diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1c3501da8a1d..2c763bbf13a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -498,6 +498,12 @@
     githubId = 567653;
     name = "Andreas Schmid";
   };
+  aashiks = {
+    email = "services@inflo.ws";
+    github = "aashiks";
+    githubId = 202316;
+    name = "Ashik Salahudeen";
+  };
   abaldeau = {
     email = "andreas@baldeau.net";
     github = "baldo";
@@ -28809,6 +28815,12 @@
     githubId = 41830259;
     name = "Thomas Marchand";
   };
+  th1nkk1d = {
+    email = "witheep@gmail.com";
+    github = "Th1nkK1D";
+    githubId = 8860448;
+    name = "Withee Poositasai";
+  };
   thall = {
     email = "niclas.thall@gmail.com";
     github = "thall";
diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index 57d6c3eb8b64..fc80faf73504 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -232,7 +232,7 @@ in
         // {
           default = true;
         };
-      createDB = mkEnableOption "the automatic creation of the database for immich." // {
+      createDB = mkEnableOption "the automatic creation of the database for immich" // {
         default = true;
       };
       name = mkOption {
@@ -325,41 +325,43 @@ in
         search_path = "\"$user\", public, vectors";
       };
     };
-    systemd.services.postgresql-setup.serviceConfig.ExecStartPost =
-      let
-        extensions = [
-          "unaccent"
-          "uuid-ossp"
-          "cube"
-          "earthdistance"
-          "pg_trgm"
-          "vector"
-          "vchord"
+    systemd.services.postgresql-setup = mkIf cfg.database.enable {
+      serviceConfig.ExecStartPost =
+        let
+          extensions = [
+            "unaccent"
+            "uuid-ossp"
+            "cube"
+            "earthdistance"
+            "pg_trgm"
+            "vector"
+            "vchord"
+          ];
+          sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
+            -- save previous version of vectorchord to trigger reindex on update
+            SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
+
+            ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions}
+            ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions}
+            ALTER SCHEMA public OWNER TO ${cfg.database.user};
+
+            -- trigger reindex if vectorchord updates
+            -- https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
+            SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
+
+            SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
+            \if :has_vchord_updated
+              REINDEX INDEX face_index;
+              REINDEX INDEX clip_index;
+            \endif
+          '';
+        in
+        [
+          ''
+            ${lib.getExe' cfg.database.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
+          ''
         ];
-        sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
-          -- save previous version of vectorchord to trigger reindex on update
-          SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
-
-          ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions}
-          ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions}
-          ALTER SCHEMA public OWNER TO ${cfg.database.user};
-
-          -- trigger reindex if vectorchord updates
-          -- https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
-          SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
-
-          SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
-          \if :has_vchord_updated
-            REINDEX INDEX face_index;
-            REINDEX INDEX clip_index;
-          \endif
-        '';
-      in
-      [
-        ''
-          ${lib.getExe' cfg.database.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
-        ''
-      ];
+    };
 
     services.redis.servers = mkIf cfg.redis.enable {
       immich = {
diff --git a/nixos/modules/tasks/filesystems/vboxsf.nix b/nixos/modules/tasks/filesystems/vboxsf.nix
index 3271351a5bca..3cc4b222f755 100644
--- a/nixos/modules/tasks/filesystems/vboxsf.nix
+++ b/nixos/modules/tasks/filesystems/vboxsf.nix
@@ -13,7 +13,7 @@ let
 
   package = pkgs.runCommand "mount.vboxsf" { preferLocalBuild = true; } ''
     mkdir -p $out/bin
-    cp ${pkgs.linuxPackages.virtualboxGuestAdditions}/bin/mount.vboxsf $out/bin
+    cp ${config.virtualisation.virtualbox.guest.package}/bin/mount.vboxsf $out/bin
   '';
 in
 
diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix
index 882cdf1f0cde..2ce02175b178 100644
--- a/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/nixos/modules/virtualisation/virtualbox-guest.nix
@@ -7,7 +7,6 @@
 }:
 let
   cfg = config.virtualisation.virtualbox.guest;
-  kernel = config.boot.kernelPackages;
 
   mkVirtualBoxUserService = serviceArgs: verbose: {
     description = "VirtualBox Guest User Services ${serviceArgs}";
@@ -25,7 +24,7 @@ let
     preStart = "${pkgs.bash}/bin/bash -c \"if [ -z $DISPLAY ]; then exit 1; fi\"";
     serviceConfig = {
       ExecStart =
-        "@${kernel.virtualboxGuestAdditions}/bin/VBoxClient"
+        "@${cfg.package}/bin/VBoxClient"
         + (lib.strings.optionalString verbose " --verbose")
         + " --foreground ${serviceArgs}";
       # Wait after a failure, hoping that the display environment is ready after waiting
@@ -66,6 +65,10 @@ in
       description = "Whether to enable the VirtualBox service and other guest additions.";
     };
 
+    package = lib.mkPackageOption config.boot.kernelPackages "virtualboxGuestAdditions" {
+      pkgsText = "config.boot.kernelPackages";
+    };
+
     clipboard = lib.mkOption {
       default = true;
       type = lib.types.bool;
@@ -115,9 +118,9 @@ in
           }
         ];
 
-        environment.systemPackages = [ kernel.virtualboxGuestAdditions ];
+        environment.systemPackages = [ cfg.package ];
 
-        boot.extraModulePackages = lib.mkIf cfg.use3rdPartyModules [ kernel.virtualboxGuestAdditions ];
+        boot.extraModulePackages = lib.mkIf cfg.use3rdPartyModules [ cfg.package ];
 
         systemd.services.virtualbox = {
           description = "VirtualBox Guest Services";
@@ -128,7 +131,7 @@ in
 
           unitConfig.ConditionVirtualization = "oracle";
 
-          serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground";
+          serviceConfig.ExecStart = "@${cfg.package}/bin/VBoxService VBoxService --foreground";
         };
 
         users.groups.vboxuserdev = { };
diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
index ff7628853bd8..bb7cc1b93f0b 100644
--- a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
@@ -55,7 +55,7 @@ jetbrains.mkJetBrainsProduct {
   product = "PyCharm Open Source";
   productShort = "PyCharm";
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     # keep-sorted start
     jetbrains.cythonDebugSpeedupsHook
     python3
diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm.nix b/pkgs/applications/editors/jetbrains/ides/pycharm.nix
index b47fa3e6fa30..70806a3004ae 100644
--- a/pkgs/applications/editors/jetbrains/ides/pycharm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm.nix
@@ -51,7 +51,7 @@ jetbrains.mkJetBrainsProduct {
     else
       null;
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     # keep-sorted start
     jetbrains.cythonDebugSpeedupsHook
     python3
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
index a6d7ed216b54..a8f34d27136d 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "4.0.5";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-wwb1u6Kpz3Nm0MMmo3OMtzWukeEEFsX4JjC+K/EaRQ4=";
+    hash = "sha256-7jJrPKEhJup9p0GJhb3W0NvIPpOOzwqcDRKj9/qaOkc=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
index 39b79420732b..d50770932428 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
@@ -1,26 +1,26 @@
 {
-  stdenv,
-  kernel,
-  fetchurl,
-  lib,
-  pam,
-  libxslt,
-  libxext,
-  libxcursor,
-  libxmu,
-  glib,
-  libxrandr,
   dbus,
-  xz,
+  fetchurl,
+  glib,
+  lib,
+  libxcrypt,
+  libxcursor,
+  libxext,
+  libxmu,
+  libxrandr,
+  libxslt,
+  linuxHeaders,
+  makeself,
+  openssl,
+  pam,
+  patchelf,
   pkg-config,
+  stdenv,
   which,
   xorg-server,
   xrandr,
+  xz,
   yasm,
-  patchelf,
-  makeself,
-  linuxHeaders,
-  openssl,
   virtualboxVersion,
   virtualboxSubVersion,
   virtualboxSha256,
@@ -31,7 +31,7 @@ let
   buildType = "release";
 in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "VirtualBox-GuestAdditions-builder-${kernel.version}";
+  pname = "VirtualBox-GuestAdditions-builder";
   version = "${virtualboxVersion}${virtualboxSubVersion}";
 
   inherit virtualboxVersion virtualboxSubVersion;
@@ -53,8 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
     linuxHeaders
     xz
-  ]
-  ++ kernel.moduleBuildDependencies;
+    libxcrypt
+  ];
+
   buildInputs = [
     dbus
     libxslt
@@ -65,9 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxrandr
   ];
 
-  KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  KERN_INCL = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/source/include";
-
   prePatch = ''
     rm -r src/VBox/Additions/x11/x11include/
     rm -r src/VBox/Additions/3D/mesa/mesa-*/
@@ -139,7 +137,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     ./configure \
       --only-additions \
-      --with-linux=${kernel.dev} \
       --disable-kmods
 
     sed -e 's@PKG_CONFIG_PATH=.*@PKG_CONFIG_PATH=${glib.dev}/lib/pkgconfig @' \
diff --git a/pkgs/build-support/rocq/default.nix b/pkgs/build-support/rocq/default.nix
index 996acbed09e7..9e0e4d956d87 100644
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -177,7 +177,7 @@ let
     "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
   ];
   docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${rocq-core.rocq-version}/user-contrib" ];
-  COQUSERCONTRIB = "$out/lib/coq/${rocq-core.rocq-version}/user-contrib";
+  ROCQUSERCONTRIB = "$out/lib/coq/${rocq-core.rocq-version}/user-contrib";
 in
 
 stdenv.mkDerivation (
@@ -209,7 +209,8 @@ stdenv.mkDerivation (
         }
         // optionalAttrs (setROCQBIN && useCoq) { COQBIN = "${rocq-core}/bin/"; }
         // optionalAttrs (args ? useMelquiondRemake) {
-          inherit COQUSERCONTRIB;
+          inherit ROCQUSERCONTRIB;
+          COQUSERCONTRIB = ROCQUSERCONTRIB;
         }
         // (args.env or { });
 
@@ -259,7 +260,7 @@ stdenv.mkDerivation (
     })
     // (optionalAttrs (args ? useMelquiondRemake) {
       preConfigurePhases = [ "autoconf" ];
-      configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
+      configureFlags = [ "--libdir=${ROCQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
       buildPhase = "./remake -j$NIX_BUILD_CORES";
       installPhase = "./remake install";
     })
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index e67578db1b82..73de41bbe6eb 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -84,7 +84,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "5.0.1.5";
+  version = "5.0.3.0";
 
   __structuredAttrs = true;
 
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-pSuKAv/Vy4k9kCotIzN1g5NbnyUG/6hDeuQQcGOt5Ow=";
+    hash = "sha256-ryKvEy4Oj6PP0WTs+XWqHSVInrVhP0tZcQqgs7gHOls=";
     fetchSubmodules = true;
     # Preserve VCS metadata needed by the build before .git is removed.
     postCheckout = ''
@@ -204,6 +204,8 @@ stdenv.mkDerivation (finalAttrs: {
     export PREM_V1_ENDPOINT="${prem-v1-endpoint}"
   '';
 
+  cmakeFlags = [ "-DCLIENT_ENABLE_APP_UPDATES=0" ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/as/aspcud/package.nix b/pkgs/by-name/as/aspcud/package.nix
index 5d83cc86be8c..6ea1d69aa2c3 100644
--- a/pkgs/by-name/as/aspcud/package.nix
+++ b/pkgs/by-name/as/aspcud/package.nix
@@ -53,6 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://potassco.org/aspcud/";
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.hakuch ];
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.mit;
   };
 })
diff --git a/pkgs/by-name/ca/cargo-arc/package.nix b/pkgs/by-name/ca/cargo-arc/package.nix
index 64152e835437..26fd61f1f667 100644
--- a/pkgs/by-name/ca/cargo-arc/package.nix
+++ b/pkgs/by-name/ca/cargo-arc/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-arc";
-  version = "0.3.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "seflue";
     repo = "cargo-arc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tAES0CP7kGS9RYDsXqiVc/Q8q/APci5m55kTjpIAXNg=";
+    hash = "sha256-FmsbcDbWNSyG1c4XQCh1Zd/WITNFI/Qe1FP103wvY4U=";
   };
 
