diff --git a/doc/packages/linux.section.md b/doc/packages/linux.section.md
index 9722b22fd2f5..4c2ec2fb63c0 100644
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -158,3 +158,9 @@ The change gets submitted like this:
   * Keep the previously latest kernel until its mainline counterpart gets removed.
     After that `linux_hardened` points to the latest LTS supported by hardened.
 * __SQUASH__ the changes into the `linux_X_Y_hardened: init at …` commit.
+
+### Policy for accepting new kernel flavours {#sec-linux-new-kernels}
+
+No new downstream kernels are accepted into nixpkgs. That includes kernels that use the mainline
+sourcetree, but a different configuration. Kernels for extended hardware support should go
+to [nixos-hardware](github.com/NixOS/nixos-hardware) instead.
diff --git a/doc/redirects.json b/doc/redirects.json
index 879145eed084..bc0bf5521384 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -4398,6 +4398,9 @@
   "sec-linux-kernel-developing-modules": [
     "index.html#sec-linux-kernel-developing-modules"
   ],
+  "sec-linux-new-kernels": [
+    "index.html#sec-linux-new-kernels"
+  ],
   "ex-edit-compile-run-kernel-modules": [
     "index.html#ex-edit-compile-run-kernel-modules"
   ],
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ef0630bf5779..9b146e5363cf 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3918,6 +3918,12 @@
     githubId = 15181236;
     keys = [ { fingerprint = "AE1E 3B80 7727 C974 B972  AB3C C324 01C3 BF52 1179"; } ];
   };
+  bridgesense = {
+    name = "Saad Nadeem";
+    email = "saad29nadeem@gmail.com";
+    github = "BridgeSenseDev";
+    githubId = 88615188;
+  };
   britter = {
     name = "Benedikt Ritter";
     email = "beneritter@gmail.com";
@@ -5686,6 +5692,7 @@
     github = "0xda157";
     githubId = 153149335;
     name = "0xda157";
+    keys = [ { fingerprint = "5A66 FF95 36DE B501 DDD2  1647 B7AC 1B10 365D 45FF"; } ];
   };
   dabao1955 = {
     email = "dabao1955@163.com";
@@ -6483,6 +6490,11 @@
       }
     ];
   };
+  Dev380 = {
+    name = "Dev380";
+    github = "Dev380";
+    githubId = 49997896;
+  };
   developer-guy = {
     name = "Batuhan Apaydın";
     email = "developerguyn@gmail.com";
@@ -10990,6 +11002,13 @@
     githubId = 1550265;
     name = "Dominic Steinitz";
   };
+  iedame = {
+    name = "Rafael Ieda";
+    github = "iedame";
+    githubId = 60272;
+    email = "git@ieda.me";
+    matrix = "@ieda:matrix.org";
+  };
   if-loop69420 = {
     github = "if-loop69420";
     githubId = 81078181;
@@ -29195,6 +29214,9 @@
       {
         fingerprint = "4E67 A4AC 2FA4 2A28 DB40  1FC8 F9FB 19F1 C1DC 9C23";
       }
+      {
+        fingerprint = "42EF 09B8 31E1 7646 8BFE  CAD8 E922 D634 9DB9 F861";
+      }
     ];
   };
   Zaechus = {
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 5dd832354fef..5d6ad24461d4 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1489,6 +1489,9 @@
   "module-services-postgres-upstream-deviation": [
     "index.html#module-services-postgres-upstream-deviation"
   ],
+  "module-services-postgresql-target-vs-service": [
+    "index.html#module-services-postgresql-target-vs-service"
+  ],
   "module-services-foundationdb": [
     "index.html#module-services-foundationdb"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index caf131313bf5..9d4f926dc718 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -22,6 +22,8 @@
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
 
+- [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)
+
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).
 
 - [dms-greeter](https://danklinux.com), a modern display manager greeter for DankMaterialShell that works with greetd and supports multiple Wayland compositors. Available as [services.displayManager.dms-greeter](#opt-services.displayManager.dms-greeter.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index bb4e5343cc50..62af18754cb5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1532,6 +1532,7 @@
   ./services/system/localtimed.nix
   ./services/system/nix-daemon-firewall.nix
   ./services/system/nix-daemon.nix
+  ./services/system/nohang.nix
   ./services/system/nscd.nix
   ./services/system/nvme-rs.nix
   ./services/system/saslauthd.nix
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index d90c503eeab7..5db44d8953ad 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -485,6 +485,35 @@ with hardening, it's considered a bug.
 When using extensions that are not packaged in `nixpkgs`, hardening adjustments may
 become necessary.
 
+## `postgresql.service` vs `postgresql.target` {#module-services-postgresql-target-vs-service}
+
+In order to delay a service's startup until the local PostgreSQL instance is up, one usually uses a combination of `wants`/`after`, i.e.
+
+```nix
+{
+  systemd.services.myservice = {
+    wants = [ "postgresql.target" ];
+    after = [ "postgresql.target" ];
+  };
+}
+```
+
+::: {.note}
+`wants` makes sure that `postgresql.target` is being started when `myservice.service` is started.
+If it's necessary to restart `myservice` when `postgresql.target` gets restarted and `myservice.service` fails to start if `postgresql.service` fails to start, use `requires` instead.
+
+See also {manpage}`systemd.unit(5)`.
+:::
+
+It's also possible to wait for `postgresql.service` instead, however that has a slightly different meaning:
+
+* `postgresql.service` is `active` if the database is __at least__ in read-only mode.
+* `postgresql.target` is `active` if the database is either in __read-write__ mode or a standby server.
+
+This is implemented by making `postgresql.target` wait for `postgresql-setup.service` which waits for the database to be fully up and applies the changes necessary for `ensureUsers`.
+
+Restarting `postgresql.service` by hand also triggers a restart of `postgresql.target`.
+
 ## Notable differences to upstream {#module-services-postgres-upstream-deviation}
 
 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 6e1b83f8d1d3..b979cdd657ba 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -100,7 +100,8 @@ in
     maxAttachmentSize = lib.mkOption {
       type = lib.types.int;
       default = 18;
-      apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.37)}M";
+      apply =
+        configuredMaxAttachmentSize: "${toString (builtins.ceil (configuredMaxAttachmentSize * 1.37))}M";
       description = ''
         The maximum attachment size in MB.
         [upstream issue comment]: https://github.com/roundcube/roundcubemail/issues/7979#issuecomment-808879209
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index ec5cf8aee8dd..58eb20815a98 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1441,6 +1441,10 @@ in
       gid = config.ids.gids.matrix-synapse;
     };
 
+    systemd.slices.system-synapse = {
+      description = "Matrix reference homeserver";
+    };
+
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
       wants = [ "network-online.target" ];
@@ -1480,6 +1484,7 @@ in
             ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
             Restart = "on-failure";
             UMask = "0077";
+            Slice = "system-synapse.slice";
 
             # Security Hardening
             # Refer to systemd.exec(5) for option descriptions.
diff --git a/nixos/modules/services/system/nohang.nix b/nixos/modules/services/system/nohang.nix
new file mode 100644
index 000000000000..abc8d00f90e7
--- /dev/null
+++ b/nixos/modules/services/system/nohang.nix
@@ -0,0 +1,113 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nohang;
+
+  inherit (lib)
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+
+  options.services.nohang = {
+    enable = mkEnableOption "nohang, a daemon that keeps system responsiveness when Linux is out of memory";
+
+    package = mkPackageOption pkgs "nohang" { };
+
+    configPath = mkOption {
+      type = types.either (types.enum [
+        "basic"
+        "desktop"
+      ]) types.path;
+      default = "desktop";
+      example = literalExpression "./my-nohang-config.conf";
+      description = ''
+        Configuration file to use with nohang. The default and desktop example configurations in the nohang repository
+        can be used by setting this to "basic" or "desktop" (which is the default). Otherwise, you can set it to the path
+        of a custom configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.nohang = {
+      description = "Sophisticated low memory handler";
+      documentation = [
+        "man:nohang(8)"
+        "https://github.com/hakavlad/nohang"
+      ];
+      after = [ "sysinit.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart =
+          "${lib.getExe cfg.package} --monitor --config "
+          + (
+            if cfg.configPath == "basic" then
+              "${cfg.package}/etc/nohang/nohang.conf"
+            else if cfg.configPath == "desktop" then
+              "${cfg.package}/etc/nohang/nohang-desktop.conf"
+            else
+              cfg.configPath
+          );
+        Slice = "hostcritical.slice";
+        SyslogIdentifier =
+          if cfg.configPath == "basic" then
+            "nohang"
+          else if cfg.configPath == "desktop" then
+            "nohang-desktop"
+          else
+            "nohang-custom-config";
+        KillMode = "mixed";
+        Restart = "always";
+        RestartSec = 0;
+
+        CPUSchedulingResetOnFork = true;
+        RestrictRealtime = "yes";
+
+        TasksMax = 25;
+        MemoryMax = "100M";
+        MemorySwapMax = "100M";
+
+        UMask = 27;
+        ProtectSystem = "strict";
+        ReadWritePaths = "/var/log";
+        InaccessiblePaths = "/home /root";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        MemoryDenyWriteExecute = "yes";
+        RestrictNamespaces = "yes";
+        LockPersonality = "yes";
+        PrivateTmp = true;
+        DeviceAllow = "/dev/kmsg rw";
+        DevicePolicy = "closed";
+
+        CapabilityBoundingSet = [
+          "CAP_KILL"
+          "CAP_IPC_LOCK"
+          "CAP_SYS_PTRACE"
+          "CAP_DAC_READ_SEARCH"
+          "CAP_DAC_OVERRIDE"
+          "CAP_AUDIT_WRITE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_SYS_RESOURCE"
+          "CAP_SYSLOG"
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index ba4b92779197..92e40f77b82a 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -720,15 +720,6 @@ in
         "xen-blkback"
         "xen-netback"
         "xen-pciback"
-        "evtchn"
-        "gntdev"
-        "netbk"
-        "blkbk"
-        "xen-scsibk"
-        "usbbk"
-        "pciback"
-        "xen-acpi-processor"
-        "blktap2"
         "tun"
         "netxen_nic"
         "xen_wdt"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index bbb72047c109..4edc8777cf16 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1105,6 +1105,7 @@ in
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
   node-red = runTest ./node-red.nix;
+  nohang = runTest ./nohang.nix;
   nomad = runTest ./nomad.nix;
   nominatim = runTest ./nominatim.nix;
   non-default-filesystems = handleTest ./non-default-filesystems.nix { };
diff --git a/nixos/tests/nohang.nix b/nixos/tests/nohang.nix
new file mode 100644
index 000000000000..8b7c4ec0ca15
--- /dev/null
+++ b/nixos/tests/nohang.nix
@@ -0,0 +1,56 @@
+# The following was modified from ./earlyoom.nix
+{ lib, pkgs, ... }:
+{
+  name = "nohang";
+  meta = {
+    maintainers = with lib.maintainers; [
+      Dev380
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Limit VM resource usage.
+      virtualisation.memorySize = 1024;
+
+      services.nohang.enable = true;
+      # disable other oom killers just in case
+      systemd.oomd.enable = false;
+
+      systemd.services.testbloat = {
+        description = "Create a lot of memory pressure";
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pkgs.coreutils "tail"} /dev/zero";
+        };
+      };
+    };
+
+  # SIGTERM may be given so tail /dev/zero may or may not succeed
+  # The output will have have something like "Sending SIGTERM to /nix/store/87fc"
+  # with the truncated path so we'll check for that in the test
+  testScript = ''
+    machine.wait_for_unit("nohang.service")
+
+    with subtest("nohang should kill the bad service"):
+        machine.execute("systemctl start --wait testbloat.service")
+        signal_type = None
+        match machine.get_unit_info("testbloat.service")["Result"]:
+          case "signal":
+            signal_type = "SIGKILL"
+          case "success":
+            signal_type = "SIGTERM"
+        output = machine.succeed('journalctl -u nohang.service -b0')
+
+        if not f'[ OK ] Sending {signal_type}' in output:
+          raise Exception(f"'[ OK ] Sending {signal_type}' not in output")
+        if not 'The victim' in output:
+          raise Exception("'The victim' not in output")
+        if not 'Memory status after implementing a corrective action:' in output:
+          raise Exception("'Memory status after implementing a corrective action:' not in output")
+        if not 'FINISHING implement_corrective_action()' in output:
+          raise Exception("'FINISHING implement_corrective_action()' not in output")
+        if not f"{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1" in output:
+          raise Exception(f"'{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1' not in output")
+  '';
+}
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index a1230f66d418..2994e787f57c 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -46,7 +46,7 @@ let
 
   products = versions.${system} or (throw "Unsupported system: ${system}");
 
