics then
+  if love.graphics.isActive and not love.graphics.checkActive then
+    love.graphics.checkActive = love.graphics.isActive
+  end
+
+  love.graphics.beginFrame = love.graphics.beginFrame or function() end
+end
diff --git a/pkgs/by-name/ba/balatro/globals.patch b/pkgs/by-name/ba/balatro/globals.patch
deleted file mode 100644
index b896a1deb61a..000000000000
--- a/pkgs/by-name/ba/balatro/globals.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- result/share/balatro/globals.lua    1970-01-01 01:00:01.000000000 +0100
-+++ result/share/balatro/globals.lua    1970-01-01 01:00:01.000000000 +0100
-@@ -56,6 +56,12 @@ function Game:set_globals()
-         self.F_CRASH_REPORTS = false
-     end
- 
-+    if love.system.getOS() == 'Linux' then
-+        self.F_SAVE_TIMER = 5
-+        self.F_DISCORD = true
-+        self.F_ENGLISH_ONLY = false
-+    end
-+
-     if love.system.getOS() == 'Nintendo Switch' then
-         self.F_HIDE_BETA_LANGS = true
-         self.F_BASIC_CREDITS = true
diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index eb039b8808a7..0b7e85ad56e7 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -4,24 +4,62 @@
   lib,
   love,
   lovely-injector,
+  curl,
   p7zip,
   copyDesktopItems,
   makeWrapper,
   makeDesktopItem,
   requireFile,
+  src ? null,
   withMods ? true,
+  withBridgePatch ? true,
   withLinuxPatch ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "balatro";
   version = "1.0.1o";
 
-  src = requireFile {
-    name = "Balatro-${finalAttrs.version}.exe";
-    url = "https://store.steampowered.com/app/2379780/Balatro/";
-    # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
-    hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
-  };
+  src =
+    if src != null then
+      src
+    else
+      requireFile {
+        name = "Balatro-${finalAttrs.version}.exe";
+        url = "https://store.steampowered.com/app/2379780/Balatro/";
+        message = ''
+          You must own Balatro in order to install it with Nix.  The Steam,
+          Google Play, and Xbox PC versions are supported.
+
+          - If you have the Steam version, you can use Balatro.exe.  Find it in
+
+            ~/.local/share/Steam/steamapps/common/Balatro/
+
+            and run
+
+            nix-store --add-fixed sha256 Balatro.exe
+
+          - If you have the Google Play version, you'll need to pull base.apk from
+            your device:
+
+            adb shell pm path com.playstack.balatro.android
+            adb pull ( path from above )/base.apk ~/Downloads/com.playstack.balatro.android.apk
+
+            and add it to /nix/store:
+
+            nix-prefetch-url file:///home/deck/Downloads/com.playstack.balatro.android.apk
+
+          - If you have the Xbox PC version, you can do the same with Assets.zip.
+
+          If you've used nix-prefetch-url to add it to your store, you'll need to
+          pass the resulting path to override:
+
+            balatro.override {
+              src = /nix/store/g44bp7ymc7qlkfv5f03b55cgs1wdmkzl-com.playstack.balatro.android.apk;
+            }
+        '';
+        # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
+        hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
+      };
 
   srcIcon = fetchurl {
     name = "balatro.png";
@@ -34,8 +72,17 @@ stdenv.mkDerivation (finalAttrs: {
     copyDesktopItems
     makeWrapper
   ];
-  buildInputs = [ love ] ++ lib.optional withMods lovely-injector;
+
+  buildInputs = [
+    love
+  ]
+  ++ lib.optionals withMods [
+    lovely-injector
+    curl
+  ];
+
   dontUnpack = true;
+
   desktopItems = [
     (makeDesktopItem {
       name = "balatro";
@@ -46,27 +93,69 @@ stdenv.mkDerivation (finalAttrs: {
       icon = "balatro";
     })
   ];
+
   buildPhase = ''
     runHook preBuild
+
     tmpdir=$(mktemp -d)
     7z x ${finalAttrs.src} -o$tmpdir -y
-    ${if withLinuxPatch then "patch $tmpdir/globals.lua -i ${./globals.patch}" else ""}
-    patchedExe=$(mktemp -u).zip
-    7z a $patchedExe $tmpdir/*
+
+    if [ -d "$tmpdir/assets" ]; then
+      mv "$tmpdir/assets/"* "$tmpdir/"
+      rmdir "$tmpdir/assets"
+    elif [ -d "$tmpdir/Assets" ]; then
+      mv "$tmpdir/Assets/"* "$tmpdir/"
+      rmdir "$tmpdir/Assets"
+    fi
+
+    ${lib.optionalString withBridgePatch ''
+      cp ${./bridge_detour.lua} $tmpdir/bridge_detour.lua
+
+      for file in main.lua engine/load_manager.lua engine/save_manager.lua; do
+        if [ -f "$tmpdir/$file" ]; then
+          sed -i '1i require("bridge_detour")' "$tmpdir/$file"
+        fi
+      done
+    ''}
+
+    ${
+      let
+        patchMarker = "if love.system.getOS() == 'Nintendo Switch' then";
+      in
+      lib.optionalString withLinuxPatch ''
+        substituteInPlace "$tmpdir/globals.lua" --replace-fail \
+          "${patchMarker}" \
+          "if love.system.getOS() == 'Linux' then
+            self.F_SAVE_TIMER = 5
+            self.F_DISCORD = true
+            self.F_ENGLISH_ONLY = false
+        end
+
+        ${patchMarker}"
+      ''
+    }
+
+    loveFile=game.love
+    7z a -tzip $loveFile $tmpdir/*
+
     runHook postBuild
   '';
 
-  # The `cat` bit is a hack suggested by whitelje (https://github.com/ethangreen-dev/lovely-injector/pull/66#issuecomment-2319615509)
-  # to make it so that lovely will pick up Balatro as the game name. The `LD_PRELOAD` bit is used to load lovely and it is the
-  # 'official' way of doing it.
   installPhase = ''
     runHook preInstall
+
     install -Dm644 $srcIcon $out/share/icons/hicolor/scalable/apps/balatro.png
 
-    cat ${lib.getExe love} $patchedExe > $out/share/Balatro
+    # Packaging the love file into the executable ensures lovely finds the game's name
+    # https://github.com/ethangreen-dev/lovely-injector/pull/66#issuecomment-2319615509
+    cat ${lib.getExe love} $loveFile > $out/share/Balatro
     chmod +x $out/share/Balatro
 
-    makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods "--prefix LD_PRELOAD : '${lovely-injector}/lib/liblovely.so'"}
+    makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods ''
+      --prefix LD_PRELOAD : '${lovely-injector}/lib/liblovely.so' \
+      --prefix LD_LIBRARY_PATH : '${lib.makeLibraryPath [ curl ]}'
+    ''}
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/bp/bpftune/package.nix b/pkgs/by-name/bp/bpftune/package.nix
index 14ac6330b4a2..f1ffcc8f6c74 100644
--- a/pkgs/by-name/bp/bpftune/package.nix
+++ b/pkgs/by-name/bp/bpftune/package.nix
@@ -9,29 +9,27 @@
   libcap,
   libnl,
   nixosTests,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bpftune";
-  version = "0-unstable-2025-03-20";
+  version = "0.4-2";
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "bpftune";
-    rev = "8c6a3ffc09265bd44ed89b75c400ef97959d1aff";
-    hash = "sha256-TQ8WaGvMcvyeZC4B9gSjJ2k5NOxpTaV4n7Qi36aA78Q=";
+    tag = finalAttrs.version;
+    hash = "sha256-clfR2nZKB9ztfUEw+znr9/Rdefv4K+mTeRCSBLIBmVY=";
   };
 
   postPatch = ''
     # otherwise shrink rpath would drop $out/lib from rpath
     substituteInPlace src/Makefile \
-      --replace-fail /sbin    /bin \
+      --replace-fail /sbin /bin \
       --replace-fail ldconfig true
     substituteInPlace src/bpftune.service \
       --replace-fail /usr/sbin/bpftune "$out/bin/bpftune"
-    substituteInPlace src/libbpftune.c \
-      --replace-fail /lib/modules /run/booted-system/kernel-modules/lib/modules
   '';
 
   nativeBuildInputs = [
@@ -56,7 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   hardeningDisable = [
-    "stackprotector"
     "zerocallusedregs"
   ];
 
@@ -64,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit (nixosTests) bpftune;
     };
-    updateScript = unstableGitUpdater { };
+    updateScript = nix-update-script { };
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index e4dd50fbe586..17607da8aeb2 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-expand";
-  version = "1.0.119";
+  version = "1.0.120";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     tag = finalAttrs.version;
-    hash = "sha256-N48BUPnVnMJSiM3EzpSiDNLGZNWFW05toHRhokNO5gI=";
+    hash = "sha256-KXnAKv8202Trkkr9D9HRmxTOZ67M2Jt4dhZ9o7D86uI=";
   };
 
-  cargoHash = "sha256-a8swmPQ+JuE/tqRYbV+kekZV8TloxszYq9k8VOGRBrM=";
+  cargoHash = "sha256-eCDjGKLPy98SuknzzIE2GZEsxFjNZKuV30Y5nBQao3s=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ca/cargo-hack/package.nix b/pkgs/by-name/ca/cargo-hack/package.nix
index 68c58c09f016..66aa21aa6bdd 100644
--- a/pkgs/by-name/ca/cargo-hack/package.nix
+++ b/pkgs/by-name/ca/cargo-hack/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hack";
-  version = "0.6.41";
+  version = "0.6.42";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-JfYsMlu+eYZvQ5HtAIhJ/y33BNkdj9LvQeSJUVL5F7Y=";
+    hash = "sha256-ebKnXTEWROIy4MREcBQ+ahbQoQZCSttiCMrgW+/buj4=";
   };
 
-  cargoHash = "sha256-fC9EUu0j/M2dfpFS5Th2pqveFia+lSEtQdaH6Xv32ww=";
+  cargoHash = "sha256-4Vg0JD2FeZV8SiD5Kzg1KLkPnQ20NVlkbiguwbpYip8=";
 
   # some necessary files are absent in the crate version
   doCheck = false;
diff --git a/pkgs/by-name/cf/cfn-nag/package.nix b/pkgs/by-name/cf/cfn-nag/package.nix
index 71c198c9a9b7..b5f7cd01298a 100644
--- a/pkgs/by-name/cf/cfn-nag/package.nix
+++ b/pkgs/by-name/cf/cfn-nag/package.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "cfn-nag";
-  version = "0.8.10";
 
   inherit ruby;
   gemdir = ./.;
diff --git a/pkgs/by-name/cl/claude-code-bin/manifest.json b/pkgs/by-name/cl/claude-code-bin/manifest.json
index 8232b3c85e95..404e75d75689 100644
--- a/pkgs/by-name/cl/claude-code-bin/manifest.json
+++ b/pkgs/by-name/cl/claude-code-bin/manifest.json
@@ -1,41 +1,41 @@
 {
-  "version": "2.1.37",
-  "buildDate": "2026-02-07T18:40:47Z",
+  "version": "2.1.39",
+  "buildDate": "2026-02-10T21:13:30Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "00ed10afb7a562440773de31284568ce9c33385d79d3a912a12af262aefd130e",
-      "size": 181423280
+      "checksum": "d8d7a2b996a691036a53933a259a532254a400934aee452e289e1f4443026d82",
+      "size": 182876336
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "5ad9639bf34affa47066fb98f2d7ad7b0f236009744d309077b194d896fc011d",
-      "size": 186482592
+      "checksum": "2cba24a410a5226f9750b8fe7e83dbe9a61485ef9b0eb286b0b00438aa990d05",
+      "size": 187935648
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "d725cc73060f400a7ac03a769969397daec9d411dbd5b1c7bb1fa60427bf657e",
-      "size": 218584946
+      "checksum": "8f66e02a5be8a620e286f6e634fb424b5ac065731b048af3d745cf719b2c7851",
+      "size": 220025668
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "f967a4d06e16a32436b6329e2dbed459a9fa4d34f07635a1fb271b74f706c91f",
-      "size": 221426063
+      "checksum": "68e4775b293d95e06d168581c523fc5c1523968179229d31a029f285b2aceaff",
+      "size": 222867057
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "8b1852e9922ecb67a6eef467d5d8f4408d58d71e51c785e155cd0c8efe417754",
-      "size": 211768338
+      "checksum": "82055ce3ec2bbcfcd11b8eae4b6f08226dfad29b10ac8b6231feb59e55b8730d",
+      "size": 213209060
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "df4f2a657f4e5c21b1907d7fb10a36622aced68d5ac4c94e709862298d1e2aac",
-      "size": 213926119
+      "checksum": "ab8161c8102f031de34f617648d250432433fbf6c2945cbe5a6bd09a841fd5b6",
+      "size": 215367113
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "8a54bdc2c7d60e84b92f5aeedb9b66791006cfff992415e58e15a6df52842859",
-      "size": 231153824
+      "checksum": "f0357538ba50c80d02deb44a9aa4e02e577b34158284edeca99f5d9ba1183fc9",
+      "size": 232531616
     }
   }
 }
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 26a33c2e9b46..6f9384dd5bfe 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.1.37",
+  "version": "2.1.39",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.1.37",
+      "version": "2.1.39",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index b9395fe9e37f..1bac26c3ee75 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.1.37";
+  version = "2.1.39";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-ijyZCT4LEEtXWOBds8WzizcfED9hVgaJByygJ4P4Yss=";
+    hash = "sha256-NLLiaJkU91ZnEcQUWIAX9oUTt+C5fnWXFFPelTtWmdo=";
   };
 
-  npmDepsHash = "sha256-2if3LsTEnC2OQjEgojqgzs8YOXdpoqJijEmVlxmEfzw=";
+  npmDepsHash = "sha256-VWw1bYkFch95JDlOwKoTAQYOr8R80ICJ8QUI4E64W7o=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/co/commafeed/package.nix b/pkgs/by-name/co/commafeed/package.nix
index ff78a7f22e9e..3d8308e8a08d 100644
--- a/pkgs/by-name/co/commafeed/package.nix
+++ b/pkgs/by-name/co/commafeed/package.nix
@@ -3,7 +3,7 @@
   biome,
   buildNpmPackage,
   fetchFromGitHub,
-  jre,
+  jdk25,
   maven,
   makeWrapper,
   unzip,
@@ -11,13 +11,13 @@
   writeText,
 }:
 let
-  version = "5.11.1";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "Athou";
     repo = "commafeed";
     tag = version;
-    hash = "sha256-B0ztra7j5V5Qm0DRpu4cl04tmOE1gS89NOV2kyMrzOg=";
+    hash = "sha256-M5p3nzlEIuIEMADZyQUqE6WAzlMmP/e4Zh9J8nbhZ9Q=";
   };
 
   frontend = buildNpmPackage {
@@ -27,7 +27,7 @@ let
 
     sourceRoot = "${src.name}/commafeed-client";
 
-    npmDepsHash = "sha256-TD57bDY/7/zYT1T/HOl0+G59/hct8fzJaKaMC8/bBEI=";
+    npmDepsHash = "sha256-XkUlsRdqIXwVExvSofZJLKMUSzjxJRRpV549UTP9Cjo=";
 
     nativeBuildInputs = [ biome ];
 
@@ -53,7 +53,8 @@ maven.buildMavenPackage {
 
   pname = "commafeed";
 
-  mvnHash = "sha256-ipGxdX/LHEn2mQa2JhfeMTmg0esj5Z+7fJ3W2ipLfto=";
+  mvnHash = "sha256-vZ7BPA2N3jgRnTwF3k9En2Pn+zTrXbtB9FGbmU4wJgY=";
+  mvnJdk = jdk25;
 
   mvnParameters = lib.escapeShellArgs [
     "-Dskip.installnodenpm"
@@ -85,7 +86,7 @@ maven.buildMavenPackage {
     mkdir -p $out/bin $out/share
     unzip -d $out/share/ commafeed-server/target/commafeed-$version-h2-jvm.zip
 