-  cargoHash = "sha256-kqFHu1+BYQQZKCr1WVAWoTzuwkPNfxY34jhtffN9MVE=";
+  cargoHash = "sha256-JbPjicHFQ+o3fxQvP6ArhP+ymaDMqBDHtg6a1XE4+Pw=";
 
   checkFlags = [
     # Tries to create temp dir
diff --git a/pkgs/by-name/ca/cargo-deb/package.nix b/pkgs/by-name/ca/cargo-deb/package.nix
index 1c6f3ec8d6d3..51ae22d88bcf 100644
--- a/pkgs/by-name/ca/cargo-deb/package.nix
+++ b/pkgs/by-name/ca/cargo-deb/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   makeWrapper,
   dpkg,
+  stdenv, # for meta.broken
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -13,7 +14,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "cargo-deb";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-KiWQq2WEAoSTuMWRi2dSWiH7yq4R80zSK6pTh0jiE/M=";
   };
 
@@ -48,6 +49,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Cargo subcommand that generates Debian packages from information in Cargo.toml";
     mainProgram = "cargo-deb";
     homepage = "https://github.com/kornelski/cargo-deb";
diff --git a/pkgs/by-name/ca/cargo-semver-checks/package.nix b/pkgs/by-name/ca/cargo-semver-checks/package.nix
index a4cf210527ef..e438bbd7c912 100644
--- a/pkgs/by-name/ca/cargo-semver-checks/package.nix
+++ b/pkgs/by-name/ca/cargo-semver-checks/package.nix
@@ -7,6 +7,7 @@
   testers,
   cargo-semver-checks,
   nix-update-script,
+  writableTmpDirAsHomeHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -26,6 +27,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cmake
   ];
 
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
   buildInputs = [
     zlib
   ];
diff --git a/pkgs/by-name/cl/clickable/package.nix b/pkgs/by-name/cl/clickable/package.nix
index 329d0742d1a9..f0b2f1cbc9fa 100644
--- a/pkgs/by-name/cl/clickable/package.nix
+++ b/pkgs/by-name/cl/clickable/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "clickable";
-  version = "8.9.0";
+  version = "8.10.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "clickable";
     repo = "clickable";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hrtAx/RKBlVf8cguPAGd55/m0D6YLu678f+aqeIzRos=";
+    hash = "sha256-OCwGaV4IsX2Tcd8vcCZ+hYrCHuq9ADm3O81UdH3roAA=";
   };
 
   __structuredAttrs = true;
@@ -48,30 +48,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # Expects /tmp to exist and not be a symlink
     # https://gitlab.com/clickable/clickable/-/issues/479
     "TestReviewCommand and test_run and not test_run_with_path_arg"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
-    # pytest's lack of exact nodeid matching or deselecting makes it impossible to nicely disable just
-    # test_architectures.py::TestArchitectures::test_arch (infix matching makes test_arch match test_architectures.py).
-    # Have to `or` for every other TestArchitectures test and then `not` that.
-    # What we want to disable: test_arch & test_restricted_arch
-    # Reason: they hardcode amd64
-    "TestArchitectures and not (${
-      lib.strings.concatStringsSep " or " [
-        "test_arch_agnostic"
-        "test_default_arch"
-        "test_fail_arch_agnostic"
-        "test_fail_in_restricted_arch"
-        "test_restricted_arch_env"
-      ]
-    })"
-
-    # no -ide images on non-x86_64
-    # https://gitlab.com/clickable/clickable/-/issues/478
-    "TestIdeQtCreatorCommand and test_command_overrided"
-    "TestIdeQtCreatorCommand and test_init_cmake_project"
-    "TestIdeQtCreatorCommand and test_initialize_qtcreator_conf"
-    "TestIdeQtCreatorCommand and test_project_pre_configured"
-    "TestIdeQtCreatorCommand and test_recurse_replace"
   ];
 
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
diff --git a/pkgs/by-name/co/comma/package.nix b/pkgs/by-name/co/comma/package.nix
index ce5265eada53..9d42164a537d 100644
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@@ -64,6 +64,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --bash <(${emulator} $out/bin/comma --print-completions bash) \
         --fish <(${emulator} $out/bin/comma --print-completions fish) \
         --zsh <(${emulator} $out/bin/comma --print-completions zsh)
+
+      installShellCompletion --cmd , \
+        --bash <(${emulator} $out/bin/, --print-completions bash) \
+        --fish <(${emulator} $out/bin/, --print-completions fish) \
+        --zsh <(${emulator} $out/bin/, --print-completions zsh)
     '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/co/containerd/package.nix b/pkgs/by-name/co/containerd/package.nix
index 27818892dfa4..59fd03ee39d4 100644
--- a/pkgs/by-name/co/containerd/package.nix
+++ b/pkgs/by-name/co/containerd/package.nix
@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.3.5";
+  version = "2.4.0";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-RIZxlXwgOizLVKr4XRIKAlUP19URolGp4J849hoQMSM=";
+    hash = "sha256-Oj2issWNh6kH4C3hVjSliThDiIKHgVMXIiFgkvqvxm4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/context7-mcp/package.nix b/pkgs/by-name/co/context7-mcp/package.nix
index 2fb31d1f01da..6df154d8528b 100644
--- a/pkgs/by-name/co/context7-mcp/package.nix
+++ b/pkgs/by-name/co/context7-mcp/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "4.0.3";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-Fe3XOepVceEYsEJYL4wqJFH0us/5d62B5WI8pvVsaqw=";
+    hash = "sha256-T0jxHt26GUm5oM3l8dPkw0FeQu0WBhxyz3xAj1XGD/8=";
   };
 
   nativeBuildInputs = [
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-1ZrQ+GMGgBNyycp/Xp2/meGwxaWTh+c53qgaEy30dl8=";
+    hash = "sha256-lgFTZ2HvGrCdN//s4brHq1o26vTopyvVhZyzwiSSW9Y=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/da/dankcalendar/package.nix b/pkgs/by-name/da/dankcalendar/package.nix
new file mode 100644
index 000000000000..7b8a8562787e
--- /dev/null
+++ b/pkgs/by-name/da/dankcalendar/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
+  stdenv,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dankcalendar";
+  version = "1.6.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "AvengeMedia";
+    repo = "dankcalendar";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-Gaa6FkFLuX4g2oivHypbs6f8zf9wRWny5sAIndNDj7A=";
+  };
+
+  modRoot = "core";
+
+  vendorHash = "sha256-sCGKtWWOzARUz+whX6tDfWTYb8jIGO3o4fhndMGCm9c=";
+
+  subPackages = [ "cmd/dcal" ];
+
+  # Embeds the quickshell UI into the binary, as upstream's Makefile does for
+  # releases. Untagged builds carry no UI and require an external shell dir.
+  tags = [ "withshell" ];
+
+  postPatch = ''
+    make -C core sync-shell
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    install -Dm644 $src/assets/com.danklinux.dankcalendar.desktop \
+      $out/share/applications/com.danklinux.dankcalendar.desktop
+    install -Dm644 $src/assets/com.danklinux.dankcalendar.svg \
+      $out/share/icons/hicolor/scalable/apps/com.danklinux.dankcalendar.svg
+
+    install -Dm644 $src/assets/systemd/dcal.service \
+      $out/lib/systemd/user/dcal.service
+    substituteInPlace $out/lib/systemd/user/dcal.service \
+      --replace-fail /usr/bin/dcal $out/bin/dcal
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd dcal \
+      --bash <($out/bin/dcal completion bash) \
+      --fish <($out/bin/dcal completion fish) \
+      --zsh <($out/bin/dcal completion zsh)
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Local, Google, Microsoft, and CalDAV calendars for the dank desktop";
+    homepage = "https://github.com/AvengeMedia/dankcalendar";
+    changelog = "https://github.com/AvengeMedia/dankcalendar/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.th1nkk1d ];
+    teams = [ lib.teams.danklinux ];
+    mainProgram = "dcal";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/di/distribution/package.nix b/pkgs/by-name/di/distribution/package.nix
index fa4d6c2db891..3d91c8a4255a 100644
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "distribution";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "distribution";
     repo = "distribution";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KsN3QW71VwGrgrhOmwzzmTm/54+ZaTFj5kNgbta1FmI=";
+    hash = "sha256-mTyg/+tYSm00XGj1DttAHPKzAfEM13D8PXe1C9N9OB4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ec/ecs-agent/package.nix b/pkgs/by-name/ec/ecs-agent/package.nix
index c14c0929bdb9..5f17a1bb9bea 100644
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "amazon-ecs-agent";
-  version = "1.106.2";
+  version = "1.107.0";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-OMoAsHqcr6DGlRP4PLWmX5RxlpP4UlPQEEpWzmyL9hQ=";
+    hash = "sha256-OLYLvURlGAYod8rL/GjFvoEUC0rytrsqQyHMXH0PKd8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fc/fcitx5-lotus/package.nix b/pkgs/by-name/fc/fcitx5-lotus/package.nix
index 3bdec1647191..bf5c51d6d123 100644
--- a/pkgs/by-name/fc/fcitx5-lotus/package.nix
+++ b/pkgs/by-name/fc/fcitx5-lotus/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fcitx5-lotus";
-  version = "3.5.9";
+  version = "3.5.10";
 
   src = fetchFromGitHub {
     owner = "LotusInputMethod";
     repo = "fcitx5-lotus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kOIs8nLSF93xDIU7v8Wldyw+Zs5NEMJqZA/42TN4oYM=";
+    hash = "sha256-Ti4O0wyUYVyGzFmlG8SN3wusoM8TlsbmI60BPyaS0RU=";
     fetchSubmodules = true;
   };
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
         pname = "fcitx5-lotus-go-modules";
         inherit (finalAttrs) version src;
         modRoot = "bamboo";
-        vendorHash = "sha256-CNDYjxDfqh9nGs5vlpb/7qXZeNtkvegC5nPvBOZcDrc=";
+        vendorHash = "sha256-0Q8axcw5UKrODpe5oU0yWiBykPWNPuun1161MUgnrlM=";
       }).goModules;
 