-  dotnet-sdk = dotnetCorePackages.sdk_9_0-source;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0-source;
 
   package = if stdenv.hostPlatform.isDarwin then ./bin/darwin.nix else ./bin/linux.nix;
   mkJetBrainsProductCore = callPackage package { inherit vmopts; };
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 3628d4089aad..7a366a6f796a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -945,6 +945,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  artio-nvim = buildVimPlugin {
+    pname = "artio.nvim";
+    version = "2025-12-28";
+    src = fetchFromGitHub {
+      owner = "comfysage";
+      repo = "artio.nvim";
+      rev = "83909f659c1da7cf8403c31a051f0ccb64c4c636";
+      hash = "sha256-22CIZrIWI8ZjXPnDtdpCzbPmV/EI7z/YFrbGzoogjGA=";
+    };
+    meta.homepage = "https://github.com/comfysage/artio.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   astrocore = buildVimPlugin {
     pname = "astrocore";
     version = "2.0.5-unstable-2025-06-06";
@@ -6974,6 +6987,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  iswap-nvim = buildVimPlugin {
+    pname = "iswap.nvim";
+    version = "0-unstable-2024-05-23";
+    src = fetchFromGitHub {
+      owner = "mizlan";
+      repo = "iswap.nvim";
+      rev = "e02cc91f2a8feb5c5a595767d208c54b6e3258ec";
+      hash = "sha256-lAYHvz23f9nJ6rb0NIm+1aq0Vr0SwjPVitPuROtUS2A=";
+    };
+    meta.homepage = "https://github.com/mizlan/iswap.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   jdaddy-vim = buildVimPlugin {
     pname = "jdaddy.vim";
     version = "1.0-unstable-2014-02-22";
@@ -7053,6 +7079,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  jj-nvim = buildVimPlugin {
+    pname = "jj.nvim";
+    version = "0.1.0-unstable-2025-12-25";
+    src = fetchFromGitHub {
+      owner = "NicolasGB";
+      repo = "jj.nvim";
+      rev = "faf1a9f63c55d1d3649896de0d7cc18e4581d71e";
+      hash = "sha256-OxBSxxPQRFq1EPmoUsICMTZFatkkb1mI/tPHCzeIW4Q=";
+    };
+    meta.homepage = "https://github.com/NicolasGB/jj.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   jq-vim = buildVimPlugin {
     pname = "jq.vim";
     version = "1.0.3-unstable-2024-11-19";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 42f57650808f..ddc01b565c1b 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -196,6 +196,14 @@ assertNoAdditions {
     ];
   };
 
+  artio-nvim = super.artio-nvim.overrideAttrs {
+    # Requires extui enabled
+    nvimSkipModules = [
+      "artio.view"
+      "artio.picker"
+    ];
+  };
+
   astrocore = super.astrocore.overrideAttrs {
     dependencies = [ self.lazy-nvim ];
   };
@@ -1530,6 +1538,10 @@ assertNoAdditions {
     dependencies = [ self.nvim-treesitter ];
   };
 
+  iswap-nvim = super.iswap-nvim.overrideAttrs {
+    dependencies = [ self.nvim-treesitter ];
+  };
+
   jdd-nvim = super.jdd-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 783a6c916d7f..fb3f9ae61c8f 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -71,6 +71,7 @@ https://github.com/solarnz/arcanist.vim/,,
 https://github.com/vim-scripts/argtextobj.vim/,,
 https://github.com/otavioschwanck/arrow.nvim/,,
 https://github.com/arsham/arshlib.nvim/,HEAD,
+https://github.com/comfysage/artio.nvim/,HEAD,
 https://github.com/AstroNvim/astrocore/,HEAD,
 https://github.com/AstroNvim/astrolsp/,HEAD,
 https://github.com/AstroNvim/astrotheme/,,
@@ -534,12 +535,14 @@ https://github.com/neutaaaaan/iosvkem/,,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,HEAD,
 https://github.com/haya14busa/is.vim/,,
+https://github.com/mizlan/iswap.nvim/,HEAD,
 https://github.com/vim-scripts/jdaddy.vim/,,
 https://github.com/mahyarmirrashed/jdd.nvim/,HEAD,
 https://github.com/davidhalter/jedi-vim/,,
 https://github.com/metalelf0/jellybeans-nvim/,,
 https://github.com/nanotech/jellybeans.vim/,,
 https://github.com/HiPhish/jinja.vim/,HEAD,
+https://github.com/NicolasGB/jj.nvim/,HEAD,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://github.com/julelang/jule.nvim/,HEAD,
diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index a05e6a688882..3d6575f0bd77 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-23";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "6400e0f0d8a1e2345def663bc646e8adc0e42e76";
-    hash = "sha256-2hmeEuO+Z0FDyDYiA59ntXl24B5OcLWuvxbiLLfiWE8=";
+    rev = "d0f1375248e3003199cb973a12332b4cc9f0724f";
+    hash = "sha256-uMPlJDjLmXDO9mrnjYu/3Fr5qwBBADUARTMz1hckLJM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/scummvm.nix b/pkgs/applications/emulators/libretro/cores/scummvm.nix
index 195eb80bacf9..acd4315d0ed5 100644
--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@@ -25,13 +25,13 @@ let
 in
 mkLibretroCore {
   core = "scummvm";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-12-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "scummvm";
-    rev = "686cdd13719b92554fa46b264c512ca7deec7a96";
-    hash = "sha256-3w1rYVPX7ENGUgKdrFRQShWoEXfagxdtzd98m1hKeYU=";
+    rev = "b56c0d796ebcb4a3a8ea966cc3b8ec3e02b452be";
+    hash = "sha256-CPYKOqyEDRdA2D1+eomrsb7w8pDWyxtqmGZF8j15OJU=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 329353210fe5..4b3ad8215705 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "inkscape";
-  version = "1.4.2";
+  version = "1.4.3";
   outputs = [
     "out"
     "man"
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://inkscape.org/release/inkscape-${finalAttrs.version}/source/archive/xz/dl/inkscape-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-IABTDHkX5SYMnoV1pxVP9pJmQ9IAZIfXFOMEqWPwx4I=";
+    sha256 = "sha256-6DosPbVwtsWh/w/M/nCYg3s/a9dLEzVnk3yKkXEO0dE=";
   };
 
   # Inkscape hits the ARGMAX when linking on macOS. It appears to be
@@ -101,26 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
       # Fix path to ps2pdf binary
       inherit ghostscript;
     })
-    (fetchpatch {
-      name = "fix-build-poppler-25.06.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/40f5b15b7e29908b79c54e81db6f340936102e08.patch";
-      hash = "sha256-bYRd/KUh/7qFb7x0EuUgQYA9P8abcTf5XS67gzaAiXA=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.07.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/8ae83ca81bbaebcc0ff0abe82300d56d2c94e6f9.patch";
-      hash = "sha256-s7UMnv1pAiQA/HL5CEdBwCn4v/tsphc0MSnBJAoqolY=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.09.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/f48b429827dca510b41a5671d467e574ef348625.patch";
-      hash = "sha256-9CfmkTGMVHjZiiE3zvi4YOrytcir8a7O2z3PrhjcohI=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.10.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/4dba481fe898c6317696d50b109f5aed8f269c19.patch";
-      hash = "sha256-FFCkMU+Ec2qobG4ru89NPcM9Gxw8ZyFV+6jpW8ZwgE4=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index 86127f9c54c1..dc677b6e377d 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   buildGo124Module,
+  buildGo125Module,
   fetchFromGitHub,
   nixosTests,
   installShellFiles,
@@ -40,12 +41,6 @@ let
           inherit hash;
         };
 
-        # Nomad requires Go 1.24.6, but nixpkgs doesn't have it in unstable yet.
-        postPatch = ''
-          substituteInPlace go.mod \
-            --replace-warn "go 1.24.6" "go 1.24.5"
-        '';
-
         nativeBuildInputs = [ installShellFiles ];
 
         ldflags = [
@@ -88,6 +83,18 @@ rec {
 
   nomad = nomad_1_10;
 
+  nomad_1_11 = generic {
+    buildGoModule = buildGo125Module;
+    version = "1.11.0";
+    hash = "sha256-ETC9zJVup/BLivsBWVez5/OLpl7cjdlIRACVK9ga3Io=";
+    vendorHash = "sha256-WqGWEjaPicpmkARSEQ/bqw8+GSemh1fcM3pb4BGjZpU=";
+    license = lib.licenses.bsl11;
+    passthru.tests.nomad = nixosTests.nomad;
+    preCheck = ''
+      export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
+    '';
+  };
+
   nomad_1_10 = generic {
     buildGoModule = buildGo124Module;
     version = "1.10.5";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 5754b0d7c43d..d6a318fa7158 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1229,13 +1229,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-leXROTarkEHfDmJVLS7kSU3Z27dCF/BfZwBsnujlB90=",
+    "hash": "sha256-GSGKjV5tuwTyPvdwd/Z8t9g7LFkkg4gHKhI3FYt00gQ=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.40.0",
+    "rev": "v1.42.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-cX5K221Jnq701Nb+2bC1LmXVL7YvkZ8dkc2wYjDNOSw="
+    "vendorHash": "sha256-XNPXjqrrTIC3WrpvDBP7veAYgmYws9FdF4W3j6ewRPk="
   },
   "splunk-terraform_signalfx": {
     "hash": "sha256-Wixg+biff6OER/nXYa+WGXG7svs4T3E/qwPlV5xJEao=",
diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix
index ac908ab9f8ab..fc60ec0b1f28 100644
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -9,6 +9,7 @@
   zarith,
   camlp5,
   camlp-streams,
+  bash,
 }:
 
 let
@@ -52,6 +53,8 @@ stdenv.mkDerivation {
 
   patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
 
+  buildInputs = [ bash ];
+
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 27e39a90a50c..c889f509119a 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -40,7 +40,6 @@
   sourceDebug ? false,
   projectDscPath ?
     {
-      i686 = "OvmfPkg/OvmfPkgIa32.dsc";
       x86_64 = "OvmfPkg/OvmfPkgX64.dsc";
       aarch64 = "ArmVirtPkg/ArmVirtQemu.dsc";
       riscv64 = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc";
@@ -50,7 +49,6 @@
       or (throw "Unsupported OVMF `projectDscPath` on ${stdenv.hostPlatform.parsed.cpu.name}"),
   fwPrefix ?
     {
-      i686 = "OVMF";
       x86_64 = "OVMF";
       aarch64 = "AAVMF";
       riscv64 = "RISCV_VIRT";
@@ -58,16 +56,12 @@
     }
     .${stdenv.hostPlatform.parsed.cpu.name}
       or (throw "Unsupported OVMF `fwPrefix` on ${stdenv.hostPlatform.parsed.cpu.name}"),
-  metaPlatforms ? edk2.meta.platforms,
+  metaPlatforms ? lib.subtractLists lib.platforms.i686 edk2.meta.platforms,
 }:
 
 let
 
   platformSpecific = {
-    i686.msVarsArgs = {
-      flavor = "OVMF";
-      archDir = "Ia32";
-    };
     x86_64.msVarsArgs = {
       flavor = "OVMF_4M";
       archDir = "X64";
diff --git a/pkgs/by-name/ak/akkoma-admin-fe/package.nix b/pkgs/by-name/ak/akkoma-admin-fe/package.nix
index e60d6588b254..c5f04681b40d 100644
--- a/pkgs/by-name/ak/akkoma-admin-fe/package.nix
+++ b/pkgs/by-name/ak/akkoma-admin-fe/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitea,
   yarn-berry_3,
   nodejs,
-  python3,
+  python311,
   pkg-config,
   libsass,
   xcbuild,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     yarn-berry
     nodejs
     pkg-config
-    python3
+    python311
     libsass
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin xcbuild;
diff --git a/pkgs/by-name/ak/akkoma/package.nix b/pkgs/by-name/ak/akkoma/package.nix
index 02f4e56fcd2c..22157be35fb4 100644
--- a/pkgs/by-name/ak/akkoma/package.nix
+++ b/pkgs/by-name/ak/akkoma/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  beamPackages,
+  beam_minimal,
   fetchFromGitea,
   cmake,
   file,
@@ -8,6 +8,16 @@
   nix-update-script,
 }:
 
