diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 27eaa998856e..1b2d8501a02a 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -97,6 +97,10 @@
 
 - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce`
 
+- `peertube` has been updated from `7.3.0` to `8.0.2`, introducing several breaking changes.
+  Some notable new features include channel collaboration and video player redesign with a new theme.
+  For details on how to upgrade, see the `IMPORTANT NOTES` section of the [v8.0.0 CHANGELOG entry](https://docs.joinpeertube.org/CHANGELOG#v8-0-0).
+
 - `python3Packages.gradio` has been updated to version 6. See upstream's migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.
 
 - `vicinae` has been updated to v0.17. Version 0.17 contains a complete overhaul of the configuration system. For update instructions, see the [release notes for v0.17.0](https://github.com/vicinaehq/vicinae/releases/tag/v0.17.0) and the [upstream configuration documentation](https://docs.vicinae.com/config).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f4f2f8e6b9ff..5882858362d9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -588,6 +588,11 @@
       { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
     ];
   };
+  adam-tj = {
+    github = "adam-tj";
+    githubId = 9314405;
+    name = "Adam Tjörnhammar";
+  };
   adam248 = {
     email = "adamjbutler091@gmail.com";
     github = "adam248";
@@ -1044,7 +1049,7 @@
     keys = [ { fingerprint = "F354 FFAB EA89 A49D 33ED  2590 4729 B829 AC5F CC72"; } ];
   };
   ALameLlama = {
-    email = "NicholasACiechanowski@gmail.com";
+    email = "nicholas@ciech.anow.ski";
     name = "Nicholas Ciechanowski";
     github = "ALameLlama";
     githubId = 55490546;
@@ -1416,6 +1421,12 @@
       { fingerprint = "DF68 C500 4024 23CC F9C5  E6CA 3D17 C832 4696 FE70"; }
     ];
   };
+  alper-han = {
+    email = "contact@zynix.net";
+    github = "alper-han";
+    githubId = 89567766;
+    name = "Zynix";
+  };
   alternateved = {
     email = "alternateved@pm.me";
     github = "alternateved";
@@ -4944,6 +4955,12 @@
     githubId = 136485;
     name = "Chad Jablonski";
   };
+  cjimti = {
+    email = "cj@imti.co";
+    github = "cjimti";
+    githubId = 356698;
+    name = "Craig Johnston";
+  };
   cjshearer = {
     email = "cjshearer@live.com";
     github = "cjshearer";
@@ -7903,6 +7920,7 @@
     email = "eric@eric.dev.br";
     github = "EpicEric";
     githubId = 3129194;
+    matrix = "@epiceric:nixos.dev";
     name = "Eric Rodrigues Pires";
   };
   epireyn = {
@@ -20715,6 +20733,12 @@
     github = "philipwilk";
     githubId = 50517631;
   };
+  philocalyst = {
+    name = "Myles Wirth";
+    email = "milestheperson@posteo.net";
+    github = "philocalyst";
+    githubId = 114884788;
+  };
   philtaken = {
     email = "philipp.herzog@protonmail.com";
     github = "philtaken";
@@ -21697,6 +21721,12 @@
     githubId = 115877;
     name = "Kenny Shen";
   };
+  qrzbing = {
+    email = "qrzbing@foxmail.com";
+    github = "qrzbing";
+    githubId = 23500397;
+    name = "qrzbing";
+  };
   quadradical = {
     email = "nixos@henryhiles.com";
     github = "Henry-Hiles";
@@ -23238,6 +23268,12 @@
     githubId = 12877905;
     name = "Roman Volosatovs";
   };
+  rwxd = {
+    email = "git@rwxd.de";
+    github = "rwxd";
+    githubId = 40308458;
+    name = "rwxd";
+  };
   rxiao = {
     email = "ben.xiao@me.com";
     github = "benxiao";
@@ -24773,6 +24809,14 @@
     githubId = 1505617;
     name = "Sean Lee";
   };
+  sleroq = {
+    name = "Sleroq";
+    email = "sleroq@cum.army";
+    github = "sleroq";
+    matrix = "@sleroq:sleroq.link";
+    githubId = 52239427;
+    keys = [ { fingerprint = "2502 640F 4254 7933 FEF1  7A33 3414 5C1D B76E 618F"; } ];
+  };
   SlothOfAnarchy = {
     email = "slothofanarchy1@gmail.com";
     matrix = "@michel.weitbrecht:helsinki-systems.de";
@@ -27130,12 +27174,6 @@
     githubId = 5623227;
     name = "Quentin Boyer";
   };
-  TredwellGit = {
-    email = "tredwell@tutanota.com";
-    github = "TredwellGit";
-    githubId = 61860346;
-    name = "Tredwell";
-  };
   treemo = {
     email = "matthieu.chevrier@treemo.fr";
     github = "treemo";
@@ -27673,6 +27711,12 @@
     github = "deviant";
     githubId = 68829907;
   };
+  v3rm1n0 = {
+    name = "Niklas Choinowski";
+    email = "niklas.choinowski@proton.me";
+    github = "v3rm1n0";
+    githubId = 57269010;
+  };
   vaavaav = {
     name = "Pedro Peixoto";
     github = "vaavaav";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 2396dcef6fa3..f1aefcb40e28 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.
 
 ## New Modules {#sec-release-26.05-new-modules}
 
@@ -58,6 +58,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
+
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
 
 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
@@ -84,6 +86,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
   - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`.
   - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.
 
+- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
@@ -153,6 +157,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
+
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
 
 - Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
diff --git a/nixos/modules/hardware/hid-fanatecff.nix b/nixos/modules/hardware/hid-fanatecff.nix
new file mode 100644
index 000000000000..b227eff5fb3c
--- /dev/null
+++ b/nixos/modules/hardware/hid-fanatecff.nix
@@ -0,0 +1,19 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.hardware.hid-fanatecff;
+  inherit (config.boot.kernelPackages) hid-fanatecff;
+  inherit (lib) maintainers mkEnableOption mkIf;
+in
+{
+  options.hardware.hid-fanatecff = {
+    enable = mkEnableOption "hid-fanatecff, a Linux kernel driver that aims to add support for Fanatec devices";
+  };
+
+  config = mkIf cfg.enable {
+    boot.extraModulePackages = [ hid-fanatecff ];
+    services.udev.packages = [ hid-fanatecff ];
+  };
+
+  meta.maintainers = with maintainers; [ rake5k ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d6725e526a32..3d8909803867 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -74,6 +74,7 @@
   ./hardware/gpgsmartcards.nix
   ./hardware/graphics.nix
   ./hardware/hackrf.nix
+  ./hardware/hid-fanatecff.nix
   ./hardware/i2c.nix
   ./hardware/infiniband.nix
   ./hardware/inputmodule.nix
@@ -557,6 +558,7 @@
   ./services/desktops/blueman.nix
   ./services/desktops/bonsaid.nix
   ./services/desktops/cpupower-gui.nix
+  ./services/desktops/crossmacro.nix
   ./services/desktops/dleyna.nix
   ./services/desktops/dunst.nix
   ./services/desktops/espanso.nix
diff --git a/nixos/modules/services/desktops/crossmacro.nix b/nixos/modules/services/desktops/crossmacro.nix
new file mode 100644
index 000000000000..e00a06b5bc6b
--- /dev/null
+++ b/nixos/modules/services/desktops/crossmacro.nix
@@ -0,0 +1,119 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.crossmacro;
+in
+{
+  options.services.crossmacro = {
+    enable = lib.mkEnableOption "CrossMacro, a cross-platform mouse and keyboard macro application";
+
+    package = lib.mkPackageOption pkgs "crossmacro" { };
+
+    daemonPackage = lib.mkPackageOption pkgs "crossmacro-daemon" { };
+
+    users = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "alice"
+        "bob"
+      ];
+      description = "List of users granted permission to use CrossMacro.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.users != [ ];
+        message = "CrossMacro: You must specify at least one user. Set `services.crossmacro.users`.";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    hardware.uinput.enable = true;
+
+    services.udev.extraRules = ''
+      KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"
+      ACTION=="add|change", KERNEL=="event*", ATTRS{name}=="CrossMacro Virtual Input Device", ENV{LIBINPUT_ATTR_POINTER_ACCEL}="0"
+    '';
+
+    environment.etc."polkit-1/actions/org.crossmacro.policy".source =
+      "${cfg.daemonPackage}/share/polkit-1/actions/org.crossmacro.policy";
+
+    environment.etc."polkit-1/rules.d/50-crossmacro.rules".source =
+      "${cfg.daemonPackage}/share/polkit-1/rules.d/50-crossmacro.rules";
+
+    users.groups.crossmacro = { };
+
+    users.users =
+      lib.listToAttrs (
+        map (user: {
+          name = user;
+          value = {
+            extraGroups = [ "crossmacro" ];
+          };
+        }) cfg.users
+      )
+      // {
+        crossmacro = {
+          isSystemUser = true;
+          group = "input";
+          extraGroups = [
+            "crossmacro"
+            "uinput"
+          ];
+          description = "CrossMacro Input Daemon User";
+        };
+      };
+
+    systemd.services.crossmacro = {
+      description = "CrossMacro Input Daemon Service";
+      documentation = [ "https://github.com/alper-han/CrossMacro" ];
+
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "dbus.service"
+        "polkit.service"
+      ];
+      wants = [
+        "dbus.service"
+        "polkit.service"
+      ];
+
+      path = [ pkgs.polkit ];
+
+      serviceConfig = {
+        Type = "notify";
+        User = "crossmacro";
+        Group = "input";
+        ExecStart = lib.getExe cfg.daemonPackage;
+        Restart = "always";
+        RestartSec = 5;
+        RuntimeDirectory = "crossmacro";
+        RuntimeDirectoryMode = "0755";
+        CapabilityBoundingSet = [
+          "CAP_SYS_ADMIN"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_DAC_READ_SEARCH"
+        ];
+        AmbientCapabilities = [
+          "CAP_SYS_ADMIN"
+          "CAP_CHOWN"
+          "CAP_DAC_READ_SEARCH"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ alper-han ];
+}
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 00263a368891..edb387fa8bca 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -7,11 +7,22 @@
 let
   cfg = config.services.n8n;
 
-  envVarToCredName = varName: lib.toLower varName;
-
   # Partition environment variables into regular and file-based (_FILE suffix)
-  regularEnv = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) cfg.environment;
-  fileBasedEnv = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) cfg.environment;
+  envVarToCredName = varName: lib.toLower varName;
+  partitionEnv =
+    env:
+    let
+      regular = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) env;
+      fileBased = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) env;
+      fileBasedTransformed = lib.mapAttrs' (
+        varName: _secretPath: lib.nameValuePair varName "%d/${envVarToCredName varName}"
+      ) fileBased;
+    in
+    {
+      inherit regular fileBased fileBasedTransformed;
+    };
+
+  n8nEnv = partitionEnv cfg.environment;
 
   customNodesDir = pkgs.linkFarm "n8n-custom-nodes" (
     map (pkg: {
@@ -19,12 +30,6 @@ let
       path = "${pkg}/lib/node_modules/${pkg.pname}";
     }) cfg.customNodes
   );
-
-  # Transform file-based env vars to point to credentials directory
-  fileBasedEnvTransformed = lib.mapAttrs' (
-    varName: _secretPath: lib.nameValuePair varName "%d/${envVarToCredName varName}"
-  ) fileBasedEnv;
-
 in
 {
   imports = [
@@ -135,14 +140,14 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       environment =
-        regularEnv
+        n8nEnv.regular
         // {
-          HOME = config.services.n8n.environment.N8N_USER_FOLDER;
+          HOME = cfg.environment.N8N_USER_FOLDER;
         }
         // lib.optionalAttrs (cfg.customNodes != [ ]) {
           N8N_CUSTOM_EXTENSIONS = toString customNodesDir;
         }
-        // fileBasedEnvTransformed;
+        // n8nEnv.fileBasedTransformed;
       serviceConfig = {
         Type = "simple";
         ExecStart = lib.getExe cfg.package;
@@ -151,7 +156,7 @@ in
 
         LoadCredential = lib.mapAttrsToList (
           varName: secretPath: "${envVarToCredName varName}:${secretPath}"
-        ) fileBasedEnv;
+        ) n8nEnv.fileBased;
 
         # Basic Hardening
         NoNewPrivileges = "yes";
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index 5c1dd50a30b4..9012d448e33b 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -660,46 +660,66 @@ in
         }
       );
 
-      systemd.services = toHardenedClientAttrs (
-        client:
-        nameValuePair client.service.name (
-          mkIf client.hardened {
-            serviceConfig = {
-              RuntimeDirectoryMode = "0750";
+      systemd.services = mkMerge [
+        # netbird services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair client.service.name (
+            mkIf client.hardened {
+              serviceConfig = {
+                RuntimeDirectoryMode = "0750";
 
-              User = client.user.name;
-              Group = client.user.group;
+                User = client.user.name;
+                Group = client.user.group;
 
-              # settings implied by DynamicUser=true, without actually using it,
-              # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
-              RemoveIPC = true;
-              PrivateTmp = true;
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
+                # settings implied by DynamicUser=true, without actually using it,
+                # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+                RemoveIPC = true;
+                PrivateTmp = true;
+                ProtectSystem = "strict";
+                ProtectHome = "yes";
 
-              AmbientCapabilities = [
-                # see https://man7.org/linux/man-pages/man7/capabilities.7.html
-                # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
-                #
-                # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
-                # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
-                #  see https://github.com/netbirdio/netbird/pull/1513
+                AmbientCapabilities = [
+                  # see https://man7.org/linux/man-pages/man7/capabilities.7.html
+                  # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
+                  #
+                  # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
+                  # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
+                  #  see https://github.com/netbirdio/netbird/pull/1513
 
-                # failed creating tunnel interface wt-priv: [operation not permitted
-                "CAP_NET_ADMIN"
-                # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
-                "CAP_NET_RAW"
-              ]
-              # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
-              ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
-              ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
-              ++ optional (
-                client.dns-resolver.address != null && client.dns-resolver.port < 1024
-              ) "CAP_NET_BIND_SERVICE";
-            };
-          }
-        )
-      );
+                  # failed creating tunnel interface wt-priv: [operation not permitted
+                  "CAP_NET_ADMIN"
+                  # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
+                  "CAP_NET_RAW"
+                ]
+                # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
+                ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
+                ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
+                ++ optional (
+                  client.dns-resolver.address != null && client.dns-resolver.port < 1024
+                ) "CAP_NET_BIND_SERVICE";
+              };
+            }
+          )
+        ))
+        # netbird-login services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair "${client.service.name}-login" (
+            mkIf client.hardened {
+              serviceConfig = {
+                User = client.user.name;
+                Group = client.user.group;
+
+                RemoveIPC = true;
+                PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
+                ProtectSystem = "strict";
+                ProtectHome = "yes";
+              };
+            }
+          )
+        ))
+      ];
 
       # see https://github.com/systemd/systemd/blob/17f3e91e8107b2b29fe25755651b230bbc81a514/src/resolve/org.freedesktop.resolve1.policy#L43-L43
       # see all actions used at https://github.com/netbirdio/netbird/blob/13e7198046a0d73a9cd91bf8e063fafb3d41885c/client/internal/dns/systemd_linux.go#L29-L32
@@ -736,14 +756,6 @@ in
               Type = "oneshot";
               RemainAfterExit = true;
 
-              User = client.user.name;
-              Group = client.user.group;
-
-              RemoveIPC = true;
-              PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
-
               LoadCredential = [ "setup-key:${client.login.setupKeyFile}" ];
             };
 
diff --git a/nixos/modules/services/networking/netbird/dashboard.nix b/nixos/modules/services/networking/netbird/dashboard.nix
index 3cddb34a8ac0..4efe1f4dfba3 100644
--- a/nixos/modules/services/networking/netbird/dashboard.nix
+++ b/nixos/modules/services/networking/netbird/dashboard.nix
@@ -168,13 +168,12 @@ in
       enable = true;
 
       virtualHosts.${cfg.domain} = {
-        locations = {
-          "/" = {
-            root = cfg.finalDrv;
-            tryFiles = "$uri $uri.html $uri/ =404";
-          };
+        root = cfg.finalDrv;
 
-          "/404.html".extraConfig = ''
+        locations = {
+          "/".tryFiles = "$uri $uri.html $uri/ =404";
+
+          "= /404.html".extraConfig = ''
             internal;
           '';
         };
diff --git a/nixos/modules/services/networking/newt.nix b/nixos/modules/services/networking/newt.nix
index 9caa45351958..8b7a8bfa5f84 100644
--- a/nixos/modules/services/networking/newt.nix
+++ b/nixos/modules/services/networking/newt.nix
@@ -21,6 +21,8 @@ let
     // {
       description = "value coercible to CLI argument";
     };
+  format = pkgs.formats.yaml { };
+  blueprint-file = format.generate "blueprint.yml" cfg.blueprint;
 in
 {
   imports = [
@@ -48,13 +50,35 @@ in
         };
         description = "Settings for Newt module, see [Newt CLI docs](https://github.com/fosrl/newt?tab=readme-ov-file#cli-args) for more information.";
       };
+      blueprint = lib.mkOption {
+        inherit (format) type;
+        default = { };
+        example = {
+          proxy-resources = {
+            jellyfin = {
+              name = "Jellyfin";
+              protocol = "http";
+              full-domain = "jfn.example.com";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = 8096;
+                }
+              ];
+              auth.sso-enabled = true;
+            };
+          };
+        };
+        description = "Blueprint for declarative settings, see [Newt Blueprint docs](https://docs.pangolin.net/manage/blueprints#blueprints) for more information.";
+      };
 
       # provide path to file to keep secrets out of the nix store
       environmentFile = lib.mkOption {
         type = with lib.types; nullOr path;
         default = null;
         description = ''
-          Path to a file containing sensitive environment variables for Newt. See <https://docs.fossorial.io/Newt/overview#cli-args>
+          Path to a file containing sensitive environment variables for Newt. See [Client credentials](https://docs.pangolin.net/manage/clients/credentials) for more information.
           These will overwrite anything defined in the config.
           The file should contain environment-variable assignments like:
           NEWT_ID=2ix2t8xk22ubpfy
@@ -81,9 +105,10 @@ in
       environment = {
         HOME = "/var/lib/private/newt";
       };
-      # the flag values will all be overwritten if also defined in the env file
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toCommandLineShellGNU { } cfg.settings}";
+        ExecStart = "${lib.getExe cfg.package} ${
+          lib.cli.toCommandLineShellGNU { } (lib.recursiveUpdate cfg.settings { inherit blueprint-file; })
+        }";
         DynamicUser = true;
         StateDirectory = "newt";
         StateDirectoryMode = "0700";
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index a76a642805bc..06638993e3de 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -16,13 +16,20 @@ let
 
   configFile = pkgs.writeText "chrony.conf" ''
     ${lib.concatMapStringsSep "\n" (
-      server: "server " + server + " " + cfg.serverOption + lib.optionalString (cfg.enableNTS) " nts"
+      server:
+      (if lib.strings.hasInfix "pool" server then "pool " else "server ")
+      + server
+      + " "
+      + cfg.serverOption
+      + lib.optionalString (cfg.enableNTS) " nts"
     ) cfg.servers}
 
     ${lib.optionalString (
       cfg.initstepslew.enabled && (cfg.servers != [ ])
     ) "initstepslew ${toString cfg.initstepslew.threshold} ${lib.concatStringsSep " " cfg.servers}"}
 
+    ${lib.optionalString cfg.makestep.enable "makestep ${toString cfg.makestep.threshold} ${toString cfg.makestep.limit}"}
+
     driftfile ${driftFile}
     keyfile ${keyFile}
     ${lib.optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
@@ -43,6 +50,20 @@ let
   ]
   ++ lib.optional cfg.enableMemoryLocking "-m"
   ++ cfg.extraFlags;
+
+  dispathcerScriptFile = pkgs.callPackage (
+    {
+      runCommand,
+      srcOnly,
+    }:
+    runCommand "10-chrony-onoffline" { } ''
+      cp ${srcOnly chronyPkg}/examples/chrony.nm-dispatcher.onoffline $out
+      substituteInPlace $out \
+        --replace-fail '/usr/bin/chronyc' '${chronyPkg}/bin/chronyc'
+      chmod +x $out
+      patchShebangs $out
+    ''
+  ) { };
 in
 {
   options = {
@@ -134,8 +155,9 @@ in
       initstepslew = {
         enabled = lib.mkOption {
           type = lib.types.bool;
-          default = true;
+          default = false;
           description = ''
+            DEPRECATED. Consider using `services.chrony.makestep` instead.
             Allow chronyd to make a rapid measurement of the system clock error
             at boot time, and to correct the system clock by stepping before
             normal operation begins.
@@ -153,12 +175,51 @@ in
         };
       };
 
+      makestep = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = ''
+            Allow chronyd to step the system clock if the error is larger than
+            the specified threshold.
+          '';
+        };
+
+        threshold = lib.mkOption {
+          type = lib.types.either lib.types.float lib.types.int;
+          default = 0.1;
+          description = ''
+            The threshold of system clock error (in seconds) above which the
+            clock will be stepped. If the correction required is less than the
+            threshold, a slew is used instead.
+          '';
+        };
+
+        limit = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 3;
+          description = ''
+            The maximum number of times the system clock will be stepped.
+          '';
+        };
+      };
+
       directory = lib.mkOption {
         type = lib.types.str;
         default = "/var/lib/chrony";
         description = "Directory where chrony state is stored.";
       };
 
+      dispatcherScript = lib.mkOption {
+        type = lib.types.bool;
+        default = config.networking.networkmanager.enable;
+        defaultText = lib.literalExpression "config.networking.networkmanager.enable";
+        description = ''
+          Whether to install the chrony NetworkManager dispatcher script
+          to handle connectivity changes.
+        '';
+      };
+
       extraConfig = lib.mkOption {
         type = lib.types.lines;
         default = "";
@@ -194,6 +255,13 @@ in
       home = stateDir;
     };
 
+    networking.networkmanager.dispatcherScripts = lib.mkIf cfg.dispatcherScript [
+      {
+        type = "basic";
+        source = dispathcerScriptFile;
+      }
+    ];
+
     services.timesyncd.enable = lib.mkForce false;
 
     # If chrony controls and tracks the RTC, writing it externally causes clock error.
diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix
index 658a356cc51c..a691bd03a77c 100644
--- a/nixos/modules/services/security/oauth2-proxy.nix
+++ b/nixos/modules/services/security/oauth2-proxy.nix
@@ -46,7 +46,7 @@ let
       approval-prompt = approvalPrompt;
       basic-auth-password = basicAuthPassword;
       client-id = clientID;
-      client-secret = clientSecret;
+      client-secret-file = if clientSecretFile != null then "%d/client-secret" else null;
       custom-templates-dir = customTemplatesDir;
       email-domain = email.domains;
       http-address = httpAddress;
@@ -71,9 +71,9 @@ let
           secure
           expire
           name
-          secret
           refresh
           ;
+        secret-file = if cookie.secretFile != null then "%d/cookie-secret" else null;
         httponly = cookie.httpOnly;
       };
       set-xauthrequest = setXauthrequest;
@@ -159,6 +159,7 @@ in
 
     clientID = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
+      default = null;
       description = ''
         The OAuth Client ID.
       '';
@@ -174,11 +175,13 @@ in
       example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
     };
 
-    clientSecret = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+    clientSecretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        The OAuth Client Secret.
+        The path to a file containing the OAuth Client Secret.
       '';
+      example = "/run/keys/oauth2-client-secret";
     };
 
     skipAuthRegexes = lib.mkOption {
@@ -423,11 +426,13 @@ in
         example = "168h0m0s";
       };
 
-      secret = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      secretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = ''
-          The seed string for secure cookies.
+          The path to a file containing the seed string for secure cookies.
         '';
+        example = "/run/keys/oauth2-cookie-secret";
       };
 
       secure = lib.mkOption {
@@ -595,14 +600,23 @@ in
 
   imports = [
     (lib.mkRenamedOptionModule [ "services" "oauth2_proxy" ] [ "services" "oauth2-proxy" ])
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "clientSecret" ] ''
+      This option has been removed as it made the client secret world-readable.
+      Use services.oauth2-proxy.clientSecretFile instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "cookie" "secret" ] ''
+      This option has been removed as it made the cookie secret world-readable.
+      Use services.oauth2-proxy.cookie.secretFile instead.
+    '')
   ];
 
   config = lib.mkIf cfg.enable {
-    services.oauth2-proxy = lib.mkIf (cfg.keyFile != null) {
-      clientID = lib.mkDefault null;
-      clientSecret = lib.mkDefault null;
-      cookie.secret = lib.mkDefault null;
-    };
+    assertions = [
+      {
+        assertion = cfg.clientID != null || cfg.keyFile != null;
+        message = "Either services.oauth2-proxy.clientID or services.oauth2-proxy.keyFile must be specified.";
+      }
+    ];
 
     users.users.oauth2-proxy = {
       description = "OAuth2 Proxy";
@@ -633,6 +647,9 @@ in
           Restart = "always";
           ExecStart = "${lib.getExe cfg.package} ${configString}";
           EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
+          LoadCredential =
+            lib.optional (cfg.clientSecretFile != null) "client-secret:${cfg.clientSecretFile}"
+            ++ lib.optional (cfg.cookie.secretFile != null) "cookie-secret:${cfg.cookie.secretFile}";
         };
       };
   };
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index 4ea87ca5372b..565f4a37c744 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -735,7 +735,7 @@ in
 
         echo "exit( \$this->getPrimaryDB()->tableExists( 'user' ) ? 1 : 0 );" | \
         ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/run.php eval --conf ${mediawikiConfig} && \
-        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/run.php ${pkg}/share/mediawiki/maintenance/install.php \
           --confpath /tmp \
           --scriptpath / \
           --dbserver ${lib.escapeShellArg dbAddr} \
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index 362f6ff32b10..481773991206 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -242,9 +242,6 @@ in
           }
         ];
 
-        # Bcachefs upstream recommends using the latest kernel
-        boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
-
         # needed for systemd-remount-fs
         system.fsPackages = [ cfg.package ];
         services.udev.packages = [ cfg.package ];
diff --git a/nixos/tests/kmscon.nix b/nixos/tests/kmscon.nix
index 0eb7e941bd84..28f2cdd1c3d3 100644
--- a/nixos/tests/kmscon.nix
+++ b/nixos/tests/kmscon.nix
@@ -29,8 +29,7 @@
   enableOCR = true;
 
   testScript = ''
-    machine.succeed(":")
-    # ^ this create a screen
+    machine.wait_for_unit("multi-user.target")
 
     with subtest("ensure we can open a tty"):
       machine.wait_for_text("machine login:")
@@ -38,6 +37,8 @@
       machine.wait_for_text("Password:")
       machine.send_chars("foobar\n")
       machine.wait_for_text("alice@machine")
+      machine.send_chars("echo $TERM\n")
+      machine.wait_for_text("xterm-256color")
       machine.screenshot("tty.png")
   '';
 }
diff --git a/nixos/tests/wine.nix b/nixos/tests/wine.nix
index 321469f72e68..ebf374750a83 100644
--- a/nixos/tests/wine.nix
+++ b/nixos/tests/wine.nix
@@ -68,21 +68,12 @@ listToAttrs (
   map (makeWineTest "winePackages" [ hello32 ]) variants
   ++ optionals pkgs.stdenv.hostPlatform.is64bit (
     map
-      (makeWineTest "wineWowPackages" [
+      (makeWineTest "wineWow64Packages" [
         hello32
         hello64
       ])
       # This wayland combination times out after spending many hours.
       # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
       (pkgs.lib.remove "wayland" variants)
-    ++
-      map
-        (makeWineTest "wineWow64Packages" [
-          hello32
-          hello64
-        ])
-        # This wayland combination times out after spending many hours.
-        # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
-        (pkgs.lib.remove "wayland" variants)
   )
 )
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
index 64fc91df1753..709db67cc413 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
@@ -10,13 +10,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.16.3";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-nIDjE5hf5kt3diEFgUEBz4dCxHatCYtdHY5Zc4YlHFg=";
+    hash = "sha256-l8bP8NNCoE7SLRMRh+Nq5OxUD+xdJ2qYyWbA140aFV0=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 95edf0d6a43c..f9c2b3006210 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.34";
-    hash = "sha256-qCvgb2fs0t3hlI36egvlZYem8CzUKIAipaEZOumDtWk=";
+    version = "2.1.37";
+    hash = "sha256-Lc3TNj74BW/M1sK+bz/xw4L5B6KKBUh2uzXckScwPr8=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ddbd0672dbb1..661f4d812946 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1268,8 +1268,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.49.0";
-          hash = "sha256-eyH5zPLhDjEEVom1nDUo9rSh/O3QtjcFIMcp/XuibFE=";
+          version = "3.50.0";
+          hash = "sha256-+EQP1QfI6W6wcIFKgr7B4gzZn6XamageDbGs5I/Iu1Q=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";
@@ -2344,8 +2344,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.30.0";
-          hash = "sha256-cN+NWHkl21ibvW743ST4kFmxGwfc6ZyNWPOyIRjFEwU=";
+          version = "7.31.1";
+          hash = "sha256-phVmMpcg3t08IeUgEOzdFPhW9Z/4XjbzmM9j17ra+uo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -2611,8 +2611,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.176.2";
-          hash = "sha256-vhdEGbIBMLTci803O+3ALDgCG2VmhjFmhcDy4rsa+BI=";
+          version = "1.180.2";
+          hash = "sha256-4F4xZrB13+jAt/LhYigLygZoGZqQPfs8LJJzRqMUFaQ=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -3413,8 +3413,8 @@ let
         mktplcRef = {
           name = "remote-containers";
           publisher = "ms-vscode-remote";
-          version = "0.437.0";
-          hash = "sha256-shEBOvwJokLOXIr4oEsSsvsxQ2WAThjlLJ4dCSfONgI=";
+          version = "0.442.0";
+          hash = "sha256-oTWYOwEfC8o2eB5G2BeNDRmgaMA26E3pZ4GbPH86rWc=";
         };
         meta = {
           description = "Open any folder or repository inside a Docker container";
@@ -3568,8 +3568,8 @@ let
         mktplcRef = {
           name = "vscode-just-syntax";
           publisher = "nefrob";
-          version = "0.8.0";
-          hash = "sha256-zuDfIxhiUKRpVRxp9BceW6WPBq5NNCuS1Si0/6kfqF8=";
+          version = "0.9.0";
+          hash = "sha256-+9OZ8sRYK9D/JiI+cR1BajqrmLqnOYvrwTIfOaPnoq4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/nefrob.vscode-just-syntax/changelog";
@@ -4470,8 +4470,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "2.0.1";
-          hash = "sha256-TYUDm+i7Chuybbx91AUxH/oIyZYWpZ5XnYxjhjXGP88=";
+          version = "2.0.2";
+          hash = "sha256-nJYy7HFycKXTQCHgaLP46CGl0hlgaexL1QZ8icGpeVo=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
@@ -4509,8 +4509,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "109.12.1";
-          hash = "sha256-0KotF1HGrM9BkImYAfSHGvAeUCZMRnveIBldjhxUUuY=";
+          version = "109.13.0";
+          hash = "sha256-8eHnAuQArNTOxewNWcPJRekXUyYGc6LnR66rHe5j9u0=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -4629,8 +4629,8 @@ let
         mktplcRef = {
           name = "ayu";
           publisher = "teabyii";
-          version = "1.1.7";
-          sha256 = "sha256-b83c4/63XHNmjUMrPCgpBhn2XA2tBcfPh5izfNS45gI=";
+          version = "1.1.8";
+          sha256 = "sha256-md6G6Zf9E8oVyBvDQZfu9jTO6ZseNM+xJ/kx9efkuHA=";
         };
         meta = {
           description = "Simple theme with bright colors and comes in three versions — dark, light and mirage for all day long comfortable work";
diff --git a/pkgs/applications/editors/vscode/extensions/joshmu.periscope/default.nix b/pkgs/applications/editors/vscode/extensions/joshmu.periscope/default.nix
index d86d2c6c259f..67f0deb6bb02 100644
--- a/pkgs/applications/editors/vscode/extensions/joshmu.periscope/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/joshmu.periscope/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "periscope";
     publisher = "joshmu";
-    version = "1.15.1";
-    hash = "sha256-Ssa3qoookSa/JnmZl1AmlT48exAgd6pbwdzzsmTcEqs=";
+    version = "1.16.1";
+    hash = "sha256-gYfsY5ZwB4vTDplWW49o9EZITY74CfM1FOrCxJ7+g6U=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/joshmu.periscope/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
index 9abd54a7691d..e3423c6ed5af 100644
--- a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1769991964";
-    hash = "sha256-RlACEEbRZjeM1JUgAxfMlwFIo8CmrJxr1DVq1XxRdoM=";
+    version = "0.0.1770596843";
+    hash = "sha256-FLajygfJM+EPOXSU7g5I7Yo1YU7zYvTuw2cfY3B17BE=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/with-extensions.nix b/pkgs/applications/editors/vscode/with-extensions.nix
index 5097d177d624..c5794101e123 100644
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@@ -73,6 +73,8 @@ in
 
 runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}"
   {
+    pname = wrappedPkgName;
+    version = wrappedPkgVersion;
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ vscode ];
     dontPatchELF = true;
diff --git a/pkgs/applications/emulators/libretro/cores/fbneo.nix b/pkgs/applications/emulators/libretro/cores/fbneo.nix
index 23a64f05159e..3196325c3b35 100644
--- a/pkgs/applications/emulators/libretro/cores/fbneo.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-01-18";
+  version = "0-unstable-2026-02-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "3faea4f9c678bad8063f3a2774b051f42848c856";
-    hash = "sha256-tH9XMBfg3O2oKIUeKWi2hl4yQuHa9BMgvkWjIxv/KIo=";
+    rev = "e21e3f3c40eb4422b93b8984ef46fe04cdaee9db";
+    hash = "sha256-7hZ2TJwHtgyHd+CZahazXZnKhfNpWZqfev9jtTHlmag=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mame.nix b/pkgs/applications/emulators/libretro/cores/mame.nix
index bfdf1a04af22..185853f4e8d9 100644
--- a/pkgs/applications/emulators/libretro/cores/mame.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame.nix
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-01-01";
+  version = "0-unstable-2026-01-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "b207f9c6fc93b9d21417a9e4424607840c71db6b";
-    hash = "sha256-n9vDYSzij01rRgUc8l763FCLXsFGHIsZxAIZ+N8IBGo=";
+    rev = "6cdc40fc53ba5574073d4009b531fda07156ff49";
+    hash = "sha256-4XmQsVuieIEcLTP1CJfNrJjXD2ENkh4MPLkTVjrx8dE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/wine/packages.nix b/pkgs/applications/emulators/wine/packages.nix
index db91a073baec..af9082a7d8f9 100644
--- a/pkgs/applications/emulators/wine/packages.nix
+++ b/pkgs/applications/emulators/wine/packages.nix
@@ -77,7 +77,7 @@ in
       "x86_64-linux"
       "x86_64-darwin"
     ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
   };
   wineWow = callPackage ./base.nix {
     pname = "wine-wow";
@@ -112,7 +112,7 @@ in
       ];
     };
     platforms = [ "x86_64-linux" ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
   };
   wineWow64 = callPackage ./base.nix {
     pname = "wine-wow64";
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 223fdba8014c..698b386300db 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -97,9 +97,9 @@ in
 rec {
 
   stable = fetchurl rec {
-    version = "10.0";
-    url = "https://dl.winehq.org/wine/source/10.0/wine-${version}.tar.xz";
-    hash = "sha256-xeCz9ffvr7MOnNTZxiS4XFgxcdM1SdkzzTQC80GsNgE=";
+    version = "11.0";
+    url = "https://dl.winehq.org/wine/source/11.0/wine-${version}.tar.xz";
+    hash = "sha256-wHpoV5M8H8YN/1RI1585ySSBwenbWqYo250DWERuBwE=";
 
     ## see http://wiki.winehq.org/Gecko
     gecko32 = fetchurl rec {
@@ -115,17 +115,15 @@ rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "8.1.0";
+      version = "10.0.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-DtPsUzrvebLzEhVZMc97EIAAmsDFtMK8/rZ4rJSOCBA=";
+      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
     };
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
-    ]
-    ++ patches-binutils-2_44-fix-wine-older-than-10_2
-    ++ patches-add-truncf-to-the-import-library;
+    ];
 
     updateScript = writeShellScript "update-wine-stable" ''
       ${updateScriptPreamble}
@@ -144,9 +142,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.20";
-    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-gbShU5WPYkf+UEHV32Xq3Lvuoba6jNok6349fOLR/jw=";
+    version = "11.1";
+    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
+    hash = "sha256-v0x8j7XYwfZW8wor6pOHDIXxP/gxGrL2Hd75AOsoy48=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -156,7 +154,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-Ys0VNYj568qMHq56ZCprnsbpb/iqtiDlU3w0er8Ol5g=";
+      hash = "sha256-KBiESkLVEEWyUPzv1I7j8U9zjqfYdF+FL6wRCcIE290=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
index 57ec5f09526e..5a6e87f2d807 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "helm-cm-push";
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "chartmuseum";
     repo = "helm-push";
     rev = "v${version}";
-    hash = "sha256-YnhI1/BDk9swr3YFm5ajGf4LLgPty7blA2tlsMH0erY=";
+    hash = "sha256-0HskUSj1+5YZMLb0OMMhkNfN7J36GzE5Rdd9uLTO1Ys=";
   };
 
-  vendorHash = "sha256-7bUDKqkvBV1Upcrj4DQnVCP74QtKlSwF0Kl2sPFZpjc=";
+  vendorHash = "sha256-W7nWiWCLrzevunxYoDAqVbG5LhG+VXCAeI1D78fQQvw=";
 
   subPackage = [ "cmd/helm-cm-push" ];
 
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 2b9d5dbd54c8..2be03398c65d 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -12,51 +12,15 @@ let
   extraArgs = removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_32 = common (
-    (import ./1_32/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "32"
-      ];
-    }
-  ) extraArgs;
+  k3s_1_32 = common (import ./1_32/versions.nix) extraArgs;
 
-  k3s_1_33 = common (
-    (import ./1_33/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "33"
-      ];
-    }
-  ) extraArgs;
+  k3s_1_33 = common (import ./1_33/versions.nix) extraArgs;
 
-  k3s_1_34 =
-    (common (
-      (import ./1_34/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "34"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        patches = [ ./go_runc_require.patch ];
-      };
+  k3s_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
+    patches = [ ./go_runc_require.patch ];
+  };
 
-  k3s_1_35 =
-    (common (
-      (import ./1_35/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "35"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        patches = [ ./go_runc_require.patch ];
-      };
+  k3s_1_35 = (common (import ./1_35/versions.nix) extraArgs).overrideAttrs {
+    patches = [ ./go_runc_require.patch ];
+  };
 }
diff --git a/pkgs/applications/networking/cluster/rke2/README.md b/pkgs/applications/networking/cluster/rke2/README.md
index 7835ef3fc77b..1b89b740d370 100644
--- a/pkgs/applications/networking/cluster/rke2/README.md
+++ b/pkgs/applications/networking/cluster/rke2/README.md
@@ -108,19 +108,9 @@ respective package block.
 
 ```nix
 {
-  rke2_1_34 =
-    (common (
-      (import ./1_34/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "34"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        meta.knownVulnerabilities = [ "rke2_1_34 has reached end-of-life on 2026-10-27" ];
-      };
+  rke2_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
+    meta.knownVulnerabilities = [ "rke2_1_34 has reached end-of-life on 2026-10-27" ];
+  };
 }
 ```
 
diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index e8afde0a7bb5..68fe28b50075 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -4,7 +4,7 @@ lib:
   rke2Commit,
   rke2TarballHash,
   rke2VendorHash,
-  updateScript,
+  updateScript ? null,
   k8sImageTag,
   etcdVersion,
   pauseVersion,
diff --git a/pkgs/applications/networking/cluster/rke2/default.nix b/pkgs/applications/networking/cluster/rke2/default.nix
index 440b2d0c2453..5b3f1ceac55f 100644
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@@ -5,45 +5,13 @@ let
   extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_32 = common (
-    (import ./1_32/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "32"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_32 = common (import ./1_32/versions.nix) extraArgs;
 
-  rke2_1_33 = common (
-    (import ./1_33/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "33"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;
 
-  rke2_1_34 = common (
-    (import ./1_34/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "34"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;
 
-  rke2_1_35 = common (
-    (import ./1_35/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "35"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_35 = common (import ./1_35/versions.nix) extraArgs;
 
   # Automatically set by update script, changes shouldn't be backported
   rke2_stable = rke2_1_34;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index eed80d2a358d..d70d5e0255e2 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-0THQNO2odOAeRKwi9NpQnq52YwgdYATAchAM5iw55C8=",
+    "hash": "sha256-UDcyYXo4K7tlr5appmzgZh1V+wX3WuaC6YEWXx5Pk8Y=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.22.18",
+    "rev": "v1.22.19",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -887,13 +887,13 @@
     "vendorHash": "sha256-0Z2V8CyIZEHZFFqTNFnseBbvVenOnpNz9Tlbu7zaPOI="
   },
   "maxlaverse_bitwarden": {
-    "hash": "sha256-9HSxaU+/1HaN4mmi9JnKuTwP/HLCh72zcKecTAQJQpM=",
+    "hash": "sha256-n1d2n6CX8iV/bRqQSaivRxMAYKA/ctfWPQaFgS7ETgE=",
     "homepage": "https://registry.terraform.io/providers/maxlaverse/bitwarden",
     "owner": "maxlaverse",
     "repo": "terraform-provider-bitwarden",
-    "rev": "v0.17.1",
+    "rev": "v0.17.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vDvGIiUIMjMAz9ST/Qjo7aurkB9RIVeevSUkQ8eJ9tk="
+    "vendorHash": "sha256-2IlD9IdiN+TBk/Eng2K4jZD8GB91IvQPeVAKhxI/6aY="
   },
   "metio_migadu": {
     "hash": "sha256-rAf+q/zNANhW8cFSJR3TtA0yYqiG5mjCStyBFG0U3tg=",
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-gzjvdAuT3HDMRULa+b2u75zqei4x1ylj3NGyHh4qa+U=",
+    "hash": "sha256-2uSMK9GvqCdIPjr/PI4FlOM5qXhPsEY6dnY3S795/vg=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v7.32.0",
+    "rev": "v8.0.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1283,13 +1283,13 @@
     "vendorHash": "sha256-rWiafaFE1RolO9JUN1WoW4EWJjR7kpfeVEOTLf21j50="
   },
   "tailscale_tailscale": {
-    "hash": "sha256-G8vSPFGtx9klRCW8Rab8UHR1AK1Kt421WMsCE0pohR0=",
+    "hash": "sha256-hw8psXRFtFkBF3x1gj/72bxcnFkuZ5RYXENNeiWB7gc=",
     "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
     "owner": "tailscale",
     "repo": "terraform-provider-tailscale",
-    "rev": "v0.25.0",
+    "rev": "v0.26.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-UWdPgXvJ68xRUNbAhBQ2SjGkerRlwNUjMA8Yu9EAowo="
+    "vendorHash": "sha256-gc8JCbYzA0nz0JBSNBSZsK0VLTAPmXRhXW2MZiadC90="
   },
   "telmate_proxmox": {
     "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/sources.json b/pkgs/applications/networking/instant-messengers/discord/sources.json
index 13ce48003d48..12485beef652 100644
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,8 +1,8 @@
 {
   "linux-canary": {
-    "hash": "sha256-HtcgQS8P5R57qV3pKYyVLcT9FCOtZ6UbFBQWFkvU8B0=",
-    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.854/discord-canary-0.0.854.tar.gz",
-    "version": "0.0.854"
+    "hash": "sha256-kjIrLBHbCvDEi/lyJadyaqR/5z77u5CvOekbptJZnxY=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.862/discord-canary-0.0.862.tar.gz",
+    "version": "0.0.862"
   },
   "linux-development": {
     "hash": "sha256-EVkjWoqWl9Z+iHCLPOLu4PIUb2wC3HVcPVjOVz++IVw=",
@@ -10,19 +10,19 @@
     "version": "0.0.94"
   },
   "linux-ptb": {
-    "hash": "sha256-Y+e3HHXE5D9Q9qKE7ipaLijZ+E6yEr9NzEOy5c+Gk54=",
-    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.173/discord-ptb-0.0.173.tar.gz",
-    "version": "0.0.173"
+    "hash": "sha256-SOShH+EzFN1ti1RcgvRaxaD45nHosi4R6lSXSY3MGYU=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.176/discord-ptb-0.0.176.tar.gz",
+    "version": "0.0.176"
   },
   "linux-stable": {
-    "hash": "sha256-WR9xyw3Zn/HAZQlfiKMAXqc2TueF6wCfQzvYtnXd1yM=",
-    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.121/discord-0.0.121.tar.gz",
-    "version": "0.0.121"
+    "hash": "sha256-2cNAfYzPbZ9O8s4b3RBLki8aM9TiFuZcGffFbY4zxJQ=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.123/discord-0.0.123.tar.gz",
+    "version": "0.0.123"
   },
   "osx-canary": {
-    "hash": "sha256-q/PAGdlOTdkQudiH/NFXSgwhz2XBL9ZwrhJXiY9Iibc=",
-    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.958/DiscordCanary.dmg",
-    "version": "0.0.958"
+    "hash": "sha256-KPneQR4BBC/1CHWYm1ie8m//tiagRCk92e1/Tz+Fx9Y=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.966/DiscordCanary.dmg",
+    "version": "0.0.966"
   },
   "osx-development": {
     "hash": "sha256-B1//zMlTv2+RWHfWZSaaU8ubVOwWob+EYjNdtFRwlgg=",
@@ -30,13 +30,13 @@
     "version": "0.0.107"
   },
   "osx-ptb": {
-    "hash": "sha256-QCzJsb1RH6HORk9hw9F9Xu0rE+NCFYJDTJQO9UrdBxo=",
-    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.205/DiscordPTB.dmg",
-    "version": "0.0.205"
+    "hash": "sha256-EPhQwolrHda8gh+G84quVlbNGYSThqJsg4qjK44nZuc=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.208/DiscordPTB.dmg",
+    "version": "0.0.208"
   },
   "osx-stable": {
-    "hash": "sha256-/CEN67VbRRwK64Iy7GIhs2XFwHe47njI5X6n45j5Q/E=",
-    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.373/Discord.dmg",
-    "version": "0.0.373"
+    "hash": "sha256-pRL1fCBXQL3iMNM/po73KrtJRQhWNvED7H8PrOBWTaU=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.375/Discord.dmg",
+    "version": "0.0.375"
   }
 }
diff --git a/pkgs/applications/video/qctools/default.nix b/pkgs/applications/video/qctools/default.nix
index 0849d92401cb..b42469008eb6 100644
--- a/pkgs/applications/video/qctools/default.nix
+++ b/pkgs/applications/video/qctools/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qctools";
-  version = "1.4";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/${pname}/${version}/${pname}_${version}.tar.xz";
-    hash = "sha256-1WqCP/4PV8hQT8ubPxHGTwZrRnOPm+msEPBGR4gkWhA=";
+    hash = "sha256-4HuNBCvN1BDjIsEyo8Lo/H1rNgCFygkXqo6yD3oDf18=";
   };
 
   sourceRoot = "${pname}/Project/QtCreator";
diff --git a/pkgs/build-support/node/fetch-yarn-deps/fixup.js b/pkgs/build-support/node/fetch-yarn-deps/fixup.js
index b9c8c90b6169..c8dc8a27f139 100755
--- a/pkgs/build-support/node/fetch-yarn-deps/fixup.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/fixup.js
@@ -33,7 +33,9 @@ const fixupYarnLock = async (lockContents, verbose) => {
       if (hash)
         pkg.resolved += `#${hash}`
 
-      return [dep, pkg]
+      // Rewrite key to remove git+ prefix and .git suffix to prevent yarn git resolver
+      let fixedDep = dep.replace(/@git\+/, '@').replace(/\.git(#|$)/, '$1')
+      return [fixedDep, pkg]
     })
   )
 
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index 5d7768b261ea..f56ffb529b71 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -46,17 +46,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = binName;
 
-  version = "0.25.7";
+  version = "0.26.2";
   src = fetchFromGitHub {
     owner = "toeverything";
     repo = "AFFiNE";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+MdPo2THiwgRT4x/Xnf9+1C+Bu0BsV9P1yIXhgdA3CQ=";
+    hash = "sha256-qFJezmSNq6Uq6xvCGUITeidrChQiZWI6lw9ZX8PcwXc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-0SOuaMjVihmSBQhVKZHIZkIUs+MXnW5VkrhGRD6xNcM=";
+    hash = "sha256-3cvq3FV3juzEaKczw/SUHSXHLLEIEJlcv2LUAMxGVVQ=";
   };
 