-    makeWrapper ${jre}/bin/java $out/bin/commafeed \
+    makeWrapper ${jdk25}/bin/java $out/bin/commafeed \
       --add-flags "-jar $out/share/commafeed-$version-h2/quarkus-run.jar"
 
     runHook postInstall
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 2170abd80a3c..457c99d4cf6a 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.421.0";
+  version = "1.429.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-W9uEfP/2wEBm/KcsH0iNVzFT8rGj34xkNKtAglsQbMg=";
+    hash = "sha256-msqySCQxAySQTEAToUF/JV+IH4B/NKxymCouofEt9Ic=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/fe/feedbackd-device-themes/package.nix b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
index 7728d80e5f31..78deacafd2a5 100644
--- a/pkgs/by-name/fe/feedbackd-device-themes/package.nix
+++ b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd-device-themes";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "agx";
     repo = "feedbackd-device-themes";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1qenmOTk2ZkPNhOHMcTf2sv5LjcPUjdwLGMv8Iuahvw=";
+    hash = "sha256-EZpzqEhUeqqe96qcfKyvhQodBTcsgwNZyXvk2zHj20k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/git-toolbelt/package.nix b/pkgs/by-name/gi/git-toolbelt/package.nix
index fd1c135aa9c7..1fc88f93f85d 100644
--- a/pkgs/by-name/gi/git-toolbelt/package.nix
+++ b/pkgs/by-name/gi/git-toolbelt/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "git-toolbelt";
-  version = "1.9.4";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "nvie";
     repo = "git-toolbelt";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-6ubxMGDi5ocSh8q8rDujxpViT1OmVi7JzH+R6V/88UQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2jpgwB2DEoRtV+WGe81X1rnC7T4+FmJovOFx+4lifQw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -31,8 +31,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     install -Dm755 git-* -t "$out"/bin
 
     for exe in "$out"/bin/*; do
-        wrapProgram "$exe" \
-            --prefix PATH : "$out"/bin:${lib.makeBinPath finalAttrs.buildInputs}
+      wrapProgram "$exe" \
+        --prefix PATH : "$out"/bin:${lib.makeBinPath finalAttrs.buildInputs}
     done
 
     runHook postInstall
diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index a5b848d28b5d..475d2df02067 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -5,22 +5,30 @@
   makeWrapper,
   ffmpeg,
   vlc,
+  vlc' ? vlc.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ x264 ];
+  }),
   jq,
+  x264,
+  nixosTests,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gopro-tool";
-  version = "0-unstable-2024-04-18";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "juchem";
     repo = "gopro-tool";
-    rev = "a678f0ea65e24dca9b8d848b245bd2d487d3c8ca";
-    sha256 = "0sh3s38m17pci24x4kdlmlhn0gwgm28aaa6p7qs16wysk0q0h6wz";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nxsIMJjacxM0PtcopZCojz9gIa20TdKJiOyeUNHQA2o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   installPhase = ''
     mkdir -p $out/bin
     cp $src/gopro-tool $out/bin/gopro-tool
@@ -30,16 +38,20 @@ stdenv.mkDerivation {
       --prefix PATH : ${
         lib.makeBinPath [
           ffmpeg
-          vlc
+          vlc'
           jq
         ]
       }
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) gopro-tool;
+  };
+
   meta = {
     description = "Tool to control GoPro webcam mode in Linux (requires v4l2loopback kernel module and a firewall rule)";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ ZMon3y ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/he/helmholtz/package.nix b/pkgs/by-name/he/helmholtz/package.nix
index ea90db2b4cff..05b797a40ec0 100644
--- a/pkgs/by-name/he/helmholtz/package.nix
+++ b/pkgs/by-name/he/helmholtz/package.nix
@@ -7,7 +7,8 @@
 }:
 
 stdenv.mkDerivation {
-  name = "helmholtz";
+  pname = "helmholtz";
+  version = "1.0";
 
   src = fetchurl {
     url = "https://www.katjaas.nl/helmholtz/helmholtz~.zip";
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 547fb8c08d5f..442f393016f8 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.6.6";
+  version = "10.7.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xU0uygvqeWfsy5FsYQQAEwc0H15j8amW0097Fojw1DM=";
+    hash = "sha256-1gwgzyISeOj4QE8hZ/KDCVW8qCQYvpQE6lf/N1jt0J4=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/md/mdbook-pandoc/package.nix b/pkgs/by-name/md/mdbook-pandoc/package.nix
index 51d25f543b6d..c485436d90f8 100644
--- a/pkgs/by-name/md/mdbook-pandoc/package.nix
+++ b/pkgs/by-name/md/mdbook-pandoc/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pandoc";
-  version = "0.10.5";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "max-heller";
     repo = "mdbook-pandoc";
     tag = "v${version}";
-    hash = "sha256-ihKju9XXJy4JciuMLw4EcKhqSQjrBiUJDG0Rd5DbFdk=";
+    hash = "sha256-lLuw6CZPWHZ8DZz/lWTd+eEv688HcbkvsxLRvW38RKs=";
   };
 
-  cargoHash = "sha256-SXXzGOBvfyLYhed5EMFUCzkFWoGEMM73PD3uWjkUcic=";
+  cargoHash = "sha256-TMFnF/aTJ2UrtnPZ4UOQke6dtUZbUxywf4JIX53mhKY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -30,21 +30,6 @@ rustPlatform.buildRustPackage rec {
     texliveSmall
   ];
 
-  checkFlags =
-    let
-      skippedTests = [
-        # failing subtly
-        "tests::html::rust_reference_regression_nested_elements"
-        "tests::css::css"
-        "tests::definition_lists::dt_attributes"
-        "tests::html::attach_id_to_div_of_stripped_html_elements"
-        "tests::html::link_to_element_by_id"
-        "tests::images::images"
-      ]
-      ++ lib.optional stdenv.buildPlatform.isDarwin "pandoc::tests::five_item_deep_list";
-    in
-    builtins.map (x: "--skip=" + x) skippedTests;
-
   passthru = {
     wrapper = callPackage ./wrapper.nix { };
   };
diff --git a/pkgs/by-name/me/mediainfo/package.nix b/pkgs/by-name/me/mediainfo/package.nix
index dd9f50623d80..07f6a45dd05a 100644
--- a/pkgs/by-name/me/mediainfo/package.nix
+++ b/pkgs/by-name/me/mediainfo/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mediainfo";
-  version = "25.10";
+  version = "26.01";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${finalAttrs.version}/mediainfo_${finalAttrs.version}.tar.xz";
-    hash = "sha256-NmsyUQGrGppO55+9uOPdnni8wKIcD5sZZjE6rtPTNQI=";
+    hash = "sha256-FQZWytiO9O+k6Cmc/CTZt6cjVFdqaTSZIFiKzuLMPHY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index c2e42872e1aa..739d2c1a9a6a 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-8dym3E6VinpExE4A+ekbhiQ+Zhwvue6/s1mAhBkwPMU=";
+    hash = "sha256-OUFmtHGGDU1+7EwfGVzrjPS2hqba0FfIuQl0V7up9Yk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 52d9ba4da6d2..4cfc622e53a3 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.39";
+  version = "2026.2.1";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-85W5OrP9Ju4ZJRUEZLpBreKxgUrHgxxZEv7KzcpqNDo=";
+    hash = "sha256-BpTN9AdQEDD2XnEUsUxgkoq+EPGhtnYgJhLKF4GVZoc=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-+wGup5wJIqTzkr4mTo/CxofffQmUz3JD2s/s/oY0viM=";
+    hash = "sha256-b3d8VcfQjCkcJThebXJ2yvKZfU8u4QnpZgNyqP6XIu0=";
   };
 
   env = {
diff --git a/pkgs/by-name/nd/ndcurves/package.nix b/pkgs/by-name/nd/ndcurves/package.nix
index ba6732ab08e6..770fea0fa4b9 100644
--- a/pkgs/by-name/nd/ndcurves/package.nix
+++ b/pkgs/by-name/nd/ndcurves/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ndcurves";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = "ndcurves";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VHxGm6fzoS51PtTj/qeZumz58ZHtxy28ihbzbnoHvHg=";
+    hash = "sha256-YnpC2yYEe9VNcHHDyv+glLrue/J/HXbK/VP7DTAE/q0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ne/netbird/package.nix b/pkgs/by-name/ne/netbird/package.nix
index 904557bf3060..792ffea51433 100644
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -68,16 +68,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird-${componentName}";
-  version = "0.64.5";
+  version = "0.64.6";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v35IS3Yt2wo7Xvmnjiew1daw7KcS+y+BZYbiwyJVuL0=";
+    hash = "sha256-og5azhvqxtjyAZaMaQDIa4jvaPbPDobQZ/xznxHl6lc=";
   };
 
-  vendorHash = "sha256-n0s2K+qbMiNfbkPbqvvXpvFvL5PkCkuJJ2CH3bEUCOk=";
+  vendorHash = "sha256-54ohzpyAzyD1YX90W7y7qDzFgqLksIFGUOOrGWImT6I=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional (componentName == "ui") pkg-config;
 
diff --git a/pkgs/by-name/ni/nixfmt-tree/package.nix b/pkgs/by-name/ni/nixfmt-tree/package.nix
index d66d23ef3d2e..2d5c3a7f1422 100644
--- a/pkgs/by-name/ni/nixfmt-tree/package.nix
+++ b/pkgs/by-name/ni/nixfmt-tree/package.nix
@@ -95,7 +95,7 @@ treefmtWithConfig.overrideAttrs {
       You can achieve similar results by manually configuring `treefmt`:
       ```nix
       pkgs.treefmt.withConfig {
-        runtimeInputs = [ pkgs.nixfmt-rfc-style ];
+        runtimeInputs = [ pkgs.nixfmt ];
 
         settings = {
           # Log level for files treefmt won't format
diff --git a/pkgs/by-name/os/oscar/package.nix b/pkgs/by-name/os/oscar/package.nix
index ee5806eb40c3..c67308279db1 100644
--- a/pkgs/by-name/os/oscar/package.nix
+++ b/pkgs/by-name/os/oscar/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitLab {
     owner = "CrimsonNape";
     repo = "OSCAR-code";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-idooSDmozMtf0akhbaQP1aBIv6Ae9UMhMmN1P48u7FE=";
+    hash = "sha256-4ekhhzX//u/UFrqIriPmhxdjEGJ1LXczZU2ZCmC+Uvo=";
   };
 
   buildInputs = [
@@ -63,7 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Software for reviewing and exploring data produced by CPAP and related machines used in the treatment of sleep apnea";
     mainProgram = "OSCAR";
     license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.roconnor ];
+    maintainers = with lib.maintainers; [
+      roconnor
+      ilkecan
+    ];
     # Someone needs to create a suitable installPhase for Darwin and Windows.
     # See https://gitlab.com/pholy/OSCAR-code/-/tree/master/Building.
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/pi/pixelorama/package.nix b/pkgs/by-name/pi/pixelorama/package.nix
index 6d3063de2812..4bfcc81eea7c 100644
--- a/pkgs/by-name/pi/pixelorama/package.nix
+++ b/pkgs/by-name/pi/pixelorama/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  godot_4_4,
+  godot_4_5,
   nix-update-script,
 }:
 
@@ -16,17 +16,17 @@ let
     presets.${stdenv.hostPlatform.system}
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  godot = godot_4_4;
+  godot = godot_4_5;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pixelorama";
-  version = "1.1.5";
+  version = "1.1.8";
 
   src = fetchFromGitHub {
     owner = "Orama-Interactive";
     repo = "Pixelorama";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5ODSGZM39FO+6tTLoosnrf5ngh+fSHpNsphTgjlux48=";
+    hash = "sha256-21DNwr5D8Bl2fkMnOtyB3tZrYS/1yZAxo9OkCqV+SYs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/qp/qpwgraph/package.nix b/pkgs/by-name/qp/qpwgraph/package.nix
index 55d539b652f1..271eef27e796 100644
--- a/pkgs/by-name/qp/qpwgraph/package.nix
+++ b/pkgs/by-name/qp/qpwgraph/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.9.8";
+  version = "0.9.9";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-fbkRSM4HFH1f/qZgRmEz7q5kvt2YAKWu/FX2GOXHhbQ=";
+    sha256 = "sha256-lL90qhd0qggLQ98g4FgMHZT6xBChHACmASLvxfYNAAw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rg/rgrc/package.nix b/pkgs/by-name/rg/rgrc/package.nix
index b7c501c52383..3dbd8ab0061d 100644
--- a/pkgs/by-name/rg/rgrc/package.nix
+++ b/pkgs/by-name/rg/rgrc/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rgrc";
-  version = "0.6.7";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "lazywalker";
     repo = "rgrc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UFGC41utbAeKa5RnVcnhwvRVXobXOTrqtA/Khwyke9w=";
+    hash = "sha256-Sc0JmcnxW9WZ78ayJtSWTZBoVgqnFGUO2dKGi8U05S0=";
   };
 
-  cargoHash = "sha256-bmMO1qfii31BUZhNnZtiEd+1wuH2sTO0hQ2FVEzYAtE=";
+  cargoHash = "sha256-wEE08Rqga5Ffz6IgYyQto0gB8bXCZ6Myc3r6uM5XTCs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sl/slade-unstable/package.nix b/pkgs/by-name/sl/slade-unstable/package.nix
index c2cd03df2e09..ce544a69a413 100644
--- a/pkgs/by-name/sl/slade-unstable/package.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.11-unstable-2026-01-28";
+  version = "3.2.11-unstable-2026-02-10";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "10cfdb655f541ba2c37da97bea9d5fc0cb5c7541";
-    hash = "sha256-5aXfy7sAewIOMqzgd1HBrVlusx2TKz61SfTFsTIRTII=";
+    rev = "b2c302bb9723a7ef12315c299244874249f4f13b";
+    hash = "sha256-lUyDsJb2DXCSwRp7G9YF9aAWhJ7a2mXriTPmQ2/nhaQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sm/small/package.nix b/pkgs/by-name/sm/small/package.nix
new file mode 100644
index 000000000000..99aa50cff700
--- /dev/null
+++ b/pkgs/by-name/sm/small/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "small";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "alandefreitas";
+    repo = "small";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+aPieFls2u2A57CKQz/q+ZqGjNyscDlWDryAp3VM1Lk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "C++ small containers";
+    homepage = "https://github.com/alandefreitas/small";
+    license = lib.licenses.boost;
+    maintainers = [ ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/su/surge-XT/clap-option.diff b/pkgs/by-name/su/surge-xt/clap-option.diff
similarity index 100%
rename from pkgs/by-name/su/surge-XT/clap-option.diff
rename to pkgs/by-name/su/surge-xt/clap-option.diff
diff --git a/pkgs/by-name/su/surge-XT/package.nix b/pkgs/by-name/su/surge-xt/package.nix
similarity index 99%
rename from pkgs/by-name/su/surge-XT/package.nix
rename to pkgs/by-name/su/surge-xt/package.nix
index 0b4ce473dbc9..3a2e22cb5574 100644
--- a/pkgs/by-name/su/surge-XT/package.nix
+++ b/pkgs/by-name/su/surge-xt/package.nix
@@ -22,7 +22,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "surge-XT";
+  pname = "surge-xt";
   version = "1.3.4";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/by-name/sy/syncthingtray/package.nix
similarity index 76%
rename from pkgs/applications/misc/syncthingtray/default.nix
rename to pkgs/by-name/sy/syncthingtray/package.nix
index 9d902d07b895..cfaa3d5723c3 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/by-name/sy/syncthingtray/package.nix
@@ -2,21 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  qtbase,
-  qtsvg,
-  qtwayland,
-  qtwebengine,
-  qtdeclarative,
-  extra-cmake-modules,
+  kdePackages,
   cpp-utilities,
-  qtutilities,
-  qtforkawesome,
   boost,
-  wrapQtAppsHook,
   cmake,
-  kio,
-  plasma-framework,
-  qttools,
   iconv,
   cppunit,
   syncthing,
@@ -49,37 +38,37 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   buildInputs = [
-    qtbase
-    qtsvg
+    kdePackages.qtbase
+    kdePackages.qtsvg
     cpp-utilities
-    qtutilities
+    kdePackages.qtutilities
     boost
-    qtforkawesome
+    kdePackages.qtforkawesome
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ iconv ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ]
-  ++ lib.optionals webviewSupport [ qtwebengine ]
-  ++ lib.optionals jsSupport [ qtdeclarative ]
-  ++ lib.optionals kioPluginSupport [ kio ]
-  ++ lib.optionals plasmoidSupport [ plasma-framework ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ kdePackages.qtwayland ]
+  ++ lib.optionals webviewSupport [ kdePackages.qtwebengine ]
+  ++ lib.optionals jsSupport [ kdePackages.qtdeclarative ]
+  ++ lib.optionals kioPluginSupport [ kdePackages.kio ]
+  ++ lib.optionals plasmoidSupport [ kdePackages.libplasma ];
 
   nativeBuildInputs = [
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
     cmake
-    qttools
+    kdePackages.qttools
     # Although these are test dependencies, we add them anyway so that we test
     # whether the test units compile. On Darwin we don't run the tests but we
     # still build them.
     cppunit
     syncthing
   ]
-  ++ lib.optionals plasmoidSupport [ extra-cmake-modules ];
+  ++ lib.optionals plasmoidSupport [ kdePackages.extra-cmake-modules ];
 