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/fo/font-smc-anjalioldlipi/package.nix b/pkgs/by-name/fo/font-smc-anjalioldlipi/package.nix
new file mode 100644
index 000000000000..54904309797c
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-anjalioldlipi/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-anjalioldlipi";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/anjalioldlipi/anjalioldlipi.zip";
+    hash = "sha256-c3ScpdN2h39Q6GLFL97pBBGrsillcMXmhlGilOAdF1w=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A traditional style Malayalam font, designed by Kevin Siji. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/anjalioldlipi";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-chilanka/package.nix b/pkgs/by-name/fo/font-smc-chilanka/package.nix
new file mode 100644
index 000000000000..8d4393422591
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-chilanka/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-chilanka";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/chilanka/chilanka.zip";
+    hash = "sha256-z+pRvm/8alA3TbUBuR4oDD/kpvuXJTqOBlzXEKBZvnE=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Chilanka is a Malayalam handwriting style font designed by Santhosh Thottingal. It follows the common style one can see in everyday handwriting of Malayalam. It has a comprehensive Malayalam glyph set that contains most of the unique Malayalam conjuncts. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/chilanka";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-dyuthi/package.nix b/pkgs/by-name/fo/font-smc-dyuthi/package.nix
new file mode 100644
index 000000000000..d3cd57b68d32
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-dyuthi/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-dyuthi";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/dyuthi/dyuthi.zip";
+    hash = "sha256-H+2ccvHmlZjtH8KfWBSQKPtMkY/NsydHqFNaTzLS4S8=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Dyuthi is the first decorative Unicode font for Malayalam, designed by Hiran Venugopalan. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/dyuthi";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-gayathri/package.nix b/pkgs/by-name/fo/font-smc-gayathri/package.nix
new file mode 100644
index 000000000000..89dbf47ba983
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-gayathri/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-gayathri";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/gayathri/gayathri.zip";
+    hash = "sha256-p9KZi31Na4hfUuDsKj4OXjc9s6J/8xMeuszlL5oVauQ=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A gentle and modern Malayalam display typeface. Available in three weights, Gayathri is best suited for headlines, posters, titles and captions. Unicode compliant and libre licensed. Designed by Binoy Dominic. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/gayathri";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-karumbi/package.nix b/pkgs/by-name/fo/font-smc-karumbi/package.nix
new file mode 100644
index 000000000000..7fe1a867082b
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-karumbi/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-karumbi";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/karumbi/karumbi.zip";
+    hash = "sha256-aeKH7CWbJNtkgv1PsaWWxyBZor+UO9q9Cctpc/qnEQU=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "The Karumbi opentype font is a Malayalam traditional script font designed by Kevin Siji. The characters are literally written directly into a computer by Kevin Siji using a tablet pen. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/karumbi";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-keraleeyam/package.nix b/pkgs/by-name/fo/font-smc-keraleeyam/package.nix
new file mode 100644
index 000000000000..ddf9bc7f0a03
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-keraleeyam/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-keraleeyam";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/keraleeyam/keraleeyam.zip";
+    hash = "sha256-UEhDtBaWof/2C36IapGhtYgdeQInUn+A/UAJIF7+RuA=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Traditional-style Malayalam typeface designed by K H Hussain. This is the last version maintained by SMC";
+    homepage = "https://smc.org.in/fonts/keraleeyam";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-malini/package.nix b/pkgs/by-name/fo/font-smc-malini/package.nix
new file mode 100644
index 000000000000..dfba2c6f59cc
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-malini/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-malini";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/malini/Malini.zip";
+    hash = "sha256-2Go6HNy2s2ZcybkuhM62UhwLehnrMMoG89YHDldflZs=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Malini is a variable typeface designed for reading long-form Malayalam text set at body sizes, where clarity and typographic color matter most. Designed by Santhosh Thottingal. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/malini";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-manjari/package.nix b/pkgs/by-name/fo/font-smc-manjari/package.nix
new file mode 100644
index 000000000000..3479933c2e74
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-manjari/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-manjari";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/manjari/manjari.zip";
+    hash = "sha256-Sq/7UOBO54c3id6FMZeOmnZTRceEkMAAN8W+C7v7Mtw=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "This is a multipurpose font suitable for body and titles. This font is available in regular, bold, thin style variants. The glyph shapes follow a spiral theme, true to the beautiful curves of Malayalam. The font has comprehensive glyph set including all widely used ligatures. Designed by Santhosh Thottingal. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/manjari";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-meera/package.nix b/pkgs/by-name/fo/font-smc-meera/package.nix
new file mode 100644
index 000000000000..6340c3bacd74
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-meera/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-meera";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/meera/meera.zip";
+    hash = "sha256-yaqA2gYKc4OJ9YxmvQPUZ3qZFyKj0YciMaUoY1SST4I=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Meera font is a Malayalam font designed by Hussain K H and maintained by Swathanthra Malayalam Computing project. This is a comprehensive Malayalam font with 1000+ glyphs for all common Malayalam ligatures. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/meera";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-nupuram/package.nix b/pkgs/by-name/fo/font-smc-nupuram/package.nix
new file mode 100644
index 000000000000..ce9695b1c2e4
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-nupuram/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-nupuram";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  srcs = [
+    (fetchzip {
+      name = "Nupuram-Arrows-Color";
+      url = "https://smc.org.in/downloads/fonts/nupuram/Nupuram-Arrows-Color.zip";
+      hash = "sha256-tqDnDCvqE7TF0Yp4wdBfQRJKDfixftCzaXdOLQL9NLQ=";
+      stripRoot = false;
+    })
+    (fetchzip {
+      name = "Nupuram-Calligraphy";
+      url = "https://smc.org.in/downloads/fonts/nupuram/Nupuram-Calligraphy.zip";
+      hash = "sha256-Cc4A4qvbAUC2+e7HmMdRJtk8lR60UU4qcXbQIPhNCR0=";
+      stripRoot = false;
+    })
+    (fetchzip {
+      name = "Nupuram-Color";
+      url = "https://smc.org.in/downloads/fonts/nupuram/Nupuram-Color.zip";
+      hash = "sha256-vH+HQ38jgYVJ5c6jp7jXPjNNIjRFJ0MDGs62+rdUd5U=";
+      stripRoot = false;
+    })
+    (fetchzip {
+      name = "Nupuram-Dots";
+      url = "https://smc.org.in/downloads/fonts/nupuram/Nupuram-Dots.zip";
+      hash = "sha256-nlBAJUJru9q0F+nXJowAhCssN2DnunPei0ZhED2A2qA=";
+      stripRoot = false;
+    })
+  ];
+
+  sourceRoot = ".";
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Nupuram is a Malayalam variable typeface inspired by the early Malayalam movie title designs of the 1960s–70s, particularly the work of title designer S. Appukkuttan Nair. This is a superfamily of related typefaces. Designed by Santhosh Thottingal. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/nupuram";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-rachana/package.nix b/pkgs/by-name/fo/font-smc-rachana/package.nix
new file mode 100644
index 000000000000..9585710636c5
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-rachana/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-rachana";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/rachana/rachana.zip";
+    hash = "sha256-csfMs4B6BD+yap/AaWpm4kQDsR/WNMrym6szM5iZNJo=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Rachana is one of the first traditional orthographic Malayalam unicode typefaces and is still widely used. Designed by K H Hussain. This is the last version maintained by SMC.";
+    homepage = "https://smc.org.in/fonts/rachana";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-raghumalayalamsans/package.nix b/pkgs/by-name/fo/font-smc-raghumalayalamsans/package.nix
new file mode 100644
index 000000000000..23fdfe57b8e2
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-raghumalayalamsans/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-raghumalayalamsans";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/raghumalayalamsans/raghumalayalamsans.zip";
+    hash = "sha256-rSM77MiFqRzs67mme8xkJZkw13esB9eG13j8OzytCaA=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A collaborative effort of Hussain K H, Prof. R. K. Joshi (TypeFont Design Director), Mr. Rajith Kumar K. M. (TypeFont Designer), assisted by Mr. Nirmal Biswas, Ms. Jui Mhatre and Ms. Supriya Kharkar at C-DAC Mumbai. This is the last version maintained by SMC";
+    homepage = "https://smc.org.in/fonts/raghumalayalamsans";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-suruma/package.nix b/pkgs/by-name/fo/font-smc-suruma/package.nix
new file mode 100644
index 000000000000..2cdc0eabc408
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-suruma/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-suruma";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/suruma/suruma.zip";
+    hash = "sha256-x4ybBr5oCwD5Stu8rRGndOYRzaV6ikE+VnLJ/src+1U=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Suruma is a traditional orthography font designed by Suresh P. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/suruma";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/fo/font-smc-uroob/package.nix b/pkgs/by-name/fo/font-smc-uroob/package.nix
new file mode 100644
index 000000000000..981c9dd4f921
--- /dev/null
+++ b/pkgs/by-name/fo/font-smc-uroob/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "font-smc-uroob";
+  version = "20241013";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchzip {
+    url = "https://smc.org.in/downloads/fonts/uroob/uroob.zip";
+    hash = "sha256-IJcKD3cDRMA7G7foKtXtJxOrv6OeOujkq9+uGo+R/dY=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name "*.otf" -exec install -Dm644 {} -t "$out/share/fonts/opentype" \;
+    find . -name "*.ttf" -exec install -Dm644 {} -t "$out/share/fonts/truetype" \;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Uroob is a Malayalam heading style font designed by Hussain K H. Maintained by SMC";
+    homepage = "https://smc.org.in/fonts/uroob";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ aashiks ];
+  };
+})
diff --git a/pkgs/by-name/ga/gauge-unwrapped/package.nix b/pkgs/by-name/ga/gauge-unwrapped/package.nix
index fd4c924ef582..de2cf581cd58 100644
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gauge";
-  version = "1.6.35";
+  version = "1.6.38";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "getgauge";
     repo = "gauge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WsyW4xlKCZO4xvvVr+O+WbmkQHp0RmXGD+HBcilMgo=";
+    hash = "sha256-maU/LKLyXTcLp+oAA/3mJakM/guoysCSYpgGf29tYb4=";
   };
 
-  vendorHash = "sha256-nQM3Ss4xQCkkOrJ1S2s0tdDr5O9SrmPnvT3Y4Ekz600=";
+  vendorHash = "sha256-uU5pX81/va0RSpEn1jgWZGbuz5uA3DqwM4/yf3BvRbM=";
 
   excludedPackages = [
     "build"
diff --git a/pkgs/by-name/gi/git-cliff/package.nix b/pkgs/by-name/gi/git-cliff/package.nix
index c26c6bf2291e..6b5c45d3a98a 100644
--- a/pkgs/by-name/gi/git-cliff/package.nix
+++ b/pkgs/by-name/gi/git-cliff/package.nix
@@ -43,7 +43,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Highly customizable Changelog Generator that follows Conventional Commit specifications";
     homepage = "https://github.com/orhun/git-cliff";
     changelog = "https://github.com/orhun/git-cliff/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = lib.licenses.gpl3Only;
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       siraben
       matthiasbeyer
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index 79ea1d21f1ab..68082733f049 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -23,15 +23,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "1.0.83";
+  version = "1.0.88";
 
   src = fetchurl {
     url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/github-copilot-${finalAttrs.version}-${platform}.tgz";
     hash =
       {
-        "aarch64-darwin" = "sha256-ns0TDgpzuRBacGodZrQCwK1KzFYYMeojb//lY1O0Xgc=";
-        "x86_64-linux" = "sha256-iI+Pu0V1wzWvukqIY8ZH7wT4HlEkx8eUvcrukMX6RQM=";
-        "aarch64-linux" = "sha256-NkIkBUiYKRySBVmWrgkUQ1n9GPGZ84m49IgJsQXDhg0=";
+        "aarch64-darwin" = "sha256-SfXKoFgpRaBMVhn46oFoCxyMJ2WIgpDPis+QPimFMVs=";
+        "x86_64-linux" = "sha256-w4YmnuG/RLrFFNorsMaypHVGYx8C4pT8Wowg0bG5kP8=";
+        "aarch64-linux" = "sha256-OMULaI8oE9VwRsm8C0CHLSA9xhoJ9HbfyOW2w2anY4w=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index a9e69e9a6421..fad97bdb074a 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -14,16 +14,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "golangci-lint";
-  version = "2.13.2";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RbWKPIG+UK82S9W9tp/CciZ669vudh95VOfHfdQWx3M=";
+    hash = "sha256-HATA7JKHwEouM+8jYZbQrkX7p4gut4IpyTvcBexu/4o=";
   };
 
-  vendorHash = "sha256-R83GeyfuZ+w30jZqFGYi0yua8E1Ey2q7/OlVmw8zDCg=";
+  vendorHash = "sha256-ekP/zDhYMpMG+tYAyYHNfLOCt/JkxrXUw1jHUEfsM8k=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/by-name/h2/h2/package.nix b/pkgs/by-name/h2/h2/package.nix
index e213425d32cc..8bf8ba66fcb8 100644
--- a/pkgs/by-name/h2/h2/package.nix
+++ b/pkgs/by-name/h2/h2/package.nix
@@ -9,7 +9,7 @@
 
 maven.buildMavenPackage (finalAttrs: {
   pname = "h2";
-  version = "2.4.240";
+  version = "2.5.252";
 
   outputs = [
     "out"
@@ -20,7 +20,7 @@ maven.buildMavenPackage (finalAttrs: {
     owner = "h2database";
     repo = "h2database";
     tag = "version-${finalAttrs.version}";
-    hash = "sha256-Cy6MoumJBhhcYT6dCHWeOfmhjGRkdNvSONdIiZaf6uU=";
+    hash = "sha256-5nzV5g5z9hxavJkOgf5Zi2j9/1iyXVGEluLwrplX2J4=";
   };
 
   mvnParameters = "-f h2/pom.xml";
diff --git a/pkgs/by-name/is/isabelle/package.nix b/pkgs/by-name/is/isabelle/package.nix
index 48cb33b840f8..7f2053965fa8 100644
--- a/pkgs/by-name/is/isabelle/package.nix
+++ b/pkgs/by-name/is/isabelle/package.nix
@@ -56,9 +56,9 @@ let
   vampire' =
     (vampire.override {
       stdenv = vampireStdenv;
-      z3' = null;
+      enableZ3 = false;
     }).overrideAttrs
-      (_: {
+      (old: {
         pname = "vampire-for-isabelle";
         version = "4.8";
 
@@ -75,9 +75,8 @@ let
           mv $out/bin/vampire_rel $out/bin/vampire
         '';
 
