diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index 55739e652aad..d09e35c3a84b 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -45,10 +45,7 @@ Here is a simple package example.
 
 - It also accepts a `duneVersion` parameter (valid values are `"2"`, and
   `"3"`). The recommended practice is to set it only if you don't want the
-  default value and/or it depends on something else like package version. You
-  might see a not-supported argument `useDune2`. The behavior was `useDune2 =
-  true;` => `duneVersion = "2";` and `useDune2 = false;` => `duneVersion =
-  "1";`. It was used at the time when dune3 didn't exist.
+  default value and/or it depends on something else like package version.
 
 - It sets the optional `doCheck` attribute such that tests will be run with
   `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index ad6ff2b380a8..c1876093600d 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -437,6 +437,9 @@ rec {
     isMacho = {
       kernel.execFormat = execFormats.macho;
     };
+    isPE = {
+      kernel.execFormat = execFormats.pe;
+    };
   };
 
   # given two patterns, return a pattern which is their logical AND.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 42e971f91080..5825f0a735ac 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24905,7 +24905,7 @@
   stepbrobd = {
     name = "Yifei Sun";
     email = "ysun@hey.com";
-    matrix = "@stepbrobd:matrix.org";
+    matrix = "@ysun:beeper.com";
     github = "stepbrobd";
     githubId = 81826728;
   };
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index ce2cb43eef21..ab81b72aaa61 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -10,7 +10,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- [knot-resolver](https://www.knot-resolver.cz/) in version 6. Available as `services.knot-resolver`. A module for knot-resolver 5 was already available as `services.kresd`.
 
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e70f9d0675bb..7d79b5132253 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1231,6 +1231,7 @@
   ./services/networking/keepalived/default.nix
   ./services/networking/keybase.nix
   ./services/networking/kismet.nix
+  ./services/networking/knot-resolver.nix
   ./services/networking/knot.nix
   ./services/networking/kresd.nix
   ./services/networking/lambdabot.nix
diff --git a/nixos/modules/services/home-automation/zigbee2mqtt.nix b/nixos/modules/services/home-automation/zigbee2mqtt.nix
index d02cc7484991..dbf714bfb84e 100644
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@@ -114,6 +114,7 @@ in
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
diff --git a/nixos/modules/services/networking/knot-resolver.nix b/nixos/modules/services/networking/knot-resolver.nix
new file mode 100644
index 000000000000..f669aa3db383
--- /dev/null
+++ b/nixos/modules/services/networking/knot-resolver.nix
@@ -0,0 +1,153 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.knot-resolver;
+  # pkgs.writers.yaml_1_1.generate with additional kresctl validate
+  configFile =
+    pkgs.runCommandLocal "knot-resolver.yaml"
+      {
+        nativeBuildInputs = [ pkgs.remarshal_0_17 ];
+        value = builtins.toJSON cfg.settings;
+        passAsFile = [ "value" ];
+      }
+      ''
+        json2yaml "$valuePath" "$out"
+        ${cfg.managerPackage}/bin/kresctl validate "$out"
+      '';
+in
+{
+  meta.maintainers = [
+    lib.maintainers.vcunat # upstream developer
+  ]
+  ++ lib.teams.flyingcircus.members;
+
+  ###### interface
+  options.services.knot-resolver = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable knot-resolver (version 6) domain name server.
+        DNSSEC validation is turned on by default.
+        If you want to use knot-resolver 5, please use services.kresd.
+      '';
+    };
+    package = lib.mkPackageOption pkgs "knot-resolver_6" {
+      example = "knot-resolver_6.override { extraFeatures = true; }";
+    };
+    managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = (pkgs.formats.yaml { }).type;
+        options = {
+          network.listen = lib.mkOption {
+            type = lib.types.listOf (
+              lib.types.submodule {
+                freeformType = (pkgs.formats.yaml { }).type;
+              }
+            );
+            description = "List of interfaces to listen to and its configuration.";
+            default = [
+              {
+                interface = [ "127.0.0.1" ];
+                kind = "dns";
+                freebind = false;
+              }
+            ]
+            ++ lib.optionals config.networking.enableIPv6 [
+              {
+                interface = [ "::1" ];
+                kind = "dns";
+                freebind = false;
+              }
+            ];
+            defaultText = lib.literalExpression ''
+              [
+                {
+                  interface = [ "127.0.0.1" ];
+                  kind = "dns";
+                  freebind = false;
+                }
+              ]
+              ++ lib.optionals config.networking.enableIPv6 [
+                {
+                  interface = [ "::1" ];
+                  kind = "dns";
+                  freebind = false;
+                }
+               ];
+            '';
+          };
+          workers = lib.mkOption {
+            type = lib.types.oneOf [
+              (lib.types.enum [ "auto" ])
+              lib.types.ints.unsigned
+            ];
+            default = 1;
+            description = ''
+              The number of running kresd (Knot Resolver daemon) workers. If set to 'auto', it is equal to number of CPUs available.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Nix-based (RFC 42) configuration for Knot Resolver.
+        For configuration reference (described as YAML) see
+        <https://www.knot-resolver.cz/documentation/latest/config-overview.html>
+      '';
+    };
+  };
+
+  ###### implementation
+  config = lib.mkIf cfg.enable {
+    users.users.knot-resolver = {
+      isSystemUser = true;
+      group = "knot-resolver";
+      description = "Knot-resolver daemon user";
+    };
+    users.groups.knot-resolver = { };
+    networking.resolvconf.useLocalResolver = lib.mkDefault true;
+    assertions = lib.optionals (lib.versions.major cfg.package.version == 5) [
+      "services.knot-resolver only works with knot-resolver 6 or later. Please use services.kresd for knot-resolver 5."
+    ];
+
+    environment = {
+      etc."knot-resolver/config.yaml".source = configFile;
+      systemPackages = [
+        # We just avoid including the other binaries, e.g. supervisorctl.
+        (pkgs.runCommandLocal "knot-resolver-cmds" { } ''
+          mkdir -p "$out/bin"
+          ln -s '${cfg.managerPackage}/bin/kresctl' "$out/bin/"
+        '')
+      ];
+    };
+
+    systemd.packages = [ cfg.package ]; # the unit gets patched a bit just below
+    systemd.services."knot-resolver" = {
+      wantedBy = [ "multi-user.target" ];
+      path = [ (lib.getBin cfg.package) ];
+      stopIfChanged = false;
+      reloadTriggers = [
+        configFile
+      ];
+      serviceConfig = {
+        ExecStart = "${cfg.managerPackage}/bin/knot-resolver";
+        ExecReload = "${cfg.managerPackage}/bin/kresctl reload";
+
+        StateDirectory = "knot-resolver";
+        StateDirectoryMode = "0770";
+
+        RuntimeDirectory = "knot-resolver";
+        RuntimeDirectoryMode = "0770";
+
+        CacheDirectory = "knot-resolver";
+        CacheDirectoryMode = "0770";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 5c7facbcb530..88f6526d19d7 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -66,13 +66,14 @@ in
       type = lib.types.bool;
       default = false;
       description = ''
-        Whether to enable knot-resolver domain name server.
+        Whether to enable knot-resolver (version 5) domain name server.
         DNSSEC validation is turned on by default.
         You can run `kresd-cli 1` and give commands interactively to kresd@1.service.
+        If you want to user knot-resolver 6, please use services.knot-resolver.
       '';
     };
-    package = lib.mkPackageOption pkgs "knot-resolver" {
-      example = "knot-resolver.override { extraFeatures = true; }";
+    package = lib.mkPackageOption pkgs "knot-resolver_5" {
+      example = "knot-resolver_5.override { extraFeatures = true; }";
     };
     extraConfig = lib.mkOption {
       type = lib.types.lines;
@@ -134,6 +135,9 @@ in
 
   ###### implementation
   config = lib.mkIf cfg.enable {
+    assertions = lib.optionals (lib.versions.major cfg.package.version > 5) [
+      "services.kresd only works with knot-resolver 5. Please use services.knot-resolver for knot-resolver 6 and newer."
+    ];
     environment = {
       etc."knot-resolver/kresd.conf".source = configFile; # not required
       systemPackages = [
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 4a29c98f085f..8a0b7a6bd09d 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -16003,6 +16003,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tv-nvim = buildVimPlugin {
+    pname = "tv.nvim";
+    version = "2025-12-05";
+    src = fetchFromGitHub {
+      owner = "alexpasmantier";
+      repo = "tv.nvim";
+      rev = "5142057ae5d1207129e26d98651525ffb781bce4";
+      sha256 = "1zxyr7wnwrxlmk14k4yd384j1ycf3c5zjydf4pn602drrip4z235";
+    };
+    meta.homepage = "https://github.com/alexpasmantier/tv.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   twilight-nvim = buildVimPlugin {
     pname = "twilight.nvim";
     version = "2025-10-28";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 438080dc73fe..d9cf9dfcab1b 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -122,6 +122,8 @@
   # search-and-replace.nvim dependencies
   fd,
   sad,
+  # tv.nvim dependency
+  television,
 }:
 self: super:
 let
@@ -3622,6 +3624,10 @@ assertNoAdditions {
     dependencies = [ self.nvim-treesitter ];
   };
 
+  tv-nvim = super.tv-nvim.overrideAttrs {
+    runtimeDeps = [ television ];
+  };
+
   typescript-nvim = super.typescript-nvim.overrideAttrs {
     checkInputs = [
       # Optional null-ls integration
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index c35bc0a7e08c..e06ec7fac000 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1228,6 +1228,7 @@ https://github.com/dmmulroy/tsc.nvim/,HEAD,
 https://github.com/jgdavey/tslime.vim/,,
 https://github.com/mtrajano/tssorter.nvim/,HEAD,
 https://github.com/Quramy/tsuquyomi/,,
+https://github.com/alexpasmantier/tv.nvim/,HEAD,
 https://github.com/folke/twilight.nvim/,,
 https://github.com/pmizio/typescript-tools.nvim/,,
 https://github.com/leafgarland/typescript-vim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
index 60bdad38a129..76d4e7c08d93 100644
--- a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1764403772";
-    hash = "sha256-3R9SMaIop+7gBPVh2cdovbt6FyfaxjMhPIgdDJIPNIE=";
+    version = "0.0.1764950983";
+    hash = "sha256-ydP5axyMbTt+h/cSuwOsFDj3Lm3sGtEi/ZKQELXzrpo=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7f2be12906b2..648d96df4235 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -597,13 +597,13 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "hashicorp_kubernetes": {
-    "hash": "sha256-QVHLGLTzr39liRcM5AKJ0unYoc/DW2elcJWisiHC2pw=",
+    "hash": "sha256-v68Tg6X+fM41dWAWY/b3RSRhzm7l7n25tKwDktFXxu0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.38.0",
+    "rev": "v3.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LeMFN4pOJotTTqakEbVelHSTEb4p7CQIuKzeuX3SZUM="
+    "vendorHash": "sha256-IDsGPzNsVPIHWEyhfIkaNaPOrhnk/4XI1UsrIPwcq/M="
   },
   "hashicorp_local": {
     "hash": "sha256-Mdy4g8i26JeYd7MDZth5WRvKVWM7xpgd5/JHG9+Yqs0=",
@@ -949,13 +949,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-mRGLUSHwPu5U2vH8ZCHiiv4a8lrQDts32G5C/shpsc8=",
+    "hash": "sha256-3ZOttg3B4V76ke2RcQzxUTIgJx71lDf4MBDkRwMvoOM=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.76.1",
+    "rev": "v3.76.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SUALSNpd/d0chLtrCpzMTJ63Iudpf45DittU30+jark="
+    "vendorHash": "sha256-qWuRxVSSIxJ9RwS5L5EHnvabLYfNcv6d+Oiox+SPyTY="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-vSq6502jHjEQEgKmgMpUrid88jhsENOVF+3MA6Zm8lg=",
@@ -1030,13 +1030,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-dKeoICBZca/IayPwX8HedPl+HgemC9IHPzzKlI8281Y=",
+    "hash": "sha256-9VqBRIaEzD3BBJjef7cXBCe2rVGjtzv1cTS6XxiHT1Q=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.53",
+    "rev": "v1.36.54",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JH7wPgkGKEUBOgv09sz4rfJm+RJQwy3Z2dqHxrF8lZU="
+    "vendorHash": "sha256-P2d+naXmiTmX3dahOegW+24UVKePi8lauTpEpugVTGk="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
diff --git a/pkgs/build-support/lib/cmake.nix b/pkgs/build-support/lib/cmake.nix
index 796f69235475..f495f3d1d6bf 100644
--- a/pkgs/build-support/lib/cmake.nix
+++ b/pkgs/build-support/lib/cmake.nix
@@ -12,7 +12,9 @@ let
     [
       "-DCMAKE_SYSTEM_NAME=${
         findFirst isString "Generic" (
-          optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system
+          # uname -s is CYGWIN_NT[...] on cygwin, but cmake expects CYGWIN
+          optional (stdenv.hostPlatform.isCygwin) "CYGWIN"
+          ++ optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system
         )
       }"
     ]
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
index f7731964920d..33ed2e4d6ba6 100644
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ab-av1";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     tag = "v${version}";
-    hash = "sha256-bVsEsQMQhXyDES5mlBHRK1Uf7UwbX6iKhTF17peokAk=";
+    hash = "sha256-HSWu3gHpgCUkmr63mAi2Hd67Rap5vDZ/oHRh6O7y6uA=";
   };
 
