diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 20b38af93d1e..afbe6cc83221 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3918,6 +3918,12 @@
     githubId = 15181236;
     keys = [ { fingerprint = "AE1E 3B80 7727 C974 B972  AB3C C324 01C3 BF52 1179"; } ];
   };
+  bridgesense = {
+    name = "Saad Nadeem";
+    email = "saad29nadeem@gmail.com";
+    github = "BridgeSenseDev";
+    githubId = 88615188;
+  };
   britter = {
     name = "Benedikt Ritter";
     email = "beneritter@gmail.com";
@@ -6484,6 +6490,11 @@
       }
     ];
   };
+  Dev380 = {
+    name = "Dev380";
+    github = "Dev380";
+    githubId = 49997896;
+  };
   developer-guy = {
     name = "Batuhan Apaydın";
     email = "developerguyn@gmail.com";
@@ -10991,6 +11002,13 @@
     githubId = 1550265;
     name = "Dominic Steinitz";
   };
+  iedame = {
+    name = "Rafael Ieda";
+    github = "iedame";
+    githubId = 60272;
+    email = "git@ieda.me";
+    matrix = "@ieda:matrix.org";
+  };
   if-loop69420 = {
     github = "if-loop69420";
     githubId = 81078181;
@@ -29196,6 +29214,9 @@
       {
         fingerprint = "4E67 A4AC 2FA4 2A28 DB40  1FC8 F9FB 19F1 C1DC 9C23";
       }
+      {
+        fingerprint = "42EF 09B8 31E1 7646 8BFE  CAD8 E922 D634 9DB9 F861";
+      }
     ];
   };
   Zaechus = {
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 5dd832354fef..5d6ad24461d4 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1489,6 +1489,9 @@
   "module-services-postgres-upstream-deviation": [
     "index.html#module-services-postgres-upstream-deviation"
   ],
+  "module-services-postgresql-target-vs-service": [
+    "index.html#module-services-postgresql-target-vs-service"
+  ],
   "module-services-foundationdb": [
     "index.html#module-services-foundationdb"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index caf131313bf5..9d4f926dc718 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -22,6 +22,8 @@
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
 
+- [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)
+
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).
 
 - [dms-greeter](https://danklinux.com), a modern display manager greeter for DankMaterialShell that works with greetd and supports multiple Wayland compositors. Available as [services.displayManager.dms-greeter](#opt-services.displayManager.dms-greeter.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index bb4e5343cc50..62af18754cb5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1532,6 +1532,7 @@
   ./services/system/localtimed.nix
   ./services/system/nix-daemon-firewall.nix
   ./services/system/nix-daemon.nix
+  ./services/system/nohang.nix
   ./services/system/nscd.nix
   ./services/system/nvme-rs.nix
   ./services/system/saslauthd.nix
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index d90c503eeab7..5db44d8953ad 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -485,6 +485,35 @@ with hardening, it's considered a bug.
 When using extensions that are not packaged in `nixpkgs`, hardening adjustments may
 become necessary.
 
+## `postgresql.service` vs `postgresql.target` {#module-services-postgresql-target-vs-service}
+
+In order to delay a service's startup until the local PostgreSQL instance is up, one usually uses a combination of `wants`/`after`, i.e.
+
+```nix
+{
+  systemd.services.myservice = {
+    wants = [ "postgresql.target" ];
+    after = [ "postgresql.target" ];
+  };
+}
+```
+
+::: {.note}
+`wants` makes sure that `postgresql.target` is being started when `myservice.service` is started.
+If it's necessary to restart `myservice` when `postgresql.target` gets restarted and `myservice.service` fails to start if `postgresql.service` fails to start, use `requires` instead.
+
+See also {manpage}`systemd.unit(5)`.
+:::
+
+It's also possible to wait for `postgresql.service` instead, however that has a slightly different meaning:
+
+* `postgresql.service` is `active` if the database is __at least__ in read-only mode.
+* `postgresql.target` is `active` if the database is either in __read-write__ mode or a standby server.
+
+This is implemented by making `postgresql.target` wait for `postgresql-setup.service` which waits for the database to be fully up and applies the changes necessary for `ensureUsers`.
+
+Restarting `postgresql.service` by hand also triggers a restart of `postgresql.target`.
+
 ## Notable differences to upstream {#module-services-postgres-upstream-deviation}
 
 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 6e1b83f8d1d3..b979cdd657ba 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -100,7 +100,8 @@ in
     maxAttachmentSize = lib.mkOption {
       type = lib.types.int;
       default = 18;
-      apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.37)}M";
+      apply =
+        configuredMaxAttachmentSize: "${toString (builtins.ceil (configuredMaxAttachmentSize * 1.37))}M";
       description = ''
         The maximum attachment size in MB.
         [upstream issue comment]: https://github.com/roundcube/roundcubemail/issues/7979#issuecomment-808879209
diff --git a/nixos/modules/services/system/nohang.nix b/nixos/modules/services/system/nohang.nix
new file mode 100644
index 000000000000..abc8d00f90e7
--- /dev/null
+++ b/nixos/modules/services/system/nohang.nix
@@ -0,0 +1,113 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nohang;
+
+  inherit (lib)
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+
+  options.services.nohang = {
+    enable = mkEnableOption "nohang, a daemon that keeps system responsiveness when Linux is out of memory";
+
+    package = mkPackageOption pkgs "nohang" { };
+
+    configPath = mkOption {
+      type = types.either (types.enum [
+        "basic"
+        "desktop"
+      ]) types.path;
+      default = "desktop";
+      example = literalExpression "./my-nohang-config.conf";
+      description = ''
+        Configuration file to use with nohang. The default and desktop example configurations in the nohang repository
+        can be used by setting this to "basic" or "desktop" (which is the default). Otherwise, you can set it to the path
+        of a custom configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.nohang = {
+      description = "Sophisticated low memory handler";
+      documentation = [
+        "man:nohang(8)"
+        "https://github.com/hakavlad/nohang"
+      ];
+      after = [ "sysinit.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart =
+          "${lib.getExe cfg.package} --monitor --config "
+          + (
+            if cfg.configPath == "basic" then
+              "${cfg.package}/etc/nohang/nohang.conf"
+            else if cfg.configPath == "desktop" then
+              "${cfg.package}/etc/nohang/nohang-desktop.conf"
+            else
+              cfg.configPath
+          );
+        Slice = "hostcritical.slice";
+        SyslogIdentifier =
+          if cfg.configPath == "basic" then
+            "nohang"
+          else if cfg.configPath == "desktop" then
+            "nohang-desktop"
+          else
+            "nohang-custom-config";
+        KillMode = "mixed";
+        Restart = "always";
+        RestartSec = 0;
+
+        CPUSchedulingResetOnFork = true;
+        RestrictRealtime = "yes";
+
+        TasksMax = 25;
+        MemoryMax = "100M";
+        MemorySwapMax = "100M";
+
+        UMask = 27;
+        ProtectSystem = "strict";
+        ReadWritePaths = "/var/log";
+        InaccessiblePaths = "/home /root";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        MemoryDenyWriteExecute = "yes";
+        RestrictNamespaces = "yes";
+        LockPersonality = "yes";
+        PrivateTmp = true;
+        DeviceAllow = "/dev/kmsg rw";
+        DevicePolicy = "closed";
+
+        CapabilityBoundingSet = [
+          "CAP_KILL"
+          "CAP_IPC_LOCK"
+          "CAP_SYS_PTRACE"
+          "CAP_DAC_READ_SEARCH"
+          "CAP_DAC_OVERRIDE"
+          "CAP_AUDIT_WRITE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_SYS_RESOURCE"
+          "CAP_SYSLOG"
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index bbb72047c109..4edc8777cf16 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1105,6 +1105,7 @@ in
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
   node-red = runTest ./node-red.nix;
+  nohang = runTest ./nohang.nix;
   nomad = runTest ./nomad.nix;
   nominatim = runTest ./nominatim.nix;
   non-default-filesystems = handleTest ./non-default-filesystems.nix { };
diff --git a/nixos/tests/nohang.nix b/nixos/tests/nohang.nix
new file mode 100644
index 000000000000..8b7c4ec0ca15
--- /dev/null
+++ b/nixos/tests/nohang.nix
@@ -0,0 +1,56 @@
+# The following was modified from ./earlyoom.nix
+{ lib, pkgs, ... }:
+{
+  name = "nohang";
+  meta = {
+    maintainers = with lib.maintainers; [
+      Dev380
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Limit VM resource usage.
+      virtualisation.memorySize = 1024;
+
+      services.nohang.enable = true;
+      # disable other oom killers just in case
+      systemd.oomd.enable = false;
+
+      systemd.services.testbloat = {
+        description = "Create a lot of memory pressure";
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pkgs.coreutils "tail"} /dev/zero";
+        };
+      };
+    };
+
+  # SIGTERM may be given so tail /dev/zero may or may not succeed
+  # The output will have have something like "Sending SIGTERM to /nix/store/87fc"
+  # with the truncated path so we'll check for that in the test
+  testScript = ''
+    machine.wait_for_unit("nohang.service")
+
+    with subtest("nohang should kill the bad service"):
+        machine.execute("systemctl start --wait testbloat.service")
+        signal_type = None
+        match machine.get_unit_info("testbloat.service")["Result"]:
+          case "signal":
+            signal_type = "SIGKILL"
+          case "success":
+            signal_type = "SIGTERM"
+        output = machine.succeed('journalctl -u nohang.service -b0')
+
+        if not f'[ OK ] Sending {signal_type}' in output:
+          raise Exception(f"'[ OK ] Sending {signal_type}' not in output")
+        if not 'The victim' in output:
+          raise Exception("'The victim' not in output")
+        if not 'Memory status after implementing a corrective action:' in output:
+          raise Exception("'Memory status after implementing a corrective action:' not in output")
+        if not 'FINISHING implement_corrective_action()' in output:
+          raise Exception("'FINISHING implement_corrective_action()' not in output")
+        if not f"{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1" in output:
+          raise Exception(f"'{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1' not in output")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 3628d4089aad..7a366a6f796a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -945,6 +945,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  artio-nvim = buildVimPlugin {
+    pname = "artio.nvim";
+    version = "2025-12-28";
+    src = fetchFromGitHub {
+      owner = "comfysage";
+      repo = "artio.nvim";
+      rev = "83909f659c1da7cf8403c31a051f0ccb64c4c636";
+      hash = "sha256-22CIZrIWI8ZjXPnDtdpCzbPmV/EI7z/YFrbGzoogjGA=";
+    };
+    meta.homepage = "https://github.com/comfysage/artio.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   astrocore = buildVimPlugin {
     pname = "astrocore";
     version = "2.0.5-unstable-2025-06-06";
@@ -6974,6 +6987,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  iswap-nvim = buildVimPlugin {
+    pname = "iswap.nvim";
+    version = "0-unstable-2024-05-23";
+    src = fetchFromGitHub {
+      owner = "mizlan";
+      repo = "iswap.nvim";
+      rev = "e02cc91f2a8feb5c5a595767d208c54b6e3258ec";
+      hash = "sha256-lAYHvz23f9nJ6rb0NIm+1aq0Vr0SwjPVitPuROtUS2A=";
+    };
+    meta.homepage = "https://github.com/mizlan/iswap.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   jdaddy-vim = buildVimPlugin {
     pname = "jdaddy.vim";
     version = "1.0-unstable-2014-02-22";
@@ -7053,6 +7079,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  jj-nvim = buildVimPlugin {
+    pname = "jj.nvim";
+    version = "0.1.0-unstable-2025-12-25";
+    src = fetchFromGitHub {
+      owner = "NicolasGB";
+      repo = "jj.nvim";
+      rev = "faf1a9f63c55d1d3649896de0d7cc18e4581d71e";
+      hash = "sha256-OxBSxxPQRFq1EPmoUsICMTZFatkkb1mI/tPHCzeIW4Q=";
+    };
+    meta.homepage = "https://github.com/NicolasGB/jj.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   jq-vim = buildVimPlugin {
     pname = "jq.vim";
     version = "1.0.3-unstable-2024-11-19";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 42f57650808f..ddc01b565c1b 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -196,6 +196,14 @@ assertNoAdditions {
     ];
   };
 