-        cmakeFlags = [
+        cmakeFlags = old.cmakeFlags ++ [
           (lib.cmakeFeature "CMAKE_BUILD_HOL" "On")
-          (lib.cmakeFeature "CMAKE_DISABLE_FIND_PACKAGE_Z3" "On")
         ];
       });
 
diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index 23245de80291..163c67e0578e 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-09-14";
+  version = "0-unstable-2026-09-24";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "e5177b5829c4ef521c3552f55f9080a3561d6216";
-    hash = "sha256-cnGfEBTJYEqDNCmR8Wcbetm2qhhgMCh1LpzXBKKXdvA=";
+    rev = "07f9ecf48bce9376dec21a8b4b40659621b7b651";
+    hash = "sha256-Q8XDsddW2e49ORhuKjnQWjciF1+QT+v361zd8fLnibI=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/ja/jackett/deps.json b/pkgs/by-name/ja/jackett/deps.json
index 691a93559d21..5a4ef49c0a21 100644
--- a/pkgs/by-name/ja/jackett/deps.json
+++ b/pkgs/by-name/ja/jackett/deps.json
@@ -6,8 +6,8 @@
   },
   {
     "pname": "AngleSharp",
-    "version": "1.7.1",
-    "hash": "sha256-GH/AJ8aNoPixvsUIeTRvZH5T9rmQV+dk1QnpLBz/tGc="
+    "version": "1.8.1",
+    "hash": "sha256-77LU4Kgtw2seb1IeY6sbc8MiLjU/oQKtxsP2OmeeLZM="
   },
   {
     "pname": "AngleSharp.Xml",
@@ -61,54 +61,54 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "9.0.19",
-    "hash": "sha256-XPsSeFa0wITp9+biWgvNcgr1BL1CbYcF/hTn+cTNOWs="
+    "version": "9.0.20",
+    "hash": "sha256-iIl7wSYVWKi8rvA7DNue1uRModxXcB3IuPDnRV1FdVo="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection",
-    "version": "9.0.19",
-    "hash": "sha256-NA7D/y1ERjUsc4up1fm6Yo/3NIBOi1sRnpX95A7fpe0="
+    "version": "9.0.20",
+    "hash": "sha256-OBzVXrcdQPJNpePiDnfN9hzBrVVqX+r1bYZ55DHW8x0="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-fndKWkxrJkY+r7Lv8wINW4uKG5N7mg1O7AEO7qaXmjY="
+    "version": "9.0.20",
+    "hash": "sha256-TfT9ugJ5CS3waqZX0Lf509GXVTI/H5u0Uua6i/lr7/E="
   },
   {
     "pname": "Microsoft.AspNetCore.Http",
-    "version": "2.3.12",
-    "hash": "sha256-aXJG/CHxIdPr2Lhcr9iVrQLQLFGL74pQSoIpIdxSDsQ="
+    "version": "2.3.13",
+    "hash": "sha256-jsx9DjIhnAi3Vjj5X6fLk2/RSx0CHb2Vo1o1ySiKxQw="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Abstractions",
-    "version": "2.3.11",
-    "hash": "sha256-TZ29MQF9aJ+Iy3NSszVVDypEv7wXhWfLf5dp1uxxuCA="
+    "version": "2.3.12",
+    "hash": "sha256-sUVALuHYiUaafAar4rTpzoy8qupNEHUOb2yMyWQQbfM="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Features",
-    "version": "2.3.10",
-    "hash": "sha256-XD/AU/0g+jriODowOVSPKGrjyQV1OlDrICmAq6xGJ9g="
+    "version": "2.3.11",
+    "hash": "sha256-cBy44q+ZSkY4DHpPamOAyVmPPiK+s2K8oOShk53VEMs="
   },
   {
     "pname": "Microsoft.AspNetCore.JsonPatch",
-    "version": "9.0.19",
-    "hash": "sha256-6kBV2zvRNS8SMsOdxW0lxjU7E0YvrD/4WP8bX2GXtag="
+    "version": "9.0.20",
+    "hash": "sha256-N0DEFIpeeOSF1vh5JOxgAJYj5eFYwRTMeveAGVOlcI4="
   },
   {
     "pname": "Microsoft.AspNetCore.Mvc.NewtonsoftJson",
-    "version": "9.0.19",
-    "hash": "sha256-j9Gc0hFdHhTQYXiUfZIJs1l8LOh5yfJ1Pge3qr1HlJg="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.WebUtilities",
-    "version": "2.3.11",
-    "hash": "sha256-HAGuLuTRLkTTcP9oqRpqPYQmIzQTecUWHI/UTAJ2iMY="
+    "version": "9.0.20",
+    "hash": "sha256-0qYAdcqkSWEhS8RRzW4gH1vT8DrXGVJsrCL+8CfVh1w="
   },
   {
     "pname": "Microsoft.AspNetCore.WebUtilities",
     "version": "2.3.12",
     "hash": "sha256-js0KyvQlV2ZeQxuLHU8dNj6N1szO3xP3RPo0tpGjPFo="
   },
+  {
+    "pname": "Microsoft.AspNetCore.WebUtilities",
+    "version": "2.3.13",
+    "hash": "sha256-pATeIF5YFKEJt8VFQ42U2NHPnFi8MVpQoAxGqfnvHtk="
+  },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "6.0.0",
@@ -126,8 +126,8 @@
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "9.0.19",
-    "hash": "sha256-7K4FZvcCfZ1vkd5Q3B1Vbd6kURvqlwT960Y79YxAP5E="
+    "version": "9.0.20",
+    "hash": "sha256-hKpZvzllStoABMCtJb5sX6aS+xb4AqMtbQRBZVCyReE="
   },
   {
     "pname": "Microsoft.Bcl.TimeProvider",
@@ -146,8 +146,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.19",
-    "hash": "sha256-/pAqE0AtGGYanAmk83vjrwNXIjwpHf5l1x3fJfTsnko="
+    "version": "9.0.20",
+    "hash": "sha256-Ie6LHGt33P0BWd7R9uZttTKdR2rC4jrFSSORtZMgn4I="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -156,8 +156,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-C6zP/A5xBGd4tj+pV7XRL0IInYAB36OqMFP1/DD2dH4="
+    "version": "9.0.20",
+    "hash": "sha256-55kxS9PTEzX1W77MDbrTlx2/BIImwd//oY24oh4llJg="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
@@ -171,23 +171,23 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-gUwYr6vb5Y+Nl2PtBgx4xrYgMz6/OgIZNz9hv3cm7aQ="
+    "version": "9.0.20",
+    "hash": "sha256-PkIyJiGugaYdNz2phYFOdohqVVN+AiUmJXoUW+c8sRk="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-UfntG1BQUaDIzlJr4+QBDSiqgz90MTnXBQQoyoMtdLk="
+    "version": "9.0.20",
+    "hash": "sha256-IH+7yYBlBmdjvvm+8N0L2t54BefO6z5ZPoU7l2dsvU8="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-WryzNdWfXpJLY1PqDnO6K9/EXYVK/p0HnxJn7cdi/kI="
+    "version": "9.0.20",
+    "hash": "sha256-XjUJOhM+L0I5oP872+MwjDq/23GRB1QrBDMTdcxZ4GQ="
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-Bk5FEVg4eotiX1jh62XrVnnXhw2tqpIhGuVJ7opfnMQ="
+    "version": "9.0.20",
+    "hash": "sha256-RlbC8WUtfeU1beJueI8EcElHkMmuSVVo0Re2fp9EYa8="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -201,8 +201,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "9.0.19",
-    "hash": "sha256-NUEhzO7a6dhWCLkGA+Op4+60S4jWSDZmh/WH0gr81Yk="
+    "version": "9.0.20",
+    "hash": "sha256-3sE4HSIGIGzStqNyJvALfmE6jcb44cZ6Z+MOOVi/lO8="
   },
   {
     "pname": "Microsoft.Extensions.ObjectPool",
@@ -221,8 +221,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "9.0.19",
-    "hash": "sha256-mUd8YqUvGJZSaV7vJ1RN7T/+fU81dwblBLATS8QmxxY="
+    "version": "9.0.20",
+    "hash": "sha256-hTwxuDdtzif5tCU/99RzYwvw3UirTaluO1LPSKX6xVM="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
@@ -231,13 +231,13 @@
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "9.0.19",
-    "hash": "sha256-/DpiE48An/Ir7IVQ6+U3FY/e7LcJE1ED4U8mdBu0F4Q="
+    "version": "9.0.20",
+    "hash": "sha256-GFjEzz6ravQ2BZdWIHZgCfVl3C+/nBVRFaI8D1sP4jQ="
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
-    "version": "2.3.11",
-    "hash": "sha256-/6ttqU89/nmwSk6KmlbpoKsWqRyS9f0NhvxpnLF0s7E="
+    "version": "2.3.12",
+    "hash": "sha256-oXMVH/BY9JjpZ7Rr5wPc1911mJI3vqxe+W9ZYnuyffE="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -401,13 +401,13 @@
   },
   {
     "pname": "Polly",
-    "version": "8.7.0",
-    "hash": "sha256-iMNusWW+4nuIvkNLUaoru23Roe9vpC140TOIHbLvewE="
+    "version": "8.8.0",
+    "hash": "sha256-ZV7xox4nUTjMLoHDWFJQuGs6pffDhsefkwHkmGSZwr4="
   },
   {
     "pname": "Polly.Core",
-    "version": "8.7.0",
-    "hash": "sha256-1AT4Xym9hn2Awgul9WErwXk2bBPN58P9XfRExrIPItg="
+    "version": "8.8.0",
+    "hash": "sha256-Qz675JdkvZJkcYFWRuwIzXGiiOUYUcXnDHvd3UmnlDg="
   },
   {
     "pname": "SharpZipLib",
@@ -461,8 +461,8 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "9.0.19",
-    "hash": "sha256-0wH4FC8pNPr/ImPjID4Eo+MNagrqzQ58p7QLLFWek7g="
+    "version": "9.0.20",
+    "hash": "sha256-62i3HS/znDdNyuXGP2BL4/kTeyvIKdU/C1cQlaeJRRg="
   },
   {
     "pname": "System.Drawing.Common",
@@ -486,8 +486,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "9.0.19",
-    "hash": "sha256-Rh+QmhasR1YKSUlczvC7DyQF2NTSFo4+CL+CkflUcjc="
+    "version": "9.0.20",
+    "hash": "sha256-/2APo7XOf5SADlbI1tq6L+v7PmDRbVZ1Wu0OUZBl3wU="
   },
   {
     "pname": "System.Memory",
@@ -541,8 +541,8 @@
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "9.0.19",
-    "hash": "sha256-NwRsuisjPKTvju0emRUkn2FTvgHMeqyr98SbToq9Y4U="
+    "version": "9.0.20",
+    "hash": "sha256-pO091N5dCajT5McRP5Tg0j+MLdcidHzaW/BxlNAXvSE="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
@@ -551,13 +551,13 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.19",
-    "hash": "sha256-f+9uhACebKboLUKT/W1XaRd73QyxA/EloGKx7JKn/8s="
+    "version": "9.0.20",
+    "hash": "sha256-UdaQyLCL7aeqiSDCimQO9TAcAKvaL9+byDLSuWR/rD0="
   },
   {
     "pname": "System.Security.Cryptography.Xml",
-    "version": "9.0.19",
-    "hash": "sha256-SXeOC+lW55jDpSSm+d1dbops2PH/UBiPp4FsJ/hJOvQ="
+    "version": "9.0.20",
+    "hash": "sha256-4pFYoAMS7CYnKweD/7LlmnFmFflVcKk9V7hHh/IAllM="
   },
   {
     "pname": "System.Security.Permissions",
@@ -571,13 +571,13 @@
   },
   {
     "pname": "System.ServiceProcess.ServiceController",
-    "version": "9.0.19",
-    "hash": "sha256-wbc8AJNktbSvBZOPFEgpUjt4SnTTG8Tyj3O5OLA4jq8="
+    "version": "9.0.20",
+    "hash": "sha256-ESJi72H/5JW8QC6yL/1Z0Nf0C0xCjfFXOokS04fNtAQ="
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "9.0.19",
-    "hash": "sha256-M+NQmMFdvckrIeucrG7MGu5+OyQsOMrcvM6soY+GcJU="
+    "version": "9.0.20",
+    "hash": "sha256-fz5IgKNlq4tpOAqgCeR01lkxL6ukoC8XZcgIoLM/N7A="
   },
   {
     "pname": "System.Text.Encodings.Web",
@@ -586,13 +586,13 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "9.0.19",
-    "hash": "sha256-VsJS/iiDZp41BY4fcqGZZAh0PYT+H5N13FMPfFeBDX8="
+    "version": "9.0.20",
+    "hash": "sha256-K7SLnVL1MjkBJD2SeDRjZGtTEuRtssq23MzaQzoN388="
   },
   {
     "pname": "System.Text.Json",
-    "version": "9.0.19",
-    "hash": "sha256-GbQS+KeI1Q5c9oNG3zERALc52l8RIlgYKmvXNbvbC7M="
+    "version": "9.0.20",
+    "hash": "sha256-g+t+DTqDC7J2sebjBCVwlky31r3rYqO4NWF247zYRj0="
   },
   {
     "pname": "System.Threading.Tasks.Extensions",
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index 5a113fe11ae8..d3d3e0fee9e2 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2586";
+  version = "0.24.2663";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rYUkxFkMcClN+GFt/nFR/y+zLbgLF9CFQUvfwuwNpo0=";
+    hash = "sha256-zPPEFitw2g68EjUql8m7Ad+nFHAmTAC9bB6rmMb0d3w=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/ke/kew/package.nix b/pkgs/by-name/ke/kew/package.nix
index 8a4865306f5a..294d0976a9e3 100644
--- a/pkgs/by-name/ke/kew/package.nix
+++ b/pkgs/by-name/ke/kew/package.nix
@@ -34,13 +34,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kew";
-  version = "4.3.4";
+  version = "4.3.6";
 