-  cargoHash = "sha256-TDpNT62jkkP+g2w1HXmPJiblHXFOuAuzYRY5cpzRW/M=";
+  cargoHash = "sha256-jzEwblYsA7tgoJE6HhdtdDyOS50DyL87/J/T+cNKB3M=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/am/amneziawg-go/package.nix b/pkgs/by-name/am/amneziawg-go/package.nix
index 5a867c83cceb..2223debdcacc 100644
--- a/pkgs/by-name/am/amneziawg-go/package.nix
+++ b/pkgs/by-name/am/amneziawg-go/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "amneziawg-go";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amneziawg-go";
     tag = "v${version}";
-    hash = "sha256-xz807BLNoh1sMfyDXMAXPU9mHSxfxI3k5ayEVQM+HH0=";
+    hash = "sha256-JGmWMPVgereSZmdHUHC7ZqWCwUNfxfj3xBf/XDDHhpo=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ buildGoModule rec {
     rm -f format_test.go
   '';
 
-  vendorHash = "sha256-VYDc6oI0CqW1T3tVX0CWQLfLIOvqHCawVA8BWASWLLY=";
+  vendorHash = "sha256-ZO8sLOaEY3bii9RSxzXDTCcwlsQEYmZDI+X1WPXbE9c=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/c2/c2patool/package.nix b/pkgs/by-name/c2/c2patool/package.nix
index 56f4620e854a..62458690bfa9 100644
--- a/pkgs/by-name/c2/c2patool/package.nix
+++ b/pkgs/by-name/c2/c2patool/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.5";
+  version = "0.26.6";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-l21tGPvbHgJOBzK+RQTa8RpeKJ8A/K6Z6CsPAjLTCUw=";
+    hash = "sha256-Gv5/GN4bdXoam8pctGRSkx7O3h1Xt9jJuBvygZrMKNA=";
   };
 
-  cargoHash = "sha256-T3cpfujue5tMAiCCqOprG+rfqACiw4OLMsbOr2G23Jc=";
+  cargoHash = "sha256-ZO7SH+D1bae4wt8rb33Vsa0bKe5JbzlRjQSCm/BYZKU=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ca/cargo-binstall/package.nix b/pkgs/by-name/ca/cargo-binstall/package.nix
index db34248362d3..ab542c8e4628 100644
--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     tag = "v${version}";
-    hash = "sha256-jaBIVR8N1UXihRDjQVdJtx5ErlrOHXBVs68SzD0bbPc=";
+    hash = "sha256-FZWBpt8QtHgPLrgck/2Yhq6hYwwP7ZLjCyA01+Jqk8M=";
   };
 
-  cargoHash = "sha256-Qn/eRQ1GDFPepwgrnZObz7Bgxm9UzFNAZsdwP36A+dM=";
+  cargoHash = "sha256-ntW5oenx80BL51qWgqkXuLebJsBCRsyl/sevh0Hi/K0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-swift/package.nix b/pkgs/by-name/ca/cargo-swift/package.nix
index 79cc437ceb85..558deb26c74d 100644
--- a/pkgs/by-name/ca/cargo-swift/package.nix
+++ b/pkgs/by-name/ca/cargo-swift/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-swift";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "antoniusnaumann";
     repo = "cargo-swift";
     rev = "v${version}";
-    hash = "sha256-D6s25pOMdVZXBtBce/KEvqwn/9owrmxDOev3E59qrQ8=";
+    hash = "sha256-koHQaYfMDc8GxQ+K7C1YluMY5u4cUGV8/Ehjt/KWl/g=";
   };
 
-  cargoHash = "sha256-pypBvfVW7m9dAvrc9ftrBOJ/wC+xLUuhGr7g7DVdZDI=";
+  cargoHash = "sha256-8aFISZ2nzCmxxKkX77jEOE/MWcKwyTw8IGTEbJ0mKWg=";
 
   meta = with lib; {
     description = "Cargo plugin to easily build Swift packages from Rust code";
diff --git a/pkgs/by-name/ci/civo/package.nix b/pkgs/by-name/ci/civo/package.nix
index 421956d3ce65..194f6eb1f6c7 100644
--- a/pkgs/by-name/ci/civo/package.nix
+++ b/pkgs/by-name/ci/civo/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "civo";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-QZZuRHcKNncQTRgizWAH723OskVMH92eQ72wHpEINEc=";
+    hash = "sha256-eR/L0AkeMgtbtaV+jIhbyGN1tUYrpnIWDeKD0p9BP1Y=";
   };
 
-  vendorHash = "sha256-ZoJdu8sA0r5kiADF+VB4BnOduWLbBAVGbMQs45HKDIU=";
+  vendorHash = "sha256-F56+450hDqAiIFt9/Jl79ltLOKMRC2NaNQM4/T4Di3k=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/co/composer-require-checker/package.nix b/pkgs/by-name/co/composer-require-checker/package.nix
index 7c737a724c02..03509e4fc344 100644
--- a/pkgs/by-name/co/composer-require-checker/package.nix
+++ b/pkgs/by-name/co/composer-require-checker/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "composer-require-checker";
-  version = "4.18.0";
+  version = "4.19.0";
 
   # Upstream no longer provides the composer.lock in their release artifact
   src = fetchgit {
     url = "https://github.com/maglnet/ComposerRequireChecker";
     tag = finalAttrs.version;
-    hash = "sha256-8y8ziaWCno389ti263N+xinADoPZZGXqhTHoc9ZkF4Y=";
+    hash = "sha256-cTXXPsHI2yiHSakiWuuxripGLvkwmzIAADqKtwHOI7c=";
   };
 
-  vendorHash = "sha256-BDGxHoDLSEdukN+zv8QNZPtVXfRpp/o95ysGFs0wl9Q=";
+  vendorHash = "sha256-ZUAXo4X4B7Z6wfcmv7L1DFvD4Lx1sSoMmw1gR5nDEP0=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 9cb223b7c53f..85cb85f0027c 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20251124";
+  version = "20251201";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-4MWmzeLpuDlz/Y8N0WmzASADtFCuWNMPT8QnCTrPRrQ=";
+    hash = "sha256-dZXneydnQsjQUmcOpKQiWcQWid7doUrMWE4TRyX2C50=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cr/credhub-cli/package.nix b/pkgs/by-name/cr/credhub-cli/package.nix
index 602b2deca179..3c7a1e04bd18 100644
--- a/pkgs/by-name/cr/credhub-cli/package.nix
+++ b/pkgs/by-name/cr/credhub-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.51";
+  version = "2.9.52";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-BFlPKkk8t6WWbDB4Z0Bsizumd0flO1GqedVSWHKlwgE=";
+    sha256 = "sha256-qTRRk7n8f5tC/uiBJgbZpd+tsoOPK5qTgZnqfwi5YlA=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index e98c1b789195..b191782cb3e5 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.6.1";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-nnbBK1dIHwhq8n1mJe2wOLcDkIuScFbQwZvJ8x+knCk=";
+    hash = "sha256-AUi/MODxCSVuJhFjlhbMUyrGnK0X28B2+uTIHIg7oMg=";
   };
 
   # Fix CMake 4 compatibility
diff --git a/pkgs/by-name/dg/dgop/package.nix b/pkgs/by-name/dg/dgop/package.nix
index cb04ca653be3..406d29a53772 100644
--- a/pkgs/by-name/dg/dgop/package.nix
+++ b/pkgs/by-name/dg/dgop/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "dgop";
   version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "AvengeMedia";
     repo = "dgop";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QhzRn7pYN35IFpKjjxJAj3GPJECuC+VLhoGem3ezycc=";
   };
 
@@ -22,7 +22,7 @@ buildGoModule rec {
   ldflags = [
     "-w"
     "-s"
-    "-X main.Version=${version}"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
@@ -43,10 +43,10 @@ buildGoModule rec {
   meta = {
     description = "API & CLI for System & Process Monitoring";
     homepage = "https://github.com/AvengeMedia/dgop";
-    changelog = "https://github.com/AvengeMedia/dgop/releases/tag/v${version}";
+    changelog = "https://github.com/AvengeMedia/dgop/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ luckshiba ];
     mainProgram = "dgop";
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/dm/dms-shell/package.nix b/pkgs/by-name/dm/dms-shell/package.nix
index a9ad173a1c62..deba3b5218bd 100644
--- a/pkgs/by-name/dm/dms-shell/package.nix
+++ b/pkgs/by-name/dm/dms-shell/package.nix
@@ -9,25 +9,25 @@
   bashNonInteractive,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "dms-shell";
   version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "AvengeMedia";
     repo = "DankMaterialShell";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-dLbiTWsKoF0if/Wqet/+L90ILdAaBqp+REGOou8uH3k=";
   };
 
-  sourceRoot = "${src.name}/core";
+  sourceRoot = "${finalAttrs.src.name}/core";
 
   vendorHash = "sha256-nc4CvEPfJ6l16/zmhnXr1jqpi6BeSXd3g/51djbEfpQ=";
 
   ldflags = [
     "-w"
     "-s"
-    "-X main.Version=${version}"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   subPackages = [ "cmd/dms" ];
@@ -39,11 +39,11 @@ buildGoModule rec {
 
   postInstall = ''
     mkdir -p $out/share/quickshell
-    cp -r ${src}/quickshell $out/share/quickshell/dms
+    cp -r ${finalAttrs.src}/quickshell $out/share/quickshell/dms
 
     wrapProgram $out/bin/dms --add-flags "-c $out/share/quickshell/dms"
 