+  artio-nvim = super.artio-nvim.overrideAttrs {
+    # Requires extui enabled
+    nvimSkipModules = [
+      "artio.view"
+      "artio.picker"
+    ];
+  };
+
   astrocore = super.astrocore.overrideAttrs {
     dependencies = [ self.lazy-nvim ];
   };
@@ -1530,6 +1538,10 @@ assertNoAdditions {
     dependencies = [ self.nvim-treesitter ];
   };
 
+  iswap-nvim = super.iswap-nvim.overrideAttrs {
+    dependencies = [ self.nvim-treesitter ];
+  };
+
   jdd-nvim = super.jdd-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 783a6c916d7f..fb3f9ae61c8f 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -71,6 +71,7 @@ https://github.com/solarnz/arcanist.vim/,,
 https://github.com/vim-scripts/argtextobj.vim/,,
 https://github.com/otavioschwanck/arrow.nvim/,,
 https://github.com/arsham/arshlib.nvim/,HEAD,
+https://github.com/comfysage/artio.nvim/,HEAD,
 https://github.com/AstroNvim/astrocore/,HEAD,
 https://github.com/AstroNvim/astrolsp/,HEAD,
 https://github.com/AstroNvim/astrotheme/,,
@@ -534,12 +535,14 @@ https://github.com/neutaaaaan/iosvkem/,,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,HEAD,
 https://github.com/haya14busa/is.vim/,,
+https://github.com/mizlan/iswap.nvim/,HEAD,
 https://github.com/vim-scripts/jdaddy.vim/,,
 https://github.com/mahyarmirrashed/jdd.nvim/,HEAD,
 https://github.com/davidhalter/jedi-vim/,,
 https://github.com/metalelf0/jellybeans-nvim/,,
 https://github.com/nanotech/jellybeans.vim/,,
 https://github.com/HiPhish/jinja.vim/,HEAD,
+https://github.com/NicolasGB/jj.nvim/,HEAD,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://github.com/julelang/jule.nvim/,HEAD,
diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index a05e6a688882..3d6575f0bd77 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-23";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "6400e0f0d8a1e2345def663bc646e8adc0e42e76";
-    hash = "sha256-2hmeEuO+Z0FDyDYiA59ntXl24B5OcLWuvxbiLLfiWE8=";
+    rev = "d0f1375248e3003199cb973a12332b4cc9f0724f";
+    hash = "sha256-uMPlJDjLmXDO9mrnjYu/3Fr5qwBBADUARTMz1hckLJM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/scummvm.nix b/pkgs/applications/emulators/libretro/cores/scummvm.nix
index 195eb80bacf9..acd4315d0ed5 100644
--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@@ -25,13 +25,13 @@ let
 in
 mkLibretroCore {
   core = "scummvm";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-12-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "scummvm";
-    rev = "686cdd13719b92554fa46b264c512ca7deec7a96";
-    hash = "sha256-3w1rYVPX7ENGUgKdrFRQShWoEXfagxdtzd98m1hKeYU=";
+    rev = "b56c0d796ebcb4a3a8ea966cc3b8ec3e02b452be";
+    hash = "sha256-CPYKOqyEDRdA2D1+eomrsb7w8pDWyxtqmGZF8j15OJU=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix
index ac908ab9f8ab..fc60ec0b1f28 100644
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -9,6 +9,7 @@
   zarith,
   camlp5,
   camlp-streams,
+  bash,
 }:
 
 let
@@ -52,6 +53,8 @@ stdenv.mkDerivation {
 
   patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
 
+  buildInputs = [ bash ];
+
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 27e39a90a50c..c889f509119a 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -40,7 +40,6 @@
   sourceDebug ? false,
   projectDscPath ?
     {
-      i686 = "OvmfPkg/OvmfPkgIa32.dsc";
       x86_64 = "OvmfPkg/OvmfPkgX64.dsc";
       aarch64 = "ArmVirtPkg/ArmVirtQemu.dsc";
       riscv64 = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc";
@@ -50,7 +49,6 @@
       or (throw "Unsupported OVMF `projectDscPath` on ${stdenv.hostPlatform.parsed.cpu.name}"),
   fwPrefix ?
     {
-      i686 = "OVMF";
       x86_64 = "OVMF";
       aarch64 = "AAVMF";
       riscv64 = "RISCV_VIRT";
@@ -58,16 +56,12 @@
     }
     .${stdenv.hostPlatform.parsed.cpu.name}
       or (throw "Unsupported OVMF `fwPrefix` on ${stdenv.hostPlatform.parsed.cpu.name}"),
-  metaPlatforms ? edk2.meta.platforms,
+  metaPlatforms ? lib.subtractLists lib.platforms.i686 edk2.meta.platforms,
 }:
 
 let
 
   platformSpecific = {
-    i686.msVarsArgs = {
-      flavor = "OVMF";
-      archDir = "Ia32";
-    };
     x86_64.msVarsArgs = {
       flavor = "OVMF_4M";
       archDir = "X64";
diff --git a/pkgs/by-name/as/asap/package.nix b/pkgs/by-name/as/asap/package.nix
index 5029244131eb..153e352ed046 100644
--- a/pkgs/by-name/as/asap/package.nix
+++ b/pkgs/by-name/as/asap/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asap";
-  version = "6.0.3";
+  version = "7.0.0";
 
   src = fetchzip {
     url = "mirror://sourceforge/project/asap/asap/${finalAttrs.version}/asap-${finalAttrs.version}.tar.gz";
-    hash = "sha256-a4RUtFue5wdoGUykLRb46s4+yR/I/7DhwE1SiWPRg8s=";
+    hash = "sha256-T4uTcaS8qIqUptggxJwZNSI/kN2NxNI+2ZUgncveb3E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 87b8b27b3b11..44ca288f6f38 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -4,7 +4,6 @@
   cmark,
   curl,
   fetchFromGitHub,
-  fetchpatch,
   fmt,
   fontconfig,
   freetype,
@@ -23,6 +22,7 @@
   libXi,
   libXxf86vm,
   libxcb,
+  libXrandr,
   ninja,
   pcre2,
   pixman,
@@ -34,7 +34,7 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.13";
+  version = "1.3.16.1";
 
   srcs = [
     (fetchFromGitHub {
@@ -43,7 +43,7 @@ clangStdenv.mkDerivation (finalAttrs: {
       repo = "aseprite";
       tag = "v${finalAttrs.version}";
       fetchSubmodules = true;
-      hash = "sha256-eeB/4fQp1lbNYQj9LpNhOn7DYxaTc+BcmyvY2vPzpxk=";
+      hash = "sha256-s2lWg5udg/8pXjOcj2nXDS2uE3urkg1iC0Div7wkxUY=";
     })
 
     # Translation strings
@@ -51,8 +51,8 @@ clangStdenv.mkDerivation (finalAttrs: {
       name = "aseprite-strings";
       owner = "aseprite";
       repo = "strings";
-      rev = "7b0af61dec1d98242d7eb2e9cab835d442d21235";
-      hash = "sha256-8OwwHCFP55pwLjk5O+a36hDZf9uX3P7cNliJM5SZdAg=";
+      rev = "0f49265d7e7aea4b862b7d1e670ed969e8a469b8";
+      hash = "sha256-S3YkWA5ECvyyqGvojDhIZci04CTjbJzTQiJ5FZsB4lU=";
     })
   ];
 