+let
+  beamPackages = beam_minimal.packages.erlang_26.extend (
+    self: super: {
+      elixir = self.elixir_1_16;
+      rebar3 = self.rebar3WithPlugins {
+        plugins = with self; [ pc ];
+      };
+    }
+  );
+in
 beamPackages.mixRelease rec {
   pname = "akkoma";
   version = "3.17.0";
diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index b137ca9c9aee..d046b2d6ea85 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -14,7 +14,7 @@
   procps,
   tree,
   which,
-  fftw,
+  fftwFloat,
   pipewire,
   withPipewireLib ? true,
   symlinkJoin,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     alsa-lib
     ncurses
     libsamplerate
-    fftw
+    fftwFloat
   ];
 
   configureFlags = [
diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index e0ab69ecc1d6..c458f0521c0c 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  stdenv,
+  gcc15Stdenv,
   cmake,
   fetchFromGitHub,
   hwdata,
@@ -21,7 +21,7 @@
   wayland-protocols,
   wayland-scanner,
 }:
-stdenv.mkDerivation (finalAttrs: {
+gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
   version = "0.10.0";
 
diff --git a/pkgs/by-name/ar/armips/package.nix b/pkgs/by-name/ar/armips/package.nix
index 72c1bada4f56..a4881193b7da 100644
--- a/pkgs/by-name/ar/armips/package.nix
+++ b/pkgs/by-name/ar/armips/package.nix
@@ -1,11 +1,11 @@
 {
-  stdenv,
+  clangStdenv,
   lib,
   fetchFromGitHub,
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+clangStdenv.mkDerivation rec {
   pname = "armips";
   version = "0.11.0";
 
diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index c77839ddf6d8..92ac5803cffa 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -22,7 +22,7 @@
   lcms2,
   libraw,
   libiptcdata,
-  fftw,
+  fftwSinglePrec,
   expat,
   pcre2,
   libsigcxx,
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
     lcms2
     libraw
     libiptcdata
-    fftw
+    fftwSinglePrec
     expat
     pcre2
     libsigcxx
diff --git a/pkgs/by-name/as/asap/package.nix b/pkgs/by-name/as/asap/package.nix
index 5029244131eb..153e352ed046 100644
--- a/pkgs/by-name/as/asap/package.nix
+++ b/pkgs/by-name/as/asap/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asap";
-  version = "6.0.3";
+  version = "7.0.0";
 
   src = fetchzip {
     url = "mirror://sourceforge/project/asap/asap/${finalAttrs.version}/asap-${finalAttrs.version}.tar.gz";
-    hash = "sha256-a4RUtFue5wdoGUykLRb46s4+yR/I/7DhwE1SiWPRg8s=";
+    hash = "sha256-T4uTcaS8qIqUptggxJwZNSI/kN2NxNI+2ZUgncveb3E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 5897f83913cb..42a9e13795a5 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -4,7 +4,6 @@
   cmark,
   curl,
   fetchFromGitHub,
-  fetchpatch,
   fmt,
   fontconfig,
   freetype,
@@ -23,6 +22,7 @@
   libXi,
   libXxf86vm,
   libxcb,
+  libXrandr,
   ninja,
   pcre2,
   pixman,
@@ -34,7 +34,7 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.13";
+  version = "1.3.16.1";
 
   srcs = [
     (fetchFromGitHub {
@@ -43,7 +43,7 @@ clangStdenv.mkDerivation (finalAttrs: {
       repo = "aseprite";
       tag = "v${finalAttrs.version}";
       fetchSubmodules = true;
-      hash = "sha256-eeB/4fQp1lbNYQj9LpNhOn7DYxaTc+BcmyvY2vPzpxk=";
+      hash = "sha256-s2lWg5udg/8pXjOcj2nXDS2uE3urkg1iC0Div7wkxUY=";
     })
 
     # Translation strings
@@ -51,8 +51,8 @@ clangStdenv.mkDerivation (finalAttrs: {
       name = "aseprite-strings";
       owner = "aseprite";
       repo = "strings";
-      rev = "7b0af61dec1d98242d7eb2e9cab835d442d21235";
-      hash = "sha256-8OwwHCFP55pwLjk5O+a36hDZf9uX3P7cNliJM5SZdAg=";
+      rev = "0f49265d7e7aea4b862b7d1e670ed969e8a469b8";
+      hash = "sha256-S3YkWA5ECvyyqGvojDhIZci04CTjbJzTQiJ5FZsB4lU=";
     })
   ];
 
@@ -89,6 +89,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libXi
     libXxf86vm
     libxcb
+    libXrandr
     pcre2
     pixman
     skia-aseprite
@@ -100,6 +101,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     ./shared-fmt.patch
     ./shared-libwebp.patch
     ./shared-skia-deps.patch
+    ./shared-libjpeg-turbo.patch
   ];
 
   postPatch = ''
@@ -108,7 +110,6 @@ clangStdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
     "-DENABLE_DESKTOP_INTEGRATION=ON"
     "-DENABLE_UPDATER=OFF"
     "-DUSE_SHARED_CMARK=ON"
@@ -117,9 +118,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     "-DUSE_SHARED_FREETYPE=ON"
     "-DUSE_SHARED_GIFLIB=ON"
     "-DUSE_SHARED_HARFBUZZ=ON"
-    "-DUSE_SHARED_JPEGLIB=ON"
     "-DUSE_SHARED_LIBPNG=ON"
-    "-DUSE_SHARED_LIBWEBP=ON"
     "-DUSE_SHARED_PIXMAN=ON"
     "-DUSE_SHARED_TINYXML=OFF"
     "-DUSE_SHARED_WEBP=ON"
@@ -167,8 +166,7 @@ clangStdenv.mkDerivation (finalAttrs: {
                 - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
                 - Onion skinning.
     '';
-    maintainers = [
-    ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
     mainProgram = "aseprite";
   };
diff --git a/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch b/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
new file mode 100644
index 000000000000..a3b01fec6c57
--- /dev/null
+++ b/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
@@ -0,0 +1,21 @@
+diff --git a/cmake/FindJpegTurbo.cmake b/cmake/FindJpegTurbo.cmake
+index 33b5204..0407a6a 100644
+--- a/cmake/FindJpegTurbo.cmake
++++ b/cmake/FindJpegTurbo.cmake
+@@ -9,14 +9,11 @@
+ 
+ if(LAF_BACKEND STREQUAL "skia")
+ 
+-  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg
+-    HINTS "${SKIA_LIBRARY_DIR}" NO_DEFAULT_PATH)
+-  set(LIBJPEG_TURBO_INCLUDE_DIRS "${SKIA_DIR}/third_party/externals/libjpeg-turbo")
++  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg)
+ 
+   add_library(libjpeg-turbo STATIC IMPORTED)
+   set_target_properties(libjpeg-turbo PROPERTIES
+-    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}"
+-    INTERFACE_INCLUDE_DIRECTORIES ${LIBJPEG_TURBO_INCLUDE_DIRS})
++    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}")
+ 
+ else()
+ 
\ No newline at end of file
diff --git a/pkgs/by-name/at/atf/package.nix b/pkgs/by-name/at/atf/package.nix
index 8f0aa01360ae..326419c5f72a 100644
--- a/pkgs/by-name/at/atf/package.nix
+++ b/pkgs/by-name/at/atf/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  darwin,
   fetchFromGitHub,
   fetchpatch,
   autoreconfHook,
@@ -8,7 +9,11 @@
   gitUpdater,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  # atf is a dependency of libiconv. Avoid an infinite recursion with `pkgsStatic` by using a bootstrap stdenv.
+  stdenv' = if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
+in
+stdenv'.mkDerivation (finalAttrs: {
   pname = "atf";
   version = "0.23";
 
@@ -26,12 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail 'atf_test_program{name="srcdir_test"}' ""
     ''
     # These tests fail on Darwin.
-    + lib.optionalString (finalAttrs.doInstallCheck && stdenv.hostPlatform.isDarwin) ''
+    + lib.optionalString (finalAttrs.doInstallCheck && stdenv'.hostPlatform.isDarwin) ''
       substituteInPlace atf-c/detail/process_test.c \
         --replace-fail 'ATF_TP_ADD_TC(tp, status_coredump);' ""
     ''
     # This test fails on Linux.
-    + lib.optionalString (finalAttrs.doInstallCheck && stdenv.hostPlatform.isLinux) ''
+    + lib.optionalString (finalAttrs.doInstallCheck && stdenv'.hostPlatform.isLinux) ''
       substituteInPlace atf-c/detail/fs_test.c \
         --replace-fail 'ATF_TP_ADD_TC(tp, eaccess);' ""
     '';
diff --git a/pkgs/by-name/ba/babeld/package.nix b/pkgs/by-name/ba/babeld/package.nix
index c5cda732dc51..d9de97ca732c 100644
--- a/pkgs/by-name/ba/babeld/package.nix
+++ b/pkgs/by-name/ba/babeld/package.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-FfJNJtoMz8Bzq83vAwnygeRoTyqnESb4JlcsTIRejdk=";
   };
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail "-lrt" ""
+  '';
+
   outputs = [
     "out"
     "man"
@@ -30,7 +35,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.irif.fr/~jch/software/babel/";
     description = "Loop-avoiding distance-vector routing protocol";
     license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     mainProgram = "babeld";
   };
 }
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index 426e63a318cc..df22c33f6a97 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "23.2.11";
+  version = "23.2.12";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-+tTZRDDYHZqZBsH+RVX2pdOJPlRZqD4fFzir4VsdB3o=";
+    hash = "sha256-sJ2Kf2xslaztQhhPWioGEnQZVW0pBu5apcUOQrpkr+Y=";
   };
 
-  npmDepsHash = "sha256-y/DNm4TiPx515UgpiCX1U9fHLPk19/8LlfqTGZHDmAA=";
+  npmDepsHash = "sha256-RC93b6mGPqqPPs6wqNuwyf3vE8wr/uGArA3wIFh+dO8=";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/ba/basalt-monado/package.nix b/pkgs/by-name/ba/basalt-monado/package.nix
index 9df8831d84da..12ff1f3905da 100644
--- a/pkgs/by-name/ba/basalt-monado/package.nix
+++ b/pkgs/by-name/ba/basalt-monado/package.nix
@@ -25,6 +25,10 @@
   cudaPackages,
   enableCuda ? config.cudaSupport,
 }:
+
+let
+  opencv' = opencv.override { enableGtk3 = true; };
+in
 stdenv.mkDerivation {
   pname = "basalt-monado";
   version = "0-unstable-2025-09-25";
@@ -57,7 +61,7 @@ stdenv.mkDerivation {
     libGL
     lz4
     magic-enum
-    opencv.cxxdev
+    opencv'.cxxdev
     onetbb
     xorg.libX11
   ]
diff --git a/pkgs/by-name/ba/bazel_7/package.nix b/pkgs/by-name/ba/bazel_7/package.nix
index a30d5ad78086..dffa79c2f7c4 100644
--- a/pkgs/by-name/ba/bazel_7/package.nix
+++ b/pkgs/by-name/ba/bazel_7/package.nix
@@ -12,7 +12,8 @@
   buildFHSEnv,
   # this package (through the fixpoint glass)
   # TODO probably still need for tests at some point
-  bazel_self,
+  bazel_7,
+  bazel_self ? bazel_7,
   # native build inputs
   runtimeShell,
   zip,
@@ -35,10 +36,11 @@
   # Apple dependencies
   cctools,
   libtool,
-  sigtool,
+  darwin,
   # Allow to independently override the jdks used to build and run respectively
-  buildJdk,
-  runJdk,
+  jdk21_headless,
+  buildJdk ? jdk21_headless,
+  runJdk ? jdk21_headless,
   # Toggle for hacks for running bazel under buildBazelPackage:
   # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
   # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
@@ -417,7 +419,7 @@ stdenv.mkDerivation rec {
         # don't use system installed Xcode to run clang, use Nix clang instead
         sed -i -E \
           -e "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
-          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${sigtool}/bin/codesign;" \
+          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${darwin.sigtool}/bin/codesign;" \
           scripts/bootstrap/compile.sh \
           tools/osx/BUILD
 
diff --git a/pkgs/by-name/bi/biblioteca/package.nix b/pkgs/by-name/bi/biblioteca/package.nix
index d35040b3ad11..8c8bba890b5c 100644
--- a/pkgs/by-name/bi/biblioteca/package.nix
+++ b/pkgs/by-name/bi/biblioteca/package.nix
@@ -12,7 +12,7 @@
   gtk4,
   gobject-introspection,
   libadwaita,
-  webkitgtk,
+  webkitgtk_6_0,
   coreutils,
   makeShellWrapper,
   wrapGAppsHook4,
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     gtk4
     gobject-introspection
     libadwaita
-    webkitgtk
+    webkitgtk_6_0
     glib-networking
   ];
 