   src = fetchFromGitHub {
     owner = "ravachol";
     repo = "kew";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zhvnPCxPm04kMOhfRBGB4EmTJITw17svVgD8zuHcu1c=";
+    hash = "sha256-Gp/A1UrbzjUFT2Og5OjaO1sHEcIYRkKSMluGdUBUA5g=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libretroPackages/cores/fbneo.nix b/pkgs/by-name/li/libretroPackages/cores/fbneo.nix
index e902cc97f722..1e2848300a68 100644
--- a/pkgs/by-name/li/libretroPackages/cores/fbneo.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-09-04";
+  version = "0-unstable-2026-09-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "a251c76229f1637e433b93e29845039752771b6d";
-    hash = "sha256-AV+1fxtoK+1j7IFl3Mjai6gcfII0kenRdtj4tdl8lt4=";
+    rev = "aceeebed9e7edc8a28652365a064baee9a16e274";
+    hash = "sha256-uZiCA11S6HCXn9BevbtCEpNxqNUvqDOk2UL4XVhAIsw=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/li/libretroPackages/cores/mame.nix b/pkgs/by-name/li/libretroPackages/cores/mame.nix
index e01e337e7bdb..db08deea0c95 100644
--- a/pkgs/by-name/li/libretroPackages/cores/mame.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/mame.nix
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-09-04";
+  version = "0-unstable-2026-09-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "4fc9a9312baaf34963847f884961ad9793fbbc1d";
-    hash = "sha256-X/5zagYp2ma2HkIG46ttDrcElQ8695FvvKeDb6EDOvY=";
+    rev = "9069f39340f2d2b1795df8e71bb1d3d0fbc76598";
+    hash = "sha256-mZMddr5uaJusRKkFet2c0/M//FOnx1hFB92Ios84RVI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ll/llmfit/package.nix b/pkgs/by-name/ll/llmfit/package.nix
index cab25a1e7b89..2da65a30b9ec 100644
--- a/pkgs/by-name/ll/llmfit/package.nix
+++ b/pkgs/by-name/ll/llmfit/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "llmfit";
-  version = "1.1.10";
+  version = "1.1.15";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "AlexsJones";
     repo = "llmfit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i7eYn7g664dDtaBAeh9Y8yIDLy6tWPKXIWDrD4Drajg=";
+    hash = "sha256-rAlWEpoHuh03sU+Ma9LqvjNMq8/1x8e0MAQRmt4etk4=";
   };
 
-  cargoHash = "sha256-1lK/zNcSei/DRInfl2I3EanmuXk0LqRVyFF7G3bJPXU=";
+  cargoHash = "sha256-RN5f0TGnhi2FrekmVmEYONU59g+akuewwCOj6kfcBjw=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ne/netbox/package.nix b/pkgs/by-name/ne/netbox/package.nix
index 1f4b1019198e..249f5c8a072d 100644
--- a/pkgs/by-name/ne/netbox/package.nix
+++ b/pkgs/by-name/ne/netbox/package.nix
@@ -162,6 +162,7 @@ py.pkgs.buildPythonApplication (finalAttrs: {
     maintainers = with lib.maintainers; [
       minijackson
       transcaffeine
+      felbinger
     ];
   };
 })
diff --git a/pkgs/by-name/ng/ngt/package.nix b/pkgs/by-name/ng/ngt/package.nix
index 9ba79113f481..5fe67345df7a 100644
--- a/pkgs/by-name/ng/ngt/package.nix
+++ b/pkgs/by-name/ng/ngt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "NGT";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "NGT-labs";
     repo = "NGT";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-GLCAyLUYdCQHnJzFC75tzqhy5gsoxZ8/vQBME3Ah2Do=";
+    sha256 = "sha256-yVxiVLk4LvvLfNmUrRl47obNR1iS1JHeq1biqWY+nj4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/np/np2kai/package.nix b/pkgs/by-name/np/np2kai/package.nix
index 3245c09ad3fb..947addd0aa32 100644
--- a/pkgs/by-name/np/np2kai/package.nix
+++ b/pkgs/by-name/np/np2kai/package.nix
@@ -121,8 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "PC-9801 series emulator";
     homepage = "https://github.com/AZO234/NP2kai";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ OPNA2608 ];
+    # Information on the repo is untrustworthy.
+    # This is a fork from the original np2, which lacked any licensing information for most of its code -> Unfree
+    license = lib.licenses.unfree;
+    maintainers = [ ];
     mainProgram = "${if enableX11 then "x" else "sdl"}np21kai";
     platforms = lib.platforms.x86;
   };
diff --git a/pkgs/by-name/nu/numkong/package.nix b/pkgs/by-name/nu/numkong/package.nix
index 7b61ba0d1f3d..d5f4d8359f9b 100644
--- a/pkgs/by-name/nu/numkong/package.nix
+++ b/pkgs/by-name/nu/numkong/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "numkong";
-  version = "7.8.2";
+  version = "7.8.3";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ashvardanian";
     repo = "NumKong";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wn1qpPKdbWUJ5Gy4hnX9XcEneFvgrijGuI+v1F9+9EE=";
+    hash = "sha256-GOs4NsTUBUWuAZX4Hy0+bpCrvq5HfzpgHzRDs60mZ/I=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/oc/octorus/package.nix b/pkgs/by-name/oc/octorus/package.nix
index 3357a2f74baf..1780b6b2cfe6 100644
--- a/pkgs/by-name/oc/octorus/package.nix
+++ b/pkgs/by-name/oc/octorus/package.nix
@@ -2,23 +2,45 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  installShellFiles,
+  writableTmpDirAsHomeHook,
+  gitMinimal,
+  gh,
+  makeWrapper,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "octorus";
-  version = "0.3.5";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "ushironoko";
     repo = "octorus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xVbLh1fe+59KxcZOtCoSAh6O+VdhAyBSGCPP3UZLidA=";
+    hash = "sha256-qwWCH/Yu9idxaOMNMlSM/RTJgSkpFSyV8VcmnK7DTqI=";
   };
 
-  cargoHash = "sha256-mOHjNQWeEcoBS4OhPj5RRja+b1PCPAeOM49t7OUtx1s=";
+  cargoHash = "sha256-wFPeBzbR+/n4gd0y15ToN2XRfsxsCu9if+XT6UTa1GI=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  nativeCheckInputs = [
+    gitMinimal
+    writableTmpDirAsHomeHook
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/or \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          gh
+          gitMinimal
+        ]
+      }
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
   meta = {
     description = "TUI PR review tool for GitHub";
@@ -27,7 +49,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer
+      kangazero
     ];
-    mainProgram = "octorus";
+    mainProgram = "or";
   };
 })
diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index 2880b3839b54..d907dfdb3dad 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium";
-  version = "0.0.40-alpha";
+  version = "0.0.42-alpha";
 
   src = fetchurl {
     url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-3rnDG3erDi7anPbOjTq5F5j/HB0f4z1XrDRmDRJgPFw=";
+    hash = "sha256-AI9hrCHa0gfI/m7zGUzAagyypgfKSgm2cVnn9LH1I0g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/palemoon-bin/package.nix b/pkgs/by-name/pa/palemoon-bin/package.nix
deleted file mode 100644
index 181ba7f2bc08..000000000000
--- a/pkgs/by-name/pa/palemoon-bin/package.nix
+++ /dev/null
@@ -1,234 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchzip,
-  alsa-lib,
-  autoPatchelfHook,
-  copyDesktopItems,
-  # ffmpeg 7 not supported yet, results in MP4 playback being unavailable
-  # https://repo.palemoon.org/MoonchildProductions/UXP/issues/2523
-  ffmpeg_6,
-  gtk2-x11,
-  withGTK3 ? true,
-  gtk3,
-  libglvnd,
-  libxt,
-  libpulseaudio,
-  makeDesktopItem,
-  wrapGAppsHook3,
-  writeScript,
-  testers,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "palemoon-bin";
-  version = "34.3.2.1";
-
-  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
-
-  preferLocalBuild = true;
-
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    alsa-lib
-    gtk2-x11
-    libxt
-    (lib.getLib stdenv.cc.cc)
-  ]
-  ++ lib.optionals withGTK3 [
-    gtk3
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "palemoon-bin";
-      desktopName = "Pale Moon Web Browser";
-      comment = "Browse the World Wide Web";
-      keywords = [
-        "Internet"
-        "WWW"
-        "Browser"
-        "Web"
-        "Explorer"
-      ];
-      exec = "palemoon %u";
-      terminal = false;
-      type = "Application";
-      icon = "palemoon";
-      categories = [
-        "Network"
-        "WebBrowser"
-      ];
-      mimeTypes = [
-        "text/html"
-        "text/xml"
-        "application/xhtml+xml"
-        "application/xml"
-        "application/rss+xml"
-        "application/rdf+xml"
-        "image/gif"
-        "image/jpeg"
-        "image/png"
-        "x-scheme-handler/http"
-        "x-scheme-handler/https"
-        "x-scheme-handler/ftp"
-        "x-scheme-handler/chrome"
-        "video/webm"
-        "application/x-xpinstall"
-      ];
-      startupNotify = true;
-      startupWMClass = "Pale moon";
-      extraConfig = {
-        X-MultipleArgs = "false";
-      };
-      actions = {
-        "NewTab" = {
-          name = "Open new tab";
-          exec = "palemoon -new-tab https://start.palemoon.org";
-        };
-        "NewWindow" = {
-          name = "Open new window";
-          exec = "palemoon -new-window";
-        };
-        "NewPrivateWindow" = {
-          name = "Open new private window";
-          exec = "palemoon -private-window";
-        };
-        "ProfileManager" = {
-          name = "Open the Profile Manager";
-          exec = "palemoon --ProfileManager";
-        };
-      };
-    })
-  ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib/palemoon}
-    cp -R * $out/lib/palemoon/
-
-    ln -s $out/{lib/palemoon,bin}/palemoon
-
-    for iconpath in chrome/icons/default/default{16,32,48} icons/mozicon128; do
-      n=''${iconpath//[^0-9]/}
-      size=$n"x"$n
-      mkdir -p $out/share/icons/hicolor/$size/apps
-      ln -s $out/lib/palemoon/browser/"$iconpath".png $out/share/icons/hicolor/$size/apps/palemoon.png
-    done
-
-    # Disable built-in updater
-    # https://forum.palemoon.org/viewtopic.php?f=5&t=25073&p=197771#p197747
-    # > Please do not take this as permission to change, remove, or alter any other preferences as that is forbidden
-    # > without express permission according to the Pale Moon Redistribution License.
-    # > We are allowing this one and **ONLY** one exception in order to properly facilitate [package manager] repacks.
-    install -Dm644 ${./zz-disableUpdater.js} $out/lib/palemoon/browser/defaults/preferences/zz-disableUpdates.js
-
-    runHook postInstall
-  '';
-
-  dontWrapGApps = true;
-
-  preFixup = ''
-    # Make optional dependencies available
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "${
-        lib.makeLibraryPath [
-          ffmpeg_6
-          libglvnd
-          libpulseaudio
-        ]
-      }"
-    )
-    wrapGApp $out/lib/palemoon/palemoon
-  '';
-
-  passthru = {
-    sources =
-      let
-        urlRegionVariants =
-          buildVariant:
-          map
-            (
-              region:
-              "https://rm-${region}.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-${buildVariant}.tar.xz"
-            )
-            [
-              "eu"
-              "us"
-            ];
-      in
-      {
-        gtk3 = fetchzip {
-          urls = urlRegionVariants "gtk3";
-          hash = "sha256-IjD3En6qNMeUWe4sX5eb2Y76pMlWDv/NOuQr3uKluiE=";
-        };
-        gtk2 = fetchzip {
-          urls = urlRegionVariants "gtk2";
-          hash = "sha256-o0vsOw1yxWURckqoq2rb9Acl6IyYenunEuy7Trb8VmM=";
-        };
-      };
-
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-    };
-
-    updateScript = writeScript "update-palemoon-bin" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p common-updater-scripts curl libxml2
-
-      set -eu -o pipefail
-
-      # Only release note announcement == finalized release
-      version="$(
-        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
-        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
-        sed 's/v\(\S*\).*/\1/'
-      )"
-
-      for variant in gtk3 gtk2; do
-        update-source-version palemoon-bin "$version" --ignore-same-version --source-key="sources.$variant"
-      done
-    '';
-  };
-
-  meta = {
-    homepage = "https://www.palemoon.org/";
-    description = "Open Source, Goanna-based web browser focusing on efficiency and customization";
-    longDescription = ''
-      Pale Moon is an Open Source, Goanna-based web browser focusing on
-      efficiency and customization.
-
-      Pale Moon offers you a browsing experience in a browser completely built
-      from its own, independently developed source that has been forked off from
-      Firefox/Mozilla code a number of years ago, with carefully selected
-      features and optimizations to improve the browser's stability and user
-      experience, while offering full customization and a growing collection of
-      extensions and themes to make the browser truly your own.
-    '';
-    changelog = "https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/${finalAttrs.version}_Release";
-    license = [
-      lib.licenses.mpl20
-      {
-        fullName = "Pale Moon Redistribution License";
-        url = "https://www.palemoon.org/redist.shtml";
-        # TODO free, redistributable? Has strict limitations on what modifications may be done & shipped by packagers
-      }
-    ];
-    maintainers = with lib.maintainers; [ OPNA2608 ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    mainProgram = "palemoon";
-    platforms = [ "x86_64-linux" ];
-    hydraPlatforms = [ ];
-  };
-})
diff --git a/pkgs/by-name/pa/palemoon-bin/zz-disableUpdater.js b/pkgs/by-name/pa/palemoon-bin/zz-disableUpdater.js
deleted file mode 100644
index 50b8a79f627a..000000000000
--- a/pkgs/by-name/pa/palemoon-bin/zz-disableUpdater.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/* https://forum.palemoon.org/viewtopic.php?f=5&t=25073&p=197771#p197747 */
-
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-pref("app.update.enabled", false);
diff --git a/pkgs/by-name/pa/palemoon-gtk2-bin/package.nix b/pkgs/by-name/pa/palemoon-gtk2-bin/package.nix
deleted file mode 100644
index 67f265c42e77..000000000000
--- a/pkgs/by-name/pa/palemoon-gtk2-bin/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  palemoon-bin,
-}:
-
-palemoon-bin.override {
-  withGTK3 = false;
-}
diff --git a/pkgs/by-name/pi/picom-pijulius/package.nix b/pkgs/by-name/pi/picom-pijulius/package.nix
index 1a02d5c13aaa..e4babb9a7c3d 100644
--- a/pkgs/by-name/pi/picom-pijulius/package.nix
+++ b/pkgs/by-name/pi/picom-pijulius/package.nix
@@ -8,13 +8,13 @@
 