   # syncthing server seems to hang on darwin, causing tests to fail.
   doCheck = !stdenv.hostPlatform.isDarwin;
   preCheck = ''
     export QT_QPA_PLATFORM=offscreen
-    export QT_PLUGIN_PATH="${lib.getBin qtbase}/${qtbase.qtPluginPrefix}"
+    export QT_PLUGIN_PATH="${lib.getBin kdePackages.qtbase}/${kdePackages.qtbase.qtPluginPrefix}"
   '';
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # put the app bundle into the proper place /Applications instead of /bin
@@ -94,14 +83,14 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
 
   cmakeFlags = [
-    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major qtbase.version}"
-    "-DKF_PACKAGE_PREFIX=KF${lib.versions.major qtbase.version}"
+    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major kdePackages.qtbase.version}"
+    "-DKF_PACKAGE_PREFIX=KF${lib.versions.major kdePackages.qtbase.version}"
     "-DBUILD_TESTING=ON"
     # See https://github.com/Martchus/syncthingtray/issues/208
     "-DEXCLUDE_TESTS_FROM_ALL=OFF"
     "-DAUTOSTART_EXEC_PATH=${autostartExecPath}"
     # See https://github.com/Martchus/syncthingtray/issues/42
-    "-DQT_PLUGIN_DIR:STRING=${placeholder "out"}/${qtbase.qtPluginPrefix}"
+    "-DQT_PLUGIN_DIR:STRING=${placeholder "out"}/${kdePackages.qtbase.qtPluginPrefix}"
     "-DBUILD_SHARED_LIBS=ON"
   ]
   ++ lib.optionals (!plasmoidSupport) [ "-DNO_PLASMOID=ON" ]
diff --git a/pkgs/by-name/th/throne/nixos-disable-setuid-request.patch b/pkgs/by-name/th/throne/nixos-disable-setuid-request.patch
index 9febc59f65f6..3b3eaec2b69d 100644
--- a/pkgs/by-name/th/throne/nixos-disable-setuid-request.patch
+++ b/pkgs/by-name/th/throne/nixos-disable-setuid-request.patch
@@ -36,7 +36,7 @@ index d31c311..ce4c357 100644
 +    QMessageBox::critical(
 +        GetMessageBoxParent(),
 +        tr("Unable to elevate privileges when installed with Nix"),
-+        tr("Due to the read-only property of Nix store, we cannot set suid for throne-core. If you are using NixOS, please set `programs.throne.tunMode.enable` option to elevate privileges."),
++        tr("Due to the read-only property of Nix store, we cannot set suid for throne-core. If you are using NixOS, please install Throne via `programs.throne.enable` and then set the `programs.throne.tunMode.enable` option to elevate privileges."),
 +        QMessageBox::Ok
 +    );
 +    return false;
diff --git a/pkgs/by-name/wi/wit-bindgen/package.nix b/pkgs/by-name/wi/wit-bindgen/package.nix
index 87361189e5ca..3b7bb0abbe4a 100644
--- a/pkgs/by-name/wi/wit-bindgen/package.nix
+++ b/pkgs/by-name/wi/wit-bindgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wit-bindgen";
-  version = "0.52.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S3iOmkAg1H6sEcXhC/7cQcrwH5OwR5ZROn0iPkUrwEY=";
+    hash = "sha256-TTSc4T8QR7cmAPAFzoV/9oBfKrUzVs20qMP3rwjELr4=";
   };
 