@@ -89,6 +89,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libXi
     libXxf86vm
     libxcb
+    libXrandr
     pcre2
     pixman
     skia-aseprite
@@ -100,6 +101,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     ./shared-fmt.patch
     ./shared-libwebp.patch
     ./shared-skia-deps.patch
+    ./shared-libjpeg-turbo.patch
   ];
 
   postPatch = ''
@@ -113,7 +115,6 @@ clangStdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
     "-DENABLE_DESKTOP_INTEGRATION=ON"
     "-DENABLE_UPDATER=OFF"
     "-DUSE_SHARED_CMARK=ON"
@@ -122,9 +123,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     "-DUSE_SHARED_FREETYPE=ON"
     "-DUSE_SHARED_GIFLIB=ON"
     "-DUSE_SHARED_HARFBUZZ=ON"
-    "-DUSE_SHARED_JPEGLIB=ON"
     "-DUSE_SHARED_LIBPNG=ON"
-    "-DUSE_SHARED_LIBWEBP=ON"
     "-DUSE_SHARED_PIXMAN=ON"
     "-DUSE_SHARED_TINYXML=OFF"
     "-DUSE_SHARED_WEBP=ON"
@@ -172,8 +171,7 @@ clangStdenv.mkDerivation (finalAttrs: {
                 - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
                 - Onion skinning.
     '';
-    maintainers = [
-    ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
     mainProgram = "aseprite";
   };
diff --git a/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch b/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
new file mode 100644
index 000000000000..a3b01fec6c57
--- /dev/null
+++ b/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
@@ -0,0 +1,21 @@
+diff --git a/cmake/FindJpegTurbo.cmake b/cmake/FindJpegTurbo.cmake
+index 33b5204..0407a6a 100644
+--- a/cmake/FindJpegTurbo.cmake
++++ b/cmake/FindJpegTurbo.cmake
+@@ -9,14 +9,11 @@
+ 
+ if(LAF_BACKEND STREQUAL "skia")
+ 
+-  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg
+-    HINTS "${SKIA_LIBRARY_DIR}" NO_DEFAULT_PATH)
+-  set(LIBJPEG_TURBO_INCLUDE_DIRS "${SKIA_DIR}/third_party/externals/libjpeg-turbo")
++  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg)
+ 
+   add_library(libjpeg-turbo STATIC IMPORTED)
+   set_target_properties(libjpeg-turbo PROPERTIES
+-    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}"
+-    INTERFACE_INCLUDE_DIRECTORIES ${LIBJPEG_TURBO_INCLUDE_DIRS})
++    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}")
+ 
+ else()
+ 
\ No newline at end of file
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index 426e63a318cc..df22c33f6a97 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "23.2.11";
+  version = "23.2.12";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-+tTZRDDYHZqZBsH+RVX2pdOJPlRZqD4fFzir4VsdB3o=";
+    hash = "sha256-sJ2Kf2xslaztQhhPWioGEnQZVW0pBu5apcUOQrpkr+Y=";
   };
 
-  npmDepsHash = "sha256-y/DNm4TiPx515UgpiCX1U9fHLPk19/8LlfqTGZHDmAA=";
+  npmDepsHash = "sha256-RC93b6mGPqqPPs6wqNuwyf3vE8wr/uGArA3wIFh+dO8=";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/bo/bob/package.nix b/pkgs/by-name/bo/bob/package.nix
deleted file mode 100644
index f4bb17388f58..000000000000
--- a/pkgs/by-name/bo/bob/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-  fetchpatch,
-}:
-
-buildGoModule rec {
-  pname = "bob";
-  version = "0.8.2";
-
-  src = fetchFromGitHub {
-    owner = "benchkram";
-    repo = "bob";
-    tag = version;
-    hash = "sha256-zmWfOLBb+GWw9v6LdCC7/WaP1Wz7UipPwqkmI1+rG8Q=";
-  };
-
-  patches = [
-    # Fix vulnerable dependencies
-    # Backport of https://github.com/benchkram/bob/pull/387
-    (fetchpatch {
-      url = "https://github.com/benchkram/bob/commit/5020e6fafbfbcb1b3add5d936886423ce882793d.patch";
-      hash = "sha256-if1ZErI0Un7d26eOkYSkEa87+VTRcEtF6JbsJYOHpHE=";
-    })
-  ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.Version=${version}"
-  ];
-
-  vendorHash = "sha256-u0nFaTQWU9O7A/RAhGaLcBka+YNGjSlpycDF8TLQALw=";
-
-  excludedPackages = [
-    "example/server-db"
-    "test/e2e"
-    "tui-example"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd bob \
-      --bash <($out/bin/bob completion) \
-      --zsh <($out/bin/bob completion -z)
-  '';
-
-  # tests require network access
-  doCheck = false;
-
-  meta = {
-    description = "Build system for microservices";
-    mainProgram = "bob";
-    homepage = "https://bob.build";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ zuzuleinen ];
-  };
-}
diff --git a/pkgs/by-name/bo/bolt-launcher/package.nix b/pkgs/by-name/bo/bolt-launcher/package.nix
index ddf07bb60edc..04678bd953db 100644
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -156,6 +156,7 @@ buildFHSEnv {
     maintainers = with lib.maintainers; [
       nezia
       jaspersurmont
+      iedame
     ];
     platforms = lib.platforms.linux;
     mainProgram = "${bolt.name}";
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 49b97f96ea7b..0dc51163c5be 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.357";
+  version = "1.4.364";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-h4BcHZHKseI+L3oabvLhs9NePZTZziQdBseYDSehJqc=";
+    hash = "sha256-XOvvT13L2vOQiq0gYeWdRP/H+mu0BI47koG+DzvuAhg=";
   };
 
-  vendorHash = "sha256-jseTLfBGUmwXz63+jTgv6k4RHh1cJVPQA/DI5OYlsdA=";
+  vendorHash = "sha256-U7oVc7DiFWdnEfemSDtmo4XYJj/564qDOZzQX0AVOqc=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 36d51faf2fbb..edd214c09a0c 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -150,13 +150,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.2.1";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-BUtHMx44efWTiS6heCUqONxngLwUCBOoDQqxoCj189U=";
+    hash = "sha256-M1/jgIbFY0VSQrHwT9/gcfA0HJ0r2cL1eJ3Y7lmmYVE=";
   };
 
   env = {
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-00Ch1EcX4cxMwvuDQLzTUIY7XkE3WX8bXBUA3yMRAMI=";
+    hash = "sha256-j+V4/oxKDg4oQ+7eg34sefIMJLelOSUKXTXasQK2Z1g=";
   };
 
   patches = [
@@ -220,6 +220,17 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace tests/checks/complete.fish \
       --replace-fail '/bin/ls' '${lib.getExe' coreutils "ls"}'
 
+    substituteInPlace tests/checks/output-buffering.fish \
+      --replace-fail '/bin/echo' '${lib.getExe' coreutils "echo"}'
+
+    substituteInPlace tests/pexpects/wait.py \
+      --replace-fail 'expect_prompt("Job ' 'expect_prompt("fish: Job ' \
+      --replace-fail 'expect_str("Job ' 'expect_str("fish: Job '
+
+    substituteInPlace share/tools/web_config/webconfig.py \
+      --replace-fail 'os.environ["__fish_terminal_color_theme"]' \
+        'os.environ.get("__fish_terminal_color_theme", "default")'
+
     # Several pexpect tests are flaky
     # See https://github.com/fish-shell/fish-shell/issues/8789
     rm tests/pexpects/exit_handlers.py
diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index b42a49615920..1c69c4ff92a7 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.29.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yV8aGmY2mUAu0urIi7d1pIjhJasRX17hpmvFEQm4YpY=";
+    hash = "sha256-thSUS3OQecOSaC6e5o1yRuI7FAyy/wZEvp+tIdJrtSo=";
   };
 
-  vendorHash = "sha256-zCzMNlpBBUS2P2aywFDUp/RSl+HlfQe+L8a1+vVYbgY=";
+  vendorHash = "sha256-Z5oKy9u/aqxoEiyDJWBBoUS5WJYWcfh77kK5wyl/pdc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ft/ftxui/package.nix b/pkgs/by-name/ft/ftxui/package.nix
index d400a98c18b9..70bfe592bc97 100644
--- a/pkgs/by-name/ft/ftxui/package.nix
+++ b/pkgs/by-name/ft/ftxui/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
   cmake,
   doxygen,
   gbenchmark,
@@ -9,14 +10,14 @@
   gtest,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ftxui";
   version = "6.1.9";
 
   src = fetchFromGitHub {
     owner = "ArthurSonzogni";
     repo = "ftxui";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-plJxTLhOhUyuay5uYv4KLK9UTmM2vsoda+iDXVa4b+k=";
   };
 
@@ -33,20 +34,20 @@ stdenv.mkDerivation rec {
     gbenchmark
   ];
 
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
   cmakeFlags = [
     (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
     (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
-    (lib.cmakeBool "FTXUI_BUILD_TESTS" doCheck)
+    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.doCheck)
   ];
 