-    install -Dm644 ${src}/quickshell/assets/systemd/dms.service \
+    install -Dm644 ${finalAttrs.src}/quickshell/assets/systemd/dms.service \
       $out/lib/systemd/user/dms.service
     substituteInPlace $out/lib/systemd/user/dms.service \
       --replace-fail /usr/bin/dms $out/bin/dms \
@@ -65,10 +65,10 @@ buildGoModule rec {
   meta = {
     description = "Desktop shell for wayland compositors built with Quickshell & GO";
     homepage = "https://danklinux.com";
-    changelog = "https://github.com/AvengeMedia/DankMaterialShell/releases/tag/v${version}";
+    changelog = "https://github.com/AvengeMedia/DankMaterialShell/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ luckshiba ];
     mainProgram = "dms";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ds/dsearch/package.nix b/pkgs/by-name/ds/dsearch/package.nix
index a6d3b8348a0e..18056b4016db 100644
--- a/pkgs/by-name/ds/dsearch/package.nix
+++ b/pkgs/by-name/ds/dsearch/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "dsearch";
   version = "0.0.7";
 
   src = fetchFromGitHub {
     owner = "AvengeMedia";
     repo = "danksearch";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-rtfymtzsxEuto1mOm8A5ubREJzXKCai6dw9Na1Fa21Q=";
   };
 
@@ -22,7 +22,7 @@ buildGoModule rec {
   ldflags = [
     "-w"
     "-s"
-    "-X main.Version=${version}"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
@@ -45,10 +45,10 @@ buildGoModule rec {
   meta = {
     description = "Fast, configurable filesystem search with fuzzy matching";
     homepage = "https://github.com/AvengeMedia/danksearch";
-    changelog = "https://github.com/AvengeMedia/danksearch/releases/tag/v${version}";
+    changelog = "https://github.com/AvengeMedia/danksearch/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ luckshiba ];
     mainProgram = "dsearch";
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/em/emmylua-doc-cli/package.nix b/pkgs/by-name/em/emmylua-doc-cli/package.nix
index 762bffbbe2a3..3fdc179ff8fa 100644
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-CAYSaRjpQwnPZojeX/VyV9/xz8SY8Lt+e1wc79qvGZg=";
+    hash = "sha256-JXe+I0CViJAXOnWzilYpjWquYFzZGIP5y6HS6KosYPU=";
   };
 
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
-  cargoHash = "sha256-nGSN7LqvAwYg2Z+2tTAc+vIwrYmb+W0OLw9EeG7e/V8=";
+  cargoHash = "sha256-UVuXeGmSvAwHs/U0s/mByiZCwa2refz1l8eJvcCoagk=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/em/emmylua-ls/package.nix b/pkgs/by-name/em/emmylua-ls/package.nix
index be9ba37a1251..9d07a651c26d 100644
--- a/pkgs/by-name/em/emmylua-ls/package.nix
+++ b/pkgs/by-name/em/emmylua-ls/package.nix
@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_ls";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-CAYSaRjpQwnPZojeX/VyV9/xz8SY8Lt+e1wc79qvGZg=";
+    hash = "sha256-JXe+I0CViJAXOnWzilYpjWquYFzZGIP5y6HS6KosYPU=";
   };
 
   buildAndTestSubdir = "crates/emmylua_ls";
 
-  cargoHash = "sha256-nGSN7LqvAwYg2Z+2tTAc+vIwrYmb+W0OLw9EeG7e/V8=";
+  cargoHash = "sha256-UVuXeGmSvAwHs/U0s/mByiZCwa2refz1l8eJvcCoagk=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index 87f15551c8d3..9aa1036638d1 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.55.1";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-pHDKVVGKOl9vdPephuClIrsIU0ooJID3M6Hbcm5GSig=";
+    hash = "sha256-kOI0PUEKmI5hZowEl/VRinjRMDXOP4K12eoFHuIDqOo=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 73fd930c97d0..8ffa990e2bc8 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.26.0";
+  version = "14.27.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-rtLjvD7HYqc2acteeBZEnFqMkAK3f5/5X8hgwPVMv+k=";
+    hash = "sha256-mkHZtC3W8ueB0cB4fVSAY5DID2QEdv+2ZmkhsVTunEc=";
   };
 
-  npmDepsHash = "sha256-BqMXNV0sSfy+hitq4Ngv1OrYgC/vyqZCG39S0HMJh4o=";
+  npmDepsHash = "sha256-XDaFdYbowygMiM0BX1ggfWt1JXHaLOaZ2Npztip7CAU=";
 
   # No more package-lock.json in upstream src
   postPatch = ''
diff --git a/pkgs/by-name/fl/flake-checker/package.nix b/pkgs/by-name/fl/flake-checker/package.nix
index 2c5fd85acacb..6d1d12177c3d 100644
--- a/pkgs/by-name/fl/flake-checker/package.nix
+++ b/pkgs/by-name/fl/flake-checker/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "flake-checker";
-  version = "0.2.8";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "flake-checker";
     rev = "v${version}";
-    hash = "sha256-elHpiMGwJ2KnN75EOTjsjpziYfXiRyTeixhY4rd85m0=";
+    hash = "sha256-/hwcRsaVdLvjKnCjFzy4T/zdvWjWAMBtfgJX/cNpmOc=";
   };
 
-  cargoHash = "sha256-QS38tAJ1V0Avd7N+Mhexv23oh+kxtmr/qvQZLRwP9zA=";
+  cargoHash = "sha256-5pK0l84L4cEhw5d8n8j6JWEXEbsmWHmHJxB5ZMrnAU0=";
 
   meta = with lib; {
     description = "Health checks for your Nix flakes";
diff --git a/pkgs/by-name/fr/freefilesync/Makefile.patch b/pkgs/by-name/fr/freefilesync/Makefile.patch
index 41e5617028fc..7e2a3db10590 100644
--- a/pkgs/by-name/fr/freefilesync/Makefile.patch
+++ b/pkgs/by-name/fr/freefilesync/Makefile.patch
@@ -9,15 +9,13 @@ index 9d81055..aed0f30 100644
  
  CXXFLAGS += -std=c++23 -pipe -DWXINTL_NO_GETTEXT_MACRO -I../.. -I../../zenXml -include "zen/i18n.h" -include "zen/warn_static.h" \
             -Wall -Wfatal-errors -Wmissing-include-dirs -Wswitch-enum -Wcast-align -Wnon-virtual-dtor -Wno-unused-function -Wshadow -Wno-maybe-uninitialized \
-@@ -17,9 +17,10 @@ LDFLAGS  += `pkg-config --libs libcurl` -lidn2
- CXXFLAGS += `pkg-config --cflags libssh2`
+@@ -21,8 +21,9 @@ CXXFLAGS += `pkg-config --cflags libssh2`
  LDFLAGS  += `pkg-config --libs libssh2`
  
--CXXFLAGS += `pkg-config --cflags gtk+-2.0`
-+CXXFLAGS += `pkg-config --cflags gtk+-3.0`
+ CXXFLAGS += `pkg-config --cflags gtk+-3.0`
 +LDFLAGS += `pkg-config --libs gtk+-3.0`
  #treat as system headers so that warnings are hidden:
--CXXFLAGS += -isystem/usr/include/gtk-2.0
+-CXXFLAGS += -isystem/usr/include/gtk-3.0
 +CXXFLAGS += -isystem@gtk3-dev@/include/gtk-3.0
  
  #support for SELinux (optional)
@@ -33,15 +31,13 @@ index 0be46c9..f510284 100644
  
  CXXFLAGS += -std=c++23 -pipe -DWXINTL_NO_GETTEXT_MACRO -I../../.. -I../../../zenXml -include "zen/i18n.h" -include "zen/warn_static.h" \
             -Wall -Wfatal-errors -Wmissing-include-dirs -Wswitch-enum -Wcast-align -Wnon-virtual-dtor -Wno-unused-function -Wshadow -Wno-maybe-uninitialized \
-@@ -8,9 +8,10 @@ CXXFLAGS += -std=c++23 -pipe -DWXINTL_NO_GETTEXT_MACRO -I../../.. -I../../../zen
- LDFLAGS += -s `wx-config --libs std, aui, richtext --debug=no` -pthread
+@@ -9,8 +9,9 @@ LDFLAGS += -s `wx-config --libs std, aui, richtext --debug=no` -pthread
  
  
--CXXFLAGS += `pkg-config --cflags gtk+-2.0`
-+CXXFLAGS += `pkg-config --cflags gtk+-3.0`
+ CXXFLAGS += `pkg-config --cflags gtk+-3.0`
 +LDFLAGS += `pkg-config --libs gtk+-3.0`
  #treat as system headers so that warnings are hidden:
--CXXFLAGS += -isystem/usr/include/gtk-2.0
+-CXXFLAGS += -isystem/usr/include/gtk-3.0
 +CXXFLAGS += -isystem@gtk3-dev@/include/gtk-3.0
  
  cppFiles=
diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index f9ec4d5035f0..e374524bc8e5 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -29,7 +29,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freefilesync";
-  version = "14.5";
+  version = "14.6";
 
   src = fetchurl {
     url = "https://freefilesync.org/download/FreeFileSync_${finalAttrs.version}_Source.zip";
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       rm -f "$out"
       tryDownload "$url" "$out"
     '';
-    hash = "sha256-+qfj1zf3V5xxtvXgCa0QDDRhEPQ3Qzii5eKiMySuUUY=";
+    hash = "sha256-OST2QIhPhKl9Qh4nHIno5XAJmLPNki0bU5A1ZXcUVTw=";
   };
 
   sourceRoot = ".";
@@ -60,6 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  postPatch = ''
+    touch zen/warn_static.h
+  '';
+
   nativeBuildInputs = [
     copyDesktopItems
     pkg-config
diff --git a/pkgs/by-name/go/go-csp-collector/package.nix b/pkgs/by-name/go/go-csp-collector/package.nix
index c8437b2b122b..8ca56da69489 100644
--- a/pkgs/by-name/go/go-csp-collector/package.nix
+++ b/pkgs/by-name/go/go-csp-collector/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-csp-collector";
-  version = "0.0.16-unstable-2025-10-10";
+  version = "0.0.17-unstable-2025-11-24";
 
   src = fetchFromGitHub {
     owner = "jacobbednarz";
     repo = "go-csp-collector";
-    rev = "a0cf22ac6d1f5c8972bf53671ba174767d2adcd5";
-    hash = "sha256-xFvO8ZuJQ5luCDOTPHtVeb1+3VvIKSwjt2TqkxBIY58=";
+    rev = "c997e31172ed2d785fc960296b826a9587bd5de9";
+    hash = "sha256-ZfE8xa+og14dlUmvYfatecSdrhmuMbFFNTw5RZ3ZHXU=";
   };
 
   vendorHash = "sha256-SrQahSHO5ZIkcLR3BR5CR5BTStW1pH1Ij1Eql0b3tuU=";
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index 121e3603bc0d..eddb9fc819a1 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "25.9.1-0";
+  version = "25.11.1-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-mV/k+9NgHp9fyc8i0trewobvk3Fcu4JnRofHGV7dp70=";
+          hash = "sha256-twEBbr00uUYQq6fGcywb/L3SdCwMyT9ChoY7I7ytcuE=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-5UMZw3n7lINJSWf0SKmux7s8ISKGn+GppXbK1gcbeVs=";
+          hash = "sha256-TcEp+xJRPmQd8yR5OQelhd5KiDZd7IYxb8ZVnpKmYso=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-aW83wSbIV31sakiZxOaUd2QjxOwK2tcnaEMF9jrvrHg=";
+          hash = "sha256-QnGoMnPhynVBWrfWb6GUiUG1C49d0FgtSHigNpxMGXs=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/ht/htgettoken/package.nix b/pkgs/by-name/ht/htgettoken/package.nix
index 046cb4be7ef8..f484915fcfc2 100644
--- a/pkgs/by-name/ht/htgettoken/package.nix
+++ b/pkgs/by-name/ht/htgettoken/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "htgettoken";
-  version = "2.4";
+  version = "2.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "fermitools";
     repo = "htgettoken";
     tag = "v${version}";
-    hash = "sha256-3xBACXxH5G1MO2dNFFSL1Rssc8RdauvLZ4Tx2djOgyw=";
+    hash = "sha256-CUzkivrkvMr8EE00tjHswyK5WidQjmki5nLYpeb8jjU=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index b8b1f4ab1759..69ffad4c85e7 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-11-01";
+  version = "0-unstable-2025-12-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "417baa847977539d641dfb83c9960c2b6b10c1d7";
-    hash = "sha256-uBregjxM/LDkAyYMLiXLVGSa83DStFxz352pFORqVdY=";
+    rev = "4ef9c544eef62ad882f66594ffec625073212735";
+    hash = "sha256-Sw4yR8KIQnYdc7anh544QX3s5+5Pk1LlXjcvUICe378=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index f8e534041458..b1f8cf84df31 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,11 +18,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.528.1";
+  version = "2.528.2";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-1jDcomX3Wo1YHxJ6kjTxZ51LCACo83DQOtShVM63KVs=";
+    hash = "sha256-YiWtzsAQ6gdcLWmP69vXLfduIV3WtsocV5u07Osq1cc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/kc/kcl/package.nix b/pkgs/by-name/kc/kcl/package.nix
index ba108e38f3d9..fa457ed5113e 100644
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kcl";
-  version = "0.11.4";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-fFT8sUxx1E6WdyiJ8DyTagGkVEQ7YZ2CCGL5tVxkAEI=";
+    hash = "sha256-dwJkV5/MCUhjralKtnlmqSrb2C0kMZ1eO+6nTnenWZw=";
   };
 