-  cargoHash = "sha256-RqDlBpwCxwwoG+u7zUz8j4t5JXonTe7mvAk8PxU7Gdc=";
+  cargoHash = "sha256-SybsgrOlxh27CQ73IXVYlTROTRR0MU3O7Sieh5pYeHw=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.
diff --git a/pkgs/by-name/zo/zotero/avoid-git.patch b/pkgs/by-name/zo/zotero/avoid-git.patch
new file mode 100644
index 000000000000..f0c6b4ffdeaf
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/avoid-git.patch
@@ -0,0 +1,55 @@
+diff --git a/app/scripts/dir_build b/app/scripts/dir_build
+index 493288ad47..ccabb3722b 100755
+--- a/app/scripts/dir_build
++++ b/app/scripts/dir_build
+@@ -86,7 +86,7 @@ fi
+ 
+ CHANNEL="source"
+ 
+-hash=$(git -C "$ROOT_DIR" rev-parse --short HEAD)
++hash="0000000000000000000000000000000000000000"
+ 
+ build_dir=$(mktemp -d)
+ cleanup() { rm -rf "$build_dir"; }
+diff --git a/js-build/note-editor.js b/js-build/note-editor.js
+index 1435730342..6eebb10c50 100644
+--- a/js-build/note-editor.js
++++ b/js-build/note-editor.js
+@@ -12,8 +12,7 @@ async function getZoteroNoteEditor(signatures) {
+ 
+ 	const modulePath = path.join(__dirname, '..', 'note-editor');
+ 
+-	const { stdout } = await exec('git rev-parse HEAD', { cwd: modulePath });
+-	const hash = stdout.trim();
++	const hash = '';
+ 
+ 	if (!('note-editor' in signatures) || signatures['note-editor'].hash !== hash) {
+ 		const targetDir = path.join(__dirname, '..', 'build', 'resource', 'note-editor');
+diff --git a/js-build/pdf-worker.js b/js-build/pdf-worker.js
+index b820304f3a..6bbd0708c9 100644
+--- a/js-build/pdf-worker.js
++++ b/js-build/pdf-worker.js
+@@ -12,8 +12,7 @@ async function getPDFWorker(signatures) {
+ 
+ 	const modulePath = path.join(__dirname, '..', 'pdf-worker');
+ 
+-	const { stdout } = await exec('git rev-parse HEAD', { cwd: modulePath });
+-	const hash = stdout.trim();
++	const hash = '';
+ 
+ 	if (!('pdf-worker' in signatures) || signatures['pdf-worker'].hash !== hash) {
+ 		const targetDir = path.join(__dirname, '..', 'build', 'chrome', 'content', 'zotero', 'xpcom', 'pdfWorker');
+diff --git a/js-build/reader.js b/js-build/reader.js
+index 67a02a3ad2..2127f680df 100644
+--- a/js-build/reader.js
++++ b/js-build/reader.js
+@@ -12,8 +12,7 @@ async function getReader(signatures) {
+ 
+ 	const modulePath = path.join(__dirname, '..', 'reader');
+ 	
+-	const { stdout } = await exec('git rev-parse HEAD', { cwd: modulePath });
+-	const hash = stdout.trim();
++	const hash = '';
+ 	
+ 	if (!('reader' in signatures) || signatures['reader'].hash !== hash) {
+ 		const targetDir = path.join(__dirname, '..', 'build', 'resource', 'reader');
diff --git a/pkgs/by-name/zo/zotero/avoid-xulrunner-fetch.patch b/pkgs/by-name/zo/zotero/avoid-xulrunner-fetch.patch
new file mode 100644
index 000000000000..b0761e4a8c41
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/avoid-xulrunner-fetch.patch
@@ -0,0 +1,135 @@
+diff --git a/app/scripts/fetch_xulrunner b/app/scripts/fetch_xulrunner
+index 30c3a9073d..aa953744f8 100755
+--- a/app/scripts/fetch_xulrunner
++++ b/app/scripts/fetch_xulrunner
+@@ -148,15 +148,6 @@ function modify_omni {
+ 	# Continue using app.update.auto in prefs.js on Windows
+ 	replace_line 'PER_INSTALLATION_PREFS_PLATFORMS = \["win"\]' 'PER_INSTALLATION_PREFS_PLATFORMS = []' modules/UpdateUtils.sys.mjs
+ 	
+-	# Prompt if major update is available instead of installing automatically on restart
+-	replace_line 'if \(!updateAuto\) \{' 'if (update.type == "major") {
+-      LOG("UpdateService:_selectAndInstallUpdate - prompting because it is a major update");
+-      AUSTLMY.pingCheckCode(this._pingSuffix, AUSTLMY.CHK_SHOWPROMPT_PREF);
+-      Services.obs.notifyObservers(update, "update-available", "show-prompt");
+-      return;
+-    }
+-    if (!updateAuto) {' modules/UpdateService.sys.mjs
+-	
+ 	# Avoid console warning about resource://gre/modules/FxAccountsCommon.js
+ 	replace_line 'const logins = this._data.logins;' 'const logins = this._data.logins; if (this._data.logins.length != -1) return;' modules/LoginStore.sys.mjs
+ 	
+@@ -506,70 +497,9 @@ cd xulrunner
+ 
+ if [ $BUILD_MAC == 1 ]; then
+ 	GECKO_VERSION="$GECKO_VERSION_MAC"
+-	DOWNLOAD_URL="https://ftp.mozilla.org/pub/firefox/releases/$GECKO_VERSION"
+-	rm -rf Firefox.app
+-	
+-	if [ -e "Firefox $GECKO_VERSION.app.zip" ]; then
+-		echo "Using Firefox $GECKO_VERSION.app.zip"
+-		unzip "Firefox $GECKO_VERSION.app.zip"
+-	else
+-		curl -o Firefox.dmg "$DOWNLOAD_URL/mac/en-US/Firefox%20$GECKO_VERSION.dmg"
+-		set +e
+-		hdiutil detach -quiet /Volumes/Firefox 2>/dev/null
+-		set -e
+-		hdiutil attach -quiet Firefox.dmg
+-		cp -a /Volumes/Firefox/Firefox.app .
+-		# Store local copy of unmodified app
+-		zip -r "Firefox $GECKO_VERSION.app.zip" Firefox.app
+-		hdiutil detach -quiet /Volumes/Firefox
+-	fi
+-	
+-	# Download custom components (e.g., XUL), as an xz-compressed tarball of the MacOS folder with
+-	# custom files in it
+-	echo
+-	rm -rf MacOS
+-	if [ -n "$custom_components_hash_mac" ]; then
+-		if [ -e "Firefox $GECKO_VERSION MacOS.zip" ]; then
+-			echo "Using Firefox $GECKO_VERSION MacOS.zip"
+-			unzip "Firefox $GECKO_VERSION MacOS.zip"
+-		else
+-			echo "Downloading custom Firefox components"
+-			echo
+-			curl -o MacOS.tar.xz "${custom_components_url}mac/$custom_components_hash_mac.tar.xz"
+-			
+-			# Verify hash
+-			if [[ "`uname`" = "Darwin" ]]; then
+-				shasum="shasum -a 256"
+-			else
+-				shasum=sha256sum
+-			fi
+-			echo
+-			echo "$custom_components_hash_mac  MacOS.tar.xz" | $shasum -c -
+-			echo
+-			
+-			tar xvf MacOS.tar.xz
+-		fi
+-		echo
+-	fi
+-	
+ 	pushd Firefox.app/Contents/Resources
+ 	modify_omni mac
+ 	popd
+-	
+-	# Replace "FirefoxCP" with "ZoteroCP" for subprocesses ("Isolated Web Content", "Socket Process", "Web Content", etc.)
+-	info_plist=Firefox.app/Contents/MacOS/plugin-container.app/Contents/Resources/English.lproj/InfoPlist.strings
+-	from=$(get_utf16_chars "FirefoxCP")
+-	to=$(get_utf16_chars "ZoteroCP")
+-	perl -pi -e "s/$from/$to/" $info_plist
+-	# Check for UTF-16 "ZoteroCP"
+-	if ! grep -a -q "Z.o.t.e.r.o.C.P." $info_plist; then
+-		echo '"ZoteroCP" not found in InfoPlist.strings after replacement'
+-		exit 1
+-	fi
+-	
+-	rm -f Firefox.dmg
+-	
+-	echo $("$SCRIPT_DIR/xulrunner_hash" -p m) > hash-mac
+ fi
+ 
+ if [ $BUILD_WIN == 1 ]; then
+@@ -709,9 +639,6 @@ if [ $BUILD_WIN == 1 ]; then
+ fi
+ 
+ if [ $BUILD_LINUX == 1 ]; then
+-	GECKO_VERSION="$GECKO_VERSION_LINUX"
+-	DOWNLOAD_URL="https://ftp.mozilla.org/pub/firefox/releases/$GECKO_VERSION"
+-	
+ 	if [[ -n $arch ]]; then
+ 		arch_list=("$arch")
+ 	else
+@@ -719,33 +646,11 @@ if [ $BUILD_LINUX == 1 ]; then
+ 	fi
+ 	for arch in "${arch_list[@]}"; do
+ 		xdir="firefox-linux-$arch"
+-		rm -rf $xdir
+-		
+-		archived_file="firefox-$GECKO_VERSION-$arch.tar.xz"
+-		if [ -e "$archived_file" ]; then
+-			echo "Using $archived_file"
+-			cp "$archived_file" "firefox-$GECKO_VERSION.tar.xz"
+-		else
+-			if [ $arch = "arm64" ]; then
+-				moz_arch=aarch64
+-			else
+-				moz_arch=$arch
+-			fi
+-			curl -O "$DOWNLOAD_URL/linux-$moz_arch/en-US/firefox-$GECKO_VERSION.tar.xz"
+-			# Store local copy of unmodified app
+-			cp "firefox-$GECKO_VERSION.tar.xz" "$archived_file"
+-		fi
+-
+-		tar xvf firefox-$GECKO_VERSION.tar.xz
+-		mv firefox $xdir
+ 
+ 		pushd $xdir
+ 		modify_omni $arch
+ 		popd
+ 		
+-		rm "firefox-$GECKO_VERSION.tar.xz"
+-		
+-		echo "$( $SCRIPT_DIR/xulrunner_hash -p l -a "$arch" )" > "hash-linux-${arch}"
+ 	done
+ fi
+ 
diff --git a/pkgs/by-name/zo/zotero/build-fixes.patch b/pkgs/by-name/zo/zotero/build-fixes.patch
new file mode 100644
index 000000000000..73854217084a
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/build-fixes.patch
@@ -0,0 +1,36 @@
+diff --git a/app/build.sh b/app/build.sh
+index de092bde16..2e58b687e7 100755
+--- a/app/build.sh
++++ b/app/build.sh
+@@ -644,11 +644,6 @@ if [ $BUILD_MAC == 1 ]; then
+ 		cp "$MAC_RUNTIME_PATH/../MacOS/XUL" "$CONTENTSDIR/MacOS/"
+ 	fi
+ 
+-	# Use our own updater, because Mozilla's requires updates signed by Mozilla
+-	cd "$CONTENTSDIR/MacOS"
+-	check_lfs_file "$CALLDIR/mac/updater.tar.xz"
+-	tar xf "$CALLDIR/mac/updater.tar.xz"
+-
+ 	# Modify Info.plist
+ 	perl -pi -e "s/\{\{VERSION\}\}/$VERSION/" "$CONTENTSDIR/Info.plist"
+ 	perl -pi -e "s/\{\{VERSION_NUMERIC\}\}/$VERSION_NUMERIC/" "$CONTENTSDIR/Info.plist"
+@@ -1027,11 +1022,6 @@ if [ $BUILD_LINUX == 1 ]; then
+ 		# Copy Ubuntu launcher files
+ 		cp "$CALLDIR/linux/zotero.desktop" "$APPDIR"
+ 		cp "$CALLDIR/linux/set_launcher_icon" "$APPDIR"
+-		
+-		# Use our own updater, because Mozilla's requires updates signed by Mozilla
+-		check_lfs_file "$CALLDIR/linux/updater.tar.xz"
+-		tar xf "$CALLDIR/linux/updater.tar.xz" --to-stdout updater-$arch > "$APPDIR/updater"
+-		chmod 755 "$APPDIR/updater"
+ 
+ 		# Copy app files
+ 		rsync -a "$base_dir/" "$APPDIR/"
+@@ -1041,6 +1031,7 @@ if [ $BUILD_LINUX == 1 ]; then
+ 		cp -RH "$CALLDIR/modules/zotero-libreoffice-integration/install" "$APPDIR/integration/libreoffice"
+ 		
+ 		# Copy icons
++		mkdir -p "$APPDIR/icons/"
+ 		cp "$CALLDIR/linux/icons/icon32.png" "$APPDIR/icons/"
+ 		cp "$CALLDIR/linux/icons/icon64.png" "$APPDIR/icons/"
+ 		cp "$CALLDIR/linux/icons/icon128.png" "$APPDIR/icons/"
diff --git a/pkgs/by-name/zo/zotero/darwin.nix b/pkgs/by-name/zo/zotero/darwin.nix
deleted file mode 100644
index 6f27faac3d3f..000000000000
--- a/pkgs/by-name/zo/zotero/darwin.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  pname,
-  version,
-  meta,
-  stdenv,
-  fetchurl,
-  undmg,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://download.zotero.org/client/release/${finalAttrs.version}/Zotero-${finalAttrs.version}.dmg";
-    hash = "sha256-lDf/jULLQyzxNVGRUKuF2df+FTbJK08z+fFQbVgwjsY=";
-  };
-  sourceRoot = ".";
-
-  nativeBuildInputs = [ undmg ];
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontFixup = true; # breaks notarization
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications
-    cp -r Zotero.app $out/Applications
-
-    runHook postInstall
-  '';
-})
diff --git a/pkgs/by-name/zo/zotero/js-build-fixes.patch b/pkgs/by-name/zo/zotero/js-build-fixes.patch
new file mode 100644
index 000000000000..446a476a0115
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/js-build-fixes.patch
@@ -0,0 +1,42 @@
+diff --git a/js-build/note-editor.js b/js-build/note-editor.js
+index 1435730342..bfd552f863 100644
+--- a/js-build/note-editor.js
++++ b/js-build/note-editor.js
+@@ -36,9 +36,6 @@ async function getZoteroNoteEditor(signatures) {
+ 			await fs.remove(path.join(targetDir, 'zotero'));
+ 		}
+ 		catch (e) {
+-			console.error(e);
+-			await exec('npm ci', { cwd: modulePath });
+-			await exec('npm run build', { cwd: modulePath });
+ 			await fs.copy(path.join(modulePath, 'build', 'zotero'), targetDir);
+ 		}
+ 		signatures['note-editor'] = { hash };
+diff --git a/js-build/pdf-worker.js b/js-build/pdf-worker.js
+index b820304f3a..aafb6b1ef5 100644
+--- a/js-build/pdf-worker.js
++++ b/js-build/pdf-worker.js
+@@ -33,9 +33,6 @@ async function getPDFWorker(signatures) {
+ 			);
+ 		}
+ 		catch (e) {
+-			console.error(e);
+-			await exec('npm ci', { cwd: modulePath });
+-			await exec('npm run build', { cwd: modulePath });
+ 			await fs.copy(path.join(modulePath, 'build', 'worker.js'), path.join(targetDir, 'worker.js'));
+ 		}
+ 		signatures['pdf-worker'] = { hash };
+diff --git a/js-build/reader.js b/js-build/reader.js
+index 67a02a3ad2..5de2f3ada8 100644
+--- a/js-build/reader.js
++++ b/js-build/reader.js
+@@ -36,9 +36,6 @@ async function getReader(signatures) {
+ 			await fs.remove(path.join(targetDir, 'zotero'));
+ 		}
+ 		catch (e) {
+-			console.error(e);
+-			await exec('npm ci', { cwd: modulePath });
+-			await exec('npm run build', { cwd: modulePath });
+ 			await fs.copy(path.join(modulePath, 'build', 'zotero'), targetDir);
+ 		}
+ 		signatures['reader'] = { hash };
diff --git a/pkgs/by-name/zo/zotero/linux.nix b/pkgs/by-name/zo/zotero/linux.nix
deleted file mode 100644
index e192ca642823..000000000000
--- a/pkgs/by-name/zo/zotero/linux.nix
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  pname,
-  version,
-  meta,
-  lib,
-  stdenv,
-  fetchurl,
-  wrapGAppsHook3,
-  makeDesktopItem,
-  atk,
-  cairo,
-  dbus-glib,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  libGL,
-  libva,
-  libxtst,
-  libxrandr,
-  libxi,
-  libxfixes,
-  libxext,
-  libxdamage,
-  libxcursor,
-  libxcomposite,
-  libx11,
-  libxcb,
-  libgbm,
-  pango,
-  pciutils,
-  alsaSupport ? true,
-  alsa-lib,
-  jackSupport ? true,
-  libjack2,
-  pulseSupport ? true,
-  libpulseaudio,
-  sndioSupport ? true,
-  sndio,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://download.zotero.org/client/release/${finalAttrs.version}/Zotero-${finalAttrs.version}_linux-x86_64.tar.bz2";
-    hash = "sha256-uV0R0L8EoZt59hMKXFlJ+EhONArPpRbb/tIV+wZKLgY=";
-  };
-
-  dontPatchELF = true;
-  nativeBuildInputs = [ wrapGAppsHook3 ];
-
-  libPath =
-    lib.makeLibraryPath (
-      [
-        atk
-        cairo
-        dbus-glib
-        gdk-pixbuf
-        glib
-        gtk3
-        libGL
-        libva
-        libx11
-        libxcomposite
-        libxcursor
-        libxdamage
-        libxext
-        libxfixes
-        libxi
-        libxrandr
-        libxtst
-        libxcb
-        libgbm
-        pango
-        pciutils
-      ]
-      ++ lib.optional alsaSupport alsa-lib
-      ++ lib.optional jackSupport libjack2
-      ++ lib.optional pulseSupport libpulseaudio
-      ++ lib.optional sndioSupport sndio
-    )
-    + ":"
-    + lib.makeSearchPathOutput "lib" "lib" [ stdenv.cc.cc ];
-
-  desktopItem = makeDesktopItem {
-    name = "zotero";
-    exec = "zotero -url %U";
-    icon = "zotero";
-    comment = finalAttrs.meta.description;
-    desktopName = "Zotero";
-    genericName = "Reference Management";
-    categories = [
-      "Office"
-      "Database"
-    ];
-    startupNotify = true;
-    mimeTypes = [
-      "x-scheme-handler/zotero"
-      "text/plain"
-    ];
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    # Copy package contents to the output directory
-    mkdir -p "$prefix/usr/lib/zotero-bin-${finalAttrs.version}"
-    cp -r * "$prefix/usr/lib/zotero-bin-${finalAttrs.version}"
-    mkdir -p "$out/bin"
-    ln -s "$prefix/usr/lib/zotero-bin-${finalAttrs.version}/zotero" "$out/bin/"
-
-    # Install desktop file and icons
-    mkdir -p $out/share/applications
-    cp ${finalAttrs.desktopItem}/share/applications/* $out/share/applications/
-    for size in 32 64 128; do
-      install -Dm444 icons/icon''${size}.png \
-        $out/share/icons/hicolor/''${size}x''${size}/apps/zotero.png
-    done
-    install -Dm444 icons/symbolic.svg \
-      $out/share/icons/hicolor/symbolic/apps/zotero-symbolic.svg
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    for executable in \
-      zotero-bin plugin-container updater vaapitest \
-      minidump-analyzer glxtest
-    do
-      if [ -e "$out/usr/lib/zotero-bin-${finalAttrs.version}/$executable" ]; then
-        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          "$out/usr/lib/zotero-bin-${finalAttrs.version}/$executable"
-      fi
-    done
-    find . -executable -type f -exec \
-      patchelf --set-rpath "$libPath" \
-        "$out/usr/lib/zotero-bin-${finalAttrs.version}/{}" \;
-  '';
-})
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index f76a17632fd9..78e8292923fb 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -1,30 +1,327 @@
 {
   lib,
   stdenv,
-  callPackage,
+  fetchFromGitHub,
+  buildNpmPackage,
+  nodejs_22,
+  perl,
+  python3,
+  zip,
+  unzip,
+  xz,
+  gawk,
+  rsync,
+  firefox-esr-140-unwrapped,
+  makeDesktopItem,
+  copyDesktopItems,
+  libGL,
+  pciutils,
+  wrapGAppsHook3,
+  nix-update-script,
+  xvfb-run,
+  doCheck ? false,
 }:
-
 let
+  # note-editor needs nodejs 22. Any newer version fails to build zotero's fork of @benrbray/prosemirror-math during npm install.
+  nodejs = nodejs_22;
+
   pname = "zotero";
-  version = "7.0.30";
+  version = "8.0.2";
+
+  src = fetchFromGitHub {
+    owner = "zotero";
+    repo = "zotero";
+    tag = version;
+    hash = "sha256-zGcTZjrbFYbE4qJH5g3betnSLCdxYU2nZBOU55HunYU=";
+    fetchSubmodules = true;
+  };
+
+  pdf-js = buildNpmPackage {
+    pname = "zotero-pdf-js";
+    inherit version nodejs;
+    src = "${src}/pdf-worker/pdf.js";
+    npmDepsHash = "sha256-KeYAY6EWBZVd3QucDEDtI6lwtTahCEFBFf2Ebib9HKg=";
+    buildPhase = ''
+      runHook preBuild
+
+      npm exec gulp lib-legacy
+      npm exec gulp generic-legacy
+      npm exec gulp minified-legacy
+
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r . $out
+
+      runHook postInstall
+    '';
+  };
+
+  epub-js = buildNpmPackage {
+    pname = "zotero-epub-js";
+    inherit version nodejs;
+    src = "${src}/reader/epubjs/epub.js";
+    npmDepsHash = "sha256-6XY6uczPOpMpRHDQbkQRHKBDDRQ/MXIVepGBx1V+h5Q=";
+    buildPhase = ''
+      runHook preBuild
+
+      npm run compile
+      npm run build
+
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r . $out
+
+      runHook postInstall
+    '';
+  };
+
+  pdf-reader = buildNpmPackage {
+    pname = "zotero-pdf-reader";
+    inherit version nodejs;
+    src = "${src}/reader";
+    npmDepsHash = "sha256-p8O2gIF0S7QO0AR9TPPQsWUtRnKnf58zSl3JZN0lnuc=";
+    patches = [ ./pdf-reader-locales.patch ];
+    postPatch = ''
+      rm -rf pdfjs/pdf.js
+      cp -r ${pdf-js} pdfjs/pdf.js
+      chmod -R u+w pdfjs/pdf.js
+
+      rm -rf epubjs/epub.js
+      cp -r ${epub-js} epubjs/epub.js
+      chmod -R u+w epubjs/epub.js
+
+      mkdir -p locales/en-US/
+      cp -r ${src}/chrome/locale/en-US/zotero/* locales/en-US/
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r . $out
+
+      runHook postInstall
+    '';
+  };
+
+  pdf-worker = buildNpmPackage {
+    pname = "zotero-pdf-worker";
+    inherit version nodejs;
+    src = "${src}/pdf-worker";
+    npmDepsHash = "sha256-TGuN1fZOClzm6xD2rmn5BAemN4mbyOVaLbSRyMeDIm8=";
+    nativeBuildInputs = [
+      rsync
+    ];
+    postPatch = ''
+      rm -rf pdf.js
+      cp -r ${pdf-js} pdf.js
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r . $out
+
+      runHook postInstall
+    '';
+  };
+
+  note-editor = buildNpmPackage {
+    pname = "zotero-note-editor";
+    inherit version nodejs;
+    src = "${src}/note-editor";
+    npmDepsHash = "sha256-3KSSm8oCNOIDN/ZHhDbx7+cF20qtjtZwpnCOOWe3WQc=";
+    makeCacheWritable = true;
+    patches = [ ./pdf-reader-locales.patch ];
+    postPatch = ''
+      mkdir -p locales/en-US/
+      cp -r ${src}/chrome/locale/en-US/zotero/* locales/en-US/
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r . $out
+
+      runHook postInstall
+    '';
+  };
+
+in
+buildNpmPackage (finalAttrs: {
+  inherit
+    pname
+    version
+    src
+    nodejs
+    ;
+
+  npmDepsHash = "sha256-dtbA1V38u26gqWoN+kW/tnccl6HFX7p8fPAneq+mw6U=";
+
+  nativeBuildInputs = [
+    perl
+    python3
+    zip
+    unzip
+    xz
+    gawk
+    rsync
+    copyDesktopItems
+    wrapGAppsHook3
+  ];
+
+  patches = [
+    ./avoid-git.patch
+    ./js-build-fixes.patch
+    ./avoid-xulrunner-fetch.patch
+    ./build-fixes.patch
+  ];
+
+  postPatch = ''
+    rm -rf reader
+    cp -r ${pdf-reader} reader
+    chmod -R u+w reader
+
+    rm -rf pdf-worker
+    cp -r ${pdf-worker} pdf-worker
+    chmod -R u+w pdf-worker
+
+    rm -rf note-editor
+    cp -r ${note-editor} note-editor
+    chmod -R u+w note-editor
+
+    patchShebangs --build app/ test/
+
+    # Skip some flaky/failing tests
+    rm test/tests/retractionsTest.js
+    for test in \
+      "should throw error on broken symlink" \
+      "should use BrowserDownload for 403 when enforcing file type" \
+      "should use BrowserDownload for a JS redirect page" \
+      "should keep attachments pane status after changing selection" \
+      "should render preview robustly after making dense calls to render and discard" \
+      "should discard attachment pane preview after becoming invisible" \
+    ; do
+      sed -i "s|it(\"$test|it.skip(\"$test|" test/tests/*.js
+    done
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    # Place firefox files at the right place.
+    # The correct firefox version can be found in zotero/app/config.sh at `GECKO_VERSION_LINUX`.
+    mkdir -p app/xulrunner/
+  ''
+  + lib.optionalString stdenv.targetPlatform.isDarwin ''
+    cp -r "${firefox-esr-140-unwrapped}/Applications/Firefox ESR.app" app/xulrunner/Firefox.app
+  ''
+  + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+    cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.targetPlatform.parsed.kernel.name}-${
+      lib.replaceString "aarch64" "arm64" stdenv.targetPlatform.parsed.cpu.name
+    }"
+  ''
+  + ''
+    chmod -R u+w app/xulrunner/
+
+    ./app/scripts/dir_build
+
+    runHook postBuild
+  '';
+
+  inherit doCheck;
+  # Build with test support if `doCheck` is enabled.
+  env.ZOTERO_TEST = doCheck;
+
+  nativeCheckInputs = [
+    xvfb-run
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    CI=true xvfb-run test/runtests.sh
+
+    runHook postCheck
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "zotero";
+      exec = "zotero -url %U";
+      icon = "zotero";
+      comment = finalAttrs.meta.description;
+      desktopName = "Zotero";
+      genericName = "Reference Management";
+      categories = [
+        "Office"
+        "Database"
+      ];
+      startupNotify = true;
+      mimeTypes = [
+        "x-scheme-handler/zotero"
+        "text/plain"
+      ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.targetPlatform.isDarwin ''
+    # Copy package contents
+    mkdir -p $out/Applications
+    cp -r app/staging/Zotero.app $out/Applications/
+  ''
+  + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+    # Copy package contents
+    mkdir -p $out/lib/
+    cp -r app/staging/*/. $out/lib/
+
+    # Add binary to bin/
+    mkdir -p $out/bin/
+    ln -s ../lib/zotero $out/bin/zotero
+
+    # Install icons
+    for size in 32 64 128; do
+      install -Dm444 "app/linux/icons/icon''${size}.png" "$out/share/icons/hicolor/''${size}x''${size}/apps/zotero.png"
+    done
+    install -Dm444 "app/linux/icons/symbolic.svg" "$out/share/icons/hicolor/scalable/apps/zotero-symbolic.svg"
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  preFixup = lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+    gappsWrapperArgs+=(--suffix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        libGL
+        pciutils
+      ]
+    })
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://www.zotero.org";
     description = "Collect, organize, cite, and share your research sources";
     mainProgram = "zotero";
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     license = lib.licenses.agpl3Only;
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [
       atila
       justanotherariel
+      mynacol
     ];
   };
-in
-if stdenv.hostPlatform.isDarwin then
-  callPackage ./darwin.nix { inherit pname version meta; }
-else
-  callPackage ./linux.nix { inherit pname version meta; }
+})
diff --git a/pkgs/by-name/zo/zotero/pdf-reader-locales.patch b/pkgs/by-name/zo/zotero/pdf-reader-locales.patch
new file mode 100644
index 000000000000..643ac3388cf1
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/pdf-reader-locales.patch
@@ -0,0 +1,13 @@
+diff --git a/webpack.zotero-locale-plugin.js b/webpack.zotero-locale-plugin.js
+index fb6eb28..e5e040f 100644
+--- a/webpack.zotero-locale-plugin.js
++++ b/webpack.zotero-locale-plugin.js
+@@ -52,7 +52,7 @@ class ZoteroLocalePlugin {
+ 		}
+ 
+ 		// If the commit hash has changed
+-		if (lastCommitHash !== this.commitHash) {
++		if (false) {
+ 			console.log(`Detected commit hash change (was: ${lastCommitHash}, now: ${this.commitHash}). Clearing and downloading locale files...`);
+ 
+ 			// Remove and recreate the output directory
diff --git a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
index 2ca1a95f47c1..8271addfc595 100644
--- a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elementary-dock";
-  version = "8.3.1";
+  version = "8.3.2";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "elementary";
     repo = "dock";
     rev = finalAttrs.version;
-    hash = "sha256-BJkJ6U9fnGSFeY/Z9tcomZ0umRDENxPl0koioUYhFYg=";
+    hash = "sha256-knnr9uKBf27tovucAgAX5N//3t70KtO++Ei/1l74ZFg=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/desktops/pantheon/desktop/gala/default.nix b/pkgs/desktops/pantheon/desktop/gala/default.nix
index 77ede83f3b64..6d1ed151e028 100644
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@@ -26,17 +26,15 @@
   nix-update-script,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gala";
-  version = "8.4.0-unstable-2026-01-06";
+  version = "8.4.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "gala";
-    # Contains crash fixes for mutter 48.
-    # nixpkgs-update: no auto update
-    rev = "8fb60a9c9b04245913733208df1c061d6c353a35";
-    hash = "sha256-GBNrcUAC7UBdyrqoja81bD1oVHjLXWhnDz3gtjMbjII=";
+    tag = finalAttrs.version;
+    hash = "sha256-CBgrHd9euRuOxBR+hut5J1d0S2qZ5hVU3b8pjJuNG7s=";
   };
 