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
       gtk4.devdoc
       glib.devdoc
       libadwaita.devdoc
-      webkitgtk.devdoc
+      webkitgtk_6_0.devdoc
       gobject-introspection.devdoc
     ]
     ++ extraDocsPackage;
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index c27f27613067..b458b7e7c057 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -67,7 +67,7 @@
   pkg-config,
   potrace,
   pugixml,
-  python3Packages, # must use instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
+  python311Packages, # must use python3Packages instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
   rocmPackages, # comes with a significantly larger closure size
   rubberband,
   runCommand,
@@ -95,8 +95,8 @@ let
     (!stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) || stdenv.hostPlatform.isDarwin;
   vulkanSupport = !stdenv.hostPlatform.isDarwin;
 
-  python3 = python3Packages.python;
-  pyPkgsOpenusd = python3Packages.openusd.override (old: {
+  python3 = python311Packages.python;
+  pyPkgsOpenusd = python311Packages.openusd.override (old: {
     opensubdiv = old.opensubdiv.override { inherit cudaSupport; };
     withOsl = false;
   });
@@ -131,7 +131,7 @@ stdenv'.mkDerivation (finalAttrs: {
       substituteInPlace source/creator/CMakeLists.txt \
         --replace-fail '${"$"}{LIBDIR}/python' \
                   '${python3}' \
-        --replace-fail '${"$"}{LIBDIR}/materialx/' '${python3Packages.materialx}/'
+        --replace-fail '${"$"}{LIBDIR}/materialx/' '${python311Packages.materialx}/'
       substituteInPlace build_files/cmake/platform/platform_apple.cmake \
         --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlicommon-static.a' \
                   '${lib.getLib brotli}/lib/libbrotlicommon.dylib' \
@@ -149,12 +149,12 @@ stdenv'.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-C../build_files/cmake/config/blender_release.cmake"
 
-    (lib.cmakeFeature "MaterialX_DIR" "${python3Packages.materialx}/lib/cmake/MaterialX")
+    (lib.cmakeFeature "MaterialX_DIR" "${python311Packages.materialx}/lib/cmake/MaterialX")
     (lib.cmakeFeature "PYTHON_INCLUDE_DIR" "${python3}/include/${python3.libPrefix}")
     (lib.cmakeFeature "PYTHON_LIBPATH" "${python3}/lib")
     (lib.cmakeFeature "PYTHON_LIBRARY" "${python3.libPrefix}")
-    (lib.cmakeFeature "PYTHON_NUMPY_INCLUDE_DIRS" "${python3Packages.numpy_1}/${python3.sitePackages}/numpy/core/include")
-    (lib.cmakeFeature "PYTHON_NUMPY_PATH" "${python3Packages.numpy_1}/${python3.sitePackages}")
+    (lib.cmakeFeature "PYTHON_NUMPY_INCLUDE_DIRS" "${python311Packages.numpy_1}/${python3.sitePackages}/numpy/core/include")
+    (lib.cmakeFeature "PYTHON_NUMPY_PATH" "${python311Packages.numpy_1}/${python3.sitePackages}")
     (lib.cmakeFeature "PYTHON_VERSION" "${python3.pythonVersion}")
 
     (lib.cmakeBool "WITH_BUILDINFO" false)
@@ -221,7 +221,7 @@ stdenv'.mkDerivation (finalAttrs: {
     cmake
     llvmPackages.llvm.dev
     makeWrapper
-    python3Packages.wrapPython
+    python311Packages.wrapPython
   ]
   ++ lib.optionals cudaSupport [
     addDriverRunpath
@@ -263,7 +263,7 @@ stdenv'.mkDerivation (finalAttrs: {
     potrace
     pugixml
     python3
-    python3Packages.materialx
+    python311Packages.materialx
     rubberband
     zlib
     zstd
@@ -316,7 +316,7 @@ stdenv'.mkDerivation (finalAttrs: {
 
   pythonPath =
     let
-      ps = python3Packages;
+      ps = python311Packages;
     in
     [
       ps.materialx
@@ -362,13 +362,13 @@ stdenv'.mkDerivation (finalAttrs: {
 
   passthru = {
     python = python3;
-    pythonPackages = python3Packages;
+    pythonPackages = python311Packages;
 
     withPackages =
       f:
       (callPackage ./wrapper.nix { }).override {
         blender = finalAttrs.finalPackage;
-        extraModules = (f python3Packages);
+        extraModules = (f python311Packages);
       };
 
     tests = {
diff --git a/pkgs/by-name/bl/bluespec/package.nix b/pkgs/by-name/bl/bluespec/package.nix
index ec1bf56298e2..c5eeb8e962d9 100644
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -17,7 +17,8 @@
   yices, # bsc uses a patched version of yices
   zlib,
   ghc,
-  gmp-static,
+  gmp,
+  gmp-static ? gmp.override { withStatic = true; },
   iverilog,
   asciidoctor,
   texliveFull,
diff --git a/pkgs/by-name/bo/bob/package.nix b/pkgs/by-name/bo/bob/package.nix
deleted file mode 100644
index f4bb17388f58..000000000000
--- a/pkgs/by-name/bo/bob/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-  fetchpatch,
-}:
-
-buildGoModule rec {
-  pname = "bob";
-  version = "0.8.2";
-
-  src = fetchFromGitHub {
-    owner = "benchkram";
-    repo = "bob";
-    tag = version;
-    hash = "sha256-zmWfOLBb+GWw9v6LdCC7/WaP1Wz7UipPwqkmI1+rG8Q=";
-  };
-
-  patches = [
-    # Fix vulnerable dependencies
-    # Backport of https://github.com/benchkram/bob/pull/387
-    (fetchpatch {
-      url = "https://github.com/benchkram/bob/commit/5020e6fafbfbcb1b3add5d936886423ce882793d.patch";
-      hash = "sha256-if1ZErI0Un7d26eOkYSkEa87+VTRcEtF6JbsJYOHpHE=";
-    })
-  ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.Version=${version}"
-  ];
-
-  vendorHash = "sha256-u0nFaTQWU9O7A/RAhGaLcBka+YNGjSlpycDF8TLQALw=";
-
-  excludedPackages = [
-    "example/server-db"
-    "test/e2e"
-    "tui-example"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd bob \
-      --bash <($out/bin/bob completion) \
-      --zsh <($out/bin/bob completion -z)
-  '';
-
-  # tests require network access
-  doCheck = false;
-
-  meta = {
-    description = "Build system for microservices";
-    mainProgram = "bob";
-    homepage = "https://bob.build";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ zuzuleinen ];
-  };
-}
diff --git a/pkgs/by-name/bo/bolt-launcher/package.nix b/pkgs/by-name/bo/bolt-launcher/package.nix
index ddf07bb60edc..04678bd953db 100644
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -156,6 +156,7 @@ buildFHSEnv {
     maintainers = with lib.maintainers; [
       nezia
       jaspersurmont
+      iedame
     ];
     platforms = lib.platforms.linux;
     mainProgram = "${bolt.name}";
diff --git a/pkgs/by-name/ca/calibre-no-speech/package.nix b/pkgs/by-name/ca/calibre-no-speech/package.nix
new file mode 100644
index 000000000000..c0714078949e
--- /dev/null
+++ b/pkgs/by-name/ca/calibre-no-speech/package.nix
@@ -0,0 +1,3 @@
+{ calibre }:
+
+calibre.override { speechSupport = false; }
diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 9e8cbc4d67d6..ead9d39a9673 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -150,27 +150,35 @@ stdenv.mkDerivation (finalAttrs: {
       ]
       ++ lib.optional unrarSupport unrardll
     ))
-    piper-tts
     xdg-utils
   ]
-  ++ lib.optional speechSupport speechd-minimal;
+  ++ lib.optionals speechSupport [
+    piper-tts
+    speechd-minimal
+  ];
+
+  env = {
+    HOME = "/tmp";
+    MAGICK_INC = "${lib.getDev imagemagick}/include/ImageMagick";
+    MAGICK_LIB = "${lib.getLib imagemagick}/lib";
+    FC_INC_DIR = "${lib.getDev fontconfig}/include/fontconfig";
+    FC_LIB_DIR = "${lib.getLib fontconfig}/lib";
+    PODOFO_INC_DIR = "${lib.getDev podofo_0_10}/include/podofo";
+    PODOFO_LIB_DIR = "${lib.getLib podofo_0_10}/lib";
+    XDG_DATA_HOME = "${placeholder "out"}/share";
+    XDG_UTILS_INSTALL_MODE = "user";
+  }
+  // lib.optionalAttrs popplerSupport {
+    POPPLER_INC_DIR = "${lib.getDev poppler-utils}/include/poppler";
+    POPPLER_LIB_DIR = "${lib.getLib poppler-utils}/lib";
+  }
+  // lib.optionalAttrs speechSupport {
+    PIPER_TTS_DIR = "${lib.getBin piper-tts}/bin";
+  };
 
   installPhase = ''
     runHook preInstall
 
-    export HOME=$TMPDIR/fakehome
-    export POPPLER_INC_DIR=${poppler-utils.dev}/include/poppler
-    export POPPLER_LIB_DIR=${poppler-utils.out}/lib
-    export MAGICK_INC=${imagemagick.dev}/include/ImageMagick
-    export MAGICK_LIB=${imagemagick.out}/lib
-    export FC_INC_DIR=${fontconfig.dev}/include/fontconfig
-    export FC_LIB_DIR=${fontconfig.lib}/lib
-    export PODOFO_INC_DIR=${podofo_0_10.dev}/include/podofo
-    export PODOFO_LIB_DIR=${podofo_0_10}/lib
-    export XDG_DATA_HOME=$out/share
-    export XDG_UTILS_INSTALL_MODE="user"
-    export PIPER_TTS_DIR=${piper-tts}/bin
-
     python setup.py install --root=$out \
       --prefix=$out \
       --libdir=$out/lib \
@@ -211,7 +219,7 @@ stdenv.mkDerivation (finalAttrs: {
               optipng
             ]
           } \
-          ${if popplerSupport then popplerArgs else ""}
+          ${lib.optionalString popplerSupport popplerArgs}
       done
     '';
 
@@ -243,6 +251,9 @@ stdenv.mkDerivation (finalAttrs: {
         # Attempt to use DefaultLogger but none has been registered.
         "test_plugins"
       ]
+      ++ lib.optionals (!speechSupport) [
+        "test_speech_dispatcher"
+      ]
       ++ lib.optionals (!unrarSupport) [
         "test_unrar"
       ];
diff --git a/pkgs/by-name/ca/candy-icons/package.nix b/pkgs/by-name/ca/candy-icons/package.nix
index 892934abb557..41e3dbef3175 100644
--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-26";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "93f38a6acf70e156ca0ef2b902e44171894021de";
-    hash = "sha256-vVVqU6GkNJ6x9PrujcmoQRgEF0G6iAs8CarVZ6NZ1QA=";
+    rev = "1ec7ed314104847d6bffdc89ef67663917a67268";
+    hash = "sha256-p8WZTNHwYTom0QnWvOU0JLRbEYZlGQq/QPpK3KlwBH8=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/by-name/ca/cantata/package.nix b/pkgs/by-name/ca/cantata/package.nix
index 7f64c6c1d881..709bd0322c2a 100644
--- a/pkgs/by-name/ca/cantata/package.nix
+++ b/pkgs/by-name/ca/cantata/package.nix
@@ -25,7 +25,7 @@
   withHttpStream ? true,
   gst_all_1,
   withReplaygain ? true,
-  ffmpeg,
+  ffmpeg_6,
   speex,
   mpg123,
   withMtp ? true,
@@ -92,7 +92,7 @@ let
       ];
       enable = withReplaygain;
       pkgs = [
-        ffmpeg
+        ffmpeg_6
         speex
         mpg123
       ];
diff --git a/pkgs/by-name/ca/cargo-insta/package.nix b/pkgs/by-name/ca/cargo-insta/package.nix
index 1290aeb12d64..9993bf1cc03a 100644
--- a/pkgs/by-name/ca/cargo-insta/package.nix
+++ b/pkgs/by-name/ca/cargo-insta/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.45.0";
+  version = "1.45.1";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     tag = version;
-    hash = "sha256-LNHxyvShfuI1CAhnYeFDTSRmitKtCeeC6U/OJRWdJH0=";
+    hash = "sha256-uNf2KkwgRCBCVFDN5ql8MisfAoU4+z7XLWogyx8sgKw=";
   };
 