-  vendorHash = "sha256-ohfNy3vOyJJuniQKEVFiDftffdHlEJejQ72TJEwNhIM=";
+  vendorHash = "sha256-1O1oTJCdGwA0TgI8dScZq7+yfumbzyi8rD4VJkFgn5E=";
 
   subPackages = [ "cmd/kcl" ];
 
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index 77256147da2c..09bf158893bc 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -26,7 +26,7 @@
   sphinx,
   autoreconfHook,
   nixosTests,
-  knot-resolver,
+  knot-resolver_5,
   knot-dns,
   runCommandLocal,
 }:
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru.tests = {
-    inherit knot-resolver;
+    inherit knot-resolver_5;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isLinux {
     inherit (nixosTests) knot kea;
diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
new file mode 100644
index 000000000000..851dec44dfa1
--- /dev/null
+++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
@@ -0,0 +1,56 @@
+{
+  knot-resolver_6,
+  writeText,
+  python3Packages,
+}:
+
+python3Packages.buildPythonPackage {
+  pname = "knot-resolver-manager_6";
+  inherit (knot-resolver_6) version src;
+  pyproject = true;
+
+  patches = [
+    # Rewrap the two supervisor's binaries, so that they obtain access to python modules
+    # defined in the manager.  Those are then used as extensions of supervisord.
+    # Manager needs this fixed bin/supervisord on its $PATH.
+    ./rewrap-supervisor.patch
+  ];
+
+  # Propagate meson config from the C part to the python part.
+  # But the install-time etc differs from a sensible run-time etc.
+  postPatch = ''
+    substitute '${knot-resolver_6.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \
+      --replace-fail '${knot-resolver_6.out}/etc' '/etc'
+  '';
+
+  build-system = with python3Packages; [
+    poetry-core
+    setuptools
+  ];
+
+  # Deps can be seen in ${src}/pyproject.toml
+  propagatedBuildInputs = with python3Packages; [
+    aiohttp
+    jinja2
+    pyyaml
+    prometheus-client
+    supervisor
+    typing-extensions
+  ];
+
+  doCheck = false; # FIXME
+  checkInputs = with python3Packages; [
+    python3Packages.augeas
+    dnspython
+    lief
+    pytestCheckHook
+    pytest-asyncio
+    pyroute2
+    pyparsing
+    toml
+  ];
+
+  meta = knot-resolver_6.meta // {
+    mainProgram = "knot-resolver";
+  };
+}
diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch b/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch
new file mode 100644
index 000000000000..5569059cefec
--- /dev/null
+++ b/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch
@@ -0,0 +1,14 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 22d6ca5b0d..15acfb3c6c 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -71,6 +71,9 @@
+ [tool.poetry.scripts]
+ kresctl = 'knot_resolver.client.main:main'
+ knot-resolver = 'knot_resolver.manager.main:main'
++supervisord = 'supervisor.supervisord:main'
++supervisorctl = 'supervisor.supervisorctl:main'
++
+
+ [tool.poe.tasks]
+ # tasks runed through scripts located in 'scripts/poe-tasks/'
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/by-name/kn/knot-resolver_5/package.nix
similarity index 92%
rename from pkgs/servers/dns/knot-resolver/default.nix
rename to pkgs/by-name/kn/knot-resolver_5/package.nix
index a589b7fb93bb..20d8e1c5494f 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/by-name/kn/knot-resolver_5/package.nix
@@ -15,7 +15,7 @@
   gnutls,
   lmdb,
   jemalloc,
-  systemd,
+  systemdMinimal,
   libcap_ng,
   dns-root-data,
   nghttp2, # optionals, in principle
@@ -33,12 +33,12 @@ let
   inherit (lib) optional optionals optionalString;
   lua = luajitPackages;
 
-  unwrapped = stdenv.mkDerivation rec {
-    pname = "knot-resolver";
+  unwrapped = stdenv.mkDerivation (finalAttrs: {
+    pname = "knot-resolver_5";
     version = "5.7.6";
 
     src = fetchurl {
-      url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
+      url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz";
       sha256 = "500ccd3a560300e547b8dc5aaff322f7c8e2e7d6f0d7ef5f36e59cb60504d674";
     };
 
@@ -69,7 +69,7 @@ let
       done
     ''
     # some tests have issues with network sandboxing, apparently
-    + optionalString doInstallCheck ''
+    + optionalString finalAttrs.doInstallCheck ''
       echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
       sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \
         tests/config/doh2.test.lua modules/http/http_doh.test.lua
@@ -96,7 +96,7 @@ let
     ## the rest are optional dependencies
     ++ optionals stdenv.hostPlatform.isLinux [
       # lib
-      systemd
+      systemdMinimal
       libcap_ng
     ]
     ++ [
@@ -116,8 +116,8 @@ let
       "-Dmalloc=jemalloc"
       "--default-library=static" # not used by anyone
     ]
-    ++ optional doInstallCheck "-Dunit_tests=enabled"
-    ++ optional doInstallCheck "-Dconfig_tests=enabled"
+    ++ optional finalAttrs.doInstallCheck "-Dunit_tests=enabled"
+    ++ optional finalAttrs.doInstallCheck "-Dconfig_tests=enabled"
     ++ optional stdenv.hostPlatform.isLinux "-Dsystemd_files=enabled" # used by NixOS service
     #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
     ;
@@ -153,7 +153,7 @@ let
       ];
       mainProgram = "kresd";
     };
-  };
+  });
 
   wrapped-full =
     runCommand unwrapped.name
diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix
new file mode 100644
index 000000000000..21fa65aab9fa
--- /dev/null
+++ b/pkgs/by-name/kn/knot-resolver_6/package.nix
@@ -0,0 +1,189 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  # native deps.
+  runCommand,
+  pkg-config,
+  meson,
+  ninja,
+  makeWrapper,
+  # build+runtime deps.
+  knot-dns,
+  luajitPackages,
+  libuv,
+  gnutls,
+  lmdb,
+  jemalloc,
+  systemdMinimal,
+  libcap_ng,
+  dns-root-data,
+  nghttp2, # optionals, in principle
+  fstrm,
+  protobufc, # more optionals
+  # test-only deps.
+  cmocka,
+  which,
+  cacert,
+  extraFeatures ? false, # catch-all if defaults aren't enough
+}:
+let
+  result = if extraFeatures then wrapped-full else unwrapped;
+
+  inherit (lib) optional optionals optionalString;
+  lua = luajitPackages;
+
+  unwrapped = stdenv.mkDerivation (finalAttrs: {
+    pname = "knot-resolver_6";
+    version = "6.0.17";
+
+    src = fetchurl {
+      url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz";
+      hash = "sha256-E9RJbvh66y+9OwBX4iEdRYUgUkHlCaDNQ0Hb5ejLXBw=";
+    };
+
+    outputs = [
+      "out"
+      "dev"
+      "config_py"
+    ];
+
+    # Path fixups for the NixOS service.
+    # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them.
+    postPatch = ''
+      patch meson.build <<EOF
+      @@ -50,2 +50,3 @@
+      -systemd_work_dir = prefix / get_option('localstatedir') / 'lib' / 'knot-resolver'
+      -systemd_cache_dir = prefix / get_option('localstatedir') / 'cache' / 'knot-resolver'
+      +systemd_work_dir  = '/var/lib/knot-resolver'
+      +systemd_cache_dir = '/var/cache/knot-resolver'
+      +run_dir = '/run/knot-resolver'
+      EOF
+
+      sed -e '/^ExecStart=/d' -e '/^ExecReload=/d' \
+        -i systemd/knot-resolver.service.in
+    ''
+    # some tests have issues with network sandboxing, apparently
+    + optionalString finalAttrs.doInstallCheck ''
+      echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
+      sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \
+        tests/config/doh2.test.lua modules/http/http_doh.test.lua
+    '';
+
+    preConfigure = ''
+      patchShebangs scripts/
+    '';
+
+    nativeBuildInputs = [
+      pkg-config
+      meson
+      ninja
+    ];
+
+    # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
+    buildInputs = [
+      knot-dns
+      lua.lua
+      libuv
+      gnutls
+      lmdb
+    ]
+    ## the rest are optional dependencies
+    ++ optionals stdenv.hostPlatform.isLinux [
+      # lib
+      systemdMinimal
+      libcap_ng
+    ]
+    ++ [
+      jemalloc
+      nghttp2
+    ]
+    ++ [
+      fstrm
+      protobufc
+    ] # dnstap support
+    ;
+
+    mesonFlags = [
+      "-Dkeyfile_default=${dns-root-data}/root.ds"
+      "-Droot_hints=${dns-root-data}/root.hints"
+      "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/
+      "-Dmalloc=jemalloc"
+      "--default-library=static" # not used by anyone
+    ]
+    ++ optional finalAttrs.doInstallCheck "-Dunit_tests=enabled"
+    ++ optional finalAttrs.doInstallCheck "-Dconfig_tests=enabled"
+    ++ optional stdenv.hostPlatform.isLinux "-Dsystemd_files=enabled" # used by NixOS service
+    #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
+    ;
+
+    postInstall = ''
+      cp -r ./python "$config_py"
+      rm "$out"/lib/libkres.a
+    ''
+    + optionalString stdenv.hostPlatform.isLinux ''
+      rm -r "$out"/lib/sysusers.d/ # ATM more likely to harm than help
+    '';
+
+    doInstallCheck = with stdenv; hostPlatform == buildPlatform;
+    nativeInstallCheckInputs = [
+      cmocka
+      which
+      cacert
+      lua.cqueues
+      lua.basexx
+      lua.http
+    ];
+    installCheckPhase = ''
+      meson test --print-errorlogs --no-suite snowflake
+    '';
+
+    meta = with lib; {
+      description = "Caching validating DNS resolver, from .cz domain registry";
+      homepage = "https://knot-resolver.cz";
+      license = licenses.gpl3Plus;
+      platforms = platforms.unix;
+      maintainers = [
+        maintainers.vcunat # upstream developer
+      ];
+      teams = [ teams.flyingcircus ];
+      mainProgram = "kresd";
+    };
+  });
+
+  wrapped-full =
+    runCommand unwrapped.name
+      {
+        nativeBuildInputs = [ makeWrapper ];
+        buildInputs = with luajitPackages; [
+          # For http module, prefill module, trust anchor bootstrap.
+          # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
+          http
+          # used by policy.slice_randomize_psl()
+          psl
+        ];
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        inherit (unwrapped) meta;
+      }
+      (
+        ''
+          mkdir -p "$out"/bin
+          makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
+            --set LUA_PATH  "$LUA_PATH" \
+            --set LUA_CPATH "$LUA_CPATH"
+
+          ln -sr '${unwrapped}/bin/kres-cache-gc' "$out"/bin/
+          ln -sr '${unwrapped}/share' "$out"/
+          ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
+          ln -sr "$out"/{bin,sbin}
+        ''
+        + lib.optionalString unwrapped.doInstallCheck ''
+          echo "Checking that 'http' module loads, i.e. lua search paths work:"
+          echo "modules.load('http')" > test-http.lua
+          echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
+        ''
+      );
+
+in
+result
diff --git a/pkgs/by-name/li/libkate/package.nix b/pkgs/by-name/li/libkate/package.nix
index 553ba6e89ce3..dc076dec0843 100644
--- a/pkgs/by-name/li/libkate/package.nix
+++ b/pkgs/by-name/li/libkate/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "0.4.3";
 