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
   meta = {
     homepage = "https://github.com/ArthurSonzogni/FTXUI";
-    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "Functional Terminal User Interface library for C++";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ phanirithvij ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/fu/fuse-overlayfs/package.nix b/pkgs/by-name/fu/fuse-overlayfs/package.nix
index f7c05239e374..f791a88172cc 100644
--- a/pkgs/by-name/fu/fuse-overlayfs/package.nix
+++ b/pkgs/by-name/fu/fuse-overlayfs/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.15";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "fuse-overlayfs";
     rev = "v${version}";
-    hash = "sha256-awVDq87lxMtpTADhy8k95N/4yuGH+2Fn94j3JZzkuUY=";
+    hash = "sha256-FwAv5PmiBz25PNH/IEIV6cHjhlE+1mDTrgvR2vN++ZY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fw/fwup/package.nix b/pkgs/by-name/fw/fwup/package.nix
index b4826588d27e..9d11291d7c30 100644
--- a/pkgs/by-name/fw/fwup/package.nix
+++ b/pkgs/by-name/fw/fwup/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.13.2";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
-    rev = "v${version}";
-    sha256 = "sha256-s9M734Ohf8kItoOdaxewk4Enbrm2wsT0M4Ak9+q3KA8=";
+    tag = "v${version}";
+    hash = "sha256-kVkw+/Z3+ZM1wXV/OmfaVPoUKc6MRuz8GRwpvOscuEM=";
   };
 
   nativeBuildInputs = [
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   meta = {
+    changelog = "https://github.com/fwup-home/fwup/blob/${src.tag}/CHANGELOG.md";
     description = "Configurable embedded Linux firmware update creator and runner";
     homepage = "https://github.com/fhunleth/fwup";
     license = lib.licenses.asl20;
diff --git a/pkgs/by-name/gi/gitlab-ci-ls/package.nix b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
index f14117206749..f26c5f7e12fc 100644
--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitlab-ci-ls";
-  version = "1.2.2";
+  version = "1.2.5";
   src = fetchFromGitHub {
     owner = "alesbrelih";
     repo = "gitlab-ci-ls";
     rev = "${version}";
-    hash = "sha256-ZpLkiTJP3pofDcXrQPdl5Vm6SKsp6DecwSfXWC9h2qI=";
+    hash = "sha256-Ly4pk+16RCr3r33VrYPTZGUXfUNd5IJHfA+uj7Ef3bk=";
   };
 
-  cargoHash = "sha256-wDu89bhyR4a0U9KDF0iasdYrc1GUGlYH1y6D8+NKPy4=";
+  cargoHash = "sha256-/w5inDL6ECs2Ce8Bdfr4sOKhGeFC0tE5SrW3aIXjHnA=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/go/go-errorlint/package.nix b/pkgs/by-name/go/go-errorlint/package.nix
index 732ae6ea64c4..8353d8f6d9cb 100644
--- a/pkgs/by-name/go/go-errorlint/package.nix
+++ b/pkgs/by-name/go/go-errorlint/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "go-errorlint";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "polyfloyd";
     repo = "go-errorlint";
     rev = "v${version}";
-    hash = "sha256-jczsgZAC90f2Kkrwpb9oeoK1HtlFDLOjqlexn9v5ojk=";
+    hash = "sha256-79hbXvLnlry2j1mmeHoEx1PRIRd0iRbzN6BDnUyFV+4=";
   };
 
-  vendorHash = "sha256-smOu92BigepCH02qm2Im3T65nUoR/IYhWTjhnjRPppA=";
+  vendorHash = "sha256-U/19X5iY7IHOHkbTADT4ueCJBPh/ryI4PCfg8ZbMLzU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix
index cc8df032b783..82445c16ce85 100644
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -8,6 +8,7 @@
   xorg,
   pkg-config,
   protobuf,
+  openssl,
   writableTmpDirAsHomeHook,
   nix-update-script,
   llvmPackages,
@@ -27,23 +28,34 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.13.1";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-61MFtAhz7yq2wStNWDIlBo+OubBVor0NnpOAX8nQ8K0=";
+    hash = "sha256-lMlpgsLkPQsvc5Ad8sRrwO27ytb5hpF3doUR18DUrvw=";
   };
 
-  cargoHash = "sha256-YR/QUEE+EbwytiL0xkCr/EYE0O2/B/KmuLaF6TA7N6I=";
+  cargoHash = "sha256-WPrCwvGVOuTKXEHLR0WRV+YXr4r10fQf9t/Sfs/2bNI=";
+
+  cargoBuildFlags = [
+    "--bin"
+    "goose"
+    "--bin"
+    "goosed"
+  ];
 
   nativeBuildInputs = [
     pkg-config
     protobuf
   ];
 
-  buildInputs = [ dbus ] ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];
+  buildInputs = [
+    dbus
+    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];
 
   env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
 
@@ -83,6 +95,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_successful_request"
     "--skip=routes::audio::tests::test_transcribe_endpoint_requires_auth"
     "--skip=routes::config_management::tests::test_get_provider_models_openai_configured"
+    # tunnel tests that need external connectivity to Cloudflare
+    "--skip=tunnel::lapstone_test::test_tunnel_end_to_end"
+    "--skip=tunnel::lapstone_test::test_tunnel_post_request"
     # integration tests that need network access
     "--skip=test_replayed_session::vec_uvx_mcp_server_fetch_vec_calltoolrequestparam_name_fetch_into_arguments_some_object_url_https_example_com_vec_expects"
     "--skip=test_replayed_session::vec_github_mcp_server_stdio_vec_calltoolrequestparam_name_get_file_contents_into_arguments_some_object_owner_block_repo_goose_path_readme_md_sha_ab62b863c1666232a67048b6c4e10007a2a5b83c_vec_github_personal_access_token_expects"
diff --git a/pkgs/by-name/im/impala/package.nix b/pkgs/by-name/im/impala/package.nix
index d64655d707d2..9a207f17ccbb 100644
--- a/pkgs/by-name/im/impala/package.nix
+++ b/pkgs/by-name/im/impala/package.nix
@@ -21,6 +21,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/pythops/impala";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.nydragon ];
+    maintainers = with lib.maintainers; [
+      nydragon
+      bridgesense
+    ];
   };
 }
diff --git a/pkgs/by-name/js/json-tui/package.nix b/pkgs/by-name/js/json-tui/package.nix
new file mode 100644
index 000000000000..852dba711ead
--- /dev/null
+++ b/pkgs/by-name/js/json-tui/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchpatch2,
+  fetchFromGitHub,
+
+  cmake,
+  ftxui,
+  libargs,
+  nlohmann_json,
+  gtest,
+  gbenchmark,
+
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "json-tui";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ArthurSonzogni";
+    repo = "json-tui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qS2EbCxH8sUUJMu5hwm1+Nu6SsJRfLReX56YSd1RZU4=";
+  };
+
+  patches = [
+    # fixes tests - https://github.com/ArthurSonzogni/json-tui/pull/37
+    (fetchpatch2 {
+      url = "https://github.com/ArthurSonzogni/json-tui/commit/645060a016c1e1ca84b9e1dc638a926415aaa5fe.patch?full_index=1";
+      hash = "sha256-8AZEZgU8HHyaasb/7LegSwRAMo1iyonv3XUY284nYKg=";
+    })
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    ftxui
+    libargs
+    nlohmann_json
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  checkInputs = [ gbenchmark ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  cmakeFlags = [
+    "-Wno-dev" # suppress cmake warning about deprecated usage
+    (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    homepage = "https://github.com/ArthurSonzogni/json-tui";
+    changelog = "https://github.com/ArthurSonzogni/json-tui/blob/v${finalAttrs.version}/CHANGELOG.md";
+    description = "JSON terminal UI made in C++";
+    license = lib.licenses.mit;
+    mainProgram = "json-tui";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ka/kata-runtime/kata-images.nix b/pkgs/by-name/ka/kata-runtime/kata-images.nix
index e1b15266a99c..d4eb2f22817b 100644
--- a/pkgs/by-name/ka/kata-runtime/kata-images.nix
+++ b/pkgs/by-name/ka/kata-runtime/kata-images.nix
@@ -4,6 +4,7 @@
   lib,
   stdenv,
   version,
+  zstd,
 }:
 
 let
@@ -16,16 +17,17 @@ let
 
   imageHash =
     {
-      "x86_64-linux" = "sha256-7xDc5Rr3rP36zS3kpM2QEqOCtmka3EAnts4Z1h8MNWY=";
-      "aarch64-linux" = "sha256-8nLHTPetEfIrdtrpiT9Czcpf0NhL97TZ2DXyeBL04LA=";
+      "x86_64-linux" = "sha256-roS2pGO00ORN+xxNU3/uqJG9RzhVqf8gCkt8EJJbY/g=";
+      "aarch64-linux" = "sha256-AuK5a2Qtd176B91+vSsEFwuWICpe8wcGTbXoE7B8b20=";
     }
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
 in
 fetchzip {
   name = "kata-images-${version}";
-  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.xz";
+  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.zst";
   hash = imageHash;
+  nativeBuildInputs = [ zstd ];
 
   postFetch = ''
     mv $out/kata/share/kata-containers kata-containers
diff --git a/pkgs/by-name/ka/kata-runtime/package.nix b/pkgs/by-name/ka/kata-runtime/package.nix
index 57dbe5608066..b04e9d100868 100644
--- a/pkgs/by-name/ka/kata-runtime/package.nix
+++ b/pkgs/by-name/ka/kata-runtime/package.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "3.16.0";
+  version = "3.21.0";
 
   kata-images = callPackage ./kata-images.nix { inherit version; };
 