-  cargoHash = "sha256-mL2Z1EXXlfJyODInG+YCRtJU6xoxgS7Gt0Lpb/Rj37o=";
+  cargoHash = "sha256-U9rtovpekFiSv+RhPwgTiUVjAPPDzis1O0RrIOKWcQc=";
 
   checkFlags = [
     # Depends on `rustfmt` and does not matter for packaging.
diff --git a/pkgs/by-name/cl/clang-uml/package.nix b/pkgs/by-name/cl/clang-uml/package.nix
index fd1871133b14..36b22f932f97 100644
--- a/pkgs/by-name/cl/clang-uml/package.nix
+++ b/pkgs/by-name/cl/clang-uml/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  stdenv,
+  clangStdenv,
   cmake,
   pkg-config,
   installShellFiles,
@@ -15,7 +15,7 @@
   enableLibcxx ? false,
   debug ? false,
 }:
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "clang-uml";
   version = "0.6.2";
 
diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix
index 5cd94a72e5a6..8033100ba783 100644
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -8,7 +8,7 @@
   wrapGAppsHook3,
   v2ray-geoip,
   v2ray-domain-list-community,
-  libsoup,
+  libsoup_3,
 }:
 let
   pname = "clash-verge-rev";
@@ -38,7 +38,7 @@ let
       pnpm-hash
       vendor-hash
       meta
-      libsoup
+      libsoup_3
       ;
   };
 
diff --git a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
index 843c3f572a24..be53a106eb6f 100644
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -23,7 +23,7 @@
   kdePackages,
   libayatana-appindicator,
   libsForQt5,
-  libsoup,
+  libsoup_3,
   openssl,
   webkitgtk_4_1,
 }:
@@ -106,7 +106,7 @@ rustPlatform.buildRustPackage {
 
   buildInputs = [
     libayatana-appindicator
-    libsoup
+    libsoup_3
     openssl
     webkitgtk_4_1
   ];
diff --git a/pkgs/by-name/co/cope/package.nix b/pkgs/by-name/co/cope/package.nix
index 96fca7559688..a138bd01cb9e 100644
--- a/pkgs/by-name/co/cope/package.nix
+++ b/pkgs/by-name/co/cope/package.nix
@@ -1,10 +1,12 @@
 {
   lib,
   fetchFromGitHub,
-  perl,
-  perlPackages,
+  perl538Packages,
   makeWrapper,
 }:
+let
+  perlPackages = perl538Packages;
+in
 perlPackages.buildPerlPackage {
   pname = "cope";
   version = "0-unstable-2025-06-20";
@@ -50,7 +52,7 @@ perlPackages.buildPerlPackage {
         if [[ -f "$script" && -x "$script" ]]; then
           wrapProgram "$script" \
             --set PERL5LIB "${perlPath}:$out/lib/perl5/site_perl"
-          sed -i "1s|^#!.*perl|#!${perl}/bin/perl|" "$out/libexec/.''${script##*/}-wrapped"
+          sed -i "1s|^#!.*perl|#!${perlPackages.perl}/bin/perl|" "$out/libexec/.''${script##*/}-wrapped"
         fi
       done
       rm -r $out/${perlPackages.perl.libPrefix}/${perlPackages.perl.version}/auto
diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index 69c6777c9fc6..711e8802fda4 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -12,7 +12,7 @@
   fftw,
   libint,
   libvori,
-  libxc,
+  libxc_7,
   dftd4,
   simple-dftd3,
   tblite,
@@ -165,7 +165,7 @@ stdenv.mkDerivation rec {
     gsl
     libint
     libvori
-    libxc
+    libxc_7
     libxsmm
     mpi
     spglib
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index e4e7b1c12f45..9e439b537528 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "1.2.3";
+  version = "1.2.4";
   executables = "csharpier";
 
-  nugetHash = "sha256-mUpciGlqLVkQW+V1KEe1/p99cy4+NYCG8PGYSynNhbs=";
+  nugetHash = "sha256-kgVQpFxQmMT/eoWkGyA8A0z//p7VponlyYF+CV7Txs8=";
 
   meta = {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/ev/everest-bin/package.nix b/pkgs/by-name/ev/everest-bin/package.nix
index 696b95a59229..820d35b4c046 100644
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6064";
+  version = "6088";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6064.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6088.0/main.zip";
     extension = "zip";
-    hash = "sha256-9NFaQNxy+2XCLr7JloxaobsNGCwJ8BLXrI5gq+8KOi0=";
+    hash = "sha256-npcjx7KOCe8T4MyK1d8Z485+XlvkMgjJ5m0PN5TbpgU=";
   };
   buildInputs = [
     icu
diff --git a/pkgs/by-name/ev/everest/deps.json b/pkgs/by-name/ev/everest/deps.json
index 6a228fef7f00..8c68d82ec8a2 100644
--- a/pkgs/by-name/ev/everest/deps.json
+++ b/pkgs/by-name/ev/everest/deps.json
@@ -26,8 +26,8 @@
   },
   {
     "pname": "KeraLua",
-    "version": "1.3.2",
-    "hash": "sha256-15C9K/S9L3yzB4wmDRNWQoWNskUVcm6qZjCbQQFGMPI="
+    "version": "1.4.7",
+    "hash": "sha256-Hr8Cs+dwmDU7ZdtLaSmAvsZ+EN3zwuazb6EjUam/cCc="
   },
   {
     "pname": "MAB.DotIgnore",
@@ -64,11 +64,6 @@
     "version": "7.0.20",
     "hash": "sha256-vq59xMfrET8InzUhkAsbs2xp3ML+SO9POsbwAiYKzkA="
   },
-  {
-    "pname": "Microsoft.Build.Tasks.Git",
-    "version": "1.1.0",
-    "hash": "sha256-cwZU5VeF6aRZJqoIevJtF9hdYC1rKEf1GuqgCmoVAzE="
-  },
   {
     "pname": "Microsoft.Build.Tasks.Git",
     "version": "8.0.0",
@@ -194,21 +189,11 @@
     "version": "1.0.3",
     "hash": "sha256-vVIonl+4dlCQuxibOZoGR3o1DAhjAYpFW15dnkUpjMk="
   },
-  {
-    "pname": "Microsoft.SourceLink.Common",
-    "version": "1.1.0",
-    "hash": "sha256-bVbHHr6Mo1NUdaaQgfj1GvGPzrobRlYb2pI7f4VDslk="
-  },
   {
     "pname": "Microsoft.SourceLink.Common",
     "version": "8.0.0",
     "hash": "sha256-AfUqleVEqWuHE7z2hNiwOLnquBJ3tuYtbkdGMppHOXc="
   },
-  {
-    "pname": "Microsoft.SourceLink.GitHub",
-    "version": "1.1.0",
-    "hash": "sha256-Y5zUGJfiSj8/rQ1lK0t5Zje8rjoUhgbWrR8IpwtzB34="
-  },
   {
     "pname": "Microsoft.SourceLink.GitHub",
     "version": "8.0.0",
diff --git a/pkgs/by-name/ev/everest/package.nix b/pkgs/by-name/ev/everest/package.nix
index c51be78a6419..da5570875879 100644
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "everest";
-  version = "6064";
+  version = "6088";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -20,11 +20,11 @@ buildDotnetModule {
   src = fetchFromGitHub {
     owner = "EverestAPI";
     repo = "Everest";
-    rev = "b5257c4a51642ca0cdda7b0e4b7287e9d1fb45e3";
+    rev = "d7bc4c2716b747d243fa4347b98422766b3d8b5a";
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-aGZ0n9iBg5gnNEtZCWxhdEeIdmmKJuzuQBpdlc7P6QE=";
+    hash = "sha256-aCeqEqSxpLZjO8xskjcBjrKOFFGun1TxK88P2VO6BEg=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 49b97f96ea7b..0dc51163c5be 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.357";
+  version = "1.4.364";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-h4BcHZHKseI+L3oabvLhs9NePZTZziQdBseYDSehJqc=";
+    hash = "sha256-XOvvT13L2vOQiq0gYeWdRP/H+mu0BI47koG+DzvuAhg=";
   };
 
-  vendorHash = "sha256-jseTLfBGUmwXz63+jTgv6k4RHh1cJVPQA/DI5OYlsdA=";
+  vendorHash = "sha256-U7oVc7DiFWdnEfemSDtmo4XYJj/564qDOZzQX0AVOqc=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fa/fasmg/package.nix b/pkgs/by-name/fa/fasmg/package.nix
index 546eb5a43f6d..f1ce0c8c4673 100644
--- a/pkgs/by-name/fa/fasmg/package.nix
+++ b/pkgs/by-name/fa/fasmg/package.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
     mainProgram = "fasmg";
     homepage = "https://flatassembler.net";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.iamanaws ];
     platforms = with lib.platforms; lib.intersectLists (linux ++ darwin) x86;
   };
 }
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 61d3dbcd4295..095e51157f30 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -151,13 +151,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.2.1";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-BUtHMx44efWTiS6heCUqONxngLwUCBOoDQqxoCj189U=";
+    hash = "sha256-M1/jgIbFY0VSQrHwT9/gcfA0HJ0r2cL1eJ3Y7lmmYVE=";
   };
 
   env = {
@@ -168,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-00Ch1EcX4cxMwvuDQLzTUIY7XkE3WX8bXBUA3yMRAMI=";
+    hash = "sha256-j+V4/oxKDg4oQ+7eg34sefIMJLelOSUKXTXasQK2Z1g=";
   };
 
   patches = [
@@ -221,6 +221,17 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace tests/checks/complete.fish \
       --replace-fail '/bin/ls' '${lib.getExe' coreutils "ls"}'
 
+    substituteInPlace tests/checks/output-buffering.fish \
+      --replace-fail '/bin/echo' '${lib.getExe' coreutils "echo"}'
+
+    substituteInPlace tests/pexpects/wait.py \
+      --replace-fail 'expect_prompt("Job ' 'expect_prompt("fish: Job ' \
+      --replace-fail 'expect_str("Job ' 'expect_str("fish: Job '
+
+    substituteInPlace share/tools/web_config/webconfig.py \
+      --replace-fail 'os.environ["__fish_terminal_color_theme"]' \
+        'os.environ.get("__fish_terminal_color_theme", "default")'
+
     # Several pexpect tests are flaky
     # See https://github.com/fish-shell/fish-shell/issues/8789
     rm tests/pexpects/exit_handlers.py
diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index d6383e9ef221..d6946bbe9458 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.29.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yV8aGmY2mUAu0urIi7d1pIjhJasRX17hpmvFEQm4YpY=";
+    hash = "sha256-thSUS3OQecOSaC6e5o1yRuI7FAyy/wZEvp+tIdJrtSo=";
   };
 