   src = fetchFromGitLab {
-    domain = "gitlab.xiph.org/";
+    domain = "gitlab.xiph.org";
     owner = "xiph";
     repo = "kate";
     tag = "kate-${finalAttrs.version}";
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index dfd54c06efad..c1742c1c3bf1 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.19";
+  version = "9.0.20";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mAf4jgI8aum/XbO8OKOoLCMWxwUMee5erDocxV8/TMA=";
+    hash = "sha256-naIlf09phlgFS4GqNSLLqzQwM3DGp3bBu3cFinrUYFA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index d520ec04b3e0..e39612f62639 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -12,7 +12,7 @@
   # for passthru.tests
   bind,
   cmake,
-  knot-resolver,
+  knot-resolver_5,
   sbclPackages,
   luajitPackages,
   mosquitto,
@@ -181,7 +181,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit
       bind
       cmake
-      knot-resolver
+      knot-resolver_5
       mosquitto
       neovim
       nodejs
diff --git a/pkgs/by-name/li/lix-diff/package.nix b/pkgs/by-name/li/lix-diff/package.nix
index cee842717b94..04cc71c5a9ce 100644
--- a/pkgs/by-name/li/lix-diff/package.nix
+++ b/pkgs/by-name/li/lix-diff/package.nix
@@ -2,19 +2,22 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lix-diff";
-  version = "1.0.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "tgirlcloud";
     repo = "lix-diff";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-apjYXFdvxLZjhcN1wV7Y/LKNuWtWtCZM0h1VFg/znVo=";
+    hash = "sha256-uZd8xoQWsvJCmHtxtKJzKtaupUdXMXKWqSjXnK/BZco=";
   };
 
-  cargoHash = "sha256-u3aFmPcceLP7yPdWWoPmOnQEbM0jhULs/kPweymQcZ8=";
+  cargoHash = "sha256-ydB65V879tW42FXSgdoUDeQbovsVf8qXku9uW4mqAfs=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     homepage = "https://github.com/isabelroses/lix-diff";
diff --git a/pkgs/by-name/ne/netpeek/package.nix b/pkgs/by-name/ne/netpeek/package.nix
index 0a05c87a2543..c7cb6829bd63 100644
--- a/pkgs/by-name/ne/netpeek/package.nix
+++ b/pkgs/by-name/ne/netpeek/package.nix
@@ -15,14 +15,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "netpeek";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "ZingyTomato";
     repo = "NetPeek";
     tag = "v${version}";
-    hash = "sha256-b7XHBmFSI3ITojd05M6tytozgfBg0WvN/CWFbk5c/JQ=";
+    hash = "sha256-SFY/bUUS4AOniOGjngH/fUHrYiq+dMWxHYvoSkhfnkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/netron/package.nix b/pkgs/by-name/ne/netron/package.nix
index b76c74b0d894..08963d43fb3b 100644
--- a/pkgs/by-name/ne/netron/package.nix
+++ b/pkgs/by-name/ne/netron/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "netron";
-  version = "8.7.5";
+  version = "8.7.6";
 
   src = fetchFromGitHub {
     owner = "lutzroeder";
     repo = "netron";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wK6aKoTnERW1qkCv1zy4Pea00VP0mOPZGFxLbGQ6IFg=";
+    hash = "sha256-gVaNYbKTvymRl1M58Hk2CAxiRXB73adfkaRbpGHsReI=";
   };
 
-  npmDepsHash = "sha256-+beWln/XjFyRc1g4ERvWACt7XRSimDX7G1x9R3YP3Eg=";
+  npmDepsHash = "sha256-ScEqjtCafuCQ3+KgQnQQ6q+t483Sy/0N5kSQUsbgnRw=";
 
   nativeBuildInputs = [ jq ];
 
diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index eb13bb875a3f..eea365cd5601 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.5.1";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-85gGcNDuARc7sMJcl3yVwuTYG0laQ5/Uk7qxcXFeViQ=";
+    hash = "sha256-jZInWfXHUuntdEKdaFV46/A7NTcCB77bLYaFSL9w+Os=";
   };
 
-  vendorHash = "sha256-VKszu2WNLL2gSkgyAoA80HkYGD6kRdfj5fGLErjL86A=";
+  vendorHash = "sha256-jw6DhUCFz7dnWX3tMsj2fMX36YA5RwkQlONVQHg37dY=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index 689f0e229072..428bad2816c1 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "openfga";
-  version = "1.11.1";
+  version = "1.11.2";
 in
 
 buildGoModule {
@@ -17,7 +17,7 @@ buildGoModule {
     owner = "openfga";
     repo = "openfga";
     rev = "v${version}";
-    hash = "sha256-GI0ZII1PlZMTjgxoJJP45mHAUF4BAXGDqV3bNlFB5ec=";
+    hash = "sha256-L8rzLTMcE2tcXrYQdTlkuIrRzZ+gHBj/NYZaq9zpUik=";
   };
 
   vendorHash = "sha256-pwEyPHQZ6XYa/HhopvY/hDFHIAbnC51d2IQBSpvMBY8=";
diff --git a/pkgs/by-name/pa/parca-debuginfo/package.nix b/pkgs/by-name/pa/parca-debuginfo/package.nix
index ca69726aae46..5ad9563bffbb 100644
--- a/pkgs/by-name/pa/parca-debuginfo/package.nix
+++ b/pkgs/by-name/pa/parca-debuginfo/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "parca-debuginfo";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-debuginfo";
     tag = "v${version}";
-    hash = "sha256-tJ3Xc5b9XnTL460u11RkCmbIc41vHKql/oZ7enTaPgQ=";
+    hash = "sha256-aFG4lMwiVZuuNq1+Q4Jz1+OywSy0oIF+VO7ZjDGQvi4=";
   };
 
   vendorHash = "sha256-bH7Y1y9BDMQJGtYfEaSrq+sWVLnovvV/uGbutJUXV2w=";
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index d19876d38926..16422945d960 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -27,13 +27,13 @@ let
     };
   };
 
-  version = "2025.2.1";
+  version = "2025.2.2";
 
   src = fetchFromGitHub {
     owner = "pretalx";
     repo = "pretalx";
     tag = "v${version}";
-    hash = "sha256-zjRtAy9Tpu5dGbpEteg+TMLgrYKSzK0wrGLQImubx7I=";
+    hash = "sha256-2qru52/ZALBAdRh0I+3VimVsiRl71YZgbSUD/LdoA/0=";
   };
 
   meta = {
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 0287b863ae2b..7a53ae82c1d0 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -82,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "beautifulsoup4"
+    "bleach"
     "celery"
     "css-inline"
     "django-bootstrap3"
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index be7157a37b93..7a05ec034c07 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.11.0";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-3MqMkef/oc6Fk2PHvdTMlH/lRU19Tru5uqs8yVThSdw=";
+    hash = "sha256-ViafZYAQCEfNJZpJgWVHG55+Ylkl3xndqT+zuNUDF04=";
   };
 
-  cargoHash = "sha256-JYsnrZsUrESOZQzVOkHLFDDtjDCzGva6mrFLSOiEUzw=";
+  cargoHash = "sha256-CaB6sobEw+Z/R/zjGNonVhIiuX676P/4SA6nwoWWA7g=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sa/safecloset/package.nix b/pkgs/by-name/sa/safecloset/package.nix
index 74a29750c4ae..60c45f766988 100644
--- a/pkgs/by-name/sa/safecloset/package.nix
+++ b/pkgs/by-name/sa/safecloset/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "safecloset";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "safecloset";
     rev = "v${version}";
-    hash = "sha256-pTfslMZmP8YzLzTru3b64qQ9qefkPzo9V8/S6eSQBgM=";
+    hash = "sha256-ZLAgSD03Qfoz+uGjVJF7vCkV1pUWqw6yG/9+redbQQ8=";
   };
 
-  cargoHash = "sha256-b0MD30IJRp06qkYsQsiEI7c4ArY3GCSIh8I16/4eom0=";
+  cargoHash = "sha256-BSWUWB8OrdmDtU+cGCVp75hakpdd9G3cs9ythDn4nnY=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     xorg.libxcb
diff --git a/pkgs/by-name/se/secrethound/package.nix b/pkgs/by-name/se/secrethound/package.nix
index 191a21aae457..bb7835df2731 100644
--- a/pkgs/by-name/se/secrethound/package.nix
+++ b/pkgs/by-name/se/secrethound/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "secrethound";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "rafabd1";
     repo = "SecretHound";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nXL7ly4W4MIXy3DcWeTPfP3t77M72EDxaqjQWwNu/TY=";
+    hash = "sha256-TyN7byX4rkRXrKzcx/u/LYNqVRBue2YNJRnkF+f34jQ=";
   };
 
   vendorHash = "sha256-oTyI3/+evDTzyH+BjfSP0A1r2bYVAMxtWRsg0G1d2zQ=";
diff --git a/pkgs/by-name/sh/sherpa/package.nix b/pkgs/by-name/sh/sherpa/package.nix
index 3367c42ec113..c05b4522f66c 100644
--- a/pkgs/by-name/sh/sherpa/package.nix
+++ b/pkgs/by-name/sh/sherpa/package.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
     gfortran
     cmake
     pkg-config
-    autoPatchelfHook
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   buildInputs = [
     libzip
@@ -41,9 +41,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  preFixup = ''
-    patchelf --add-rpath $out/lib/SHERPA-MC $out/bin/Sherpa
-  '';
+  preFixup =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool -add_rpath "$out"/lib/SHERPA-MC "$out"/bin/Sherpa
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --add-rpath "$out"/lib/SHERPA-MC "$out"/bin/Sherpa
+    '';
 
   meta = {
     description = "Monte Carlo event generator for the Simulation of High-Energy Reactions of PArticles";
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index 856dce4673cb..5ef4e17376cf 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "spicetify-cli";
-  version = "2.42.3";
+  version = "2.42.4";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gLVysXgQyodjyxXd81Rbduvr/xsaECioDHPgrpw8UiM=";
+    hash = "sha256-JOAw2GEHGr7eIIZtoAeKFqde1L7TidbyvRv1kAcUm2w=";
   };
 
   vendorHash = "sha256-DiVu/ePiZvn9+B/r8LS0qLt8eXKAtg4IXZ1WRzzAvcE=";
diff --git a/pkgs/by-name/ss/ssdfs-utils/package.nix b/pkgs/by-name/ss/ssdfs-utils/package.nix
index 0b3436066b80..50481524faf8 100644
--- a/pkgs/by-name/ss/ssdfs-utils/package.nix
+++ b/pkgs/by-name/ss/ssdfs-utils/package.nix
@@ -13,13 +13,13 @@ stdenv.mkDerivation {
   # as ssdfs-utils, not ssdfs-tools.
   pname = "ssdfs-utils";
   # The version is taken from `configure.ac`, there are no tags.
-  version = "4.64";
+  version = "4.65";
 
   src = fetchFromGitHub {
     owner = "dubeyko";
     repo = "ssdfs-tools";
-    rev = "46ef1ea7baa81fb009b4010700a9e00c39fb61a8";
-    hash = "sha256-ky0+UKqIF37tf0drNRvdi116VZsgUn2HedPeKuitHLg=";
+    rev = "256c3415a580c2bec37f98bdc6d972c10454d627";
+    hash = "sha256-HGT7hBzsbtlBud4zwWZHDrQqzA1lmnNMrCZy5oylBSQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 61a5800caaab..31fe69b8c7ac 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -14,13 +14,13 @@
 