@@ -34,7 +34,7 @@ buildGoModule rec {
     owner = "kata-containers";
     repo = "kata-containers";
     rev = version;
-    hash = "sha256-+SppAF77NbXlSrBGvIm40AmNC12GrexbX7fAPBoDAcs=";
+    hash = "sha256-gOPabvimKzP7U1/BRzjKPDKE0MHnhKI4j0WZPM6ZTSA=";
   };
 
   sourceRoot = "${src.name}/src/runtime";
diff --git a/pkgs/by-name/li/libmt32emu/package.nix b/pkgs/by-name/li/libmt32emu/package.nix
index e01401581474..9de77adc2e7c 100644
--- a/pkgs/by-name/li/libmt32emu/package.nix
+++ b/pkgs/by-name/li/libmt32emu/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmt32emu";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     tag = "libmt32emu_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-wXIvdGoup/AOQggkeXvtbi3pXhyKUKWmyt/ZbGzufds=";
+    hash = "sha256-3sL9ZDM4/70vKPkOU6Et82c3RC5OYt0eQb5miDYRU0I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index b02a921ff74d..7aa206c49634 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-12-22";
+  version = "0-unstable-2025-12-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "92ec9ff8c2d53d397b6d943788c748c073ee1fe8";
-    hash = "sha256-p2CmXbgd0oKibZa2PiS3xI6KXfsIWtJ+QyvLrc9PFWY=";
+    rev = "e24402e35d762a017127f44701cad8d3f4704f44";
+    hash = "sha256-yv0MM90ACG5JGf9ypkyK3xlr6V284F/PrPAbXjuLZWw=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix
index fd4406389eaf..9098b44ded57 100644
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.58.0";
+  version = "1.59.0";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-6+GVyUSDsv9INoivIsiO+eoBZvueLeDGA/9Lc2l7xRk=";
+    hash = "sha256-hd1yQ+VJenmBk2WIjO7tFdoyJ8jIq6248ljz9T6c4Vc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 5fd306230a8f..784535d2717a 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -274,6 +274,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       leleuvilela
       bricklou
       jonhermansen
+      iedame
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/na/naja/package.nix b/pkgs/by-name/na/naja/package.nix
index dfc565a5e09f..ceced274fcaa 100644
--- a/pkgs/by-name/na/naja/package.nix
+++ b/pkgs/by-name/na/naja/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "naja";
-  version = "0.3.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "najaeda";
     repo = "naja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u7pblUmMJYYd0o7jzT5g9moPrWdOgqhPXPzx+B90ybg=";
+    hash = "sha256-94sv8eeQacsCELTMIUhG9JKtJtVAxmF88Pvj9udN/fM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/no/nohang/package.nix b/pkgs/by-name/no/nohang/package.nix
new file mode 100644
index 000000000000..846a644bd6ab
--- /dev/null
+++ b/pkgs/by-name/no/nohang/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  nixosTests,
+  fetchFromGitHub,
+  python3,
+  sudo,
+  libnotify,
+  coreutils,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nohang";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "hakavlad";
+    repo = "nohang";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aRiBGnJHdtQ5euvJ4DSuCZO5i5OJVRiCesaatrIARmg=";
+  };
+
+  postPatch = ''
+    patchShebangs src
+    substituteInPlace src/nohang \
+      --replace-fail 'notify-send' '${lib.getExe libnotify}' \
+      --replace-fail 'sudo' '${lib.getExe sudo}' \
+      --replace-fail "'env'" "'${lib.getExe' coreutils "env"}'"
+  '';
+
+  buildInputs = [ python3 ];
+
+  dontBuild = true;
+
+  installTargets = [ "base" ];
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "PREFIX=/"
+    "SBINDIR=/sbin"
+    "SYSCONFDIR=/etc"
+    "SYSTEMDUNITDIR=/lib/systemd/system"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) nohang;
+  };
+
+  meta = {
+    homepage = "https://github.com/hakavlad/nohang";
+    description = "Sophisticated low memory handler for Linux";
+    license = with lib.licenses; [ mit ];
+    mainProgram = "nohang";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+})
diff --git a/pkgs/by-name/op/opengamepadui/package.nix b/pkgs/by-name/op/opengamepadui/package.nix
index bb6f041a135d..7e91a2d92920 100644
--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opengamepadui";
-  version = "0.42.2";
+  version = "0.42.3";
 
   buildType = if withDebug then "debug" else "release";
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ShadowBlip";
     repo = "OpenGamepadUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-POTW6qnzaVtoTo8ibCCaap0DS8VJiEGm2Mr5ZBkuLZc=";
+    hash = "sha256-sqzCGGrMxOjepi9GxJFCAY+tzuIwOgs5qYeIYKb7Y1U=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/op/opensnitch-ui/package.nix b/pkgs/by-name/op/opensnitch-ui/package.nix
index 2c7a17b2266f..9ff43d40c67e 100644
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -1,6 +1,6 @@
 {
   python3Packages,
-  qt5,
+  qt6,
   lib,
   opensnitch,
 }:
@@ -12,29 +12,21 @@ python3Packages.buildPythonApplication {
   inherit (opensnitch) src version;
   sourceRoot = "${opensnitch.src.name}/ui";
 
-  patches = [
-    # https://github.com/evilsocket/opensnitch/pull/1413
-    # unicode-slugify has failing tests and is overall unmaintained and broken.
-    # python-slugify is a preferrable replacement
-    ./use_python_slugify.patch
-  ];
-
   postPatch = ''
     substituteInPlace opensnitch/utils/__init__.py \
       --replace-fail /usr/lib/python3/dist-packages/data ${python3Packages.pyasn}/${python3Packages.python.sitePackages}/pyasn/data
   '';
 
   nativeBuildInputs = [
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    qt5.qtwayland
+    qt6.qtwayland
   ];
 
   build-system = with python3Packages; [
     setuptools
-    pyqt5
   ];
 
   dependencies = with python3Packages; [
@@ -43,7 +35,7 @@ python3Packages.buildPythonApplication {
     packaging
     pyasn
     pyinotify
-    pyqt5
+    pyqt6
     qt-material
     python-slugify
     unidecode
@@ -52,7 +44,6 @@ python3Packages.buildPythonApplication {
   preBuild = ''
     make -C ../proto ../ui/opensnitch/ui_pb2.py
     # sourced from ui/Makefile
-    pyrcc5 -o opensnitch/resources_rc.py opensnitch/res/resources.qrc
     sed -i 's/^import ui_pb2/from . import ui_pb2/' opensnitch/proto/ui_pb2*
   '';
 
diff --git a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch b/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
deleted file mode 100644
index 877b5006251a..000000000000
--- a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff --git a/requirements.txt b/requirements.txt
-index 66e0de13..68d651b1 100644
---- a/requirements.txt
-+++ b/requirements.txt
-@@ -1,5 +1,5 @@
- grpcio-tools>=1.10.1
- pyinotify==0.9.6
--unicode_slugify==0.1.5
-+python-slugify>=7.0.0
- pyqt5>=5.6
- protobuf
diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix
index b682efc1bc1e..8aeea61e15da 100644
--- a/pkgs/by-name/op/opensnitch/package.nix
+++ b/pkgs/by-name/op/opensnitch/package.nix
@@ -1,7 +1,6 @@
 {
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
   protobuf,
   go-protobuf,
   pkg-config,
@@ -35,29 +34,15 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opensnitch";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ=";
+    hash = "sha256-Bz5h2DEC61vpkeWZxFlogh6NvTubJcnHuwgTNSzZd68=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/evilsocket/opensnitch/pull/1418
-      # allow configuring the audit socket path
-      url = "https://github.com/evilsocket/opensnitch/commit/f9358a464f204068359bf5174e6ff43288f12c7e.patch?full_index=1";
-      hash = "sha256-s9CM1CyGpfJZXEtihXCM7nfPhBY8XuwubynTotqtf3E=";
-    })
-    (fetchpatch {
-      # add missing colon in test definition
-      url = "https://github.com/evilsocket/opensnitch/commit/4b38ca1260295d2e0f8c4a7313529f83dcca4554.patch?full_index=1";
-      hash = "sha256-/z3iFRpcv75FyarVnpK8/PTU2fcFHS+SNbHn7M5Etk8=";
-    })
-  ];
-
   postPatch = ''
     # Allow configuring Version at build time
     substituteInPlace daemon/core/version.go --replace-fail "const " "var "
@@ -87,13 +72,11 @@ buildGoModule (finalAttrs: {
   postBuild = ''
     mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
     mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
-    cp system-fw.json $out/etc/opensnitchd/
-    substitute default-config.json $out/etc/opensnitchd/default-config.json \
+    cp -r data/{rules,*.json} $out/etc/opensnitchd/
+    substituteInPlace $out/etc/opensnitchd/default-config.json \
       --replace-fail "/var/log/opensnitchd.log" "/dev/stdout"
-    # Do not mkdir rules path
-    sed -i '8d' opensnitchd.service
     # Fixup hardcoded paths
-    substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
+    substitute data/init/opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
       --replace-fail "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd"
   '';
 
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index c0c046f00aa2..adbc135a0b4e 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gK5WkGWAS64R/msPbHDrMPtWlHQQbnxfPINmFARCBR8=";
+    hash = "sha256-s+4TH6xYs53/HVU5UD3YyjYgbc0Ul+RmC1kV7eJHO/o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index a00ccd3dc2f8..f7b14b795537 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-26";
+  version = "GE-Proton10-27";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-Q5bKTDn3sTgp4mbsevOdN3kcdRsyKylghXqM2I2cYq8=";
+    hash = "sha256-yBPjPb2LzxdgEobuoeSfs3UZ1XUxZF6vIMYF+fAnLA0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index 739df02ab46d..8710e546aaf4 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reth";
-  version = "1.8.3";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
     repo = "reth";
     rev = "v${version}";
-    hash = "sha256-jyStSIVTQeBJGwNelxHItIjHPQyvg3luGRj0qziZ8u0=";
+    hash = "sha256-zTSwRSSZDINHEkbtTiLP3mgod9lDzFrPxMXq88NTOAM=";
   };
 