 picom.overrideAttrs (previousAttrs: {
   pname = "picom-pijulius";
-  version = "8.2-unstable-2026-06-03";
+  version = "8.2-unstable-2026-09-22";
 
   src = fetchFromGitHub {
     owner = "pijulius";
     repo = "picom";
-    rev = "8f83eb54a690b1c52f1e4dbeb5ab5a42d66cc167";
-    hash = "sha256-CpQ8x/HrNx4IR+Qj+aBEQeKNRKNvXUPaUyNyj6ljBFg=";
+    rev = "a719ef3a40a2d70f3fc23e8dd055ef312b37f5db";
+    hash = "sha256-YhzrwqJFhvwI9aAVYzlcXAUkI5kKHBXzbLtvIP4s1Go=";
   };
 
   dontVersionCheck = true;
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index b2cddcac801f..f17d5d5f214a 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -14,18 +14,18 @@
 }:
 buildGo127Module (finalAttrs: {
   pname = "pocket-id";
-  version = "2.14.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4BtVTfjXu/V9l4L2ucabpQXjrTBEB4cTrO4tb/oE3YU=";
+    hash = "sha256-4dTXzw54mxOWG3hz+1wRJTpwbLWmHmKzxgFwT3yEOn0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";
 
-  vendorHash = "sha256-SrpUgyruwbIJZ1HB6sqidbGAwzBOqKcJzR+cH9E0siw=";
+  vendorHash = "sha256-koGfs+XwwMZbikN0aY8jprBWcK97SVFlmlOafNFg/CI=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
@@ -70,7 +70,7 @@ buildGo127Module (finalAttrs: {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 4;
-      hash = "sha256-KswQQVz2Xw/dG21134SObM3mQAKP2IHc+UM/BX/dvrI=";
+      hash = "sha256-MADbUI/SJSHZ9pAeeW6cOtmRP7+cTG0ol4zJTjA37mQ=";
     };
 
     env.BUILD_OUTPUT_PATH = "dist";
diff --git a/pkgs/by-name/qu/qui/package.nix b/pkgs/by-name/qu/qui/package.nix
index 73f854a09049..a9679ac14507 100644
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@@ -13,12 +13,12 @@
 }:
 buildGo127Module (finalAttrs: {
   pname = "qui";
-  version = "1.29.0";
+  version = "1.30.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GTW/kHy4UtBjQK8PugrHXso5wj5VOig3sOiv5PiJprQ=";
+    hash = "sha256-LoMTUeMABJMzTobwa3PwlX7ffDWm3C344ZGRaWiboT4=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -54,7 +54,7 @@ buildGo127Module (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-8po/cyG8R39NwNwszcvvo9LL1OceCptL671zU8E/NDg=";
+  vendorHash = "sha256-UbVFfSioo5SJmYT38RpCEA4j2bTQ7CFkZ+HhBC6TbNk=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist
diff --git a/pkgs/by-name/ro/rocketchat-desktop/package.nix b/pkgs/by-name/ro/rocketchat-desktop/package.nix
index c1ebd06b619c..b45c460129bf 100644
--- a/pkgs/by-name/ro/rocketchat-desktop/package.nix
+++ b/pkgs/by-name/ro/rocketchat-desktop/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocketchat-desktop";
-  version = "4.17.0";
+  version = "4.17.1";
 
   src = fetchFromGitHub {
     owner = "RocketChat";
     repo = "Rocket.Chat.Electron";
     tag = finalAttrs.version;
-    hash = "sha256-Z9yTtlpud3nCMVnyCTd0eYM3G/9UjrPu2sfTVirDR0k=";
+    hash = "sha256-6QA7dPuE70CLx7OD4s/a26Iya+L2Tx4yZ0cIsDjJPyY=";
 
     # Remove after upstream updates to Yarn 4.15
     # https://github.com/RocketChat/Rocket.Chat.Electron/blob/master/package.json#L187
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-VMCLYLuNAZQzfglLS6ncFCLOcmGsuXPR2J+q+Gn/CP4=";
+    hash = "sha256-NR0HJj8yHYaiDr8yhcoHxFHiO3zIJLXEMbG+gfBaMEY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/sparrow/package.nix b/pkgs/by-name/sp/sparrow/package.nix
index c3acb8a720b7..144842816ccb 100644
--- a/pkgs/by-name/sp/sparrow/package.nix
+++ b/pkgs/by-name/sp/sparrow/package.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "2.5.4";
+  version = "2.5.5";
 
   openjdk = zulu25.override { enableJavaFX = true; };
 
@@ -53,8 +53,8 @@ let
     url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrowwallet-${version}-${sparrowArch}.tar.gz";
     hash =
       {
-        x86_64-linux = "sha256-waMYAReGbkihnK8tntb+gP7Oyf34K4/bzFZdDTrse24=";
-        aarch64-linux = "sha256-hRg6THLofwZHTppXjEfxYSH5LjdsJ9N+Pq+uHFkYfFQ=";
+        x86_64-linux = "sha256-fopZv35yk72SRRjdqOp3R2lmNCl95Uh4wcX1zbUoVZ0=";
+        aarch64-linux = "sha256-E9DOz3juTDxDkO5dwfNUq4pI9a1B28BsQZfGpyTqCb4=";
       }
       ."${stdenvNoCC.hostPlatform.system}";
 
@@ -85,12 +85,12 @@ let
 
   manifest = fetchurl {
     url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrow-${version}-manifest.txt";
-    hash = "sha256-apDQg6FiyDcWeUCH1Iy5hg14yhMQkogbZwFv83qPBn0=";
+    hash = "sha256-/beBl+4nD9CZLQn0OsiZxWKaJTmyHaQi/devyImEJI8=";
   };
 
   manifestSignature = fetchurl {
     url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrow-${version}-manifest.txt.asc";
-    hash = "sha256-L2hCy+lbaZ6dh3bCQYVlpf+ankCLS9Y/7zcGKJ4iZa0=";
+    hash = "sha256-kk4rC68Ij/mUeSgX1bw7x4unUeriFsmcruBky1pbYro=";
   };
 