   depsBuildBuild = [ pkg-config ];
@@ -85,4 +83,4 @@ stdenv.mkDerivation {
     teams = [ lib.teams.pantheon ];
     mainProgram = "gala";
   };
-}
+})
diff --git a/pkgs/development/compilers/chicken/5/deps.toml b/pkgs/development/compilers/chicken/5/deps.toml
index 1a258fdc8a27..8652d50b20a4 100644
--- a/pkgs/development/compilers/chicken/5/deps.toml
+++ b/pkgs/development/compilers/chicken/5/deps.toml
@@ -114,9 +114,9 @@ version = "0.6"
 [apropos]
 dependencies = ["utf8", "srfi-1", "symbol-utils", "check-errors"]
 license = "bsd"
-sha256 = "0z546hhrva65kgfm1620w0hg95h016yq2r1mjnx89r0bmmibviv3"
+sha256 = "0l121cy671szi9g4d1shfb6nb4s09m26961lpyw87jcxpw2h76b2"
 synopsis = "CHICKEN apropos"
-version = "3.11.3"
+version = "3.12.2"
 
 [arcadedb]
 dependencies = ["medea"]
@@ -366,9 +366,9 @@ version = "1.0.2"
 [brev-separate]
 dependencies = ["matchable", "miscmacros", "srfi-1", "srfi-69"]
 license = "bsd-1-clause"
-sha256 = "08mczqjyaf5bhm64hnb80r0237mq9w2kj4grn2a8ahzc7870h7jm"
+sha256 = "1ak9n8rdccnkhg8bnin7j4wqqj15wjp7r1mjc7z9627zas9jsj8w"
 synopsis = "Hodge podge of macros and combinators"
-version = "1.98"
+version = "1.99"
 
 [brev]
 dependencies = ["anaphora", "brev-separate", "clojurian", "combinators", "define-options", "dwim-sort", "fix-me-now", "acetone", "html-parser", "match-generics", "http-client", "matchable", "miscmacros", "scsh-process", "sequences", "srfi-1", "srfi-42", "srfi-69", "strse", "sxml-serializer", "sxml-transforms", "sxpath", "tree", "uri-common"]
@@ -497,11 +497,11 @@ synopsis = "Explore Chicken documentation locally"
 version = "0.7.0"
 
 [chicken-update]
-dependencies = ["srfi-1", "srfi-13", "fmt", "sxpath", "http-client", "uri-common", "optimism", "ssax"]
+dependencies = ["srfi-1", "http-client", "uri-common", "getopt-long"]
 license = "public-domain"
-sha256 = "1kbxk93k7p9x2594q4zsya93m7rzpnhixksvdvmiwq42dj72hyid"
+sha256 = "0fk5197x9ap6cax6flspnyszhr5y54g3dglnki7zn2nh03g8pgpg"
 synopsis = "Update installed eggs"
-version = "0.1.6"
+version = "0.1.8"
 
 [cis]
 dependencies = []
@@ -618,9 +618,9 @@ version = "1.0"
 [condition-utils]
 dependencies = ["srfi-1", "srfi-69", "check-errors"]
 license = "bsd"
-sha256 = "09y01vdwi54acwg0nq1vdf10w9w1a0mdmp1fc2vaxh69zfjzxaiq"
+sha256 = "13zz6fp6dswn4pv20hv95m03lk8xnymfnpgjyhp5mwjgnri9jvc4"
 synopsis = "SRFI 12 Condition Utilities"
-version = "2.4.1"
+version = "2.4.2"
 
 [continuations]
 dependencies = []
@@ -667,9 +667,9 @@ version = "1.4"
 [csm]
 dependencies = ["matchable", "srfi-1", "srfi-13", "srfi-14", "miscmacros"]
 license = "bsd"
-sha256 = "02y11q6lgsk4w7qdsz4af3y7lcxk3cl1hy8dycsqfaai6kvjndjg"
+sha256 = "1pa85qy5s2mb6ra7nd2g3f30ylvsg7pzw0m5a2zlwbz27xq231n0"
 synopsis = "a build system"
-version = "0.7"
+version = "0.7.1"
 
 [cst]
 dependencies = ["brev-separate", "srfi-1", "define-options", "match-generics"]
@@ -744,9 +744,9 @@ version = "0.2.0"
 [defstruct]
 dependencies = ["srfi-1"]
 license = "bsd"
-sha256 = "1n8qy9bxlnacdq9gr4z4zjkwqsh9m34ij66qffah5nvqwskcavfy"
+sha256 = "0sm5d7cbdgpb70qy7jc0yxri2wazcxj2q5ii6gcsbpkzjmfd2fka"
 synopsis = "A more convenient form of define-record"
-version = "2.0"
+version = "2.1"
 
 [digraph]
 dependencies = ["dyn-vector", "matchable", "yasos", "srfi-1"]
@@ -790,6 +790,13 @@ sha256 = "13fndcyk4xavn694k1a8kcv3c02a2scxn0z3s56mya2nw4wns88z"
 synopsis = "advisory locking mechanism based on standard file operations"
 version = "0.4"
 
+[dotenv]
+dependencies = ["srfi-13"]
+license = "mit"
+sha256 = "07nlsxmavc1r4hil3361hda3mhlzf6z75r46nsxlyvd779lyydaj"
+synopsis = "A simple .env file loader"
+version = "v1.0.1"
+
 [dotted-lambdas]
 dependencies = []
 license = "bsd"
@@ -821,9 +828,9 @@ version = "2.1"
 [dynamic-import]
 dependencies = []
 license = "public-domain"
-sha256 = "1xb22gv5zip4x32qyssiyxlskxz6l8kp54k7i4x8lv88p0y3ybkp"
+sha256 = "1c877knzlcg9azdjmg1461cq5bczjakk4z0kffwqmwssc14wvprh"
 synopsis = "Dynamic Import"
-version = "1.1.0"
+version = "1.3.2"
 
 [edn]
 dependencies = ["r7rs", "srfi-69", "srfi-1", "chalk"]
@@ -891,9 +898,9 @@ version = "0.2.2"
 [error-utils]
 dependencies = ["srfi-1"]
 license = "bsd"
-sha256 = "0rc32v4l2mn0q92vdksh4nirz7ycvmzszi65ixg7h7s42wrx7x78"
+sha256 = "116d4128wb51lvchkkvcahq1xx22k4xl9az32pfvzvgm34jpgl1w"
 synopsis = "Error Utilities"
-version = "2.1.1"
+version = "2.1.2"
 
 [ersatz]
 dependencies = ["datatype", "silex", "lalr", "utf8", "uri-generic", "srfi-1"]
@@ -926,9 +933,9 @@ version = "1.2"
 [expand-full]
 dependencies = ["srfi-1", "test-utils"]
 license = "bsd"
-sha256 = "1cy595kqrgd1y9xlvcg5wrp74vdh8wx602p8nc1xadx4jxy5dn4q"
+sha256 = "1428r5740mckvkg6hg8ddhcwsm0lpik9igzf3qds89s877aqp6jd"
 synopsis = "Full macro expansion"
-version = "2.2.0"
+version = "2.2.1"
 
 [expat]
 dependencies = ["bind", "silex"]
@@ -982,9 +989,9 @@ version = "0.2.0"
 [filepath]
 dependencies = ["matchable", "srfi-1", "srfi-13", "srfi-14"]
 license = "bsd"
-sha256 = "14mrpq6g4hirj2qsirnxpj4b9b48m8fk80r23wm95wrcir9cjqmr"
+sha256 = "1qn9h1xb9kacbpsp7mnhxv1wbpqc729zxvmn9kn3dnqm58s4kk2m"
 synopsis = "Cross-platform file path manipulation."
-version = "1.6"
+version = "1.7"
 
 [fix-me-now]
 dependencies = ["strse", "srfi-1", "sxml-transforms"]
@@ -1056,6 +1063,13 @@ sha256 = "1ywgjrhkr45837xf5vnb2i3aacby7yjkhm62drdf70c09za860dd"
 synopsis = "Filesystems in Userspace"
 version = "0.1.1"
 
+[futures]
+dependencies = ["srfi-18"]
+license = "bsd"
+sha256 = "0wp5yy588k49xfvghidf023hzdfrpxxklacqr460bxm3hhdh2w4l"
+synopsis = "Concurrent evaluation of expressions"
+version = "2.0.2"
+
 [fx-utils]
 dependencies = []
 license = "bsd"
@@ -1094,16 +1108,16 @@ version = "1.5"
 [genann]
 dependencies = []
 license = "zlib"
-sha256 = "15q4ybxb04y4alkik99dkl5i3brh8dazahgmwjn51xk2s389gba1"
+sha256 = "1x59f0pridbdlx1l3jhjbya17gqb2licqrkpz38kxww5ayali8xs"
 synopsis = "Chicken bindings to genann - a simple neural network library in ANSI C"
-version = "0.2.2"
+version = "0.2.3"
 
 [generalized-arrays]
-dependencies = ["r7rs", "srfi-48", "srfi-128", "srfi-133", "srfi-143", "srfi-160", "srfi-253", "transducers"]
+dependencies = ["r7rs", "srfi-128", "srfi-133", "srfi-143", "srfi-160", "srfi-253", "transducers"]
 license = "bsd-3"
-sha256 = "0yzzy553mawvh270zsrfgj4gyhmxjwz0l85i1h9d3hg8rvm8zsgy"
+sha256 = "0j4spxk36llwxkwdlvb3ljr78v2bd1mknn3pcdw80mh4s2ampapw"
 synopsis = "Provides generalized arrays, intervals, and storage classes for CHICKEN Scheme."
-version = "2.1.1"
+version = "2.2.2"
 
 [generics]
 dependencies = ["simple-cells"]
@@ -1252,6 +1266,13 @@ sha256 = "1p7i8vmh4pg9q0k1ml2n8wbrl7hq8b7x9xgxz5jsb8ywwax74fk4"
 synopsis = "In-source documentation"
 version = "0.10.1"
 
+[hascheme]
+dependencies = ["r7rs"]
+license = "bsd-0-clause"
+sha256 = "0zafgldajj0wrdvw4n6ah7ms5ifql6wq8ighxhsnhqqh9x447s2i"
+synopsis = "Implictly Lazy Scheme embedded into Scheme"
+version = "0.2.0"
+
 [hash-trie]
 dependencies = []
 license = "mit"
@@ -1276,9 +1297,9 @@ version = "0.0.1"
 [henrietta-cache]
 dependencies = ["http-client", "matchable", "srfi-1"]
 license = "bsd"
-sha256 = "1ac3d4bb28cwzbamcz4ak62w4xbh7j15q0445b6c4z06cbfz0bj3"
+sha256 = "15pk51smzimvr2s1wa22q60kkgnxsn2wzlx47s7rshq2rczxb325"
 synopsis = "Fetch and cache extensions from various sources for Henrietta to consume"
-version = "1.7"
+version = "1.8"
 