-  cargoHash = "sha256-v7B2W9SSQvUlJQzP/AAffsJq+fP4Ghxr4C5+gB1LE9k=";
+  cargoHash = "sha256-WDe75Sg7y4GfH3dSfY48aXrIBe89skj1VW0NcgtLEVU=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index d1ce92a2bc34..21b5ebd51736 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2025-12-24";
 
   outputs = [
     "out"
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "f1ca8cfefba8f32095861bbcf2a4f4d773f0fbb4";
-    hash = "sha256-q0iEoN8+f438ScgAvobDh7evulfaZ3Cd8zkc19kRT54=";
+    rev = "feec623003c01a9fff5b30e114c38f550255b511";
+    hash = "sha256-AGfuUYUGbea3LDgGiwxq6XBMgLeatsdWDpciL4JeTWU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/si/sillytavern/package.nix b/pkgs/by-name/si/sillytavern/package.nix
index 821ace818dd6..ca81a2dabe7e 100644
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@@ -5,15 +5,15 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "sillytavern";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "SillyTavern";
     repo = "SillyTavern";
     tag = finalAttrs.version;
-    hash = "sha256-5bml7PwmlfJag8DzbR5qdNJ6ddKmZsEUD155VwkJhjI=";
+    hash = "sha256-yx1vPnKxhQTRnBDOTR4jEcDaU8DDDOW7P98LI3hOTHc=";
   };
-  npmDepsHash = "sha256-cqS8UFyXNql/SE1nrWhZlIXhz0SO3JUSDThsfAOHP7E=";
+  npmDepsHash = "sha256-fKFt10eg72C5wBeAQ6SQH6mBF1Lf/EADN/wCrHkDf3U=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/sk/skia-aseprite/deps.nix b/pkgs/by-name/sk/skia-aseprite/deps.nix
index a51fe82d9bce..de50c8fa2c69 100644
--- a/pkgs/by-name/sk/skia-aseprite/deps.nix
+++ b/pkgs/by-name/sk/skia-aseprite/deps.nix
@@ -2,22 +2,33 @@
 {
   angle2 = fetchgit {
     url = "https://chromium.googlesource.com/angle/angle.git";
-    rev = "8718783526307a3fbb35d4c1ad4e8101262a0d73";
-    hash = "sha256-UXYCqn++WCyncwNyuuq8rIkxlB7koMK9Ynx7TRzCIDE=";
+    rev = "21d124c4bf321a18dae1dc94602aa262fc346a8b";
+    hash = "sha256-Cz9n2ya4l3L1lvF4elHYJCfxr3l+h5UYOEhrhtw6WJg=";
+    fetchSubmodules = false;
   };
   dng_sdk = fetchgit {
     url = "https://android.googlesource.com/platform/external/dng_sdk.git";
     rev = "c8d0c9b1d16bfda56f15165d39e0ffa360a11123";
     hash = "sha256-lTtvBUGaia0jhrxpw7k7NIq2SVyGmBJPCvjIqAQCmNo=";
   };
+  icu = fetchgit {
+    url = "https://chromium.googlesource.com/chromium/deps/icu.git";
+    rev = "a0718d4f121727e30b8d52c7a189ebf5ab52421f";
+    hash = "sha256-BI3f/gf9GNDvSfXWeRHKBvznSz4mjXY8rM24kK7QvOM=";
+  };
+  icu4x = fetchgit {
+    url = "https://chromium.googlesource.com/external/github.com/unicode-org/icu4x.git";
+    rev = "bcf4f7198d4dc5f3127e84a6ca657c88e7d07a13";
+    hash = "sha256-Lha5m97zwTBFJZZUwewCv1blQh/VgDR0G2h+GMMAzME=";
+  };
   piex = fetchgit {
     url = "https://android.googlesource.com/platform/external/piex.git";
     rev = "bb217acdca1cc0c16b704669dd6f91a1b509c406";
     hash = "sha256-IhAfxlu0UmllihBP9wbg7idT8azlbb9arLKUaZ6qNxY=";
   };
-  sfntly = fetchgit {
-    url = "https://chromium.googlesource.com/external/github.com/googlei18n/sfntly.git";
-    rev = "b55ff303ea2f9e26702b514cf6a3196a2e3e2974";
-    hash = "sha256-/zp1MsR31HehoC5OAI4RO8QBlm7mldQNiTI7Xr/LJeI=";
+  wuffs = fetchgit {
+    url = "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git";
+    rev = "e3f919ccfe3ef542cfc983a82146070258fb57f8";
+    hash = "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw=";
   };
 }
diff --git a/pkgs/by-name/sk/skia-aseprite/package.nix b/pkgs/by-name/sk/skia-aseprite/package.nix
index c2de5cece603..e901343a2941 100644
--- a/pkgs/by-name/sk/skia-aseprite/package.nix
+++ b/pkgs/by-name/sk/skia-aseprite/package.nix
@@ -7,7 +7,6 @@
   fontconfig,
   gn,
   harfbuzzFull,
-  icu,
   lib,
   libglvnd,
   libjpeg,
@@ -26,13 +25,13 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "skia-aseprite";
-  version = "m102-861e4743af";
+  version = "m124-08a5439a6b";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "skia";
     rev = finalAttrs.version;
-    hash = "sha256-IlZbalmHl549uDUfPG8hlzub8TLWhG0EsV6HVAPdsl0=";
+    hash = "sha256-D79Z/deJsDVclcUTZXUrNZdTPW2TFNaVF4mTeHO8I+U=";
   };
 
   nativeBuildInputs = [
@@ -55,13 +54,15 @@ clangStdenv.mkDerivation (finalAttrs: {
     mkdir -p third_party/externals
     ln -s ${angle2} third_party/externals/angle2
     ln -s ${dng_sdk} third_party/externals/dng_sdk
+    ln -s ${icu} third_party/externals/icu
+    ln -s ${icu4x} third_party/externals/icu4x
     ln -s ${piex} third_party/externals/piex
-    ln -s ${sfntly} third_party/externals/sfntly
+    ln -s ${wuffs} third_party/externals/wuffs
   '';
 
   configurePhase = ''
     runHook preConfigure
-    gn gen lib --args="is_debug=false is_official_build=true extra_cflags=[\"-I${harfbuzzFull.dev}/include/harfbuzz\"]"
+    gn gen lib --args="is_debug=false is_official_build=true skia_use_system_icu=false extra_cflags=[\"-I${harfbuzzFull.dev}/include/harfbuzz\"]"
     runHook postConfigure
   '';
 
@@ -69,7 +70,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     expat
     fontconfig
     harfbuzzFull
-    icu
     libglvnd
     libjpeg
     libpng
@@ -94,20 +94,26 @@ clangStdenv.mkDerivation (finalAttrs: {
 
     # All these paths are used in some way when building Aseprite.
     cp -r --parents -t $out/ \
-      include/codec \
-      include/config \
-      include/core \
-      include/effects \
-      include/gpu \
-      include/private \
-      include/utils \
-      include/third_party/skcms/*.h \
+      include/codec/**/*.h \
+      include/config/**/*.h \
+      include/core/**/*.h \
+      include/effects/**/*.h \
+      include/gpu/**/*.h \
+      include/private/**/*.h \
+      include/utils/**/*.h \
+      include/ports/**/*.h \
+      include/sksl/**/*.h \
       lib/*.a \
-      modules/skshaper/include/*.h \
+      modules/skshaper/**/*.h \
+      modules/skcms/**/*.h \
+      modules/skunicode/**/*.h \
       src/core/*.h \
       src/gpu/**/*.h \
+      src/image/*.h \
+      src/sksl/**/*.h \
+      src/base/**/*.h \
       third_party/externals/angle2/include \
-      third_party/skcms/**/*.h
+      third_party/externals/icu/flutter/icudtl.dat
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/sk/skia-aseprite/update.sh b/pkgs/by-name/sk/skia-aseprite/update.sh
index 78f7e67da6e9..605387d5a122 100755
--- a/pkgs/by-name/sk/skia-aseprite/update.sh
+++ b/pkgs/by-name/sk/skia-aseprite/update.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell --pure -i bash
-#!nix-shell -p cacert curl git jq nix-prefetch-git
+#!nix-shell -p cacert curl git jq nix-prefetch-git nix
 # shellcheck shell=bash
 # vim: set tabstop=2 shiftwidth=2 expandtab:
 set -euo pipefail
@@ -12,17 +12,17 @@ shopt -s inherit_errexit
 }
 
 pkgpath=$(git rev-parse --show-toplevel)/pkgs/by-name/sk/skia-aseprite
-depfilter=$(tr ' ' '|' <<< "$*")
+depfilter=$(tr ' ' '|' <<<"$*")
 depfile=$pkgpath/deps.nix
 pkgfile=$pkgpath/package.nix
 
 update_deps() {
   local deps third_party_deps name url rev hash prefetch
 
-  version=$(sed -n 's|.*version = "\(.*\)".*|\1|p' < "$pkgfile")
+  version=$(sed -n 's|.*version = "\(.*\)".*|\1|p' <"$pkgfile")
   deps=$(curl -fsS https://raw.githubusercontent.com/aseprite/skia/$version/DEPS)
-  third_party_deps=$(sed -n 's|[ ",]||g; s|:| |; s|@| |; s|^third_party/externals/||p' <<< "$deps")
-  filtered=$(grep -E -- "$depfilter" <<< "$third_party_deps")
+  third_party_deps=$(sed -n 's|[ ",]||g; s|:| |; s|@| |; s|^third_party/externals/||p' <<<"$deps")
+  filtered=$(grep -E -- "$depfilter" <<<"$third_party_deps")
   if [[ -z $filtered ]]; then
     printf >&2 '%s: error: filter "%s" matched nothing' "$0" "$depfilter"
     return 1
@@ -32,16 +32,20 @@ update_deps() {
   while read -r name url rev; do
     printf >&2 'Fetching %s@%s\n' "$name" "$rev"
     prefetch=$(nix-prefetch-git --quiet --rev "$rev" "$url")
-    hash=$(jq -r '.hash' <<< "$prefetch")
+    hash=$(jq -r '.hash' <<<"$prefetch")
 