-  vendorHash = "sha256-zCzMNlpBBUS2P2aywFDUp/RSl+HlfQe+L8a1+vVYbgY=";
+  vendorHash = "sha256-Z5oKy9u/aqxoEiyDJWBBoUS5WJYWcfh77kK5wyl/pdc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index 5cce3cb1d2c8..2748f03d30dc 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "newt";
-  version = "1.7.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = version;
-    hash = "sha256-R6X9DOu1iGS/a4d5kmKoBZI0L5k7S0w3SHHFQnQH/ho=";
+    hash = "sha256-ndgigIk/3/cPZaJHfxWh6XvtAJe3S57sEwNTMBH0lSE=";
   };
 
   vendorHash = "sha256-5Xr6mwPtsqEliKeKv2rhhp6JC7u3coP4nnhIxGMqccU=";
diff --git a/pkgs/by-name/fr/freetube/package.nix b/pkgs/by-name/fr/freetube/package.nix
index 6bbb8df57cd2..b0a0fa1519ef 100644
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -20,13 +20,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.12";
+  version = "0.23.12-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
-    tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-DH5uT3dPDFZnFYoiMjxpNouNDRbWDctVqvDwHpUlnkY=";
+    # tag = "v${finalAttrs.version}-beta";
+    rev = "6717114de5653b08caec20b7bf3f3217723866a4";
+    hash = "sha256-PfK4Ny8MyBJ9Xw6ozJUzu+4rX+/rLWNac3lE8dBNPE0=";
   };
 
   # Darwin requires writable Electron dist
@@ -38,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ''
     else
       ''
-        ln -s ${electron.dist} electron-dist
+        ln -s ${electron.dist} source/electron-dist
       '';
 
   patches = [
@@ -49,7 +50,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-sM9CkDnATSEUf/uuUyT4JuRmjzwa1WzIyNYEw69MPtU=";
+    hash = "sha256-at/Kq7M8qSjlDmB6R4z51VRZRvkKAGyjU6sgHho8tBQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fr/freetube/patch-build-script.patch b/pkgs/by-name/fr/freetube/patch-build-script.patch
index c543391605dd..91aa139eed4c 100644
--- a/pkgs/by-name/fr/freetube/patch-build-script.patch
+++ b/pkgs/by-name/fr/freetube/patch-build-script.patch
@@ -1,13 +1,13 @@
-diff --git a/_scripts/ebuilder.config.js b/_scripts/ebuilder.config.js
-index 5b79d961..9f5945d2 100644
---- a/_scripts/ebuilder.config.js
-+++ b/_scripts/ebuilder.config.js
-@@ -1,6 +1,8 @@
- const { name, productName } = require('../package.json')
+diff --git a/_scripts/ebuilder.config.mjs b/_scripts/ebuilder.config.mjs
+index 55e72b227..d218f5ac4 100644
+--- a/_scripts/ebuilder.config.mjs
++++ b/_scripts/ebuilder.config.mjs
+@@ -2,6 +2,8 @@ import packageDetails from '../package.json' with { type: 'json' }
  
- const config = {
+ /** @type {import('electron-builder').Configuration} */
+ export default {
 +  electronVersion: "@electron-version@",
 +  electronDist: "electron-dist",
-   appId: `io.freetubeapp.${name}`,
-   copyright: 'Copyleft © 2020-2024 freetubeapp@protonmail.com',
+   appId: `io.freetubeapp.${packageDetails.name}`,
+   copyright: 'Copyleft © 2020-2025 freetubeapp@protonmail.com',
    // asar: false,
diff --git a/pkgs/by-name/ft/ftxui/package.nix b/pkgs/by-name/ft/ftxui/package.nix
index d400a98c18b9..70bfe592bc97 100644
--- a/pkgs/by-name/ft/ftxui/package.nix
+++ b/pkgs/by-name/ft/ftxui/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
   cmake,
   doxygen,
   gbenchmark,
@@ -9,14 +10,14 @@
   gtest,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ftxui";
   version = "6.1.9";
 
   src = fetchFromGitHub {
     owner = "ArthurSonzogni";
     repo = "ftxui";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-plJxTLhOhUyuay5uYv4KLK9UTmM2vsoda+iDXVa4b+k=";
   };
 
@@ -33,20 +34,20 @@ stdenv.mkDerivation rec {
     gbenchmark
   ];
 
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
   cmakeFlags = [
     (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
     (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
-    (lib.cmakeBool "FTXUI_BUILD_TESTS" doCheck)
+    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.doCheck)
   ];
 
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
   meta = {
     homepage = "https://github.com/ArthurSonzogni/FTXUI";
-    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "Functional Terminal User Interface library for C++";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ phanirithvij ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/fu/fuse-overlayfs/package.nix b/pkgs/by-name/fu/fuse-overlayfs/package.nix
index f7c05239e374..f791a88172cc 100644
--- a/pkgs/by-name/fu/fuse-overlayfs/package.nix
+++ b/pkgs/by-name/fu/fuse-overlayfs/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.15";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "fuse-overlayfs";
     rev = "v${version}";
-    hash = "sha256-awVDq87lxMtpTADhy8k95N/4yuGH+2Fn94j3JZzkuUY=";
+    hash = "sha256-FwAv5PmiBz25PNH/IEIV6cHjhlE+1mDTrgvR2vN++ZY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fw/fwup/package.nix b/pkgs/by-name/fw/fwup/package.nix
index b4826588d27e..9d11291d7c30 100644
--- a/pkgs/by-name/fw/fwup/package.nix
+++ b/pkgs/by-name/fw/fwup/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.13.2";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
-    rev = "v${version}";
-    sha256 = "sha256-s9M734Ohf8kItoOdaxewk4Enbrm2wsT0M4Ak9+q3KA8=";
+    tag = "v${version}";
+    hash = "sha256-kVkw+/Z3+ZM1wXV/OmfaVPoUKc6MRuz8GRwpvOscuEM=";
   };
 
   nativeBuildInputs = [
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   meta = {
+    changelog = "https://github.com/fwup-home/fwup/blob/${src.tag}/CHANGELOG.md";
     description = "Configurable embedded Linux firmware update creator and runner";
     homepage = "https://github.com/fhunleth/fwup";
     license = lib.licenses.asl20;
diff --git a/pkgs/by-name/gi/gitlab-ci-ls/package.nix b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
index f14117206749..f26c5f7e12fc 100644
--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitlab-ci-ls";
-  version = "1.2.2";
+  version = "1.2.5";
   src = fetchFromGitHub {
     owner = "alesbrelih";
     repo = "gitlab-ci-ls";
     rev = "${version}";
-    hash = "sha256-ZpLkiTJP3pofDcXrQPdl5Vm6SKsp6DecwSfXWC9h2qI=";
+    hash = "sha256-Ly4pk+16RCr3r33VrYPTZGUXfUNd5IJHfA+uj7Ef3bk=";
   };
 
-  cargoHash = "sha256-wDu89bhyR4a0U9KDF0iasdYrc1GUGlYH1y6D8+NKPy4=";
+  cargoHash = "sha256-/w5inDL6ECs2Ce8Bdfr4sOKhGeFC0tE5SrW3aIXjHnA=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/go/go-errorlint/package.nix b/pkgs/by-name/go/go-errorlint/package.nix
index 732ae6ea64c4..8353d8f6d9cb 100644
--- a/pkgs/by-name/go/go-errorlint/package.nix
+++ b/pkgs/by-name/go/go-errorlint/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "go-errorlint";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "polyfloyd";
     repo = "go-errorlint";
     rev = "v${version}";
-    hash = "sha256-jczsgZAC90f2Kkrwpb9oeoK1HtlFDLOjqlexn9v5ojk=";
+    hash = "sha256-79hbXvLnlry2j1mmeHoEx1PRIRd0iRbzN6BDnUyFV+4=";
   };
 
-  vendorHash = "sha256-smOu92BigepCH02qm2Im3T65nUoR/IYhWTjhnjRPppA=";
+  vendorHash = "sha256-U/19X5iY7IHOHkbTADT4ueCJBPh/ryI4PCfg8ZbMLzU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix
index cc8df032b783..82445c16ce85 100644
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -8,6 +8,7 @@
   xorg,
   pkg-config,
   protobuf,
+  openssl,
   writableTmpDirAsHomeHook,
   nix-update-script,
   llvmPackages,
@@ -27,23 +28,34 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.13.1";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-61MFtAhz7yq2wStNWDIlBo+OubBVor0NnpOAX8nQ8K0=";
+    hash = "sha256-lMlpgsLkPQsvc5Ad8sRrwO27ytb5hpF3doUR18DUrvw=";
   };
 
-  cargoHash = "sha256-YR/QUEE+EbwytiL0xkCr/EYE0O2/B/KmuLaF6TA7N6I=";
+  cargoHash = "sha256-WPrCwvGVOuTKXEHLR0WRV+YXr4r10fQf9t/Sfs/2bNI=";
+
+  cargoBuildFlags = [
+    "--bin"
+    "goose"
+    "--bin"
+    "goosed"
+  ];
 
   nativeBuildInputs = [
     pkg-config
     protobuf
   ];
 
-  buildInputs = [ dbus ] ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];
+  buildInputs = [
+    dbus
+    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];
 
   env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
 
@@ -83,6 +95,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_successful_request"
     "--skip=routes::audio::tests::test_transcribe_endpoint_requires_auth"
     "--skip=routes::config_management::tests::test_get_provider_models_openai_configured"
+    # tunnel tests that need external connectivity to Cloudflare
+    "--skip=tunnel::lapstone_test::test_tunnel_end_to_end"
+    "--skip=tunnel::lapstone_test::test_tunnel_post_request"
     # integration tests that need network access
     "--skip=test_replayed_session::vec_uvx_mcp_server_fetch_vec_calltoolrequestparam_name_fetch_into_arguments_some_object_url_https_example_com_vec_expects"
     "--skip=test_replayed_session::vec_github_mcp_server_stdio_vec_calltoolrequestparam_name_get_file_contents_into_arguments_some_object_owner_block_repo_goose_path_readme_md_sha_ab62b863c1666232a67048b6c4e10007a2a5b83c_vec_github_personal_access_token_expects"
diff --git a/pkgs/by-name/hu/hunspell/dictionaries.nix b/pkgs/by-name/hu/hunspell/dictionaries.nix
index 127bedb9fd48..effde844fecf 100644
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@@ -969,14 +969,14 @@ rec {
   th_TH = th-th;
   th-th = mkDict {
     pname = "hunspell-dict-th-th";
-    version = "experimental-2024-04-15";
+    version = "0-unstable-2025-12-23";
     dictFileName = "th_TH";
     readmeFile = "README.md";
     src = fetchFromGitHub {
       owner = "SyafiqHadzir";
       repo = "Hunspell-TH";
-      rev = "419eb32115b936da9c949e35b35c29b8187f6c93";
-      sha256 = "sha256-aXjof5dcEoCmep3PtvVkBhcgcd2NtqUpUEu37wsi1Uk=";
+      rev = "2c85c67288df6c5c161086eb5314cb7ba360c961";
+      sha256 = "sha256-2+tfLJGPHopfwOp2FufZYVHiWSo2z4LjvCozqr6TyGU=";
     };
     meta = {
       description = "Hunspell dictionary for Central Thai (Thailand)";
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index 6e2ec524b221..d4ccaf28b2d3 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-11-07";
+  version = "0-unstable-2025-12-24";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "f9a04192e8fb90a48e1756989f582dc0baec2351";
-    hash = "sha256-W/eYgKKVqCh7SJLHk6Asc4LvU3YXvGtlL29yBMGymz4=";
+    rev = "17ecff630bece1ac81569e427088ee8b11322f36";
+    hash = "sha256-xgMcrwKhFSQeSQN7ak0iUHNsnxaprEzuRYRo2ADeTtg=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
diff --git a/pkgs/by-name/im/impala/package.nix b/pkgs/by-name/im/impala/package.nix
index d64655d707d2..9a207f17ccbb 100644
--- a/pkgs/by-name/im/impala/package.nix
+++ b/pkgs/by-name/im/impala/package.nix
@@ -21,6 +21,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/pythops/impala";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.nydragon ];
+    maintainers = with lib.maintainers; [
+      nydragon
+      bridgesense
+    ];
   };
 }
diff --git a/pkgs/by-name/ja/jack-link/package.nix b/pkgs/by-name/ja/jack-link/package.nix
index 2b1d32a5fbbb..9d0368f0fa89 100644
--- a/pkgs/by-name/ja/jack-link/package.nix
+++ b/pkgs/by-name/ja/jack-link/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jack-link";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "rncbc";
     repo = "jack_link";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UYyVGc9/NOLzFD/31zB9lhUJW8G/PGt7VkSBjntpymw=";
+    hash = "sha256-mZ74nkiAQHkJAZYHTsNcQnrisaUIyHwEDUbrvOL6CAU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/js/json-tui/package.nix b/pkgs/by-name/js/json-tui/package.nix
new file mode 100644
index 000000000000..852dba711ead
--- /dev/null
+++ b/pkgs/by-name/js/json-tui/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchpatch2,
+  fetchFromGitHub,
+
+  cmake,
+  ftxui,
+  libargs,
+  nlohmann_json,
+  gtest,
+  gbenchmark,
+
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "json-tui";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ArthurSonzogni";
+    repo = "json-tui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qS2EbCxH8sUUJMu5hwm1+Nu6SsJRfLReX56YSd1RZU4=";
+  };
+
+  patches = [
+    # fixes tests - https://github.com/ArthurSonzogni/json-tui/pull/37
+    (fetchpatch2 {
+      url = "https://github.com/ArthurSonzogni/json-tui/commit/645060a016c1e1ca84b9e1dc638a926415aaa5fe.patch?full_index=1";
+      hash = "sha256-8AZEZgU8HHyaasb/7LegSwRAMo1iyonv3XUY284nYKg=";
+    })
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    ftxui
+    libargs
+    nlohmann_json
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  checkInputs = [ gbenchmark ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  cmakeFlags = [
+    "-Wno-dev" # suppress cmake warning about deprecated usage
+    (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    homepage = "https://github.com/ArthurSonzogni/json-tui";
+    changelog = "https://github.com/ArthurSonzogni/json-tui/blob/v${finalAttrs.version}/CHANGELOG.md";
+    description = "JSON terminal UI made in C++";
+    license = lib.licenses.mit;
+    mainProgram = "json-tui";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ka/kaidan/package.nix b/pkgs/by-name/ka/kaidan/package.nix
index 531c1b50bff1..cca4bfed4d03 100644
--- a/pkgs/by-name/ka/kaidan/package.nix
+++ b/pkgs/by-name/ka/kaidan/package.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaidan";
-  version = "0.13.0-unstable-2025-12-13";
+  version = "0.13.0-unstable-2025-12-25";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
-    rev = "eb43bd732997f52c630dc94d45682713c2bb5c75";
-    hash = "sha256-YIK6te7pjD28M/5bkPnYojGeaBNk8j8pt1VPlh+OnXE=";
+    rev = "834d89c2115a48188e827089db05a88db5dc1f8f";
+    hash = "sha256-o7x6Ib9zL4akzjvz+mSACQHyj2xH6RzoCniumNjK1lw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ka/kata-runtime/kata-images.nix b/pkgs/by-name/ka/kata-runtime/kata-images.nix
index e1b15266a99c..d4eb2f22817b 100644
--- a/pkgs/by-name/ka/kata-runtime/kata-images.nix
+++ b/pkgs/by-name/ka/kata-runtime/kata-images.nix
@@ -4,6 +4,7 @@
   lib,
   stdenv,
   version,
+  zstd,
 }:
 