   # keep yarnOfflineCache same output style with offlineCache = yarn-berry.fetchYarnBerryDeps { inherit (finalAttrs) src missingHashes; hash = "" };
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-pPLnNsQ7+ao+MQw6Zmf/XA8ITWr+AeUA0gvu6qVUECw=";
+    outputHash = "sha256-TgrepMMOZkVK2uUEvwllrnFzVsEjgvRb8AtBsDzrHSg=";
   };
 
   buildInputs = lib.optionals hostPlatform.isDarwin [
diff --git a/pkgs/by-name/ai/air/package.nix b/pkgs/by-name/ai/air/package.nix
index bab2776ab236..833457a14d98 100644
--- a/pkgs/by-name/ai/air/package.nix
+++ b/pkgs/by-name/ai/air/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "air";
-  version = "1.64.4";
+  version = "1.64.5";
 
   src = fetchFromGitHub {
     owner = "air-verse";
     repo = "air";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m2NIRf/dZQKB3IeEChEBfJ7GJkxiyuWSRvMoHfbsLeI=";
+    hash = "sha256-vaNXG+bS+RB0Qi0kI9lBGyr8FcUxm5igG982+cOZwqw=";
   };
 
   vendorHash = "sha256-03xZ3P/7xjznYdM9rv+8ZYftQlnjJ6ZTq0HdSvGpaWw=";
diff --git a/pkgs/by-name/ai/airwave/package.nix b/pkgs/by-name/ai/airwave/package.nix
index 4f2a4e455157..e356bc9198de 100644
--- a/pkgs/by-name/ai/airwave/package.nix
+++ b/pkgs/by-name/ai/airwave/package.nix
@@ -2,7 +2,7 @@
   lib,
   multiStdenv,
   fetchFromGitHub,
-  wineWowPackages,
+  wineWow64Packages,
   cmake,
   makeWrapper,
   file,
@@ -12,7 +12,7 @@
 }:
 
 let
-  wine-wow64 = wineWowPackages.stableFull;
+  wine-wow64 = wineWow64Packages.stableFull;
 in
 multiStdenv.mkDerivation (finalAttrs: {
   pname = "airwave";
@@ -65,7 +65,7 @@ multiStdenv.mkDerivation (finalAttrs: {
     mkdir $out/bin
     mv $out/libexec/airwave-manager $out/bin
     wrapProgram $out/libexec/airwave-host-32.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
-    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine64"}
+    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
   '';
 
   meta = {
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 7f881e0005d1..e788ac297efb 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "8.3.3";
+  version = "8.3.4";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-213AlF4lNg5K4y25rXCBtVoc4w/3m7b8gGi0jFgzqR0=";
+    hash = "sha256-I5Dx/71+rY6qThE8ton4EtDtcfMQzx4Yle+1tpOAkDI=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 27f523a3a743..813705229a49 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2026-01-25";
+  version = "0-unstable-2026-02-08";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "2cb699e7a2367390db6fdb56c78383854a8522b9";
-    hash = "sha256-a6p3ZL3Rg3zK4B8Nfoe28etWnDeV6/sn5pnCpVQThXY=";
+    rev = "e9988402c5007c886f5256bd189009d3abd842a7";
+    hash = "sha256-qjai8UeqSkoDmc0YAmIxxaMJiLwTDcZteqChHGf3CPg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/as/asunder/package.nix b/pkgs/by-name/as/asunder/package.nix
index 40c6d1009dd7..190df9934acc 100644
--- a/pkgs/by-name/as/asunder/package.nix
+++ b/pkgs/by-name/as/asunder/package.nix
@@ -20,7 +20,7 @@
   wavpack,
   #, musepackSupport ? false, TODO: mpcenc
   monkeysAudioSupport ? false,
-  monkeysAudio,
+  monkeys-audio,
   #, aacSupport ? false, TODO: neroAacEnc
 }:
 
@@ -31,7 +31,7 @@ let
     ++ lib.optional flacSupport flac
     ++ lib.optional opusSupport opusTools
     ++ lib.optional wavpackSupport wavpack
-    ++ lib.optional monkeysAudioSupport monkeysAudio
+    ++ lib.optional monkeysAudioSupport monkeys-audio
     ++ [ cdparanoia ];
 in
 
diff --git a/pkgs/by-name/as/async-profiler/package.nix b/pkgs/by-name/as/async-profiler/package.nix
index c7e916bf6466..dbe0d483fa63 100644
--- a/pkgs/by-name/as/async-profiler/package.nix
+++ b/pkgs/by-name/as/async-profiler/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "async-profiler";
-  version = "4.2.1";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "jvm-profiling-tools";
     repo = "async-profiler";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ggqfBndcwHUerWjsvDqmRQ5uEyL6zhNgwVl18R18k0Q=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wysOjirCfxm0SmwDW7GS+S73lAT8/0g4avu7T5+qy2Q=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/at/atac/package.nix b/pkgs/by-name/at/atac/package.nix
index 72bc2c507c81..eda0302d12bf 100644
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atac";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "Julien-cpsn";
     repo = "ATAC";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PXSjyMe7Rcoeczm/cqFgn1Ra66T9cA34NdfaqLTljmc=";
+    hash = "sha256-2z0+6CyVJR6sTFHotegCU8+isDy4Pw+gkJ1eUBs+AYM=";
   };
 
-  cargoHash = "sha256-qjg5yxWRcNnmrl91kogUEOfFOs06tcgmK2hpqx6nftU=";
+  cargoHash = "sha256-lJO9riP/3FRrQ/gkKQCghfkNn1ePS+p6FtMcJTIJxZY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/au/autotiling-rs/package.nix b/pkgs/by-name/au/autotiling-rs/package.nix
index eaa9cf4a8e24..efe04c733cd3 100644
--- a/pkgs/by-name/au/autotiling-rs/package.nix
+++ b/pkgs/by-name/au/autotiling-rs/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "autotiling-rs";
-  version = "0.1.6";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "ammgws";
     repo = "autotiling-rs";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-21XIKZ2rzuQMpkaOhGu1pg4J3OGOzHNQ20Rcw1V4BfI=";
+    sha256 = "sha256-jeakiO28LM223qyPqZ4tdozQbNxJ6vEEl2Avk8ZBwlA=";
   };
 
-  cargoHash = "sha256-+5GibhSkiKmgRrESKrliKLrrtUQ7iv2sFz46OFwAIwE=";
+  cargoHash = "sha256-ytViAnvcU99hr9Ki9AOtcmBRYFtuBdWeRe2Z00+WRGs=";
 
   meta = {
     description = "Autotiling for sway (and possibly i3)";
diff --git a/pkgs/by-name/ba/badger/package.nix b/pkgs/by-name/ba/badger/package.nix
index 45465a5232cc..88fc67f01b38 100644
--- a/pkgs/by-name/ba/badger/package.nix
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "badger";
-  version = "4.9.0";
+  version = "4.9.1";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "badger";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-AmDfG4IOpptdH0/Un4V275UTTUXoV1LNKtbSj3O50rs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BsKFi4oMNJE09PBjFmqNhbMcQcHk5uR5QssbwN2ZNCk=";
   };
 
   vendorHash = "sha256-+rXXCVH2xuULPzdM0KVPwYht+tu0qyxPjLLaBMWVIuI=";
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 28cf35927d28..bc40f324d8f5 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,13 +18,13 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.37.2";
+  version = "1.37.4";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-xFbVeNfOse7FfivTFwBnEZ0XUU2uUXqe1im6MncZwyY=";
+    hash = "sha256-BTqsymgthJH1gIakSrDBx3Hxthm48kLPc85IjreX1vA=";
   };
 
   npmDepsHash = "sha256-aZ9kfkW+S6Hjt59Z4Fc5joghs7OQ32354IYevFuKNeo=";
diff --git a/pkgs/by-name/bc/bcachefs-tools/kernel-module.nix b/pkgs/by-name/bc/bcachefs-tools/kernel-module.nix
index b9b4667a4d99..6889353cec9c 100644
--- a/pkgs/by-name/bc/bcachefs-tools/kernel-module.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/kernel-module.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation {
       platforms
       ;
 
-    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.19");
+    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.20");
   };
 }
diff --git a/pkgs/by-name/bc/bcc/package.nix b/pkgs/by-name/bc/bcc/package.nix
index ccc87a826181..a5c1e235e9ac 100644
--- a/pkgs/by-name/bc/bcc/package.nix
+++ b/pkgs/by-name/bc/bcc/package.nix
@@ -5,7 +5,6 @@
   cmake,
   elfutils,
   fetchFromGitHub,
-  fetchpatch,
   flex,
   iperf,
   lib,
@@ -23,14 +22,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.35.0";
+  version = "0.36.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "iovisor";
     repo = "bcc";
     tag = "v${version}";
-    hash = "sha256-eP/VEq7cPALi2oDKAZFQGQ3NExdmcBKyi6ddRZiYmbI=";
+    hash = "sha256-J00GRIM9AemLkKHoyKqLR2U2aEBwNy/a5hbGjLRrO8w=";
   };
 
   patches = [
@@ -44,12 +43,6 @@ python3Packages.buildPythonApplication rec {
     (replaceVars ./absolute-ausyscall.patch {
       ausyscall = lib.getExe' audit "ausyscall";
     })
-
-    (fetchpatch {
-      name = "clang-21.patch";
-      url = "https://github.com/iovisor/bcc/commit/8c5c96ad3beeed2fa827017f451a952306826974.diff";
-      hash = "sha256-VOzhdeZ3mRstLlMhxHwEgqCa6L39eRpbFJuKZqFnBws=";
-    })
   ];
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/be/beans/package.nix b/pkgs/by-name/be/beans/package.nix
new file mode 100644
index 000000000000..36e6b0a1741f
--- /dev/null
+++ b/pkgs/by-name/be/beans/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "beans";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "hmans";
+    repo = "beans";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3SgTqR5DGAb5r+VU3YknoWATqglq8G7QV3kTVUSL9u4=";
+  };
+
+  vendorHash = "sha256-TprfPZ/clb7PLMAkxF0y78bCef4XarhgHlIhIPn1nQA=";
+
+  ldflags = [
+    "-s"
+    "-X github.com/hmans/beans/cmd.version=${finalAttrs.version}"
+    "-X github.com/hmans/beans/cmd.commit=${finalAttrs.src.rev}"
+    "-X github.com/hmans/beans/cmd.date=unknown"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  meta = {
+    description = "Issue tracker for you, your team, and your coding agents";
+    homepage = "https://github.com/hmans/beans";
+    changelog = "https://github.com/hmans/beans/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sleroq ];
+    mainProgram = "beans";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index f55378b207d0..02409231bb2a 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "5.5.3";
+  version = "5.5.5";
 
   src =
     let
@@ -54,10 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
       hash = selectSystem {
-        x86_64-linux = "sha256-zbOePN975TWp7zo3XagKYPjHPQiz3r6ui2fPfNEboGs=";
-        aarch64-linux = "sha256-AoyaHBKO0gHgbq51D+OMH7SyUVnq2IjH4FIbeNepFHw=";
-        x86_64-darwin = "sha256-GzK9fmhW86IKER1IPsLNDwyz03rKuqCTO+hcPR/2QnM=";
-        aarch64-darwin = "sha256-pRBkgzp2w92/ACQaqpruwRtbfvg7f+nNE5rZ4YuQREc=";
+        x86_64-linux = "sha256-XV7PXoXA99BwPolg20vUVAAWhs3eBTmgLOEWZrq6Mq4=";
+        aarch64-linux = "sha256-lfW7gjes/Kn8zCKh2LNItu4kwSr9dxYGviUjgXFiHzU=";
+        x86_64-darwin = "sha256-EGsfHUYAxjgMBye+D8XzPdUqtXIG7X+DpJoViVcYGHU=";
+        aarch64-darwin = "sha256-JfxhOS74xQP8MK2nBz3V0VPxHbXF5m9OtRI2m4ZWjk0=";
       };
     };
 
diff --git a/pkgs/by-name/bs/bs-manager/package.nix b/pkgs/by-name/bs/bs-manager/package.nix
index 19848408dd79..cc4c51073cbd 100644
--- a/pkgs/by-name/bs/bs-manager/package.nix
+++ b/pkgs/by-name/bs/bs-manager/package.nix
@@ -18,15 +18,15 @@
   steam-run-free,
 }:
 
-buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "bs-manager";
-  version = "1.5.4";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Zagrios";
     repo = "bs-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YitQjhnadQrpdBOV2CUedRNm/RW7/rpXtS9PJTa9kUU=";
+    hash = "sha256-hx6ciEz772NYd9+7WjLqTzNNenWMoOq57IneqsDC1Qg=";
   };
 
   postPatch = ''
@@ -39,13 +39,13 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
     ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
   '';
 
-  npmDepsHash = "sha256-3NMqYD7S4wYjwYuGJOmq2/C82qtG1mImsR4crjFLe30=";
+  npmDepsHash = "sha256-wmPZv1lqGr31wBGaeLw7LL6ZMzq/x8lkoy/iMxU+M80=";
 
   extraNpmDeps = fetchNpmDeps {
     name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/release/app";
-    hash = "sha256-UWsxty1kfxMr5fybtykrN2G+yiQ9dw/bbMwfcVLJgp4=";
+    hash = "sha256-jE/M22QQzuTS0zgcB+tLEL8Ey61HE8MP7H1MTX060gY=";
   };
 
   makeCacheWritable = true;
@@ -64,6 +64,10 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
     stdenv.cc.cc
   ];
 
+  autoPatchelfIgnoreMissingDeps = [
+    "libc.musl-x86_64.so.1" # musl-based node modules won't be used on glibc systems
+  ];
+
   preBuild = ''
     pushd release/app
 
diff --git a/pkgs/by-name/bu/buildah-unwrapped/package.nix b/pkgs/by-name/bu/buildah-unwrapped/package.nix
index 13d4e4cf86e9..20670b02fdaf 100644
--- a/pkgs/by-name/bu/buildah-unwrapped/package.nix
+++ b/pkgs/by-name/bu/buildah-unwrapped/package.nix
@@ -18,13 +18,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "buildah";
-  version = "1.42.2";
+  version = "1.43.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YWyA2wTIlJNwuqcPHOBFZ2wr46Z0I83FWRew/FC3Wxs=";
+    hash = "sha256-SihJXPnUrOe4TxbbnQOhXoZlbQZfLy0YGMV32CtojV8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ca/capypdf/package.nix b/pkgs/by-name/ca/capypdf/package.nix
index 3ddff2102dc8..1621be0f370d 100644
--- a/pkgs/by-name/ca/capypdf/package.nix
+++ b/pkgs/by-name/ca/capypdf/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "capypdf";
-  version = "0.18.0";
+  version = "0.20.0";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "jpakkane";
     repo = "capypdf";
     rev = finalAttrs.version;
-    hash = "sha256-FivwBSpaIpkdKPYk7FuwpcBCYq59XH7SouA47rmGSaQ=";
+    hash = "sha256-A2wjXYLiszWNaPChWGzBMG7OggsomT2cRi3LsjasOIQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/carapace-bridge/package.nix b/pkgs/by-name/ca/carapace-bridge/package.nix
index f91823a8a9c2..24366416ade2 100644
--- a/pkgs/by-name/ca/carapace-bridge/package.nix
+++ b/pkgs/by-name/ca/carapace-bridge/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u+vcXTTLoRyKW/o/+bPpeFd7tgks9yfQcZDfgHjxZmc=";
+    hash = "sha256-jqE5xSq/Nbh7rhDHs21w6tY/oqRZEvq0bj0kvoDY3SI=";
   };
 
   # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on
diff --git a/pkgs/by-name/ca/cargo-nextest/no-dtrace-macos.patch b/pkgs/by-name/ca/cargo-nextest/no-dtrace-macos.patch
index ffd49c79d4dc..f7142c2156d1 100644
--- a/pkgs/by-name/ca/cargo-nextest/no-dtrace-macos.patch
+++ b/pkgs/by-name/ca/cargo-nextest/no-dtrace-macos.patch
@@ -1,62 +1,62 @@
 diff --git a/nextest-runner/Cargo.toml b/nextest-runner/Cargo.toml
-index 776c9341..06196bd2 100644
+index 748f162e4c..2cda438ded 100644
 --- a/nextest-runner/Cargo.toml
 +++ b/nextest-runner/Cargo.toml
-@@ -118,7 +118,7 @@ nix.workspace = true
+@@ -126,7 +126,7 @@
  #
  # Also, usdt 0.6.0 fails to compile on x86_64-apple-darwin, so restrict it to
  # aarch64-apple-darwin.
 -[target.'cfg(any(all(target_arch = "x86_64", any(target_os = "linux", target_os = "freebsd", target_os = "illumos")), all(target_arch = "aarch64", any(target_os = "macos", target_os = "freebsd", target_os = "illumos"))))'.dependencies]
 +[target.'cfg(any(all(target_arch = "x86_64", any(target_os = "linux", target_os = "freebsd", target_os = "illumos")), all(target_arch = "aarch64", any(target_os = "freebsd", target_os = "illumos"))))'.dependencies]
- usdt = "0.6.0"
+ usdt = { version = "0.6.0", optional = true }
  
  [target.'cfg(windows)'.dependencies]
 diff --git a/nextest-runner/src/usdt.rs b/nextest-runner/src/usdt.rs
-index 7732eeb4..af69015b 100644
+index b0905030a4..a1abbcfdca 100644
 --- a/nextest-runner/src/usdt.rs
 +++ b/nextest-runner/src/usdt.rs
-@@ -28,7 +28,7 @@ use serde::Serialize;
-     ),
-     all(
-         target_arch = "aarch64",
--        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -30,7 +30,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
++            any(target_os = "freebsd", target_os = "illumos")
+         )
      )
  ))]
- pub fn register_probes() -> Result<(), usdt::Error> {
-@@ -43,7 +43,7 @@ pub fn register_probes() -> Result<(), usdt::Error> {
-     ),
-     all(
-         target_arch = "aarch64",
--        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -48,7 +48,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
++            any(target_os = "freebsd", target_os = "illumos")
+         )
      )
  )))]
- pub fn register_probes() -> Result<(), std::convert::Infallible> {
-@@ -57,7 +57,7 @@ pub fn register_probes() -> Result<(), std::convert::Infallible> {
-     ),
-     all(
-         target_arch = "aarch64",
--        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -65,7 +65,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
++            any(target_os = "freebsd", target_os = "illumos")
+         )
      )
  ))]
- #[usdt::provider(provider = "nextest")]
-@@ -135,7 +135,7 @@ pub mod usdt_probes {
-     ),
-     all(
-         target_arch = "aarch64",
--        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -146,7 +146,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
++            any(target_os = "freebsd", target_os = "illumos")
+         )
      )
  ))]
- #[macro_export]
-@@ -246,7 +246,7 @@ macro_rules! fire_usdt {
-     ),
-     all(
-         target_arch = "aarch64",
--        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -260,7 +260,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
++            any(target_os = "freebsd", target_os = "illumos")
+         )
      )
  )))]
- #[macro_export]
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index a3201f766a3c..76d4a07346d7 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.124";
+  version = "0.9.126";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-qvJ/dqbls2fVSPY++kYBIeiu14eDD8ORuvcD8dEtMZ8=";
+    hash = "sha256-meAry18+M+VizSWFvMY99F4ZDbb2LuaTqi3kBuoxhD0=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-3fZSXBP6vMh7GN2eY2upsvV/mTuDOcSovdsbcZBQA4U=";
+  cargoHash = "sha256-I25ObQEM9sxwnmqebb4P6EXFUMkXWjNfoV01WyZOivA=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/cc/ccache/package.nix b/pkgs/by-name/cc/ccache/package.nix
index c8be20b00970..1247c6069b10 100644
--- a/pkgs/by-name/cc/ccache/package.nix
+++ b/pkgs/by-name/cc/ccache/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ccache";
-  version = "4.12.2";
+  version = "4.12.3";
 
   src = fetchFromGitHub {
     owner = "ccache";
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
         exit 1
       fi
     '';
-    hash = "sha256-oWzVCrNgYtOeN4+KJmIynT3jiFZfxrsLkoIm0lK3MBo=";
+    hash = "sha256-oX7qG3jjrLm4gKZd8w7Bc7uE5U5sIa35//PDRJ/XHcM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/cc/ccrypt/package.nix b/pkgs/by-name/cc/ccrypt/package.nix
index d64e62913e3f..6fe179cfef91 100644
--- a/pkgs/by-name/cc/ccrypt/package.nix
+++ b/pkgs/by-name/cc/ccrypt/package.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   meta = {
     homepage = "https://ccrypt.sourceforge.net/";
     description = "Utility for encrypting and decrypting files and streams with AES-256";
diff --git a/pkgs/by-name/ce/ceph-csi/package.nix b/pkgs/by-name/ce/ceph-csi/package.nix
index 02ddfdee1e26..9db06c4c4176 100644
--- a/pkgs/by-name/ce/ceph-csi/package.nix
+++ b/pkgs/by-name/ce/ceph-csi/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ceph-csi";
-  version = "3.15.1";
+  version = "3.16.0";
 
   src = fetchFromGitHub {
     owner = "ceph";
     repo = "ceph-csi";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-eLF/V6NaBU8r3ttJku4lSGrIuP2vao24rsAsEAWB0wk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dVSztcnfofPkd4lv/WBZQNS6POHWdAeNqMta1p7G51c=";
   };
 
   preConfigure = ''
diff --git a/pkgs/by-name/ch/chafa/package.nix b/pkgs/by-name/ch/chafa/package.nix
index db38014956f5..f43ef93abf9b 100644
--- a/pkgs/by-name/ch/chafa/package.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@@ -19,14 +19,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.18.0";
+  version = "1.18.1";
   pname = "chafa";
 
   src = fetchFromGitHub {
     owner = "hpjansson";
     repo = "chafa";
     tag = finalAttrs.version;
-    hash = "sha256-SKwrc0bOaSdxENUWMtErSCug7of9s/ZGLeKhTtUCbWY=";
+    hash = "sha256-Is7N5WUjYVDFz1VKrKQqa7n48gXf2JtvDHB5vXMjoZg=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ch/chamber/package.nix b/pkgs/by-name/ch/chamber/package.nix
index 7115616fb8d4..3e344f91ea27 100644
--- a/pkgs/by-name/ch/chamber/package.nix
+++ b/pkgs/by-name/ch/chamber/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "chamber";
-  version = "3.1.4";
+  version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "chamber";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-CSLG1y7D2dozwB5Lme9xX+kjDuPB/5cOrsfmvGDXX4E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vmWRbQzgZJA2dQMdmZ/dLFlYb5O2yAexBZt3Oc2FLMM=";
   };
 
   env.CGO_ENABLED = 0;
 
-  vendorHash = "sha256-xhfBpLAhAVT42vA2oRm+EQHXA1dWy3UD5m8Ds8/IyAk=";
+  vendorHash = "sha256-Yin8hNavlcANY8ynmzceLVHUfgk/MbH9Xx9MfW12E+0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 0e214657b572..470b834cb90e 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.5.5";
+  version = "6.5.8";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-Kr/DpxptU3j3Q97G+5fG5y7oLrpK7KaqlDv0TtsAl4E=";
+    hash = "sha256-JrGiRYE9YLuUdOhIqtNOsk+yiTLeiaTVQ7A5g3jqk/8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-3WZgjf2ytnnTKVR0E6n3d4WhHS/cjgEgfENtOpBf57w=";
+  cargoHash = "sha256-QXSOeiXJadTQaCRRfbn3C3KDyKIV4eOa2IdHHPK5Dzo=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 790f1d26a92d..b05cb3f10465 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2026-02-01";
+  version = "0.4.0-unstable-2026-02-06";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "52a3a4be4035fac1bec56ee6f20ae50ea15f8c31";
-    hash = "sha256-HrLOo9duWDOxoranH2fo9KVs3OIV0oHDvzEcWdwthTs=";
+    rev = "450cf8a7a126419400eb3b271e4e22f7a8ada1ec";
+    hash = "sha256-UjLVYLd+OjDPoSBSSQQuh5eXn+7Hq5BFXnoy/PuaUsI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ci/circus/package.nix b/pkgs/by-name/ci/circus/package.nix
new file mode 100644
index 000000000000..61c16c756763
--- /dev/null
+++ b/pkgs/by-name/ci/circus/package.nix
@@ -0,0 +1 @@
+{ python3Packages }: with python3Packages; toPythonApplication circus
diff --git a/pkgs/by-name/cl/claude-code-bin/manifest.json b/pkgs/by-name/cl/claude-code-bin/manifest.json
index 7b28d4bb081d..8232b3c85e95 100644
--- a/pkgs/by-name/cl/claude-code-bin/manifest.json
+++ b/pkgs/by-name/cl/claude-code-bin/manifest.json
@@ -1,41 +1,41 @@
 {
-  "version": "2.1.34",
-  "buildDate": "2026-02-06T06:39:27Z",
+  "version": "2.1.37",
+  "buildDate": "2026-02-07T18:40:47Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "58bd74f33a9f0beb4338e02f613f63064fda73e9226288d10909df50a466ec60",
-      "size": 180901616
+      "checksum": "00ed10afb7a562440773de31284568ce9c33385d79d3a912a12af262aefd130e",
+      "size": 181423280
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "57e08c32782d0e3d1e38cf697261f85813a710d2719447a75770bdafdc4740c8",
-      "size": 187198656
+      "checksum": "5ad9639bf34affa47066fb98f2d7ad7b0f236009744d309077b194d896fc011d",
+      "size": 186482592
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "ffb0625ad609b5816cedfb23f88325f62b63747ab6fdfe5a53f352fd4ed77b33",
-      "size": 215296297
+      "checksum": "d725cc73060f400a7ac03a769969397daec9d411dbd5b1c7bb1fa60427bf657e",
+      "size": 218584946
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "3665f12f67a1159b31005dcce11ca1de41d49759bae3d01ed853940fe7c4a21f",
-      "size": 223101542
+      "checksum": "f967a4d06e16a32436b6329e2dbed459a9fa4d34f07635a1fb271b74f706c91f",
+      "size": 221426063
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "2f610b62fb441b4b9d4223f1036a76d86576ab484876eb5f10bcede91178f913",
-      "size": 210560329
+      "checksum": "8b1852e9922ecb67a6eef467d5d8f4408d58d71e51c785e155cd0c8efe417754",
+      "size": 211768338
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "e1f8081c9f53bcb7055bfe855c717bd6040cee8a81a7c29deb6d8b1c6e4d8259",
-      "size": 215790118
+      "checksum": "df4f2a657f4e5c21b1907d7fb10a36622aced68d5ac4c94e709862298d1e2aac",
+      "size": 213926119
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "655008c690f8e5397ce7d420d0b3e09ef286035e7a1e4d12caa8f61fb3c968ec",
-      "size": 232975520
+      "checksum": "8a54bdc2c7d60e84b92f5aeedb9b66791006cfff992415e58e15a6df52842859",
+      "size": 231153824
     }
   }
 }
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 41383c8c8978..26a33c2e9b46 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.1.34",
+  "version": "2.1.37",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.1.34",
+      "version": "2.1.37",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index d5403e0f9e52..b9395fe9e37f 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.1.34";
+  version = "2.1.37";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-J3kltFY5nR3PsRWbW310VqD/6hhfMbVSvynv0eaIi3M=";
+    hash = "sha256-ijyZCT4LEEtXWOBds8WzizcfED9hVgaJByygJ4P4Yss=";
   };
 
-  npmDepsHash = "sha256-n762einDxLUUXWMsfdPVhA/kn0ywlJgFQ2ZGoEk3E68=";
+  npmDepsHash = "sha256-2if3LsTEnC2OQjEgojqgzs8YOXdpoqJijEmVlxmEfzw=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/cl/cloudflared/tests.nix b/pkgs/by-name/cl/cloudflared/tests.nix
index c1c081c0a503..7555af2b1f0d 100644
--- a/pkgs/by-name/cl/cloudflared/tests.nix
+++ b/pkgs/by-name/cl/cloudflared/tests.nix
@@ -56,7 +56,7 @@ in
       }
       ''
         export HOME="$(mktemp -d)"
-        wine64 $exe help
+        wine $exe help
         mkdir $out
       '';
 }
diff --git a/pkgs/by-name/co/cocom-tool-set/package.nix b/pkgs/by-name/co/cocom-tool-set/package.nix
index 9ab545e01c4f..757d74a37ba6 100644
--- a/pkgs/by-name/co/cocom-tool-set/package.nix
+++ b/pkgs/by-name/co/cocom-tool-set/package.nix
@@ -16,11 +16,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   env = {
     RANLIB = "${stdenv.cc.targetPrefix}gcc-ranlib";
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=implicit-int"
-      "-Wno-error=implicit-function-declaration"
-      "-std=gnu17"
-    ];
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-Wno-error=implicit-int"
+        "-Wno-error=implicit-function-declaration"
+      ]
+      ++ lib.optional stdenv.cc.isGNU "-std=gnu17"
+    );
   };
 
   autoreconfFlags = "REGEX";
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index ba951382b780..50e7100bff08 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.24.0";
+  version = "2.24.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-LxKS/KKuw6vwsYnrHE2jAJ3lEuudXQ57870WSdtTW50=";
+    hash = "sha256-NpbXUw2KivAi/7Lg3UuL30HPa/PeTjhvSgXliDkVKe4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/commitizen/package.nix b/pkgs/by-name/co/commitizen/package.nix
index 512a4e18886d..9fa4a2fed7da 100644
--- a/pkgs/by-name/co/commitizen/package.nix
+++ b/pkgs/by-name/co/commitizen/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.11.6";
+  version = "4.13.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-7KF7qzBWF8OQLHxXYWHI+zcjBWV7KogMr0FYhitPSTw=";
+    hash = "sha256-f0fB5FkWG4fkV7ccMPJ8z5MBFVYBwE33BDa4Cz94K4M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/commitlint/package.nix b/pkgs/by-name/co/commitlint/package.nix
index 02f748e92e31..fb34238aa1b5 100644
--- a/pkgs/by-name/co/commitlint/package.nix
+++ b/pkgs/by-name/co/commitlint/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.4.0";
+  version = "20.4.1";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Koi4twmDeCV716rGEUUmkt25gzBROBFL5y48qr+J/FA=";
+    hash = "sha256-FJod+jzd8zHOcyoHyxw+UltS2NsHmbocIWIbxHk2EDg=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-ihN9DmW46nKeFjcZWdxsutE+Q6ezdqPXO0i/xkNJdI0=";
+    hash = "sha256-pnxnFvEv6fo1I6XAFZw6xcues52WYxFjdehH9BzB+w4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/complgen/package.nix b/pkgs/by-name/co/complgen/package.nix
index 3adb08a269ad..e4c19ba6d0a0 100644
--- a/pkgs/by-name/co/complgen/package.nix
+++ b/pkgs/by-name/co/complgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "complgen";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5fEownFj5cyLL+4ZPN80qlkw3xu6xspsKfruk7KBhrI=";
+    hash = "sha256-6cduIe0qy3r4hYaVzajYHDklN9fzOpmmWo875pPsTWk=";
   };
 
-  cargoHash = "sha256-wGbf1UiCwjOzUbR0k45EAuGjEg9+x14d8kKpz7pHQN8=";
+  cargoHash = "sha256-UeaXwq9Q8ognW9IWtUJmQ0kxm7bbootN7epzwobHR70=";
 
   meta = {
     changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";
diff --git a/pkgs/by-name/co/conkeyscan/package.nix b/pkgs/by-name/co/conkeyscan/package.nix
index 9260aa7c73a9..f5ccf0110e29 100644
--- a/pkgs/by-name/co/conkeyscan/package.nix
+++ b/pkgs/by-name/co/conkeyscan/package.nix
@@ -9,15 +9,7 @@ let
   python = python3.override {
     self = python3;
     packageOverrides = self: super: {
-      pyrate-limiter = super.pyrate-limiter.overridePythonAttrs (oldAttrs: rec {
-        version = "2.10.0";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src) owner repo;
-          tag = "v${version}";
-          hash = "sha256-CPusPeyTS+QyWiMHsU0ii9ZxPuizsqv0wQy3uicrDw0=";
-        };
-        doCheck = false;
-      });
+      pyrate-limiter = super.pyrate-limiter_2;
     };
   };
 
diff --git a/pkgs/by-name/co/container/package.nix b/pkgs/by-name/co/container/package.nix
index d5cd3bb9e059..75166c26b4ab 100644
--- a/pkgs/by-name/co/container/package.nix
+++ b/pkgs/by-name/co/container/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "container";
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchurl {
     url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-installer-signed.pkg";
-    hash = "sha256-2rfh8OD0H5BQkJsnST886U2dyf4aedJvCQziJ9YTxnE=";
+    hash = "sha256-6KQysR85bVzlDkTqFPAvffkP/O9EHJFrL6krY+lfWAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/convertx/package.nix b/pkgs/by-name/co/convertx/package.nix
new file mode 100644
index 000000000000..153ab012903a
--- /dev/null
+++ b/pkgs/by-name/co/convertx/package.nix
@@ -0,0 +1,154 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+
+  # Build deps
+  bun,
+  tailwindcss_4,
+  typescript,
+  makeBinaryWrapper,
+
+  # Runtime deps
+  assimp,
+  calibre,
+  dasel,
+  ffmpeg-headless,
+  graphicsmagick,
+  imagemagick,
+  inkscape,
+  libheif,
+  libjxl,
+  libreoffice,
+  libva,
+  pandoc,
+  perl5Packages,
+  potrace,
+  python3,
+  resvg,
+  texliveBasic,
+  vips,
+  vtracer,
+}:
+let
+  pin = lib.importJSON ./pin.json;
+  inherit (pin) version;
+
+  pname = "convertx";
+
+  src = fetchFromGitHub {
+    owner = "C4illin";
+    repo = "ConvertX";
+    tag = "v${version}";
+    hash = pin.srcHash;
+  };
+
+  node_modules = stdenv.mkDerivation (finalAttrs: {
+    pname = "${pname}-node_modules";
+    inherit version src;
+
+    dontConfigure = true;
+
+    nativeBuildInputs = [
+      bun
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      bun install --frozen-lockfile --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mkdir -p $out/lib/node_modules
+
+      rm -rf ./node_modules/.cache
+      rm -rf node_modules/.bin
+      cp -R ./node_modules $out/lib
+      cp package.json $out/lib
+    '';
+
+    outputHash = pin."${stdenv.system}";
+    outputHashMode = "recursive";
+  });
+in
+stdenv.mkDerivation {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    tailwindcss_4
+    typescript
+  ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ln -s ${node_modules}/lib/node_modules ./node_modules
+    tailwindcss -i ./src/main.css -o ./public/generated.css
+    tsc
+
+    substituteInPlace ./dist/src/index.js \
+      --replace-fail "assets: \"public\"" "assets: \"$out/share/convertx/dist/public\""
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/convertx
+    cp -R ./dist $out/share/convertx
+    cp -R ./public $out/share/convertx/dist
+    ln -s ${node_modules}/lib/node_modules $out
+
+    makeBinaryWrapper ${bun}/bin/bun $out/bin/convertx \
+      --add-flags "run --prefer-offline --no-install $out/share/convertx/dist/src/index.js" \
+      --set NODE_ENV production \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          assimp
+          calibre
+          dasel
+          ffmpeg-headless
+          graphicsmagick
+          imagemagick
+          inkscape
+          libheif
+          libjxl
+          libreoffice
+          libva
+          pandoc
+          perl5Packages.EmailOutlookMessage
+          potrace
+          (python3.withPackages (ps: [ ps.markitdown ]))
+          resvg
+          (texliveBasic.withPackages (ps: [
+            ps.dvisvgm
+            ps.latex
+            ps.latexmk
+            ps.unicode-math
+            ps.xcolor
+            ps.xetex
+          ]))
+          vips
+          vtracer
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Self-hosted online file converter";
+    homepage = "https://github.com/C4illin/ConvertX/tree/main";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    changelog = "https://github.com/C4illin/ConvertX/blob/main/CHANGELOG.md";
+    mainProgram = "convertx";
+    maintainers = with lib.maintainers; [
+      EpicEric
+    ];
+  };
+}
diff --git a/pkgs/by-name/co/convertx/pin.json b/pkgs/by-name/co/convertx/pin.json
new file mode 100644
index 000000000000..1fc9e21d094a
--- /dev/null
+++ b/pkgs/by-name/co/convertx/pin.json
@@ -0,0 +1,6 @@
+{
+  "version": "0.17.0",
+  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
+  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
+  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+}
diff --git a/pkgs/by-name/cr/crossmacro-daemon/deps.json b/pkgs/by-name/cr/crossmacro-daemon/deps.json
new file mode 100644
index 000000000000..6d172f70917d
--- /dev/null
+++ b/pkgs/by-name/cr/crossmacro-daemon/deps.json
@@ -0,0 +1,218 @@
+[
+  {
+    "pname": "Avalonia",
+    "version": "11.3.11",
+    "hash": "sha256-FSMuXVA5q5L5evwos5bIsuT81suO8FbCjEF3OvAL9p0="
+  }
+,
+  {
+    "pname": "Avalonia.Angle.Windows.Natives",
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
+  }
+,
+  {
+    "pname": "Avalonia.BuildServices",
+    "version": "11.3.2",
+    "hash": "sha256-6wx06tjSKWQOlX2czdp6Wh0nuwVapx5qf/s8Qj5we40="
+  }
+,
+  {
+    "pname": "Avalonia.Controls.ColorPicker",
+    "version": "11.3.11",
+    "hash": "sha256-Ki6O9HYbseQPV3DsvwmJ+ERimi/WmvzelNJDKP6loo0="
+  }
+,
+  {
+    "pname": "Avalonia.Desktop",
+    "version": "11.3.11",
+    "hash": "sha256-oFivO8/0rir4BwQsTeWs3bSnb7RmldwxYmI77j5pt8k="
+  }
+,
+  {
+    "pname": "Avalonia.Diagnostics",
+    "version": "11.3.11",
+    "hash": "sha256-p38+O0VDqZ8u5VOzImP21/U5wyP1BUp2UrLLc9HSfwE="
+  }
+,
+  {
+    "pname": "Avalonia.Fonts.Inter",
+    "version": "11.3.11",
+    "hash": "sha256-S0DWwcZHulVUIckiv2HM1Vbqno64c/Xt+mPhZp1tfsA="
+  }
+,
+  {
+    "pname": "Avalonia.FreeDesktop",
+    "version": "11.3.11",
+    "hash": "sha256-UE2/w9cw3YDzsw3HuhI2sTPy8reH9C71ufmHOpzvlSQ="
+  }
+,
+  {
+    "pname": "Avalonia.Native",
+    "version": "11.3.11",
+    "hash": "sha256-vw67lp/oOt+2lqdJ5PK2FY93jqPTcgZqOAXLtSXlJ8s="
+  }
+,
+  {
+    "pname": "Avalonia.Remote.Protocol",
+    "version": "11.3.11",
+    "hash": "sha256-l1f3rVygtI268llwbN0NvTDSfXwZE3CyRw8w5tbHBC4="
+  }
+,
+  {
+    "pname": "Avalonia.Skia",
+    "version": "11.3.11",
+    "hash": "sha256-89TGu50JfEVFo+QZgyOR0uOagC/xoJvqfnrHep3W/cc="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Fluent",
+    "version": "11.3.11",
+    "hash": "sha256-tiJ0xAFf0UVSH7LASPtg/7ils7+vZjw2UKBMydyUR3Q="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Simple",
+    "version": "11.3.11",
+    "hash": "sha256-AJS5Ls0tJ6PCr2mnr1PpxGWX4sII8mpe2R+VCFYRg44="
+  }
+,
+  {
+    "pname": "Avalonia.Win32",
+    "version": "11.3.11",
+    "hash": "sha256-6/NG4OrB/4YisXzJ51GPuq3uDn8oEUWyJRAqejyMCQw="
+  }
+,
+  {
+    "pname": "Avalonia.X11",
+    "version": "11.3.11",
+    "hash": "sha256-2fiQvKxU/r71UOAQgy0zwSHVCM2uG2sdEUhObd5TrQQ="
+  }
+,
+  {
+    "pname": "CommunityToolkit.Mvvm",
+    "version": "8.4.0",
+    "hash": "sha256-a0D550q+ffreU9Z+kQPdzJYPNaj1UjgyPofLzUg02ZI="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp",
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Linux",
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.macOS",
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Win32",
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
+  }
+,
+  {
+    "pname": "MicroCom.Runtime",
+    "version": "0.11.0",
+    "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection",
+    "version": "10.0.2",
+    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
+  }
+,
+  {
+    "pname": "Serilog",
+    "version": "4.3.0",
+    "hash": "sha256-jyIy4BjsyFXge3aO4GRFAdnX4/rz1MHfBkBDIpCDsTw="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Async",
+    "version": "2.1.0",
+    "hash": "sha256-LDoLpXkleD2MVPK2KBsLGRf5yqrwckBiAnYDbuIbaUM="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "6.1.1",
+    "hash": "sha256-CfIg4Us4kSMQAn6rU2rsAeE22g6MpFiZdhoZWySpZeY="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "7.0.0",
+    "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
+  }
+,
+  {
+    "pname": "SkiaSharp",
+    "version": "2.88.9",
+    "hash": "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux",
+    "version": "2.88.9",
+    "hash": "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux.NoDependencies",
+    "version": "2.88.9",
+    "hash": "sha256-WjpcM78Q6kaW0eU5iqDR5+fGcF+06/tawWHsJRK57Es="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.macOS",
+    "version": "2.88.9",
+    "hash": "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.WebAssembly",
+    "version": "2.88.9",
+    "hash": "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Win32",
+    "version": "2.88.9",
+    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
+  }
+,
+  {
+    "pname": "Tmds.DBus",
+    "version": "0.23.0",
+    "hash": "sha256-BwWQSqOOMS+Cf2fM8MIuiHey8QnGH4WvYjOn9haq5e0="
+  }
+,
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.21.2",
+    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+  }
+
+]
diff --git a/pkgs/by-name/cr/crossmacro-daemon/package.nix b/pkgs/by-name/cr/crossmacro-daemon/package.nix
new file mode 100644
index 000000000000..9e93a307206a
--- /dev/null
+++ b/pkgs/by-name/cr/crossmacro-daemon/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  buildDotnetModule,
+  dotnetCorePackages,
+  fetchFromGitHub,
+  nix-update-script,
+  autoPatchelfHook,
+  clang,
+  patchelf,
+  systemd,
+  zlib,
+}:
+
+buildDotnetModule rec {
+  pname = "crossmacro-daemon";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "alper-han";
+    repo = "CrossMacro";
+    tag = "v${version}";
+    hash = "sha256-6Cc1mC34l+4dUPD1LAYxlXxzNF76l4HoOmbqTdTJVk0=";
+  };
+
+  projectFile = "src/CrossMacro.Daemon/CrossMacro.Daemon.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = null;
+
+  selfContainedBuild = true;
+  executables = [ "CrossMacro.Daemon" ];
+  buildType = "Release";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    clang
+    patchelf
+  ];
+
+  buildInputs = [
+    systemd
+    zlib
+  ];
+
+  dotnetFlags = [ "-p:Version=${version}" ];
+
+  postInstall = ''
+    install -Dm644 scripts/assets/org.crossmacro.policy \
+      $out/share/polkit-1/actions/org.crossmacro.policy
+
+    install -Dm644 scripts/assets/50-crossmacro.rules \
+      $out/share/polkit-1/rules.d/50-crossmacro.rules
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    patchelf --add-needed libsystemd.so.0 $out/lib/crossmacro-daemon/CrossMacro.Daemon
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Privileged input daemon for CrossMacro";
+    homepage = "https://github.com/alper-han/CrossMacro";
+    changelog = "https://github.com/alper-han/CrossMacro/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "CrossMacro.Daemon";
+    maintainers = with lib.maintainers; [ alper-han ];
+  };
+}
diff --git a/pkgs/by-name/cr/crossmacro/deps.json b/pkgs/by-name/cr/crossmacro/deps.json
new file mode 100644
index 000000000000..6d172f70917d
--- /dev/null
+++ b/pkgs/by-name/cr/crossmacro/deps.json
@@ -0,0 +1,218 @@
+[
+  {
+    "pname": "Avalonia",
+    "version": "11.3.11",
+    "hash": "sha256-FSMuXVA5q5L5evwos5bIsuT81suO8FbCjEF3OvAL9p0="
+  }
+,
+  {
+    "pname": "Avalonia.Angle.Windows.Natives",
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
+  }
+,
+  {
+    "pname": "Avalonia.BuildServices",
+    "version": "11.3.2",
+    "hash": "sha256-6wx06tjSKWQOlX2czdp6Wh0nuwVapx5qf/s8Qj5we40="
+  }
+,
+  {
+    "pname": "Avalonia.Controls.ColorPicker",
+    "version": "11.3.11",
+    "hash": "sha256-Ki6O9HYbseQPV3DsvwmJ+ERimi/WmvzelNJDKP6loo0="
+  }
+,
+  {
+    "pname": "Avalonia.Desktop",
+    "version": "11.3.11",
+    "hash": "sha256-oFivO8/0rir4BwQsTeWs3bSnb7RmldwxYmI77j5pt8k="
+  }
+,
+  {
+    "pname": "Avalonia.Diagnostics",
+    "version": "11.3.11",
+    "hash": "sha256-p38+O0VDqZ8u5VOzImP21/U5wyP1BUp2UrLLc9HSfwE="
+  }
+,
+  {
+    "pname": "Avalonia.Fonts.Inter",
+    "version": "11.3.11",
+    "hash": "sha256-S0DWwcZHulVUIckiv2HM1Vbqno64c/Xt+mPhZp1tfsA="
+  }
+,
+  {
+    "pname": "Avalonia.FreeDesktop",
+    "version": "11.3.11",
+    "hash": "sha256-UE2/w9cw3YDzsw3HuhI2sTPy8reH9C71ufmHOpzvlSQ="
+  }
+,
+  {
+    "pname": "Avalonia.Native",
+    "version": "11.3.11",
+    "hash": "sha256-vw67lp/oOt+2lqdJ5PK2FY93jqPTcgZqOAXLtSXlJ8s="
+  }
+,
+  {
+    "pname": "Avalonia.Remote.Protocol",
+    "version": "11.3.11",
+    "hash": "sha256-l1f3rVygtI268llwbN0NvTDSfXwZE3CyRw8w5tbHBC4="
+  }
+,
+  {
+    "pname": "Avalonia.Skia",
+    "version": "11.3.11",
+    "hash": "sha256-89TGu50JfEVFo+QZgyOR0uOagC/xoJvqfnrHep3W/cc="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Fluent",
+    "version": "11.3.11",
+    "hash": "sha256-tiJ0xAFf0UVSH7LASPtg/7ils7+vZjw2UKBMydyUR3Q="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Simple",
+    "version": "11.3.11",
+    "hash": "sha256-AJS5Ls0tJ6PCr2mnr1PpxGWX4sII8mpe2R+VCFYRg44="
+  }
+,
+  {
+    "pname": "Avalonia.Win32",
+    "version": "11.3.11",
+    "hash": "sha256-6/NG4OrB/4YisXzJ51GPuq3uDn8oEUWyJRAqejyMCQw="
+  }
+,
+  {
+    "pname": "Avalonia.X11",
+    "version": "11.3.11",
+    "hash": "sha256-2fiQvKxU/r71UOAQgy0zwSHVCM2uG2sdEUhObd5TrQQ="
+  }
+,
+  {
+    "pname": "CommunityToolkit.Mvvm",
+    "version": "8.4.0",
+    "hash": "sha256-a0D550q+ffreU9Z+kQPdzJYPNaj1UjgyPofLzUg02ZI="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp",
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Linux",
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.macOS",
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Win32",
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
+  }
+,
+  {
+    "pname": "MicroCom.Runtime",
+    "version": "0.11.0",
+    "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection",
+    "version": "10.0.2",
+    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
+  }
+,
+  {
+    "pname": "Serilog",
+    "version": "4.3.0",
+    "hash": "sha256-jyIy4BjsyFXge3aO4GRFAdnX4/rz1MHfBkBDIpCDsTw="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Async",
+    "version": "2.1.0",
+    "hash": "sha256-LDoLpXkleD2MVPK2KBsLGRf5yqrwckBiAnYDbuIbaUM="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "6.1.1",
+    "hash": "sha256-CfIg4Us4kSMQAn6rU2rsAeE22g6MpFiZdhoZWySpZeY="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "7.0.0",
+    "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
+  }
+,
+  {
+    "pname": "SkiaSharp",
+    "version": "2.88.9",
+    "hash": "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux",
+    "version": "2.88.9",
+    "hash": "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux.NoDependencies",
+    "version": "2.88.9",
+    "hash": "sha256-WjpcM78Q6kaW0eU5iqDR5+fGcF+06/tawWHsJRK57Es="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.macOS",
+    "version": "2.88.9",
+    "hash": "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.WebAssembly",
+    "version": "2.88.9",
+    "hash": "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Win32",
+    "version": "2.88.9",
+    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
+  }
+,
+  {
+    "pname": "Tmds.DBus",
+    "version": "0.23.0",
+    "hash": "sha256-BwWQSqOOMS+Cf2fM8MIuiHey8QnGH4WvYjOn9haq5e0="
+  }
+,
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.21.2",
+    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+  }
+
+]
diff --git a/pkgs/by-name/cr/crossmacro/package.nix b/pkgs/by-name/cr/crossmacro/package.nix
new file mode 100644
index 000000000000..b076dd651952
--- /dev/null
+++ b/pkgs/by-name/cr/crossmacro/package.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  buildDotnetModule,
+  dotnetCorePackages,
+  fetchFromGitHub,
+  nix-update-script,
+  fontconfig,
+  freetype,
+  expat,
+  libx11,
+  libice,
+  libsm,
+  libxi,
+  libxcursor,
+  libxext,
+  libxrandr,
+  libxrender,
+  libxfixes,
+  libxtst,
+  libglvnd,
+  mesa,
+  wayland,
+  libxkbcommon,
+  glib,
+  icu,
+  openssl,
+  zlib,
+}:
+
+buildDotnetModule rec {
+  pname = "crossmacro";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "alper-han";
+    repo = "CrossMacro";
+    tag = "v${version}";
+    hash = "sha256-6Cc1mC34l+4dUPD1LAYxlXxzNF76l4HoOmbqTdTJVk0=";
+  };
+
+  projectFile = "src/CrossMacro.UI/CrossMacro.UI.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+
+  executables = [ "CrossMacro.UI" ];
+  buildType = "Release";
+
+  dotnetFlags = [
+    "-p:SelfContained=false"
+    "-p:Version=${version}"
+  ];
+
+  runtimeDeps = [
+    zlib
+    icu
+    openssl
+    fontconfig
+    freetype
+    expat
+    libx11
+    libice
+    libsm
+    libxi
+    libxcursor
+    libxext
+    libxrandr
+    libxrender
+    libxfixes
+    libxtst
+    glib
+    libglvnd
+    mesa
+    wayland
+    libxkbcommon
+  ];
+
+  postInstall = ''
+    install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
+
+    for size in 16 32 48 64 128 256 512; do
+      install -Dm644 src/CrossMacro.UI/Assets/icons/''${size}x''${size}/apps/crossmacro.png \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/crossmacro.png
+    done
+
+    install -Dm644 scripts/assets/io.github.alper-han.CrossMacro.metainfo.xml \
+      $out/share/metainfo/io.github.alper-han.CrossMacro.metainfo.xml
+
+    mkdir -p $out/bin
+    ln -sf $out/bin/CrossMacro.UI $out/bin/crossmacro
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cross-platform mouse and keyboard macro recorder and player";
+    homepage = "https://github.com/alper-han/CrossMacro";
+    changelog = "https://github.com/alper-han/CrossMacro/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "crossmacro";
+    maintainers = with lib.maintainers; [ alper-han ];
+  };
+}
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 0af0627dc876..a0ab5976cbfa 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -13,7 +13,7 @@
   # Enabling both withOneDNN and withOpenblas is broken
   # https://github.com/OpenNMT/CTranslate2/issues/1294
   withOneDNN ? false,
-  oneDNN,
+  onednn,
   withOpenblas ? true,
   openblas,
   withRuy ? true,
@@ -93,7 +93,7 @@ stdenv'.mkDerivation (finalAttrs: {
       cudaPackages.cudnn
     ]
     ++ lib.optionals withOneDNN [
-      oneDNN
+      onednn
     ]
     ++ lib.optionals withOpenblas [
       openblas
diff --git a/pkgs/by-name/dr/drawterm/package.nix b/pkgs/by-name/dr/drawterm/package.nix
index e9b98a9a5a7e..3b40b2d4f0d6 100644
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "0-unstable-2025-12-27";
+  version = "0-unstable-2026-01-11";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "ec862e9c8acd30ec73eb9e11b8e849ed5b711e76";
-    hash = "sha256-nFWOJnZKT5mr/Bf1r228v1Oexvy35bL2VS2JLPvJHp0=";
+    rev = "8a88fb5b8c75450d2e20ae1c7839d823bb1f6fad";
+    hash = "sha256-hejdFLYJvANKOC4Jgr9XvYl/5kU9PiKSH5cWE6d6e/o=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/du/dump1090-fa/package.nix b/pkgs/by-name/du/dump1090-fa/package.nix
index 681db8400e7e..71fc34cd2ca7 100644
--- a/pkgs/by-name/du/dump1090-fa/package.nix
+++ b/pkgs/by-name/du/dump1090-fa/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
+  fetchpatch2,
   pkg-config,
   hackrf,
   libbladeRF,
@@ -24,6 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-kTJ8FMugBRJaxWas/jEj4E5TmVnNpNdhq4r2YFFwgTU=";
   };
 