   publicKey = ./publickey.asc;
diff --git a/pkgs/by-name/st/stashcat/package.nix b/pkgs/by-name/st/stashcat/package.nix
new file mode 100644
index 000000000000..112e2e6429f4
--- /dev/null
+++ b/pkgs/by-name/st/stashcat/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  dpkg,
+  autoPatchelfHook,
+
+  # Required dependencies for autoPatchelfHook
+  gtk3,
+  libnotify,
+  nss,
+  libxscrnsaver,
+  libxtst,
+  xdg-utils,
+  at-spi2-atk,
+  libuuid,
+  libsecret,
+  libappindicator,
+  libgbm,
+  alsa-lib,
+  libGL,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+
+  pname = "stashcat";
+  version = "6.52.0";
+
+  src = fetchurl {
+    url = "http://deb.stashcat.com/repo01/dists/stashcat-dc/main/binary-amd64/stashcat-dc/${finalAttrs.pname}_${finalAttrs.version}_amd64.deb";
+    hash = "sha512-z+riGE4cRsDy/jugkAaGJiQx9uys0ynjrTehOyYskWLX8Nzvqh18VSrrlAxsc0rUXNY0bFDQpFhStSMmQWLC7g==";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    gtk3
+    libnotify
+    nss
+    libxscrnsaver
+    libxtst
+    xdg-utils
+    at-spi2-atk
+    libuuid
+    libsecret
+    libappindicator
+    libgbm
+    alsa-lib
+    libGL
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg-deb --fsys-tarfile $src | tar --extract
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{share,opt,bin}
+    cp -r usr/share/* $out/share/
+    cp -r opt/* $out/opt/
+
+    ln -s $out/opt/Stashcat/stashcat $out/bin/stashcat
+
+    substituteInPlace $out/share/applications/stashcat.desktop \
+      --replace-fail "Exec=/opt/Stashcat/stashcat %U" "Exec=$out/opt/Stashcat/stashcat %U"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.py;
+
+  meta = {
+    description = "Stashcat Desktop Messenger";
+    license = lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    homepage = "https://stashcat.com/";
+    mainProgram = "stashcat";
+    maintainers = with lib.maintainers; [
+      _365tuwe
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/st/stashcat/update.py b/pkgs/by-name/st/stashcat/update.py
new file mode 100755
index 000000000000..2608be7a8a90
--- /dev/null
+++ b/pkgs/by-name/st/stashcat/update.py
@@ -0,0 +1,161 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3Packages.packaging python3Packages.python-debian common-updater-scripts gnupg
+
+import hashlib
+import os
+import subprocess
+import sys
+import tempfile
+from collections import OrderedDict
+from urllib import request
+
+from debian.deb822 import Packages, Release
+from debian.debian_support import Version
+
+# The repo is http-only, so Packages (which carries the actual download
+# hashes) is verified against the gpg-signed Release file before use.
+DIST_URL = "http://deb.stashcat.com/repo01/dists/stashcat-dc"
+PACKAGES_PATH = "main/binary-amd64/Packages"
+
+# The stashcat repo signing key, manually checked against
+# http://deb.stashcat.com/stashcat.repo.key (fingerprint 653E 2B89 57B7 1342
+# 43AF 2DC2 FA67 1F46 5250 5E5B). Kept inline rather than fetched at update
+# time, so a compromise of that URL can't silently swap in a different key.
+PUBKEY = """\
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGFESk0BEADGIWFcUC6F9aggJ8Uka1qLNM2Pco9hHklxE73VwG9SJjeF9yTq
+rYwoOMd1Q1EK3se/BFJ/I8g5ash8dShacAQZA6AxXcLXDJ1laGBVH6X1fde72iCZ
+FFz7nSh3AVkbpnOVx31zSZI/v39UOKKRl9/6GRAquxKGi4tNk9mDlNEGR/U3j5wH
+u8Mvpj0k13I0sDvJG4+sPaDQQsXrKO5CxA6yjVh6lYNIDGQaCOSzhQ79JasZNqoK
+1/LqBhUN2rLAuVUGxb5QtghbQaff5y8Nq4E5ZLBgWd2dyFPtWKBjx9aJWr+1XWeP
+ZcVxHAfzH4NrYtsqLAOJ5KpD5uOtOwGr+SwL6VGYT6tm9gVHWQ3EtNeoVlgwlDEm
+yzzOvwnKgvdZMGXfky1OaiEPd5/wMoAb0b4kZsIraguAR64xZWUldKKzhRawo3Zf
+8Vz+o/njdOdTUu2MoQEkILbBlSkq8GyjyZJfBFHVHYijQloBa4nwWmPQrUPQAXs2
+6uRBQuZwofAO5i84G/pvgLXpDx9wsVKo23qoWj9LlA5ozfy6SvK0+NPPR2w/WPPD
+b3dkaqIPzEFJUuWh5hjtasgVl4dIHmQdy6igc4GRDxfUY68VDIY3X2ZcCshm/TtA
+CJx/j4MXkYMjdyDMsHN1Uq3MZ/UgKdvNeZqobnD1X50cPvj1VsdfKpTZ6QARAQAB
+tCxzdGFzaGNhdCBkZWIgcmVwb3NpdG9yeSA8aGVsbG9Ac3Rhc2hjYXQuY29tPokC
+VAQTAQoAPhYhBGU+K4lXtxNCQ68twvpnH0ZSUF5bBQJhREpNAhsDBQmTQWPzBQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEPpnH0ZSUF5bIKIP/2MOz0ujjtJsuDV0
+iUhKD5szlHEgztAv+STF9dGN8dns1z9XXtMtIZ/OWrMfXyNfUk/VodDP9ZhPMSTl
+tS0oDbP3+o3VqfgYyNsr0UplASLnm7/anMDN+KBCQ+c1NMX/gmGqreYj67ayN/Ui
+h2+DqmVqAsboO8Qco6aMv9xcV29W90/VTOYIfaTLVLpRkkXUWMnNFdNcFsqQn6mY
+KIbuHKJlO48vstyLsQ6TyV3cnDcsz5l3mJrChM6mNVt2sZ12NSncPJpCgcCDMr9Z
+JjPEcixXHkEHnC4j92VypswIsXzv0JxWFNsF8YqZnFFVTiFbttEgL+6ca2c1J0Fx
+zd/zjjxTwa7s0y4R6QSJ0TIW/GHbcYYfn+c9nXXCkWjEhEhLS0D6epRVXLJP+h4c
+pcGj51VaVz3NYpLofkNYN71tQNwsKibvSV+6xjX05ZhF0a82UVRyixnqz0CrSb9V
+2UsU5RJTWfyFvVUQqxdX4kDqEox5yGLWBtPsquKXyRvIUQ9XaI9kYNSgXPHoE0+Y
+Y1kf+mUjLuPa+MDOXJbfiSVPoQXB28qz3dLQnMqsMRr0FHk+kWoPn8iQWhLS6Qoo
+Nqoy3t5/LKl+X4jnhJd8lXobVdIFzVfp2m6qA3J5+cvnNcG7x+5ypFpV8ExY+Z+M
+iGhbuJoJfA31LPYASY9cXq7XxZGU
+=njOg
+-----END PGP PUBLIC KEY BLOCK-----
+"""
+
+
+def fetch(url: str) -> bytes:
+    with request.urlopen(url) as handle:
+        return handle.read()
+
+
+def verify_release_signature(release: bytes, signature: bytes, pubkey: bytes):
+    print("Verifying signature of Release file")
+    # Use gpgv to check a detached signature directly against a keyring file,
+    # with no import step and no persistent trust database.
+    with tempfile.TemporaryDirectory() as tmp:
+        release_file = os.path.join(tmp, "Release")
+        sig_file = os.path.join(tmp, "Release.gpg")
+        keyring_file = os.path.join(tmp, "keyring.gpg")
+        with open(release_file, "wb") as f:
+            f.write(release)
+        with open(sig_file, "wb") as f:
+            f.write(signature)
+
+        dearmor = subprocess.run(
+            ["gpg", "--homedir", tmp, "--dearmor"],
+            input=pubkey,
+            capture_output=True,
+            check=True,
+        )
+        with open(keyring_file, "wb") as f:
+            f.write(dearmor.stdout)
+
+        result = subprocess.run(
+            ["gpgv", "--keyring", keyring_file, sig_file, release_file],
+            capture_output=True,
+        )
+        if result.returncode != 0:
+            sys.exit(
+                "stashcat: Release signature verification failed:\n"
+                + result.stderr.decode(errors="replace")
+            )
+
+
+def verified_packages() -> bytes:
+    # Exits the whole script (via subprocess `check=True` or explicit
+    # sys.exit calls) if any verification step below fails.
+
+    print("Fetching deb repo Release file")
+    release = fetch(f"{DIST_URL}/Release")
+    print("Fetching deb repo Release.gpg file")
+    signature = fetch(f"{DIST_URL}/Release.gpg")
+    verify_release_signature(release, signature, PUBKEY.encode())
+
+    checksums = {entry["name"]: entry["sha512"] for entry in Release(release)["SHA512"]}
+    if PACKAGES_PATH not in checksums:
+        sys.exit(f"stashcat: {PACKAGES_PATH} missing from Release SHA512 checksums")
+
+    print("Fetching deb repo Packages file")
+    packages = fetch(f"{DIST_URL}/{PACKAGES_PATH}")
+    print("Checking checksum of Packages file against Release file")
+    digest = hashlib.sha512(packages).hexdigest()
+    if digest != checksums[PACKAGES_PATH]:
+        sys.exit(
+            f"stashcat: SHA512 mismatch for {PACKAGES_PATH}: "
+            f"expected {checksums[PACKAGES_PATH]}, got {digest}"
+        )
+    return packages
+
+
+def latest_packages(packages: bytes):
+    latest_packages: OrderedDict[str, Packages] = {}
+    for package in Packages.iter_paragraphs(packages, use_apt_pkg=False):
+        name: str = package["Package"]
+        if not name.startswith("stashcat"):
+            continue
+        channel = "stable"  # It's the only channel
+        if channel not in latest_packages:
+            latest_packages[channel] = package
+        else:
+            old_package = latest_packages[channel]
+            if old_package.get_version() < package.get_version():  # type: ignore
+                latest_packages[channel] = package
+    return OrderedDict(sorted(latest_packages.items(), key=lambda x: x[0]))
+
+def convert_hash_to_sri(pkg_hash):
+    sri_result = subprocess.run(
+        ["nix", "hash", "to-sri", f"sha512:{pkg_hash}"], capture_output=True, text=True
+    )
+    sri_result.check_returncode()
+    return sri_result.stdout.strip()
+
+def write_expression():
+    latest = latest_packages(verified_packages())
+    version = Version.re_valid_version.match(latest["stable"]["Version"]).group(
+        "upstream_version"
+    )
+    print(f"Latest version from deb repo: {version}")
+    hash_value = convert_hash_to_sri(latest["stable"]["SHA512"])
+
+    subprocess.run(
+        [
+            "update-source-version",
+            "stashcat",
+            version,
+            hash_value
+        ],
+        check=True,
+    )
+
+write_expression()
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index 0c8a2b1e5c91..a1231f709131 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.29.0";
+  version = "1.30.1";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-xtAUEOThVVa2wGUP4e43v7/zgW6oauWlZrXXNYTfWGg=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.30.1/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-m5I1aIcorN7I4e9STfRCgyOKU3u6xv/k52hcMq45zaQ=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-2hYbmcKd2HHY8OFzOUTLnfHbIWLBTKN3M4vfo5E0ZJc=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.30.1/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-A0sdBNrE2z/mdPsE0214f1IN07KV3h0ic/OprtWHkwE=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-E34rPFsIUIth8yzze1MudV4mGk9zNJnN1Jfb8Y7OiLs=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.30.1/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-X/O2ZBL+AhjkkdXeSX/q0TBTZGV69ln1aiH/FW9mfZk=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-RUmqMIdIeTvMs3XO96+ZxUsaZvqSxXf5mVylR9eoDG4=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.30.1/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-A9k+ihoSW+DajgoZ+/gC1IY7q6re3fK5SHalrsPxlxk=";
   };
 }
diff --git a/pkgs/by-name/ty/tyrolienne/package.nix b/pkgs/by-name/ty/tyrolienne/package.nix
index 961eb5663bfa..51833820ca66 100644
--- a/pkgs/by-name/ty/tyrolienne/package.nix
+++ b/pkgs/by-name/ty/tyrolienne/package.nix
@@ -15,17 +15,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tyrolienne";
-  version = "1.2.2";
+  version = "1.2.4";
 
   src = fetchFromGitea {
     domain = "git.uku3lig.net";
     owner = "uku";
     repo = "tyrolienne";
     tag = finalAttrs.version;
-    hash = "sha256-JdXamx+pwUEJWSbPFvROrx/XJojZ5sC+MEH0QVpKD+Y=";
+    hash = "sha256-oos96EU172bmt9WBV84xbkw5zgEbzaB/s+BcjMsPH5U=";
   };
 
-  cargoHash = "sha256-JM4Y0FyqVYqChpPh9p/QulfV8IesUJ0p/ooxAJLfo6I=";
+  cargoHash = "sha256-/rY3QXrnnxLjowHzj1O78FP0KLTViDdLwzmPrec/zmA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/va/vampire/package.nix b/pkgs/by-name/va/vampire/package.nix
index f0324e379638..55601ae57f04 100644
--- a/pkgs/by-name/va/vampire/package.nix
+++ b/pkgs/by-name/va/vampire/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   cmake,
   z3,
+  # We use an older version of z3 because upstream pins this older version as a submodule
+  # And doesn't recommend using different versions unless you know specfically what you are doing
   z3' ? z3.overrideAttrs rec {
     version = "4.14.0";
     src = fetchFromGitHub {
@@ -13,34 +15,56 @@
       hash = "sha256-Bv7+0J7ilJNFM5feYJqDpYsOjj7h7t1Bx/4OIar43EI=";
     };
   },
+  enableZ3 ? z3' != null,
   nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vampire";
-  version = "5.0.1";
+  version = "5.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "vprover";
     repo = "vampire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ka9HmicIf7b5VN9nbiCW604ZZrGpJuP57RPTzOnwJbU=";
+    hash = "sha256-zPE2GmaHupBhyPEZFcoRADzClPKYydlJ74dNkyQpJa8=";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    z3'
+  buildInputs = [ z3' ];
+
+  # Needed so we can case on it's value
+  cmakeBuildType = "Release";
+  buildFlags = lib.optionals (finalAttrs.doCheck) [
+    "all"
+    "vtest"
   ];
 
-  cmakeFlags = [ (lib.cmakeFeature "Z3_DIR" "${z3'.dev}/lib/cmake") ];
-
-  enableParallelBuilding = true;
+  cmakeFlags = [
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_Z3" (!enableZ3))
+  ]
+  ++ lib.optionals enableZ3 [
+    (lib.cmakeFeature "Z3_DIR" "${z3'.dev}/lib/cmake")
+  ];
 
   prePatch = ''
     rm -rf z3
   '';
 