 [henrietta]
 dependencies = ["regex", "srfi-1"]
@@ -1360,9 +1381,9 @@ version = "2.0"
 [icu]
 dependencies = ["utf8", "srfi-13", "srfi-1", "foreigners", "chalk"]
 license = "unicode"
-sha256 = "1hii4n3mraqaznaiwznwbx06yy99157pxxarkj558zarkn43k82y"
+sha256 = "0ql50rymyzqaglv1q396shmlv1fi6qdgkbx0zdsjjj54j7ivw1ca"
 synopsis = "Chicken bindings to the ICU unicode library"
-version = "0.3.3"
+version = "0.3.4"
 
 [image-dimensions]
 dependencies = ["srfi-1"]
@@ -1437,9 +1458,9 @@ version = "0.4"
 [ipfs]
 dependencies = ["http-client", "intarweb", "medea", "srfi-1", "srfi-13", "srfi-189", "srfi-197", "uri-common"]
 license = "unlicense"
-sha256 = "1qi0z6mgvlmvcjam03n6ly6n35crkfhmjpaz1m8rabl4sh2bx1qd"
+sha256 = "07dknmklg035wr5yqqjnghv162dfdryr87xilrkrwpg88v1wzrs4"
 synopsis = "IPFS HTTP API for Scheme"
-version = "0.0.20"
+version = "0.0.22"
 
 [irc]
 dependencies = ["matchable", "regex", "srfi-1"]
@@ -1542,9 +1563,9 @@ version = "0.3"
 [lay]
 dependencies = []
 license = "bsd"
-sha256 = "16dq7w93yg0m0df76lf506kg30715n932sv3ww4p1fn0b5mn0g27"
+sha256 = "09f0fd9gcv9yrl81vh9bfh1ywda9gljpa48w3vvmya0aknh1x05q"
 synopsis = "Lay eggs efficiently"
-version = "0.3.3"
+version = "0.3.4"
 
 [lazy-ffi]
 dependencies = ["bind", "srfi-1", "srfi-69"]
@@ -1556,9 +1577,9 @@ version = "1.8.6"
 [lazy-seq]
 dependencies = ["srfi-1"]
 license = "bsd"
-sha256 = "12gz8999g73fa20v067gs4v6zs65w8qajwjfsngbcdaqadv2733g"
+sha256 = "0yg2vc6njcf2zfrmd4ija1y9cpcg7sylcmh8iv3xk5sadxws5j5b"
 synopsis = "Clojure-like lazy sequences"
-version = "2"
+version = "3"
 
 [ldif-sexpr]
 dependencies = ["uri-common", "base64", "srfi-1", "srfi-13", "srfi-14", "matchable"]
@@ -1577,9 +1598,9 @@ version = "1.2"
 [levenshtein]
 dependencies = ["srfi-1", "srfi-13", "srfi-63", "srfi-69", "vector-lib", "utf8", "miscmacros", "record-variants", "check-errors"]
 license = "bsd"
-sha256 = "07i97va0ajg1zhbnpc5lyp8qdpa7rhg579y0xhvpp370sa6qrchf"
+sha256 = "16zj9k22fdxs8z9nrgb0x1y3l2gmi6vyzdqf7w2jswdxkb79p0dd"
 synopsis = "Levenshtein edit distance"
-version = "2.4.4"
+version = "2.4.5"
 
 [lexgen]
 dependencies = ["srfi-1", "utf8", "srfi-127"]
@@ -1588,6 +1609,13 @@ sha256 = "1dbvs2g5772w8nvh62rvnsqsmivr76ypkbncbs8l0rx9qi8ir9fn"
 synopsis = "Lexer combinators"
 version = "8.2"
 
+[libyaml]
+dependencies = ["varg"]
+license = "mit"
+sha256 = "1wj0gmry0jj1ni50grkh96a56pc0fgal26djlzk6h0qxb9cb58k1"
+synopsis = "A yaml parser based on libyaml"
+version = "1.0.3"
+
 [linenoise]
 dependencies = []
 license = "bsd"
@@ -1623,6 +1651,13 @@ sha256 = "07g7b9yp9h1r2zgdaqgzm5vpv77x74n34gij1fbw2l57h9r69yk8"
 synopsis = "Inference with Llama2 model."
 version = "1.2"
 
+[llm]
+dependencies = ["medea", "base64", "uri-common", "http-client", "intarweb", "openssl", "srfi-1", "srfi-13", "logger"]
+license = "bsd-3-clause"
+sha256 = "15xf195jkjk1lkn6xkr455h3nkmvllpmwpcsl1b0xd5jdqnwly75"
+synopsis = "Provider-agnostic LLM chat API client with tool calling support"
+version = "0.0.6"
+
 [llrb-syntax]
 dependencies = []
 license = "bsd"
@@ -1665,6 +1700,13 @@ sha256 = "15wpww2qjv87k0j8lqvf4za16y7ip4s2949ax1h9ibfb4g21c11b"
 synopsis = "local declarations inspired by ML"
 version = "1.0.1"
 
+[logger]
+dependencies = ["srfi-1", "medea"]
+license = "bsd-3-clause"
+sha256 = "0k85w08p1b6r2gdrqcrgczc3qpg64rw49ch2i76apzdxl088fijm"
+synopsis = "Simple structured logging with per-module level control"
+version = "0.0.2"
+
 [loop]
 dependencies = ["srfi-1"]
 license = "gpl-2"
@@ -1759,9 +1801,9 @@ version = "1.2"
 [math-utils]
 dependencies = ["memoize", "miscmacros", "srfi-1", "vector-lib"]
 license = "public-domain"
-sha256 = "0dbglbhj9bb1fbhb5ckssalvvpvmqmq71lzifzmpqlpjqra12ql5"
+sha256 = "0k5gb9jmcjyf29icdyf81956x70df15fxmb0rb0vz3ysl5spw49q"
 synopsis = "Miscellaneous math utilities"
-version = "1.12.0"
+version = "1.14.1"
 
 [math]
 dependencies = ["srfi-1", "r6rs-bytevectors", "miscmacros", "srfi-133", "srfi-42"]
@@ -1773,9 +1815,9 @@ version = "0.3.4"
 [mathh]
 dependencies = []
 license = "public-domain"
-sha256 = "1dh0clclb8bh7jl0xk806cz4gc41nzyav9zk4lpiw8pliagwal4m"
+sha256 = "0ir3w0fpfrnkjf5c75zbqac896r45sf7fqfv9v99ksdinqbdqdg2"
 synopsis = "ISO C math functions and constants"
-version = "4.7.1"
+version = "4.7.2"
 
 [matrico]
 dependencies = []
@@ -1869,25 +1911,25 @@ synopsis = "Creating algebraic- and abstract-types based on vectors"
 version = "0.7"
 
 [micro-benchmark]
-dependencies = ["micro-stats", "srfi-1"]
+dependencies = ["micro-stats"]
 license = "gplv3"
-sha256 = "0v1w94p4ijwv6lhnhxb9v3rc2vxa8jy0jfh1qgyv658200q4ja77"
+sha256 = "1jc0s53qhighcvpzfzgsc2fl9h9whri32jgxpb1f7vs92hmhh0ys"
 synopsis = "Easily create micro-benchmarks"
-version = "0.1.0"
+version = "0.3.4"
 
 [micro-stats]
 dependencies = ["srfi-1", "sequences", "sequences-utils"]
 license = "gplv3"
-sha256 = "1l605zjij8xbj55skqr7mbmpfibf7ijzz7q8i320g7iav9z8vjmk"
+sha256 = "1xwf5jqrbsl8xsnp497lzxc8vdabc98za9lmbnwpi2kyaz4ncw3w"
 synopsis = "Easily create micro-stats"
-version = "0.3.0"
+version = "0.4.1"
 
 [mini-kanren]
-dependencies = ["srfi-1"]
+dependencies = []
 license = "mit"
-sha256 = "036i34dzdnpb62951n7qh253q7gzg0rwhjj7nw1c43zn1hb5zw5j"
+sha256 = "147mlnc82vhzxh90rzncbr2z25kp1pplwz5kdffihsb11zx1imgr"
 synopsis = "Packages the canonical miniKanren implementation for CHICKEN Scheme."
-version = "1.2.0"
+version = "1.3.2"
 
 [minissh]
 dependencies = ["tweetnacl", "matchable", "gochan", "base64", "queues", "srfi-13", "srfi-18", "srfi-69", "message-digest-utils", "sha2"]
@@ -1980,6 +2022,13 @@ sha256 = "10ik64k5hi7i78nwnc3q9ms49zvn794n6k3imnjr6hhvi9hxy0vy"
 synopsis = "Reads & decodes HTTP multipart/form-data requests."
 version = "0.2"
 
+[nanograd]
+dependencies = ["test", "srfi-1", "srfi-4", "srfi-42", "srfi-69", "mathh", "vector-lib", "blas", "yasos", "s11n"]
+license = "lgpl-3"
+sha256 = "0dyxfi1qmjzkf3fx0xqx0d4cd8f7pyzfwvmgmg788xbacmcg53jd"
+synopsis = "Minimalistic automatic differentiation framework."
+version = "2.3"
+
 [nanomsg]
 dependencies = ["foreigners", "srfi-18"]
 license = "mit"
@@ -2008,6 +2057,13 @@ sha256 = "1cdkicn3zmb8vcnqwd4rk19ywc7kfj3zsmi2wl6g41b4gdyd3xw8"
 synopsis = "An interface to the UNIX ncurses package"
 version = "2.0"
 
+[nitrate]
+dependencies = ["r7rs", "srfi-225"]
+license = "bsd-0-clause"
+sha256 = "0jf95nh4z4b6rrh337v27d7zvpmzcr3r7731cg41vdnxh5w6sji3"
+synopsis = "Combinator based pattern matching"
+version = "1.0.0"
+
 [noise]
 dependencies = ["glls"]
 license = "bsd"
@@ -2032,9 +2088,9 @@ version = "5.1.0"
 [number-limits]
 dependencies = []
 license = "bsd"
-sha256 = "0cn8ikb474qns94qh2xnpswqljkw6dczrcqlnyf8paj3fiyqqxmj"
+sha256 = "0rr68djpkcw6qc4d0kv6ckiky0psyz1v3d7qqf0ik2m5kv4m6nbz"
 synopsis = "Limit constants for numbers"
-version = "3.0.10"
+version = "3.0.11"
 
 [oauth]
 dependencies = ["srfi-1", "srfi-13", "uri-common", "intarweb", "http-client", "hmac", "sha1", "base64"]
@@ -2046,9 +2102,9 @@ version = "0.3"
 [oauthtoothy]
 dependencies = ["schematra", "openssl", "http-client", "intarweb", "uri-common", "medea", "schematra", "schematra-session"]
 license = "bsd"
-sha256 = "02r2lmf1mqlqji0v4x808gw6hc3lciq860kf51dr9bkn3smcg1j7"
+sha256 = "0i88m3v20w5wjij9m10596aw9a447jhxnl511fkkq6341wvgdgyj"
 synopsis = "Oauth2 support for Schematra"
-version = "0.1.0"
+version = "0.2.3"
 
 [object-evict]
 dependencies = ["srfi-69"]
@@ -2060,9 +2116,9 @@ version = "0.1.1"
 [opencl]
 dependencies = []
 license = "bsd"
-sha256 = "18xbnw47abkxyqm8irlk38qak8m2zmnw3z53ixzck97260hyy03y"
+sha256 = "18pybrrn81dm34abg2g3vacl6bkw6vw1mdxrj2f4z2mhq6342gxl"
 synopsis = "Bindings to OpenCL"
-version = "1.3"
+version = "1.4"
 
 [opengl]
 dependencies = ["bind", "silex"]
@@ -2148,6 +2204,13 @@ sha256 = "1klqq78pcdg2r8simcyjkdjb9664h5cz2indksjdlpj3ma3zb3ax"
 synopsis = "A library for PDF generation."
 version = "1.1"
 
+[phosphate]
+dependencies = ["r7rs", "utf8", "srfi-225"]
+license = "bsd-0-clause"
+sha256 = "1k5r3scv9r5f3bsqm0s0i2i6wqz49q38lrbwhb2v7m6msra7amck"
+synopsis = "Parser combinators with error recovery using call/cc"
+version = "0.1.0"
+
 [pigeon-hole]
 dependencies = ["srfi-18"]
 license = "bsd"
@@ -2214,9 +2277,9 @@ version = "1.4"
 [posix-utils]
 dependencies = ["srfi-1", "utf8", "check-errors"]
 license = "bsd"
-sha256 = "1x5591jxyz31b2d0s5ywp6ywd5ia57nv1pavwf4iizyifs500bm8"
+sha256 = "11vb7g36lk5abxzgbi52jf2vlr13cf2mw7zffralfc7l9kw789qq"
 synopsis = "posix-utils"
-version = "2.1.5"
+version = "2.1.6"
 
 [postgresql]
 dependencies = ["sql-null", "srfi-1", "srfi-13", "srfi-69"]
@@ -2354,16 +2417,16 @@ version = "0.1"
 [qwiki]
 dependencies = ["intarweb", "uri-common", "spiffy", "sxml-transforms", "svn-client", "estraier-client", "sxpath", "simple-sha1", "svnwiki-sxml", "html-parser", "colorize", "srfi-1", "srfi-13", "srfi-14"]
 license = "bsd"
-sha256 = "14m75v6a2bfqag646zx95hqhn6g16dm921klkmj1xvf8f19nf2mb"
+sha256 = "0l60pjyczyglnr3gaqsv5cj0h8rb3syp7l6id9v9dbf5na09akf0"
 synopsis = "qwiki - the quick wiki"
-version = "2.2"
+version = "2.2.1"
 
 [r6rs-bytevectors]
 dependencies = ["utf8"]
 license = "mit"
-sha256 = "1qah1bym1q3ww0fkyqvz048q9brv7ffsz2x3cqpx0cp7yk41by9m"
+sha256 = "1p0ghpcdai93clcbp6yjbrnqz2by7g1xwizm30qanxp8pk5v1fvj"
 synopsis = "An implementation of r6rs bytevectors"
-version = "0.1.7"
+version = "0.1.8"
 
 [r7rs-tools]
 dependencies = ["r7rs", "srfi-1"]
@@ -2393,6 +2456,13 @@ sha256 = "0swkhz2ifg2f5cwpi4njfgjfzvdhr0crkz4w77bnsk4fip86vk6h"
 synopsis = "MT19937 random number generator with Marsaglia and Tang's Ziggurat algorithm to generate random numbers from a non-uniform distribution."
 version = "5.1"
 
+[raylib]
+dependencies = ["foreigners"]
+license = "mit"
+sha256 = "1d9lx18525iya1lmlrfr43vjn40wiyyy819cfpa1a8z7dxz7lhiq"
+synopsis = "Bindings for raylib: A simple and easy-to-use library to enjoy videogames programming"
+version = "1.1.1"
+
 [rb-tree]
 dependencies = ["datatype", "matchable", "yasos", "srfi-1"]
 license = "gpl-3"
@@ -2414,6 +2484,13 @@ sha256 = "1ha392k88389ls5yj08mf7gnnlysy5vzcz30ndiihlcwk2q49sq5"
 synopsis = "Optimized record access"
 version = "1.1"
 
+[record-vector]
+dependencies = ["vector-lib"]
+license = "bsd"
+sha256 = "19h1f4gbsnh1z9393w5as9fgx8zn417c88r5hyy5kq5kqwllngq0"
+synopsis = "The dumb simple inplace data records without type tag."
+version = "1.0.2"
+
 [records]
 dependencies = ["srfi-1"]
 license = "public-domain"
@@ -2513,18 +2590,18 @@ synopsis = "basic Scheme48 module syntax"
 version = "0.7"
 