-    cat << EOF
+    cat <<EOF
   $name = fetchgit {
     url = "$url";
     rev = "$rev";
     hash = "$hash";
-  };
 EOF
-  # `read` could exit with a non-zero code without a newline at the end
+    # Avoid accidentally pulling in submodules during fetch.
+    if [[ $name == angle2 ]]; then
+      printf '    fetchSubmodules = false;\n'
+    fi
+    echo "  };"
+    # `read` could exit with a non-zero code without a newline at the end
   done < <(printf '%s\n' "$filtered")
   printf '}\n'
 }
@@ -53,8 +57,8 @@ update_version() {
       --header 'Accept: application/vnd.github+json' \
       --location --show-error --silent \
       ${GITHUB_TOKEN:+ --user \":$GITHUB_TOKEN\"} \
-      https://api.github.com/repos/aseprite/skia/releases/latest \
-      | jq -r .tag_name
+      https://api.github.com/repos/aseprite/skia/releases/latest |
+      jq -r .tag_name
   )
   newhash=$(nix-prefetch-git --quiet --rev "$newver" https://github.com/aseprite/skia.git | jq -r '.hash')
   sed \
@@ -65,7 +69,7 @@ update_version() {
 
 temp=$(mktemp)
 trap 'ret=$?; rm -rf -- "$temp"; exit $ret' EXIT
-update_version > "$temp"
+update_version >"$temp"
 cp "$temp" "$pkgfile"
-update_deps > "$temp"
+update_deps >"$temp"
 cp "$temp" "$depfile"
diff --git a/pkgs/by-name/sp/splitcode/package.nix b/pkgs/by-name/sp/splitcode/package.nix
index 15e5973ee38c..ab3d6fe420dd 100644
--- a/pkgs/by-name/sp/splitcode/package.nix
+++ b/pkgs/by-name/sp/splitcode/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "splitcode";
-  version = "0.31.5";
+  version = "0.31.6";
 
   src = fetchFromGitHub {
     owner = "pachterlab";
     repo = "splitcode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x2N+IQHB6gbEKTEofsWy7SwVf1lvRxh5f93avtAs8fM=";
+    hash = "sha256-80XrLr6gk398a/JVSpb8j0i2pMEDKn0EnTiSw7cWS2c=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -25,12 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
-  postPatch = ''
-    # https://github.com/pachterlab/splitcode/pull/46
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 2.8.12 3.10
-  '';
-
   doCheck = true;
   checkPhase = ''
     mkdir func_tests
@@ -44,7 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool for flexible, efficient parsing, interpreting, and editing of technical sequences in sequencing reads";
     homepage = "https://github.com/pachterlab/splitcode";
     license = lib.licenses.bsd2;
-    platforms = lib.platforms.all;
+    # also compiles on macos, but since it seems to return invalid results.
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ zimward ];
     mainProgram = "splitcode";
     badPlatforms = [
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index fa71c06ccf1a..f5da6e9c8111 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-HSmRRSsti0TcGaidmYJ7zAzdDpbbitEP+GpqQU2HgMw=";
+    hash = "sha256-PSw+yRAj6i2qld+10FEMWRxOaqzqu+4CYJcO0PAgG0g=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-d5F9xp770b4M5T5k04/1DiMsXm9RwkL6IZuaSrACfvM=";
+  cargoHash = "sha256-XRiIngGFG8j3zQd6QMAFoZ64M7X4NkXCwYiUKA6oefA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ui/uiua/unstable.nix b/pkgs/by-name/ui/uiua/unstable.nix
index 923f9ff07ce5..531b52fbd5d7 100644
--- a/pkgs/by-name/ui/uiua/unstable.nix
+++ b/pkgs/by-name/ui/uiua/unstable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.18.0-dev.3";
+  version = "0.18.0-dev.4";
   tag = version;
-  hash = "sha256-0xQIbKLvdoFfh0Kxgopb4z0K2HCueEGm0Mq1erpcITc=";
-  cargoHash = "sha256-34FaXwBUtbF4V9hJjud3gQKpqOZm3FG2fEF/QLYUqXY=";
+  hash = "sha256-/uM92x0jBgfbkBY5/NFPBDHgH+caISEtJiiXAFQj61A=";
+  cargoHash = "sha256-MsoLvwFlVBJnbWMA8Z7wCjQKJ9VHYhAV1HpNVmM+MEo=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/yk/ykush/package.nix b/pkgs/by-name/yk/ykush/package.nix
index 778f19deee39..f8507e20849f 100644
--- a/pkgs/by-name/yk/ykush/package.nix
+++ b/pkgs/by-name/yk/ykush/package.nix
@@ -8,15 +8,15 @@
 }:
 stdenv.mkDerivation (final: {
   pname = "ykushcmd";
-  version = "1.2.5";
+  version = "1.4.0";
 
   buildInputs = [ libusb1 ];
 
   src = fetchFromGitHub {
     owner = "yepkit";
     repo = "ykush";
-    tag = "${final.version}";
-    hash = "sha256-FbqlXh8A5hzpthBE3jZ1LLOMs4WcEGke3sOZi9vmZF8=";
+    tag = "v${final.version}";
+    hash = "sha256-+ssr1QHKjEdK8pFkmyHYwG9tY7YHaYcIIJUqaEXixOg=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index b224fb1abd45..1e4f24cbc83f 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -27,9 +27,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.7".officialRelease.sha256 = "sha256-SaRJ7+iZMhhBdcUDuJpMAY4REQVhrvYMqI2aq3Kz08o=";
     "22.0.0-git".gitRelease = {
-      rev = "185f5fd5ce4c65116ca8cf6df467a682ef090499";
-      rev-version = "22.0.0-unstable-2025-12-21";
-      sha256 = "sha256-NcDH3JspWmq6B3wFy4wkbAzdpsKJojrJpQyAIm7qFdQ=";
+      rev = "2c72af88213c0f9c507d9c8b34a39de8173a6fcc";
+      rev-version = "22.0.0-unstable-2025-12-28";
+      sha256 = "sha256-R7WcZLas5+a4gUDzG0EBLL1S56PvUBZM6c91nYhmEsQ=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 3e1a38195ac4..e54a8077d761 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -1,8 +1,6 @@
 {
   lib,
   clangStdenv,
-  buildPackages,
-  runCommand,
   fetchurl,
   perl,
   python3,
@@ -65,7 +63,7 @@
   bubblewrap,
   libseccomp,
   libbacktrace,
-  systemd,
+  systemdLibs,
   xdg-dbus-proxy,
   replaceVars,
   glib,
@@ -74,7 +72,7 @@
   enableGeoLocation ? true,
   enableExperimental ? false,
   withLibsecret ? true,
-  systemdSupport ? lib.meta.availableOn clangStdenv.hostPlatform systemd,
+  systemdSupport ? lib.meta.availableOn clangStdenv.hostPlatform systemdLibs,
   testers,
   fetchpatch,
 }:
@@ -191,7 +189,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     xorg.libX11
   ]
   ++ lib.optionals systemdSupport [
-    systemd
+    systemdLibs
   ]
   ++ lib.optionals enableGeoLocation [
     geoclue2
diff --git a/pkgs/development/ocaml-modules/ezgzip/default.nix b/pkgs/development/ocaml-modules/ezgzip/default.nix
new file mode 100644
index 000000000000..49ec207f46b5
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ezgzip/default.nix
@@ -0,0 +1,37 @@
+{
+  alcotest,
+  astring,
+  buildDunePackage,
+  camlzip,
+  fetchurl,
+  lib,
+  ocplib-endian,
+  qcheck,
+  rresult,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "ezgzip";
+  version = "0.2.3";
+  src = fetchurl {
+    url = "https://github.com/hcarty/ezgzip/releases/download/v${finalAttrs.version}/ezgzip-v${finalAttrs.version}.tbz";
+    hash = "sha256-iGju25j4Oy1T8JGoJ9ubeltOm6U4u8CAyRtKxLr2edQ=";
+  };
+  propagatedBuildInputs = [
+    astring
+    camlzip
+    ocplib-endian
+    rresult
+  ];
+  checkInputs = [
+    alcotest
+    qcheck
+  ];
+  doCheck = true;
+  meta = {
+    description = "Simple gzip (de)compression library";
+    homepage = "https://github.com/hcarty/ezgzip";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+})
diff --git a/pkgs/development/ocaml-modules/reason-react/default.nix b/pkgs/development/ocaml-modules/reason-react/default.nix
index a447c3172d60..148a79fe5cee 100644
--- a/pkgs/development/ocaml-modules/reason-react/default.nix
+++ b/pkgs/development/ocaml-modules/reason-react/default.nix
@@ -5,7 +5,7 @@
   reason-react-ppx,
 }:
 