 let
@@ -16,16 +17,17 @@ let
 
   imageHash =
     {
-      "x86_64-linux" = "sha256-7xDc5Rr3rP36zS3kpM2QEqOCtmka3EAnts4Z1h8MNWY=";
-      "aarch64-linux" = "sha256-8nLHTPetEfIrdtrpiT9Czcpf0NhL97TZ2DXyeBL04LA=";
+      "x86_64-linux" = "sha256-roS2pGO00ORN+xxNU3/uqJG9RzhVqf8gCkt8EJJbY/g=";
+      "aarch64-linux" = "sha256-AuK5a2Qtd176B91+vSsEFwuWICpe8wcGTbXoE7B8b20=";
     }
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
 in
 fetchzip {
   name = "kata-images-${version}";
-  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.xz";
+  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.zst";
   hash = imageHash;
+  nativeBuildInputs = [ zstd ];
 
   postFetch = ''
     mv $out/kata/share/kata-containers kata-containers
diff --git a/pkgs/by-name/ka/kata-runtime/package.nix b/pkgs/by-name/ka/kata-runtime/package.nix
index 57dbe5608066..b04e9d100868 100644
--- a/pkgs/by-name/ka/kata-runtime/package.nix
+++ b/pkgs/by-name/ka/kata-runtime/package.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "3.16.0";
+  version = "3.21.0";
 
   kata-images = callPackage ./kata-images.nix { inherit version; };
 
@@ -34,7 +34,7 @@ buildGoModule rec {
     owner = "kata-containers";
     repo = "kata-containers";
     rev = version;
-    hash = "sha256-+SppAF77NbXlSrBGvIm40AmNC12GrexbX7fAPBoDAcs=";
+    hash = "sha256-gOPabvimKzP7U1/BRzjKPDKE0MHnhKI4j0WZPM6ZTSA=";
   };
 
   sourceRoot = "${src.name}/src/runtime";
diff --git a/pkgs/by-name/li/libmt32emu/package.nix b/pkgs/by-name/li/libmt32emu/package.nix
index e01401581474..9de77adc2e7c 100644
--- a/pkgs/by-name/li/libmt32emu/package.nix
+++ b/pkgs/by-name/li/libmt32emu/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmt32emu";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     tag = "libmt32emu_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-wXIvdGoup/AOQggkeXvtbi3pXhyKUKWmyt/ZbGzufds=";
+    hash = "sha256-3sL9ZDM4/70vKPkOU6Et82c3RC5OYt0eQb5miDYRU0I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index b02a921ff74d..7aa206c49634 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-12-22";
+  version = "0-unstable-2025-12-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "92ec9ff8c2d53d397b6d943788c748c073ee1fe8";
-    hash = "sha256-p2CmXbgd0oKibZa2PiS3xI6KXfsIWtJ+QyvLrc9PFWY=";
+    rev = "e24402e35d762a017127f44701cad8d3f4704f44";
+    hash = "sha256-yv0MM90ACG5JGf9ypkyK3xlr6V284F/PrPAbXjuLZWw=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index a83dc8824125..9862c8fa2314 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.5.1";
+  version = "10.6.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sD41QQJ3zGDHinynlj5lpZoOPVPyutMCLDnNZNmttHI=";
+    hash = "sha256-rNLPfDHYVGOzO7pnv7w+l8kevmKPFFJ3O5MtPN6YlG4=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix
index 7ba34b401a10..0cf2ca404349 100644
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.58.0";
+  version = "1.59.0";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-6+GVyUSDsv9INoivIsiO+eoBZvueLeDGA/9Lc2l7xRk=";
+    hash = "sha256-hd1yQ+VJenmBk2WIjO7tFdoyJ8jIq6248ljz9T6c4Vc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ly/lynis/package.nix b/pkgs/by-name/ly/lynis/package.nix
index baa2b557e16a..f50daa7f4f3e 100644
--- a/pkgs/by-name/ly/lynis/package.nix
+++ b/pkgs/by-name/ly/lynis/package.nix
@@ -7,15 +7,15 @@
   installShellFiles,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lynis";
   version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "CISOfy";
     repo = "lynis";
-    rev = version;
-    sha256 = "sha256-f1iV9OBkycrwP3ydjaGMX45JIBtzZKHEJqnEoVuZPu4=";
+    tag = finalAttrs.version;
+    hash = "sha256-XMgC6KjkLgjSOBHBx7WM7C2Vm3Z/lto7CFs10kIxwZc=";
   };
 
   nativeBuildInputs = [
@@ -28,10 +28,11 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    install -d $out/bin $out/share/lynis/plugins
-    cp -r include db default.prf $out/share/lynis/
-    cp -a lynis $out/bin
-    wrapProgram "$out/bin/lynis" --prefix PATH : ${lib.makeBinPath [ gawk ]}
+    install -d $out/bin $out/share/lynis
+    install -Dm555 -t $out/libexec lynis
+    cp -r include db default.prf plugins $out/share/lynis/
+    makeWrapper "$out/libexec/lynis" "$out/bin/lynis" \
+      --prefix PATH : ${lib.makeBinPath [ gawk ]}
 
     installManPage lynis.8
     installShellCompletion --bash --name lynis.bash \
@@ -44,6 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://cisofy.com/lynis/";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.ryneeverett ];
+    maintainers = with lib.maintainers; [ ryneeverett ];
   };
-}
+})
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 5fd306230a8f..784535d2717a 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -274,6 +274,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       leleuvilela
       bricklou
       jonhermansen
+      iedame
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 6917af413f3b..2d5c79932518 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.178.0",
+  "version": "3.179.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_linux_x86_64",
-      "hash": "sha256-UFG/N5qNuBuBnmD6FDJk3Ly+zKGaUtOEO+7H82VFeFc="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_linux_x86_64",
+      "hash": "sha256-VStFqwOut1VnspK7963VvR5tnEEmASiWxHj8riiPUCg="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_linux_aarch64",
-      "hash": "sha256-/K9VoCHacmPZuv0ycvt9GPrDG/xDPlq6AP3zAO0Lmlo="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_linux_aarch64",
+      "hash": "sha256-mK+b3oCCZ098MMYQtRoXo1BuAlxz+4rtdB7EN1vDO38="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_mac_universal",
-      "hash": "sha256-l3ho45nkazyk8byirvq5J0ZMmrqcMasUMUYBj88bh24="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_mac_universal",
+      "hash": "sha256-TX4DolNZE0dqZj3DFzCyDOKSBcfHK2b8vjJQ07SOtIM="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_mac_universal",
-      "hash": "sha256-l3ho45nkazyk8byirvq5J0ZMmrqcMasUMUYBj88bh24="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_mac_universal",
+      "hash": "sha256-TX4DolNZE0dqZj3DFzCyDOKSBcfHK2b8vjJQ07SOtIM="
     }
   }
 }
diff --git a/pkgs/by-name/na/naja/package.nix b/pkgs/by-name/na/naja/package.nix
index dfc565a5e09f..ceced274fcaa 100644
--- a/pkgs/by-name/na/naja/package.nix
+++ b/pkgs/by-name/na/naja/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "naja";
-  version = "0.3.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "najaeda";
     repo = "naja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u7pblUmMJYYd0o7jzT5g9moPrWdOgqhPXPzx+B90ybg=";
+    hash = "sha256-94sv8eeQacsCELTMIUhG9JKtJtVAxmF88Pvj9udN/fM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/no/nohang/package.nix b/pkgs/by-name/no/nohang/package.nix
new file mode 100644
index 000000000000..846a644bd6ab
--- /dev/null
+++ b/pkgs/by-name/no/nohang/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  nixosTests,
+  fetchFromGitHub,
+  python3,
+  sudo,
+  libnotify,
+  coreutils,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nohang";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "hakavlad";
+    repo = "nohang";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aRiBGnJHdtQ5euvJ4DSuCZO5i5OJVRiCesaatrIARmg=";
+  };
+
+  postPatch = ''
+    patchShebangs src
+    substituteInPlace src/nohang \
+      --replace-fail 'notify-send' '${lib.getExe libnotify}' \
+      --replace-fail 'sudo' '${lib.getExe sudo}' \
+      --replace-fail "'env'" "'${lib.getExe' coreutils "env"}'"
+  '';
+
+  buildInputs = [ python3 ];
+
+  dontBuild = true;
+
+  installTargets = [ "base" ];
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "PREFIX=/"
+    "SBINDIR=/sbin"
+    "SYSCONFDIR=/etc"
+    "SYSTEMDUNITDIR=/lib/systemd/system"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) nohang;
+  };
+
+  meta = {
+    homepage = "https://github.com/hakavlad/nohang";
+    description = "Sophisticated low memory handler for Linux";
+    license = with lib.licenses; [ mit ];
+    mainProgram = "nohang";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+})
diff --git a/pkgs/by-name/op/openapi-generator-cli/package.nix b/pkgs/by-name/op/openapi-generator-cli/package.nix
index d749b8364138..20ebc46eebd9 100644
--- a/pkgs/by-name/op/openapi-generator-cli/package.nix
+++ b/pkgs/by-name/op/openapi-generator-cli/package.nix
@@ -10,7 +10,7 @@
 
 let
   jre = jre_headless;
-  version = "7.17.0";
+  version = "7.18.0";
   mainProgram = "openapi-generator-cli";
   this = maven.buildMavenPackage {
     inherit version;
@@ -21,10 +21,10 @@ let
       owner = "OpenAPITools";
       repo = "openapi-generator";
       tag = "v${version}";
-      hash = "sha256-9jO+u08wrxW0RcXTGDh8mpPp9Eu2PwRifKNsso6s3QM=";
+      hash = "sha256-D7F4fbgXqUMH0ZOsnGtB3gVWmans0MPdD7ix6ImXsfA=";
     };
 