+  patches = [
+    # Fix compilation with GCC 15: https://github.com/flightaware/dump1090/pull/261
+    (fetchpatch2 {
+      url = "https://github.com/flightaware/dump1090/commit/93be1da123215e8ac15a0deaffedd480e8899f77.patch";
+      hash = "sha256-ehpMfLLEh1pMgvFAPg1JHo8XRlta+GvCIZsSXVPISLc=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/by-name/du/dumpvdl2/package.nix b/pkgs/by-name/du/dumpvdl2/package.nix
index 830518419310..b0577ff40ea3 100644
--- a/pkgs/by-name/du/dumpvdl2/package.nix
+++ b/pkgs/by-name/du/dumpvdl2/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dumpvdl2";
-  version = "2.5.1";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "szpajder";
     repo = "dumpvdl2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7UAw48BQttF+6J/nhg9zpoplRCtpTwjM1XB7DxM7Ymg=";
+    hash = "sha256-SSCPJ2D5JuMEEDG+8KYoequWCwRJcd6XwZAZSprShy8=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/dx/dxvk/setup_dxvk.sh b/pkgs/by-name/dx/dxvk/setup_dxvk.sh
index 529397ab2422..be0388df1425 100644
--- a/pkgs/by-name/dx/dxvk/setup_dxvk.sh
+++ b/pkgs/by-name/dx/dxvk/setup_dxvk.sh
@@ -145,7 +145,7 @@ export WINEDEBUG=-all
 export WINEDLLOVERRIDES="mscoree,mshtml="
 
 wine="wine"
-wine64="wine64"
+wine64="wine"
 wineboot="wineboot"
 
 # $PATH is the way for user to control where wine is located (including custom Wine versions).
diff --git a/pkgs/by-name/eb/ebusd/package.nix b/pkgs/by-name/eb/ebusd/package.nix
index c06cdd3280ca..904d26f25b32 100644
--- a/pkgs/by-name/eb/ebusd/package.nix
+++ b/pkgs/by-name/eb/ebusd/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ebusd";
-  version = "25.1";
+  version = "26.1";
 
   src = fetchFromGitHub {
     owner = "john30";
     repo = "ebusd";
     rev = version;
-    sha256 = "sha256-rj0Wkfk3Tpm58fbCUkgCdHt5MvW+tGgDyUd5COXfBc0=";
+    sha256 = "sha256-CmArhkJfxf8lL6FoHRQKjk/8ObfEy3Xef9DUtOVKRas=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/ente-web/package.nix b/pkgs/by-name/en/ente-web/package.nix
index 4f391c42b084..d02e60da6858 100644
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -1,9 +1,15 @@
 {
   lib,
   stdenv,
+  binaryen,
+  cargo,
   fetchFromGitHub,
   fetchYarnDeps,
   nodejs,
+  rustPlatform,
+  rustc,
+  wasm-bindgen-cli_0_2_106,
+  wasm-pack,
   yarnConfigHook,
   yarnBuildHook,
   nix-update-script,
@@ -19,43 +25,73 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web-${enteApp}";
-  version = "1.2.22";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
-    sparseCheckout = [ "web" ];
+    sparseCheckout = [
+      "rust"
+      "web"
+    ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-ckrACrgQ9qj6e44QifiUPtldBbDVrKv29s5oQ1Y+gvk=";
+    hash = "sha256-2f4A8RQFhXjPpHKvZACUmUcoukJ800yqTTMWBtLyIlI=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      cargoRoot
+      ;
+    hash = "sha256-dedLmQP15V+gAtycXx1fpWfjXWsTPLXPPcCIAcr/ME0=";
+  };
+  cargoRoot = "packages/wasm";
+
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-omFNobZ+2hb1cEO2Gfn+F3oYy7UDSrtIY4cliQ80CUs=";
+    hash = "sha256-H9ZNnbY22BddJl3SDhg+cEN0IaBZtilBFBDUf+zOzV0=";
   };
 
   nativeBuildInputs = [
     yarnConfigHook
     yarnBuildHook
+    binaryen
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+    rustc.llvmPackages.lld
     nodejs
+    wasm-bindgen-cli_0_2_106
+    wasm-pack
   ];
 
   # See: https://github.com/ente-io/ente/blob/main/web/apps/photos/.env
   env = extraBuildEnv;
 
-  # Replace hardcoded ente.io urls if desired
-  postPatch = lib.optionalString (enteMainUrl != null) ''
-    substituteInPlace \
-      apps/payments/src/services/billing.ts \
-      apps/photos/src/pages/shared-albums.tsx \
-      --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}
+  postPatch =
+    # Use our `wasm-pack` binary, rather than the Node version, which is
+    # just a wrapper that tries to download the actual binary
+    ''
+      substituteInPlace \
+        packages/wasm/package.json \
+        --replace-fail "wasm-pack " ${lib.escapeShellArg "${wasm-pack}/bin/wasm-pack "}
+    ''
+    # Replace hardcoded ente.io urls if desired
+    + lib.optionalString (enteMainUrl != null) ''
+      substituteInPlace \
+        apps/payments/src/services/billing.ts \
+        apps/photos/src/pages/shared-albums.tsx \
+        --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}
 
-    substituteInPlace \
-      apps/accounts/src/pages/index.tsx \
-      --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
-  '';
+      substituteInPlace \
+        apps/accounts/src/pages/index.tsx \
+        --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
+    '';
 
   yarnBuildScript = "build:${enteApp}";
   installPhase =
@@ -85,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       pinpox
       oddlama
+      nicegamer7
     ];
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 7ea80fb5a75a..9f34ddd41e0a 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.239";
+  version = "0.0.249";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-Sa+AVA8OdCQ5PGphs60zWnMkkEMm9CRyGT5Nsc5TX+M=";
+    hash = "sha256-M15AUk5x/vB6TpWVXueXGAChnlVvKCgrQxJb6tY2Y0M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/eq/equibop/node-modules.nix b/pkgs/by-name/eq/equibop/node-modules.nix
index b8e9d3fb67a0..5b630f0031a6 100644
--- a/pkgs/by-name/eq/equibop/node-modules.nix
+++ b/pkgs/by-name/eq/equibop/node-modules.nix
@@ -50,8 +50,8 @@ stdenvNoCC.mkDerivation {
 
   outputHash =
     {
-      x86_64-linux = "sha256-YqUAP11oSxfKifa8QL4VXGCWV5xGG2+vk60f4NdIXIA=";
-      aarch64-linux = "sha256-q7adhMY95g5BCcoiCVIwCpnqJAidE4a2cxGOjuE2YDk=";
+      x86_64-linux = "sha256-os/+0Xb3N1NMtTMP/G9bhELoQF3kDfqzuKUP5RcelJI=";
+      aarch64-linux = "sha256-EvHJQGtW62AOyMnWAEK0HsrwU875JrbMeqD+ctBEI3k=";
     }
     .${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 51163aad809b..8d8df583b91b 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "equibop";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "Equicord";
     repo = "Equibop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AzXBANUcm/DYYkNlO7q++/Dx826o5Hg/1cYJ84rMY0U=";
+    hash = "sha256-OcD4xcD/A48oJcsKuhYBc/UigK+1NfTEuJivL+qdfeA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fa/fail2ban/package.nix b/pkgs/by-name/fa/fail2ban/package.nix
index aac8c531e204..391b24b27f08 100644
--- a/pkgs/by-name/fa/fail2ban/package.nix
+++ b/pkgs/by-name/fa/fail2ban/package.nix
@@ -23,7 +23,17 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   outputs = [
     "out"
     "man"
-  ];
+  ]
+  # From some reason upstream installs documentation only for Linux, solaris,
+  # sunos and any gnu system.
+  ++ lib.optionals (lib.pipe stdenv.hostPlatform [
+    (lib.attrVals [
+      "isLinux"
+      "isSunOS"
+      "isGnu"
+    ])
+    (builtins.any lib.id)
+  ]) [ "doc" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -89,6 +99,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       rm $out/bin/fail2ban-python
       ln -s ${python3.interpreter} $out/bin/fail2ban-python
 
+      # Irrelevant for NixOS
+      rm -r $out/var
     ''
     + lib.optionalString stdenv.hostPlatform.isLinux ''
       # see https://github.com/NixOS/nixpkgs/issues/4968
diff --git a/pkgs/by-name/fa/famly-fetch/package.nix b/pkgs/by-name/fa/famly-fetch/package.nix
index 8562baa142a8..c1b05c804076 100644
--- a/pkgs/by-name/fa/famly-fetch/package.nix
+++ b/pkgs/by-name/fa/famly-fetch/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "famly-fetch";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jacobbunk";
     repo = "famly-fetch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ua2g+YGzMHfMGZrOSKzeqdT/ppanZZWJHjrRxfwVDmE=";
+    hash = "sha256-uyLGBNV+GiYNqy4wWxPNx/xQL0lnMsIHfPIlaIu85HA=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ff/ffizer/package.nix b/pkgs/by-name/ff/ffizer/package.nix
index 39d29d444e2d..a0067b7fd95d 100644
--- a/pkgs/by-name/ff/ffizer/package.nix
+++ b/pkgs/by-name/ff/ffizer/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ffizer";
-  version = "2.13.6";
+  version = "2.13.7";
 
   buildFeatures = [ "cli" ];
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "ffizer";
     repo = "ffizer";
     rev = finalAttrs.version;
-    hash = "sha256-1UKXUcoAFQymz1J4oLH8Bwqxby8d+fhcFFYbfQBwTeo=";
+    hash = "sha256-r4jaqjHYDZxftU7J6hGMXW/Oq+8biy9bFoHIOt33ta8=";
   };
 
-  cargoHash = "sha256-+0d2cnRso6M4qhtdb3fk4AZ7vsDl49Ycly98xybaZRg=";
+  cargoHash = "sha256-+aXhumywpcynKz0R0wWPWhEMfqiPBuwLbIFsABvWTnA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/fl/flacon/package.nix b/pkgs/by-name/fl/flacon/package.nix
index c592c8432c9d..594f25869473 100644
--- a/pkgs/by-name/fl/flacon/package.nix
+++ b/pkgs/by-name/fl/flacon/package.nix
@@ -14,7 +14,7 @@
   taglib,
   wavpack,
   vorbisgain,
-  monkeysAudio,
+  monkeys-audio,
   sox,
   gtk3,
   libsForQt5,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     mp3gain
     lame
     wavpack
-    monkeysAudio
+    monkeys-audio
     vorbisgain
     sox
   ];
diff --git a/pkgs/by-name/ge/gelly/package.nix b/pkgs/by-name/ge/gelly/package.nix
index 8eb615193ebc..354fe5800892 100644
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TU2WI927ECSqbvIcQbxSLXLxmos4pxqPuDV7LCOY2bY=";
+    hash = "sha256-FMkn5yNfMdQyKXFz9oBgvbPrwpjPrsssoU4MAmPsIdQ=";
   };
 
-  cargoHash = "sha256-rgKvfOsP85THalkr412aLOxl6gmFKPpBann1i9BEB20=";
+  cargoHash = "sha256-wjb3GWl7mXn3aM/gqcmK6uM/odGylRs9jwotxqHo0QQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gh/ghorg/package.nix b/pkgs/by-name/gh/ghorg/package.nix
index 4ac360383b2f..920a4b293c34 100644
--- a/pkgs/by-name/gh/ghorg/package.nix
+++ b/pkgs/by-name/gh/ghorg/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghorg";
-  version = "1.11.8";
+  version = "1.11.9";
 
   src = fetchFromGitHub {
     owner = "gabrie30";
     repo = "ghorg";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Co6TR60RfY24y/FZkdBQUvXtE19Il0KASbkDSe/e3Bw=";
+    sha256 = "sha256-rbbPa1svbGOrjWepPpZyTU+NHdwR2A2nkI1HA/UOhnI=";
   };
 
   doCheck = false;
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index b5982a605336..a65002d09af3 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.234.0";
+  version = "2.237.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-kj7KCgk4s9Ua//UPGXBh3pI91FTGC90bqMdUrvH4Bhc=";
+    hash = "sha256-udko0oiO5tLEDBKxkGiTRU0Qd/Yd0bvPB6iPM5wJ7Ls=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-FA5T95nii7pk36YwQQVMSJAvKgOWKFbGwKeyCuygDIQ=";
+  npmDepsHash = "sha256-2j/u++63qaOzvsgdhWeDsH+TUVmOLvgQQRNY14LZI2k=";
 
   nativeBuildInputs = [
     prisma_6
diff --git a/pkgs/by-name/gi/git-latexdiff/package.nix b/pkgs/by-name/gi/git-latexdiff/package.nix
index 34f5a33b5e69..69acfd533d9e 100644
--- a/pkgs/by-name/gi/git-latexdiff/package.nix
+++ b/pkgs/by-name/gi/git-latexdiff/package.nix
@@ -2,46 +2,61 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  git,
-  bash,
+  installShellFiles,
+  asciidoc,
+  makeBinaryWrapper,
+  coreutils,
+  gnused,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.0";
+  version = "1.7.1";
   pname = "git-latexdiff";
 
   src = fetchFromGitLab {
-    hash = "sha256-DMoGEbCBuqUGjbna3yDpD4WNTikPudYRD4Wy1pPG2mw=";
-    rev = finalAttrs.version;
     repo = "git-latexdiff";
     owner = "git-latexdiff";
+    tag = finalAttrs.version;
+    hash = "sha256-ocEDds1vAnaj84YiAez150OZV82w3NlsgXoxNbUGW/Q=";
   };
 
-  buildInputs = [
-    git
-    bash
-  ];
-
-  dontBuild = true;
-
-  patches = [ ./version-test.patch ];
-
   postPatch = ''
     substituteInPlace git-latexdiff \
-      --replace "@GIT_LATEXDIFF_VERSION@" "v${finalAttrs.version}"
+      --replace-fail "@GIT_LATEXDIFF_VERSION@" "v${finalAttrs.version}"
     patchShebangs git-latexdiff
   '';
 
+  nativeBuildInputs = [
+    installShellFiles
+    asciidoc
+    makeBinaryWrapper
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  dontBuild = true;
+
   installPhase = ''
-    mkdir -p $prefix/bin
-    mv git-latexdiff $prefix/bin
-    chmod +x $prefix/bin/git-latexdiff
+    installBin git-latexdiff
+    wrapProgram ''${!outputBin}/bin/git-latexdiff \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          gnused
+        ]
+      }
+    make git-latexdiff.1
+    installManPage git-latexdiff.1
   '';
 
   meta = {
     description = "View diff on LaTeX source files on the generated PDF files";
     homepage = "https://gitlab.com/git-latexdiff/git-latexdiff";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ doronbehar ];
     license = lib.licenses.bsd3; # https://gitlab.com/git-latexdiff/git-latexdiff/issues/9
     platforms = lib.platforms.unix;
     mainProgram = "git-latexdiff";
diff --git a/pkgs/by-name/gi/git-latexdiff/version-test.patch b/pkgs/by-name/gi/git-latexdiff/version-test.patch
deleted file mode 100644
index 243bd90f9005..000000000000
--- a/pkgs/by-name/gi/git-latexdiff/version-test.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Fix for https://gitlab.com/git-latexdiff/git-latexdiff/issues/7
----
---- src/git-latexdiff	2016-01-26 14:04:54.338568955 +0100
-+++ src/git-latexdiff	2016-01-26 14:40:23.700381943 +0100
-@@ -44,11 +44,7 @@
- git_latexdiff_version='@GIT_LATEXDIFF_VERSION@'
-
- git_latexdiff_compute_version () {
--    if [ "$git_latexdiff_version" = '@GIT_LATEXDIFF''_VERSION@' ]; then
--	(cd "$(dirname "$0")" && git describe --tags HEAD 2>/dev/null || echo 'Unknown version')
--    else
--	echo "$git_latexdiff_version"
--    fi
-+    echo "$git_latexdiff_version"
- }
-
- usage () {
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index b11c252b5597..37e41e5852fe 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "0.0.400";
+  version = "0.0.406";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@github/copilot/-/copilot-${finalAttrs.version}.tgz";
-    hash = "sha256-TZDeDmN2GF0a4KFOHt+oXn4IXDRl+OwvlEkBefNR3io=";
+    hash = "sha256-APjQW8YDoIO+Q2D5SkH0KI4u+w5mAF3VfEk/Yda2/54=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index 396e15cb3170..588dcecb49a1 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "0.29.0";
+  version = "0.30.3";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-diL1aIVxsR1Bl+HeWuZiFe3s9Xt4B6jYW8PBkBZu+Kk=";
+    hash = "sha256-RqTwii79h7Kk1bpJT1uGG2ODZE5DtROZZyMDKvH3jmo=";
   };
 
-  vendorHash = "sha256-q4Fy/dfnzLuMuZ27KO3MogGP/XdJbmOUISBkoTNPUUk=";
+  vendorHash = "sha256-rv7mZQ2/j4R9s3p+Psq5E2I99zFtnieGc3eaMT3ykqQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gonic/package.nix b/pkgs/by-name/go/gonic/package.nix
index 11b4564f920b..e5470be8825b 100644
--- a/pkgs/by-name/go/gonic/package.nix
+++ b/pkgs/by-name/go/gonic/package.nix
@@ -20,15 +20,15 @@
 
 buildGoModule rec {
   pname = "gonic";
-  version = "0.20.0";
+  version = "0.20.1";
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = "gonic";
     rev = "v${version}";
-    sha256 = "sha256-llNKCxVrsDmi5a33NoAPEyJu+728gFQcAItPk2IBdwo=";
+    sha256 = "sha256-tW+GuNMMeiPf5XInR1BN2L7ommWh1SPClbRew8/2+cA=";
   };
 
-  vendorHash = "sha256-uVZ0Q1nrE7DLurW4fldsr3yyz80J6ONiPjLXHXHDGlg=";
+  vendorHash = "sha256-ynoIR4S02v3qec7447feuu/igFWR20VQVbL0GbTBpqM=";
 
   # TODO(Profpatsch): write a test for transcoding support,
   # since it is prone to break
diff --git a/pkgs/by-name/go/google-clasp/package.nix b/pkgs/by-name/go/google-clasp/package.nix
index 8c14181a2f92..71117e6a036d 100644
--- a/pkgs/by-name/go/google-clasp/package.nix
+++ b/pkgs/by-name/go/google-clasp/package.nix
@@ -2,29 +2,20 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 buildNpmPackage rec {
   pname = "clasp";
-  version = "3.1.3";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "clasp";
     tag = "v${version}";
-    hash = "sha256-Pxt3MaDDsk/qq3NSuwG3jOoPthwrL0QelaruoC37hfA=";
+    hash = "sha256-JLfkGxUHvde5RXlIWH+raBvTwqvpHOR/ul4yArLFj28=";
   };
 
-  patches = [
-    # https://github.com/google/clasp/pull/1112
-    (fetchpatch {
-      url = "https://github.com/google/clasp/commit/b183d4b5fbdb51f7bc2e3edadf5fd3bbff28bad1.patch";
-      hash = "sha256-lnC7DfKsV4E5guxbjZ+WfkLj5wDLYwObPtH21dmFUcc=";
-    })
-  ];
-
-  npmDepsHash = "sha256-IyFcGcT3ceoaaf2sCPriEIoWPavg+YGsvkxr1MkLj5c=";
+  npmDepsHash = "sha256-dT0HA21wvU+wP5/9juMYinY60Fq5ngWl5dgj0JJi9hM=";
 
   # `npm run build` tries installing clasp globally
   npmBuildScript = [ "compile" ];
diff --git a/pkgs/by-name/go/goverlay/package.nix b/pkgs/by-name/go/goverlay/package.nix
index 408fe7b02114..65bad84795ef 100644
--- a/pkgs/by-name/go/goverlay/package.nix
+++ b/pkgs/by-name/go/goverlay/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goverlay";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "goverlay";
     tag = finalAttrs.version;
-    hash = "sha256-XZ8C556ufBI58Ai2v2sjIwjqoF0zqL8DOEQwbMuik/k=";
+    hash = "sha256-30Z2d7w8VStusJFvaTT3IcA3KH3jCyV7ibDOuOFPutQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gr/grpc_cli/package.nix b/pkgs/by-name/gr/grpc_cli/package.nix
index 2056961e47c9..57fa3862008f 100644
--- a/pkgs/by-name/gr/grpc_cli/package.nix
+++ b/pkgs/by-name/gr/grpc_cli/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc_cli";
-  version = "1.76.0";
+  version = "1.78.0";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f25ccZC0pJw00ETgxBtXU6+0OnlJsV7zXjK/ayiCIJY=";
+    hash = "sha256-hupso9w++lYtAMoLS/qVmUYqZyQAX3rH0I8zCLyBo40=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hc/hcxdumptool/package.nix b/pkgs/by-name/hc/hcxdumptool/package.nix
index b55df7c76481..146356b7c178 100644
--- a/pkgs/by-name/hc/hcxdumptool/package.nix
+++ b/pkgs/by-name/hc/hcxdumptool/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hcxdumptool";
-  version = "7.1.0";
+  version = "7.1.2";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = "hcxdumptool";
     tag = finalAttrs.version;
-    hash = "sha256-54gKvOcmNxMND1iXJCgwtwT+PYntukVKtdT4dLwOOpI=";
+    hash = "sha256-dEmjzduVN5QhFRhj2bs2KTGH4e8DIiDSrs4vwznvkRA=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/hc/hcxtools/package.nix b/pkgs/by-name/hc/hcxtools/package.nix
index adfce387a595..302c75079269 100644
--- a/pkgs/by-name/hc/hcxtools/package.nix
+++ b/pkgs/by-name/hc/hcxtools/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hcxtools";
-  version = "7.1.0";
+  version = "7.1.2";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = "hcxtools";
     rev = finalAttrs.version;
-    sha256 = "sha256-wfLeHL9xqHAkWPodrz7+dDcLcylwVrS6Kes5meV4UDM=";
+    sha256 = "sha256-v33RpDKA4OeUU4YXXWhHpdlqQvxk4HIWQKCPskdTSTU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/he/heptabase/package.nix b/pkgs/by-name/he/heptabase/package.nix
index cb2ac955195f..2959509d2b8c 100644
--- a/pkgs/by-name/he/heptabase/package.nix
+++ b/pkgs/by-name/he/heptabase/package.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "heptabase";
-  version = "1.83.4";
+  version = "1.83.7";
   src = fetchurl {
     url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-XQELvBRTq5vaf6mDI5ywkH3GgV5gvDqKGDbbYZR1abQ=";
+    hash = "sha256-inwkvv6wQIhp34z1FjpfwjRW1NsYXa8vsxukMb+RuTo=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/hi/highscore-mgba/package.nix b/pkgs/by-name/hi/highscore-mgba/package.nix
index eb5f9f4774d9..f629fe2e9f0b 100644
--- a/pkgs/by-name/hi/highscore-mgba/package.nix
+++ b/pkgs/by-name/hi/highscore-mgba/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "highscore-mgba";
-  version = "0-unstable-2026-01-29";
+  version = "0-unstable-2026-02-03";
 
   src = fetchFromGitHub {
     owner = "highscore-emu";
     repo = "mgba";
-    rev = "9727cd743a0e647913a024d57a535e8cbb4dc0f7";
-    hash = "sha256-2cwoRXW8IjA1ojsuDRdNlrzPdbqIs2g2qyTXF4nMhWs=";
+    rev = "178d7dbe3c2927f2fc52a6032bc7b6c805192e9b";
+    hash = "sha256-AXOe2YoYQDeRpicYD9B9BR2l0rCJ+syYTwTnJUIcG1U=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/hm/hmcl/0001-nix-use-terracotta-from-nix.patch b/pkgs/by-name/hm/hmcl/0001-nix-use-terracotta-from-nix.patch
new file mode 100644
index 000000000000..8bb7103962d6
--- /dev/null
+++ b/pkgs/by-name/hm/hmcl/0001-nix-use-terracotta-from-nix.patch
@@ -0,0 +1,52 @@
+From ff7e9316ae220c002cc6d3cced0ae0786bcd0392 Mon Sep 17 00:00:00 2001
+From: Moraxyc <i@qaq.li>
+Date: Wed, 4 Feb 2026 15:36:17 +0800
+Subject: [PATCH 1/2] nix: use terracotta from nix
+
+---
+ .../hmcl/terracotta/TerracottaBundle.java     | 21 +++----------------
+ 1 file changed, 3 insertions(+), 18 deletions(-)
+
+diff --git a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
+index 727edde9b..5b6e8b02f 100644
+--- a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
++++ b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
+@@ -139,26 +139,11 @@ public final class TerracottaBundle {
+     }
+ 
+     public Path locate(String file) {
+-        FileDownloadTask.IntegrityCheck check = files.get(file);
+-        if (check == null) {
+-            throw new AssertionError(String.format("Expecting %s file in terracotta bundle.", file));
+-        }
+-        return root.resolve(file).toAbsolutePath();
++        return Path.of("@TERRACOTTA_BIN@");
+     }
+ 
+     public AbstractTerracottaProvider.Status status() throws IOException {
+-        if (Files.exists(root) && isLocalBundleValid()) {
+-            return AbstractTerracottaProvider.Status.READY;
+-        }
+-
+-        try {
+-            if (TerracottaMetadata.hasLegacyVersionFiles()) {
+-                return AbstractTerracottaProvider.Status.LEGACY_VERSION;
+-            }
+-        } catch (IOException e) {
+-            Logger.LOG.warning("Cannot determine whether legacy versions exist.", e);
+-        }
+-        return AbstractTerracottaProvider.Status.NOT_EXIST;
++        return AbstractTerracottaProvider.Status.READY;
+     }
+ 
+     private boolean isLocalBundleValid() throws IOException { // FIXME: Make control flow clearer.
+@@ -188,4 +173,4 @@ public final class TerracottaBundle {
+         }
+         return true;
+     }
+-}
++}
+\ No newline at end of file
+-- 
+2.52.0
+
diff --git a/pkgs/by-name/hm/hmcl/0003-nix-skip-terracotta-existence-check-on-darwin.patch b/pkgs/by-name/hm/hmcl/0002-nix-skip-terracotta-existence-check-on-darwin.patch
similarity index 65%
rename from pkgs/by-name/hm/hmcl/0003-nix-skip-terracotta-existence-check-on-darwin.patch
rename to pkgs/by-name/hm/hmcl/0002-nix-skip-terracotta-existence-check-on-darwin.patch
index 1df97fffc3d0..4100426ede5b 100644
--- a/pkgs/by-name/hm/hmcl/0003-nix-skip-terracotta-existence-check-on-darwin.patch
+++ b/pkgs/by-name/hm/hmcl/0002-nix-skip-terracotta-existence-check-on-darwin.patch
@@ -1,27 +1,27 @@
-From bcf95a23380424f2ca82649d93e9e0bdf8274b74 Mon Sep 17 00:00:00 2001
+From 110289f39d01713de5f8cd1e7146a36de8c35308 Mon Sep 17 00:00:00 2001
 From: Moraxyc <i@qaq.li>
-Date: Fri, 31 Oct 2025 14:23:54 +0800
-Subject: [PATCH 3/3] nix: skip terracotta existence check on darwin
+Date: Wed, 4 Feb 2026 15:40:50 +0800
+Subject: [PATCH 2/2] nix: skip terracotta existence check on darwin
 
 ---
  .../org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java | 4 ----
  1 file changed, 4 deletions(-)
 
 diff --git a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java
-index 00626f8b6..59125962d 100644
+index 83debfc0a..fd4f851a7 100644
 --- a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java
 +++ b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java
-@@ -45,10 +45,6 @@ public final class MacOSProvider implements ITerracottaProvider {
-     public Status status() throws IOException {
-         assert binary != null;
+@@ -44,10 +44,6 @@ public final class MacOSProvider extends AbstractTerracottaProvider {
  
+     @Override
+     public Status status() throws IOException {
 -        if (!Files.exists(Path.of("/Applications/terracotta.app"))) {
 -            return Status.NOT_EXIST;
 -        }
 -
-         return binary.status();
+         return bundle.status();
      }
  
 -- 
-2.51.0
+2.52.0
 
diff --git a/pkgs/by-name/hm/hmcl/0002-nix-use-terracotta-from-nix.patch b/pkgs/by-name/hm/hmcl/0002-nix-use-terracotta-from-nix.patch
deleted file mode 100644
index 651759ce63f0..000000000000
--- a/pkgs/by-name/hm/hmcl/0002-nix-use-terracotta-from-nix.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 541d055bf55703aa9e2c5a5e04a397f1d25efe28 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Wed, 29 Oct 2025 00:09:56 +0800
-Subject: [PATCH 2/3] nix: use terracotta from nix
-
----
- .../org/jackhuang/hmcl/terracotta/TerracottaNative.java   | 8 +++-----
- 1 file changed, 3 insertions(+), 5 deletions(-)
-
-diff --git a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaNative.java b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaNative.java
-index 079537978..68954b09e 100644
---- a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaNative.java
-+++ b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaNative.java
-@@ -47,7 +47,7 @@ public final class TerracottaNative {
- 
-     public TerracottaNative(List<URI> links, Path path, FileDownloadTask.IntegrityCheck checking) {
-         this.links = links;
--        this.path = path;
-+        this.path = Path.of("@TERRACOTTA_BIN@");
-         this.checking = checking;
-     }
- 
-@@ -130,9 +130,7 @@ public final class TerracottaNative {
- 
-     public ITerracottaProvider.Status status() throws IOException {
-         if (Files.exists(path)) {
--            if (DigestUtils.digestToString(checking.getAlgorithm(), path).equalsIgnoreCase(checking.getChecksum())) {
--                return ITerracottaProvider.Status.READY;
--            }
-+            return ITerracottaProvider.Status.READY;
-         }
- 
-         try {
-@@ -144,4 +142,4 @@ public final class TerracottaNative {
-         }
-         return ITerracottaProvider.Status.NOT_EXIST;
-     }
--}
-+}
-\ No newline at end of file
--- 
-2.51.0
-
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index aa7a55dd59d2..1679c8df3e08 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.9.2";
+  version = "3.10.2";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-/thuAsPadixV2vkez3w9yhkDdpJra54WkhFYaeKH0GU=";
+    hash = "sha256-tmQN0kSjm8oU36ENHhgA649IohdG4ZDHyEaMPscd3nQ=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for
@@ -63,38 +63,38 @@ stdenv.mkDerivation (finalAttrs: {
   #   Terracotta downloads, package them into a patch jar that overrides
   #   the original classes, and have it load the original jar. This preserves
   #   the original jar’s integrity check and avoids modifying the upstream jar.
-  terracottaNativeJava = fetchurl {
-    name = "hmcl-terracotta-native-java-${finalAttrs.version}";
-    url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.terracottaNativeJavaPath}";
-    hash = "sha256-sg8gBOMNdITmHeYByYriYp05ja1vtWPF/wuqdGmkgiA=";
+  terracottaBundleJava = fetchurl {
+    name = "hmcl-terracotta-bundle-java-${finalAttrs.version}";
+    url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.terracottaBundleJavaPath}";
+    hash = "sha256-QXjo/NiYQyJfan15hnvJlBir9s9R6H+jHsr+K9M1oTw=";
   };
   macOSProviderJava = fetchurl {
     name = "hmcl-macos-provider-java-${finalAttrs.version}";
     url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.macOSProviderJavaPath}";
-    hash = "sha256-V8FNPPkq6/P3/HKcqKkAy6Ya1kUI3oEMfjEc8XdExgo=";
+    hash = "sha256-+Zji2B8ksT7P+IObyrM9q7vHPJVl5ZtH+v/J8Mfr0Q4=";
   };
-  terracottaNativeJavaPath = "HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaNative.java";
+  terracottaBundleJavaPath = "HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java";
   macOSProviderJavaPath = "HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java";
 
   dontUnpack = true;
 
   prePatch = ''
-    install -Dm644 $terracottaNativeJava $terracottaNativeJavaPath
+    install -Dm644 $terracottaBundleJava $terracottaBundleJavaPath
     install -Dm644 $macOSProviderJava $macOSProviderJavaPath
   '';
 
   patches = [
-    (replaceVars ./0002-nix-use-terracotta-from-nix.patch {
+    (replaceVars ./0001-nix-use-terracotta-from-nix.patch {
       TERRACOTTA_BIN = lib.getExe terracotta;
     })
-    ./0003-nix-skip-terracotta-existence-check-on-darwin.patch
+    ./0002-nix-skip-terracotta-existence-check-on-darwin.patch
   ];
 
   buildPhase = ''
     runHook preBuild
 
     # Build only classes we modified
-    javac -cp $src -d out $terracottaNativeJavaPath $macOSProviderJavaPath
+    javac -cp $src -d out $terracottaBundleJavaPath $macOSProviderJavaPath
 
     # Extract MANIFEST.MF from original jar
     # We need Main-Class, Add-Opens, etc
diff --git a/pkgs/by-name/hm/hmcl/update.nix b/pkgs/by-name/hm/hmcl/update.nix
index 1f65d2578cec..351702bae382 100644
--- a/pkgs/by-name/hm/hmcl/update.nix
+++ b/pkgs/by-name/hm/hmcl/update.nix
@@ -35,7 +35,7 @@ writeShellApplication {
     fi
 
     nix-update hmcl --version="$version"
-    update-source-version hmcl --source-key=terracottaNativeJava --ignore-same-version
+    update-source-version hmcl --source-key=terracottaBundleJava --ignore-same-version
     update-source-version hmcl --source-key=macOSProviderJava --ignore-same-version
   '';
 }
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index 33f017d65713..609f7972f528 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "26.1.0-0";
+  version = "26.1.1-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-ReLp+KxYzWmLWiCty/tgq9BNDF0iSDgoTHC6ExMaR2w=";
+          hash = "sha256-O+LJFg7js0anQxKzruVuaWO4JE6M70Gcq8TowejWLIc=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-MRDgJSHPQ4gRwKj6jOhWZRFq/opd1RPT0xPhKBYEjbI=";
+          hash = "sha256-yF1fyk++CigS/sD2qttM3e2H4Dxq0wXM6be32egl0t0=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-v99TjjDVqALwHhQjjZW1+/3FAR+kTb7Oj7udeewK/6Y=";
+          hash = "sha256-IoK+bLGox/9To3EzR1pk/ku/e+nm1PDpvz/5b59csu8=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/hx/hxtools/package.nix b/pkgs/by-name/hx/hxtools/package.nix
index deef21e399f1..a8ff6ac6d242 100644
--- a/pkgs/by-name/hx/hxtools/package.nix
+++ b/pkgs/by-name/hx/hxtools/package.nix
@@ -7,7 +7,7 @@
   bash,
   perl,
   perlPackages,
-  libHX,
+  libhx,
   nix-update-script,
 }:
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Perl and Bash are pulled to make patchShebangs work.
     perl
     bash
-    libHX
+    libhx
   ]
   ++ (with perlPackages; [ TextCSV_XS ]);
 
diff --git a/pkgs/by-name/i2/i2pd/package.nix b/pkgs/by-name/i2/i2pd/package.nix
index 65f0424b4d93..28fcc1e92e80 100644
--- a/pkgs/by-name/i2/i2pd/package.nix
+++ b/pkgs/by-name/i2/i2pd/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2pd";
-  version = "2.58.0";
+  version = "2.59.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = "i2pd";
     tag = finalAttrs.version;
-    hash = "sha256-moUcivW3YIE2SvjS7rCXTjeCKUW/u/NXWH3VmJ9x6jg=";
+    hash = "sha256-PBwjP54gVtMduN//OXxd35KnRJv7sbA1MIUU+1KNUac=";
   };
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
diff --git a/pkgs/by-name/im/imsprog/package.nix b/pkgs/by-name/im/imsprog/package.nix
index 5772d44c8af9..63678303c20a 100644
--- a/pkgs/by-name/im/imsprog/package.nix
+++ b/pkgs/by-name/im/imsprog/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imsprog";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "bigbigmdm";
     repo = "IMSProg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KOtInfdMbBeW4oeQrKR8uK7nEsiS1NHrg/kW9nyKKNI=";
+    hash = "sha256-+poPHy1q7lWuXgSvpbBpwVzRcXhYR8xjy3cs9nHExJo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/in/inih/package.nix b/pkgs/by-name/in/inih/package.nix
index a852a46aaa57..63ea1f9c9816 100644
--- a/pkgs/by-name/in/inih/package.nix
+++ b/pkgs/by-name/in/inih/package.nix
@@ -32,7 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/benhoyt/inih";
     changelog = "https://github.com/benhoyt/inih/releases/tag/r${finalAttrs.version}";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ TredwellGit ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/ip/ipgrep/package.nix b/pkgs/by-name/ip/ipgrep/package.nix
index c3f99ee71ca3..00d47caca389 100644
--- a/pkgs/by-name/ip/ipgrep/package.nix
+++ b/pkgs/by-name/ip/ipgrep/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ipgrep";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "ipgrep";
     rev = finalAttrs.version;
-    hash = "sha256-NrhcUFQM+L66KaDRRpAoC+z5s54a+1fqEepTRXVZ5Qs=";
+    hash = "sha256-4Fa0fqd8S6yZmUzHlgkUWgYZhAbf48zZhzq4Fx3MS5A=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/ip/iptsd/package.nix b/pkgs/by-name/ip/iptsd/package.nix
index d40cb5b42910..eecabac7b8df 100644
--- a/pkgs/by-name/ip/iptsd/package.nix
+++ b/pkgs/by-name/ip/iptsd/package.nix
@@ -6,11 +6,13 @@
   meson,
   ninja,
   pkg-config,
+  cairomm,
   cli11,
   eigen,
   hidrd,
   inih,
   microsoft-gsl,
+  sdl2-compat,
   spdlog,
   systemd,
   udevCheckHook,
@@ -38,11 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
   dontUseCmakeConfigure = true;
 
   buildInputs = [
+    cairomm
     cli11
     eigen
     hidrd
     inih
     microsoft-gsl
+    sdl2-compat
     spdlog
     systemd
   ];
@@ -63,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
   mesonFlags = [
     "-Dservice_manager=systemd"
     "-Dsample_config=false"
-    "-Ddebug_tools="
     "-Db_lto=false" # plugin needed to handle lto object -> undefined reference to ...
   ];
 
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index 606b7bfe4e5b..ade7dae5be4b 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2026-01-01";
+  version = "0-unstable-2026-02-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "0e0aeca3c6980fabe2b8d2eec934517bfcc1acc7";
-    hash = "sha256-9FQjQ/0ee/dBKGsh/DYizkZZSy1/MwkVJ3ZqLK53x9g=";
+    rev = "ae3c1d0dcba155bdc984f057061f2f8008fb6e38";
+    hash = "sha256-H2TjUbZApQT12G/Rec+Y8eqRyJNMO5Tv4xTSmGSn6gE=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/js/jsoncons/package.nix b/pkgs/by-name/js/jsoncons/package.nix
index 0b92bd2cdf2a..622c0cfa656a 100644
--- a/pkgs/by-name/js/jsoncons/package.nix
+++ b/pkgs/by-name/js/jsoncons/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  env.NIX_CFLAGS_COMPILE = "-std=c++20 -Wno-error";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-overlap-compare";
 
   meta = {
     description = "C++, header-only library for constructing JSON and JSON-like data formats";
diff --git a/pkgs/by-name/ki/kitex/package.nix b/pkgs/by-name/ki/kitex/package.nix
index 8b238db72df8..503fd144942a 100644
--- a/pkgs/by-name/ki/kitex/package.nix
+++ b/pkgs/by-name/ki/kitex/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kitex";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "cloudwego";
     repo = "kitex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jNrFW7VsKzoKDk0ylF/YU2n3UbpfyVuhYV8dhmEmAA0=";
+    hash = "sha256-61VZ+eqAfxra5dEJ1MDwmLDuykEoVT07rPbMXcqZ/7o=";
   };
 
   vendorHash = "sha256-xsyfOuovG7LHcRMrtkT02DOp/L96M309QMiPLE24y9k=";
diff --git a/pkgs/by-name/kl/klog-time-tracker/package.nix b/pkgs/by-name/kl/klog-time-tracker/package.nix
index 599de8db3169..bf3120d8afc0 100644
--- a/pkgs/by-name/kl/klog-time-tracker/package.nix
+++ b/pkgs/by-name/kl/klog-time-tracker/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "klog-time-tracker";
-  version = "6.6";
+  version = "7.0";
 
   src = fetchFromGitHub {
     owner = "jotaen";
     repo = "klog";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Tq780+Gsu2Ym9+DeMpaOhsP2XluyKBh01USnmwlYsTs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Lr9MLEodp+lZSXvRRGnEC74ws3pyxVWxjKgguy3ydZ8=";
   };
 
-  vendorHash = "sha256-ilV/+Xogy4+5c/Rs0cCSvVTgDhL4mm9V/pxJB3XGDkw=";
+  vendorHash = "sha256-zaQzDmF9m7pHpOzYxcrQ8loIclM2bWv5W3/9icgvUEY=";
 
   meta = {
     description = "Command line tool for time tracking in a human-readable, plain-text file format";
diff --git a/pkgs/by-name/km/kmscon/package.nix b/pkgs/by-name/km/kmscon/package.nix
index 61a5d5e7ae97..5723f7bc1568 100644
--- a/pkgs/by-name/km/kmscon/package.nix
+++ b/pkgs/by-name/km/kmscon/package.nix
@@ -12,6 +12,7 @@
   pango,
   pkg-config,
   docbook_xsl,
+  docbook_xml_dtd_42,
   libxslt,
   libgbm,
   ninja,
@@ -23,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kmscon";
-  version = "9.3.0";
+  version = "9.3.1";
 
   src = fetchFromGitHub {
     owner = "kmscon";
     repo = "kmscon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vdM/3n3Y2FM+PLDgVuU10kkNLCSzTrFI35CaY5NxWks=";
+    hash = "sha256-pH+dBcUKXrVh9/y6mNWmYBx6HVbuSZX/F2sCG/Yj5UQ=";
   };
 
   strictDeps = true;
@@ -60,10 +61,23 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt # xsltproc
   ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   patches = [
     ./sandbox.patch # Generate system units where they should be (nix store) instead of /etc/systemd/system
   ];
 
+  postPatch = ''
+    for i in ./docs/man/*.in; do
+      substituteInPlace "''${i}" \
+        --replace-fail "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" \
+                       "${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd"
+    done
+  '';
+
   passthru = {
     tests.kmscon = nixosTests.kmscon;
     updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
@@ -73,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "KMS/DRM based System Console";
     mainProgram = "kmscon";
     homepage = "https://www.freedesktop.org/wiki/Software/kmscon/";
+    changelog = "https://github.com/kmscon/kmscon/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ko/kokkos/package.nix b/pkgs/by-name/ko/kokkos/package.nix
index af4f7a0090d1..94793a80ea1e 100644
--- a/pkgs/by-name/ko/kokkos/package.nix
+++ b/pkgs/by-name/ko/kokkos/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kokkos";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "kokkos";
     repo = "kokkos";
     rev = finalAttrs.version;
-    hash = "sha256-Lsdx8Jnh3t1fbG2kok9oGfNGsNiHrjEx7cNLFikgMMw=";
+    hash = "sha256-KoTshYKiDiYb2VKyo7C9pzi6SdpoCOjObwI9o4fr91c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ku/kubefwd/package.nix b/pkgs/by-name/ku/kubefwd/package.nix
index 979720a5524f..7ebfd63a654a 100644
--- a/pkgs/by-name/ku/kubefwd/package.nix
+++ b/pkgs/by-name/ku/kubefwd/package.nix
@@ -6,16 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubefwd";
-  version = "1.22.5";
+  version = "1.25.9";
 
   src = fetchFromGitHub {
     owner = "txn2";
     repo = "kubefwd";
-    rev = finalAttrs.version;
-    hash = "sha256-xTd/1h9fW2GbZ2u3RsExbQouRZot9CUDuqNLItRySxM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eJcmQRVrBYcT/o++d4hKUd8UWJDS/Z395M/sz8kpLfw=";
   };
 
-  vendorHash = "sha256-qAlzgPw1reDZYK+InlnAsBgVemVumWwLgEuYm+ALcCs=";
+  vendorHash = "sha256-l0iHkuSX1ECtOYY2HIFTPFVSYiZL9fi5BDOjhxWpDyA=";
+
+  subPackages = [ "cmd/kubefwd" ];
 
   ldflags = [
     "-s"
@@ -25,9 +27,9 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Bulk port forwarding Kubernetes services for local development";
-    homepage = "https://github.com/txn2/kubefwd";
+    homepage = "https://kubefwd.com";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ cjimti ];
     mainProgram = "kubefwd";
   };
 })
diff --git a/pkgs/by-name/ku/kubernetes-validate/unwrapped.nix b/pkgs/by-name/ku/kubernetes-validate/unwrapped.nix
index fdfd92a84dfb..31b115ed6122 100644
--- a/pkgs/by-name/ku/kubernetes-validate/unwrapped.nix
+++ b/pkgs/by-name/ku/kubernetes-validate/unwrapped.nix
@@ -14,13 +14,13 @@
 }:
 buildPythonPackage rec {
   pname = "kubernetes-validate";
-  version = "1.34.1";
+  version = "1.35.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "kubernetes_validate";
     inherit version;
-    hash = "sha256-uC2kR6QG/EdauD4PZ4tkQixZX8EHcN0nMyDCRMm0AxU=";
+    hash = "sha256-UKnkbaLARxwoK7MTjH14XSkjH28be8LmimEatBsigyY=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/ku/kubetrim/package.nix b/pkgs/by-name/ku/kubetrim/package.nix
index 0d0ed2590128..97f2120698bf 100644
--- a/pkgs/by-name/ku/kubetrim/package.nix
+++ b/pkgs/by-name/ku/kubetrim/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubetrim";
-  version = "0.0.1";
+  version = "0.0.2";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "kubetrim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fX8CbId2ArJlnGkevCSB7eE6Ovs8vJR9+l//k4DgvK4=";
+    hash = "sha256-XYsj4wbVNPfPht9Odqk2FjlhS2uJUQS7vLRUd5rAht4=";
   };
 
   vendorHash = "sha256-m9OuVFlD4F170Q6653HdvUhdULjR2cAttLsUN03XIXo=";
diff --git a/pkgs/by-name/la/LAStools/drop-64-suffix.patch b/pkgs/by-name/la/lastools/drop-64-suffix.patch
similarity index 100%
rename from pkgs/by-name/la/LAStools/drop-64-suffix.patch
rename to pkgs/by-name/la/lastools/drop-64-suffix.patch
diff --git a/pkgs/by-name/la/LAStools/package.nix b/pkgs/by-name/la/lastools/package.nix
similarity index 97%
rename from pkgs/by-name/la/LAStools/package.nix
rename to pkgs/by-name/la/lastools/package.nix
index 35da3703adb5..e66f3144d4e2 100644
--- a/pkgs/by-name/la/LAStools/package.nix
+++ b/pkgs/by-name/la/lastools/package.nix
@@ -6,7 +6,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "LAStools";
+  pname = "lastools";
   version = "2.0.4";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/li/libGDSII/package.nix b/pkgs/by-name/li/libgdsii/package.nix
similarity index 97%
rename from pkgs/by-name/li/libGDSII/package.nix
rename to pkgs/by-name/li/libgdsii/package.nix
index 8b66a95d3a23..d7c011932808 100644
--- a/pkgs/by-name/li/libGDSII/package.nix
+++ b/pkgs/by-name/li/libgdsii/package.nix
@@ -6,7 +6,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libGDSII";
+  pname = "libgdsii";
   version = "0.21";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/li/libgeneral/package.nix b/pkgs/by-name/li/libgeneral/package.nix
index 055ffc92b77e..cffd8d44ada8 100644
--- a/pkgs/by-name/li/libgeneral/package.nix
+++ b/pkgs/by-name/li/libgeneral/package.nix
@@ -10,13 +10,13 @@
 }:
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "libgeneral";
-  version = "86";
+  version = "89";
 
   src = fetchFromGitHub {
     owner = "tihmstar";
     repo = "libgeneral";
     tag = finalAttrs.version;
-    hash = "sha256-60vzQkf5ztAEyLRz/+q+pGs6g9Wdv3DJp1uXgRFNUDA=";
+    hash = "sha256-BADbLFE6DmkpKGMOeaaWybnjz+7QDv2iaYYXJcfFGM8=";
   };
 