-buildDunePackage {
+buildDunePackage (finalAttrs: {
   pname = "reason-react";
   inherit (reason-react-ppx) version src;
   nativeBuildInputs = [
@@ -25,4 +25,4 @@ buildDunePackage {
   meta = reason-react-ppx.meta // {
     description = "Reason bindings for React.js";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/reason-react/ppx.nix b/pkgs/development/ocaml-modules/reason-react/ppx.nix
index d81cbf021849..578a35604678 100644
--- a/pkgs/development/ocaml-modules/reason-react/ppx.nix
+++ b/pkgs/development/ocaml-modules/reason-react/ppx.nix
@@ -3,18 +3,21 @@
   fetchurl,
   lib,
   ppxlib,
+  version ? if lib.versionAtLeast ppxlib.version "0.36" then "0.17.0" else "0.16.0",
 }:
 
-let
-  version = "0.16.0";
-in
-buildDunePackage {
+buildDunePackage (finalAttrs: {
   pname = "reason-react-ppx";
   inherit version;
   minimalOCamlVersion = "4.14";
   src = fetchurl {
-    url = "https://github.com/reasonml/reason-react/releases/download/${version}/reason-react-${version}.tbz";
-    hash = "sha256-esPB+mvHHTQ3mUYILrkOjMELJxRDIsWleFcxIwOPQ1w=";
+    url = "https://github.com/reasonml/reason-react/releases/download/${finalAttrs.version}/reason-react-${finalAttrs.version}.tbz";
+    hash =
+      {
+        "0.16.0" = "sha256-esPB+mvHHTQ3mUYILrkOjMELJxRDIsWleFcxIwOPQ1w=";
+        "0.17.0" = "sha256-ArZ6CL1UjcGYPBvGnvQX7Qa16+mQT3T8mETHprT/MYw=";
+      }
+      ."${finalAttrs.version}";
   };
   buildInputs = [ ppxlib ];
   doCheck = false; # Needs to run in reason-react, see default.nix
@@ -23,6 +26,5 @@ buildDunePackage {
     homepage = "https://github.com/reasonml/reason-react";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vog ];
-    broken = lib.versionAtLeast ppxlib.version "0.36";
   };
-}
+})
diff --git a/pkgs/development/python-modules/deltachat2/default.nix b/pkgs/development/python-modules/deltachat2/default.nix
index d7f7b7113812..d23e2f8b6105 100644
--- a/pkgs/development/python-modules/deltachat2/default.nix
+++ b/pkgs/development/python-modules/deltachat2/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "deltachat2";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adbenitez";
     repo = "deltachat2";
     tag = version;
-    hash = "sha256-RVEohIFILAaCGuOwq6VmK7qLOKKP4cTuTMX+9DBO+Ns=";
+    hash = "sha256-/Q524yoY25kcRNYgFw2k/lJJ3ydVN3hhoaC571nh1cw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/langchain-mistralai/default.nix b/pkgs/development/python-modules/langchain-mistralai/default.nix
index fb5812ecbd34..130f01f33fea 100644
--- a/pkgs/development/python-modules/langchain-mistralai/default.nix
+++ b/pkgs/development/python-modules/langchain-mistralai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-mistralai";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-mistralai==${version}";
-    hash = "sha256-dmuDgKQW1yAz/8tjQx7LaUiuz5Sh4cAyd9nt33mCPbI=";
+    hash = "sha256-cdUl6LusttH6c0tBvaxQR5UGHjwyubKELCDv61VQ6Qo=";
   };
 
   sourceRoot = "${src.name}/libs/partners/mistralai";
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 7ae45f470ff2..6d6a2f2eaad9 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "moyopy";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "moyo";
     tag = "v${version}";
-    hash = "sha256-jocBC0jP0gx8RsmLuV5RjQm3+XDMAEhO+v55ao5GIqE=";
+    hash = "sha256-3NL2++a2OxasgoEZbyo9/bfKDxH7e1J/kaKiwvygAZY=";
   };
 
   sourceRoot = "${src.name}/moyopy";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-mGePfCIg2xREmFmIs05oAJvzL22XbLr3yG5VyV46/nQ=";
+    hash = "sha256-nNKc+U3T6Iv8UqrkKlgCsehBGzjCjvEhTJMLRge27h4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 1ec87b3943bd..d9873bbfde06 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-data";
-  version = "1.2.10";
+  version = "1.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = version;
-    hash = "sha256-9SxIslA/gfIe1lboWuK5/Ya7trMhVJokf7X3P0XyELE=";
+    hash = "sha256-Verxvo81rFphT1fV6fs6JaVM/kSVqni9Zn5rq5Yq3rU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index e42ba01767db..9832b8f52abc 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     repo = "scs-python";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-MC63xCZxJsHOiarMsQYtXljTV8xdIfJHzkUG5mV63NA=";
+    hash = "sha256-ZxbQ1WbavDKKYBmGB2W0zMVCH/WZIk8bFJ5TmC+QqYc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/torchio/default.nix b/pkgs/development/python-modules/torchio/default.nix
index 8411f4438727..c6c1c3d2899a 100644
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "torchio";
-  version = "0.21.0";
+  version = "0.21.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TorchIO-project";
     repo = "torchio";
     tag = "v${version}";
-    hash = "sha256-y3p5LdBC/O82GVroA5B0PNC5qRwVjNbiNroJrV1iU/A=";
+    hash = "sha256-ut1uRak87J5b1bjLkupUB2HZEog8WVFwLMHNtNhmC4s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 83322dd12397..332e980ce69f 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "7.6.7";
+  version = "7.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-S0Y+BylUR9BwOWZP524oCBskGRNHpQNDfwQqjDniGc4=";
+    hash = "sha256-F2sb3JgbNjbmgS5o9vUCWOBgII4Vv2E8Ml6ijTQA8D8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 6672d00ec7b4..660526711ba8 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -29,11 +29,6 @@
         "hash": "sha256:1cvxvwlmnqw71nf6nizf0hpp710a8dsczz5bjwy3i55qwkzwa0lm",
         "lts": true
     },
-    "6.17": {
-        "version": "6.17.13",
-        "hash": "sha256:1fgdy9j90yfd4c2yqdciasdhda14pbfrpzkgriin2r6i7bf04s0i",
-        "lts": false
-    },
     "6.18": {
         "version": "6.18.2",
         "hash": "sha256:0smrmbnlhfivw2kx689wd52aff80gf0gw9wqz4s2nja9nyx6p32m",
diff --git a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
index 4211a2ce3bf4..496225940afc 100644
--- a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
@@ -3,6 +3,7 @@
   buildHomeAssistantComponent,
   fetchFromGitHub,
   beautifulsoup4,
+  cloudscraper,
   icalendar,
   icalevents,
   lxml,
@@ -13,17 +14,18 @@
 buildHomeAssistantComponent rec {
   owner = "mampfes";
   domain = "waste_collection_schedule";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hacs_waste_collection_schedule";
     tag = version;
-    hash = "sha256-qFeo2VE0sgBq4dwOUm26Vkgi+rv/0PsOyQhlVEJ45aE=";
+    hash = "sha256-+yt6kjUV+fqbOa7jj603XdGX7XtI8mXnCnmUjYFNA7c=";
   };
 
   dependencies = [
     beautifulsoup4
+    cloudscraper
     icalendar
     icalevents
     lxml
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4fcd6266e643..181e875e7708 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -368,6 +368,7 @@ mapAliases {
   blockbench-electron = throw "'blockbench-electron' has been renamed to/replaced by 'blockbench'"; # Converted to throw 2025-10-27
   bloomeetunes = throw "bloomeetunes is unmaintained and has been removed"; # Added 2025-08-26
   bmap-tools = throw "'bmap-tools' has been renamed to/replaced by 'bmaptool'"; # Converted to throw 2025-10-27
+  bob = throw "'bob' has been removed as it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-12-29
   botan2 = throw "botan2 has been removed as it is EOL"; # Added 2025-10-20
   bower2nix = throw "bower2nix has been removed as bower was removed. It is recommended to migrate to yarn."; # Added 2025-09-17
   brasero-original = throw "'brasero-original' has been renamed to/replaced by 'brasero-unwrapped'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 821abfb26474..96a9f223aa00 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -196,14 +196,6 @@ in
           ];
         };
 
-        linux_6_17 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.17";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
         linux_6_18 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "6.18";
           kernelPatches = [
@@ -293,6 +285,7 @@ in
         linux_6_14 = throw "linux 6.14 was removed because it has reached its end of life upstream";
         linux_6_15 = throw "linux 6.15 was removed because it has reached its end of life upstream";
         linux_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream";
+        linux_6_17 = throw "linux 6.17 was removed because it has reached its end of life upstream";
 
         linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
         linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
@@ -734,7 +727,6 @@ in
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
-    linux_6_17 = recurseIntoAttrs (packagesFor kernels.linux_6_17);
     linux_6_18 = recurseIntoAttrs (packagesFor kernels.linux_6_18);
   }
   // lib.optionalAttrs config.allowAliases {
@@ -747,6 +739,7 @@ in
     linux_6_14 = throw "linux 6.14 was removed because it reached its end of life upstream"; # Added 2025-06-22
     linux_6_15 = throw "linux 6.15 was removed because it reached its end of life upstream"; # Added 2025-08-23
     linux_6_16 = throw "linux 6.16 was removed because it reached its end of life upstream"; # Added 2025-10-22
+    linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22
   };
 
   rtPackages = {
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7635223d55dc..5bcdeeae5423 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -577,6 +577,8 @@ let
 
         extunix = callPackage ../development/ocaml-modules/extunix/default.nix { };
 
+        ezgzip = callPackage ../development/ocaml-modules/ezgzip { };
+
         ezjsonm = callPackage ../development/ocaml-modules/ezjsonm { };
 
         ezjsonm-encoding = callPackage ../development/ocaml-modules/ezjsonm-encoding { };