-  passthru.updateScript = nix-update-script { };
+  # The tests only are able to be built in Debug builds, otherwise the `vtest`
+  # binary doesn't exist as a target
+  doCheck = finalAttrs.cmakeBuildType == "Debug";
+
+  passthru = {
+    updateScript = nix-update-script { };
+    z3 = z3';
+    tests.debug-build-with-tests = finalAttrs.finalPackage.overrideAttrs {
+      cmakeBuildType = "Debug";
+    };
+  };
 
   meta = {
     homepage = "https://vprover.github.io/";
diff --git a/pkgs/by-name/ve/verifpal/package.nix b/pkgs/by-name/ve/verifpal/package.nix
index 7b38cde0f324..acf89203a192 100644
--- a/pkgs/by-name/ve/verifpal/package.nix
+++ b/pkgs/by-name/ve/verifpal/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "verifpal";
-  version = "1.4.10";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "symbolicsoft";
     repo = "verifpal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Cg8qaOGAGRYPacbv4WswcEkQrNRSh5xtO5y6gsUW3x8=";
+    hash = "sha256-7OeGuZV8M/0/Hjn3gD+iEqsPmSNAgUK/Usf4eEXoNJ4=";
   };
 
-  cargoHash = "sha256-c5cnkZD5XPpYab0JOF8L5h7U5GbvHBzLXH1jq4b5Y1w=";
+  cargoHash = "sha256-7uMs6DSZVUFZh1UBzAtyqJhQjuUVen0O9Mx8vmbMedY=";
 
   meta = {
     homepage = "https://verifpal.com/";
diff --git a/pkgs/by-name/ve/vermouth/package.nix b/pkgs/by-name/ve/vermouth/package.nix
index 3009262ba702..c9fafcf64c12 100644
--- a/pkgs/by-name/ve/vermouth/package.nix
+++ b/pkgs/by-name/ve/vermouth/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vermouth";
-  version = "2.2.1";
+  version = "2.3.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "dekomote";
     repo = "vermouth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HvjRi5nIjZAjXVrv/Y8dS4HPSfiqIfiZzJpSm9rREv8=";
+    hash = "sha256-NEawV8Bp9CLMaWQSo8s0W8wiuyaFOIoQgNqr9x13yyY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index 1d4e86d86894..8f3e650b5684 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wezterm";
-  version = "0-unstable-2026-08-31";
+  version = "0-unstable-2026-09-17";
 
   src = fetchFromGitHub {
     owner = "wezterm";
     repo = "wezterm";
-    rev = "4fbd6b8e90e2326b8e25c589768f98bd71ddd047";
+    rev = "b09b56c29c1e367e598b60ca266e2cc9038751e0";
     fetchSubmodules = true;
-    hash = "sha256-Fe2rH9HegaUixPXHyHv4B8c0RI34GPbeX8mTzHCQwQ4=";
+    hash = "sha256-wVK9IcPezoEWeTlDkD/foGyRH2tnwEHX3ZgChpIX3Vw=";
   };
 
   postPatch = ''
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # https://github.com/wezterm/wezterm/blob/main/nix/flake.nix#L134
   auditable = false;
 
-  cargoHash = "sha256-h/qbCAEukgk1ADvn5iUfE4u596Sf+C24OsELlnCNX0g=";
+  cargoHash = "sha256-GiHuJkkcPKoQpzVKDlbI2eZVj+5Fns/CHKxRtBw39WU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/default.nix b/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
index e0686ed37fe3..01f3aeeb486b 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
@@ -11,13 +11,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "happy-eyeballs";
-  version = "2.0.1";
-
-  minimalOCamlVersion = "4.08";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "https://github.com/roburio/happy-eyeballs/releases/download/v${finalAttrs.version}/happy-eyeballs-${finalAttrs.version}.tbz";
-    hash = "sha256-slVFiDApMbqF4Yhh5hCjraeCNJbU1JoZXpU1VsNR0mk=";
+    hash = "sha256-C9yLKA8FtciilZgjgvCX1MtxP/BV9pPP1/5kqN5t3Yw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
index e5b6cf3660e1..8821fe936d6b 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
@@ -17,19 +17,17 @@ buildDunePackage {
 
   inherit (happy-eyeballs) src version;
 
-  minimalOCamlVersion = "4.08";
-
   buildInputs = [
     cmdliner
     duration
     domain-name
     ipaddr
     fmt
-    mtime
+    dns
   ];
 
   propagatedBuildInputs = [
-    dns
+    mtime
     happy-eyeballs
     logs
     lwt
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/miou-unix.nix b/pkgs/development/ocaml-modules/happy-eyeballs/miou-unix.nix
index de396a05174e..77cb99d34480 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/miou-unix.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/miou-unix.nix
@@ -20,14 +20,14 @@ buildDunePackage {
     duration
     domain-name
     fmt
-    ipaddr
-    mtime
+    logs
   ];
 
   propagatedBuildInputs = [
     happy-eyeballs
-    logs
+    ipaddr
     miou
+    mtime
   ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
index 49b6e7a86707..e8949ce77bdd 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
@@ -17,21 +17,16 @@ buildDunePackage {
 
   inherit (happy-eyeballs) src version;
 
-  minimalOCamlVersion = "4.08";
-
-  buildInputs = [
-    duration
-    ipaddr
-    domain-name
-    fmt
-    mirage-mtime
-    mirage-sleep
-  ];
-
   propagatedBuildInputs = [
+    domain-name
+    duration
+    fmt
     happy-eyeballs
+    ipaddr
     logs
     lwt
+    mirage-mtime
+    mirage-sleep
     tcpip
   ];
 
diff --git a/pkgs/development/ocaml-modules/ppx_tools_versioned/default.nix b/pkgs/development/ocaml-modules/ppx_tools_versioned/default.nix
index 5d4e4366e4d5..0fa33aeb92b7 100644
--- a/pkgs/development/ocaml-modules/ppx_tools_versioned/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_tools_versioned/default.nix
@@ -23,7 +23,7 @@ buildDunePackage (finalAttrs: {
   meta = {
     homepage = "https://github.com/let-def/ppx_tools_versioned";
     description = "Tools for authors of syntactic tools (such as ppx rewriters)";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 })
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index ea889b5c3e94..21547f3df5ce 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.3.3";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-w8KKQDnVORm3OFV94H+rEzVP7+XtHN7ZdKoFpp6Idww=";
+    hash = "sha256-VZ4PxZpCKoXJkoUPAEVpI4FEunfHzcai2POc4fqX9yo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/base64io/default.nix b/pkgs/development/python-modules/base64io/default.nix
index e49670f6e856..1ad27019725b 100644
--- a/pkgs/development/python-modules/base64io/default.nix
+++ b/pkgs/development/python-modules/base64io/default.nix
@@ -6,6 +6,7 @@
   pytestCheckHook,
   setuptools,
   unstableGitUpdater,
+  fetchpatch2,
 }:
 
 buildPythonPackage rec {
@@ -20,6 +21,14 @@ buildPythonPackage rec {
     hash = "sha256-1MUWjFFitJ3nqvVwAQYcAVVPhPs6NEgq7t/mI71u2Bk=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "default-buffer-size-compat.patch";
+      url = "https://github.com/abus-sh/base64io-python/commit/a929dc3c9d873eabe491ccae9a2d0d57726f37da.patch?full_index=1";
+      hash = "sha256-VfPOZ8cDRW2mQy6ROl77kBRE780NhH4kbjkyD1/jMRk=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/cashaddress/default.nix b/pkgs/development/python-modules/cashaddress/default.nix
index 2d2fdb42722f..e7fc0d1af7c0 100644
--- a/pkgs/development/python-modules/cashaddress/default.nix
+++ b/pkgs/development/python-modules/cashaddress/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     description = "Python tool for convert bitcoin cash legacy addresses";
     homepage = "https://github.com/oskyk/cashaddress";
     changelog = "https://github.com/oskyk/cashaddress/releases/tag/${version}";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/rocq-modules/flocq/default.nix b/pkgs/development/rocq-modules/flocq/default.nix
index 601c8ae24898..1d4b85a38b90 100644
--- a/pkgs/development/rocq-modules/flocq/default.nix
+++ b/pkgs/development/rocq-modules/flocq/default.nix
@@ -2,14 +2,14 @@
   lib,
   bash,
   autoconf,
-  mkCoqDerivation,
-  coq,
+  mkRocqDerivation,
+  rocq-core,
   stdlib,
   version ? null,
 }:
 
 let
-  derivation = mkCoqDerivation {
+  derivation = mkRocqDerivation {
     pname = "flocq";
     owner = "flocq";
     domain = "gitlab.inria.fr";
@@ -19,7 +19,7 @@ let
         case = case: out: { inherit case out; };
       in
       with lib.versions;
-      lib.switch coq.coq-version [
+      lib.switch rocq-core.rocq-version [
         (case (range "8.15" "9.3") "4.2.2")
         (case (range "8.15" "9.1") "4.2.1")
         (case (range "8.14" "8.20") "4.2.0")
@@ -51,8 +51,10 @@ let
 
     propagatedBuildInputs = [ stdlib ];
 
+    useCoqifVersion = v: v != null && v != "dev" && lib.versions.isLe "4.2.2" v;
+
     meta = {
-      description = "Floating-point formalization for the Coq system";
+      description = "Floating-point formalization for the Rocq system";
       license = lib.licenses.lgpl3;
       maintainers = with lib.maintainers; [ jwiegley ];
     };
@@ -61,7 +63,7 @@ let
     o:
     lib.optionalAttrs (o.version != null && (o.version == "dev" || lib.versions.isGe "4.2.2" o.version))
       {
-        nativeBuildInputs = o.nativeBuildInputs ++ [ coq.ocamlPackages.ocaml ];
+        nativeBuildInputs = o.nativeBuildInputs ++ [ rocq-core.ocamlPackages.ocaml ];
       }
   );
 in
diff --git a/pkgs/development/rocq-modules/iris/default.nix b/pkgs/development/rocq-modules/iris/default.nix
index b72d89b48340..8aed6e9e6629 100644
--- a/pkgs/development/rocq-modules/iris/default.nix
+++ b/pkgs/development/rocq-modules/iris/default.nix
@@ -9,8 +9,11 @@
 let
   derivation = mkRocqDerivation {
     pname = "iris";
-    domain = "gitlab.mpi-sws.org";
-    owner = "iris";
+    # MPI's gitlab is unfortunately under siege of various LLM scrappers
+    # and had to establish some strong rate limiting, a mirror is put on github
+    # domain = "gitlab.mpi-sws.org";
+    # owner = "iris";
+    owner = "rocq-iris";
     inherit version;
     defaultVersion =
       let
diff --git a/pkgs/development/rocq-modules/stdpp/default.nix b/pkgs/development/rocq-modules/stdpp/default.nix
index 2c32d70f171d..d87a9b130d62 100644
--- a/pkgs/development/rocq-modules/stdpp/default.nix
+++ b/pkgs/development/rocq-modules/stdpp/default.nix
@@ -9,8 +9,11 @@
 mkRocqDerivation {
   pname = "stdpp";
   inherit version;
-  domain = "gitlab.mpi-sws.org";
-  owner = "iris";
+  # MPI's gitlab is unfortunately under siege of various LLM scrappers
+  # and had to establish some strong rate limiting, a mirror is put on github
+  # domain = "gitlab.mpi-sws.org";
+  # owner = "iris";
+  owner = "rocq-iris";
   defaultVersion =
     let
       case = case: out: { inherit case out; };
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 715dcb3be538..d988c3224a67 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1987,6 +1987,8 @@ mapAliases {
   pacup = throw "'pacup' has been renamed to/replaced by 'perlPackages.pacup'"; # Converted to throw 2025-10-27
   PageEdit = throw "'PageEdit' has been renamed to/replaced by 'pageedit'"; # Converted to throw 2025-10-27
   pal = throw "pal has been removed, as it was broken"; # Added 2025-08-25
+  palemoon-bin = throw "'palemoon-bin' has been removed, as it relies on to-be-removed GTK2 for full NPAPI support"; # Added 2026-09-21
+  palemoon-gtk2-bin = throw "'palemoon-gtk2-bin' has been removed, as it relies on to-be-removed GTK2 for full NPAPI support"; # Added 2026-09-21
   pam_pgsql = pam-pgsql; # Added 2025-12-16
   pangolin = throw "pangolin has been removed due to lack of maintenance"; # Added 2025-11-17
   pangomm = throw "'pangomm' attribute has been removed from nixpkgs. Use a 'pangomm_*' attribute with an explicit ABI version instead."; # Added 2026-09-05