   # Do not depend on git to calculate version, instead
diff --git a/pkgs/by-name/li/libHX/package.nix b/pkgs/by-name/li/libhx/package.nix
similarity index 98%
rename from pkgs/by-name/li/libHX/package.nix
rename to pkgs/by-name/li/libhx/package.nix
index f4da20d36771..b944d878d3d7 100644
--- a/pkgs/by-name/li/libHX/package.nix
+++ b/pkgs/by-name/li/libhx/package.nix
@@ -7,7 +7,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libHX";
+  pname = "libhx";
   version = "5.3";
 
   src = fetchFromCodeberg {
diff --git a/pkgs/by-name/li/libjodycode/package.nix b/pkgs/by-name/li/libjodycode/package.nix
index c170bc447118..33880333d0b9 100644
--- a/pkgs/by-name/li/libjodycode/package.nix
+++ b/pkgs/by-name/li/libjodycode/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libjodycode";
-  version = "4.1.1";
+  version = "4.1.2";
 
   outputs = [
     "out"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "jbruchon";
     repo = "libjodycode";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vuFANaQLJjyRTw+0ggye4TpFiqVa50GaRVKboagsJ7Q=";
+    hash = "sha256-HqDNbZwWDebVnu1uj07N/ttwmvvz1qGk8s/Vrc3hJK4=";
   };
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/by-name/li/libLAS/package.nix b/pkgs/by-name/li/liblas/package.nix
similarity index 99%
rename from pkgs/by-name/li/libLAS/package.nix
rename to pkgs/by-name/li/liblas/package.nix
index 0f61c70c5f7a..3826a46af7ed 100644
--- a/pkgs/by-name/li/libLAS/package.nix
+++ b/pkgs/by-name/li/liblas/package.nix
@@ -13,7 +13,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libLAS";
+  pname = "liblas";
   version = "1.8.1";
 
   src = fetchurl {
diff --git a/pkgs/by-name/li/libtsm/package.nix b/pkgs/by-name/li/libtsm/package.nix
index cd7fd796e593..917798f96b0c 100644
--- a/pkgs/by-name/li/libtsm/package.nix
+++ b/pkgs/by-name/li/libtsm/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Terminal-emulator State Machine";
     homepage = "https://www.freedesktop.org/wiki/Software/kmscon/libtsm/";
+    changelog = "https://github.com/kmscon/libtsm/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ll/lla/package.nix b/pkgs/by-name/ll/lla/package.nix
index 53fd19056b66..9d8c38b2578c 100644
--- a/pkgs/by-name/ll/lla/package.nix
+++ b/pkgs/by-name/ll/lla/package.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lla";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "chaqchase";
     repo = "lla";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AVvng3pF68bLlJBobEDBxW7/CQADTfg1Ylm/tjQFFfQ=";
+    hash = "sha256-pNm3IBt5Wlk3TMqIehJKhEdEw6i+PY+w4IPYh4pS9Qo=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Do not vendor Oniguruma
   env.RUSTONIG_SYSTEM_LIBONIG = true;
 
-  cargoHash = "sha256-SQBaUaNuPUUw/bQ9UnUNCo+HpU7VVK3wzKAtSDpmTHo=";
+  cargoHash = "sha256-gGa0NNcnUwnrBXHp609ShdmcyjjK7/dZ5T0MNYXz6z8=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/lo/logrotate/package.nix b/pkgs/by-name/lo/logrotate/package.nix
index 7e8139df25aa..b0c08570fc13 100644
--- a/pkgs/by-name/lo/logrotate/package.nix
+++ b/pkgs/by-name/lo/logrotate/package.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ popt ] ++ lib.optionals aclSupport [ acl ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   preCheck = ''
     sed -i 's#/bin/date#${lib.getExe' coreutils "date"}#' test/*.sh
     # Exiting with 77 signals that a test is skipped, and we only place it on line 2 because the shebang is on line 1
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 73c31cb0299a..bd7d48e56318 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0VPXRO8ApVKToP1/2xJlOxi5UTXSfXkCuHV0hECv4VA=";
+    hash = "sha256-wxVXQIqOenq8MRt6PGKGwuVDRgylGxVNlDMc1gWSCXw=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-GkzTN4DjbzyvLAuiXONyMXm8Bgd9t6tj2cqTi/ir268=";
+  cargoHash = "sha256-A47laM9WvAldFvC3Fz8kkJh1Q8MzOFj1Mmu7ZQS2mI0=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -90,6 +90,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
       mrcjkb
+      ALameLlama
     ];
     platforms = lib.platforms.all;
     mainProgram = "lx";
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 56c6eb1ff707..b59708eab959 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.240";
+  version = "1.241";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-q+gTBC5/CjRY3sjub5qku/K+Xdm4DElKydnKeLpXmJw=";
+    hash = "sha256-9yyOumwZ9Veh0GwHR9sFpsCn1dLNN1e16ML2crGZxCY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ma/marksman/package.nix b/pkgs/by-name/ma/marksman/package.nix
index 3bae06398551..5523d8eeacc1 100644
--- a/pkgs/by-name/ma/marksman/package.nix
+++ b/pkgs/by-name/ma/marksman/package.nix
@@ -13,13 +13,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname dotnet-sdk;
-  version = "2026-01-28";
+  version = "2026-02-08";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     tag = finalAttrs.version;
-    hash = "sha256-jqjf5nDxrw9W+PY9qo5j0dFiWGItRYHWiwEyCpn6ZKA=";
+    hash = "sha256-xebt55WKHOKwA6QIkW5mnvqUGHeGRzINCWfViA4cfJ0=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index 85bb0b84b22d..7103e5d66735 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2026.1.31";
+  version = "2026.2.4";
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-HnMTsrSp6mF2KzvqmX2sUA6viABXk5JWgngb3VzE2IE=";
+    hash = "sha256-iqKxRdYxp3S+CgwkBRtqWZDEUzdHgScpZvwN1us0nUo=";
   };
 
   vendorHash = "sha256-c94sQa1zKmt+mVC2yRm6rhBXh8Jr+r1PFcrlDPEE/04=";
diff --git a/pkgs/by-name/ma/matrix-hookshot/package.nix b/pkgs/by-name/ma/matrix-hookshot/package.nix
index 1a756900c638..12377a05339c 100644
--- a/pkgs/by-name/ma/matrix-hookshot/package.nix
+++ b/pkgs/by-name/ma/matrix-hookshot/package.nix
@@ -18,23 +18,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "matrix-hookshot";
-  version = "7.3.0";
+  version = "7.3.2";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-hookshot";
     tag = finalAttrs.version;
-    hash = "sha256-d0ybypFKruL236yZZJbMd9kLKPD1/LBiIQuM0l7gtpc=";
+    hash = "sha256-FHxR0rUrony/z8Nxv4HA0XCDlwsdoLXK/yBQlfkC6U4=";
   };
 
   offlineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-zeONd4JjUuXR009osMBUamzAvom21HnMJtNpkbC66IQ=";
+    hash = "sha256-Qodvybg0G2a6Jtcd89Mci/PoLXrozTJCRRVh/fedngk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xr7/Swo2FwkJjLQ0Yrvytqc9a5XwycenEOjtJi0cHJ4=";
+    hash = "sha256-X0k60VOG/VoffE5+pCJ33C0Oxjr7NsOHHsLNWFb/z6s=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/me/mediawiki/package.nix b/pkgs/by-name/me/mediawiki/package.nix
index 8ab98a9ec81c..f5c3544abd52 100644
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenvNoCC,
+  fetchpatch,
   fetchurl,
   nixosTests,
 }:
@@ -14,6 +15,19 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-4vEmsZrsQiBRoKUODGq36QTzOzmIpHudqK+/0MCiUsw=";
   };
 
+  patches = [
+    # Fix installation with postgres
+    (fetchpatch {
+      url = "https://gerrit.wikimedia.org/r/changes/mediawiki%2Fcore~1231289/revisions/4/patch?download";
+      decode = "base64 -d";
+      postFetch = ''
+        substituteInPlace $out \
+          --replace "/Installer/" "/installer/"
+      '';
+      hash = "sha256-bhfw5CW4EEpr2GTGda3va+EmM/vK6AqBfyoCcsSiqNQ=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace includes/installer/CliInstaller.php \
       --replace-fail '$vars = Installer::getExistingLocalSettings();' '$vars = null;'
diff --git a/pkgs/by-name/me/melonDS/package.nix b/pkgs/by-name/me/melonDS/package.nix
index edd77825b4b3..6b05243ab6d7 100644
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "1.1-unstable-2026-01-20";
+  version = "1.1-unstable-2026-02-02";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "73b38200fd0fa81b0bd4b3c1d2f9395a6ec5ac0b";
-    hash = "sha256-/JnAf+qknOaGl3RcRzCFIh4dFIcHxTwu8Woju+d0nUw=";
+    rev = "8104a20be1d8370499667da32a5196939e5af584";
+    hash = "sha256-8taczrHnez2lW++grMF/nfONZcGmq1Qg/QiuhXYHbms=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/memogram/package.nix b/pkgs/by-name/me/memogram/package.nix
index cb8635ea85ed..162dd0d6123b 100644
--- a/pkgs/by-name/me/memogram/package.nix
+++ b/pkgs/by-name/me/memogram/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "memogram";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "telegram-integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYtH6r/2nPTBiAY9b3LDEAfgkiO4SaHAi7NkLg6sUrg=";
+    hash = "sha256-b7y3+Qfa6NWX58gMmIPXSZxfl/d40xUQDQN9EBaewaY=";
   };
 
-  vendorHash = "sha256-6nJiB9LXF5QI4XJrcPDwwnG9CTmvyX7vf8X17lVuaZM=";
+  vendorHash = "sha256-G3ZkjpmZjIGyCwZvxWDQGW33n/AbuN9hXlvdLo85M6Q=";
 
   subPackages = [ "bin/memogram" ];
 
diff --git a/pkgs/by-name/me/metacubexd/package.nix b/pkgs/by-name/me/metacubexd/package.nix
index 74ff8930e2ca..075e1f2c97ca 100644
--- a/pkgs/by-name/me/metacubexd/package.nix
+++ b/pkgs/by-name/me/metacubexd/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "metacubexd";
-  version = "1.235.3";
+  version = "1.240.2";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "metacubexd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3CtXD8fG/JEK13VcovjckrtPLTQUltut1AOk2nufdCc=";
+    hash = "sha256-6GsUiOBYFDov3/O36iYglxEn7qtcGmn4WeIls68i4Og=";
   };
 
   nativeBuildInputs = [
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 1;
-    hash = "sha256-cT0HGAc/eu7LMZp4/MNRgodo+nkhLoN5yOWfcrtsr5I=";
+    hash = "sha256-PAtw+qrxl3gZC+kdWcsp34tj8CH/jEOkXgodycs2cZg=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mi/miniHttpd/package.nix b/pkgs/by-name/mi/mini-httpd/package.nix
similarity index 100%
rename from pkgs/by-name/mi/miniHttpd/package.nix
rename to pkgs/by-name/mi/mini-httpd/package.nix
diff --git a/pkgs/by-name/mi/miriway/package.nix b/pkgs/by-name/mi/miriway/package.nix
index b9bf53bf8f31..b2e45f5acde5 100644
--- a/pkgs/by-name/mi/miriway/package.nix
+++ b/pkgs/by-name/mi/miriway/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miriway";
-  version = "25.13";
+  version = "26.01";
 
   src = fetchFromGitHub {
     owner = "Miriway";
     repo = "Miriway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W05XAhZwdqotlDSklnw4Yh3k8VJNQJzHCJsMQn1p5rQ=";
+    hash = "sha256-JHLP5M9uBS4CmTGx3xgNq7YN1Tj8FZyKo1C8aGTtG9E=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ml/mlkit/package.nix b/pkgs/by-name/ml/mlkit/package.nix
index 476090110b92..2bd381fdd2f4 100644
--- a/pkgs/by-name/ml/mlkit/package.nix
+++ b/pkgs/by-name/ml/mlkit/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mlkit";
-  version = "4.7.18";
+  version = "4.7.21";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-OACdbHwg3sEAVw+Fje0tWVHh7Xy6C/WdOQHfexOezlo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-c1GdM3K6dgY0EgHu01adBXwAxuMehRfo73Lo71couJ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mm/MMA/package.nix b/pkgs/by-name/mm/mma/package.nix
similarity index 100%
rename from pkgs/by-name/mm/MMA/package.nix
rename to pkgs/by-name/mm/mma/package.nix
diff --git a/pkgs/by-name/mo/mochi/package.nix b/pkgs/by-name/mo/mochi/package.nix
index a9a63fad183b..99191d5ae593 100644
--- a/pkgs/by-name/mo/mochi/package.nix
+++ b/pkgs/by-name/mo/mochi/package.nix
@@ -1,23 +1,24 @@
 {
-  _7zz,
   appimageTools,
   fetchurl,
-  fetchzip,
   lib,
+  makeWrapper,
+  stdenv,
   stdenvNoCC,
   libxshmfence,
+  undmg,
 }:
 
 let
   pname = "mochi";
-  version = "1.18.11";
+  version = "1.20.10";
 
   linux = appimageTools.wrapType2 rec {
     inherit pname version meta;
 
     src = fetchurl {
-      url = "https://mochi.cards/releases/Mochi-${version}.AppImage";
-      hash = "sha256-NQ591KtWQz8hlXPhV83JEwGm+Au26PIop5KVzsyZKp4=";
+      url = "https://download.mochi.cards/releases/Mochi-${version}.AppImage";
+      hash = "sha256-oC53TXgK6UUgsHbLo0Ri/+2/UajYwpoXxHwqO1xY91U=";
     };
 
     appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -30,23 +31,35 @@ let
       substituteInPlace $out/share/applications/${pname}.desktop \
         --replace-fail 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
     '';
+
+    passthru.updateScript = ./update.sh;
   };
 
-  darwin = stdenvNoCC.mkDerivation {
+  darwin = stdenv.mkDerivation {
     inherit pname version meta;
 
-    src = fetchzip {
-      url = "https://mochi.cards/releases/Mochi-${version}.dmg";
-      hash = "sha256-5RM4eqHQoYfO5JiUH9ol+3XxOk4VX4ocE3Yia82sovI=";
-      stripRoot = false;
-      nativeBuildInputs = [ _7zz ];
+    src = fetchurl {
+      url = "https://download.mochi.cards/releases/Mochi-${version}${lib.optionalString stdenv.hostPlatform.isAarch64 "-arm64"}.dmg";
+      hash =
+        if stdenv.hostPlatform.isAarch64 then
+          "sha256-nLz73G6vthiXex7+y6bLVhe/RvK3fE3UHuzHf8lcilE="
+        else
+          "sha256-MuvzijF2eDELcSfOyqffKk5tx2a51vU8cGV2/ShSfTg=";
     };
 
+    sourceRoot = ".";
+
+    nativeBuildInputs = [
+      makeWrapper
+      undmg
+    ];
+
     installPhase = ''
       runHook preInstall
 
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
+      mkdir -p $out/{Applications,bin}
+      cp -a Mochi.app $out/Applications
+      makeWrapper $out/Applications/Mochi.app/Contents/MacOS/Mochi $out/bin/${pname}
 
       runHook postInstall
     '';
@@ -57,6 +70,7 @@ let
     homepage = "https://mochi.cards/";
     changelog = "https://mochi.cards/changelog.html";
     license = lib.licenses.unfree;
+    mainProgram = "mochi";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ poopsicles ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/by-name/mo/mochi/update.sh b/pkgs/by-name/mo/mochi/update.sh
new file mode 100755
index 000000000000..cc6e20044d54
--- /dev/null
+++ b/pkgs/by-name/mo/mochi/update.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl nix common-updater-scripts
+
+set -euo pipefail
+
+latestVersion=$(curl -Ls https://mochi.cards/ | grep -oP 'Mochi-\K[0-9]+\.[0-9]+\.[0-9]+(?=\.AppImage)' | head -1)
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; mochi.version" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+# Update version and hash for x86_64-linux (AppImage)
+update-source-version mochi "$latestVersion" --system=x86_64-linux
+
+# Update hashes for darwin systems
+for system in x86_64-darwin aarch64-darwin; do
+    url=$(nix-instantiate --eval --json -E "with import ./. { system = \"$system\"; }; mochi.src.url" | tr -d '"')
+    hash=$(nix-prefetch-url "$url")
+    sriHash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$hash")
+    update-source-version mochi "$latestVersion" "$sriHash" --system="$system" --ignore-same-version
+done
diff --git a/pkgs/by-name/mo/mockgen/package.nix b/pkgs/by-name/mo/mockgen/package.nix
index 91359b62d370..83ecf88bd1f2 100644
--- a/pkgs/by-name/mo/mockgen/package.nix
+++ b/pkgs/by-name/mo/mockgen/package.nix
@@ -2,8 +2,7 @@
   buildGoModule,
   fetchFromGitHub,
   lib,
-  testers,
-  mockgen,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -13,8 +12,8 @@ buildGoModule (finalAttrs: {
   src = fetchFromGitHub {
     owner = "uber-go";
     repo = "mock";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-gYUL+ucnKQncudQDcRt8aDqM7xE5XSKHh4X0qFrvfGs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gYUL+ucnKQncudQDcRt8aDqM7xE5XSKHh4X0qFrvfGs=";
   };
 
   vendorHash = "sha256-Cf7lKfMuPFT/I1apgChUNNCG2C7SrW7ncF8OusbUs+A=";
@@ -26,18 +25,12 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-X=main.version=${finalAttrs.version}"
     "-X=main.date=1970-01-01T00:00:00Z"
-    "-X=main.commit=unknown"
+    "-X=main.commit=${finalAttrs.src.rev}"
   ];
 
-  passthru.tests.version = testers.testVersion {
-    package = mockgen;
-    command = "mockgen -version";
-    version = ''
-      v${finalAttrs.version}
-      Commit: unknown
-      Date: 1970-01-01T00:00:00Z
-    '';
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+  doInstallCheck = true;
 
   meta = {
     description = "Mocking framework for the Go programming language";
diff --git a/pkgs/by-name/mo/mockoon/package.nix b/pkgs/by-name/mo/mockoon/package.nix
index 4bb7d5f50f25..2f8c17c04583 100644
--- a/pkgs/by-name/mo/mockoon/package.nix
+++ b/pkgs/by-name/mo/mockoon/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "mockoon";
-  version = "9.4.0";
+  version = "9.5.0";
 
   src = fetchurl {
     url = "https://github.com/mockoon/mockoon/releases/download/v${version}/mockoon-${version}.x86_64.AppImage";
-    hash = "sha256-BnzeCJIuVvbrdS5X6Or2t2QjwE+S9/jZOfgsjbtBoZU=";
+    hash = "sha256-I+ilXk2WPZECz/jpxfrIokBgeh6bFFPJnLPwuy+CyvA=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeys-audio/package.nix
similarity index 100%
rename from pkgs/by-name/mo/monkeysAudio/package.nix
rename to pkgs/by-name/mo/monkeys-audio/package.nix
diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index fe55113a169b..f2d6e0bec28c 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ip9QcpPeojOdvUX7PMt3owSvMCy6hpsyxtAAsIWM8f4=";
+    hash = "sha256-UEOp+ht+F4uh48OcERRCuKZEt3cM2SAaVF9Hb3/U/NA=";
   };
 
   vendorHash = "sha256-lz3cq2xL9byhLNbAwEvYOsP9WQsu0hqrWe2EDaLSeOQ=";
diff --git a/pkgs/by-name/mu/murex/package.nix b/pkgs/by-name/mu/murex/package.nix
index 2557b4fe5f9d..2f7bc0768d6b 100644
--- a/pkgs/by-name/mu/murex/package.nix
+++ b/pkgs/by-name/mu/murex/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "murex";
-  version = "7.1.4143";
+  version = "7.2.1001";
 
   src = fetchFromGitHub {
     owner = "lmorg";
     repo = "murex";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-wLEEyRnV0ERji+HPgtu6NgZSgKu0B6MErL+8KX1lUhw=";
+    sha256 = "sha256-Ua5KEtT1HXRCqW4MwB0dYCd03DBrliEfgiSmcp+vZS8=";
   };
 
-  vendorHash = "sha256-ttBC4ZSoOcfauSNo5WTt/Ln3dn94VvdhYEFCzAli0dU=";
+  vendorHash = "sha256-MaBBi2Qi7s9lfRWmnYkyr7PtwzC7ZL0jmyUXzISOXVg=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 6dc6e2651723..6823350f7b30 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.2.28";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-t0GYaIce5fmQfwpI1cqZEL3OXPmdIet+i1BegIbpU3s=";
+    hash = "sha256-x22RzmDHTb6YVB0/+KcaFlX3e/c8vvFR/572MZWNvL8=";
   };
 
   vendorHash = "sha256-napF55nA/9P8l5lddnEHQMjLXWSyTzgblIQCbSZ20MA=";
@@ -61,6 +61,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       pinpox
       oddlama
+      nicegamer7
     ];
     mainProgram = "museum";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 6715df1b42bf..9340d40e9fa7 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -16,6 +16,13 @@
   libpq,
   makeWrapper,
 }:
+let
+  python = python3.withPackages (
+    ps: with ps; [
+      websockets
+    ]
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
   version = "2.6.3";
@@ -87,11 +94,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/{bin,lib/n8n}
-    mv {packages,node_modules} $out/lib/n8n
+    cp -r {packages,node_modules} $out/lib/n8n
 
     makeWrapper $out/lib/n8n/packages/cli/bin/n8n $out/bin/n8n \
       --set N8N_RELEASE_TYPE "stable"
 
+    # JavaScript runner
+    makeWrapper ${nodejs}/bin/node $out/bin/n8n-task-runner \
+      --add-flags "$out/lib/n8n/packages/@n8n/task-runner/dist/start.js"
+
+    # Python runner
+    mkdir -p $out/lib/n8n-task-runner-python
+    cp -r packages/@n8n/task-runner-python/* $out/lib/n8n-task-runner-python/
+    makeWrapper ${python}/bin/python $out/bin/n8n-task-runner-python \
+      --add-flags "$out/lib/n8n-task-runner-python/src/main.py" \
+      --prefix PYTHONPATH : "$out/lib/n8n-task-runner-python"
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 4cd6c0798356..7cd3bdc99779 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.478";
+  version = "0.0.479";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AGERHGA2jPEXZqueMzVRtVF3UJIEGxX0glVxjS4OuiU=";
+    hash = "sha256-EznGetJAjUMgQjTHgWA4nv3c6RobrSU28lEjN0PgsiE=";
   };
 
-  vendorHash = "sha256-FfQMnZD+H0LDLPThOz8BJ6FN/B9pDVT5nt84AmpawO0=";
+  vendorHash = "sha256-dk32fNNO5nN/RuYOu+vx8Gjxdcs1vt6K9CrV1iXn++E=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index 897b6b2d61f2..8cbb3cc0f5f5 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nb";
-  version = "7.24.0";
+  version = "7.24.1";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = finalAttrs.version;
-    hash = "sha256-oGVuBwnuKQqlhwW8gBWwhR09ZVBYV3vWzJxKu+KTlL8=";
+    hash = "sha256-NTBRuxy66mytpJ/UNeS1N2jIMu4IrZmGNp/jPwa2qZI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/nb/nbping/package.nix b/pkgs/by-name/nb/nbping/package.nix
new file mode 100644
index 000000000000..4c88714fe89c
--- /dev/null
+++ b/pkgs/by-name/nb/nbping/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+let
+  pname = "nbping";
+  version = "0.6.1";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "hanshuaikang";
+    repo = "Nping";
+    tag = "v${version}";
+    hash = "sha256-6eUsvNMQoJ5TUWPkOlmcJqdmxaXoBStnhiXiya+0nV8=";
+  };
+
+  cargoHash = "sha256-6+drbq9dQ5/Atzoz9VPS4BoYEPeM5OqPXUuM1AXP72g=";
+
+  meta = {
+    description = "Ping Tool in Rust with Real-Time Data and Visualizations";
+    homepage = "https://github.com/hanshuaikang/Nping";
+    changelog = "https://github.com/hanshuaikang/Nping/releases/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+    mainProgram = "nbping";
+  };
+}
diff --git a/pkgs/by-name/nf/nfs-ganesha/package.nix b/pkgs/by-name/nf/nfs-ganesha/package.nix
index af613da6bf43..83ebff353c3e 100644
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-ganesha";
-  version = "9.4";
+  version = "9.5";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-Adax64aaioYfPg7SMtylS2wpYV52l8KgXBA8eJefGkY=";
+    hash = "sha256-WgNuzG9A3pA9K9Wwtr+kLtvYA9PKQgZuEJlx8OVgCqY=";
   };
 
   patches = lib.optional useDbus ./allow-bypassing-dbus-pkg-config-test.patch;
diff --git a/pkgs/by-name/ni/nix-direnv/package.nix b/pkgs/by-name/ni/nix-direnv/package.nix
index 9db6efeaffbe..856cc332ce78 100644
--- a/pkgs/by-name/ni/nix-direnv/package.nix
+++ b/pkgs/by-name/ni/nix-direnv/package.nix
@@ -11,13 +11,13 @@
 # https://github.com/abathur/resholve/issues/107
 resholve.mkDerivation rec {
   pname = "nix-direnv";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = version;
-    hash = "sha256-HdnQRcysoKNPbVa/D3KDcLgqf5+u9JDPmcl29cGj4AI=";
+    hash = "sha256-AsWnRH7LAb78iFfE+ZdYyCR5AVuPloT8ZnghDXW6arY=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index aeae7b435523..ad0f45b3971b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -376,20 +376,20 @@ def main() -> None:
 
     try:
         execute(sys.argv)
+    except KeyboardInterrupt:
+        sys.exit(130)
     except CalledProcessError as ex:
-        _handle_called_process_error(ex)
-    except (Exception, KeyboardInterrupt) as ex:
+        sys.exit(_handle_called_process_error(ex))
+    except Exception as ex:
         if logger.isEnabledFor(logging.DEBUG):
             raise
         else:
             sys.exit(str(ex))
 
 
-def _handle_called_process_error(ex: CalledProcessError) -> None:
+def _handle_called_process_error(ex: CalledProcessError) -> int:
     if logger.isEnabledFor(logging.DEBUG):
-        import traceback
-
-        traceback.print_exception(ex)
+        sys.excepthook(*sys.exc_info())
     else:
         import shlex
 
@@ -410,4 +410,4 @@ def _handle_called_process_error(ex: CalledProcessError) -> None:
         print(str(ex), file=sys.stderr)
 
     # Exit with the error code of the process that failed
-    sys.exit(ex.returncode)
+    return ex.returncode
diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index 7746fd543d1e..e80bb821385d 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -22,14 +22,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nixpkgs-review";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nixpkgs-review";
     tag = finalAttrs.version;
-    hash = "sha256-SGykze7xkurdrqwMvXZU4E7VAuEcHCKqtlXAdaQrr1M=";
+    hash = "sha256-AYizZ36di7DOtmaqMtWTvMVfe4DqJfCdhvxypweEArs=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
index 8dbfc26dab38..68a6b989913a 100644
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -17,15 +17,17 @@
     weights, and freely available to all.
   '',
 }:
-
-stdenvNoCC.mkDerivation rec {
+let
+  _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noto-fonts${suffix}";
   version = "2026.02.01";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
-    rev = "noto-monthly-release-${version}";
+    tag = "noto-monthly-release-${finalAttrs.version}";
     hash = "sha256-vhu3jojG6QlgY5gP4bCbpJznsQ1gExAfcRT42FcZUp4=";
   };
 
@@ -34,8 +36,6 @@ stdenvNoCC.mkDerivation rec {
     "megamerge" # Experimental fonts created by merging regular notofonts
   ];
 
-  _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
-
   installPhase = ''
     # We check availability in order of variable -> otf -> ttf
     # unhinted -- the hinted versions use autohint
@@ -61,7 +61,7 @@ stdenvNoCC.mkDerivation rec {
       ''
     else
       ''
-        for variant in $_variants; do
+        for variant in ${lib.concatStringsSep " " _variants}; do
           if [[ -d fonts/"$variant"/unhinted/variable-ttf ]]; then
             install -m444 -Dt $out_font fonts/"$variant"/unhinted/variable-ttf/*.ttf
           elif [[ -d fonts/"$variant"/unhinted/otf ]]; then
@@ -91,4 +91,4 @@ stdenvNoCC.mkDerivation rec {
       jopejoe1
     ];
   };
-}
+})
diff --git a/pkgs/by-name/nu/nu_scripts/package.nix b/pkgs/by-name/nu/nu_scripts/package.nix
index 0531aa1019aa..b860a456c5a8 100644
--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "nu_scripts";
-  version = "0-unstable-2026-01-29";
+  version = "0-unstable-2026-02-05";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nu_scripts";
-    rev = "049b00e54e0dc878bc9a37ee0e05c6ba18789c2f";
-    hash = "sha256-zHLVDV7RsQMMgYP7ysWF83Q+7PoP4E+pOguzixWf9iA=";
+    rev = "4444335709d0c9f8291ac925b0854d91132f6ffc";
+    hash = "sha256-50uIcHHV3yPX91KRxDrMmG1eaSfw08CNG/S86CM08P0=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nu/nushell-plugin-bson/package.nix b/pkgs/by-name/nu/nushell-plugin-bson/package.nix
new file mode 100644
index 000000000000..d0208edde789
--- /dev/null
+++ b/pkgs/by-name/nu/nushell-plugin-bson/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  llvmPackages,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nu_plugin_bson";
+  version = "26.1100.0";
+
+  src = fetchFromGitHub {
+    owner = "Kissaki";
+    repo = "nu_plugin_bson";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3Uu2YF5fnNvRP4+9GpLYjzZt7lg0kCbBl4bk4l5rEuY=";
+  };
+
+  cargoHash = "sha256-iORPlIP9kDLlJkm09SZn2lO3bWcj/Q/g+dBd2CPWiOg=";
+
+  nativeBuildInputs = [
+    llvmPackages.libclang
+  ];
+
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+
+  passthru.update-script = nix-update-script { };
+  meta = {
+    description = " Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
+    homepage = "https://github.com/Kissaki/nu_plugin_bson";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ philocalyst ];
+    mainProgram = "nu_plugin_bson";
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
diff --git a/pkgs/by-name/nv/nvc/package.nix b/pkgs/by-name/nv/nvc/package.nix
index 004953fb409b..1f2a657c5c15 100644
--- a/pkgs/by-name/nv/nvc/package.nix
+++ b/pkgs/by-name/nv/nvc/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nvc";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "nickg";
     repo = "nvc";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-99aYjP5YGMSM9V2gkU5tT5KeyddGjlxvzT7oKzU9WCg=";
+    hash = "sha256-r/fgOy2KnDwcNxLrOFYFYqUqBLL8NkmuaBOFbfn/gug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ob/obs-cmd/package.nix b/pkgs/by-name/ob/obs-cmd/package.nix
index a09fb90a91cc..968a1a5d2e22 100644
--- a/pkgs/by-name/ob/obs-cmd/package.nix
+++ b/pkgs/by-name/ob/obs-cmd/package.nix
@@ -6,23 +6,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "obs-cmd";
-  version = "0.20.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "grigio";
     repo = "obs-cmd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-67kMAUwgrQcGipsbKo0kubkVJA4/T4nfqghEZlhnvHU=";
+    hash = "sha256-xjtNQZDgo7DIUsoH0PNHbsgE+FSXYnqWXpISdiRqTKw=";
   };
 
-  cargoHash = "sha256-t0R2QMmNpLgqmqLVL4hgEcqN0xIUIK3gIwxZxzkupbQ=";
+  cargoHash = "sha256-yoXwiNkEOj/wDw70wWHmuTyOE8nPaCXFar9FFiKOOAM=";
 
   meta = {
     description = "Minimal CLI to control OBS Studio via obs-websocket";
     homepage = "https://github.com/grigio/obs-cmd";
     changelog = "https://github.com/grigio/obs-cmd/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.ramblurr ];
     mainProgram = "obs-cmd";
   };
 })
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index 7276682d01a2..1f05158046ac 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -25,14 +25,14 @@ in
 
 py.pkgs.buildPythonApplication rec {
   pname = "oci-cli";
-  version = "3.73.1";
+  version = "3.73.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${version}";
-    hash = "sha256-kjqJldzPjuXYJoA1DU4Dn6Xd3BhLSlmn+OttTG1efSE=";
+    hash = "sha256-se8xUSamPI4K6JQ+eUjCgnB2E5j9iRVNqam4vdRELPA=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/on/oneDNN/package.nix b/pkgs/by-name/on/onednn/package.nix
similarity index 94%
rename from pkgs/by-name/on/oneDNN/package.nix
rename to pkgs/by-name/on/onednn/package.nix
index 927f7e3fce22..297ca30b7747 100644
--- a/pkgs/by-name/on/oneDNN/package.nix
+++ b/pkgs/by-name/on/onednn/package.nix
@@ -10,7 +10,7 @@
 # just recently been renamed again to oneDNN. See here for details:
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation (finalAttrs: {
-  pname = "oneDNN";
+  pname = "onednn";
   version = "3.10.2";
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     changelog = "https://github.com/oneapi-src/oneDNN/releases/tag/v${finalAttrs.version}";
     description = "oneAPI Deep Neural Network Library (oneDNN)";
-    homepage = "https://01.org/oneDNN";
+    homepage = "http://uxlfoundation.github.io/oneDNN";
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/on/oneDNN_2/package.nix b/pkgs/by-name/on/onednn_2/package.nix
similarity index 91%
rename from pkgs/by-name/on/oneDNN_2/package.nix
rename to pkgs/by-name/on/onednn_2/package.nix
index adbb3720c2f5..51a6fa36e2ee 100644
--- a/pkgs/by-name/on/oneDNN_2/package.nix
+++ b/pkgs/by-name/on/onednn_2/package.nix
@@ -8,10 +8,10 @@
 # This was originally called mkl-dnn, then it was renamed to dnnl, and it has
 # just recently been renamed again to oneDNN. See here for details:
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
-# oneDNN_2 is currently only consumed by rocmPackages.migraphx and likely
+# onednn_2 is currently only consumed by rocmPackages.migraphx and likely
 # to be dropped once migraphx can migrate to 3
 stdenv.mkDerivation (finalAttrs: {
-  pname = "oneDNN";
+  pname = "onednn";
   version = "2.7.5";
 
   src = fetchFromGitHub {
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     changelog = "https://github.com/oneapi-src/oneDNN/releases/tag/v${finalAttrs.version}";
     description = "oneAPI Deep Neural Network Library (oneDNN)";
-    homepage = "https://01.org/oneDNN";
+    homepage = "http://uxlfoundation.github.io/oneDNN";
     license = lib.licenses.asl20;
     teams = [ lib.teams.rocm ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ar/artyFX/package.nix b/pkgs/by-name/op/openav-artyfx/package.nix
similarity index 97%
rename from pkgs/by-name/ar/artyFX/package.nix
rename to pkgs/by-name/op/openav-artyfx/package.nix
index 650b83b4dda1..cc615bb1fb98 100644
--- a/pkgs/by-name/ar/artyFX/package.nix
+++ b/pkgs/by-name/op/openav-artyfx/package.nix
@@ -15,7 +15,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "artyFX";
+  pname = "openav-artyfx";
   version = "1.3.1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/op/openscenegraph/package.nix b/pkgs/by-name/op/openscenegraph/package.nix
index 95e35c44172c..53f4aeb4d97a 100644
--- a/pkgs/by-name/op/openscenegraph/package.nix
+++ b/pkgs/by-name/op/openscenegraph/package.nix
@@ -48,7 +48,7 @@
   vncSupport ? false,
   libvncserver,
   lasSupport ? false,
-  libLAS,
+  liblas,
   luaSupport ? false,
   lua,
   sdlSupport ? false,
@@ -108,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional svgSupport librsvg
     ++ lib.optional pdfSupport poppler
     ++ lib.optional vncSupport libvncserver
-    ++ lib.optional lasSupport libLAS
+    ++ lib.optional lasSupport liblas
     ++ lib.optional luaSupport lua
     ++ lib.optional sdlSupport SDL2
     ++ lib.optional restSupport asio
diff --git a/pkgs/by-name/op/opentrack/package.nix b/pkgs/by-name/op/opentrack/package.nix
index 3f0e59c1947a..dfe8a2387ad1 100644
--- a/pkgs/by-name/op/opentrack/package.nix
+++ b/pkgs/by-name/op/opentrack/package.nix
@@ -15,7 +15,7 @@
   libxdmcp,
   libevdev,
   makeDesktopItem,
-  wineWowPackages,
+  wineWow64Packages,
   onnxruntime,
   nix-update-script,
   withWine ? stdenv.targetPlatform.isx86_64,
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qt6.wrapQtAppsHook
   ]
-  ++ lib.optionals withWine [ wineWowPackages.stable ];
+  ++ lib.optionals withWine [ wineWow64Packages.stable ];
 
   buildInputs = [
     finalAttrs.aruco
diff --git a/pkgs/by-name/oq/oqs-provider/package.nix b/pkgs/by-name/oq/oqs-provider/package.nix
index fd9f514b4a57..c6d8a7bfad8f 100644
--- a/pkgs/by-name/oq/oqs-provider/package.nix
+++ b/pkgs/by-name/oq/oqs-provider/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oqs-provider";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "open-quantum-safe";
     repo = "oqs-provider";
-    rev = finalAttrs.version;
-    hash = "sha256-/FdVcFNrRWJmEmO1B+LybL+MH4N7LdwvHaOpQi6vCTU=";
+    tag = finalAttrs.version;
+    hash = "sha256-7nPYnlq6/GokWceHk1ZcnZo9A1z6LMtLBGM61zHvcyY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix b/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
index c34a5d44141f..65c09c277967 100644
--- a/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
+++ b/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
@@ -59,8 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
-  SourceRoot = "${finalAttrs.src.name}/Build";
-
   nativeBuildInputs = [
     cmake
     python3
diff --git a/pkgs/by-name/os/oscar64/package.nix b/pkgs/by-name/os/oscar64/package.nix
index 32ac834579a4..068630fc32b6 100644
--- a/pkgs/by-name/os/oscar64/package.nix
+++ b/pkgs/by-name/os/oscar64/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar64";
-  version = "1.32.266";
+  version = "1.32.267";
 
   src = fetchFromGitHub {
     owner = "drmortalwombat";
     repo = "oscar64";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udbVRdGIGv3jgeh1cKp7MhSDxNs56FlqEbpzgfWcieE=";
+    hash = "sha256-SxjR+HAUJrjBPCn5doEx+6lzUikG55/KgiV/e3Vg/tQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pa/pam_mount/package.nix b/pkgs/by-name/pa/pam_mount/package.nix
index 3906ea4f1980..dd5dc5c698e6 100644
--- a/pkgs/by-name/pa/pam_mount/package.nix
+++ b/pkgs/by-name/pa/pam_mount/package.nix
@@ -6,7 +6,7 @@
   perl,
   pkg-config,
   pam,
-  libHX,
+  libhx,
   libxml2,
   pcre2,
   openssl,
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     cryptsetup
-    libHX
+    libhx
     libxml2
     openssl
     pam
diff --git a/pkgs/by-name/pd/pdnsgrep/package.nix b/pkgs/by-name/pd/pdnsgrep/package.nix
new file mode 100644
index 000000000000..2def94da7c0b
--- /dev/null
+++ b/pkgs/by-name/pd/pdnsgrep/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pdnsgrep";
+  version = "1.1.2";
+
+  src = fetchFromGitHub {
+    owner = "akquinet";
+    repo = "pdnsgrep";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NFJkLYOHBUYRVehT0VBIFPagLiR8cVvVkAnqCwVUqYg=";
+  };
+
+  vendorHash = "sha256-kbX3oTg2OGr4Gj9MEXa2Z7AlYIyv6LNIY4mR06F6OvQ=";
+  proxyVendor = true;
+
+  ldflags = [
+    "-s"
+  ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Search tool for PowerDNS logs";
+    homepage = "https://github.com/akquinet/pdnsgrep";
+    changelog = "https://github.com/akquinet/pdnsgrep/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ rwxd ];
+    mainProgram = "pdnsgrep";
+  };
+})
diff --git a/pkgs/by-name/pe/peertube/package.nix b/pkgs/by-name/pe/peertube/package.nix
index 58c4142829c6..7399c0ef32cb 100644
--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@@ -1,79 +1,33 @@
 {
   lib,
   stdenv,
-  fetchurl,
   fetchFromGitHub,
-  fetchYarnDeps,
-  nixosTests,
+  fetchPnpmDeps,
+
+  # build
   brotli,
-  fixup-yarn-lock,
-  jq,
+  dart-sass,
   fd,
-  nodejs_20,
+  jq,
+  pnpmConfigHook,
+  pnpm_10,
   which,
-  yarn,
+
+  # runtime
+  nodejs_20,
+
+  # tests
+  nixosTests,
 }:
-let
-  bcryptHostPlatformAttrs = {
-    x86_64-linux = {
-      arch = "linux-x64";
-      libc = "glibc";
-      hash = "sha256-C5N6VgFtXPLLjZt0ZdRTX095njRIT+12ONuUaBBj7fQ=";
-    };
-    aarch64-linux = {
-      arch = "linux-arm64";
-      libc = "glibc";
-      hash = "sha256-TerDujO+IkSRnHYlSbAKSP9IS7AT7XnQJsZ8D8pCoGc=";
-    };
-    x86_64-darwin = {
-      arch = "darwin-x64";
-      libc = "unknown";
-      hash = "sha256-gphOONWujbeCCr6dkmMRJP94Dhp1Jvp2yt+g7n1HTv0=";
-    };
-    aarch64-darwin = {
-      arch = "darwin-arm64";
-      libc = "unknown";
-      hash = "sha256-JMnELVUxoU1C57Tzue3Sg6OfDFAjfCnzgDit0BWzmlo=";
-    };
-  };
-  bcryptAttrs =
-    bcryptHostPlatformAttrs."${stdenv.hostPlatform.system}"
-      or (throw "Unsupported architecture: ${stdenv.hostPlatform.system}");
-  bcryptVersion = "5.1.1";
-  bcryptLib = fetchurl {
-    url = "https://github.com/kelektiv/node.bcrypt.js/releases/download/v${bcryptVersion}/bcrypt_lib-v${bcryptVersion}-napi-v3-${bcryptAttrs.arch}-${bcryptAttrs.libc}.tar.gz";
-    inherit (bcryptAttrs) hash;
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "peertube";
-  version = "7.3.0";
+  version = "8.0.2";
 
   src = fetchFromGitHub {
     owner = "Chocobozzz";
     repo = "PeerTube";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WbZFOOvX6WzKB9tszxJl6z+V6cDBH6Y2SjoxF17WvUo=";
-  };
-
-  yarnOfflineCacheServer = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-T1stKz8+1ghQBJB8kujwcqmygMdoswjFBL/QWAHSis0=";
-  };
-
-  yarnOfflineCacheClient = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/client/yarn.lock";
-    hash = "sha256-jeE6Xpi/A1Ldbbp12rkG19auud61AZna/vbVE2mpp/8=";
-  };
-
-  yarnOfflineCacheAppsCli = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/apps/peertube-cli/yarn.lock";
-    hash = "sha256-lcWtZGE/6XGm8KXmzSowCHAb/vGwBoqkwk32Ru3mMYU=";
-  };
-
-  yarnOfflineCacheAppsRunner = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/apps/peertube-runner/yarn.lock";
-    hash = "sha256-OX9em03iqaRCqFuo2QO/r+CBdk7hHk3WY1EBXlFr1cY=";
+    hash = "sha256-u4LDk9r88h3EqX6ZRMPCQmjOvfJDXwV2YYrKEkGBWgs=";
   };
 
   outputs = [
@@ -82,55 +36,40 @@ stdenv.mkDerivation (finalAttrs: {
     "runner"
   ];
 
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+    hash = "sha256-1CmfcDZ23oITP8GQGIBeZP4Z5AON0f3CtdHGnpZxHgQ=";
+  };
+
   nativeBuildInputs = [
     brotli
-    fixup-yarn-lock
-    jq
-    which
-    yarn
     fd
+    jq
+    pnpmConfigHook
+    pnpm_10
+    which
   ];
 
-  buildInputs = [ nodejs_20 ];
+  buildInputs = [
+    nodejs_20
+  ];
+
+  preBuild = ''
+    # force sass-embedded to use our own sass instead of the bundled one
+    for dep in node_modules/.pnpm/sass-embedded@*; do
+      substituteInPlace $dep/node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+          --replace-fail \
+            'compilerCommand = (() => {' \
+            'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
+    done
+  '';
 
   buildPhase = ''
-    # Build node modules
+    runHook preBuild
+
     export HOME=$PWD
-    fixup-yarn-lock ~/yarn.lock
-    fixup-yarn-lock ~/client/yarn.lock
-    fixup-yarn-lock ~/apps/peertube-cli/yarn.lock
-    fixup-yarn-lock ~/apps/peertube-runner/yarn.lock
-    yarn config --offline set yarn-offline-mirror $yarnOfflineCacheServer
-    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
-    cd ~/client
-    yarn config --offline set yarn-offline-mirror $yarnOfflineCacheClient
-    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
-
-    # Switch sass-embedded to sass
-    find node_modules/vite/dist -name "*.js" -type f -exec grep -l "sass-embedded" {} \; | while read file; do
-      echo "Patching $file"
-      sed -i 's/"sass-embedded"/"sass"/g; s/'"'"'sass-embedded'"'"'/'"'"'sass'"'"'/g' "$file"
-    done
-
-    cd ~/apps/peertube-cli
-    yarn config --offline set yarn-offline-mirror $yarnOfflineCacheAppsCli
-    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
-    cd ~/apps/peertube-runner
-    yarn config --offline set yarn-offline-mirror $yarnOfflineCacheAppsRunner
-    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
-
-    patchShebangs ~/{node_modules,client/node_modules,/apps/peertube-cli/node_modules,apps/peertube-runner/node_modules,scripts}
-
-    # Fix bcrypt node module
-    cd ~/node_modules/bcrypt
-    if [ "${bcryptVersion}" != "$(cat package.json | jq -r .version)" ]; then
-      echo "Mismatching version please update bcrypt in derivation"
-      exit
-    fi
-    mkdir -p ./lib/binding && tar -C ./lib/binding -xf ${bcryptLib}
-
-    # Return to home directory
-    cd ~
 
     # Build PeerTube server
     npm run build:server
@@ -147,7 +86,8 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs ~/apps/peertube-runner/dist/peertube-runner.js
 
     # Clean up declaration files
-    find ~/dist/ \
+    find \
+      ~/dist/ \
       ~/packages/core-utils/dist/ \
       ~/packages/ffmpeg/dist/ \
       ~/packages/models/dist/ \
@@ -156,14 +96,20 @@ stdenv.mkDerivation (finalAttrs: {
       ~/packages/transcription/dist/ \
       ~/packages/typescript-utils/dist/ \
       \( -name '*.d.ts' -o -name '*.d.ts.map' \) -type f -delete
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/dist
     mv ~/dist $out
     mv ~/node_modules $out/node_modules
+
     mkdir $out/client
-    mv ~/client/{dist,node_modules,package.json,yarn.lock} $out/client
+    mv ~/client/{dist,node_modules,package.json} $out/client
+
     mkdir -p $out/packages/{core-utils,ffmpeg,models,node-utils,server-commands,transcription,typescript-utils}
     mv ~/packages/core-utils/{dist,package.json} $out/packages/core-utils
     mv ~/packages/ffmpeg/{dist,package.json} $out/packages/ffmpeg
@@ -172,22 +118,22 @@ stdenv.mkDerivation (finalAttrs: {
     mv ~/packages/server-commands/{dist,package.json} $out/packages/server-commands
     mv ~/packages/transcription/{dist,package.json} $out/packages/transcription
     mv ~/packages/typescript-utils/{dist,package.json} $out/packages/typescript-utils
-    mv ~/{config,support,CREDITS.md,FAQ.md,LICENSE,README.md,package.json,yarn.lock} $out
+    mv ~/{config,support,CREDITS.md,FAQ.md,LICENSE,README.md,package.json,pnpm-lock.yaml} $out
 
     # Remove broken symlinks in node_modules from workspace packages that aren't needed
     # by the built artifact. If any new packages break the check for broken symlinks,
     # they should be checked before adding them here to make sure they aren't likely to
     # be needed, either now or in the future. If they might be, then we probably want
     # to move the package to $out above instead of removing the broken symlink.
-    rm $out/node_modules/@peertube/{peertube-server,peertube-transcription-devtools,peertube-types-generator,tests}
-    rm $out/client/node_modules/@peertube/{peertube-transcription-devtools,peertube-types-generator,tests,player}
+    rm $out/node_modules/.pnpm/node_modules/@peertube/{peertube-cli,peertube-runner,peertube-server,peertube-transcription-devtools,peertube-types-generator,tests,player}
+    rm $out/client/node_modules/@peertube/player
 
     mkdir -p $cli/bin
-    mv ~/apps/peertube-cli/{dist,node_modules,package.json,yarn.lock} $cli
+    mv ~/apps/peertube-cli/{dist,node_modules,package.json} $cli
     ln -s $cli/dist/peertube.js $cli/bin/peertube-cli
 
     mkdir -p $runner/bin
-    mv ~/apps/peertube-runner/{dist,node_modules,package.json,yarn.lock} $runner
+    mv ~/apps/peertube-runner/{dist,node_modules,package.json} $runner
     ln -s $runner/dist/peertube-runner.js $runner/bin/peertube-runner
 