 [s9fes-char-graphics-shapes]
-dependencies = []
+dependencies = ["srfi-1", "utf8", "record-variants", "s9fes-char-graphics"]
 license = "public-domain"
-sha256 = "18v3gspj8wirkzdy42bc199j4l3s0j0n0751hxli1m3b145agf01"
+sha256 = "177586papy5w6dwcby2yjgkm4aqy1kqq73xp8wf7fa6c0gnbfn00"
 synopsis = "Scheme 9 from Empty Space Char Graphics Shapes"
-version = "1.5.0"
+version = "1.5.2"
 
 [s9fes-char-graphics]
-dependencies = []
+dependencies = ["srfi-1", "utf8", "record-variants"]
 license = "public-domain"
-sha256 = "09fklvrpss4ysgviy9bf1g569c6al93vg374s44prmlmwpcbynfj"
+sha256 = "1av13fh565jh2y3nrfhkj5miqzz1bvhfvg596ilvbihmwpjgxamr"
 synopsis = "Scheme 9 from Empty Space Char Graphics"
-version = "1.19.0"
+version = "1.21.1"
 
 [salmonella-diff]
 dependencies = ["salmonella", "salmonella-html-report", "srfi-1", "srfi-13", "sxml-transforms"]
@@ -2550,9 +2627,9 @@ version = "1.7.2"
 [salmonella]
 dependencies = []
 license = "bsd"
-sha256 = "1hafbvhcscksjwf3s9ch7f2szk24i653zhnnlpcmx9dra6kzp8hj"
+sha256 = "0g7wfap92skmr8hvhj6mx933z1hq0njsy0zg6bavf9w95hk5xj45"
 synopsis = "A tool for testing eggs"
-version = "3.2.0"
+version = "3.2.1"
 
 [salt]
 dependencies = ["datatype", "matchable", "make", "mathh", "lalr", "datatype", "unitconv", "fmt"]
@@ -2599,9 +2676,9 @@ version = "0.1.0"
 [schematra]
 dependencies = ["spiffy", "base64", "nrepl", "srfi-1", "srfi-13", "srfi-18", "srfi-69", "chiccup", "medea"]
 license = "bsd"
-sha256 = "02h3a7jjpl0czymj5qp3fj2ph2qy1a44fl5cp6bm5divmba274js"
+sha256 = "0sdjdswgrh6fq5bf1793w6vnc12a1mn406xbiq1rfypf6xmb6077"
 synopsis = "Schematra is a minimalistic web server built on top of spiffy"
-version = "0.2.3"
+version = "0.4.3"
 
 [scheme-indent]
 dependencies = ["srfi-1"]
@@ -2674,11 +2751,11 @@ synopsis = "Bindings to Simple DirectMedia Layer 2 (SDL2)"
 version = "0.4.1"
 
 [semantic-version]
-dependencies = ["utf8", "srfi-1", "vector-lib", "srfi-69", "srfi-128", "record-variants"]
+dependencies = ["utf8", "srfi-1", "srfi-69", "vector-lib", "record-variants"]
 license = "bsd"
-sha256 = "0xwy5jimqqq7h3sfvvhhs5kb29a9x57k4jcbmkrmsxizb3fqdl18"
+sha256 = "1x8s5znvdsikbrx9z1ys46lm5mavphlvrv9y289z59r7kxncwc7i"
 synopsis = "Semantic Version Utilities"
-version = "0.0.18"
+version = "0.0.22"
 
 [sendfile]
 dependencies = ["memory-mapped-files"]
@@ -3012,9 +3089,9 @@ version = "2.0"
 [sqlite3]
 dependencies = ["srfi-1", "srfi-13", "srfi-18", "srfi-69", "object-evict", "check-errors", "synch", "miscmacros", "matchable", "sql-null"]
 license = "bsd"
-sha256 = "1i9387ph1l7ky30in2v9y8zqc4rqzl0xmzb4hqjpipsxv6haa98s"
+sha256 = "1c68y9g6qph2pb2pzj2ph086x0p92w6a613aq5p8mb5x76j8ykcl"
 synopsis = "Bindings to version 3.x of the SQLite API"
-version = "3.7.2"
+version = "3.7.3"
 
 [sqlite3pth]
 dependencies = ["pthreads", "srfi-34", "llrb-tree", "miscmacros", "srfi-1"]
@@ -3054,9 +3131,9 @@ version = "0.5"
 [srfi-113]
 dependencies = ["r7rs", "srfi-69", "srfi-128"]
 license = "bsd"
-sha256 = "1dwik86f7hi3q5ppvnr38y22hkawknrx9yc2fkvynpkc9xjpdv5k"
+sha256 = "0x653zdkrplc40xmmvn88ljy1qbvqyihsbmfywzzhwc1v8yac0jb"
 synopsis = "SRFI-113: Sets and Bags"
-version = "1.2.1"
+version = "2.0.0"
 
 [srfi-115]
 dependencies = ["srfi-14", "srfi-152"]
@@ -3173,9 +3250,9 @@ version = "1.0.0"
 [srfi-143]
 dependencies = ["r7rs"]
 license = "mit"
-sha256 = "1zfl2mv6ma97yf6p1ql5a3v50brk5b0h61p2dzyz2n2qi81mrfgm"
+sha256 = "0dkg9h3wrqippgigviaq2pf9d1h2wzqan69ya5jv48ai1h5xrpl6"
 synopsis = "SRFI 143: Fixnums"
-version = "1.0.0"
+version = "1.1.0"
 
 [srfi-144]
 dependencies = ["r7rs"]
@@ -3222,9 +3299,9 @@ version = "0.1"
 [srfi-160]
 dependencies = ["srfi-128"]
 license = "mit"
-sha256 = "1zwvc79q46rdb06p3skvqb7v0akgj80z56g8hhbk9qni6hjkq938"
+sha256 = "0ykdv7pg68dakkpgjirlivgy2qkpl03gg2lnl44dbjl5h0bb94lz"
 synopsis = "SRFI 160: Homogeneous numeric vector libraries"
-version = "0.5.3"
+version = "0.5.4"
 
 [srfi-171]
 dependencies = ["r6rs-bytevectors", "vector-lib", "srfi-1", "srfi-69"]
@@ -3257,9 +3334,9 @@ version = "1.0.2"
 [srfi-179]
 dependencies = ["srfi-1", "srfi-133", "srfi-160"]
 license = "mit"
-sha256 = "0y5y6sr0flmhnkfbazihi72hyc3cs067i00c0zcd6jcpr28ki103"
+sha256 = "1lyl21nw9z44k90z8yfy21rqpc9sbs7kdlhpjik2bnmzsspcgd90"
 synopsis = "SRFI-179: Nonempty Intervals and Generalized Arrays (Updated)"
-version = "0.2.3"
+version = "0.3.0"
 
 [srfi-18]
 dependencies = []
@@ -3285,9 +3362,9 @@ version = "1.0.3"
 [srfi-19]
 dependencies = ["srfi-1", "utf8", "srfi-18", "srfi-29", "miscmacros", "locale", "record-variants", "check-errors"]
 license = "bsd"
-sha256 = "05wc234bai2qgszqbpl2s1070ir2xkhq3xwpsyjwg9n1s1022v6z"
+sha256 = "07dbqmj40w2p4jja8jl7icv1i626vv1sm5m8r4iql5g2jaby8n8a"
 synopsis = "Time Data Types and Procedures"
-version = "4.12.1"
+version = "4.13.0"
 
 [srfi-193]
 dependencies = []
@@ -3320,9 +3397,9 @@ version = "1.0.1"
 [srfi-197]
 dependencies = []
 license = "mit"
-sha256 = "19lxc4id9k7hqi1d8fm2mxn32gh18lv35xiash018r6cscz9hh01"
+sha256 = "1ra6y49x3qhcihrs36libdij5is0fflwn7a6npkjlb7qr6732spg"
 synopsis = "SRFI-197: Pipeline Operators"
-version = "0.2.0"
+version = "0.2.1"
 
 [srfi-203]
 dependencies = []
@@ -3411,9 +3488,9 @@ version = "1.0.0"
 [srfi-253]
 dependencies = ["r7rs"]
 license = "mit"
-sha256 = "1b7lrsv5fhl9s3swz0abfx3y2wqrk07n3fwhymg9cz3908cjqms3"
+sha256 = "0lqf45ymbl53c6ysvd2v4kslxxql6i94z18n290nhyvib7g7hgyy"
 synopsis = "SRFI 253: Data (Type-)Checking"
-version = "0.1.0"
+version = "0.2.0"
 
 [srfi-259]
 dependencies = ["r7rs", "integer-map"]
@@ -3474,9 +3551,9 @@ version = "1.5"
 [srfi-41]
 dependencies = ["srfi-1", "record-variants", "check-errors"]
 license = "bsd"
-sha256 = "0nia0iazpkn04hnl4k9m5xlksa9bq85crx07vf76zl8hkw57pjs4"
+sha256 = "0rm6n0gfcrmwpg2cic7c5fgdhbpi05h6zg5p89m048hz8rpnlvvq"
 synopsis = "SRFI 41 (Streams)"
-version = "2.3.2"
+version = "2.3.3"
 
 [srfi-42]
 dependencies = ["srfi-1", "srfi-13"]
@@ -3558,9 +3635,9 @@ version = "0.1"
 [srfi-69-weak]
 dependencies = []
 license = "bsd"
-sha256 = "14kxp8zkxrnc0rxj6sm282bznn4i0a9w86pw0v75g199q7kahhk3"
+sha256 = "1s13jsp0ig4ivgclc7lajcm0qmphcri48rkcz0ilhc3lqj8vs2la"
 synopsis = "SRFI-69/90 hash-table library (w/ weak references)"
-version = "0.8.0"
+version = "1.0.0"
 
 [srfi-69]
 dependencies = []
@@ -3656,9 +3733,9 @@ version = "1.0"
 [statistics]
 dependencies = ["srfi-1", "srfi-25", "srfi-69", "vector-lib", "random-mtzig", "yasos", "compile-file", "srfi-13"]
 license = "gpl-3"
-sha256 = "0s659vg9na72brl1bs336vbv7jxy3blf113mifax7ya5vpvxnl71"
+sha256 = "189ka9kyxc6c1y96m5c1gsppvyv5mnajhkwfiq235hn7h3d6qdmc"
 synopsis = "Statistics library"
-version = "0.13"
+version = "0.14"
 
 [stb-image-resize]
 dependencies = []
@@ -3780,11 +3857,11 @@ synopsis = "The sxpath bits of sxml-tools from the SSAX project at Sourceforge"
 version = "1.0"
 
 [symbol-utils]
-dependencies = ["utf8"]
+dependencies = ["utf8", "srfi-1"]
 license = "bsd"
-sha256 = "1234p97sagl4bn1rgkrvp7xn22m6qrisnnpabmf51a6zn6ffj286"
+sha256 = "0jkgkg0fy40lys2ph03n51nmz5643wxshkjsr34cycjzlwwd5fay"
 synopsis = "Symbol Utilities"
-version = "2.6.2"
+version = "2.8.0"
 
 [synch]
 dependencies = ["srfi-18", "check-errors"]
@@ -3873,9 +3950,9 @@ version = "1.6.1"
 [test]
 dependencies = []
 license = "bsd"
-sha256 = "1l88lb8cnb0i49qvpdj1rnlj06srp5myg0vhs0fv23gzrzjspxh8"
+sha256 = "12136zb4q0p7j9ahsgq97jbxx3q4kqz5fn04ck93b6813vabclvg"
 synopsis = "Yet Another Testing Utility"
-version = "1.2"
+version = "1.3"
 
 [this]
 dependencies = []
@@ -3941,11 +4018,11 @@ synopsis = "tracing and breakpoints"
 version = "2.0"
 
 [transducers]
-dependencies = ["r7rs", "srfi-1", "srfi-128", "srfi-133", "srfi-143", "srfi-146", "srfi-160", "srfi-253"]
+dependencies = ["r7rs", "srfi-128", "srfi-143", "srfi-146", "srfi-160", "srfi-253"]
 license = "mit"
-sha256 = "0fyypwr9syd3iwhwayglff2rg6xsc4w3hcaz4k6ldm2y2f16g7yv"
+sha256 = "00phm1lsc0k3fxcyvfjvdpfjxrcl67djm3794p8bdx7jd3gvhgln"
 synopsis = "Transducers for working with foldable data types."
-version = "0.7.1"
+version = "0.8.0"
 
 [transmission]
 dependencies = ["http-client", "intarweb", "medea", "r7rs", "srfi-1", "srfi-189", "uri-common"]
@@ -3978,9 +4055,9 @@ version = "1.50"
 [trie]
 dependencies = ["srfi-1"]
 license = "bsd"
-sha256 = "1k7hq31px236s25wqfqh22wb4kpm97hl2kcvj4amsyvlxc1y4w96"
+sha256 = "1f7ykc0gjxh2i1ci027gyjm9gdqifpcniplxbd2gvm58sfxq1kmp"
 synopsis = "A trie (prefix tree) implementation"
-version = "2"
+version = "3"
 
 [tweetnacl]
 dependencies = []
@@ -4101,6 +4178,13 @@ sha256 = "0279v7nwwd2zgr9dkpnhpn430lb6byigny3ci0mg30z293iv2fmx"
 synopsis = "A cheeky IRC bot"
 version = "0.15"
 
+[varg]
+dependencies = []
+license = "mit"
+sha256 = "1v9j09q76prls2vq8s6yfrwzvw50fb1mi6id8dp1kc6jfkiqi2qg"
+synopsis = "A template for defining dynamic arguments procedure"
+version = "1.0.2"
+
 [vector-lib]
 dependencies = []
 license = "bsd"
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index 4e0c60b91527..ef48b8c0232c 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -265,6 +265,7 @@ in
         --replace-quiet 'only chicken.base' 'only chicken.base define-values'
     '';
   };
+  raylib = addToBuildInputsWithPkgConfig pkgs.raylib;
   socket = old: {
     # chicken-do checks for changes to a file that doesn't exist
     preBuild = ''
@@ -284,10 +285,10 @@ in
         chickenEggs.foreigners
       ];
     };
-  ephem = broken;
   canvas-draw = broken;
   coops-utils = broken;
   crypt = broken;
+  ephem = addToBuildInputs pkgs.libnova;
   gemini = broken;
   gemini-client = broken;
   hypergiant = broken;
@@ -295,8 +296,13 @@ in
   kiwi = broken;
   lmdb-ht = broken;
   mpi = broken;
+  oauthtoothy = broken;
   pyffi = broken;
   qt-light = broken;
+  schematra-csrf = broken;
+  schematra-session = broken;
+  srfi-174 = broken;
+  srfi-19 = broken;
   sundials = broken;
   svn-client = broken;
   tokyocabinet = broken;
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index 1ce150c481d1..c76700cbd193 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -33,6 +33,7 @@
   harfbuzz,
   icu,
   dbus,
+  expat,
   libdrm,
   zlib,
   minizip,
@@ -231,6 +232,7 @@ qtModule {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     dbus
+    expat
     zlib
     minizip
     snappy
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 3b56d3c9bc39..251fe2886d19 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -84,7 +84,7 @@ in
 # https://webkitgtk.org/2024/10/04/webkitgtk-2.46.html recommends building with clang.
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.50.4";
+  version = "2.50.5";
   name = "webkitgtk-${finalAttrs.version}+abi=${abiVersion}";
 
   outputs = [
@@ -99,7 +99,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-07+kc4Raz6tyY1utpeDRNP2meSxblcXFzRQbRhJb2OQ=";
+    hash = "sha256-hzdjG6w+nHrT5SCPk3DgdsCdnEWzmYACHOVO2tzG+U8=";
   };
 
   patches = lib.optionals clangStdenv.hostPlatform.isLinux [
diff --git a/pkgs/development/lisp-modules/import/main.lisp b/pkgs/development/lisp-modules/import/main.lisp
index 6671b8f22b4f..c131dc6efdb5 100644
--- a/pkgs/development/lisp-modules/import/main.lisp
+++ b/pkgs/development/lisp-modules/import/main.lisp
@@ -49,7 +49,7 @@
           (truename "imported.nix")))
 