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "16.4.1";
+  version = "16.5.0";
 
   src = fetchFromGitHub {
     owner = "johannesjo";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-d4mkIy+iFTM1fZxwUVLFgIIjen6+P/l4jsYeEP1kojc=";
+    hash = "sha256-FBquRpn+g5wOwvM62MqL7RZ41LXer0CskVN5+5mD9kM=";
 
     postFetch = ''
       find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -63,7 +63,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-lIkIxR/SfmbmBLEkhUZkTXSy6RIGcPVoNP8T2EgamEo=";
+      hash = "sha256-r0xlODXi4+C+Aat3e3goMIBvBordes/KVlsBG696ZWs=";
     }
   );
 
diff --git a/pkgs/by-name/te/terragrunt/package.nix b/pkgs/by-name/te/terragrunt/package.nix
index 898fbe1c3eed..293342cea560 100644
--- a/pkgs/by-name/te/terragrunt/package.nix
+++ b/pkgs/by-name/te/terragrunt/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "terragrunt";
-  version = "0.93.11";
+  version = "0.93.12";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "terragrunt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ff56GmIgi95BIRFUJ5KJGiqeioCfHY/ZseZ3Q4YzrtU=";
+    hash = "sha256-TiSjKr8A5mxUWgVnWjWB2sgPbqSjIJlf8DetYiuw8No=";
   };
 
   nativeBuildInputs = [
@@ -25,7 +25,7 @@ buildGo125Module (finalAttrs: {
     make generate-mocks
   '';
 
-  vendorHash = "sha256-SLRWtOBPa2jVWTHVYfjlEEfK+I/ZKA3ls/LLV5/oLfQ=";
+  vendorHash = "sha256-DkFqj52mdkJvjG5yceRH5GEKWHU73rOE6dJno/6N2k8=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ti/tinfoil-cli/package.nix b/pkgs/by-name/ti/tinfoil-cli/package.nix
index e13aeefcd4dc..70593b4430cc 100644
--- a/pkgs/by-name/ti/tinfoil-cli/package.nix
+++ b/pkgs/by-name/ti/tinfoil-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tinfoil-cli";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "tinfoilsh";
     repo = "tinfoil-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ei3noC/RXUCfwLHjiYZ/+M1vjn/9g1JhTI2A4O4DJZM=";
+    hash = "sha256-C5X1+spnhJgynG8vPgU/HMjDikPmm/xNZ/svVQHA9N4=";
   };
 
-  vendorHash = "sha256-S+aiL1nY57gOXgaNwFXUk9xfUpFOok8XHYKBtQKHmOc=";
+  vendorHash = "sha256-LdCwPXPPt7kxK8FvXN332ih9SMhUWyEfXq+7OLQ+Uv0=";
 
   # The attestation test requires internet access
   checkFlags = [ "-skip=TestAttestationVerifySEV" ];
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index 3f49e3c54867..4d33c0fff2a8 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "25.11.2";
+  version = "25.11.3";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-pwwtspFYDJAT6MAKzD7G3dI4JXtBDfsaPhe1YDFU0FsNkYhvObpvXfHIwzaRYKJT3Naam9KTLyGqmjgRdf3zag==";
-        x86_64-linux = "sha512-/+fGC4B303mW+HJ7uOzPrQLQtofZVdnQnry3Z5CcpyGJFm+4tGAdmcFHVgYV81flabeH105q+pcR3hJhTTb8Jg==";
+        aarch64-linux = "sha512-fY2X571p71HCtAFGcYxBwvrlb556hJSyBCNkyVJ6s+P3GuBlTqapSTuE/ZAyPraS9H/QMEVnZF+Qpzu/6hgiew==";
+        x86_64-linux = "sha512-00Nnc7xY3snP5gS5GzszgE3MVTNZ6jUiU43D68Pz4aYzgNaPn8JMuh3kC0ybxm4HaHnZ9EC4Eraa9U5gO8Mq3w==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/ts/tsidp/package.nix b/pkgs/by-name/ts/tsidp/package.nix
index 04bc37a65d86..6d590565b0f6 100644
--- a/pkgs/by-name/ts/tsidp/package.nix
+++ b/pkgs/by-name/ts/tsidp/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "tsidp";
-  version = "0.0.7";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tsidp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7VOTrIYwNnayjQ4s/dFIIUj58XG5LTRvdLXdGpeW0CY=";
+    hash = "sha256-ClN3aZ0mLmb4UPSW+oQSrKPar56wbHp+NXOzGA6GpCQ=";
   };
 
   vendorHash = "sha256-iBy+osK+2LdkTzXhrkSaB6nWpUCpr8VkxJTtcfVCFuw=";
diff --git a/pkgs/by-name/vi/virtiofsd/package.nix b/pkgs/by-name/vi/virtiofsd/package.nix
index 37421a78941e..a9bf7b47ca1e 100644
--- a/pkgs/by-name/vi/virtiofsd/package.nix
+++ b/pkgs/by-name/vi/virtiofsd/package.nix
@@ -5,16 +5,17 @@
   fetchFromGitLab,
   libcap_ng,
   libseccomp,
+  versionCheckHook,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "virtiofsd";
   version = "1.13.3";
 
   src = fetchFromGitLab {
     owner = "virtio-fs";
     repo = "virtiofsd";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-H8FjnrwB6IfZ7pVFesEWZkWpWjVYGrewlPRZc97Nlh8=";
   };
 
@@ -38,8 +39,14 @@ rustPlatform.buildRustPackage rec {
     install -Dm644 50-virtiofsd.json "$out/share/qemu/vhost-user/50-virtiofsd.json"
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   meta = with lib; {
     homepage = "https://gitlab.com/virtio-fs/virtiofsd";
+    changelog = "https://gitlab.com/virtio-fs/virtiofsd/-/releases/v${finalAttrs.version}";
     description = "vhost-user virtio-fs device backend written in Rust";
     maintainers = with maintainers; [
       qyliss
@@ -52,4 +59,4 @@ rustPlatform.buildRustPackage rec {
       bsd3
     ];
   };
-}
+})
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index 178ba48fd5e1..51c880afb30b 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "webdav";
-  version = "5.10.0";
+  version = "5.10.1";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${version}";
-    hash = "sha256-A8Gt3HWspV01AZC4mxj4i9+CnrMX0XcIvW5X4nnKvig=";
+    hash = "sha256-V4PNDtKyB0uoMY4ehWQUeTa1ZqIYAvL3Xm2rWw9zKTE=";
   };
 
-  vendorHash = "sha256-jBCtTBqHXY7786G+QOlU0BB3g+qmsGGOg96xSGv6hXI=";
+  vendorHash = "sha256-nrvL+glI4kVFUELege8q7z62AsvrLMw5JxigZkZ8kkY=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index f2625af2956f..3295df657819 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -65,6 +65,7 @@ python.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "certifi"
+    "django-appconf"
   ];
 
   dependencies =
diff --git a/pkgs/by-name/xn/xnviewmp/package.nix b/pkgs/by-name/xn/xnviewmp/package.nix
index 2e004a88dac2..895c6f39b58c 100644
--- a/pkgs/by-name/xn/xnviewmp/package.nix
+++ b/pkgs/by-name/xn/xnviewmp/package.nix
@@ -25,11 +25,11 @@ let
 in
 appimageTools.wrapType2 rec {
   pname = "xnviewmp";
-  version = "1.9.5";
+  version = "1.9.7";
 
   src = fetchurl {
     url = "https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${version}.glibc2.17-x86_64.AppImage";
-    hash = "sha256-flLFyl4c0+kaQyXXzCpK/uSQ4tvRBUEYSgC4wqf4QMw=";
+    hash = "sha256-PUV46AmzFBtBh361dS84rtZM5N7mKBG9aLkoyvz16R0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix b/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix
index 8b5a9d33da45..0c387ce96abb 100644
--- a/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix
@@ -43,13 +43,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-telephony-service";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-telephony-service";
     tag = finalAttrs.version;
-    hash = "sha256-7WKKRUEEF3NL8S1xg8E1WcD3dGasrw49pydeC4CyL+c=";
+    hash = "sha256-CNtJPMust7zCuoXw/CpaK4NVXijTXA3Xs4YMJiZyxes=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/beam-modules/ex_doc/default.nix b/pkgs/development/beam-modules/ex_doc/default.nix
index 3d1f5a0e6320..ee6733e38581 100644
--- a/pkgs/development/beam-modules/ex_doc/default.nix
+++ b/pkgs/development/beam-modules/ex_doc/default.nix
@@ -14,12 +14,12 @@
 
 let
   pname = "ex_doc";
-  version = "0.39.1";
+  version = "0.39.2";
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-edK484d5Fn5Kb/UEV1g3XinFF1rQJ1DypLEueET//Bg=";
+    hash = "sha256-khQIYS7iHOODlLMwFYPJTVE0MNia/gwYcin9ITpwttY=";
   };
 in
 mixRelease {
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 93a1d4eb5cf3..bfe11cb0b835 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -234,4 +234,9 @@ optionals noSysDirs (
     url = "https://inbox.sourceware.org/gcc-patches/20250926170154.2222977-1-corngood@gmail.com/raw";
     hash = "sha256-mgzMRvgPdhj+Q2VRsFhpE2WQzg0CvWsc5/FRAsSU1Es=";
   })
+  (fetchpatch {
+    name = "cygwin-use-builtin_define_std-for-unix.patch";
+    url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-3-corngood@gmail.com/raw";
+    hash = "sha256-8I2G4430gkYoWgUued4unqhk8ZCajHf1dcivAeuLZ0E=";
+  })
 ]
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index b66dcc37c0a1..528ce1697b48 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -32,7 +32,7 @@
   emacs,
   ffmpeg,
   haskellPackages,
-  knot-resolver,
+  knot-resolver_5,
   ngtcp2-gnutls,
   ocamlPackages,
   pkgsStatic,
@@ -203,7 +203,7 @@ stdenv.mkDerivation rec {
       ffmpeg
       emacs
       qemu
-      knot-resolver
+      knot-resolver_5
       samba
       openconnect
       ;
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index 46ecec7c2901..0eaf22962740 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -135,7 +135,7 @@ assert lib.assertMsg (invalidPlugins == [ ])
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-rs";
-  version = "0.14.2";
+  version = "0.14.4";
 
   outputs = [
     "out"
@@ -147,13 +147,13 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gstreamer";
     repo = "gst-plugins-rs";
     rev = finalAttrs.version;
-    hash = "sha256-mIq8Fo6KoxAo1cL2NQHnSMPgzUWl1eNJUujdaerGjFA=";
+    hash = "sha256-MZyYHMq6gFJkVxlrmeXUjOmRYsQBHj0848cnF+7mtbU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "gst-plugins-rs-${finalAttrs.version}";
-    hash = "sha256-Z1mqpVL2SES1v0flykOwoDX2/apZHxg7eI5If4BsP4o=";
+    hash = "sha256-T+fdu+Oe07Uf1YoRGYl2DMb1QgdSZVLwcOqH4bBNGXU=";
   };
 
   strictDeps = true;
@@ -227,6 +227,10 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_CACHE_HOME=$(mktemp -d)
   '';
 