     # Create static gzip and brotli files
@@ -195,6 +141,8 @@ stdenv.mkDerivation (finalAttrs: {
       --type file --search-path $out/client/dist --threads $NIX_BUILD_CORES \
       --exec gzip -9 -n -c {} > {}.gz \;\
       --exec brotli --best -f {} -o {}.br
+
+    runHook postInstall
   '';
 
   passthru.tests.peertube = nixosTests.peertube;
@@ -228,5 +176,8 @@ stdenv.mkDerivation (finalAttrs: {
       izorkin
       stevenroose
     ];
+    teams = with lib.teams; [
+      ngi
+    ];
   };
 })
diff --git a/pkgs/by-name/pg/pgdog/package.nix b/pkgs/by-name/pg/pgdog/package.nix
new file mode 100644
index 000000000000..6256297621db
--- /dev/null
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  clangStdenv,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  useMoldLinker,
+  versionCheckHook,
+  withMold ? with clangStdenv.hostPlatform; isUnix && !isDarwin,
+}:
+let
+  stdenv = if withMold then useMoldLinker clangStdenv else clangStdenv;
+in
+rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
+  pname = "pgdog";
+  version = "0.1.28";
+
+  src = fetchFromGitHub {
+    owner = "pgdogdev";
+    repo = "pgdog";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3TRpjLlyS9XKqBPCUqW0ilwaMiAXRzg1RdF9x3GYnxY=";
+  };
+
+  cargoHash = "sha256-iqUB9m2MXbl4rgwTH2TYF6lqbpkMFng5pUAzUXzhhJs=";
+
+  # Hardcoded paths for C compiler and linker
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
+  cargoBuildFlags = [
+    "--package"
+    "pgdog"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  strictDeps = true;
+
+  # Several tests rely on networking
+  doCheck = false;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "PostgreSQL connection pooler, load balancer, and database sharder";
+    homepage = "https://pgdog.dev/";
+    changelog = "https://github.com/pgdogdev/pgdog/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "pgdog";
+    maintainers = with lib.maintainers; [ EpicEric ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/pi/picgo/launcher.cjs b/pkgs/by-name/pi/picgo/launcher.cjs
new file mode 100644
index 000000000000..52057e16628c
--- /dev/null
+++ b/pkgs/by-name/pi/picgo/launcher.cjs
@@ -0,0 +1,12 @@
+const { app } = require("electron");
+const path = require("path");
+
+// Set application name (determines config directory as ~/.config/picgo)
+app.setName("picgo");
+
+if (process.platform === "linux") {
+  app.setDesktopName("picgo.desktop");
+}
+
+// Load main process
+require(path.join(__dirname, "dist_electron/main/index.js"));
diff --git a/pkgs/by-name/pi/picgo/package.nix b/pkgs/by-name/pi/picgo/package.nix
new file mode 100644
index 000000000000..7b283e9ec5a3
--- /dev/null
+++ b/pkgs/by-name/pi/picgo/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nodejs_22,
+  pnpm,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  electron_38,
+  makeWrapper,
+  copyDesktopItems,
+  makeDesktopItem,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "picgo";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "Molunerfinn";
+    repo = "PicGo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M3cA17DoPXfldvq1vjF3P9HEXGkd+TXFuTr95iqIWsQ=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) version src;
+    pname = "picgo";
+    hash = "sha256-BfKTZy9NBfBj0MwREoxYmyvhfXP4FlADam2SwNTOJ2U=";
+    fetcherVersion = 3; # lockfileVersion 9.0 corresponds to fetcherVersion 3
+  };
+
+  nativeBuildInputs = [
+    nodejs_22
+    pnpm
+    pnpmConfigHook
+    makeWrapper
+    copyDesktopItems
+    writableTmpDirAsHomeHook
+  ];
+
+  env = {
+    NODE_ENV = "development";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Create application directory
+    mkdir -p $out/lib/picgo
+
+    # Copy build outputs
+    cp -r dist_electron $out/lib/picgo/
+    cp -r public $out/lib/picgo/
+    cp package.json $out/lib/picgo/
+    cp -r node_modules $out/lib/picgo/
+
+    # Create launcher script to set application name
+    cp ${./launcher.cjs} $out/lib/picgo/.launcher.cjs
+
+    # Create startup script
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe electron_38} $out/bin/picgo \
+      --add-flags "$out/lib/picgo/.launcher.cjs" \
+      --add-flags "--name picgo" \
+      --set NODE_ENV production \
+      --set-default ELECTRON_OZONE_PLATFORM_HINT auto \
+      --chdir "$out/lib/picgo"
+
+    # Install icons
+    for size in 256x256 512x512; do
+      if [ -f "build/icons/$size.png" ]; then
+        mkdir -p $out/share/icons/hicolor/$size/apps
+        cp "build/icons/$size.png" $out/share/icons/hicolor/$size/apps/picgo.png
+      fi
+    done
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "picgo";
+      desktopName = "PicGo";
+      genericName = "Picture Uploader";
+      comment = "A simple & beautiful tool for pictures uploading";
+      exec = "picgo %U";
+      icon = "picgo";
+      categories = [
+        "Utility"
+        "Graphics"
+      ];
+      mimeTypes = [ "x-scheme-handler/picgo" ];
+      startupWMClass = "picgo";
+    })
+  ];
+
+  meta = {
+    description = "Simple tool for uploading pictures";
+    longDescription = ''
+      PicGo is a simple & beautiful tool for uploading pictures built by `electron-vue`.
+      It supports uploading images to various cloud storage services and clipboard management.
+      The application features a plugin system for extending functionality.
+    '';
+    homepage = "https://picgo.app";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "picgo";
+    maintainers = with lib.maintainers; [ qrzbing ];
+  };
+})
diff --git a/pkgs/by-name/pi/picom-pijulius/package.nix b/pkgs/by-name/pi/picom-pijulius/package.nix
index fcda0235f81b..ad9848c4f6ef 100644
--- a/pkgs/by-name/pi/picom-pijulius/package.nix
+++ b/pkgs/by-name/pi/picom-pijulius/package.nix
@@ -8,13 +8,13 @@
 
 picom.overrideAttrs (previousAttrs: {
   pname = "picom-pijulius";
-  version = "8.2-unstable-2026-01-24";
+  version = "8.2-unstable-2026-02-08";
 
   src = fetchFromGitHub {
     owner = "pijulius";
     repo = "picom";
-    rev = "cb09df27efb4cd78417926f02338e93805067730";
-    hash = "sha256-/8865rKifoRk73YVul6IaDYmF2q1oFD9TCXDAIEEy5Q=";
+    rev = "6a97dddc348a753ecf8e34d68a5e43541186b1ee";
+    hash = "sha256-AaZ4xddlLjq3SoS0KrDA6AOHSB6sz4DWFzBMgXZ5LXE=";
   };
 
   dontVersionCheck = true;
diff --git a/pkgs/by-name/pi/pixel2svg/package.nix b/pkgs/by-name/pi/pixel2svg/package.nix
new file mode 100644
index 000000000000..1010fb369d7d
--- /dev/null
+++ b/pkgs/by-name/pi/pixel2svg/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  python3Packages,
+  fetchurl,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "pixel2svg";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchurl {
+    url = "https://static.florian-berger.de/pixel2svg-${finalAttrs.version}.zip";
+    hash = "sha256-aqcTTmZKcdRdVd8GGz5cuaQ4gjPapVJNtiiZu22TZgQ=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    pillow
+    svgwrite
+  ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    homepage = "https://florian-berger.de/en/software/pixel2svg/";
+    description = "Converts pixel art to SVG - pixel by pixel";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ annaaurora ];
+    mainProgram = "pixel2svg.py";
+  };
+})
diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index 477ec4c21039..491be34eebc4 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2026-01-16";
+  version = "0-unstable-2026-02-06";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "550788255d99f0e9ee169f12bf65d16e1ede9f7b";
-    hash = "sha256-Gx4MKLQ7Ed8XIy9oULWD1mRVcD2f7i+fb2aDjFrG9RI=";
+    rev = "2a8da3345a36148f4dca0cfb2b99cbe84ba9a50b";
+    hash = "sha256-693eUnNtuagCwfXq+FYAVHHHgHDT0CDXu7kaYK2ru9Q=";
   };
 
   vendorHash = "sha256-udLOOjBMLZ38jrX/7r+hmiUr/k6gxU0Sypo6S0ezep0=";
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index 5e5ed57a7eb7..b317a4507a58 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -34,11 +34,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.81.3";
+  version = "0.81.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-EADMAO5F8yrOFruGRd9JtRPywwUbaJ0qQa7RyCYHp8M=";
+    hash = "sha256-/i0lcF5xDCaZgr/LJriojzQzMLqV1ULT+rBmEXVMsx0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prl-tools/package.nix b/pkgs/by-name/pr/prl-tools/package.nix
index 7b7b719a530d..7a0ffc0fb7d1 100644
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "26.2.1-57371";
+  version = "26.2.2-57373";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-mmZsaLYaA9OjYwfZ75Be59n8Ve2DjdG6fGqgx8NpdLI=";
+    hash = "sha256-QsMMPzF7RRw2etxHLiOHc8ofSrO+rk/3T1Y3+zAnwnM=";
   };
 
   hardeningDisable = [
diff --git a/pkgs/by-name/pr/procmail/package.nix b/pkgs/by-name/pr/procmail/package.nix
index 824ef2cb7ae1..19041cefc29f 100644
--- a/pkgs/by-name/pr/procmail/package.nix
+++ b/pkgs/by-name/pr/procmail/package.nix
@@ -1,10 +1,15 @@
 {
   lib,
   stdenv,
+  gcc14Stdenv,
   fetchurl,
   fetchpatch,
   buildPackages,
-}:
+}@args:
+
+let
+  stdenv = if args.stdenv.cc.isGNU then gcc14Stdenv else args.stdenv;
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "procmail";
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index 21a20d0c805a..fdbbe82bfdc8 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "proto";
-  version = "0.55.0";
+  version = "0.55.2";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/8oSTdjFCTitU0u08hEN+sktsCcETgulTVVuIt4+ozs=";
+    hash = "sha256-fUotpknMclEjUGppkErBBK+P7sbkYuCv8FKhbvyiHWA=";
   };
 
-  cargoHash = "sha256-aF3ccfp1jX8xN3FEi2znExxLh0x24u/024LHdRCPSWQ=";
+  cargoHash = "sha256-Mk7HzT9GA8SfVKmiQaTsDvXqGUIuEi4cQnFZFTqC5V8=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/by-name/pr/protols/package.nix b/pkgs/by-name/pr/protols/package.nix
index bd9be0c8d3bc..2063f5d67260 100644
--- a/pkgs/by-name/pr/protols/package.nix
+++ b/pkgs/by-name/pr/protols/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protols";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = finalAttrs.version;
-    hash = "sha256-kPYCvkPVxWDNgYpieDMIwvM7Q/HWKu0hNbKW1K5jo+Y=";
+    hash = "sha256-GgCJPL18xcMSipaM4YwyuaR1sEadu1Zwyt5qWJXdS3c=";
   };
 
-  cargoHash = "sha256-TIzPXQm9SPi1H+KpZuoLag1C90skMiKQvTwXVt6jy+0=";
+  cargoHash = "sha256-1HZlNW4wLMXpFp+Z3HAEC0w3Ro+Rh/EdPxoBuFeyDjE=";
 
   env.FALLBACK_INCLUDE_PATH = "${protobuf}/include";
 
diff --git a/pkgs/by-name/pr/protonup-rs/package.nix b/pkgs/by-name/pr/protonup-rs/package.nix
index 6e5cb47f7abe..75c6276a9317 100644
--- a/pkgs/by-name/pr/protonup-rs/package.nix
+++ b/pkgs/by-name/pr/protonup-rs/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protonup-rs";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-GpKiecfEV66TGgU3f/WlQZZ4mVJD4+quZSb+45fsWpM=";
+    hash = "sha256-Ro5bYnmWs+Yjj6x5qkY2X1qBuQlvV7WIw4Oluvono54=";
   };
 
-  cargoHash = "sha256-15K6n7npZmbxDroIN09Tr5L8oTUJ0js9/cfiPQDeTTQ=";
+  cargoHash = "sha256-w6SBIsyxtbRtWRocskAG/UqBVRSvLoVS2fy9pTpWL4U=";
 
   checkFlags = [
     # Requires internet access
diff --git a/pkgs/by-name/pr/protonvpn-gui/package.nix b/pkgs/by-name/pr/protonvpn-gui/package.nix
index 4887851de5ba..b7e23c4ddf9e 100644
--- a/pkgs/by-name/pr/protonvpn-gui/package.nix
+++ b/pkgs/by-name/pr/protonvpn-gui/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "protonvpn-gui";
-  version = "4.14.0";
+  version = "4.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zmtx7lua1VsjRjtGYlkuT+u2rCJt7RQk8JRgVrLWVaM=";
+    hash = "sha256-0VshVHhJlxMb31L/gF3ujvGnsH6IMtMGwdvEpdXDwiQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index 6e38a7b68d38..efa30d77540e 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyradio";
-  version = "0.9.3.11.25";
+  version = "0.9.3.11.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = finalAttrs.version;
-    hash = "sha256-+0anoFhbADIMAMBQUqDfI7liui+7sDgUtG9+ZwFg+nI=";
+    hash = "sha256-0NcVjXkGhWYqgllEsbV+I8RzDgPn8CTPkRWRPUsmw0M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/rain-bittorrent/package.nix b/pkgs/by-name/ra/rain-bittorrent/package.nix
index 6128adcb9f73..1df3524d7a2d 100644
--- a/pkgs/by-name/ra/rain-bittorrent/package.nix
+++ b/pkgs/by-name/ra/rain-bittorrent/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rain";
-  version = "2.2.3";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "cenkalti";
     repo = "rain";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-phBZ1hIH6o4q8CU6+dheZG78OcO+e7YvJoC6hyHHNb4=";
+    hash = "sha256-g7KzqQymnB37nngi4CUuFMoLTUpc5iA3YKEoD+nJ814=";
   };
 
   vendorHash = "sha256-U4NZR3vJRLTrhE1CoCAB+7pkVnvxlJpbLmIGMFuZzWc=";
diff --git a/pkgs/by-name/re/re-isearch/package.nix b/pkgs/by-name/re/re-isearch/package.nix
index fb527df247ad..bd4b97adb99b 100644
--- a/pkgs/by-name/re/re-isearch/package.nix
+++ b/pkgs/by-name/re/re-isearch/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation {
   pname = "re-Isearch";
-  version = "2.20220925.4.0a-unstable-2026-01-14";
+  version = "2.20220925.4.0a-unstable-2026-02-06";
 
   src = fetchFromGitHub {
     owner = "re-Isearch";
     repo = "re-Isearch";
-    rev = "304fa432f4f364c96e99e12f362d8c1f4c02db08";
-    hash = "sha256-B8fjW9ulGgoU7nZerv893PV6Blnq/Nyj2YYZBsu+Tf8=";
+    rev = "4295a8c6716d63d04738c5a6486914b51e3b6dcd";
+    hash = "sha256-rQoF4HTtdQQEj86g2g2MRJdwwlLNTUpunP9+f1IZOzg=";
   };
 
   patches = [
diff --git a/pkgs/by-name/re/redli/package.nix b/pkgs/by-name/re/redli/package.nix
index 748d22d66a26..e58164bd5b7a 100644
--- a/pkgs/by-name/re/redli/package.nix
+++ b/pkgs/by-name/re/redli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "redli";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "IBM-Cloud";
     repo = "redli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pEEfJWDwMBkx2Ff9pHuvO6N8FvEe93pOI3EO40sNV+8=";
+    hash = "sha256-RSiXJwsQ1hj9+hIA4Q/xadNsS3skJhdGyJBV2LUX3n4=";
   };
 
-  vendorHash = "sha256-30a/cZNkXsR0+fv74mfFZnvsylqJDRU72t/cwJur1dU=";
+  vendorHash = "sha256-WMDQG69VWQyhDyEBzHaUIPXJChfdl/jO/POqtPxIDGU=";
 
   meta = {
     description = "Humane alternative to the Redis-cli and TLS";
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 1ee0b06f346b..ec7ea1289a99 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-01-27";
+  version = "0-unstable-2026-02-03";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "23efee6616cf3b45e519702363bb1c0748312a6f";
-    hash = "sha256-toAx1+ZjrlAq7wbCm2OcEJxEN+9vfTV1ypikQcbkskU=";
+    rev = "9a95defc04faac0c3787082245656771a3de69e6";
+    hash = "sha256-0zYTU3FVV8Inmu0Y1ZNm8RqMQBjJ4xpGKX99Tp3m0xs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/rewaita/package.nix b/pkgs/by-name/re/rewaita/package.nix
index cb461ef5680d..9a1227893b5b 100644
--- a/pkgs/by-name/re/rewaita/package.nix
+++ b/pkgs/by-name/re/rewaita/package.nix
@@ -17,7 +17,7 @@
   nix-update-script,
 }:
 let
-  version = "1.1.0";
+  version = "1.1.1";
 in
 python3Packages.buildPythonApplication {
   pname = "rewaita";
@@ -28,7 +28,7 @@ python3Packages.buildPythonApplication {
     owner = "SwordPuffin";
     repo = "Rewaita";
     tag = "v${version}";
-    hash = "sha256-B3CxtGKLvlGORae1b7vMDFbvNntVO24yrzbiHzOP28k=";
+    hash = "sha256-T9GQuhMkCEUFX2BpTTQ+zKhDpSxtVKuncITtm7nqzyY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ri/rime-moegirl/package.nix b/pkgs/by-name/ri/rime-moegirl/package.nix
index 271307fa55af..c0ba17f0c8ea 100644
--- a/pkgs/by-name/ri/rime-moegirl/package.nix
+++ b/pkgs/by-name/ri/rime-moegirl/package.nix
@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-moegirl";
-  version = "20260109";
+  version = "20260209";
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-S8zQTHMMFF0D7uW7OGAOpHXWK1KggnZZ6blvqdcGKM4=";
+    hash = "sha256-mzvxFW/lwrAnoBTQsfB1cnfUvn0D9666iWgUDpaYrcI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index d6f3eb0c71eb..50ffb68edf76 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -10,22 +10,23 @@
   glib,
   cairo,
   pango,
+  sqlite,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rofi-games";
-  version = "1.13.0";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "rofi-games";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Id2PfgLc9MQI82u7qKKJVaqpGfGFfCKZldVKlYHc5JE=";
+    hash = "sha256-LwzlBjRh9YdUGBl9+L3Vdetmy7lUdAIvjKvp8hSebvY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-EO5gVoZIB7Dduc8LfXwcBriPYyIfGNWEog1bCkegqcI=";
+    hash = "sha256-opImhuLXj3/TtpmBjjMvrcdHalxYFyv5QZ0V8poYH7U=";
   };
 
   patches = [
@@ -49,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     cairo
     pango
+    sqlite
   ];
 
   meta = {
diff --git a/pkgs/by-name/ro/ronin/package.nix b/pkgs/by-name/ro/ronin/package.nix
index e19c0ac95b84..592e68a36cad 100644
--- a/pkgs/by-name/ro/ronin/package.nix
+++ b/pkgs/by-name/ro/ronin/package.nix
@@ -9,7 +9,7 @@
 }:
 
 bundlerEnv rec {
-  name = "ronin";
+  pname = "ronin";
   version = "2.1.1";
   gemdir = ./.;
 
diff --git a/pkgs/by-name/ru/ruqola/package.nix b/pkgs/by-name/ru/ruqola/package.nix
index 77d202231c8d..01df74ca627e 100644
--- a/pkgs/by-name/ru/ruqola/package.nix
+++ b/pkgs/by-name/ru/ruqola/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ruqola";
-  version = "2.5.3";
+  version = "2.6.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "ruqola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OX4eATqcV7k+TIHQINujT5opItDwffIxC577M9q5ef8=";
+    hash = "sha256-z/JyIXZKXdOc92Ebq1Jcnhx/6EL7rkcdnxN2BsQn5Cw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rustdesk-flutter/package.nix b/pkgs/by-name/ru/rustdesk-flutter/package.nix
index 05989c11182b..fa7a1f6b554e 100644
--- a/pkgs/by-name/ru/rustdesk-flutter/package.nix
+++ b/pkgs/by-name/ru/rustdesk-flutter/package.nix
@@ -66,14 +66,14 @@ let
 in
 flutter329.buildFlutterApplication rec {
   pname = "rustdesk";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "rustdesk";
     repo = "rustdesk";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-o7jsVWiCkHaKFpAu27r/Lr1Q9g7uR/OYJdwsiQeDJUA=";
+    hash = "sha256-FRtYafsIKHnGPV8NaiaHxIHkon8/T2P83uq9taUD1Xc=";
   };
 
   strictDeps = true;
@@ -95,7 +95,7 @@ flutter329.buildFlutterApplication rec {
       src
       patches
       ;
-    hash = "sha256-gd2vS+p+1QtOWZcRWJWahFGo5rFG+soqxx3vJYSYJUo=";
+    hash = "sha256-mEtTo1ony5w/dzJcHieG9WywHirBoQ/C0WpiAr7pUVc=";
   };
 
   dontCargoBuild = true;
diff --git a/pkgs/by-name/sb/sbomnix/package.nix b/pkgs/by-name/sb/sbomnix/package.nix
index c5dde3a7d84d..1dd45df9a6d3 100644
--- a/pkgs/by-name/sb/sbomnix/package.nix
+++ b/pkgs/by-name/sb/sbomnix/package.nix
@@ -13,15 +13,7 @@ let
   python = python3.override {
     self = python3;
     packageOverrides = self: super: {
-      pyrate-limiter = super.pyrate-limiter.overridePythonAttrs (oldAttrs: rec {
-        version = "2.10.0";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src) owner repo;
-          tag = "v${version}";
-          hash = "sha256-CPusPeyTS+QyWiMHsU0ii9ZxPuizsqv0wQy3uicrDw0=";
-        };
-        doCheck = false;
-      });
+      pyrate-limiter = super.pyrate-limiter_2;
     };
   };
 
diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index 392f5743d1c5..8d2a07f4817f 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -8,17 +8,17 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.13.0";
+  version = "0.14.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-3NdqnK1/vs2Z3SnLDzJBP69E+okqVZaI6dZHEylgcPU=";
+    sha256 = "sha256-vpfkWoKu1oksHmgq86QYN7fzIcptormN9ffzXbrJJLs=";
   };
 
-  cargoHash = "sha256-aC1FXjE6aj1YUIyXoTIjFHJfTtK40ZaXOl4uV/IgqMs=";
+  cargoHash = "sha256-oiB/KKxNyKu1sxlu/Ep2cgilyJPWzRkohjKL7/azVP0=";
 
   buildFeatures = lib.optionals distributed [
     "dist-client"
diff --git a/pkgs/by-name/sc/scope-lite/package.nix b/pkgs/by-name/sc/scope-lite/package.nix
index de3b08056081..be48383fab83 100644
--- a/pkgs/by-name/sc/scope-lite/package.nix
+++ b/pkgs/by-name/sc/scope-lite/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scope-lite";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "martinmoene";
     repo = "scope-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/Vu3blgyEOQRFqhQjuT/6ukV0iWA0TdPrLnt2Z/gd6E=";
+    hash = "sha256-EZ+bBnMPpgATANa+al5SnVEfUFYc0TkaPTLNHD6zcWU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 91f71a07f0a8..bfdd09d8538c 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,29 +13,19 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-01-30";
+    version = "0-unstable-2026-02-06";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "ad42b553bf80e645f4a5cddf7d9391a501d12371";
-      hash = "sha256-ZHMJ3Ns27tiF/ez4XVNVOkdMw7Rc6xCaJphewttM914=";
+      rev = "b5bb27f231e5f24b3985cd7cbd3f371486c21a11";
+      hash = "sha256-y52R+MzPCa0zo52hZ/wnBacLLbF9k6P8UeVFobR+uUQ=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
-    pythonRelaxDeps = [
-      "certifi"
-      "flask"
-      "flask-babel"
-      "httpx-socks"
-      "lxml"
-      "markdown-it-py"
-      "msgspec"
-      "typer-slim"
-      "whitenoise"
-    ];
+    pythonRelaxDeps = true;
 
     preBuild =
       let
diff --git a/pkgs/by-name/se/sem/package.nix b/pkgs/by-name/se/sem/package.nix
index 2e45b61eeb13..f600970bef51 100644
--- a/pkgs/by-name/se/sem/package.nix
+++ b/pkgs/by-name/se/sem/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sem";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "semaphoreci";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-w9j7Lv8aSTWqH75ttazHjop+B1JbcgSuUIIGbJpR2vc=";
+    sha256 = "sha256-sWj0eenqZBanHO2E047Jd0MlphgzszvD+1ZsMFHiQ00=";
   };
 
-  vendorHash = "sha256-p8+M+pRp12P7tYlFpXjU94JcJOugQpD8rFdowhonh74=";
+  vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
   subPackages = [ "." ];
 
   ldflags = [
diff --git a/pkgs/by-name/sf/sftool/package.nix b/pkgs/by-name/sf/sftool/package.nix
index a599f0f2f795..8433b7aa3010 100644
--- a/pkgs/by-name/sf/sftool/package.nix
+++ b/pkgs/by-name/sf/sftool/package.nix
@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sftool";
-  version = "0.1.19";
+  version = "0.2.1";
   src = fetchFromGitHub {
     owner = "OpenSiFli";
     repo = "sftool";
     tag = finalAttrs.version;
-    hash = "sha256-64U7meXI8BTpve7nKmizR857QgFH9sjHVvCIfSK2dFQ=";
+    hash = "sha256-scHvBbpIZXwRC7lpY2lj0mN/ECj+uDxN4DF9sxOzy6o=";
   };
 
-  cargoHash = "sha256-FdGr0n+PvE6mFx+F4Fdhq7bbCQ2AwGEnroWjpzFH6vI=";
+  cargoHash = "sha256-ysuSGXHtpDKW3p18EgZUd0biqfK685BxKseQVHmWOWI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index a47674c4b90c..6676c5003c6f 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "signalbackup-tools";
-  version = "20260126";
+  version = "20260208";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = finalAttrs.version;
-    hash = "sha256-gmS1aZxdCPn3o+bYa5/NKEo9JZ3jq71l55t6enNxeEE=";
+    hash = "sha256-rRj8r2uJ6hbvhqzmjOdjBMGj/FlSbnI3tucnCn6oji4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slimserver/package.nix b/pkgs/by-name/sl/slimserver/package.nix
index 6eecc81e51bd..59e2a1707901 100644
--- a/pkgs/by-name/sl/slimserver/package.nix
+++ b/pkgs/by-name/sl/slimserver/package.nix
@@ -5,7 +5,7 @@
   lame,
   lib,
   makeWrapper,
-  monkeysAudio,
+  monkeys-audio,
   nixosTests,
   perlPackages,
   sox,
@@ -24,7 +24,7 @@ let
       sox
       wavpack
     ]
-    ++ (lib.optional stdenv.hostPlatform.isLinux monkeysAudio)
+    ++ (lib.optional stdenv.hostPlatform.isLinux monkeys-audio)
   );
 
   libPath = lib.makeLibraryPath [
diff --git a/pkgs/by-name/sl/slushload/package.nix b/pkgs/by-name/sl/slushload/package.nix
index 38f3fad72542..78e61950ce9a 100644
--- a/pkgs/by-name/sl/slushload/package.nix
+++ b/pkgs/by-name/sl/slushload/package.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   fetchzip,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "slushload";
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/{bin,share}
-    makeWrapper ${wineWowPackages.base}/bin/wine $out/bin/slushload \
+    makeWrapper ${wineWow64Packages.stable}/bin/wine $out/bin/slushload \
       --set WINEDEBUG "-all" \
       --run "export WINEPREFIX=''${XDG_DATA_HOME:-\$HOME/.local/share}/slushload" \
       --add-flags $src/slushload_v3.exe
@@ -42,6 +42,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     mainProgram = "slushload";
+    platforms = wineWow64Packages.stable.meta.platforms;
     maintainers = with lib.maintainers; [ matthewcroughan ];
   };
 })
diff --git a/pkgs/by-name/sm/smartmontools/package.nix b/pkgs/by-name/sm/smartmontools/package.nix
index 4d3df0776b9a..c20309345a91 100644
--- a/pkgs/by-name/sm/smartmontools/package.nix
+++ b/pkgs/by-name/sm/smartmontools/package.nix
@@ -50,6 +50,12 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-update-smart-drivedb"
   ];
 
+  outputs = [
+    "out"
+    "man"
+    "doc"
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optionals (lib.meta.availableOn stdenv.hostPlatform systemdLibs) [ systemdLibs ];
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/sn/snips-sh/package.nix b/pkgs/by-name/sn/snips-sh/package.nix
index 603d95a5906b..aedab5e3aa11 100644
--- a/pkgs/by-name/sn/snips-sh/package.nix
+++ b/pkgs/by-name/sn/snips-sh/package.nix
@@ -9,14 +9,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "snips-sh";
-  version = "0.6.1";
-  vendorHash = "sha256-1aS9aICqakGaKPVju5Y9VQ1LV5SjW3oqZciihwhORag=";
+  version = "0.7.0";
+  vendorHash = "sha256-smmfGpnHcY570RelGbE3R7cOiYLaJs+LE+H2eq8j81A=";
 
   src = fetchFromGitHub {
     owner = "robherley";
     repo = "snips.sh";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lXR6tDVH4CSJOn6n8dM1OoBqeynFnP/Hg046LH9J3Bs=";
+    hash = "sha256-WsfDFgu1a55i3lu5/nlNr7TCYOrpKMX2vsK6SqT3vrw=";
   };
 
   tags = (lib.optional (!withTensorflow) "noguesser");
diff --git a/pkgs/by-name/so/socks-to-http-proxy/package.nix b/pkgs/by-name/so/socks-to-http-proxy/package.nix
new file mode 100644
index 000000000000..28364a3d3b52
--- /dev/null
+++ b/pkgs/by-name/so/socks-to-http-proxy/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+let
+  version = "0.5.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "socks-to-http-proxy";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "KaranGauswami";
+    repo = "socks-to-http-proxy";
+    tag = "v${version}";
+    hash = "sha256-adtrGMkYueplW6rJ+pK+6+LaMU++YeV48m2Ntliqsy4=";
+  };
+
+  cargoHash = "sha256-jR0uX/edFby9OYCF0HVkRDT3fiz4bI3yGr8Yc3IlnRM=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  doCheck = false; # Skip network tests
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Converts SOCKS5 proxy into HTTP proxy";
+    homepage = "https://github.com/KaranGauswami/socks-to-http-proxy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mksafavi ];
+    mainProgram = "sthp";
+  };
+}
diff --git a/pkgs/by-name/so/solaar/package.nix b/pkgs/by-name/so/solaar/package.nix
index ff64e54077fe..2bd83cb0d174 100644
--- a/pkgs/by-name/so/solaar/package.nix
+++ b/pkgs/by-name/so/solaar/package.nix
@@ -18,14 +18,14 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "solaar";
-  version = "1.1.16";
+  version = "1.1.19";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     tag = finalAttrs.version;
-    hash = "sha256-PhZoDRsckJXk2t2qR8O3ZGGeMUhmliqSpibfQDO7BeA=";
+    hash = "sha256-Z3rWGmFQmfJvsWiPgxQmfXMPHXAAiFneBaoSVIXnAV8=";
   };
 
   outputs = [
@@ -67,7 +67,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   preConfigure = ''
     substituteInPlace lib/solaar/listener.py \
-      --replace-fail /usr/bin/getfacl "${lib.getExe' acl "getfacl"}"
+      --replace-fail getfacl "${lib.getExe' acl "getfacl"}"
   '';
 
   # the -cli symlink is just to maintain compabilility with older versions where
diff --git a/pkgs/by-name/so/solanum/dont-create-logdir.patch b/pkgs/by-name/so/solanum/dont-create-logdir.patch
index e348dd7b85ba..a9d11fe4c610 100644
--- a/pkgs/by-name/so/solanum/dont-create-logdir.patch
+++ b/pkgs/by-name/so/solanum/dont-create-logdir.patch
@@ -1,13 +1,15 @@
 diff --git a/Makefile.am b/Makefile.am
-index 19e7b396..21093521 100644
+index 99444f6c..1804c50a 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -35,9 +35,6 @@ include/serno.h:
+@@ -34,11 +34,6 @@ include/serno.h:
  		echo '#define DATECODE 0UL' >>include/serno.h; \
  	fi
  
 -install-data-hook:
 -	test -d ${DESTDIR}${logdir} || mkdir -p ${DESTDIR}${logdir}
+-	@# needed for FHS paths:
+-	test -d ${DESTDIR}${pkglocalstatedir} || mkdir -p ${DESTDIR}${pkglocalstatedir}
 -
  install-exec-hook:
  	rm -f ${DESTDIR}${libdir}/*.la
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 3c9a551458e9..d251b455cec3 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2026-01-27";
+  version = "0-unstable-2026-02-03";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "852bef71f56d206aa224231589849c4c9be81867";
-    hash = "sha256-hPlWOHplf6mOMmSX5DWY8kw6YNskTE6YYVqEmGsrnxs=";
+    rev = "9778247c3dca59370b21c4f34f328c52e8b8c669";
+    hash = "sha256-qeAO4AcrPPUW+5TA20GcLSzTKGC51IrK53K9qtBxnH4=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   ];
 
   postPatch = ''
-    substituteInPlace include/defaults.h --replace 'ETCPATH "' '"/etc/solanum'
+    substituteInPlace include/defaults.h --replace-fail 'ETCPATH "' '"/etc/solanum'
   '';
 
   preConfigure = ''
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     "--enable-ipv6"
     "--enable-openssl=${openssl.dev}"
     "--with-program-prefix=solanum-"
-    "--localstatedir=/var/lib"
+    "--localstatedir=/var"
     "--with-rundir=/run"
     "--with-logdir=/var/log"
   ]
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index 46f963b5f19c..146786bd3ab3 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spacectl";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gVDeHA1u0crhnNYYlVz5OoAgoI2voFLj33DDg84rD54=";
+    hash = "sha256-lOlG8WpM7U+U6ATgg9npT86HWnuON67517xA7U2rfYE=";
   };
 
   vendorHash = "sha256-f/09XZiaYNUZzKM0jITFdUmKt8UQy90K4PGhC6ZupCk=";
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 6ed52fb59373..0409c0dcd9a1 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -10,21 +10,23 @@
   rustPlatform,
   cargo,
   rustc,
+  python3,
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
+  removeReferencesTo,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "splayer";
-  version = "3.0.0-beta.8.2025";
+  version = "3.0.0-beta.9";
 
   src = fetchFromGitHub {
     owner = "imsyy";
     repo = "SPlayer";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-LS9Z+dfL50ICaF8WskiKswl3LD7aSrpJHu6DY9m6ByE=";
+    hash = "sha256-+9F4ckATxRE+/PhMi5c1GVDq5V9QMOogCD9uT6QkREM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -35,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-t1pZJ7j+VyvXSTctNVg2XkoQ4CA6DlkxOlK9akDghUU=";
+    hash = "sha256-tAOtrxQasIQ1IS2jKdcX4KEM5p3zhshqw8phzsj667Q=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -44,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       version
       src
       ;
-    hash = "sha256-LJuY9BFI+/GSckilZCXs3cw1EEG5Oy/iSljIABqsD/E=";
+    hash = "sha256-QKk1coOuZNaqKgvbBgorvOotHmTJ+YXTHBfyhF0L37E=";
   };
 
   nativeBuildInputs = [
@@ -54,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     rustPlatform.cargoSetupHook
     cargo
     rustc
+    python3
     makeWrapper
     copyDesktopItems
   ];
@@ -73,6 +76,21 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
+    # After the pnpm configure, we need to build the binaries of all instances
+    # of better-sqlite3. It has a native part that it wants to build using a
+    # script which is disallowed.
+    # What's more, we need to use headers from electron to avoid ABI mismatches.
+    # Adapted from mkYarnModules.
+    for f in $(find . -path '*/node_modules/better-sqlite3' -type d); do
+      (cd "$f" && (
+      npm run build-release --offline --nodedir="${electron.headers}"
+      find build -type f -exec \
+        ${lib.getExe removeReferencesTo} \
+        -t "${electron.headers}" {} \;
+      ))
+    done
+    rm -rf build/Release/{.deps,obj,obj.target,test_extension.node}
+
     pnpm build
 
     npm exec electron-builder -- \
@@ -130,9 +148,18 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Simple Netease Cloud Music player";
     homepage = "https://github.com/imsyy/SPlayer";
+    changelog = "https://github.com/imsyy/SPlayer/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     mainProgram = "splayer";
     platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      # public/wasm/ffmpeg.wasm
+      # source: https://github.com/apoint123/ffmpeg-audio-player
+      # native/ferrous-opencc-wasm/pkg/ferrous_opencc_wasm_bg.wasm
+      # source: native/ferrous-opencc-wasm
+      binaryBytecode
+    ];
   };
 })
diff --git a/pkgs/by-name/sp/spotify-qt/package.nix b/pkgs/by-name/sp/spotify-qt/package.nix
index 95829d972ec2..94b4c079e460 100644
--- a/pkgs/by-name/sp/spotify-qt/package.nix
+++ b/pkgs/by-name/sp/spotify-qt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spotify-qt";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "kraxarn";
     repo = "spotify-qt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R6ucuQdntc1OxDCV8jDAlyjAo/393HN7fjRJH70OdNs=";
+    hash = "sha256-GItr7Zxc6qzuB64UvfPB4wEzhts7E61oBN+re/M8jU4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ss/ssh-vault/package.nix b/pkgs/by-name/ss/ssh-vault/package.nix
index 360176ba00e6..aca4704f8c82 100644
--- a/pkgs/by-name/ss/ssh-vault/package.nix
+++ b/pkgs/by-name/ss/ssh-vault/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ssh-vault";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "ssh-vault";
     repo = "ssh-vault";
     tag = finalAttrs.version;
-    hash = "sha256-vrMYQ+0lRui4OhEnSOE4rth/L8J73lCo0TF+u/9MCDg=";
+    hash = "sha256-fRU2i7zzVs6Wx7y1idgMUqZhNMqLGE2UJRrSCIG0R2o=";
   };
 
-  cargoHash = "sha256-BQftk6VGqFqiq+Wo92uBrYScSLyW6BcaUk2ivZfA/Us=";
+  cargoHash = "sha256-qUp9/Ts8IUz5JgvgTekcJuSPDzVnaywmKHhzKynzDP4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/st/starboard/package.nix b/pkgs/by-name/st/starboard/package.nix
index d9c19e1d1045..8f3cddc8d775 100644
--- a/pkgs/by-name/st/starboard/package.nix
+++ b/pkgs/by-name/st/starboard/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "starboard";
-  version = "0.15.30";
+  version = "0.15.32";
 
   __darwinAllowLocalNetworking = true; # for tests
 
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "aquasecurity";
     repo = "starboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3Z2dALOgm68bPrchyXYd1HsWJbplTUV1JapYFoS/OPU=";
+    hash = "sha256-rFElikd/R5i7Itp+3XFgPRCoWd61X0IYszbcOMhcKRc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/st/steam-art-manager/package.nix b/pkgs/by-name/st/steam-art-manager/package.nix
new file mode 100644
index 000000000000..ef4318bac5fc
--- /dev/null
+++ b/pkgs/by-name/st/steam-art-manager/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  fetchurl,
+  appimageTools,
+}:
+
+let
+  pname = "steam-art-manager";
+  version = "3.12.1";
+  src = fetchurl {
+    url = "https://github.com/Tormak9970/Steam-Art-Manager/releases/download/v${version}/steam-art-manager.AppImage";
+    hash = "sha256-eH2Adl0+i+8I7+hPUyCGHzrm7xW34D7MdVex5Yi7pfI=";
+  };
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -m 444 -D "${appimageContents}/usr/share/applications/Steam Art Manager.desktop" $out/share/applications/steam-art-manager.desktop
+    install -m 444 -D "${appimageContents}/Steam Art Manager.png" $out/share/icons/hicolor/512x512/apps/steam-art-manager.png
+    substituteInPlace $out/share/applications/steam-art-manager.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}' \
+      --replace 'Icon=Steam Art Manager' 'Icon=steam-art-manager'
+  '';
+
+  meta = with lib; {
+    description = "A tool to manage and change Steam library artwork";
+    homepage = "https://github.com/Tormak9970/Steam-Art-Manager";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ adam-tj ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "steam-art-manager";
+  };
+}
diff --git a/pkgs/by-name/st/steampipe/package.nix b/pkgs/by-name/st/steampipe/package.nix
index 9f7abc31b799..fd4148c78b10 100644
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "steampipe";
-  version = "2.3.4";
+  version = "2.3.5";
 
   env.CGO_ENABLED = 0;
 
@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
     owner = "turbot";
     repo = "steampipe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6p3GbPQ60DK4V565ipZq3OZDB6Tu/5tynhka8EQQUf4=";
+    hash = "sha256-nQd+ay5t3rNSCHzhmBNF7sheESrD6KnhRDdm5KZHUI4=";
   };
 
-  vendorHash = "sha256-A4STD+EaUoYNgLwvD8B6IySE+wu+OsTydTukEnvWKjw=";
+  vendorHash = "sha256-YetZI3zWZlTZxrj7H7owSWarhq0VrXzbSOow596doT0=";
   proxyVendor = true;
 
   postPatch = ''
diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
new file mode 100644
index 000000000000..7fafd0cf3132
--- /dev/null
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -0,0 +1,99 @@
+{
+  stdenvNoCC,
+  lib,
+  asar,
+  fetchurl,
+  fetchzip,
+  makeDesktopItem,
+  copyDesktopItems,
+  makeWrapper,
+  electron,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "stoat-desktop";
+  version = "1.1.12";
+
+  src = fetchzip {
+    url = "https://github.com/stoatchat/for-desktop/releases/download/v${version}/Stoat-linux-x64-${version}.zip";
+    hash = "sha256-S3uJ4ADzDgrpKVxBdEpz73Q6bqOakzk9bObaoRZopbM=";
+    stripRoot = false;
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    asar
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    set -euo pipefail
+
+    mkdir -p "$out/bin" "$out/share/applications" "$out/share/stoat-desktop"
+
+    asarPath="$(find "$src" -type f -path '*/resources/app.asar' -print -quit || true)"
+    if [ -z "$asarPath" ]; then
+      echo "ERROR: could not find resources/app.asar in $src" >&2
+      exit 1
+    fi
+
+    resDir="$(dirname "$asarPath")"
+    appDir="$(dirname "$resDir")"
+
+    cp -a "$resDir" "$out/share/stoat-desktop/resources"
+    if [ -d "$appDir/locales" ]; then
+      cp -a "$appDir/locales" "$out/share/stoat-desktop/locales"
+    fi
+
+    mkdir -p "$out/share/icons/hicolor/scalable/apps"
+    install -m644 ${
+      fetchurl {
+        url = "https://raw.githubusercontent.com/stoatchat/assets/628eb2f8255c215148007f4227d2e0d5d1a67582/desktop/icon.svg";
+        hash = "sha256-EMDwnAtfTZqhw8hMGTbMjZUrnVkP+2HkyHlSy6pZmik=";
+      }
+    } "$out/share/icons/hicolor/scalable/apps/stoat-desktop.svg"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Stoat";
+      exec = "stoat-desktop %u";
+      icon = "stoat-desktop";
+      desktopName = "Stoat";
+      genericName = meta.description;
+      categories = [
+        "Network"
+        "Chat"
+        "InstantMessaging"
+      ];
+      startupNotify = false;
+    })
+  ];
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron "$out/bin/stoat-desktop" \
+      --add-flags "$out/share/stoat-desktop/resources/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+  '';
+
+  meta = {
+    description = "Open source user-first chat platform";
+    homepage = "https://stoat.chat/";
+    changelog = "https://github.com/stoatchat/for-desktop/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      heyimnova
+      magistau
+      v3rm1n0
+    ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "stoat-desktop";
+  };
+}
diff --git a/pkgs/by-name/su/sudo-rs/package.nix b/pkgs/by-name/su/sudo-rs/package.nix
index 7504db39c031..0d87ecc7af26 100644
--- a/pkgs/by-name/su/sudo-rs/package.nix
+++ b/pkgs/by-name/su/sudo-rs/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sudo-rs";
-  version = "0.2.11";
+  version = "0.2.12";
 
   src = fetchFromGitHub {
     owner = "trifectatechfoundation";
     repo = "sudo-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F1JwVP2GDzKCfiJXh8PXTBghNwWeD8a+TMiEaPx6wGg=";
+    hash = "sha256-VTqjsbd5CsvsNEItl8tTWnfyKHZVlYQpOQXpah68VH8=";
   };
 
-  cargoHash = "sha256-6NhyPdOAk2va8Vibsfpfq3xGLIzDBRmqxj4bZhQT9bY=";
+  cargoHash = "sha256-2h7ObKcrhtbJyoIinA1sawfpbY3Kt/8tEyZzjEdSQBI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/su/sudo/package.nix b/pkgs/by-name/su/sudo/package.nix
index f916f8d53377..781761698db3 100644
--- a/pkgs/by-name/su/sudo/package.nix
+++ b/pkgs/by-name/su/sudo/package.nix
@@ -54,6 +54,18 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-sssd-lib=${sssd}/lib"
   ];
 
+  outputs = [
+    "out"
+    "man"
+    "doc"
+    "dev"
+  ];
+  # The default stdenv ./configure flags for some reason cause the upstream's
+  # Makefile to `mkdir /var/db`, which fails in the sandbox. Since we split
+  # only trivial outputs - a single header and documentation, we can safely set
+  # the following:
+  setOutputFlags = false;
+
   postConfigure = ''
     cat >> pathnames.h <<'EOF'
       #undef _PATH_MV
diff --git a/pkgs/by-name/su/sumo/package.nix b/pkgs/by-name/su/sumo/package.nix
index 07b36b793bb5..5fd4e9147f24 100644
--- a/pkgs/by-name/su/sumo/package.nix
+++ b/pkgs/by-name/su/sumo/package.nix
@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sumo";
-  version = "1.25.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "eclipse-sumo";
     repo = "sumo";
     tag = "v${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-rUa5DpoBfnviSEmzPEiVnZU0KGavAIOFoysQ74uTll0=";
+    hash = "sha256-HMuUQeme/cmJFR71bxsgr1tqtewl3vmsclGhc6ygiyk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/su/suricata/package.nix b/pkgs/by-name/su/suricata/package.nix
index 17222d57d76f..b4c2782e8eb2 100644
--- a/pkgs/by-name/su/suricata/package.nix
+++ b/pkgs/by-name/su/suricata/package.nix
@@ -38,11 +38,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "suricata";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/suricata-${finalAttrs.version}.tar.gz";
-    hash = "sha256-nUUMosrb4QGZPpkDOmI0nSvanf2QpqzBvLbMbbdutVE=";
+    hash = "sha256-PZp7gDuXwR4GDzNJsXm+qv1vlrjIqVCF2f3AjIIoF9k=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.is64bit [
diff --git a/pkgs/by-name/sy/synthesia/package.nix b/pkgs/by-name/sy/synthesia/package.nix
index c55a6540c328..e5f913b2ce6b 100644
--- a/pkgs/by-name/sy/synthesia/package.nix
+++ b/pkgs/by-name/sy/synthesia/package.nix
@@ -5,7 +5,7 @@
   runtimeShell,
   copyDesktopItems,
   makeDesktopItem,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 let
@@ -36,7 +36,7 @@ stdenvNoCC.mkDerivation rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wineWowPackages.stable
+    wineWow64Packages.stable
   ];
 
   src = fetchurl {
@@ -53,7 +53,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/bin
     cat <<'EOF' > $out/bin/synthesia
     #!${runtimeShell}
-    export PATH=${wineWowPackages.stable}/bin:$PATH
+    export PATH=${wineWow64Packages.stable}/bin:$PATH
     export WINEARCH=win64
     export WINEPREFIX="''${SYNTHESIA_HOME:-"''${XDG_DATA_HOME:-"''${HOME}/.local/share"}/synthesia"}/wine"
     export WINEDLLOVERRIDES="mscoree=" # disable mono
@@ -75,6 +75,6 @@ stdenvNoCC.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ ners ];
-    platforms = wineWowPackages.stable.meta.platforms;
+    platforms = wineWow64Packages.stable.meta.platforms;
   };
 }
diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index 46e6d5219c14..576d856ab680 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nTdNpOloiX1yxZnjdD1CmZz0J73Mi/JaMyJzDopnPKk=";
+    hash = "sha256-UxPWSd6lIpz754ygGRrLxhgS86qHt6KJ3sdCWWDF6Bw=";
   };
 
-  vendorHash = "sha256-AkCUKg5oA2XvvDtE0m9fQdeqowx5A1SnnimF7F/CORg=";
+  vendorHash = "sha256-idtOLMg0KFUXTDl+y3uDYZekHMIyEVOzyZyNE67vXgY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index 12d08097119e..c834569748fa 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talosctl";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E3WeFu4PpgJN+ZLeTfAqqkTgInu/imytpdCixM33wiw=";
+    hash = "sha256-REQ1JAmqZLdoUMuydu4SCq0OsjWRba7s1pWabRbzB0I=";
   };
 