 (defun run-nix-formatter ()
-  (uiop:run-program '("nixfmt" "imported.nix")))
+  (uiop:run-program '("treefmt" "imported.nix")))
 
 (defun main ()
   (format t "~%")
diff --git a/pkgs/development/lisp-modules/shell.nix b/pkgs/development/lisp-modules/shell.nix
index 4dd970c30821..02f9f2360828 100644
--- a/pkgs/development/lisp-modules/shell.nix
+++ b/pkgs/development/lisp-modules/shell.nix
@@ -1,10 +1,12 @@
 let
-  pkgs = import ../../../. { };
-  inherit (pkgs) mkShellNoCC sbcl nixfmt;
+  # Use CI-pinned (Hydra-cached) packages and formatter,
+  # rather than the local nixpkgs checkout.
+  inherit (import ../../../ci { }) pkgs fmt;
+  inherit (pkgs) mkShellNoCC sbcl;
 in
 mkShellNoCC {
   packages = [
-    nixfmt
+    fmt.pkg
     (sbcl.withPackages (
       ps:
       builtins.attrValues {
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index ce5fb7f5d6f1..45fb77d95415 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.1.8";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-KX4e14D3oA8OpvoeeM6z/OY6Xtvf7OgxPjJM66DbJlw=";
+    hash = "sha256-iaDhI3LA/kTJqk6ViMlwLsmSpg20EogGskBrinVKpME=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 1e29d3bf73bd..f94c7e9b37bd 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.46";
+  version = "1.42.47";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-o5iSlgn8jNf3vE+xfur2EtcqeoJk7H8YtXnKSY5JLQA=";
+    hash = "sha256-z5q4ALtYYhFiZOWfsBWToldR2BondR0B/DrHkfHYmzE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 7f2740622a3c..f75ed3eac75f 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202602111";
+  version = "0.1.202602121";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gkPU9P3xgQ2jGrxi/Dl+wtbpJjZDGfYLiLZnKXEE3y8=";
+    hash = "sha256-gTsr0CBDBXLI9l2G3ACHdb7HdQoxvNAb5uXYtgB1ZSQ=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/jupyter-docprovider/default.nix b/pkgs/development/python-modules/jupyter-docprovider/default.nix
index 04e2f5a615e7..55eeef745a50 100644
--- a/pkgs/development/python-modules/jupyter-docprovider/default.nix
+++ b/pkgs/development/python-modules/jupyter-docprovider/default.nix
@@ -7,15 +7,15 @@
   jupyter-collaboration,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupyter-docprovider";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_docprovider";
-    inherit version;
-    hash = "sha256-UZwPhBJsb7qWIOUYm+9t8GfX14nRJt69czAapLiN/Qw=";
+    inherit (finalAttrs) version;
+    hash = "sha256-2Ko7XbO5tAHeBRWd+No24th0hebc31l6IOWMkh9wXdo=";
   };
 
   postPatch = ''
@@ -41,4 +41,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index cc88e3f3a3e5..3494a09f8bfb 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mitogen";
-  version = "0.3.40";
+  version = "0.3.41";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yGIXgqngr4hjejCuYaNTArncbs0Pcg1Iia5geujPQhg=";
+    hash = "sha256-ws7MPURrqt5+9bCJeKePjhsHyaj57SqsB3+Juc5YF5M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index f405bdfe0a5a..23856f61d877 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,8 +163,8 @@ in
       "sha256-uKbD5VkYnYO2PKd1Lp9PAg9+5p8X+LisT+N6TsqhZRY=";
 
   mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.42.41"
-      "sha256-IDtmHGtBihawUVZVLgf4+8uB3Jm8OqmLlRrge8zZvFY=";
+    buildMypyBoto3Package "batch" "1.42.47"
+      "sha256-A8fLv0hcx6fofnf807NJ/FjLLDwOAx3BHFG8Cmae53g=";
 
   mypy-boto3-billingconductor =
     buildMypyBoto3Package "billingconductor" "1.42.7"
@@ -443,8 +443,8 @@ in
       "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.45"
-      "sha256-q3YTS3urB2ZNYiVxJLZOR7fwMhKrq6mLyqBESkfEdiY=";
+    buildMypyBoto3Package "ec2" "1.42.47"
+      "sha256-imwY2DYwb94g96whzwn/2Xr18Vsxjmf98RRB8vGmb98=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -467,8 +467,8 @@ in
       "sha256-lNlav7BQkVjbYE9cdnvcdNki9IDo6tTlerD+lt69Rio=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.42.46"
-      "sha256-5PziEDkoUEgUwmaPCWo5N6G3rQ9LRhEqOPCslMKyk78=";
+    buildMypyBoto3Package "eks" "1.42.47"
+      "sha256-40eBd8o+6R4kX2N8MR4NkoqtJ2lKAf/AghJSmfOTlKQ=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -710,8 +710,8 @@ in
       "sha256-XfZloR5nG1xGyAb4D1UsDpH1xc2hKoBCWabS+yc+uO8=";
 
   mypy-boto3-kafkaconnect =
-    buildMypyBoto3Package "kafkaconnect" "1.42.19"
-      "sha256-82y1eElG60knpJhQYQiVa+qv2xi1z+CHjHE8IfGSpkE=";
+    buildMypyBoto3Package "kafkaconnect" "1.42.47"
+      "sha256-61rA7KEkt8Z/rzOEoArxsuspgfIe+NfjqT4yoCmM/3Q=";
 
   mypy-boto3-kendra =
     buildMypyBoto3Package "kendra" "1.42.3"
diff --git a/pkgs/development/python-modules/nrgkick-api/default.nix b/pkgs/development/python-modules/nrgkick-api/default.nix
index c02cbedc3eee..071b8ec2d115 100644
--- a/pkgs/development/python-modules/nrgkick-api/default.nix
+++ b/pkgs/development/python-modules/nrgkick-api/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nrgkick-api";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andijakl";
     repo = "nrgkick-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q9mLX+DjNSyvjJ6hNPZckaHTNNelOsOlOe9XeVqutaU=";
+    hash = "sha256-ZOVSQOjFPVnm3xnkhp+KFC9YbASEfzB05VpSzKcXJiU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/piccolo/default.nix b/pkgs/development/python-modules/piccolo/default.nix
index 7d4558e8e782..d5a4cbe0b7c7 100644
--- a/pkgs/development/python-modules/piccolo/default.nix
+++ b/pkgs/development/python-modules/piccolo/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "piccolo";
-  version = "1.31.0";
+  version = "1.32.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "piccolo-orm";
     repo = "piccolo";
     tag = finalAttrs.version;
-    hash = "sha256-ZREsvxj9fWNwbbO2erUchiXCuaFh9vziWQjdaJBl/QI=";
+    hash = "sha256-RDXrw+z/hFlnpknI+bGBsn8MHLkFbhHms11qu51Kj7k=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydaikin/default.nix b/pkgs/development/python-modules/pydaikin/default.nix
index d07399899db1..073bd963bca6 100644
--- a/pkgs/development/python-modules/pydaikin/default.nix
+++ b/pkgs/development/python-modules/pydaikin/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pydaikin";
-  version = "2.17.1";
+  version = "2.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "fredrike";
     repo = "pydaikin";
     tag = "v${version}";
-    hash = "sha256-GSZJ7Upq43S8AC2U+8qRaPlcht/GndA2jm1mSVfEiaY=";
+    hash = "sha256-JESTwtrDuBydXIzRfbtnvbb4Hsumt1wMRpppU2xdWJQ=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/pytest-mockito/default.nix b/pkgs/development/python-modules/pytest-mockito/default.nix
index 78137669be4b..abb5e1ec9aa9 100644
--- a/pkgs/development/python-modules/pytest-mockito/default.nix
+++ b/pkgs/development/python-modules/pytest-mockito/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-mockito";
-  version = "0.0.5";
+  version = "0.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kaste";
     repo = "pytest-mockito";
     rev = version;
-    hash = "sha256-GX3esFlMtKRCTjvTPS4jrnK/mV9eIENvDXRo5sOqBGc=";
+    hash = "sha256-iXL9INddGWkBTPoR1fvyeRts8JPKoyeqAmaHRBlXq2k=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/wassima/default.nix b/pkgs/development/python-modules/wassima/default.nix
index e5db5328abd6..629297879e9a 100644
--- a/pkgs/development/python-modules/wassima/default.nix
+++ b/pkgs/development/python-modules/wassima/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "wassima";
-  version = "2.0.4";
+  version = "2.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "wassima";
     tag = version;
-    hash = "sha256-6tNmJwnOtl+luN1qgu93LXEfBZ0oieEpLa9Q9N6Gsag=";
+    hash = "sha256-qfsoo+y8lbQomyBRltTsPp/OCPL/f1S0bzW9KwKabuA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/tools/compass/default.nix b/pkgs/development/tools/compass/default.nix
index cbf28b43f425..e09f5e9f3926 100644
--- a/pkgs/development/tools/compass/default.nix
+++ b/pkgs/development/tools/compass/default.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "compass";
-  version = "1.0.3";
 
   inherit ruby;
   gemdir = ./.;
diff --git a/pkgs/development/tools/license_finder/default.nix b/pkgs/development/tools/license_finder/default.nix
index 6eb7fe397a9c..2b3247c504df 100644
--- a/pkgs/development/tools/license_finder/default.nix
+++ b/pkgs/development/tools/license_finder/default.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "license_finder";
-  version = "7.0.1";
 
   inherit ruby;
   gemdir = ./.;
diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index 550f9747a66f..283873a2485f 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -1,7 +1,6 @@
 import ./generic.nix {
   version = "14.21";
-  # rev = "refs/tags/REL_14_21";
-  rev = "eb788b43371849237c61ba2747fc11e96c08d861";
+  rev = "refs/tags/REL_14_21";
   hash = "sha256-9uG32BVzXOL2yAJmFVkIvEZJrmI5ToL7ojtivWmufL8=";
   muslPatches = {
     disable-test-collate-icu-utf8 = {
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index 50877491601d..bb0043b7d2a9 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,7 +1,6 @@
 import ./generic.nix {
   version = "15.16";
-  # rev = "refs/tags/REL_15_16";
-  rev = "78bc85dd4455c302c345c550e0628a1522df108d";
+  rev = "refs/tags/REL_15_16";
   hash = "sha256-ju/KkeBOumYHCarhqNA8jq+ceUo4y8g/SzjAMWm80ak=";
   muslPatches = {
     dont-use-locale-a = {
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index 13ab44599795..56176de6f674 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,7 +1,6 @@
 import ./generic.nix {
   version = "16.12";
-  # rev = "refs/tags/REL_16_12";
-  rev = "e15d96551f9760e62888b5082ad050329c1c4cdf";
+  rev = "refs/tags/REL_16_12";
   hash = "sha256-1jkVElZTtp60Jgl5RyPT+8lalDYtjRDe9MxO3KMYJmU=";
   muslPatches = {
     dont-use-locale-a = {
diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix
index 1c5f4dc98948..b6419a41a48d 100644
--- a/pkgs/servers/sql/postgresql/17.nix
+++ b/pkgs/servers/sql/postgresql/17.nix
@@ -1,7 +1,6 @@
 import ./generic.nix {
   version = "17.8";
-  # rev = "refs/tags/REL_17_8";
-  rev = "6af885119b52a2a6229959670ba3ae5e36bf9806";
+  rev = "refs/tags/REL_17_8";
   hash = "sha256-4lV1/xRmMsc5rgY3RB6WMigTXHgHjh9bmR6nzL82Rs4=";
   muslPatches = {
     dont-use-locale-a = {
diff --git a/pkgs/servers/sql/postgresql/18.nix b/pkgs/servers/sql/postgresql/18.nix
index a5bca108217a..22b652ca1c07 100644
--- a/pkgs/servers/sql/postgresql/18.nix
+++ b/pkgs/servers/sql/postgresql/18.nix
@@ -1,7 +1,6 @@
 import ./generic.nix {
   version = "18.2";
-  # rev = "refs/tags/REL_18_2";
-  rev = "5a461dc4dbf72a1ec281394a76eb36d68cbdd935";
+  rev = "refs/tags/REL_18_2";
   hash = "sha256-cvBXxA7/kEwDGxFv/YoZCIh17jzUujrCtfKAmtSxKTw=";
   muslPatches = {
     dont-use-locale-a = {
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 015c46bc6d9f..123ea0d71b94 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -71,6 +71,8 @@ rec {
     mkPrefetchScript "fossil" ../../../build-support/fetchfossil/nix-prefetch-fossil
       [
         fossil
+        gnugrep
+        gnused
       ];
   nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [
     findutils
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 70ea0a920d1c..319b85c17030 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1807,6 +1807,7 @@ mapAliases {
   sumalibs = throw "'sumalibs' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
   sumatra = throw "'sumatra' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
   sumneko-lua-language-server = throw "'sumneko-lua-language-server' has been renamed to/replaced by 'lua-language-server'"; # Converted to throw 2025-10-27
+  surge-XT = warnAlias "'surge-XT' has been renamed to 'surge-xt'" surge-xt; # Added 2026-02-12
   svt-av1-psy = warnAlias "'svt-av1-psy' has been replaced by 'svt-av1-psyex'" svt-av1-psyex; # Added 2026-01-10
   swig4 = throw "'swig4' has been renamed to/replaced by 'swig'"; # Converted to throw 2025-10-27
   swiProlog = throw "'swiProlog' has been renamed to/replaced by 'swi-prolog'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e78750027eba..ec5a75d2b26a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4295,10 +4295,9 @@ with pkgs;
   ghc =
     targetPackages.haskellPackages.ghc or (
       # Prefer native-bignum to avoid linking issues with gmp;
-      # TemplateHaskell doesn't work with hadrian built GHCs yet
-      # https://github.com/NixOS/nixpkgs/issues/275304
-      if stdenv.targetPlatform.isStatic then
-        haskell.compiler.native-bignum.ghc94
+      # GHC 9.10 doesn't work too well with iserv-proxy.
+      if stdenv.hostPlatform.isStatic then
+        haskell.packages.native-bignum.ghc912
       # JS backend can't use GMP
       else if stdenv.targetPlatform.isGhcjs then
         haskell.compiler.native-bignum.ghc910
@@ -4369,12 +4368,6 @@ with pkgs;
 
   dotnetPackages = recurseIntoAttrs (callPackage ./dotnet-packages.nix { });
 
-  gopro-tool = callPackage ../by-name/go/gopro-tool/package.nix {
-    vlc = vlc.overrideAttrs (old: {
-      buildInputs = old.buildInputs ++ [ x264 ];
-    });
-  };
-
   gwe = callPackage ../tools/misc/gwe {
     nvidia_x11 = linuxPackages.nvidia_x11;
   };
@@ -10978,11 +10971,6 @@ with pkgs;
     syncthing-relay
     ;
 
-  syncthingtray = kdePackages.callPackage ../applications/misc/syncthingtray {
-    # renamed in KF5 -> KF6
-    plasma-framework = kdePackages.libplasma;
-  };
-
   synergyWithoutGUI = synergy.override { withGUI = false; };
 
   tabbed = callPackage ../applications/window-managers/tabbed {
@@ -12615,6 +12603,7 @@ with pkgs;
     nix-prefetch-bzr
     nix-prefetch-cvs
     nix-prefetch-darcs
+    nix-prefetch-fossil
     nix-prefetch-git
     nix-prefetch-hg
     nix-prefetch-pijul