+  postInstall = ''
+    install -Dm444 -t ''${!outputDev}/lib/pkgconfig gst*.pc
+  '';
+
   doInstallCheck =
     (lib.elem "webp" selectedPlugins) && !stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isElf;
   installCheckPhase = ''
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index d7f9a42511ad..32040cd5dd15 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -39,6 +39,8 @@
 assert (securityLevel == null) || (securityLevel >= 0 && securityLevel <= 5);
 
 let
+  useBinaryWrapper = !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isCygwin);
+
   common =
     {
       version,
@@ -98,7 +100,10 @@ let
           (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
           ''
             rm test/recipes/02-test_errstr.t
-          '';
+          ''
+      + lib.optionalString stdenv.hostPlatform.isCygwin ''
+        rm test/recipes/01-test_symbol_presence.t
+      '';
 
       outputs = [
         "bin"
@@ -121,7 +126,7 @@ let
         && stdenv.cc.isGNU;
 
       nativeBuildInputs =
-        lib.optional (!stdenv.hostPlatform.isWindows) makeBinaryWrapper
+        lib.optional useBinaryWrapper makeBinaryWrapper
         ++ [ perl ]
         ++ lib.optionals static [ removeReferencesTo ];
       buildInputs = lib.optional withCryptodev cryptodev ++ lib.optional withZlib zlib;
@@ -175,6 +180,8 @@ let
               "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
           else if stdenv.hostPlatform.isiOS then
             "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
+          else if stdenv.hostPlatform.isCygwin then
+            "./Configure Cygwin-${stdenv.hostPlatform.linuxArch}"
           else
             throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}"
         );
@@ -290,7 +297,7 @@ let
 
         ''
         +
-          lib.optionalString (!stdenv.hostPlatform.isWindows)
+          lib.optionalString useBinaryWrapper
             # makeWrapper is broken for windows cross (https://github.com/NixOS/nixpkgs/issues/120726)
             ''
               # c_rehash is a legacy perl script with the same functionality
@@ -439,7 +446,11 @@ in
       (
         if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch
       )
-    ];
+    ]
+    ++
+      # https://cygwin.com/cgit/cygwin-packages/openssl/plain/openssl-3.0.18-skip-dllmain-detach.patch?id=219272d762128451822755e80a61db5557428598
+      # and also https://github.com/openssl/openssl/pull/29321
+      lib.optional stdenv.hostPlatform.isCygwin ./openssl-3.0.18-skip-dllmain-detach.patch;
 
     withDocs = true;
 
@@ -471,7 +482,11 @@ in
     ]
     ++ lib.optionals stdenv.hostPlatform.isMinGW [
       ./3.5/fix-mingw-linking.patch
-    ];
+    ]
+    ++
+      # https://cygwin.com/cgit/cygwin-packages/openssl/plain/openssl-3.0.18-skip-dllmain-detach.patch?id=219272d762128451822755e80a61db5557428598
+      # and also https://github.com/openssl/openssl/pull/29321
+      lib.optional stdenv.hostPlatform.isCygwin ./openssl-3.0.18-skip-dllmain-detach.patch;
 
     withDocs = true;
 
diff --git a/pkgs/development/libraries/openssl/openssl-3.0.18-skip-dllmain-detach.patch b/pkgs/development/libraries/openssl/openssl-3.0.18-skip-dllmain-detach.patch
new file mode 100644
index 000000000000..254fb1b30d44
--- /dev/null
+++ b/pkgs/development/libraries/openssl/openssl-3.0.18-skip-dllmain-detach.patch
@@ -0,0 +1,24 @@
+--- origsrc/crypto/dllmain.c
++++ src/crypto/dllmain.c
+@@ -35,7 +35,9 @@
+     case DLL_THREAD_ATTACH:
+         break;
+     case DLL_THREAD_DETACH:
++# ifndef __CYGWIN__
+         OPENSSL_thread_stop();
++# endif
+         break;
+     case DLL_PROCESS_DETACH:
+         break;
+--- origsrc/providers/fips/self_test.c
++++ src/providers/fips/self_test.c
+@@ -95,7 +95,9 @@
+         init();
+         break;
+     case DLL_PROCESS_DETACH:
++# ifndef __CYGWIN__
+         cleanup();
++# endif
+         break;
+     default:
+         break;
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index c0aafbb9fbc1..66c782e212e0 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -43,12 +43,17 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-mpOyt9/ax3zrpaVYpYDnRmfdb+3kWFuR7vtg8Dty3yM=";
     };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace configure \
-      --replace '/usr/bin/libtool' '${stdenv.cc.targetPrefix}ar' \
-      --replace 'AR="libtool"' 'AR="${stdenv.cc.targetPrefix}ar"' \
-      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
-  '';
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace configure \
+        --replace '/usr/bin/libtool' '${stdenv.cc.targetPrefix}ar' \
+        --replace 'AR="libtool"' 'AR="${stdenv.cc.targetPrefix}ar"' \
+        --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+    ''
+    + lib.optionalString stdenv.hostPlatform.isCygwin ''
+      substituteInPlace win32/zlib.def \
+        --replace-fail 'gzopen_w' ""
+    '';
 
   strictDeps = true;
   outputs = [
@@ -59,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   setOutputFlags = false;
   outputDoc = "dev"; # single tiny man3 page
 
-  dontConfigure = stdenv.hostPlatform.isMinGW;
+  dontConfigure = (stdenv.hostPlatform.isMinGW || stdenv.hostPlatform.isCygwin);
 
   preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     export CHOST=${stdenv.hostPlatform.config}
@@ -112,7 +117,9 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
       # As zlib takes part in the stdenv building, we don't want references
       # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-      NIX_CFLAGS_COMPILE = "-static-libgcc";
+      NIX_CFLAGS_COMPILE = toString (
+        [ "-static-libgcc" ] ++ lib.optional stdenv.hostPlatform.isCygwin "-DHAVE_UNISTD_H"
+      );
     }
     // lib.optionalAttrs (stdenv.hostPlatform.linker == "lld") {
       # lld 16 enables --no-undefined-version by default
@@ -126,7 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontStrip = stdenv.hostPlatform != stdenv.buildPlatform && static;
   configurePlatforms = [ ];
 
-  installFlags = lib.optionals stdenv.hostPlatform.isMinGW [
+  installFlags = lib.optionals (stdenv.hostPlatform.isMinGW || stdenv.hostPlatform.isCygwin) [
     "BINARY_PATH=$(out)/bin"
     "INCLUDE_PATH=$(dev)/include"
     "LIBRARY_PATH=$(out)/lib"
@@ -138,10 +145,14 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "PREFIX=${stdenv.cc.targetPrefix}"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isMinGW [
+  ++ lib.optionals (stdenv.hostPlatform.isMinGW || stdenv.hostPlatform.isCygwin) [
     "-f"
     "win32/Makefile.gcc"
   ]
+  ++ lib.optionals stdenv.hostPlatform.isCygwin [
+    "SHAREDLIB=cygz.dll"
+    "IMPLIB=libz.dll.a"
+  ]
   ++ lib.optionals shared [
     # Note that as of writing (zlib 1.2.11), this flag only has an effect
     # for Windows as it is specific to `win32/Makefile.gcc`.
diff --git a/pkgs/development/ocaml-modules/ocaml-syntax-shims/default.nix b/pkgs/development/ocaml-modules/ocaml-syntax-shims/default.nix
index e3539194e111..00dc61f326af 100644
--- a/pkgs/development/ocaml-modules/ocaml-syntax-shims/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-syntax-shims/default.nix
@@ -4,26 +4,22 @@
   fetchurl,
 }:
 
-buildDunePackage rec {
-  minimumOCamlVersion = "4.02.3";
-
+buildDunePackage (finalAttrs: {
   pname = "ocaml-syntax-shims";
   version = "1.0.0";
 
   src = fetchurl {
-    url = "https://github.com/ocaml-ppx/${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "1j7848khli4p7j8i2kmnvhdnhcwhy3zgdpf5ds5ic30ax69y3cl9";
+    url = "https://github.com/ocaml-ppx/ocaml-syntax-shims/releases/download/${finalAttrs.version}/ocaml-syntax-shims-${finalAttrs.version}.tbz";
+    hash = "sha256-ibLhk+kKDBaLbsXd9v7wkDNoG9y2ThGRPJdECici6Mg=";
   };
 
-  useDune2 = true;
-
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/ocaml-ppx/ocaml-syntax-shims";
     description = "Backport new syntax to older OCaml versions";
     mainProgram = "ocaml-syntax-shims";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sternenseemann ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/authlib/default.nix b/pkgs/development/python-modules/authlib/default.nix
index fd6cebfe657c..ecd33ab50f7a 100644
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -11,6 +11,7 @@
   mock,
   pytest-asyncio,
   pytestCheckHook,
+  python-multipart,
   pythonOlder,
   requests,
   setuptools,
@@ -20,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "authlib";
-  version = "1.6.3";
+  version = "1.6.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +30,7 @@ buildPythonPackage rec {
     owner = "lepture";
     repo = "authlib";
     tag = "v${version}";
-    hash = "sha256-AzIjfUH89tYZwVnOpdSwEzaGNpedfQ50k9diKUfH+Fg=";
+    hash = "sha256-lz2cPqag6lZ9PXb3O/SV4buIPDDzhI71/teqWHLG+vE=";
   };
 
   build-system = [ setuptools ];
@@ -46,6 +47,7 @@ buildPythonPackage rec {
     mock
     pytest-asyncio
     pytestCheckHook
+    python-multipart
     requests
     starlette
     werkzeug
diff --git a/pkgs/development/python-modules/azure-servicebus/default.nix b/pkgs/development/python-modules/azure-servicebus/default.nix
index 61075e86b880..57bd7fff1ceb 100644
--- a/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/pkgs/development/python-modules/azure-servicebus/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-servicebus";
-  version = "7.14.2";
+  version = "7.14.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_servicebus";
     inherit version;
-    hash = "sha256-QBS3rIguDZ/4dqMwKBhgfhpkC5Pp1IIHPWOfWwQmblw=";
+    hash = "sha256-cKYzhFV67AvucndA57Jd7Snp5wG3dhF2RXf9dAI4lAI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 92f82f16877d..14f5d0a0458b 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "cvxpy";
-  version = "1.7.4";
+  version = "1.7.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${version}";
-    hash = "sha256-z/3ErQbYxO4OiJv2AgtuRqtf4zOu/UZxrIcREdG43Hw=";
+    hash = "sha256-ze9znWob/Asba20AVpNeVCuz7UayiYeW40nc7eZlXHU=";
   };
 