-  vendorHash = "sha256-1RNNAGCvmtau7oI4gSUpz+savxSugp2yh2THwt/mNG4=";
+  vendorHash = "sha256-Ni7DWXNinC+eZSajFqA5w6XJim23Yd5dhzWkZL6r4rg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index 49dd3d0915f6..780ed4c7d174 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.506.0";
+  version = "1.509.0";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-w37/8jxAxdDb0FUlS+eaQhremkXnT2xttj6sFEIxzl4=";
+    hash = "sha256-zjFMF46a/aHxNbbAfuvmX8CFxcy5Q8cajultHuBi3Ew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taproot-assets/package.nix b/pkgs/by-name/ta/taproot-assets/package.nix
index e85b69325394..9cdf1c600535 100644
--- a/pkgs/by-name/ta/taproot-assets/package.nix
+++ b/pkgs/by-name/ta/taproot-assets/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "taproot-assets";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z4lNeVmy0AEDM8ivdfXfXqi/V1LIDHV2KtS5/19+Jlk=";
+    hash = "sha256-F/I/h80+QEUpxF1fS90hgCXMubU4Hdk0ECGosSvdC1E=";
   };
 
-  vendorHash = "sha256-p75eZoM6tSayrxcKTCoXR8Jlc3y2UyzfPCtRJmDy9ew=";
+  vendorHash = "sha256-W6wAa1KAE0gBWkXeZ0VEQFyRle/qT/O3CvVAmm1nQfs=";
 
   subPackages = [
     "cmd/tapcli"
diff --git a/pkgs/by-name/te/teapot/package.nix b/pkgs/by-name/te/teapot/package.nix
index 89fdd6b4b214..31a2fefaec79 100644
--- a/pkgs/by-name/te/teapot/package.nix
+++ b/pkgs/by-name/te/teapot/package.nix
@@ -32,9 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ];
 
-  # By no known reason libtirpc is not detected
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env = {
+    # By no known reason libtirpc is not detected
+    NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+    NIX_LDFLAGS = [ "-ltirpc" ];
+  };
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
diff --git a/pkgs/by-name/te/tectonic/package.nix b/pkgs/by-name/te/tectonic/package.nix
index 200c6f8b6368..0f36036bfcfb 100644
--- a/pkgs/by-name/te/tectonic/package.nix
+++ b/pkgs/by-name/te/tectonic/package.nix
@@ -9,7 +9,8 @@
 }:
 
 symlinkJoin {
-  name = "${tectonic-unwrapped.pname}-wrapped-${tectonic-unwrapped.version}";
+  inherit (tectonic-unwrapped) version;
+  pname = "${tectonic-unwrapped.pname}-wrapped";
   paths = [ tectonic-unwrapped ];
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/te/tenacity/package.nix b/pkgs/by-name/te/tenacity/package.nix
index be4b431566fc..eefa424ddbdf 100644
--- a/pkgs/by-name/te/tenacity/package.nix
+++ b/pkgs/by-name/te/tenacity/package.nix
@@ -108,18 +108,20 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH"
   '';
 
-  # Tenacity only looks for ffmpeg at runtime, so we need to link it in manually.
-  # On darwin, these are ignored by the ffmpeg search even when linked.
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux (toString [
-    "-lavcodec"
-    "-lavdevice"
-    "-lavfilter"
-    "-lavformat"
-    "-lavutil"
-    "-lpostproc"
-    "-lswresample"
-    "-lswscale"
-  ]);
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # Tenacity only looks for ffmpeg at runtime, so we need to link it in manually.
+    # On darwin, these are ignored by the ffmpeg search even when linked.
+    NIX_LDFLAGS = toString [
+      "-lavcodec"
+      "-lavdevice"
+      "-lavfilter"
+      "-lavformat"
+      "-lavutil"
+      "-lpostproc"
+      "-lswresample"
+      "-lswscale"
+    ];
+  };
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/te/terraform-config-inspect/package.nix b/pkgs/by-name/te/terraform-config-inspect/package.nix
index 84f5fa01bbc0..c36a532bdb98 100644
--- a/pkgs/by-name/te/terraform-config-inspect/package.nix
+++ b/pkgs/by-name/te/terraform-config-inspect/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule {
   pname = "terraform-config-inspect";
-  version = "0-unstable-2026-01-20";
+  version = "0-unstable-2026-02-04";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-config-inspect";
-    rev = "785479628bd75c5577341c4b8730569940439629";
-    hash = "sha256-NZ8YxMrH1mWjgSeSk+vRuegY3EQmx0EL8vwIzDbxm44=";
+    rev = "477360eb0c774b44c9769c270aa701536576cbd7";
+    hash = "sha256-ingQyP+DhVvvz9rL+Pbec3dAYS5Qo5b5l75J98KWws4=";
   };
 
   vendorHash = "sha256-iYrSk9JqxvhYSJuSv/nhZep41gRr644ZzGFWXMGQgyc=";
diff --git a/pkgs/by-name/te/terraform-ls/package.nix b/pkgs/by-name/te/terraform-ls/package.nix
index f608090d6083..04355f8746fa 100644
--- a/pkgs/by-name/te/terraform-ls/package.nix
+++ b/pkgs/by-name/te/terraform-ls/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "terraform-ls";
-  version = "0.38.3";
+  version = "0.38.4";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-ls";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k6cOwFcyD8C0rAG/QDtzQ/J4p7lMSTzcp7r4E+TQ7Kw=";
+    hash = "sha256-lnFmeE9kPSG+r1PW83Ld5WaLqQSlfglSiUIZAtVzjF4=";
   };
 
-  vendorHash = "sha256-NIWEEJSZP3BbLdRV2sHGsomlt0e1w/wA9mOOZb86CrM=";
+  vendorHash = "sha256-g7r2+enb2j8cvRY3EP7GDIwEUfin8366ihw1r7zMhjw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tf/tf-summarize/package.nix b/pkgs/by-name/tf/tf-summarize/package.nix
index 7fa57409f616..f286ee7c2f31 100644
--- a/pkgs/by-name/tf/tf-summarize/package.nix
+++ b/pkgs/by-name/tf/tf-summarize/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tf-summarize";
-  version = "0.3.14";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "dineshba";
     repo = "tf-summarize";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yjketL/7+gsWIvltqotouSNgTCBOqVrHqiblXoCsWgI=";
+    hash = "sha256-m0XQkxcNW0QTYd3tPz9v13dsiI/jUV0eJW0Oo2vKKtk=";
   };
 
-  vendorHash = "sha256-e17oCuvPkPAJGPhFoaNZ5Bl4/OoVujkNII1akuQviE0=";
+  vendorHash = "sha256-ncXJCOmpf6cuZd7JouAlyae/+pbjmlByrT3Z32EZEhc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tf/tflint/package.nix b/pkgs/by-name/tf/tflint/package.nix
index 671c325cb75d..bd873fcaa6b5 100644
--- a/pkgs/by-name/tf/tflint/package.nix
+++ b/pkgs/by-name/tf/tflint/package.nix
@@ -12,16 +12,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "tflint";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = "tflint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hf4C8DaI+u7cAbOiQ6XvQLlF+Kl484TeJ1oJsvIw/wo=";
+    hash = "sha256-j2bP3McVCxtVEVQYs3mHWFtmUTKDIEd5aU4I/6W/Pns=";
   };
 
-  vendorHash = "sha256-aOa+FO3LA9S97wgbayAW3vY5ZCAqn72N8HxvVfThGY4=";
+  vendorHash = "sha256-R4NmHSyay0FGpOSMNPbXWxNJFH3lhyWxGeJsNefkBrc=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index d1af82448e81..f4fd79639e7f 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-xYntVFki+UgunpqTdo6PREWl7Lv+KnaMRwOUwQ24OmU=";
-    "x86_64-linux" = "sha256-OKb32S6uSTuhVSbLXrV9MhYO+ot8BaPQOBeibFKlbnI=";
-    "aarch64-linux" = "sha256-7/zZ3fXypypXT8ck++mT3InmUG1RHtbme6B2cVUx074=";
+    "universal-macos" = "sha256-NNXbkfA46kYq12SjD8G3r7fitMXwPxNdVQNslwj9p3A=";
+    "x86_64-linux" = "sha256-H+oU30NLVI9Pv7qEx9qQh7n/8+8/up5YYj9qo46UMi8=";
+    "aarch64-linux" = "sha256-ifFOvyBIT0gmfMzfIGYnV0w39M5WW/CFHzIBgdIbcho=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.69";
+  version = "0.16.70";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/ti/timemachine/package.nix b/pkgs/by-name/ti/timemachine/package.nix
index 53a088d01167..72f4afa55e41 100644
--- a/pkgs/by-name/ti/timemachine/package.nix
+++ b/pkgs/by-name/ti/timemachine/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/by-name/ti/tirith/package.nix b/pkgs/by-name/ti/tirith/package.nix
index 78e25428bd95..bfd823ef656e 100644
--- a/pkgs/by-name/ti/tirith/package.nix
+++ b/pkgs/by-name/ti/tirith/package.nix
@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage (final: {
   pname = "tirith";
-  version = "0.1.8";
+  version = "0.1.9";
   src = fetchFromGitHub {
     owner = "sheeki03";
     repo = "tirith";
     tag = "v${final.version}";
-    hash = "sha256-B/NiA7tag66wCvJMCX8oNeDiJDZVdPgOg8dhSaIGAJs=";
+    hash = "sha256-HrYpcVmHBNPB4I+Luq9EwZ003M5TU2FVHhP8CmRRi2I=";
   };
 
-  cargoHash = "sha256-DKVuZuBQ1RAfcuwSdaTq4ke6qjTXe99kPcbPz25SCPM=";
+  cargoHash = "sha256-RxKK9jnIRsvj2fOVq1cv0B4SSb5EwvBk5eIUGC2H7dY=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/to/tomat/package.nix b/pkgs/by-name/to/tomat/package.nix
index a6f40695d245..a3c5a7352b8e 100644
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tomat";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "tomat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8/AOnwCJFXScnyyg2CUhIxzcCOxeWyVlEpae9sWhhts=";
+    hash = "sha256-Oyahjz6dzEV5WwNyq2xjlBeoifXoSR48VZNqv+l8y+Y=";
   };
 
-  cargoHash = "sha256-gjeqmuzz6qdAasu1/0Gz8y+tKhJEZTu90aJabdDafsc=";
+  cargoHash = "sha256-eKuobKkNDXF/PyCcOt4nBpde+HwKyqzeOF2ZV2wpJoI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/tr/transgui/package.nix b/pkgs/by-name/tr/transgui/package.nix
index 706d43f47009..0add18952d72 100644
--- a/pkgs/by-name/tr/transgui/package.nix
+++ b/pkgs/by-name/tr/transgui/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     openssl
   ];
 
-  NIX_LDFLAGS = ''
+  env.NIX_LDFLAGS = ''
     -L${lib.getLib stdenv.cc.cc}/lib -lX11 -lglib-2.0 -lgtk-x11-2.0
     -lgdk-x11-2.0 -lgdk_pixbuf-2.0 -lpango-1.0 -latk-1.0 -lcairo
     -lc -lcrypto
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     "INSTALL_PREFIX=$(out)"
   ];
 
-  LCL_PLATFORM = "gtk2";
+  env.LCL_PLATFORM = "gtk2";
 
   desktopItem = makeDesktopItem {
     name = pname;
diff --git a/pkgs/by-name/tr/trickle/package.nix b/pkgs/by-name/tr/trickle/package.nix
index 822c250c1ad7..f1d606714a0f 100644
--- a/pkgs/by-name/tr/trickle/package.nix
+++ b/pkgs/by-name/tr/trickle/package.nix
@@ -44,14 +44,16 @@ stdenv.mkDerivation {
     sed -i 's|^_select(int|select(int|' trickle-overload.c
   '';
 
-  NIX_LDFLAGS = [
-    "-levent"
-    "-ltirpc"
-  ];
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-I${libtirpc.dev}/include/tirpc"
-    "-Wno-error=incompatible-pointer-types"
-  ];
+  env = {
+    NIX_LDFLAGS = toString [
+      "-levent"
+      "-ltirpc"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      "-I${libtirpc.dev}/include/tirpc"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
 
   configureFlags = [ "--with-libevent" ];
 
diff --git a/pkgs/by-name/tr/trufflehog/package.nix b/pkgs/by-name/tr/trufflehog/package.nix
index b8480e440afe..f2f7381b680a 100644
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "trufflehog";
-  version = "3.93.0";
+  version = "3.93.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Tvc0+xAVaPOXNo5JKTfdxDTPEhaisKVjWxbp1zEy6Rk=";
+    hash = "sha256-XGTPtvWpa9u7T/KtFwk/hE9x62j8J3dE34nRm4kF6HQ=";
   };
 
   vendorHash = "sha256-U3pznVPh/nQ4YZ5y94VF+UeISXDaWJ/gTNrY8wqq2gQ=";
diff --git a/pkgs/by-name/ts/tsidp/package.nix b/pkgs/by-name/ts/tsidp/package.nix
index 6bfa519cf646..75f00942050f 100644
--- a/pkgs/by-name/ts/tsidp/package.nix
+++ b/pkgs/by-name/ts/tsidp/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "tsidp";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tsidp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q8TkH91Nt5F+/3DPMm8AFhE+DO6Mhil4hVxdku6NTQc=";
+    hash = "sha256-quhMj015EfchFeJIl/t1Z+zman/6IAYsRumCcN2wkAw=";
   };
 
   vendorHash = "sha256-iBy+osK+2LdkTzXhrkSaB6nWpUCpr8VkxJTtcfVCFuw=";
diff --git a/pkgs/by-name/tu/turborepo-remote-cache/package.nix b/pkgs/by-name/tu/turborepo-remote-cache/package.nix
index 6a71337649e7..9b8805d9aad6 100644
--- a/pkgs/by-name/tu/turborepo-remote-cache/package.nix
+++ b/pkgs/by-name/tu/turborepo-remote-cache/package.nix
@@ -12,20 +12,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "turborepo-remote-cache";
-  version = "2.7.0";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "ducktors";
     repo = "turborepo-remote-cache";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ySMZZ9rhVNkoJzz9g1ZxfnL67xGjN2WbirINJMKQqN4=";
+    hash = "sha256-OSqQ1unaQa2f0ANfCkxS9yJKiWUd1FLil3GE+BrQhoA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-i8kXC9bRit9S1TPV9uixCkkn3KahRu/hhBeDyHm6MBc=";
+    hash = "sha256-CJE8fZEgde06Mm3sg9tRfbU/5jHT9caP67ODWCjQyJI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/un/uni-vga/package.nix b/pkgs/by-name/un/uni-vga/package.nix
index a2b8a12da10f..5295e49b1fe2 100644
--- a/pkgs/by-name/un/uni-vga/package.nix
+++ b/pkgs/by-name/un/uni-vga/package.nix
@@ -11,7 +11,8 @@
 }:
 
 stdenv.mkDerivation {
-  name = "uni-vga";
+  pname = "uni-vga";
+  version = "0-unstable-2002-10-31";
 
   src = fetchurl {
     url = "http://www.inp.nsk.su/~bolkhov/files/fonts/univga/uni-vga.tgz";
diff --git a/pkgs/by-name/un/unicorn-angr/package.nix b/pkgs/by-name/un/unicorn-angr/package.nix
index bb076522518d..061b9120ec04 100644
--- a/pkgs/by-name/un/unicorn-angr/package.nix
+++ b/pkgs/by-name/un/unicorn-angr/package.nix
@@ -23,8 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  env = lib.optionalAttrs stdenv.hostPlatform.isRiscV {
+    # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
+    NIX_LDFLAGS = "-latomic";
+  };
 
   cmakeFlags = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Some x86 tests are interrupted by signal 10
diff --git a/pkgs/by-name/un/unicorn/package.nix b/pkgs/by-name/un/unicorn/package.nix
index 54d524e33ff8..156ca182d110 100644
--- a/pkgs/by-name/un/unicorn/package.nix
+++ b/pkgs/by-name/un/unicorn/package.nix
@@ -26,8 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
     cctools
   ];
 
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  env = lib.optionalAttrs stdenv.hostPlatform.isRiscV {
+    # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
+    NIX_LDFLAGS = "-latomic";
+  };
 
   cmakeFlags = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Some x86 tests are interrupted by signal 10
diff --git a/pkgs/by-name/un/unified-memory-framework/package.nix b/pkgs/by-name/un/unified-memory-framework/package.nix
index eee9ed639a9f..a41bf4644056 100644
--- a/pkgs/by-name/un/unified-memory-framework/package.nix
+++ b/pkgs/by-name/un/unified-memory-framework/package.nix
@@ -125,11 +125,13 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   dontUseNinjaCheck = true;
 
-  NIX_LDFLAGS = lib.optionalString finalAttrs.doCheck "-rpath ${
-    lib.makeLibraryPath [
-      onetbb
-    ]
-  }";
+  env = lib.optionalAttrs finalAttrs.doCheck {
+    NIX_LDFLAGS = "-rpath ${
+      lib.makeLibraryPath [
+        onetbb
+      ]
+    }";
+  };
 
   disabledTests = [
     # These tests try to access sysfs, which is unavailable in the sandbox
diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index 8cca1d00f1c2..e1e425c5f734 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.16.1";
+  version = "3.16.2";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-C21G9bbm6z/JSPb9zqJRnpqlJB+W3Y33tbEGFZIIlTc=";
+    hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/un/unpoller/package.nix b/pkgs/by-name/un/unpoller/package.nix
index 7efd718204f4..c020617af2ad 100644
--- a/pkgs/by-name/un/unpoller/package.nix
+++ b/pkgs/by-name/un/unpoller/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "unpoller";
-  version = "2.32.0";
+  version = "2.33.0";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SEfTgLQoU8jtzFqQtj5vIei/sWHveNWvWnSfmVi7dKE=";
+    hash = "sha256-RPhM1oAQhwyNr4CjtxhrhVxw5NfO0lzOq3kx2OqzlwY=";
   };
 
-  vendorHash = "sha256-oOeCNizROwGS+OabpbSNq8dHOIA7U96a4lcF7ilkmb4=";
+  vendorHash = "sha256-Z7Wb4nQMPr3og0wWWJp3jU8lTR6hhxMz7XENkanIgQg=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/un/unzip/package.nix b/pkgs/by-name/un/unzip/package.nix
index efe3226d6cdd..985daead4d35 100644
--- a/pkgs/by-name/un/unzip/package.nix
+++ b/pkgs/by-name/un/unzip/package.nix
@@ -79,7 +79,16 @@ stdenv.mkDerivation rec {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = "-lbz2" + lib.optionalString enableNLS " -lnatspec";
+  env = {
+    NIX_LDFLAGS = toString (
+      [
+        "-lbz2"
+      ]
+      ++ lib.optionals enableNLS [
+        "-lnatspec"
+      ]
+    );
+  };
 
   buildFlags = [
     "generic"
diff --git a/pkgs/by-name/up/uptime-kuma/package.nix b/pkgs/by-name/up/uptime-kuma/package.nix
index f471f10b6a27..614975815ea1 100644
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "uptime-kuma";
-  version = "2.0.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     tag = finalAttrs.version;
-    hash = "sha256-zW5sl1g96PvDK3S6XhJ6F369/NSnvU9uSQORCQugfvs=";
+    hash = "sha256-9wgrzZrog5QMx6vnQ+kIP4pkQdvQo1QSxGZav2ikNRY=";
   };
 
-  npmDepsHash = "sha256-EmSZJUbtD4FW7Rzdpue6/bV8oZt7RUL11tFBXGJQthg=";
+  npmDepsHash = "sha256-r3QkAE1Bm2rh+h/4dpqj6c8yldcH3J1/38JYXcVV80o=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index 9e4499e8f8bb..0086300d475a 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vals";
-  version = "0.43.1";
+  version = "0.43.2";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "helmfile";
     repo = "vals";
-    sha256 = "sha256-CHDEhWdGNctl5bTbiul4T7U9yia/mn/ps9c6Zkgdqrw=";
+    sha256 = "sha256-eLYvcv+8CPtNPZpuO/mLnEHASv8z8vJYZiw509R9Ujk=";
   };
 
-  vendorHash = "sha256-Mv3mqKDokRahWoOsTDLjFrDVAfQuftkRop3wAX9wc7Y=";
+  vendorHash = "sha256-+g6bUv2FwwDiQQMSSzMxTcbdlAeYT71ADJGwjaG92cE=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/va/vassal/package.nix b/pkgs/by-name/va/vassal/package.nix
index 6983fa1d79f8..98db09a80581 100644
--- a/pkgs/by-name/va/vassal/package.nix
+++ b/pkgs/by-name/va/vassal/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.7.19";
+  version = "3.7.20";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-Es87lZVxI91AzTVpawNn4C3NGy9oGPAC+hTvOPnV4qg=";
+    sha256 = "sha256-aPJgZGRbP016w8riqIVOYnH90QvRs4hnsEdbCVJmLZc=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ve/vega-lite/package.nix b/pkgs/by-name/ve/vega-lite/package.nix
index 0cba997f3f78..2455804e525e 100644
--- a/pkgs/by-name/ve/vega-lite/package.nix
+++ b/pkgs/by-name/ve/vega-lite/package.nix
@@ -11,16 +11,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "vega-lite";
-  version = "6.4.1";
+  version = "6.4.2";
 
   src = fetchFromGitHub {
     owner = "vega";
     repo = "vega-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X6O7ZehY3tS7dFBaKnBuDokCfG+zWmSDHl1d+ifyc/o=";
+    hash = "sha256-UQEgZk9SZTSKiAfOvBxnpkyiih9QcSv08O8vt4ooeYQ=";
   };
 
-  npmDepsHash = "sha256-YjZdh5R7hawgf8EAGlKEAkqchcFuN1j2yMJo9Ptnjyk=";
+  npmDepsHash = "sha256-EOJGMmIObN4XCC4ZbZQQ89X12+STKejt6vugyIb7v0A=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index ad48f40df4e8..ab466cabed16 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -7,7 +7,7 @@
   pnpmConfigHook,
   nodejs,
   electron,
-  unstableGitUpdater,
+  nix-update-script,
   fetchFromGitHub,
   fetchPnpmDeps,
   vikunja,
@@ -15,12 +15,12 @@
 
 let
   executableName = "vikunja-desktop";
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-IJ6985gLuI0O08xZq8NYoet02NPFqQQhDLND+nfmdbA=";
+    hash = "sha256-xxfn3UoKreRDRC5GR7pLL8gkBLe6VmBYdps9eFc5c3g=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmInstallFlags
       ;
     fetcherVersion = 1;
-    hash = "sha256-BvQfRsV5hiOTkxK+W3qHvVQwMAGdLB3X+PwYBa6Bwl4=";
+    hash = "sha256-mzrck/JdfN3Qu+xhf/iM4HFamVmQkVSwUwU2KBK5XsA=";
   };
 
   env = {
@@ -94,9 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     true
   '';
 
-  passthru.updateScript = unstableGitUpdater {
-    url = "${src.meta.homepage}.git";
-  };
+  passthru.updateScript = nix-update-script { };
 
   # The desktop item properties should be kept in sync with data from upstream:
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 86621be67d0c..b88b3d9d4a6c 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -14,12 +14,12 @@
 }:
 
 let
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-IJ6985gLuI0O08xZq8NYoet02NPFqQQhDLND+nfmdbA=";
+    hash = "sha256-xxfn3UoKreRDRC5GR7pLL8gkBLe6VmBYdps9eFc5c3g=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ let
         ;
       pnpm = pnpm_10;
       fetcherVersion = 1;
-      hash = "sha256-OmLFn5aKsXPSbW6AehjkuTJMgOMzDSaYo2XbPvU6WXo=";
+      hash = "sha256-NrysokKNmKAUdiC0o4qEPvsHr7KH7mMrcrEjxwmgb+g=";
     };
 
     nativeBuildInputs = [
@@ -138,6 +138,7 @@ buildGoModule {
   passthru = {
     tests.vikunja = nixosTests.vikunja;
     frontend = frontend;
+    updateScript = ./update.sh;
   };
 
   meta = {
diff --git a/pkgs/by-name/vi/vikunja/update.sh b/pkgs/by-name/vi/vikunja/update.sh
new file mode 100755
index 000000000000..1c09f61cb0f6
--- /dev/null
+++ b/pkgs/by-name/vi/vikunja/update.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget jq nurl
+
+# shellcheck shell=bash
+
+set -euo pipefail
+
+if [[ $# -gt 1 || "${1:-}" == -* ]]; then
+    echo "Regenerates packaging data for the vikunja package."
+    echo "Usage: $0 [version]"
+    exit 1
+fi
+
+version="${1:-}"
+
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+
+if [ -z "$version" ]; then
+    TOKEN_ARGS=()
+    if [ -n "${GITHUB_TOKEN:-}" ]; then
+        TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+    fi
+    version="$(wget -q -O- ${TOKEN_ARGS[@]+"${TOKEN_ARGS[@]}"} "https://api.github.com/repos/go-vikunja/vikunja/releases?per_page=10" | jq -r '[.[] | select(.prerelease == false)][0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+cd "$(dirname "$0")"
+
+# Update version, blank out all hashes so nurl can recompute them
+sed -i -E 's#version = ".*"#version = "'"$version"'"#' package.nix
+sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
+sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
+sed -i -E 's#vendorHash = ".*"#vendorHash = ""#' package.nix
+
+# Source hash (must be computed first, pnpm and vendor depend on it)
+src_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.src")
+sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = "'"$src_hash"'"#' package.nix
+
+# pnpm dependencies hash for frontend
+pnpm_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.frontend.pnpmDeps")
+sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = "'"$pnpm_hash"'"#' package.nix
+
+# Go modules vendor hash
+vendor_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.goModules")
+sed -i -E 's#vendorHash = ".*"#vendorHash = "'"$vendor_hash"'"#' package.nix
+
+echo "Update complete!"
+echo "Version: $version"
+echo "Source hash: $src_hash"
+echo "Frontend pnpm hash: $pnpm_hash"
+echo "Go vendor hash: $vendor_hash"
diff --git a/pkgs/by-name/vs/vsftpd/package.nix b/pkgs/by-name/vs/vsftpd/package.nix
index 1e9b8c79d155..33bca86ea867 100644
--- a/pkgs/by-name/vs/vsftpd/package.nix
+++ b/pkgs/by-name/vs/vsftpd/package.nix
@@ -56,7 +56,14 @@ stdenv.mkDerivation (finalAttrs: {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
-  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap -lseccomp";
+  env.NIX_LDFLAGS = toString [
+    "-lcrypt"
+    "-lssl"
+    "-lcrypto"
+    "-lpam"
+    "-lcap"
+    "-lseccomp"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/vt/vtfedit/package.nix b/pkgs/by-name/vt/vtfedit/package.nix
index 525eaf3ec79a..d89994f0487f 100644
--- a/pkgs/by-name/vt/vtfedit/package.nix
+++ b/pkgs/by-name/vt/vtfedit/package.nix
@@ -7,11 +7,11 @@
 
   copyDesktopItems,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
   winetricks,
 }:
 let
-  wine = wineWowPackages.staging;
+  wine = wineWow64Packages.staging;
 in
 stdenv.mkDerivation rec {
   pname = "vtfedit";
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/vtfedit
 
     cp ${icon} $out/share/icons/hicolor/256x256/apps/vtfedit.png
-    cp -r ${if wine.meta.mainProgram == "wine64" then "x64" else "x86"}/* $out/share/lib
+    cp -r ${if builtins.elem "i686-linux" wine.meta.platforms then "x86" else "x64"}/* $out/share/lib
     cp ${./mimetype.xml} $out/share/mime/packages/vtfedit.xml
 
     runHook postInstall
diff --git a/pkgs/by-name/wa/wac-cli/package.nix b/pkgs/by-name/wa/wac-cli/package.nix
index 7d112611ebfc..531e4a0b91b3 100644
--- a/pkgs/by-name/wa/wac-cli/package.nix
+++ b/pkgs/by-name/wa/wac-cli/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wac-cli";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LZ8d6J9akOrXbmbQ6OOl2sTHYWvObRTyV2I8Uloa64M=";
+    hash = "sha256-X3v6MiIqtuQxVjkAG0kXzKL/Mekb32ydEeRvXsdG04I=";
   };
 
-  cargoHash = "sha256-CVNFPvcdGyndV4UURa/RY0g8J90qkp3RiuyZNOXRVIE=";
+  cargoHash = "sha256-MC5rP+mTo2CQHi70h3l1bXDWToN6o8NAkjzsuydWzGI=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index b5470d569d14..4b9bd8933119 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "41.0.1";
+  version = "41.0.3";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x3WA49sj+77uf9iy06IDPZfrRymVLlj9sRe7BF4bms0=";
+    hash = "sha256-7ToSLnVXHkY7nWJizL+gF6aWFUo4dkVeJpzP9w8IcZY=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-ub6MWrVejxRJRCaeEOls1fgAegLG2GJpFEQYORJuWLk=";
+  cargoHash = "sha256-WvDewH/jjvxU9zEbQNg2j000Xb4a9Hko5d8y8TjFwhU=";
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"
diff --git a/pkgs/by-name/wa/watcher/package.nix b/pkgs/by-name/wa/watcher/package.nix
index 55c65e9959c2..05c43ccd4ecd 100644
--- a/pkgs/by-name/wa/watcher/package.nix
+++ b/pkgs/by-name/wa/watcher/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "watcher";
-  version = "0.14.3";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "e-dant";
     repo = "watcher";
     tag = finalAttrs.version;
-    hash = "sha256-LDzZk47GHSh+SSolz7FdOVNKsNhVNrrsuNGBtXanC+U=";
+    hash = "sha256-V3s7IpnDJMV0ojNcJhg+15VXQviZptu2hB5oE/2B5Hw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/watchexec/package.nix b/pkgs/by-name/wa/watchexec/package.nix
index e43e6c7ccf1c..d3553f90056f 100644
--- a/pkgs/by-name/wa/watchexec/package.nix
+++ b/pkgs/by-name/wa/watchexec/package.nix
@@ -22,7 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework AppKit";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = toString [
+      "-framework"
+      "AppKit"
+    ];
+  };
 
   checkFlags = [
     "--skip=help"
diff --git a/pkgs/by-name/wa/wavemon/package.nix b/pkgs/by-name/wa/wavemon/package.nix
index 473ff3f86943..6e0373d951a0 100644
--- a/pkgs/by-name/wa/wavemon/package.nix
+++ b/pkgs/by-name/wa/wavemon/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavemon";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = "uoaerg";
     repo = "wavemon";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-OnELXlnzXamQflCAWuc4fxwvqHZtl+nrlTpkKK4IGKw=";
+    sha256 = "sha256-PLdlh9xs0bROShpFESvRYy78Hig4/rZ8MkQ4LMcgXTg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wayscriber/package.nix b/pkgs/by-name/wa/wayscriber/package.nix
index 1009c419be2d..337a1eae9d44 100644
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wayscriber";
-  version = "0.9.9.1";
+  version = "0.9.9.3";
 
   src = fetchFromGitHub {
     owner = "devmobasa";
     repo = "wayscriber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t7BXAIYkebaf3DpcSUCFc1+0YyazhZfsJAzwyPaJ+aM=";
+    hash = "sha256-FZHXdA1jZPktPAcWqKRkMduuloXxtIOVt/L36bLKf/g=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pango
     libxkbcommon
   ];
-  cargoHash = "sha256-QCZ0izvrWqFbVk6Nu5La1wgYrG+vMIlhHxlMipjoInA=";
+  cargoHash = "sha256-/QX1QxgUp4zvqWirbR0DnBSVoEnIrsx1UjNWM/As48c=";
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/wi/winbox3/package.nix b/pkgs/by-name/wi/winbox3/package.nix
index f9687ca6785c..6f5ed0499fc5 100644
--- a/pkgs/by-name/wi/winbox3/package.nix
+++ b/pkgs/by-name/wi/winbox3/package.nix
@@ -5,11 +5,11 @@
   copyDesktopItems,
   makeDesktopItem,
   makeBinaryWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 let
-  wine = wineWowPackages.stable;
+  wine = wineWow64Packages.stable;
   # The icon is also from the winbox AUR package (see above).
   icon = fetchurl {
     name = "winbox.png";
@@ -22,16 +22,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   version = "3.43";
 
   src = fetchurl (
-    if (wine.meta.mainProgram == "wine64") then
-      {
-        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox64.exe";
-        hash = "sha256-W0HPUf2B6NCCaH9rUiFZz0q6IubfjtxIZyHU4JUHtuk=";
-      }
-    else
+    if (builtins.elem "i686-linux" wine.meta.platforms) then
       {
         url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox.exe";
         hash = "sha256-pAOOTgmjQoXI2o2MKTDuOOpb7q0rb/zWATDNyAMOLms=";
       }
+    else
+      {
+        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox64.exe";
+        hash = "sha256-W0HPUf2B6NCCaH9rUiFZz0q6IubfjtxIZyHU4JUHtuk=";
+      }
   );
 
   dontUnpack = true;
diff --git a/pkgs/by-name/wi/wineasio/package.nix b/pkgs/by-name/wi/wineasio/package.nix
index 413ba8049e20..cbf080ac7106 100644
--- a/pkgs/by-name/wi/wineasio/package.nix
+++ b/pkgs/by-name/wi/wineasio/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libjack2,
   pkg-config,
-  wineWowPackages,
+  wineWow64Packages,
   pkgsi686Linux,
   python3,
   python3Packages,
@@ -53,7 +53,7 @@ multiStdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wineWowPackages.stable
+    wineWow64Packages.stable
   ];
 
   buildInputs = [
@@ -63,7 +63,7 @@ multiStdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  makeFlags = [ "PREFIX=${wineWowPackages.stable}" ];
+  makeFlags = [ "PREFIX=${wineWow64Packages.stable}" ];
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/wi/wiringpi/package.nix b/pkgs/by-name/wi/wiringpi/package.nix
index 5fa4ca174f72..8cea11bad067 100644
--- a/pkgs/by-name/wi/wiringpi/package.nix
+++ b/pkgs/by-name/wi/wiringpi/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "3.16";
+  version = "3.18";
   srcAll = fetchFromGitHub {
     owner = "WiringPi";
     repo = "WiringPi";
     tag = version;
-    hash = "sha256-NBHmRA+6Os6/IpW8behbgpVjtN8QF9gkffXU2ZVC8ts=";
+    hash = "sha256-7zDknn2UUR2Dt3BUJ9YI0LAjRedVyUPJAiIBiRyyphQ=";
   };
   mkSubProject =
     {
diff --git a/pkgs/by-name/wi/witr/package.nix b/pkgs/by-name/wi/witr/package.nix
index b22c6fde110e..62cd99a12c1d 100644
--- a/pkgs/by-name/wi/witr/package.nix
+++ b/pkgs/by-name/wi/witr/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "witr";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "pranshuparmar";
     repo = "witr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0OjGVdZ6WZbEtrOmkygsA5UdPya3feGNQ3jdCvxiTM0=";
+    hash = "sha256-myVl7mphBAc4BnWL62+X3hSfAkk/s0CmsZlM65n0HN0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/x1/x11spice/package.nix b/pkgs/by-name/x1/x11spice/package.nix
index 1e3d42e4dc31..df02a65b80a7 100644
--- a/pkgs/by-name/x1/x11spice/package.nix
+++ b/pkgs/by-name/x1/x11spice/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     spice-protocol
   ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = {
     description = "Enable a running X11 desktop to be available via a Spice server";
diff --git a/pkgs/by-name/xb/xbyak/package.nix b/pkgs/by-name/xb/xbyak/package.nix
index 2a1dfb8240ac..3933bc6cb6f2 100644
--- a/pkgs/by-name/xb/xbyak/package.nix
+++ b/pkgs/by-name/xb/xbyak/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xbyak";
-  version = "7.30";
+  version = "7.31";
 
   src = fetchFromGitHub {
     owner = "herumi";
     repo = "xbyak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vHm/xN3n2Xc2zPw2l3q4BXDqPluP9VlndlJIOmLBYGU=";
+    hash = "sha256-+VRyge7vDxggHKtVa6qQZCUKuhjXNixoKEu3H3wp71g=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/xd/xdg-user-dirs/package.nix b/pkgs/by-name/xd/xdg-user-dirs/package.nix
index c0423a044442..3b87f75c7f07 100644
--- a/pkgs/by-name/xd/xdg-user-dirs/package.nix
+++ b/pkgs/by-name/xd/xdg-user-dirs/package.nix
@@ -37,7 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
     libintl
   ];
 
-  NIX_LDFLAGS = if stdenv.isDarwin then "-liconv" else null;
+  env = lib.optionalAttrs stdenv.isDarwin {
+    NIX_LDFLAGS = "-liconv";
+  };
 
   preFixup = ''
     # fallback values need to be last
diff --git a/pkgs/by-name/xe/xenia-canary/package.nix b/pkgs/by-name/xe/xenia-canary/package.nix
index 6befa0a556cb..dae7a6ac363c 100644
--- a/pkgs/by-name/xe/xenia-canary/package.nix
+++ b/pkgs/by-name/xe/xenia-canary/package.nix
@@ -19,14 +19,14 @@
 }:
 llvmPackages_20.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2026-02-02";
+  version = "0-unstable-2026-02-08";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "60ffc2e83f901bcce4ccb9b9fdd86f5fe8c1bc6b";
-    hash = "sha256-2mUS3mAXaKnE7FWk+hcn1SiQZnjOaQFKi/A6l57qMI0=";
+    rev = "8f5da619f99fc66adc01c060b6b491939abae9d0";
+    hash = "sha256-2Ke5aT//FucrvhTSVfrZwPZ24Kjg0ELwQ1nAO5fMvl8=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/xf/xfitter/package.nix b/pkgs/by-name/xf/xfitter/package.nix
index c867258bbaee..57530ebc6768 100644
--- a/pkgs/by-name/xf/xfitter/package.nix
+++ b/pkgs/by-name/xf/xfitter/package.nix
@@ -66,10 +66,10 @@ stdenv.mkDerivation {
                      'cmake_minimum_required(VERSION 3.10)'
   '';
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.hostPlatform.libc == "glibc"
-  ) "-I${libtirpc.dev}/include/tirpc";
-  NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
+  env = lib.optionalAttrs (stdenv.hostPlatform.libc == "glibc") {
+    NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+    NIX_LDFLAGS = "-ltirpc";
+  };
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/by-name/xi/xidel/package.nix b/pkgs/by-name/xi/xidel/package.nix
index b28e17732440..703b77bf50b1 100644
--- a/pkgs/by-name/xi/xidel/package.nix
+++ b/pkgs/by-name/xi/xidel/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ fpc ];
   buildInputs = [ openssl ];
 
-  NIX_LDFLAGS = [ "-lcrypto" ];
+  env.NIX_LDFLAGS = toString [ "-lcrypto" ];
 
   patchPhase = ''
     patchShebangs \
diff --git a/pkgs/by-name/xk/xk6/package.nix b/pkgs/by-name/xk/xk6/package.nix
index a195a7294499..90608d3a9aa4 100644
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-qqfrvReO6V7kUV2GouBJBgc/+xOClX2WrbTkrZ+lLtA=";
+    hash = "sha256-XW5BB2vkamL4tEqE8HcjZxEZ08OyF4PuBJ8AsUJ8or8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 0d0d713b443a..abf6cf39530e 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -79,7 +79,7 @@ lib.fix (
     configureFlags = [ "--enable-soap" ];
 
     # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-    NIX_LDFLAGS = "-lgcrypt";
+    env.NIX_LDFLAGS = "-lgcrypt";
 
     postInstall = ''
       moveToOutput "bin/xmlsec1-config" "$dev"
diff --git a/pkgs/by-name/ya/yabridge/package.nix b/pkgs/by-name/ya/yabridge/package.nix
index 378e2231744e..0735d19ddfc5 100644
--- a/pkgs/by-name/ya/yabridge/package.nix
+++ b/pkgs/by-name/ya/yabridge/package.nix
@@ -8,13 +8,13 @@
   meson,
   ninja,
   pkg-config,
-  wineWowPackages,
+  wineWow64Packages,
   libxcb,
   nix-update-script,
 }:
 
 let
-  wine = wineWowPackages.yabridge;
+  wine = wineWow64Packages.yabridge;
 
   # Derived from subprojects/asio.wrap
   asio = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yabridgectl/package.nix b/pkgs/by-name/ya/yabridgectl/package.nix
index 53ee5714dc87..00ec166df7df 100644
--- a/pkgs/by-name/ya/yabridgectl/package.nix
+++ b/pkgs/by-name/ya/yabridgectl/package.nix
@@ -3,7 +3,7 @@
   rustPlatform,
   yabridge,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 rustPlatform.buildRustPackage {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage {
     wrapProgram "$out/bin/yabridgectl" \
       --prefix PATH : ${
         lib.makeBinPath [
-          wineWowPackages.yabridge # winedump
+          wineWow64Packages.yabridge # winedump
         ]
       }
   '';
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index edd2c83b2d39..bd4df58d6396 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "yamlscript";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${finalAttrs.version}/yamlscript.cli-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-qA8j14xUWtg2988ahklawnRZl9u3pvogjjXXs8byE2g=";
+    hash = "sha256-N3F2lZ81hcs2ul4AndSxSPic4hmeGAPXDS/K8iDihtw=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/ya/yandex-cloud/sources.json b/pkgs/by-name/ya/yandex-cloud/sources.json
index 2511389ba7f8..1e34bc9c5dc2 100644
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@@ -1,25 +1,25 @@
 {
-  "version": "0.188.0",
+  "version": "0.190.0",
   "binaries": {
     "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/darwin/arm64/yc",
-      "hash": "sha256-/vr9q1Do9G+kaEq3L9tSQAk1kJw9pxGDF0B9jyLvvZg="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.190.0/darwin/arm64/yc",
+      "hash": "sha256-RbqjJbeJX4+mdS/NDIpY6D2u6GPEcpZN5CLu1uYLHGw="
     },
     "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/arm64/yc",
-      "hash": "sha256-X07Y2ZgrLk1PCrX1fG0nn5OtucK8EHDvDIQ5xqKtXps="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.190.0/linux/arm64/yc",
+      "hash": "sha256-0CieXqEqty90+CUjmt9YkGrH8jmUJCPcd+RHxp+68eA="
     },
     "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/386/yc",
-      "hash": "sha256-zFcQwG1lGINWTlr/Z8ZdQvOkgXLRP2eJLuEO5X+UZug="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.190.0/linux/386/yc",
+      "hash": "sha256-qmlGjfftu0bXCSoxJa9pv7l7k+pXbDxnbujEz2yAvos="
     },
     "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/darwin/amd64/yc",
-      "hash": "sha256-V2aGj6TMuYIpIYRQtl5lFDwZcpEYT7XreSRj0MoKA1E="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.190.0/darwin/amd64/yc",
+      "hash": "sha256-KQtv6qDeU7Tc4qDDWT+lHfZZoAsyYq/mHSZ05Kfm6ck="
     },
     "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/amd64/yc",
-      "hash": "sha256-T2IaPbvNrehCT7VStjzrHLLemLeQqXjoX3fglt/5xX0="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.190.0/linux/amd64/yc",
+      "hash": "sha256-kBmX42PlaiwcyDaVUE5DqpTXr7E75sTqUgnU0naQXL8="
     }
   }
 }
diff --git a/pkgs/by-name/ya/yarn-zpm/package.nix b/pkgs/by-name/ya/yarn-zpm/package.nix
new file mode 100644
index 000000000000..8fa77ca5d160
--- /dev/null
+++ b/pkgs/by-name/ya/yarn-zpm/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "yarn-zpm";
+  version = "6.0.0-rc.13";
+
+  src = fetchFromGitHub {
+    owner = "yarnpkg";
+    repo = "zpm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mfzy2dmnQWD8B3bYhMnqAic7rv4JS6pzuqGKrrCqCY0=";
+  };
+
+  cargoHash = "sha256-k5lOVe9Ju6BjHswaN7WrzpHgyuOcHTCOEH+ExzUC5lc=";
+
+  cargoBuildFlags = [ "--package=zpm" ];
+  cargoTestFlags = [ "--package=zpm" ];
+
+  # yarn is the Yarn Switch binary (zpm-switch package), yarn-bin is the actual package manager (zpm package)
+  # See https://yarn6.netlify.app/getting-started/#:~:text=You%20can%20bypass%20Yarn%20Switch
+  postInstall = ''
+    mv $out/bin/yarn-bin $out/bin/yarn
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Yarn is an open-source package manager for JavaScript and TypeScript projects";
+    homepage = "https://yarn6.netlify.app";
+    changelog = "https://github.com/yarnpkg/zpm/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = with lib.platforms; linux ++ darwin;
+    maintainers = with lib.maintainers; [ DimitarNestorov ];
+    mainProgram = "yarn";
+  };
+})
diff --git a/pkgs/by-name/zl/zlcompressor/package.nix b/pkgs/by-name/zl/zlcompressor/package.nix
index 9b8ce4235eb3..a7fff69c4ddd 100644
--- a/pkgs/by-name/zl/zlcompressor/package.nix
+++ b/pkgs/by-name/zl/zlcompressor/package.nix
@@ -67,24 +67,25 @@ clangStdenv.mkDerivation (finalAttrs: {
   ];
 
   # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZlEqualizer#clone-and-build
diff --git a/pkgs/by-name/zl/zlequalizer/package.nix b/pkgs/by-name/zl/zlequalizer/package.nix
index 91318d2abaa7..23c73cf7e126 100644
--- a/pkgs/by-name/zl/zlequalizer/package.nix
+++ b/pkgs/by-name/zl/zlequalizer/package.nix
@@ -66,25 +66,27 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxkbcommon
   ];
 
-  # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    # JUCE dlopen's these at runtime, crashes without them
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZLEqualizer#clone-and-build
diff --git a/pkgs/by-name/zl/zlsplitter/package.nix b/pkgs/by-name/zl/zlsplitter/package.nix
index fd2f7e4aa15f..2c2097366078 100644
--- a/pkgs/by-name/zl/zlsplitter/package.nix
+++ b/pkgs/by-name/zl/zlsplitter/package.nix
@@ -66,25 +66,26 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxkbcommon
   ];
 
-  # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    # JUCE dlopen's these at runtime, crashes without them
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZlEqualizer#clone-and-build
diff --git a/pkgs/by-name/zp/zpaqfranz/package.nix b/pkgs/by-name/zp/zpaqfranz/package.nix
index 43ae82b152b8..247e72ebbb65 100644
--- a/pkgs/by-name/zp/zpaqfranz/package.nix
+++ b/pkgs/by-name/zp/zpaqfranz/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zpaqfranz";
-  version = "63.8";
+  version = "64.4";
 
   src = fetchFromGitHub {
     owner = "fcorbelli";
     repo = "zpaqfranz";
     rev = finalAttrs.version;
-    hash = "sha256-8d3Y0X5M/nkOzKtXcMW9kCQTqi8Os76u7qw//WoiByE=";
+    hash = "sha256-RSMAFEZVjI8WNzR6ipG1ev4lVvJvda8/EtHh/IJsZ2M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zr/zrythm/package.nix b/pkgs/by-name/zr/zrythm/package.nix
index df928b135fd3..815fd6f3c795 100644
--- a/pkgs/by-name/zr/zrythm/package.nix
+++ b/pkgs/by-name/zr/zrythm/package.nix
@@ -178,11 +178,14 @@ stdenv.mkDerivation (finalAttrs: {
     # "-Duser_manual=true" # needs sphinx-intl
   ];
 
-  NIX_LDFLAGS = ''
-    -lfftw3_threads -lfftw3f_threads
-  '';
+  env = {
+    NIX_LDFLAGS = toString [
+      "-lfftw3_threads"
+      "-lfftw3f_threads"
+    ];
 
-  GUILE_AUTO_COMPILE = 0;
+    GUILE_AUTO_COMPILE = 0;
+  };
 
   dontStrip = true;
 
diff --git a/pkgs/development/beam-modules/rebar3-release.nix b/pkgs/development/beam-modules/rebar3-release.nix
index 472e64978d52..11d1ebfd3ab4 100644
--- a/pkgs/development/beam-modules/rebar3-release.nix
+++ b/pkgs/development/beam-modules/rebar3-release.nix
@@ -74,7 +74,7 @@ let
 
         inherit src;
 
-        REBAR_IGNORE_DEPS = beamDeps != [ ];
+        env.REBAR_IGNORE_DEPS = beamDeps != [ ];
 
         configurePhase = ''
           runHook preConfigure
diff --git a/pkgs/development/cuda-modules/packages/cuda_nvcc.nix b/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
index 5abce2729b4a..cd2b9eee94b2 100644
--- a/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
+++ b/pkgs/development/cuda-modules/packages/cuda_nvcc.nix
@@ -168,7 +168,7 @@ buildRedist (finalAttrs: {
       # The cospi|sinpi|rsqrt function signatures in include/common/math_functions.h do not match
       # glibc 2.42's.
       # Indeed, there they are declared with noexcept(true) which is not the case in cuda_nvcc.
-      + lib.optionalString (lib.versionAtLeast glibc.version "2.42") ''
+      + lib.optionalString (cudaOlder "13.0" && lib.versionAtLeast glibc.version "2.42") ''
         nixLog "Patching math_functions.h signatures to match glibc's ones"
         substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.h" \
           --replace-fail \
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 08cfabb16f12..d1891d56fabf 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -146,7 +146,7 @@ let
             '';
 
             phpWithExtensions = symlinkJoin {
-              name = "php-with-extensions-${version}";
+              pname = "php-with-extensions";
               inherit (php) version;
               nativeBuildInputs = [ makeBinaryWrapper ];
               passthru = php.passthru // {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 13944f58ff5d..d65868fa97ea 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -386,7 +386,7 @@ stdenv.mkDerivation {
     jdupes --hard-links --link-soft --recurse "$out"
 
     # add RPATH here so Zink can find libvulkan.so
-    patchelf --add-rpath ${vulkan-loader}/lib $out/lib/libgallium*.so
+    patchelf --add-rpath ${vulkan-loader}/lib $out/lib/libgallium*.so $opencl/lib/libRusticlOpenCL.so
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index df052a2d4773..f9d236b6a568 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -32,11 +32,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "4.3.2";
+  version = "5.0.0";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-R9d0WHpxVqU3UiGMgRyFLnCsRNucUC3D85m0y4F+OBg=";
+    hash = "sha256-6TUOMiJCg+lTEfIhNPNsmOPNHGZdF/riCmzJLtPP/hE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 09df550969a4..4ee650fb3a38 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -43,7 +43,7 @@
   # io modules
   cgns,
   adios2,
-  libLAS,
+  liblas,
   gdal,
   pdal,
   alembic,
@@ -138,7 +138,7 @@ stdenv.mkDerivation (finalAttrs: {
   ) python3Packages.pythonImportsCheckHook;
 
   buildInputs = [
-    libLAS
+    liblas
     alembic
     imath
     c-blosc
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 93bf068e47cf..5756580d1680 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -79,12 +79,16 @@ let
       ]
       ++ extraNativeBuildInputs;
 
+      propagatedBuildInputs = [
+        # The headers of wlroots #include <libinput.h>, and consumers of `wlroots` need not add it explicitly, hence we propagate it.
+        libinput
+      ];
+
       buildInputs = [
         libliftoff
         libdisplay-info
         libGL
         libcap
-        libinput
         libxkbcommon
         libgbm
         pixman
diff --git a/pkgs/development/lua-modules/lux-lua.nix b/pkgs/development/lua-modules/lux-lua.nix
index 316cdc021e31..2cf916e418f8 100644
--- a/pkgs/development/lua-modules/lux-lua.nix
+++ b/pkgs/development/lua-modules/lux-lua.nix
@@ -13,6 +13,7 @@
   pkg-config,
   rustPlatform,
   toLuaModule,
+  stdenv,
 }:
 let
   luaMajorMinor = lib.take 2 (lib.splitVersion lua.version);
@@ -62,6 +63,8 @@ toLuaModule (
       LIBGIT2_NO_VENDOR = 1;
       LIBSSH2_SYS_USE_PKG_CONFIG = 1;
       LUX_SKIP_IMPURE_TESTS = 1; # Disable impure unit tests
+      # Allow undefined symbols on Darwin - they must be provided by the Lua runtime
+      RUSTFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-C link-arg=-undefined -C link-arg=dynamic_lookup";
     };
 
     buildPhase = ''
diff --git a/pkgs/development/ocaml-modules/symex/default.nix b/pkgs/development/ocaml-modules/symex/default.nix
new file mode 100644
index 000000000000..38f3405c521d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/symex/default.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  fmt,
+  prelude,
+  smtml,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "symex";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "ocamlpro";
+    repo = "symex";
+    tag = finalAttrs.version;
+    hash = "sha256-jKwFtxVcBD8Y1bfKRB8Z/MSeQLQWKvk00i8HqodkBbM=";
+  };
+
+  propagatedBuildInputs = [
+    fmt
+    prelude
+    smtml
+  ];
+
+  meta = {
+    description = "Primitives to write symbolic execution engines";
+    homepage = "https://github.com/ocamlpro/symex";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ redianthus ];
+  };
+})
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index b45c8fa98226..93dde2cfe1b1 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "16.3.0";
+  version = "17.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     tag = "v${version}";
-    hash = "sha256-t/+o1qFGIkb1BfNKNvh1CvuqezKGPyhPbEvKod2UyC4=";
+    hash = "sha256-mucJ0mMDoxyIRs3aZm3vFQ0Q0hOa2bhZHCc+e8cvvOA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildcatrust/default.nix b/pkgs/development/python-modules/buildcatrust/default.nix
index 957b0a7c41fc..2b859b5ad3f8 100644
--- a/pkgs/development/python-modules/buildcatrust/default.nix
+++ b/pkgs/development/python-modules/buildcatrust/default.nix
@@ -6,17 +6,17 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "buildcatrust";
   version = "0.4.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-GYw/RN1OK5fqo3em8hia2l/IwN76hnPnFuYprqeX144=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -37,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lukegb ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cf-xarray/default.nix b/pkgs/development/python-modules/cf-xarray/default.nix
index b1072b4aca8c..50df4370af1c 100644
--- a/pkgs/development/python-modules/cf-xarray/default.nix
+++ b/pkgs/development/python-modules/cf-xarray/default.nix
@@ -1,37 +1,31 @@
 {
   lib,
   buildPythonPackage,
+  dask,
   fetchFromGitHub,
-
-  # build-system
-  setuptools,
-  setuptools-scm,
-  xarray,
-
-  # optional-dependencies
   matplotlib,
   pint,
   pooch,
+  pytestCheckHook,
   regex,
   rich,
-  shapely,
-
-  # tests
-  dask,
-  pytestCheckHook,
   scipy,
+  setuptools-scm,
+  setuptools,
+  shapely,
+  xarray,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cf-xarray";
-  version = "0.10.10";
+  version = "0.10.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xarray-contrib";
     repo = "cf-xarray";
-    tag = "v${version}";
-    hash = "sha256-t6b4Tog0BLk5y+wi3QH6IKLbJSKw5NkLa3kJRtSBKRs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SHVSHfB80iLz8uONwH1WoUajef/YT4k0CIzTrHTG3kI=";
   };
 
   build-system = [
@@ -58,7 +52,7 @@ buildPythonPackage rec {
     pytestCheckHook
     scipy
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   pythonImportsCheck = [ "cf_xarray" ];
 
@@ -72,8 +66,8 @@ buildPythonPackage rec {
   meta = {
     description = "Accessor for xarray objects that interprets CF attributes";
     homepage = "https://github.com/xarray-contrib/cf-xarray";
-    changelog = "https://github.com/xarray-contrib/cf-xarray/releases/tag/${src.tag}";
+    changelog = "https://github.com/xarray-contrib/cf-xarray/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cgal/default.nix b/pkgs/development/python-modules/cgal/default.nix
index cc34575d0018..127651984f31 100644
--- a/pkgs/development/python-modules/cgal/default.nix
+++ b/pkgs/development/python-modules/cgal/default.nix
@@ -11,7 +11,7 @@
   cmake,
   gmp,
   onetbb,
-  LAStools,
+  lastools,
   eigen,
   mpfr,
   numpy,
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     eigen
   ]
   ++ lib.optionals withLAS [
-    LAStools
+    lastools
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/dbt-protos/default.nix b/pkgs/development/python-modules/dbt-protos/default.nix
index 1a7f384b2b0a..2176b7e4f73d 100644
--- a/pkgs/development/python-modules/dbt-protos/default.nix
+++ b/pkgs/development/python-modules/dbt-protos/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-protos";
-  version = "1.0.428";
+  version = "1.0.431";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "proto-python-public";
     tag = "v${version}";
-    hash = "sha256-cpfU/CfwqQwNysUX1rwOSi6G/rEeeNVeeeuLmksM+Iw=";
+    hash = "sha256-+aV/0668LOmMdUpjt8AIfSIHf2sohwmxQuo3DO6fvFY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-cache-url/default.nix b/pkgs/development/python-modules/django-cache-url/default.nix
index 390784d03a75..4fd1a8c1cd18 100644
--- a/pkgs/development/python-modules/django-cache-url/default.nix
+++ b/pkgs/development/python-modules/django-cache-url/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "django-cache-url";
-  version = "3.4.5";
+  version = "3.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "epicserve";
     repo = "django-cache-url";
     tag = "v${version}";
-    hash = "sha256-SjTcBYaFMD8XwIlqOgoJrc30FLrpX+M2ZcvZzA9ou6g=";
+    hash = "sha256-nXn/aDTMla4Pi6v93LoElxCpL6AFbbWKTd4TMFaK+Nk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-filer/default.nix b/pkgs/development/python-modules/django-filer/default.nix
index 5aaab801e51b..25b5cd7bedc3 100644
--- a/pkgs/development/python-modules/django-filer/default.nix
+++ b/pkgs/development/python-modules/django-filer/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django-filer";
-  version = "3.4.3";
+  version = "3.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-cms";
     repo = "django-filer";
     tag = version;
-    hash = "sha256-Zy1CkQL3FEJ4YDv0VGuRKS8XlqvFT6HjnGGZFSgOPew=";
+    hash = "sha256-HB82YDS6RV4wg10XUxGpfRzebIbI5QMvyzYq01AWWj0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-tenants/default.nix b/pkgs/development/python-modules/django-tenants/default.nix
index 7e9e787b8086..294fe6b6351c 100644
--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-tenants";
-  version = "3.9.0";
+  version = "3.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-tenants";
     repo = "django-tenants";
     tag = "v${version}";
-    hash = "sha256-oj8nh2qzdTChu6URvfWEj6FeqPq38h5N8V2G/e6hE/Q=";
+    hash = "sha256-MzpoA49LOORR8LRLdWKhVZ+zQbF9GKLqBBi/j8WecK8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index b4af10473aee..1f26f2b81d12 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-monitoring";
-  version = "2.29.0";
+  version = "2.29.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_monitoring";
     inherit (finalAttrs) version;
-    hash = "sha256-7tuK/RxOgOjGJDXwXESOnmW+kHJQpm2B5q9ZCXeCZ7Y=";
+    hash = "sha256-hsrFXN0mCFYYGdGVRPs8Epu7fc7MRF2N5CbjTNb6jkk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/itables/default.nix b/pkgs/development/python-modules/itables/default.nix
index c13f8bf76de9..bca1f8516c48 100644
--- a/pkgs/development/python-modules/itables/default.nix
+++ b/pkgs/development/python-modules/itables/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "itables";
-  version = "2.6.2";
+  version = "2.7.0";
 
   # itables has 4 different node packages, each with their own
   # package-lock.json, and partially depending on each other.
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   # the source tarball from pypi, which includes the javascript bundle already.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-P3PzBBB022Q3+9L3Loq18kyWhXB2JcCF/3FwHUPkxi8=";
+    hash = "sha256-/Z5UGXOmVPedzrvXwNh1oI23uZo/xGepHeJgx49mQ+o=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
index 18d8dee2add5..baa5c1da7edf 100644
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -7,15 +7,15 @@
   jupyter-collaboration,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupyter-collaboration-ui";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
-    inherit version;
-    hash = "sha256-ZQHBVZ/yMxWE+hg8OLIzTBiGdh5xy+CvjV9SXyXqM20=";
+    inherit (finalAttrs) version;
+    hash = "sha256-KpqOmQz10rp4+pkzRWhpHEaBXrcp4XM5JWzHplJioZY=";
   };
 
   postPatch = ''
@@ -41,4 +41,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 421e16fbe59d..b4b308884694 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -8,24 +8,25 @@
   hatchling,
 
   # dependencies
+  anyio,
   pycrdt,
-  pytestCheckHook,
 
   # tests
   pycrdt-websocket,
+  pytestCheckHook,
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupyter-ydoc";
-  version = "3.3.4";
+  version = "3.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "jupyter_ydoc";
-    tag = "v${version}";
-    hash = "sha256-hcIBLhwRLyDdl7LemK8Et10aS2AVPM0wmHAcnmpA9Zg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-k6qrkXnrz6gunqh6bx5/fLLfBBQOYJVOnJifP3aRmLI=";
   };
 
   build-system = [
@@ -33,7 +34,10 @@ buildPythonPackage rec {
     hatchling
   ];
 
-  dependencies = [ pycrdt ];
+  dependencies = [
+    anyio
+    pycrdt
+  ];
 
   pythonImportsCheck = [ "jupyter_ydoc" ];
 
@@ -47,10 +51,10 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    changelog = "https://github.com/jupyter-server/jupyter_ydoc/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jupyter-server/jupyter_ydoc/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Document structures for collaborative editing using Yjs/pycrdt";
     homepage = "https://github.com/jupyter-server/jupyter_ydoc";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index bd7125cffe1a..04cde3216496 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
 
   # build-system
   setuptools,
@@ -51,7 +52,7 @@
   tomlkit,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "kserve";
   version = "0.16.0";
   pyproject = true;
@@ -59,23 +60,22 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "kserve";
     repo = "kserve";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-f6ILZMLxfckEpy7wSgCqUx89JWSnn0DbQiqRSHcQHms=";
   };
 
-  # Fix vllm 0.12.0 compatibility
-  # Patch submitted upstream: https://github.com/kserve/kserve/pull/4882
-  postPatch = ''
-    substituteInPlace kserve/protocol/rest/openai/types/__init__.py \
-      --replace-fail \
-        "from vllm.entrypoints.openai.protocol import EmbeddingRequest, EmbeddingResponse as Embedding, EmbeddingResponseData, EmbeddingCompletionRequest" \
-        "from vllm.entrypoints.pooling.embed.protocol import EmbeddingRequest, EmbeddingResponse as Embedding, EmbeddingResponseData, EmbeddingCompletionRequest" \
-      --replace-fail \
-        "from vllm.entrypoints.openai.protocol import RerankRequest, RerankResponse as Rerank" \
-        "from vllm.entrypoints.pooling.score.protocol import RerankRequest, RerankResponse as Rerank"
-  '';
+  patches = [
+    # Fix vllm imports in python/kserve/kserve/protocol/rest/openai/types/__init__.py
+    # Submitted upstream: https://github.com/kserve/kserve/pull/4882
+    (fetchpatch2 {
+      name = "update-vllm-imports-to-fix-compat";
+      url = "https://github.com/kserve/kserve/commit/dd1575501e56f588103f448efca684bc54569b81.patch";
+      stripLen = 2;
+      hash = "sha256-K0ImsDADhH6G3R+27nRX/sD7UdRXptYIkLaoxuwB8+M=";
+    })
+  ];
 
-  sourceRoot = "${src.name}/python/kserve";
+  sourceRoot = "${finalAttrs.src.name}/python/kserve";
 
   pythonRelaxDeps = [
     "fastapi"
@@ -142,7 +142,7 @@ buildPythonPackage rec {
     pytestCheckHook
     tomlkit
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pythonImportsCheck = [ "kserve" ];
 
@@ -205,8 +205,8 @@ buildPythonPackage rec {
   meta = {
     description = "Standardized Serverless ML Inference Platform on Kubernetes";
     homepage = "https://github.com/kserve/kserve/tree/master/python/kserve";
-    changelog = "https://github.com/kserve/kserve/releases/tag/${src.tag}";
+    changelog = "https://github.com/kserve/kserve/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index 7a7bf0ec760e..b0ff30054bb2 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-sdk";
-  version = "0.3.3";
+  version = "0.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "sdk==${version}";
-    hash = "sha256-nhx/0qSdS8itk6jY/NR8iQCUNkk/LBDlGzEGddIXxLs=";
+    hash = "sha256-Jlxin3NZaPxWpp8RfrZS5qZToObQ1zcgNKPvIGkRpX0=";
   };
 
   sourceRoot = "${src.name}/libs/sdk-py";
diff --git a/pkgs/development/python-modules/lexilang/default.nix b/pkgs/development/python-modules/lexilang/default.nix
index 6f287b236cd7..6c9b34bfc66b 100644
--- a/pkgs/development/python-modules/lexilang/default.nix
+++ b/pkgs/development/python-modules/lexilang/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "lexilang";
-  version = "1.0.6";
+  version = "1.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LexiLang";
     tag = "v${version}";
-    hash = "sha256-+AtdmkYKJgQwFOK0B2jkrNfSWGaydv6tCVjNnb2DJng=";
+    hash = "sha256-5/P9u2naTTyG5l3uhrinRIAekyOYn8OKLwb/VEON2Vc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lifelines/default.nix b/pkgs/development/python-modules/lifelines/default.nix
index d6fb49c7db6f..f7c2cc852471 100644
--- a/pkgs/development/python-modules/lifelines/default.nix
+++ b/pkgs/development/python-modules/lifelines/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "lifelines";
-  version = "0.30.0";
+  version = "0.30.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CamDavidsonPilon";
     repo = "lifelines";
     tag = "v${version}";
-    hash = "sha256-rbt0eON8Az5jDvj97RDn3ppWyjbrSa/xumbwhq21g6g=";
+    hash = "sha256-zEkXuv0GmYvvDntgVVHHZdjE04uCKKp2ia+p0zAVB9s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llguidance/default.nix b/pkgs/development/python-modules/llguidance/default.nix
index a7e60c9717c5..46d1c530e138 100644
--- a/pkgs/development/python-modules/llguidance/default.nix
+++ b/pkgs/development/python-modules/llguidance/default.nix
@@ -20,21 +20,21 @@
   transformers,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "llguidance";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "guidance-ai";
     repo = "llguidance";
-    tag = "v${version}";
-    hash = "sha256-+DRJIzFqJEeinwJVyXuRQ1niQmDoNhKLHrfvFnjDL8c=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dLX01+8R6SbirFda10dufhMxARSVIXj2y8xIj95Od7A=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src pname version;
-    hash = "sha256-SQ8ahSCJUaYF7PzPfRUjCdJTJ811oTyxiLDfRre2BO0=";
+    inherit (finalAttrs) src pname version;
+    hash = "sha256-fmQ+A6spWUR0bY5LG+MGW9uTFmYJPQjx8tGxkFXttgc=";
   };
 
   nativeBuildInputs = [
@@ -96,8 +96,8 @@ buildPythonPackage rec {
   meta = {
     description = "Super-fast Structured Outputs";
     homepage = "https://github.com/guidance-ai/llguidance";
-    changelog = "https://github.com/guidance-ai/llguidance/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/guidance-ai/llguidance/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/meep/default.nix b/pkgs/development/python-modules/meep/default.nix
index a49a7bce19ca..fe4a2e3a1315 100644
--- a/pkgs/development/python-modules/meep/default.nix
+++ b/pkgs/development/python-modules/meep/default.nix
@@ -17,7 +17,7 @@
   gsl,
   harminv,
   libctl,
-  libGDSII,
+  libgdsii,
   guile,
   mpb,
   python,
@@ -65,7 +65,7 @@ buildPythonPackage rec {
     hdf5-mpi
     harminv
     libctl
-    libGDSII
+    libgdsii
     guile
     gsl
     mpb
diff --git a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
index 193b8372ffd9..4f0d3e24ee52 100644
--- a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-git-revision-date-localized-plugin";
-  version = "1.5.0";
+  version = "1.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timvink";
     repo = "mkdocs-git-revision-date-localized-plugin";
     tag = "v${version}";
-    hash = "sha256-3Txfb4ErY8moCBlXp6DgrL5BXTggu8XMa3sU4AfRS8U=";
+    hash = "sha256-y4hPiK9M0fcbZd30JCujdFpiYKEbsjXrlH8l4LEMtuY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index 200c31fd54b1..61ec422a8ea7 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "msgraph-sdk";
-  version = "1.53.0";
+  version = "1.54.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zBVqH1mPAFhMmGlaI/bYCP4d+Rsu8aH6egi4MVECtYs=";
+    hash = "sha256-xlUZFw3A9ByXswVGBsxi00n3WvLc4OzCQnIQkTZp21A=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/napari-npe2/default.nix b/pkgs/development/python-modules/napari-npe2/default.nix
index 49cfb118008d..00a70ad03454 100644
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@@ -2,31 +2,48 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
   hatchling,
   hatch-vcs,
-  pythonOlder,
-  pyyaml,
-  platformdirs,
+
+  # dependencies
   build,
+  platformdirs,
   psygnal,
   pydantic,
-  tomli-w,
-  tomli,
+  pydantic-extra-types,
+  pyyaml,
   rich,
+  tomli-w,
   typer,
+  # python<3.11 only
+  tomli,
+
+  # tests
+  imagemagick,
+  jsonschema,
+  magicgui,
+  napari-plugin-engine,
+  numpy,
+  pytest-pretty,
+  pytestCheckHook,
+
+  # passthru
   napari, # reverse dependency, for tests
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "napari-npe2";
-  version = "0.7.9";
+  version = "0.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "napari";
     repo = "npe2";
-    tag = "v${version}";
-    hash = "sha256-q+vgzUuSSHFR64OajT/j/tLsNgSm3azQPCvDlrIvceM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aZOs9wTYcblt9EZftYHKFWI/GvpZcC2KqVTAis15+Iw=";
   };
 
   build-system = [
@@ -35,13 +52,14 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    pyyaml
-    platformdirs
     build
+    platformdirs
     psygnal
     pydantic
-    tomli-w
+    pydantic-extra-types
+    pyyaml
     rich
+    tomli-w
     typer
   ]
   ++ lib.optionals (pythonOlder "3.11") [
@@ -50,6 +68,30 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "npe2" ];
 
+  nativeCheckInputs = [
+    imagemagick
+    jsonschema
+    magicgui
+    napari-plugin-engine
+    numpy
+    pytest-pretty
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Require internet connection
+    "test_cli_fetch"
+    "test_fetch_npe1_manifest_dock_widget_as_attribute"
+    "test_fetch_npe1_manifest_with_sample_data"
+    "test_fetch_npe2_manifest"
+    "test_get_manifest_from_wheel"
+    "test_get_pypi_url"
+
+    # No package or entry point found with name 'svg'
+    "test_cli_convert_svg"
+    "test_conversion"
+  ];
+
   passthru.tests = {
     inherit napari;
   };
@@ -57,8 +99,9 @@ buildPythonPackage rec {
   meta = {
     description = "Plugin system for napari (the image visualizer)";
     homepage = "https://github.com/napari/npe2";
+    changelog = "https://github.com/napari/npe2/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ SomeoneSerge ];
     mainProgram = "npe2";
   };
-}
+})
diff --git a/pkgs/development/python-modules/napari/default.nix b/pkgs/development/python-modules/napari/default.nix
index 18d79d06ceb0..725091b56a15 100644
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
 
   # build-system
@@ -53,15 +54,19 @@
   zarr,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "napari";
   version = "0.6.6";
   pyproject = true;
 
+  # napari uses pydantic v1 which is not compatible with python 3.14
+  # ValueError: '__slots__' in __slots__ conflicts with class variable
+  disabled = pythonAtLeast "3.14";
+
   src = fetchFromGitHub {
     owner = "napari";
     repo = "napari";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-F0l6GWyZ6n4HNZW7XyUk4ZBPQfrAW4DWixCaRHViDPI=";
   };
 
@@ -202,8 +207,8 @@ buildPythonPackage rec {
   meta = {
     description = "Fast, interactive, multi-dimensional image viewer";
     homepage = "https://github.com/napari/napari";
-    changelog = "https://github.com/napari/napari/releases/tag/${src.tag}";
+    changelog = "https://github.com/napari/napari/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ SomeoneSerge ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index a27f1be9e5da..55d002fe2012 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "netutils";
-  version = "1.17.0";
+  version = "1.17.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
     tag = "v${version}";
-    hash = "sha256-j5SSlbxQtJvjZoloB9eS7moiISfFcVZZPg6OG+LpyBI=";
+    hash = "sha256-LdLNDzO5ANpTqpcemgyNoZxm6LDYRonS5o8mMmdg4vM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/notobuilder/default.nix b/pkgs/development/python-modules/notobuilder/default.nix
index 6f4198953ea1..894b71e0712f 100644
--- a/pkgs/development/python-modules/notobuilder/default.nix
+++ b/pkgs/development/python-modules/notobuilder/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage {
   pname = "notobuilder";
-  version = "0-unstable-2026-01-27";
+  version = "0-unstable-2026-01-30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notobuilder";
-    rev = "5d66754065c6257278d5cb780f6b8dc80d2a686b";
-    hash = "sha256-ba9+X1ybaHW8ZWfrIuZnnJXeFZhkcXO9RXrc37mVz4U=";
+    rev = "0fa2bd755e02d57630d1f5ff7cda965454e68022";
+    hash = "sha256-ZqB/jv3KwRIiZST2Ghe3DLxnfeRDpx83LooCAdYwh5E=";
   };
 
   postPatch = ''
@@ -52,7 +52,6 @@ buildPythonPackage {
     ufo2ft
     gftools
     fontbakery
-    diffenator2
     chevron
     sh
   ]
diff --git a/pkgs/development/python-modules/ome-zarr-models/default.nix b/pkgs/development/python-modules/ome-zarr-models/default.nix
new file mode 100644
index 000000000000..85adf56190ba
--- /dev/null
+++ b/pkgs/development/python-modules/ome-zarr-models/default.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonAtLeast,
+
+  # build-system
+  hatch-vcs,
+  hatchling,
+
+  # dependencies
+  pydantic,
+  pydantic-zarr,
+  zarr,
+
+  # tests
+  aiohttp,
+  fsspec,
+  pytest-cov-stub,
+  pytest-vcr,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "ome-zarr-models";
+  version = "1.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ome-zarr-models";
+    repo = "ome-zarr-models-py";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lEzYP4AcEV6EtE+E8yqNHJPIPJ0RwWtzm77fcdxYGYk=";
+  };
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    pydantic
+    pydantic-zarr
+    zarr
+  ];
+
+  pythonImportsCheck = [ "ome_zarr_models" ];
+
+  nativeCheckInputs = [
+    aiohttp
+    fsspec
+    pytest-cov-stub
+    pytest-vcr
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Require internet connection
+    "test_bioformats2raw_get_image"
+    "test_load_remote_data"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # pydantic.errors.PydanticUserError: `Image` is not fully defined; you should define all
+    # referenced types, then call `Image.model_rebuild()`.
+    "test_datasets"
+    "test_example_hcs"
+    "test_from_zarr_ectopic_group"
+    "test_from_zarr_missing_array"
+    "test_global_transform"
+    "test_image"
+    "test_multiscale_group_ectopic_group"
+    "test_multiscale_group_missing_arrays"
+    "test_new_image"
+    "test_no_global_transform"
+    "test_non_existent_wells"
+    "test_non_existent_wells_from_zarr"
+    "test_well"
+
+    # RuntimeError: Could not successfully validate
+    # <Group file:///build/source/tests/data/examples/v04/hcs_example.ome.zarr> against any OME-Zarr
+    # group model
+    "test_cli_validate"
+    "test_load_ome_zarr_group"
+  ];
+
+  meta = {
+    description = "Minimal Python package for reading, writing and validating OME-Zarr (meta)data";
+    homepage = "https://ome-zarr-models-py.readthedocs.io/en/stable";
+    downloadPage = "https://github.com/ome-zarr-models/ome-zarr-models-py";
+    changelog = "https://github.com/ome-zarr-models/ome-zarr-models-py/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/ome-zarr/default.nix b/pkgs/development/python-modules/ome-zarr/default.nix
index 78f854f744b7..a796d577c71d 100644
--- a/pkgs/development/python-modules/ome-zarr/default.nix
+++ b/pkgs/development/python-modules/ome-zarr/default.nix
@@ -12,25 +12,27 @@
   dask,
   fsspec,
   numpy,
+  rangehttpserver,
   requests,
   scikit-image,
   toolz,
   zarr,
 
   # tests
+  ome-zarr-models,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ome-zarr";
-  version = "0.12.2";
+  version = "0.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ome";
     repo = "ome-zarr-py";
-    tag = "v${version}";
-    hash = "sha256-lwv6PHm41HFylt7b0d5LHCrCIXNWFNGg59VQvPXYtVc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bRksh6ZKqF6cL6XnWBsQRb4gRVxH/vutKtep6SyFo48=";
   };
 
   build-system = [
@@ -38,11 +40,15 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  pythonRelaxDeps = [
+    "dask"
+  ];
   dependencies = [
     aiohttp
     dask
     fsspec
     numpy
+    rangehttpserver
     requests
     scikit-image
     toolz
@@ -51,6 +57,7 @@ buildPythonPackage rec {
   ++ fsspec.optional-dependencies.s3;
 
   nativeCheckInputs = [
+    ome-zarr-models
     pytestCheckHook
   ];
 
@@ -104,9 +111,9 @@ buildPythonPackage rec {
   meta = {
     description = "Implementation of next-generation file format (NGFF) specifications for storing bioimaging data in the cloud";
     homepage = "https://pypi.org/project/ome-zarr";
-    changelog = "https://github.com/ome/ome-zarr-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/ome/ome-zarr-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.bcdarwin ];
     mainProgram = "ome_zarr";
   };
-}
+})
diff --git a/pkgs/development/python-modules/onnxruntime/default.nix b/pkgs/development/python-modules/onnxruntime/default.nix
index 16ab351739db..6d52ed8ca512 100644
--- a/pkgs/development/python-modules/onnxruntime/default.nix
+++ b/pkgs/development/python-modules/onnxruntime/default.nix
@@ -6,7 +6,7 @@
   autoPatchelfHook,
 
   # buildInputs
-  oneDNN,
+  onednn,
   re2,
 
   # dependencies
@@ -53,7 +53,7 @@ buildPythonPackage {
 
   # Libraries are not linked correctly.
   buildInputs = [
-    oneDNN
+    onednn
     re2
     onnxruntime.protobuf
 
diff --git a/pkgs/development/python-modules/pbxproj/default.nix b/pkgs/development/python-modules/pbxproj/default.nix
index 38e8011b3690..3f038b1f9859 100644
--- a/pkgs/development/python-modules/pbxproj/default.nix
+++ b/pkgs/development/python-modules/pbxproj/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pbxproj";
-  version = "4.3.2";
+  version = "4.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kronenthaler";
     repo = "mod-pbxproj";
     tag = version;
-    hash = "sha256-Kwt/ellGOZBenYBCCW13pSMsPVdJyiEklIPMtw/UDvI=";
+    hash = "sha256-Gb3JeMONOkQWm3pv2EXIU4aw1HJQiiYSr94sjTFVF/Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pueblo/default.nix b/pkgs/development/python-modules/pueblo/default.nix
index a4ff90d3c2d3..6f5c97680fe4 100644
--- a/pkgs/development/python-modules/pueblo/default.nix
+++ b/pkgs/development/python-modules/pueblo/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pueblo";
-  version = "0.0.14";
+  version = "0.0.15";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # should work for us as well.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B2uI/3SbxUdhM9OUGdwHNXKrsVQLji8E4aI9OyiIYEI=";
+    hash = "sha256-bz4ZxKp5oUfhLDMv0etJfDIPCoMcDtwCcA2hw+DAS8I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index b11f13a1295e..ea83e9dead9d 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.19";
+  version = "2.2.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pbs";
     repo = "pycaption";
     tag = version;
-    hash = "sha256-fDOE2hYOlQQs2OZ6r7wK6M66zMfHi7/0pgk9MfWb7zg=";
+    hash = "sha256-SDUTQ2oYLstFHw0rO9I3jeKIfEoAU7we66Uj4+vTXyE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydantic-zarr/default.nix b/pkgs/development/python-modules/pydantic-zarr/default.nix
new file mode 100644
index 000000000000..91e8ca9f312a
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic-zarr/default.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatch-vcs,
+  hatchling,
+
+  # dependencies
+  numpy,
+  packaging,
+  pydantic,
+
+  # tests
+  dask,
+  pytest-examples,
+  pytestCheckHook,
+  xarray,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pydantic-zarr";
+  version = "0.9.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "zarr-developers";
+    repo = "pydantic-zarr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rgtRN3EXSORa2g2a4aCZacCDLeWM6BosZe5XR0Pg6pU=";
+  };
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    numpy
+    packaging
+    pydantic
+  ];
+
+  pythonImportsCheck = [ "pydantic_zarr" ];
+
+  nativeCheckInputs = [
+    dask
+    pytest-examples
+    pytestCheckHook
+    xarray
+  ];
+
+  meta = {
+    description = "Pydantic models for Zarr";
+    homepage = "https://github.com/zarr-developers/pydantic-zarr";
+    changelog = "https://github.com/zarr-developers/pydantic-zarr/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      bsd3
+      mit
+    ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/pymobiledevice3/default.nix b/pkgs/development/python-modules/pymobiledevice3/default.nix
index 5f4a785d6d61..025b76368341 100644
--- a/pkgs/development/python-modules/pymobiledevice3/default.nix
+++ b/pkgs/development/python-modules/pymobiledevice3/default.nix
@@ -31,6 +31,7 @@
   pytest-asyncio,
   pytestCheckHook,
   python-pcapng,
+  pythonOlder,
   pytun-pmd3,
   pyusb,
   qh3,
@@ -49,14 +50,14 @@
 
 buildPythonPackage rec {
   pname = "pymobiledevice3";
-  version = "7.4.0";
+  version = "7.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "doronz88";
     repo = "pymobiledevice3";
     tag = "v${version}";
-    hash = "sha256-sFpC9qG8RxrR35W0UtLslps5hK2VFhpSka2trzIQyIc=";
+    hash = "sha256-j183S5H6jUnhOn/xMfeZtG9c4OowH/6HPpP2giko4dM=";
   };
 
   build-system = [
@@ -97,7 +98,6 @@ buildPythonPackage rec {
     qh3
     requests
     srptools
-    sslpsk-pmd3
     tqdm
     typer
     typer-injector
@@ -105,7 +105,9 @@ buildPythonPackage rec {
     wsproto
     xonsh
   ]
-  ++ fastapi.optional-dependencies.all;
+  ++ lib.optionals (pythonOlder "3.13") [
+    sslpsk-pmd3
+  ];
 
   pythonImportsCheck = [ "pymobiledevice3" ];
 
diff --git a/pkgs/development/python-modules/pyppeteer-ng/default.nix b/pkgs/development/python-modules/pyppeteer-ng/default.nix
index bf68798908a2..5e2168a8f1cb 100644
--- a/pkgs/development/python-modules/pyppeteer-ng/default.nix
+++ b/pkgs/development/python-modules/pyppeteer-ng/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "pyppeteer-ng";
-  version = "2.0.0rc12";
+  version = "2.0.0rc13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "pyppeteer-ng";
     tag = version;
-    hash = "sha256-FHvVnIBK29GFYfUahi49TlJGwyU3xc7kI4rZ+C/Q4oU=";
+    hash = "sha256-zx3uzD0y5FIw2ZWU3fPzY3nmnuhLRo7Ml+rTY1HUA9Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyrate-limiter_2/default.nix b/pkgs/development/python-modules/pyrate-limiter_2/default.nix
new file mode 100644
index 000000000000..ebfafeb6176f
--- /dev/null
+++ b/pkgs/development/python-modules/pyrate-limiter_2/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pyrate-limiter";
+  # nixpkgs-update: no auto update
+  version = "2.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "vutran1710";
+    repo = "PyrateLimiter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CPusPeyTS+QyWiMHsU0ii9ZxPuizsqv0wQy3uicrDw0=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonImportsCheck = [ "pyrate_limiter" ];
+
+  passthru.skipBulkUpdate = true;
+
+  meta = {
+    description = "Python Rate-Limiter using Leaky-Bucket Algorimth Family";
+    homepage = "https://github.com/vutran1710/PyrateLimiter";
+    changelog = "https://github.com/vutran1710/PyrateLimiter/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+})
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index 7219869ab6c7..f139162a6b19 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "pyscf";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pyscf";
     repo = "pyscf";
     tag = "v${version}";
-    hash = "sha256-/C8BKUNtp8QoSjbcSZGH2Si4JjygIygW04wtL8vGXLk=";
+    hash = "sha256-voiXNoJ7lHQeqroOs9AxqX55NDEhHVNMLeB+XzJgBQM=";
   };
 
   # setup.py calls Cmake and passes the arguments in CMAKE_CONFIGURE_ARGS to cmake.
@@ -96,6 +96,7 @@ buildPythonPackage rec {
     "test_collinear_kgks_gga"
     "test_libxc_gga_deriv4"
     "test_sacasscf_grad"
+    "test_sparse_dot"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/pysfcgal/default.nix b/pkgs/development/python-modules/pysfcgal/default.nix
new file mode 100644
index 000000000000..ac619c48eb1b
--- /dev/null
+++ b/pkgs/development/python-modules/pysfcgal/default.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  pytestCheckHook,
+
+  cffi,
+  icontract,
+  setuptools,
+  sfcgal,
+  wheel,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pysfcgal";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "sfcgal";
+    repo = "pysfcgal";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/G6yC7u2CYM7D9xO2IOB8+AjWc4ErzTIdvHmwGRxXBc=";
+  };
+
+  buildInputs = [
+    sfcgal
+  ];
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    cffi
+  ];
+
+  pythonImportsCheck = [
+    "pysfcgal"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    icontract
+  ];
+
+  # remove src module, so tests use the installed module instead
+  preCheck = ''
+    rm -rf pysfcgal
+  '';
+
+  disabledTests = [
+    # this test is failing due to mismatched output
+    "test_wrap_geom_segfault"
+  ];
+
+  meta = {
+    description = "Python wrapper for SFCGAL";
+    homepage = "https://gitlab.com/sfcgal/pysfcgal";
+    changelog = "https://gitlab.com/sfcgal/pysfcgal/-/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Plus;
+    teams = with lib.teams; [
+      geospatial
+      ngi
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/python-sat/default.nix b/pkgs/development/python-modules/python-sat/default.nix
index 8f7b2f14618d..7f4a8cf420a3 100644
--- a/pkgs/development/python-modules/python-sat/default.nix
+++ b/pkgs/development/python-modules/python-sat/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "python-sat";
-  version = "1.8.dev28";
+  version = "1.8.dev30";
   pyproject = true;
 
   build-system = [ setuptools ];
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "python_sat";
-    hash = "sha256-eFBUismC7x2+ng+8rbXxZTis/xNKSx2I/lVkCbx4dgo=";
+    hash = "sha256-KaR6NPD6wzA0WcYzq/ptRFBeI0Pfumz/S2rVlsDKnU4=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/redbaron/default.nix b/pkgs/development/python-modules/redbaron/default.nix
index 2e8a90f8eef5..b3d2ce75643e 100644
--- a/pkgs/development/python-modules/redbaron/default.nix
+++ b/pkgs/development/python-modules/redbaron/default.nix
@@ -1,34 +1,61 @@
 {
   lib,
-  fetchPypi,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   baron,
+
+  # tests
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "redbaron";
   version = "0.9.2";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0bqkq0wn20cc3qrcd1ifq74p4m570j345bkq4axl08kbr8whfba7";
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = "redbaron";
+    tag = finalAttrs.version;
+    hash = "sha256-Wgq7ltAsy4aPtfEiLp42p5pfcc/w9U0kFJTVNqy0iio=";
   };
 
-  propagatedBuildInputs = [ baron ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    baron
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   preCheck = ''
-    rm -rf tests/__pycache__
-    rm tests/test_bounding_box.py
-  ''; # error about fixtures
+    cd tests
+  '';
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  disabledTestPaths = [
+    "test_bounding_box.py"
+  ];
+
+  disabledTests = [
+    # AssertionError: assert '0 ----------...39m\x1b[39m\n' == '0 ----------...5m]\x1b[39m\n'
+    "test_highlight"
+  ];
 
   meta = {
-    homepage = "https://github.com/PyCQA/redbaron";
     description = "Abstraction on top of baron, a FST for python to make writing refactoring code a realistic task";
+    homepage = "https://redbaron.readthedocs.io/en/latest";
+    downloadPage = "https://github.com/PyCQA/redbaron";
+    changelog = "https://github.com/PyCQA/redbaron/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ marius851000 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/requests-ratelimiter/default.nix b/pkgs/development/python-modules/requests-ratelimiter/default.nix
index 78d9be2c7e85..08da327b0acd 100644
--- a/pkgs/development/python-modules/requests-ratelimiter/default.nix
+++ b/pkgs/development/python-modules/requests-ratelimiter/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  hatchling,
   pyrate-limiter,
   pytestCheckHook,
   requests-mock,
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     hash = "sha256-/fyZ+fjboAw97FPI6TgcjHRUAJbdNomvh7xJqTrTmuY=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     pyrate-limiter
diff --git a/pkgs/development/python-modules/smbprotocol/default.nix b/pkgs/development/python-modules/smbprotocol/default.nix
index 264182010e2d..52a9c6c6ad5b 100644
--- a/pkgs/development/python-modules/smbprotocol/default.nix
+++ b/pkgs/development/python-modules/smbprotocol/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "smbprotocol";
-  version = "1.15.0";
+  version = "1.16.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = "smbprotocol";
     tag = "v${version}";
-    hash = "sha256-4BIrJAYazU4Bm6V1bYW/Bw2MXpR7CQpGQ6JammJ75HI=";
+    hash = "sha256-OZedYBOMBO/EegSvg7aq5lIOWdxSOHh+yHDFZ7bwLec=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
index 344b61d65464..de5a3cbdf62d 100644
--- a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
+++ b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "snakemake-storage-plugin-xrootd";
-  version = "0.4.1";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = "snakemake-storage-plugin-xrootd";
     tag = "v${version}";
-    hash = "sha256-vfMAgOTmT3uzUZHXeKsd8Ze3+b3nFsVHDhkPG+xvz+k=";
+    hash = "sha256-QYG/BE7y3h/Mz1PrVVxmfBBLBLoirrEx9unSEaflUds=";
   };
 
   # xrootd<6.0.0,>=5.6.4 not satisfied by version 5.7rc20240303
diff --git a/pkgs/development/python-modules/spyder-kernels/default.nix b/pkgs/development/python-modules/spyder-kernels/default.nix
index 94ccc8bd5749..e92b5f9d6212 100644
--- a/pkgs/development/python-modules/spyder-kernels/default.nix
+++ b/pkgs/development/python-modules/spyder-kernels/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonAtLeast,
 
   # build-system
   setuptools,
@@ -32,7 +33,7 @@
   xarray,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spyder-kernels";
   version = "3.1.2";
   pyproject = true;
@@ -40,16 +41,12 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "spyder-ide";
     repo = "spyder-kernels";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-HqjgeCmjQfwSVaJNWnDYHGeC81/iLzmAmnFrPhpwfLY=";
   };
 
   build-system = [ setuptools ];
 
-  pythonRelaxDeps = [
-    "ipython"
-  ];
-
   dependencies = [
     cloudpickle
     ipykernel
@@ -89,16 +86,22 @@ buildPythonPackage rec {
     "test_multiprocessing"
     "test_np_threshold"
     "test_runfile"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # AttributeError: 'Frame' object has no attribute 'f_locals'. Did you mean: 'f_globals'?
+    "test_functions_with_locals_in_pdb"
   ];
 
   pythonImportsCheck = [ "spyder_kernels" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Jupyter kernels for Spyder's console";
     homepage = "https://docs.spyder-ide.org/current/ipythonconsole.html";
     downloadPage = "https://github.com/spyder-ide/spyder-kernels/releases";
-    changelog = "https://github.com/spyder-ide/spyder-kernels/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/spyder-ide/spyder-kernels/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index a37aea0a6971..74f777f71fe2 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.10";
+  version = "1.10.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ed3j0gUKvpy5AtUICD5H+FLCYZLzPepiB1vF6VEL7E0=";
+    hash = "sha256-ggSAEq3Lbk+5b8FSHoZCIfGUsmxi7erYB2/hg21TPtU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/subarulink/default.nix b/pkgs/development/python-modules/subarulink/default.nix
index 845b3de41053..f6a7d7056211 100644
--- a/pkgs/development/python-modules/subarulink/default.nix
+++ b/pkgs/development/python-modules/subarulink/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "subarulink";
-  version = "0.7.18";
+  version = "0.7.19";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "G-Two";
     repo = "subarulink";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GzTIgxFBmVjdM+D5IxHAoqDW29ZJEywX4+B217ZdITM=";
+    hash = "sha256-+huEDrcMjCMUKnzL0wfqnpVjIm8zebV3qAq4OWLZ+GU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/superqt/default.nix b/pkgs/development/python-modules/superqt/default.nix
index aaba190c7e63..5badb14be18a 100644
--- a/pkgs/development/python-modules/superqt/default.nix
+++ b/pkgs/development/python-modules/superqt/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "superqt";
-  version = "0.7.7";
+  version = "0.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyapp-kit";
     repo = "superqt";
     tag = "v${version}";
-    hash = "sha256-l6O3qI1mkaqiQAVL2jIf/ylRntsqa5p2x+ojV1ZdAtE=";
+    hash = "sha256-ipDtwymKocCRwcW/eYpM6jrmrjkYQJlaEyaSV4SinMM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/symbolic/default.nix b/pkgs/development/python-modules/symbolic/default.nix
index cd356d600c50..42e8d8f5f28a 100644
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "symbolic";
-  version = "12.17.1";
+  version = "12.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage rec {
     tag = version;
     # the `py` directory is not included in the tarball, so we fetch the source via git instead
     forceFetchGit = true;
-    hash = "sha256-rO+bLg2TgSxWJ+ub3TLejKdWTlp9e5/++TEna73Y0Lk=";
+    hash = "sha256-Rcijs9yq+WzzADxq0SKcL99jvquZTVb2dPs+qUB7zJc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-Us3xROXFKmlYOavXVyvxraMuY6p75AKjh9AOX49ui4Q=";
+    hash = "sha256-yTSBWs7wN+XGh687LSryJ1d55ZTV5GbojwPyQ+JXKNI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/temporalio/default.nix b/pkgs/development/python-modules/temporalio/default.nix
index ef363dd64248..a755fe339a21 100644
--- a/pkgs/development/python-modules/temporalio/default.nix
+++ b/pkgs/development/python-modules/temporalio/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "temporalio";
-  version = "1.21.1";
+  version = "1.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     repo = "sdk-python";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-eOhaT5phQdHpaZB+TefJObAWgrO3vLgFkjH0XZW4rWU=";
+    hash = "sha256-6QqROLHEu4+htIddBJ8sMhPHZmD2eHcxvIa0L0PLZHA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
       src
       cargoRoot
       ;
-    hash = "sha256-d/mrBcItzKCQx27HyZ2q4f9r/XI0oXc+M7Hwfm98csc=";
+    hash = "sha256-G64Gw3jpo2wyI75bl2yJoN6UlIt/wk3NI4J5i4R3lgg=";
   };
 
   cargoRoot = "temporalio/bridge";
diff --git a/pkgs/development/python-modules/thermopro-ble/default.nix b/pkgs/development/python-modules/thermopro-ble/default.nix
index bf29fabcdf17..83c6b11858f1 100644
--- a/pkgs/development/python-modules/thermopro-ble/default.nix
+++ b/pkgs/development/python-modules/thermopro-ble/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "thermopro-ble";
-  version = "1.1.2";
+  version = "1.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = "thermopro-ble";
     tag = "v${version}";
-    hash = "sha256-xn6scfK2nz2AU4DkUOVj3drku0hOzZSgeBiBudnH2bU=";
+    hash = "sha256-LyFA/O7nsmbg8KxT07Z0l+GEnTWF/IG0ykIN/8FK8Es=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index 5b210387e2f4..bbc2c55aab77 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -6,16 +6,16 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tlds";
-  version = "2025102200";
+  version = "2026020700";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
-    tag = version;
-    hash = "sha256-rulYXgVjzPcb5cBi57u4uzR6KDCp+NUaUMzi1o/SrN4=";
+    tag = finalAttrs.version;
+    hash = "sha256-cpm3x17B+w+Tq+ztQjd0Xttkyivv5Al+3w6RD+SU3T8=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -33,4 +33,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/ultralytics/default.nix b/pkgs/development/python-modules/ultralytics/default.nix
index 1483ee21092a..50a27df6fa9f 100644
--- a/pkgs/development/python-modules/ultralytics/default.nix
+++ b/pkgs/development/python-modules/ultralytics/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ultralytics";
-  version = "8.4.9";
+  version = "8.4.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultralytics";
     repo = "ultralytics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yZI0lvmXC2yFH8qiDPgCMN+7gxd4BwidwDrLoDDr1Mc=";
+    hash = "sha256-D3b0KFqdbd6DaGkblek5MEI2J3OmoNQ2xlMMoW13C6k=";
   };
 
   build-system = [ setuptools ];
@@ -134,6 +134,14 @@ buildPythonPackage (finalAttrs: {
     description = "Train YOLO models for computer vision tasks";
     mainProgram = "yolo";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ osbm ];
+    maintainers = with lib.maintainers; [
+      osbm
+      mana-byte
+    ];
+    badPlatforms = [
+      # Tests crash with:
+      # Fatal Python error: Segmentation fault for x86_64 Darwin in tests/python.py
+      "x86_64-darwin"
+    ];
   };
 })
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 86b3c493f335..30b05b17a6da 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -21,7 +21,7 @@
   setuptools-scm,
 