   postPatch =
@@ -94,6 +94,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/cvxpy/cvxpy//releases";
     changelog = "https://github.com/cvxpy/cvxpy/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/django-appconf/default.nix b/pkgs/development/python-modules/django-appconf/default.nix
index 8812b5dd5333..d760900fae4b 100644
--- a/pkgs/development/python-modules/django-appconf/default.nix
+++ b/pkgs/development/python-modules/django-appconf/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-appconf";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "django-compressor";
     repo = "django-appconf";
     tag = "v${version}";
-    hash = "sha256-raK3Q+6cDSOiK5vrgZG65qDUiFOrRhDKxsPOQv/lz8w=";
+    hash = "sha256-kpytEpvibnumkQGfHBDKA0GzSB0R8o0g0f51Rv6KEhA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-otp/default.nix b/pkgs/development/python-modules/django-otp/default.nix
index 907e3180d0f0..5702ea88d7c8 100644
--- a/pkgs/development/python-modules/django-otp/default.nix
+++ b/pkgs/development/python-modules/django-otp/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-otp";
-  version = "1.6.1";
+  version = "1.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-otp";
     repo = "django-otp";
     tag = "v${version}";
-    hash = "sha256-//i2KSsrkofcNE2JUlIG9zPCe/cIzBo/zmueC4I5g7I=";
+    hash = "sha256-sYwt41YWQQN6nKXGmrrZ75t/i1XNVjIgRKVElVaCGRc=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/hiredis/default.nix b/pkgs/development/python-modules/hiredis/default.nix
index a36fc0735ca3..e6bc6c169a1e 100644
--- a/pkgs/development/python-modules/hiredis/default.nix
+++ b/pkgs/development/python-modules/hiredis/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "hiredis";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     repo = "hiredis-py";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-WaHjqp/18FquYU2H9ftPQSyunLMG29FVpu3maB3/0bs=";
+    hash = "sha256-9KIbXmEk4K2xdGM7SUV64mcSEPGQdDez9mAb/920gZs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 1e4ad9a1c146..d0d71f3aa2dc 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202512041";
+  version = "0.1.202512051";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-x5UMJPwLrkx96k4q0x+4jsDblHG0nGsuIju6JDV4FLQ=";
+    hash = "sha256-8Hhf84VpZd5HASr80gaeSSZ5QGk5YlEggkR29PEzSmE=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/jupyterlab-server/default.nix b/pkgs/development/python-modules/jupyterlab-server/default.nix
index f21a7add8327..1d229c637587 100644
--- a/pkgs/development/python-modules/jupyterlab-server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-server/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab-server";
-  version = "2.27.3";
+  version = "2.28.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jupyterlab_server";
     inherit version;
-    hash = "sha256-6zbKylnnRHGYjwriXHeUVhC4h/d3JVqiH4Bl3vnlHtQ=";
+    hash = "sha256-NbqoGJixX5NXPi3spQ0RrArkB+u2iCmdOlITJlAzcSw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/kernels/default.nix b/pkgs/development/python-modules/kernels/default.nix
index 1d3bb26a713f..a371684c6321 100644
--- a/pkgs/development/python-modules/kernels/default.nix
+++ b/pkgs/development/python-modules/kernels/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "kernels";
-  version = "0.11.1";
+  version = "0.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "kernels";
     tag = "v${version}";
-    hash = "sha256-ITrriB3G7tuNaGSMDB2o+RqQO7TKerq9F02u1DtzhmM=";
+    hash = "sha256-fEi7yiLv0a28SefOcF8so9CpNuTinBfrTbEAwwPlKiw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix b/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
index 88523d744a7e..715ee093c246 100644
--- a/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
+++ b/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
@@ -16,14 +16,14 @@
 }:
 buildPythonPackage rec {
   pname = "mkdocs-awesome-nav";
-  version = "3.2.0";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lukasgeiter";
     repo = "mkdocs-awesome-nav";
     tag = "v${version}";
-    hash = "sha256-JeVOJl26ooAZ2xbmyOqSKRa/5Dbu5BXov3ZS6sXgnnU=";
+    hash = "sha256-guv+c4QwaATYEZ6XcWVZaOcZ7U9oLsW+RdWBtB1Xrnc=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index b71a9397020e..699079c67bd1 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "6.3.0";
+  version = "6.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-0cch0Je5se1FeHSXH78WhDpNiJQ3Qt0wqxRnv9lr8Qo=";
+    hash = "sha256-QCMOB0qnxVPo8fGcf+TsEcBYYINXVbDCowrLUqNjojw=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index dbefc1929ba4..3aa5f56cbf25 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -5,7 +5,6 @@
   flask,
   logmatic-python,
   pytestCheckHook,
-  pythonOlder,
   pyyaml,
   requests,
   setuptools,
@@ -14,16 +13,14 @@
 
 buildPythonPackage rec {
   pname = "reconplogger";
-  version = "4.18.0";
+  version = "4.18.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "omni-us";
     repo = "reconplogger";
     tag = "v${version}";
-    hash = "sha256-awUGDE9yuPhWMZ4osCJKw8v5V1leoFF3DeCbluHeN70=";
+    hash = "sha256-kYNidF1sTC6WulX3HXMUm+TFJWvHgZj86Asmi6uIKRs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 632874fb19e1..ef30ac23095e 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.17.0";
+  version = "0.17.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = version;
-    hash = "sha256-XJ5Ec3f4OCVsi7WFLxAi3kemC87yRw4gGmgHyGLeHiY=";
+    hash = "sha256-tAanxijwWCKzxkMXsIGtbb7lLhGDog5k5MS8m9I6Hnc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rjsmin/default.nix b/pkgs/development/python-modules/rjsmin/default.nix
index 910994134f0c..1395bb481aae 100644
--- a/pkgs/development/python-modules/rjsmin/default.nix
+++ b/pkgs/development/python-modules/rjsmin/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "rjsmin";
-  version = "1.2.4";
+  version = "1.2.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/8vgTg36w5zqj7vLQcOLLgcjXOIYi8oV6ZjaHTSKeGA=";
+    hash = "sha256-o/gECwJz3sdz4OgH6GpNCpU1UWwKCjWqG7bebhW7Hwk=";
   };
 
   # The package does not ship tests, and the setup machinery confuses
diff --git a/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix b/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix
index 3cd42a0b9ebb..8c8679f3a17a 100644
--- a/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix
@@ -9,13 +9,13 @@
 }:
 buildPythonPackage rec {
   pname = "sphinxcontrib-mermaid";
-  version = "1.0.0";
+  version = "1.2.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "sphinxcontrib_mermaid";
-    hash = "sha256-Loq2fT4eKBZmP5NH0Cao3uSoWKzdStMt0cgIiT24gUY=";
+    hash = "sha256-NYaZ0OySTvZ5tBhz2e3ZfQdzRG2vl2DHXhjcCt/ZE3E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/stable-baselines3/default.nix b/pkgs/development/python-modules/stable-baselines3/default.nix
index 05718c482729..c6a81f6be253 100644
--- a/pkgs/development/python-modules/stable-baselines3/default.nix
+++ b/pkgs/development/python-modules/stable-baselines3/default.nix
@@ -22,14 +22,14 @@
 }:
 buildPythonPackage rec {
   pname = "stable-baselines3";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DLR-RM";
     repo = "stable-baselines3";
     tag = "v${version}";
-    hash = "sha256-Ms2qoq1fokhUQ1/Wus786oYPT6C2lnHOZ+D7E7qUbjI=";
+    hash = "sha256-ucfdXyOYgevrKQ+RQbuoLjhGEvlzwH80yognMNbJlgQ=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ef899db4737a..191d3a343cc0 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.6";
+  version = "3.1.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-ZBufZVFriwe1upgzu5Eg1cq0hkVvdWeCZ7HYNaVBFes=";
+    hash = "sha256-3+FZjR9qVz6BSHmyaXiMVmgzIclpipEr9u7kSQsEQ1A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/cygwin/w32api/default.nix b/pkgs/os-specific/cygwin/w32api/default.nix
index c8dd0cb670c1..bee269007663 100644
--- a/pkgs/os-specific/cygwin/w32api/default.nix
+++ b/pkgs/os-specific/cygwin/w32api/default.nix
@@ -32,8 +32,6 @@
     };
 
     meta = {
-      # Marked broken 2025-11-28 because it has failed on Hydra for at least one year.
-      broken = true;
       description = "MinGW w32api package for Cygwin";
       inherit (windows.mingw_w64_headers.meta)
         homepage
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index eab96764ebc4..97546a17ef2d 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.0.26";
+  version = "2.0.27";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-eIPZhSft0myWkJgv20Ryt9XMMKKYgJunDZYwl4D2l3I=";
+    hash = "sha256-EUihU3qH4IyUoOZdLTne7/iK5AFwIJNoGu69gig+WHw=";
   };
 
-  npmDepsHash = "sha256-seCHRwf0VSYEZN6CAsXZoj0KQPUCMWTU9pB6Bez76uk=";
+  npmDepsHash = "sha256-qIckMQ2d65vCU9Yx+vFzTTWLJjjtlpQg1h12wiDimqA=";
 
   postPatch = ''
     # Remove git dependency from rspack config
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
index fc24d6bccf59..30312d05fdba 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
@@ -21,6 +21,10 @@
   version,
 
   embeddedSandboxShell ? stdenv.hostPlatform.isStatic,
+
+  withAWS ?
+    # Default is this way because there have been issues building this dependency
+    stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin),
 }:
 
 mkMesonLibrary (finalAttrs: {
@@ -39,7 +43,7 @@ mkMesonLibrary (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
   # There have been issues building these dependencies
   ++
-    lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))
+    lib.optional withAWS
       # Nix >=2.33 doesn't depend on aws-sdk-cpp and only requires aws-crt-cpp for authenticated s3:// requests.
       (if lib.versionAtLeast (lib.versions.majorMinor version) "2.33" then aws-crt-cpp else aws-sdk-cpp);
 
@@ -52,6 +56,9 @@ mkMesonLibrary (finalAttrs: {
     (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
     (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
   ]
+  ++ lib.optional (lib.versionAtLeast (lib.versions.majorMinor version) "2.33") (
+    lib.mesonEnable "s3-aws-auth" withAWS
+  )
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
   ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6b1ffb6a7324..62fd46aed46c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -781,6 +781,7 @@ mapAliases {
   kgx = throw "'kgx' has been renamed to/replaced by 'gnome-console'"; # Converted to throw 2025-10-27
   khoj = throw "khoj has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-11
   kmplayer = throw "'kmplayer' has been removed, as it is unmaintained upstream"; # Added 2025-08-30
+  knot-resolver = warnAlias "'knot-resolver' is currently aliased to 'knot-resolver_5'. This will change with the knot-resolver 6 being declared as stable. Please explicitly use the 'knot-resolver_5' or 'knot-resolver_6' package until then." knot-resolver_5; # Added 2025-11-30
   kodiGBM = throw "'kodiGBM' has been renamed to/replaced by 'kodi-gbm'"; # Converted to throw 2025-10-27
   kodiPlain = throw "'kodiPlain' has been renamed to/replaced by 'kodi'"; # Converted to throw 2025-10-27
   kodiPlainWayland = throw "'kodiPlainWayland' has been renamed to/replaced by 'kodi-wayland'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cad718c0f0b2..9ada14df5ee8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9216,10 +9216,6 @@ with pkgs;
     kanidmWithSecretProvisioning_1_8
     ;
 
-  knot-resolver = callPackage ../servers/dns/knot-resolver {
-    systemd = systemdMinimal; # in closure already anyway
-  };
-
   leafnode = callPackage ../servers/news/leafnode { };
 
   leafnode1 = callPackage ../servers/news/leafnode/1.nix { };