   # buildInputs
-  oneDNN,
+  onednn,
   numactl,
   llvmPackages,
 
@@ -133,8 +133,8 @@ let
   cutlass-flashmla = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    tag = "v3.9.0";
-    hash = "sha256-Q6y/Z6vahASeSsfxvZDwbMFHGx8CnsF90IlveeVLO9g=";
+    rev = "147f5673d0c1c3dcf66f78d677fd647e4a020219";
+    hash = "sha256-dHQto08IwTDOIuFUp9jwm1MWkFi8v2YJ/UESrLuG71g=";
   };
 
   flashmla = stdenv.mkDerivation {
@@ -148,8 +148,8 @@ let
       name = "FlashMLA-source";
       owner = "vllm-project";
       repo = "FlashMLA";
-      rev = "46d64a8ebef03fa50b4ae74937276a5c940e3f95";
-      hash = "sha256-jtMzWB5hKz8mJGsdK6q4YpQbGp9IrQxbwmB3a64DIl0=";
+      rev = "c2afa9cb93e674d5a9120a170a6da57b89267208";
+      hash = "sha256-pKlwxV6G9iHag/jbu3bAyvYvnu5TbrQwUMFV0AlGC3s=";
     };
 
     dontConfigure = true;
@@ -324,14 +324,14 @@ in
 
 buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
   pname = "vllm";
-  version = "0.14.0";
+  version = "0.15.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = "vllm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gUfEjoNgS/FgSDqQDnDe/onWGigzwkKuPgmdRZHVGn0=";
+    hash = "sha256-qsAvcOB8ugGlBqBrLfNHqaIUcxLwaXBTg8xWRnGyd94=";
   };
 
   patches = [
@@ -392,7 +392,7 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
 
   buildInputs =
     lib.optionals cpuSupport [
-      oneDNN
+      onednn
     ]
     ++ lib.optionals (cpuSupport && stdenv.hostPlatform.isLinux) [
       numactl
@@ -529,7 +529,7 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
     }
     // lib.optionalAttrs cpuSupport {
       VLLM_TARGET_DEVICE = "cpu";
-      FETCHCONTENT_SOURCE_DIR_ONEDNN = "${oneDNN.src}";
+      FETCHCONTENT_SOURCE_DIR_ONEDNN = "${onednn.src}";
     };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/webdavclient3/default.nix b/pkgs/development/python-modules/webdavclient3/default.nix
index 3377bd16eb95..c4c14d3d997b 100644
--- a/pkgs/development/python-modules/webdavclient3/default.nix
+++ b/pkgs/development/python-modules/webdavclient3/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "webdavclient3";
-  version = "3.14.6";
+  version = "3.14.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ezhov-evgeny";
     repo = "webdav-client-python-3";
     tag = "v${version}";
-    hash = "sha256-vtZTBfq3PVrapv3ivYc18+71y7SPpJ+Mwk5qGe/DdTM=";
+    hash = "sha256-On2vCV3iLxqLYKaiUkwry/lZFjhzlAlU2OYYq/7rrcE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 48b3e453210a..99cb3eeb3a39 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "x-transformers";
-  version = "2.14.2";
+  version = "2.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "x-transformers";
     tag = version;
-    hash = "sha256-2g79NSdcyVfzWohI10bU5crldrqiOoJgnF4Uog1npIw=";
+    hash = "sha256-6L6e0E6Yx5K+KOkkxJm6iF5Uxj6Tga4hTbkGy9MUtW4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/ziamath/default.nix b/pkgs/development/python-modules/ziamath/default.nix
index 817d60b33811..4771d51b9598 100644
--- a/pkgs/development/python-modules/ziamath/default.nix
+++ b/pkgs/development/python-modules/ziamath/default.nix
@@ -12,14 +12,14 @@
 }:
 buildPythonPackage rec {
   pname = "ziamath";
-  version = "0.12";
+  version = "0.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cdelker";
     repo = "ziamath";
     tag = version;
-    hash = "sha256-ShR9O170Q26l6XHSe2CO4bEuQm4JNOxiPZ2kbKDLNEU=";
+    hash = "sha256-4TSKxCCU4DP+CQKJoi3nBqstHVUb9ycz+JAlYctxGxY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/rocm-modules/migraphx/default.nix b/pkgs/development/rocm-modules/migraphx/default.nix
index fa7bda79fc7b..cfbf3c0afde2 100644
--- a/pkgs/development/rocm-modules/migraphx/default.nix
+++ b/pkgs/development/rocm-modules/migraphx/default.nix
@@ -21,9 +21,9 @@
   boost,
   msgpack-cxx,
   sqlite,
-  # TODO(@LunNova): Swap to `oneDNN` once v3 is supported
+  # TODO(@LunNova): Swap to `onednn` once v3 is supported
   # Upstream issue: https://github.com/ROCm/AMDMIGraphX/issues/4351
-  oneDNN_2,
+  onednn_2,
   blaze,
   texliveSmall,
   doxygen,
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     msgpack-cxx
     sqlite
-    oneDNN_2
+    onednn_2
     blaze
     python3Packages.pybind11
     python3Packages.onnx
diff --git a/pkgs/development/ruby-modules/bundler-app/default.nix b/pkgs/development/ruby-modules/bundler-app/default.nix
index d02c0cd49257..f3aa66cae7c1 100644
--- a/pkgs/development/ruby-modules/bundler-app/default.nix
+++ b/pkgs/development/ruby-modules/bundler-app/default.nix
@@ -57,7 +57,7 @@ let
     ]
     // {
       inherit preferLocalBuild allowSubstitutes; # pass the defaults
-      inherit (basicEnv) version;
+      inherit (basicEnv) version pname;
 
       nativeBuildInputs = nativeBuildInputs ++ lib.optionals (scripts != [ ]) [ makeWrapper ];
 
diff --git a/pkgs/development/ruby-modules/bundler-env/default.nix b/pkgs/development/ruby-modules/bundler-env/default.nix
index 9510ebf659bd..a103dcd6ae7a 100644
--- a/pkgs/development/ruby-modules/bundler-env/default.nix
+++ b/pkgs/development/ruby-modules/bundler-env/default.nix
@@ -69,7 +69,7 @@ else
     bundlerEnvArgs = {
       inherit ignoreCollisions;
 
-      name = basicEnv.name;
+      inherit (basicEnv) pname version;
 
       paths = envPaths;
       pathsToLink = [ "/lib" ];
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 17a34ee8b5da..ee801f452471 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.25.5";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-jemGZkWmN1x2+ZzJ5cLp3MoXO0oDKjtZTmZS9Be/TDw=";
+    hash = "sha256-JbJB3F1NQlmA5d0rdsLm4RVD24OPdV4QXpxW8VWbESA=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/ocaml/ocp-index/default.nix b/pkgs/development/tools/ocaml/ocp-index/default.nix
index a8a540f718b9..0a00fd008a33 100644
--- a/pkgs/development/tools/ocaml/ocp-index/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-index/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromGitHub,
+  fetchurl,
   buildDunePackage,
   cppo,
   ocp-indent,
@@ -8,17 +8,13 @@
   re,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ocp-index";
-  version = "1.4.0";
+  version = "1.4.1";
 
-  minimalOCamlVersion = "4.08";
-
-  src = fetchFromGitHub {
-    owner = "OCamlPro";
-    repo = "ocp-index";
-    rev = version;
-    hash = "sha256-pv6aBJjRkibISpZEnlfyn72smcYEbZoPQoQH2p/JwH0=";
+  src = fetchurl {
+    url = "https://github.com/OCamlPro/ocp-index/releases/download/${finalAttrs.version}/ocp-index-${finalAttrs.version}.tbz";
+    hash = "sha256:59adbd99a9c88106dcf23bc0e3424a00f840fcedee4e4b644eaf0385ada3f911";
   };
 
   nativeBuildInputs = [ cppo ];
@@ -32,8 +28,8 @@ buildDunePackage rec {
   meta = {
     homepage = "https://www.typerex.org/ocp-index.html";
     description = "Simple and light-weight documentation extractor for OCaml";
-    changelog = "https://github.com/OCamlPro/ocp-index/raw/${version}/CHANGES.md";
+    changelog = "https://github.com/OCamlPro/ocp-index/raw/${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ vbgl ];
   };
-}
+})
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index ad8fef2839c1..ce8fc1d8ea23 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -70,7 +70,13 @@ stdenv.mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl -L${libmysqlclient}/lib/mariadb";
+  env.NIX_LDFLAGS = toString [
+    "-lgvc"
+    "-lmysqlclient"
+    "-lecpg"
+    "-lssl"
+    "-L${libmysqlclient}/lib/mariadb"
+  ];
 
   qtWrapperArgs = [
     "--prefix PATH : ${lib.getBin graphviz}/bin"
diff --git a/pkgs/games/dwarf-fortress/themes/default.nix b/pkgs/games/dwarf-fortress/themes/default.nix
index 890b9a19dd5e..0c89c9cfa339 100644
--- a/pkgs/games/dwarf-fortress/themes/default.nix
+++ b/pkgs/games/dwarf-fortress/themes/default.nix
@@ -14,7 +14,8 @@ listToAttrs (
   map (v: {
     inherit (v) name;
     value = fetchFromGitHub {
-      name = "${v.name}-theme-${v.version}";
+      pname = v.name;
+      version = v.version;
       owner = "DFgraphics";
       repo = v.name;
       rev = v.version;
diff --git a/pkgs/games/ue4demos/default.nix b/pkgs/games/ue4demos/default.nix
deleted file mode 100644
index 852e9a847c68..000000000000
--- a/pkgs/games/ue4demos/default.nix
+++ /dev/null
@@ -1,212 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  unzip,
-  patchelf,
-  libxxf86vm,
-  libxext,
-  openal,
-}:
-
-let
-  urls = file: [
-    # Untrusted mirrors - do not update hashes
-    "https://ludios.org/mirror/ue4demos/${file}"
-    "https://web.archive.org/web/20140824192039/http://ue4linux.raxxy.com/${file}"
-  ];
-
-  buildDemo =
-    { name, src }:
-    stdenv.mkDerivation rec {
-      inherit name src;
-
-      nativeBuildInputs = [
-        unzip
-        patchelf
-      ];
-
-      rtdeps =
-        lib.makeLibraryPath [
-          libxxf86vm
-          libxext
-          openal
-        ]
-        + ":"
-        + lib.makeSearchPathOutput "lib" "lib64" [ stdenv.cc.cc ];
-
-      buildCommand = ''
-        mkdir -p "$out"
-        cd $out
-        unzip $src
-
-        interpreter=$(echo ${stdenv.cc.libc}/lib/ld-linux*.so.2)
-        binary=$(find . -executable -type f)
-        patchelf \
-          --set-interpreter $interpreter \
-          --set-rpath ${rtdeps} \
-          "$binary"
-
-        # Workaround on
-        # LogLinuxPlatformFile:Warning: open('/nix/store/hash-ue4demos-demo/demo/demo/Saved/Config/CleanSourceConfigs/Engine.ini', Flags=0x00080241) failed: errno=2 (No such file or directory)
-        # for Vehicle, Shooter and Strategy games.
-        ls | grep ' ' && $(
-          haxname=$(ls | grep ' ' | sed 's/ //g'); \
-          haxpath=$(ls | grep ' ')/$haxname/Saved; \
-          mkdir -p "$haxpath"/Config/CleanSourceConfigs; \
-          ln -s /dev/null "$haxpath"/Config/CleanSourceConfigs/Engine.ini; \
-          mkdir -p "$haxpath"/Logs; \
-          ln -s /dev/null "$haxpath"/Logs/$haxname.log)
-
-        # Executables are buried under a varied paths across demos.
-        mkdir bin
-        cd bin
-        ln -s "$out/$binary" $(basename "$out/$binary")
-      '';
-
-      meta = {
-        description = "Unreal Engine 4 Linux demos";
-        homepage = "https://wiki.unrealengine.com/Linux_Demos";
-        platforms = [ "x86_64-linux" ];
-        license = lib.licenses.unfree;
-      };
-    };
-
-in
-{
-  tappy_chicken = buildDemo {
-    name = "ue4demos-tappy_chicken";
-    src = fetchurl {
-      urls = urls "tappy_chicken.zip";
-      sha256 = "0lwhvk3lpb2r5ng2cnzk7fpjj5lwhy2sch1a8v154x1xfhfb3h4v";
-    };
-  };
-
-  swing_ninja = buildDemo {
-    name = "ue4demos-swing_ninja";
-    src = fetchurl {
-      urls = urls "swing_ninja.zip";
-      sha256 = "1bmgqqk3lda5h7nnqi59jgyrsn0clr3xs0k1jclnqf9fk0m8hjcv";
-    };
-  };
-
-  card_game = buildDemo {
-    name = "ue4demos-card_game";
-    src = fetchurl {
-      urls = urls "card_game.zip";
-      sha256 = "154baqias5q7kad0c89k35jbmnmlm865sll02mi7bk1yllcckz5z";
-    };
-  };
-
-  vehicle_game = buildDemo {
-    name = "ue4demos-vehicle_game";
-    src = fetchurl {
-      urls = urls "vehicle_game.zip";
-      sha256 = "03dlacf1iv7sgn7pl3sx9r6243wy8fsi2kd858syfm9slg0190bs";
-    };
-  };
-
-  shooter_game = buildDemo {
-    name = "ue4demos-shooter_game";
-    src = fetchurl {
-      urls = urls "shooter_game.zip";
-      sha256 = "1bk32k349iqbqk8x8jffnqq0pjiqmvrvv675xxmlvkkr8qrlhz98";
-    };
-  };
-
-  strategy_game = buildDemo {
-    name = "ue4demos-strategy_game";
-    src = fetchurl {
-      urls = urls "strategy_game.zip";
-      sha256 = "1p7i966v1ssm20y12g4wsccpgnky3szy19qyjlacynk7bgbk6lg7";
-    };
-  };
-
-  black_jack = buildDemo {
-    name = "ue4demos-black_jack";
-    src = fetchurl {
-      urls = urls "black_jack.zip";
-      sha256 = "0g52wkzn5isa3az32y25yx5b56wxks97pajqwkmm6gf4qpkfksxv";
-    };
-  };
-
-  landscape_mountains = buildDemo {
-    name = "ue4demos-landscape_mountains";
-    src = fetchurl {
-      urls = urls "landscape_mountains.zip";
-      sha256 = "14jzajhs3cpydvf3ag7lpj4hkpbjpwnn3xkdvdx92fi0pcl8cwym";
-    };
-  };
-
-  matinee_demo = buildDemo {
-    name = "ue4demos-matinee_demo";
-    src = fetchurl {
-      urls = urls "matinee_demo.zip";
-      sha256 = "0ib8k6fl15cxzdarar2sqq5v3g3c7p2jidkdjd00nym6cvkibb4d";
-    };
-  };
-
-  elemental_demo = buildDemo {
-    name = "ue4demos-elemental_demo";
-    src = fetchurl {
-      urls = urls "elemental_demo.zip";
-      sha256 = "1v4jdsy8jvv8wgc8dx17q17xigfrya5q0nfdzw4md7fzm3bg9z0v";
-    };
-  };
-
-  effects_cave_demo = buildDemo {
-    name = "ue4demos-effects_cave_demo";
-    src = fetchurl {
-      urls = urls "effects_cave_demo.zip";
-      sha256 = "0lvd3aaha2x9pnpkdmrzi6nf7hymr95834z3l8shygjf9kbbzsz4";
-    };
-  };
-
-  realistic_rendering = buildDemo {
-    name = "ue4demos-realistic_rendering";
-    src = fetchurl {
-      urls = urls "realistic_rendering_demo.zip";
-      sha256 = "0r16nznkv475hkw5rnngqsc69ch8vh86dppyyyr9nn43dkr2110a";
-    };
-  };
-
-  reflections_subway = buildDemo {
-    name = "ue4demos-reflections_subway";
-    src = fetchurl {
-      urls = urls "reflections_subway_demo.zip";
-      sha256 = "0dw5sm7405gxw9iqz0vpnhdprrb4wl5i14pvzl1381k973m8bd00";
-    };
-  };
-
-  scifi_hallway_demo = buildDemo {
-    name = "ue4demos-scifi_hallway_demo";
-    src = fetchurl {
-      urls = urls "sci-fi_hallway_demo.zip";
-      sha256 = "14qp9iwm47awn8d9j6ijh6cnds308x60xs4vi2fvz2666jlz1pq2";
-    };
-  };
-
-  mobile_temple_demo = buildDemo {
-    name = "ue4demos-mobile_temple_demo";
-    src = fetchurl {
-      urls = urls "mobile_temple_demo.zip";
-      sha256 = "12bz4h1b9lhmqglwsa6r8q48ijqbjdha9fql31540d01kigaka75";
-    };
-  };
-
-  stylized_demo = buildDemo {
-    name = "ue4demos-stylized_demo";
-    src = fetchurl {
-      urls = urls "stylized_demo.zip";
-      sha256 = "1676ridmj8rk4y4hbdscfnnka5l636av1xxl0qwvk236kq9j7v0l";
-    };
-  };
-
-  blueprint_examples_demo = buildDemo {
-    name = "ue4demos-blueprint_examples_demo";
-    src = fetchurl {
-      urls = urls "blueprint_examples_demo.zip";
-      sha256 = "076q33h2hy965fvr805hsprkpcmizf638lj2ik8k923v86b15nbv";
-    };
-  };
-}
diff --git a/pkgs/os-specific/cygwin/newlib-cygwin/default.nix b/pkgs/os-specific/cygwin/newlib-cygwin/default.nix
index 9869493c3be8..516498e6ec3b 100644
--- a/pkgs/os-specific/cygwin/newlib-cygwin/default.nix
+++ b/pkgs/os-specific/cygwin/newlib-cygwin/default.nix
@@ -142,15 +142,20 @@
           "target"
         ];
 
+        preConfigure =
+          lib.optionalString (!lib.systems.equals stdenvNoLibc.hostPlatform stdenvNoLibc.buildPlatform)
+            ''
+              configureFlagsArray+=(ac_cv_prog_CC=$CC_FOR_BUILD)
+            '';
+
         configureFlags = [
           "--disable-shared"
           "--disable-doc"
           "--enable-static"
           "--disable-dumper"
           "--with-cross-bootstrap"
-        ]
-        ++ lib.optional (stdenvNoLibc.hostPlatform != stdenvNoLibc.buildPlatform) [
-          "ac_cv_prog_CC=gcc"
+          # if gm4 or gnum4 are in PATH, they would be be preferred to nixpkgs m4
+          "M4=m4"
         ];
 
         allowedImpureDLLs = [
diff --git a/pkgs/os-specific/linux/hid-fanatecff/default.nix b/pkgs/os-specific/linux/hid-fanatecff/default.nix
new file mode 100644
index 000000000000..9ccdb93cc322
--- /dev/null
+++ b/pkgs/os-specific/linux/hid-fanatecff/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  bashNonInteractive,
+  linuxConsoleTools,
+  nix-update-script,
+}:
+
+let
+  moduleDir = "lib/modules/${kernel.modDirVersion}/kernel/drivers/hid";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hid-fanatecff";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "gotzl";
+    repo = "hid-fanatecff";
+    tag = finalAttrs.version;
+    hash = "sha256-aVuTnrxw7zWMZ1U21DUKDvcYlIp7iHJHaX8ijmUd/TE=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  postPatch = ''
+    mkdir -p $out/{lib/udev/rules.d,${moduleDir}}
+
+    sed -i '/depmod/d' Makefile
+    substituteInPlace Makefile \
+      --replace-fail '/etc/udev/rules.d' "$out/lib/udev/rules.d"
+
+    substituteInPlace fanatec.rules \
+      --replace-fail '/usr/bin/evdev-joystick' '${lib.getExe' linuxConsoleTools "evdev-joystick"}' \
+      --replace-fail '/bin/sh' '${lib.getExe bashNonInteractive}'
+  '';
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KVERSION=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "MODULEDIR=$(out)/${moduleDir}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Linux module driver for Fanatec driving wheels";
+    homepage = "https://github.com/gotzl/hid-fanatecff";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ rake5k ];
+    platforms = lib.platforms.linux;
+    mainProgram = "hid-fanatecff";
+  };
+})
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d909526a5aef..5d45d4526774 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -591,6 +591,8 @@ let
         DRM_VC4_HDMI_CEC = yes;
         # Enable HDMI out on platforms using the RK3588 lineup of SoCs.
         ROCKCHIP_DW_HDMI_QP = whenAtLeast "6.13" yes;
+        # Enable DSI out on platforms using the RK3588 lineup of SoCs.
+        ROCKCHIP_DW_MIPI_DSI2 = whenAtLeast "6.16" yes;
       };
 
     # Enable Rust and features that depend on it
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index f086165ae3e8..fa6d9bde9a48 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -33,5 +33,10 @@
         "version": "6.18.9",
         "hash": "sha256:0y05jg6126h946pac5mkl5myh573qgml1p29hinm7jxlizzia083",
         "lts": false
+    },
+    "6.19": {
+        "version": "6.19",
+        "hash": "sha256:0mqka8ii7bvmx9hvfjdiyva9ib0j7m390gxhh8gki3qb4nl7jc1h",
+        "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index b3aa9f4c363b..1af4dce118a6 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mcelog";
-  version = "208";
+  version = "210";
 
   src = fetchFromGitHub {
     owner = "andikleen";
     repo = "mcelog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UBWgdRrSNkocreyFs61IxtdbUrL1UGn2gJswqXjWhlY=";
+    hash = "sha256-RcIcEu9Y6ggYHDP46hMA/HBXq447gYbOzCcyEAiBDNM=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/nullfs/default.nix b/pkgs/os-specific/linux/nullfs/default.nix
index 3ec5a6361ca7..c289c63f3a88 100644
--- a/pkgs/os-specific/linux/nullfs/default.nix
+++ b/pkgs/os-specific/linux/nullfs/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nullfs";
-  version = "0.21";
+  version = "0.22";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "nullfsvfs";
     rev = "v${version}";
-    sha256 = "sha256-csEfgXOXrFgWcyKmxEPKi33M7nVVI2hE+YGXMe4vdFE=";
+    sha256 = "sha256-UJubWx5QfzLAiYTN1BPaziT3gKsTI0OVCmcuwKX3Gp0=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/asterisk/versions.json b/pkgs/servers/asterisk/versions.json
index 5c509d700c8e..e1e8f24f53a9 100644
--- a/pkgs/servers/asterisk/versions.json
+++ b/pkgs/servers/asterisk/versions.json
@@ -4,19 +4,19 @@
     "version": "18.26.4"
   },
   "asterisk_20": {
-    "sha256": "fffc04d9348676c884224d5f66201c0c88468f382b3f58c41c2e5afd4a72868f",
-    "version": "20.18.1"
+    "sha256": "247e47727856b113ad520f3142225b3b7e526e1ba471fb7d546bc0fa4a734592",
+    "version": "20.18.2"
   },
   "asterisk_21": {
-    "sha256": "ccd04f5f433dd398448858dcac68231c67cf13826f068f4321d06d45dbd999a8",
-    "version": "21.12.0"
+    "sha256": "f7d2535e949dfc531c8480ba2c72c4a007701d787986c01730e391d601320153",
+    "version": "21.12.1"
   },
   "asterisk_22": {
-    "sha256": "9a63ae4df974ab55199b0d1fbde22fec6ce7ede69929b18890ed5c928b4ad63b",
-    "version": "22.8.1"
+    "sha256": "8dd373ce0771a9ed40bb54a72a889ccdd14c0cee458ed68da9ce913a668e4b22",
+    "version": "22.8.2"
   },
   "asterisk_23": {
-    "sha256": "8d3eddea9a9d5f0239c1509a8890787ae0ef23ba07c4b3ac99e96a3ff391b47c",
-    "version": "23.2.1"
+    "sha256": "dfba245e993d500a4a04a7e859e5e60d9623e769b403919254a140ec1d52aa71",
+    "version": "23.2.2"
   }
 }
diff --git a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
new file mode 100644
index 000000000000..3ef33f9c3d60
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "andrew-codechimp";
+  domain = "battery_notes";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "HA-Battery-Notes";
+    tag = version;
+    hash = "sha256-WOSWiWojT0pUhKvnl7qGvk6IHjENOy1rr0SFpTaQ0yI=";
+  };
+
+  # has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Home Assistant integration to provide battery details of devices";
+    homepage = "https://github.com/andrew-codechimp/HA-Battery-Notes";
+    changelog = "https://github.com/andrew-codechimp/HA-Battery-Notes/releases/tag/${src.tag}";
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/package.nix
index 2f78a29eee51..ea1e729b323e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "mushroom";
-  version = "5.0.10";
+  version = "5.0.11";
 
   src = fetchFromGitHub {
     owner = "piitaya";
     repo = "lovelace-mushroom";
     rev = "v${version}";
-    hash = "sha256-AjHBYjhuux10YOqLDmlA7qEMnVZC+2aS3j5GueLXioY=";
+    hash = "sha256-6TPfHpaHoM7k60A9XhitToiwn8wlNuN3deIjjPZqRwc=";
   };
 
-  npmDepsHash = "sha256-6OpENvqB9bORnVm1n4aE5fTVwqAN5zw49czMtqN4qKM=";
+  npmDepsHash = "sha256-BaIjzW/puRi+GXtp3dJ8b/daZxafhMRxJTQQFj0Tfcw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b1967573f896..99140c757a51 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -87,14 +87,6 @@ let
         ];
       });
 
-      imageio = super.imageio.overridePythonAttrs (oldAttrs: {
-        disabledTests = oldAttrs.disabledTests or [ ] ++ [
-          # broken by pyav pin
-          "test_keyframe_intervals"
-          "test_lagging_video_stream"
-        ];
-      });
-
       gspread = super.gspread.overridePythonAttrs (oldAttrs: rec {
         version = "5.12.4";
         src = fetchFromGitHub {
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 4de3f6c527c4..ba6dc4b9408e 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.29.4";
-  hash = "sha256-Wn037uUFhm+6tYEPqfeCR9bV2RV6WVxOenIEMUHdqyU=";
+  version = "1.29.5";
+  hash = "sha256-Z0R2ikEUiA83sToEQyROcxvLMTDAoGXX432P1Ymt43Q=";
 }
diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix
index 458d907357ea..baead60d7658 100644
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,13 +1,6 @@
-{ callPackage, fetchpatch, ... }@args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.28.0";
-  hash = "sha256-xrXGsIbA3508o/9eCEwdDvkJ5gOCecccHD6YX1dv92o=";
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2025-53859.patch";
-      url = "https://nginx.org/download/patch.2025.smtp.txt";
-      hash = "sha256-v49sLskFNMoKuG8HQISw8ST7ga6DS+ngJiL0D3sUyGk=";
-    })
-  ];
+  version = "1.28.2";
+  hash = "sha256-IOXg8skXrPtREg7sL7qaS6Th4Q/ShGUGfMh6fYGoKaM=";
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/mesak-imagesave-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/mesak-imagesave-panel/default.nix
new file mode 100644
index 000000000000..f3711db64783
--- /dev/null
+++ b/pkgs/servers/monitoring/grafana/plugins/mesak-imagesave-panel/default.nix
@@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "mesak-imagesave-panel";
+  version = "1.0.4";
+  zipHash = "sha256-WwGCcMhPhE8q2E/0uXYNMpd0HitPvVOCbazhpX/1q2U=";
+  meta = {
+    description = "Plugin for Grafana that allows you to save image to grafana and display it in dashboard";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana/plugins/plugins.nix b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
index 89c749ef3bcf..ec886e536404 100644
--- a/pkgs/servers/monitoring/grafana/plugins/plugins.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
@@ -29,6 +29,7 @@
   marcusolsson-csv-datasource = callPackage ./marcusolsson-csv-datasource { };
   marcusolsson-dynamictext-panel = callPackage ./marcusolsson-dynamictext-panel { };
   marcusolsson-json-datasource = callPackage ./marcusolsson-json-datasource { };
+  mesak-imagesave-panel = callPackage ./mesak-imagesave-panel { };
   redis-app = callPackage ./redis-app { };
   redis-datasource = callPackage ./redis-datasource { };
   redis-explorer-app = callPackage ./redis-explorer-app { };
diff --git a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
index c373fc643f95..9b0863cd6c8b 100644
--- a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "victoriametrics-metrics-datasource";
-  version = "0.20.1";
-  zipHash = "sha256-OITIzKV4eGc4RniVFrgp4VBAM5m38Zms8xj9EgC5YZc=";
+  version = "0.21.0";
+  zipHash = "sha256-S+MKGEIZ3dq2sN8yxR/Cuos/AXV66aXololLY7BaJco=";
   meta = {
     description = "VictoriaMetrics metrics datasource for Grafana";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index 053c8976e6c5..3e6d72253e61 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -26,10 +26,11 @@ let
       # https://github.com/influxdata/flux/pull/5542
       ../influxdb2/fix-unsigned-char.patch
     ];
-    # Don't fail on missing code documentation and allow dead_code/lifetime warnings
+
+    # Don't fail on missing code documentation and allow dead_code/lifetime/unused_assignments warnings
     postPatch = ''
       substituteInPlace flux-core/src/lib.rs \
-        --replace-fail "deny(warnings, missing_docs))]" "deny(warnings), allow(dead_code, mismatched_lifetime_syntaxes))]"
+        --replace-fail "deny(warnings, missing_docs))]" "deny(warnings), allow(dead_code, mismatched_lifetime_syntaxes, unused_assignments))]"
     '';
     sourceRoot = "${src.name}/libflux";
 
diff --git a/pkgs/servers/sql/postgresql/ext/pg-gvm.nix b/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
index 052b605c830a..42e47273e711 100644
--- a/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
@@ -14,13 +14,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-gvm";
-  version = "22.6.13";
+  version = "22.6.14";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pg-gvm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kdYDKChjlXtolpzt9H+ijb39bZq3ABsxw5ofUKs6E5g=";
+    hash = "sha256-g6/p2uqLd8nAc5BVvnMF/2v+A17wDWyrsSWlPATgz7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/sql/postgresql/ext/pgmq.nix b/pkgs/servers/sql/postgresql/ext/pgmq.nix
index ca1ab9c44226..1ee1ead36226 100644
--- a/pkgs/servers/sql/postgresql/ext/pgmq.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgmq.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgmq";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "tembo-io";
     repo = "pgmq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rgs3iZfnKAijz8mk9A2tM1WuL8uMFYE3IRa+JgWk0LE=";
+    hash = "sha256-sNOFr3tiZATFBvRBm4pSsn8YR62zqN06VBOBnvdXgts=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pgmq-extension";
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index c997fa131ebb..7956c320c7e1 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "plpgsql-check";
-  version = "2.8.5";
+  version = "2.8.8";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1EMK6WTJ/LBB0oD4i+Lni8wMh80HZtop8uRqwm3XwKw=";
+    hash = "sha256-jAcQ5gUWjyw4A+pJWKf06EayY/UKeSzlNmnTD4mV/c4=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 7337a80fa284..870b7b26b08e 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -664,7 +664,8 @@ let
     let
       installedExtensions = f postgresql.pkgs;
       finalPackage = buildEnv {
-        name = "${postgresql.pname}-and-plugins-${postgresql.version}";
+        pname = "${postgresql.pname}-and-plugins";
+        inherit (postgresql) version;
         paths = installedExtensions ++ [
           # consider keeping in-sync with `postBuild` below
           postgresql
@@ -694,7 +695,6 @@ let
           inherit (postgresql)
             pkgs
             psqlSchema
-            version
             ;
 
           pg_config = postgresql.pg_config.override {
diff --git a/pkgs/tools/graphics/pixel2svg/default.nix b/pkgs/tools/graphics/pixel2svg/default.nix
deleted file mode 100644
index 196b897f1cf8..000000000000
--- a/pkgs/tools/graphics/pixel2svg/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchurl,
-  pillow,
-  svgwrite,
-}:
-
-buildPythonPackage rec {
-  pname = "pixel2svg";
-  version = "0.3.0";
-  format = "setuptools";
-
-  src = fetchurl {
-    url = "https://static.florian-berger.de/pixel2svg-${version}.zip";
-    sha256 = "sha256-aqcTTmZKcdRdVd8GGz5cuaQ4gjPapVJNtiiZu22TZgQ=";
-  };
-
-  propagatedBuildInputs = [
-    pillow
-    svgwrite
-  ];
-
-  meta = {
-    homepage = "https://florian-berger.de/en/software/pixel2svg/";
-    description = "Converts pixel art to SVG - pixel by pixel";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ annaaurora ];
-    mainProgram = "pixel2svg.py";
-  };
-}
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index 5b71b82a63c4..f575e355bcda 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.30.2";
+  version = "2.30.3";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-9Y8vHGYyUYG0Vu6nglZseA92kpgKEBiNFU7wmGsmPlc=";
+    hash = "sha256-YC38zi1Wr94ExCEUHtWt7HOEjnV4s1RiPpvMPWAsXC4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/miniupnpd/default.nix b/pkgs/tools/networking/miniupnpd/default.nix
index 913b123cc9bb..6f9b25a62681 100644
--- a/pkgs/tools/networking/miniupnpd/default.nix
+++ b/pkgs/tools/networking/miniupnpd/default.nix
@@ -81,6 +81,7 @@ stdenv.mkDerivation rec {
     "--firewall=${firewall}"
     # allow using various config options
     "--ipv6"
+    "--igd2"
     "--leasefile"
     "--regex"
     "--vendorcfg"
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 0228748f724e..369c645a750d 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -206,26 +206,17 @@ lib.makeExtensible (
 
       nixComponents_2_33 =
         (nixDependencies.callPackage ./modular/packages.nix rec {
-          version = "2.33.1";
+          version = "2.33.2";
           inherit (self.nix_2_32.meta) teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_2_33";
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
             tag = version;
-            hash = "sha256-TVKn52SoKq8mMyW/x3NPPskGVurFdnGGV0DGvnL0gak=";
+            hash = "sha256-bjkycwYUs2TS5pYcqlJ2yA2W8gc6iq+Is1kNSY+QPHk=";
           };
         }).appendPatches
-          (
-            patches_common
-            ++ [
-              (fetchpatch2 {
-                name = "nix-2.33-15012-missing-include-glibc-2.42.patch";
-                url = "https://github.com/NixOS/nix/commit/c0c13d73233c740b7d278c71b161da7b16217564.patch?full_index=1";
-                hash = "sha256-iRMg36UMs5WmUfNxz4zoZq6mM3dwo2NiR8s1cM/uooU=";
-              })
-            ]
-          );
+          patches_common;
 
       nix_2_33 = addTests "nix_2_33" self.nixComponents_2_33.nix-everything;
 
diff --git a/pkgs/tools/security/mkpasswd/default.nix b/pkgs/tools/security/mkpasswd/default.nix
index 59c9c411af81..9f2e36ed7bd0 100644
--- a/pkgs/tools/security/mkpasswd/default.nix
+++ b/pkgs/tools/security/mkpasswd/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation {
   buildPhase = "make mkpasswd";
   installPhase = "make install-mkpasswd";
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   meta = {
     homepage = "https://packages.qa.debian.org/w/whois.html";
     description = "Overfeatured front-end to crypt, from the Debian whois package";
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 94bd06efacaa..155c2c801983 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -14,6 +14,7 @@
   buildEnv,
   callPackage,
   ghostscript_headless,
+  git-latexdiff,
   harfbuzz,
   makeWrapper,
   installShellFiles,
@@ -79,6 +80,7 @@ let
           gawk
           getopt
           ghostscript_headless
+          git-latexdiff
           gnugrep
           gnumake
           gnupg
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
index 489fc23c05eb..df72bce8ffc1 100644
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@@ -12,6 +12,7 @@
   gawk,
   getopt,
   ghostscript_headless,
+  git-latexdiff,
   gnugrep,
   gnumake,
   gnupg,
@@ -545,6 +546,12 @@ lib.recursiveUpdate orig rec {
     fi
   '';
 
+  # Use top-level git-latexdiff's version and src. NOTE that this derivation is
+  # still different from top-level's `git-latexdiff`, due to __structuredAttrs
+  # enabled unconditionally. Still though this derivation produces a funcitonal
+  # binary.
+  inherit git-latexdiff;
+
   # RISC-V: https://github.com/LuaJIT/LuaJIT/issues/628
   luajittex.binfiles = lib.optionals (lib.meta.availableOn stdenv.hostPlatform luajit) orig.luajittex.binfiles;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7b5701eebc67..a15ea1060543 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -322,6 +322,7 @@ mapAliases {
   arrayfire = throw "arrayfire was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
   artichoke = throw "artichoke has been removed due to being archived upstream."; # Added 2025-11-04
   artim-dark = aritim-dark; # Added 2025-07-27
+  artyFX = openav-artyfx; # Added 2026-02-08
   aseprite-unfree = throw "'aseprite-unfree' has been renamed to/replaced by 'aseprite'"; # Converted to throw 2025-10-27
   asio_1_10 = throw "'asio_1_10' has been removed as it is outdated and unused. Use 'asio' instead"; # Added 2025-12-03
   asitop = throw "'asitop' has been renamed to/replaced by 'macpm'"; # Converted to throw 2025-10-27
@@ -961,6 +962,7 @@ mapAliases {
   lanzaboote-tool = throw "lanzaboote-tool has been removed due to lack of integration maintenance with nixpkgs. Consider using the Nix expressions provided by https://github.com/nix-community/lanzaboote"; # Added 2025-07-23
   larynx = throw "'larynx' has been renamed to/replaced by 'piper-tts'"; # Converted to throw 2025-10-27
   lash = throw "'lash' has been removed, as it is unmaintained upstream"; # Added 2026-01-02
+  LAStools = lastools; # Added 2026-02-08
   LASzip2 = throw "'LASzip2' has been renamed to/replaced by 'laszip_2'"; # Converted to throw 2025-10-27
   LASzip = throw "'LASzip' has been renamed to/replaced by 'laszip'"; # Converted to throw 2025-10-27
   latinmodern-math = throw "'latinmodern-math' has been renamed to/replaced by 'lmmath'"; # Converted to throw 2025-10-27
@@ -988,14 +990,17 @@ mapAliases {
   libFS = libfs; # Added 2026-02-04
   libgadu = throw "'libgadu' has been removed as upstream is unmaintained and has no dependents or maintainers in Nixpkgs"; # Added 2025-05-17
   libgda = throw "'libgda' has been renamed to/replaced by 'libgda5'"; # Converted to throw 2025-10-27
+  libGDSII = libgdsii; # Added 2026-02-08
   libgme = throw "'libgme' has been renamed to/replaced by 'game-music-emu'"; # Converted to throw 2025-10-27
   libgnome-keyring3 = throw "'libgnome-keyring3' has been renamed to/replaced by 'libgnome-keyring'"; # Converted to throw 2025-10-27
   libheimdal = throw "'libheimdal' has been renamed to/replaced by 'heimdal'"; # Converted to throw 2025-10-27
+  libHX = libhx; # Added 2026-02-08
   libICE = libice; # Added 2026-02-04
   libiconv-darwin = throw "'libiconv-darwin' has been renamed to/replaced by 'darwin.libiconv'"; # Converted to throw 2025-10-27
   libixp_hg = throw "'libixp_hg' has been renamed to/replaced by 'libixp'"; # Converted to throw 2025-10-27
   libkkc = throw "'libkkc' has been removed due to lack of maintenance. Consider using anthy instead"; # Added 2025-08-28
   libkkc-data = throw "'libkkc-data' has been removed as it depended on libkkc which was removed"; # Added 2025-08-28
+  libLAS = liblas; # Added 2026-02-08
   liblinphone = throw "'liblinphone' has been moved to 'linphonePackages.liblinphone'"; # Added 2025-09-20
   libmesode = throw "'libmesode' has been removed because it was deprecated and archived upstream. Consider using 'libstrophe' instead"; # Added 2026-01-15
   libmp3splt = throw "'libmp3splt' has been removed due to lack of maintenance upstream."; # Added 2025-05-17
@@ -1095,6 +1100,7 @@ mapAliases {
   linux_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream"; # Added 2025-10-22
   linux_6_17 = linuxKernel.kernels.linux_6_17;
   linux_6_18 = linuxKernel.kernels.linux_6_18;
+  linux_6_19 = linuxKernel.kernels.linux_6_19;
   linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages"; # Added 2025-06-24
   linux_hardened = linuxPackages_hardened.kernel; # Added 2025-08-10
   linux_latest-libre = throw "linux_latest_libre has been removed due to lack of maintenance"; # Added 2025-10-01
@@ -1125,6 +1131,7 @@ mapAliases {
   linuxPackages_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream"; # Added 2025-10-22
   linuxPackages_6_17 = linuxKernel.packages.linux_6_17;
   linuxPackages_6_18 = linuxKernel.packages.linux_6_18;
+  linuxPackages_6_19 = linuxKernel.packages.linux_6_19;
   linuxPackages_ham = throw "linux_ham has been removed in favour of the standard kernel packages"; # Added 2025-06-24
   linuxPackages_hardened = linuxKernel.packages.linux_hardened; # Added 2025-08-10
   linuxPackages_latest-libre = throw "linux_latest_libre has been removed due to lack of maintenance"; # Added 2025-10-01
@@ -1263,18 +1270,21 @@ mapAliases {
   minetest-touch = throw "'minetest-touch' has been renamed to/replaced by 'luanti-client'"; # Converted to throw 2025-10-27
   minetestclient = throw "'minetestclient' has been renamed to/replaced by 'luanti-client'"; # Converted to throw 2025-10-27
   minetestserver = throw "'minetestserver' has been renamed to/replaced by 'luanti-server'"; # Converted to throw 2025-10-27
+  miniHttpd = mini-httpd; # Added 2026-02-08
   minio_legacy_fs = throw "'minio_legacy_fs' has been removed, migrate your data and use 'minio'"; # Added 2026-02-02
   minizincide = warnAlias "'minizincide' has been renamed to 'minizinc-ide'" minizinc-ide; # Added 2026-01-03
   minizip2 = throw "'minizip2' has been renamed to/replaced by 'minizip-ng'"; # Converted to throw 2025-10-27
   miru = throw "'miru' has been removed due to lack maintenance"; # Added 2025-08-21
   mlir_16 = throw "mlir_16 has been removed, as it is unmaintained and obsolete"; # Added 2025-08-09
   mlir_17 = throw "mlir_17 has been removed, as it is unmaintained and obsolete"; # Added 2025-08-09
+  MMA = mma; # Added 2026-02-08
   mmsd = throw "'mmsd' has been removed due to being unmaintained upstream. Consider using 'mmsd-tng' instead"; # Added 2025-06-07
   mmutils = throw "'mmutils' has been removed due to being unmaintained upstream"; # Added 2025-08-29
   moar = warnAlias "`moar` has been renamed to `moor` by upstream in v2.0.0. See https://github.com/walles/moor/pull/305 for more." pkgs.moor; # Added 2025-09-02
   mold-wrapped = warnAlias "'mold-wrapped' has been renamed to 'mold'" pkgs.mold; # Added 2025-11-12
   mongodb-6_0 = throw "mongodb-6_0 has been removed, it's end of life since July 2025"; # Added 2025-07-23
   monitor = pantheon.elementary-monitor; # Added 2025-10-10
+  monkeysAudio = monkeys-audio; # Added 2026-02-08
   mono4 = mono6; # Added 2025-08-25
   mono5 = mono6; # Added 2025-08-25
   mono-addins = throw "mono-addins has been removed due to its dependency on the removed mono4. Consider alternative frameworks or migrate to newer .NET technologies."; # Added 2025-08-25
@@ -1399,6 +1409,8 @@ mapAliases {
   oclgrind = throw "oclgrind has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
   oil = throw "'oil' has been renamed to/replaced by 'oils-for-unix'"; # Converted to throw 2025-10-27
   olaris-server = throw "'olaris-server' has been removed as it failed to build since 2024"; # Added 2026-01-15
+  oneDNN = onednn; # Added 2026-02-08
+  oneDNN_2 = onednn_2; # Added 2026-02-08
   onevpl-intel-gpu = throw "'onevpl-intel-gpu' has been renamed to/replaced by 'vpl-gpu-rt'"; # Converted to throw 2025-10-27
   onlyoffice-bin = throw "'onlyoffice-bin' has been renamed to/replaced by 'onlyoffice-desktopeditors'"; # Converted to throw 2025-10-27
   onlyoffice-bin_latest = throw "'onlyoffice-bin_latest' has been renamed to/replaced by 'onlyoffice-bin'"; # Converted to throw 2025-10-27
@@ -1873,6 +1885,7 @@ mapAliases {
   uae = throw "'uae' has been removed due to lack of upstream maintenance. Consider using 'fsuae' instead."; # Added 2025-06-11
   ubuntu_font_family = throw "'ubuntu_font_family' has been renamed to/replaced by 'ubuntu-classic'"; # Converted to throw 2025-10-27
   udisks2 = udisks; # Added 2025-10-30
+  ue4demos = throw "'ue4demos' has been removed because it is unmaintained"; # Added 2026-02-07
   unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
   unifi-poller = throw "'unifi-poller' has been renamed to/replaced by 'unpoller'"; # Converted to throw 2025-10-27
   unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
@@ -1940,6 +1953,11 @@ mapAliases {
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27
   wineWayland = throw "'wineWayland' has been renamed to/replaced by 'wine-wayland'"; # Converted to throw 2025-10-27
+  wineWowPackages =
+    warnAlias
+      "'wineWowPackages' is deprecated as it is no longer preferred by upstream. Use wineWow64Packages instead"
+      lib.recurseIntoAttrs
+      (winePackagesFor "wineWow");
   wingpanel-indicator-ayatana = throw "'wingpanel-indicator-ayatana' has been removed as it is archived upstream and doesn't work with pantheon 8 and onwards. Use wingpanel-indicator-namarupa instead"; # Added 2026-01-14
   winhelpcgi = throw "'winhelpcgi' has been removed as it was unmaintained upstream and broken with GCC 14"; # Added 2025-06-14
   wireshark-qt = warnAlias "'wireshark-qt' has been renamed to/replaced by 'wireshark'" wireshark; # Added 2026-01-23
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b4fe9c25fb7..e173b985e4c6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2022,8 +2022,6 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  circus = with python310Packages; toPythonApplication circus;
-
   inherit (callPackage ../applications/networking/remote/citrix-workspace { })
     citrix_workspace_25_08_10
     ;
@@ -9095,6 +9093,7 @@ with pkgs;
 
   nushellPlugins = recurseIntoAttrs {
     gstat = callPackage ../by-name/nu/nushell-plugin-gstat/package.nix { };
+    bson = callPackage ../by-name/nu/nushell-plugin-bson/package.nix { };
     formats = callPackage ../by-name/nu/nushell-plugin-formats/package.nix { };
     polars = callPackage ../by-name/nu/nushell-plugin-polars/package.nix { };
     query = callPackage ../by-name/nu/nushell-plugin-query/package.nix { };
@@ -10100,8 +10099,6 @@ with pkgs;
 
   pinboard-notes-backup = haskell.lib.compose.justStaticExecutables haskellPackages.pinboard-notes-backup;
 
-  pixel2svg = python310Packages.callPackage ../tools/graphics/pixel2svg { };
-
   inherit (callPackage ../applications/virtualization/singularity/packages.nix { })
     apptainer
     singularity
@@ -11863,8 +11860,6 @@ with pkgs;
 
   ultrastar-manager = libsForQt5.callPackage ../tools/misc/ultrastar-manager { };
 
-  ue4demos = recurseIntoAttrs (callPackage ../games/ue4demos { });
-
   # To ensure vdrift's code is built on hydra
   vdrift-bin = vdrift.bin;
 
@@ -12845,7 +12840,6 @@ with pkgs;
 
   winePackages = recurseIntoAttrs (winePackagesFor (config.wine.build or "wine32"));
   wine64Packages = recurseIntoAttrs (winePackagesFor "wine64");
-  wineWowPackages = recurseIntoAttrs (winePackagesFor "wineWow");
   wineWow64Packages = recurseIntoAttrs (winePackagesFor "wineWow64");
 
   wine = winePackages.full;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 43335fb607bd..ee208018b454 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -204,6 +204,14 @@ in
           ];
         };
 
+        linux_6_19 = callPackage ../os-specific/linux/kernel/mainline.nix {
+          branch = "6.19";
+          kernelPatches = [
+            kernelPatches.bridge_stp_helper
+            kernelPatches.request_key_helper
+          ];
+        };
+
         linux_testing =
           let
             testing = callPackage ../os-specific/linux/kernel/mainline.nix {
@@ -270,7 +278,7 @@ in
 
         linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
 
-        linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
+        linux_hardened = linux_6_12_hardened;
       }
       // lib.optionalAttrs config.allowAliases {
         linux_libre = throw "linux_libre has been removed due to lack of maintenance";
@@ -463,6 +471,8 @@ in
 
         nct6687d = callPackage ../os-specific/linux/nct6687d { };
 
+        hid-fanatecff = callPackage ../os-specific/linux/hid-fanatecff { };
+
         new-lg4ff = callPackage ../os-specific/linux/new-lg4ff { };
 
         zenergy = callPackage ../os-specific/linux/zenergy { };
@@ -728,6 +738,7 @@ in
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
     linux_6_18 = recurseIntoAttrs (packagesFor kernels.linux_6_18);
+    linux_6_19 = recurseIntoAttrs (packagesFor kernels.linux_6_19);
   }
   // lib.optionalAttrs config.allowAliases {
     linux_4_19 = throw "linux 4.19 was removed because it will reach its end of life within 24.11"; # Added 2024-09-21
@@ -801,9 +812,9 @@ in
   );
 
   packageAliases = {
-    linux_default = packages.linux_6_12;
+    linux_default = packages.linux_6_18;
     # Update this when adding the newest kernel major version!
-    linux_latest = packages.linux_6_18;
+    linux_latest = packages.linux_6_19;
     linux_rt_default = packages.linux_rt_5_15;
     linux_rt_latest = packages.linux_rt_6_6;
   }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index dc76d9fd80bd..71687bb12137 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2052,6 +2052,8 @@ let
 
         swhid_core = callPackage ../development/ocaml-modules/swhid_core { };
 
+        symex = callPackage ../development/ocaml-modules/symex { };
+
         synchronizer = callPackage ../development/ocaml-modules/synchronizer { };
 
         syslog = callPackage ../development/ocaml-modules/syslog { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ab027f6e314e..d74fd3a72014 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11258,6 +11258,8 @@ self: super: with self; {
 
   ome-zarr = callPackage ../development/python-modules/ome-zarr { };
 
+  ome-zarr-models = callPackage ../development/python-modules/ome-zarr-models { };
+
   omegaconf = callPackage ../development/python-modules/omegaconf { };
 
   omemo = callPackage ../development/python-modules/omemo { };
@@ -13341,6 +13343,8 @@ self: super: with self; {
 
   pydantic-settings = callPackage ../development/python-modules/pydantic-settings { };
 
+  pydantic-zarr = callPackage ../development/python-modules/pydantic-zarr { };
+
   pydantic_1 = callPackage ../development/python-modules/pydantic/1.nix { };
 
   pydash = callPackage ../development/python-modules/pydash { };
@@ -14540,6 +14544,8 @@ self: super: with self; {
 
   pyrate-limiter = callPackage ../development/python-modules/pyrate-limiter { };
 
+  pyrate-limiter_2 = callPackage ../development/python-modules/pyrate-limiter_2 { };
+
   pyrdfa3 = callPackage ../development/python-modules/pyrdfa3 { };
 
   pyre-extensions = callPackage ../development/python-modules/pyre-extensions { };
@@ -14710,6 +14716,8 @@ self: super: with self; {
 
   pyseventeentrack = callPackage ../development/python-modules/pyseventeentrack { };
 
+  pysfcgal = callPackage ../development/python-modules/pysfcgal { };
+
   pysftp = callPackage ../development/python-modules/pysftp { };
 
   pyshark = callPackage ../development/python-modules/pyshark { };