-    mvnHash = "sha256-PiLpJponpJUXakdno+KGxzDvZG6jYRPp3t5q/G5JX+M=";
+    mvnHash = "sha256-17siKb+TIYAuY1p7+1mcc3QY+Rfnsoy+CJiWT5LFM0w=";
     mvnParameters = "-Duser.home=$TMPDIR";
     doCheck = false;
 
diff --git a/pkgs/by-name/op/opengamepadui/package.nix b/pkgs/by-name/op/opengamepadui/package.nix
index bb6f041a135d..7e91a2d92920 100644
--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opengamepadui";
-  version = "0.42.2";
+  version = "0.42.3";
 
   buildType = if withDebug then "debug" else "release";
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ShadowBlip";
     repo = "OpenGamepadUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-POTW6qnzaVtoTo8ibCCaap0DS8VJiEGm2Mr5ZBkuLZc=";
+    hash = "sha256-sqzCGGrMxOjepi9GxJFCAY+tzuIwOgs5qYeIYKb7Y1U=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/op/opensnitch-ui/package.nix b/pkgs/by-name/op/opensnitch-ui/package.nix
index 2c7a17b2266f..9ff43d40c67e 100644
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -1,6 +1,6 @@
 {
   python3Packages,
-  qt5,
+  qt6,
   lib,
   opensnitch,
 }:
@@ -12,29 +12,21 @@ python3Packages.buildPythonApplication {
   inherit (opensnitch) src version;
   sourceRoot = "${opensnitch.src.name}/ui";
 
-  patches = [
-    # https://github.com/evilsocket/opensnitch/pull/1413
-    # unicode-slugify has failing tests and is overall unmaintained and broken.
-    # python-slugify is a preferrable replacement
-    ./use_python_slugify.patch
-  ];
-
   postPatch = ''
     substituteInPlace opensnitch/utils/__init__.py \
       --replace-fail /usr/lib/python3/dist-packages/data ${python3Packages.pyasn}/${python3Packages.python.sitePackages}/pyasn/data
   '';
 
   nativeBuildInputs = [
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    qt5.qtwayland
+    qt6.qtwayland
   ];
 
   build-system = with python3Packages; [
     setuptools
-    pyqt5
   ];
 
   dependencies = with python3Packages; [
@@ -43,7 +35,7 @@ python3Packages.buildPythonApplication {
     packaging
     pyasn
     pyinotify
-    pyqt5
+    pyqt6
     qt-material
     python-slugify
     unidecode
@@ -52,7 +44,6 @@ python3Packages.buildPythonApplication {
   preBuild = ''
     make -C ../proto ../ui/opensnitch/ui_pb2.py
     # sourced from ui/Makefile
-    pyrcc5 -o opensnitch/resources_rc.py opensnitch/res/resources.qrc
     sed -i 's/^import ui_pb2/from . import ui_pb2/' opensnitch/proto/ui_pb2*
   '';
 
diff --git a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch b/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
deleted file mode 100644
index 877b5006251a..000000000000
--- a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff --git a/requirements.txt b/requirements.txt
-index 66e0de13..68d651b1 100644
---- a/requirements.txt
-+++ b/requirements.txt
-@@ -1,5 +1,5 @@
- grpcio-tools>=1.10.1
- pyinotify==0.9.6
--unicode_slugify==0.1.5
-+python-slugify>=7.0.0
- pyqt5>=5.6
- protobuf
diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix
index b682efc1bc1e..8aeea61e15da 100644
--- a/pkgs/by-name/op/opensnitch/package.nix
+++ b/pkgs/by-name/op/opensnitch/package.nix
@@ -1,7 +1,6 @@
 {
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
   protobuf,
   go-protobuf,
   pkg-config,
@@ -35,29 +34,15 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opensnitch";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ=";
+    hash = "sha256-Bz5h2DEC61vpkeWZxFlogh6NvTubJcnHuwgTNSzZd68=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/evilsocket/opensnitch/pull/1418
-      # allow configuring the audit socket path
-      url = "https://github.com/evilsocket/opensnitch/commit/f9358a464f204068359bf5174e6ff43288f12c7e.patch?full_index=1";
-      hash = "sha256-s9CM1CyGpfJZXEtihXCM7nfPhBY8XuwubynTotqtf3E=";
-    })
-    (fetchpatch {
-      # add missing colon in test definition
-      url = "https://github.com/evilsocket/opensnitch/commit/4b38ca1260295d2e0f8c4a7313529f83dcca4554.patch?full_index=1";
-      hash = "sha256-/z3iFRpcv75FyarVnpK8/PTU2fcFHS+SNbHn7M5Etk8=";
-    })
-  ];
-
   postPatch = ''
     # Allow configuring Version at build time
     substituteInPlace daemon/core/version.go --replace-fail "const " "var "
@@ -87,13 +72,11 @@ buildGoModule (finalAttrs: {
   postBuild = ''
     mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
     mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
-    cp system-fw.json $out/etc/opensnitchd/
-    substitute default-config.json $out/etc/opensnitchd/default-config.json \
+    cp -r data/{rules,*.json} $out/etc/opensnitchd/
+    substituteInPlace $out/etc/opensnitchd/default-config.json \
       --replace-fail "/var/log/opensnitchd.log" "/dev/stdout"
-    # Do not mkdir rules path
-    sed -i '8d' opensnitchd.service
     # Fixup hardcoded paths
-    substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
+    substitute data/init/opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
       --replace-fail "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd"
   '';
 
diff --git a/pkgs/by-name/op/openvscode-server/package.nix b/pkgs/by-name/op/openvscode-server/package.nix
index ab5bb984538a..8fdde59bcfe9 100644
--- a/pkgs/by-name/op/openvscode-server/package.nix
+++ b/pkgs/by-name/op/openvscode-server/package.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvscode-server";
-  version = "1.103.1";
+  version = "1.106.3";
 
   src = fetchFromGitHub {
     owner = "gitpod-io";
     repo = "openvscode-server";
     rev = "openvscode-server-v${finalAttrs.version}";
-    hash = "sha256-Co0MF8Yr60Ppv6Zv85nJeua2S5Rnye6wGB1hTWNpMm4=";
+    hash = "sha256-wcmk35oqJ6d5MR9YnqC/pR0pC03/vCFCd9KLRByQWqk=";
   };
 
   ## fetchNpmDeps doesn't correctly process git dependencies
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
         inherit (finalAttrs) src nativeBuildInputs;
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-xK4qfzkWuOsEyP1+6cY5Dhrr5wNW3eOJBTyQaE6gTcc=";
+        outputHash = "sha256-FnlzXlhu72G9dUnezzc62qH2TG5mU9EJNe9akWtR6zg=";
         env = {
           FORCE_EMPTY_CACHE = true;
           FORCE_GIT_DEPS = true;
@@ -69,10 +69,8 @@ stdenv.mkDerivation (finalAttrs: {
         mkdir $out
         for p in $(find -name package-lock.json)
         do (
-          ${prefetch-npm-deps}/bin/prefetch-npm-deps "$p" "$out"
-          local lockpath=$out/lockfiles/$p
-          mkdir -p "$(dirname $lockpath)"
-          mv $out/package-lock.json "$lockpath"
+          echo "Prefetching $p"
+          ${prefetch-npm-deps}/bin/prefetch-npm-deps "$p" "$out/$(dirname $p)"
         )
         done
       '';
@@ -89,9 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_NODEJS_BUILDNPMPACKAGE = "1";
     npm_config_nodedir = nodejs;
     npm_config_node_gyp = "${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";
-
-    # use local npm cache (see <nixpkgs/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh>)
-    npm_config_cache = finalAttrs.nodeModules;
     npm_config_offline = true;
     npm_config_progress = false;
 
@@ -145,12 +140,9 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     export HOME=$TMPDIR/home
     mkdir -p $HOME
-    mkdir -p $TMPDIR/cache/_cacache
-    # ln -s $nodeModules/_cacache/* $TMPDIR/cache/_cacache
-    # mkdir -p $TMPDIR/cache
-    cp -R $nodeModules/_cacache $TMPDIR/cache
+    mkdir -p $TMPDIR
+    cp -R $nodeModules $TMPDIR/cache
     chmod -R +w $TMPDIR/cache
-    export npm_config_cache=$TMPDIR/cache
   '';
 
   configurePhase = ''
@@ -167,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
         echo >&2 "File exists $p/node_modules"
         exit 0
       fi
-      npm ci --ignore-scripts
+      npm_config_cache=$TMPDIR/cache/$p npm ci --ignore-scripts
       patchShebangs node_modules
     )
     done
@@ -186,13 +178,10 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   ## node-pty build fix
   + ''
-    substituteInPlace remote/node_modules/node-pty/scripts/post-install.js \
-      --replace-fail "npx node-gyp" "$npm_config_node_gyp"
-  ''
-  ## rebuild native binaries
-  + ''
-    echo >&2 "Rebuilding from source in ./remote"
-    npm --offline --prefix ./remote rebuild --build-from-source
+    find -path node_modules/node-pty/scripts/gen-compile-commands.js \
+         -exec substituteInPlace {} \
+                 --replace-fail "npx node-gyp" "$npm_config_node_gyp" \
+               \;
   ''
   ## run postinstall scripts
   + ''
@@ -200,11 +189,16 @@ stdenv.mkDerivation (finalAttrs: {
       if jq -e ".scripts.postinstall" {} >-
       then
         echo >&2 "Running postinstall script in $(dirname {})"
-        npm --offline --prefix=$(dirname {}) run postinstall
+        npm --prefix=$(dirname {}) run postinstall
       fi
       exit 0
     ' \;
   ''
+  ## rebuild native binaries
+  + ''
+    echo >&2 "Rebuilding from source in ./remote"
+    npm --prefix ./remote rebuild --build-from-source
+  ''
   + ''
     runHook postConfigure
   '';
diff --git a/pkgs/by-name/pi/pixelfed/package.nix b/pkgs/by-name/pi/pixelfed/package.nix
index a6c280df71e5..d2343eb3150a 100644
--- a/pkgs/by-name/pi/pixelfed/package.nix
+++ b/pkgs/by-name/pi/pixelfed/package.nix
@@ -44,7 +44,7 @@ php.buildComposerProject2 (finalAttrs: {
     description = "Federated image sharing platform";
     license = lib.licenses.agpl3Only;
     homepage = "https://pixelfed.org/";
-    maintainers = [ ];
+    teams = with lib.teams; [ ngi ];
     platforms = php.meta.platforms;
   };
 })
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index c0c046f00aa2..adbc135a0b4e 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gK5WkGWAS64R/msPbHDrMPtWlHQQbnxfPINmFARCBR8=";
+    hash = "sha256-s+4TH6xYs53/HVU5UD3YyjYgbc0Ul+RmC1kV7eJHO/o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index a00ccd3dc2f8..f7b14b795537 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-26";
+  version = "GE-Proton10-27";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-Q5bKTDn3sTgp4mbsevOdN3kcdRsyKylghXqM2I2cYq8=";
+    hash = "sha256-yBPjPb2LzxdgEobuoeSfs3UZ1XUxZF6vIMYF+fAnLA0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index c15bd6080c82..ace87b2c7bee 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.12.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-fqCJXWmmvgGpdJ+mAP2rizQUX3gQdN6rYW5dqkvWFns=";
+    sha256 = "sha256-CA1+Sa9fqeTaz37FCJGErShinMP6cSNoCtuifdyLUpk=";
   };
 
   vendorHash = "sha256-Kj60MkxqRYORANalbJnjgtHMDgxOUOeaF1opqcYnVww=";
diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index 739df02ab46d..8710e546aaf4 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reth";
-  version = "1.8.3";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
     repo = "reth";
     rev = "v${version}";
-    hash = "sha256-jyStSIVTQeBJGwNelxHItIjHPQyvg3luGRj0qziZ8u0=";
+    hash = "sha256-zTSwRSSZDINHEkbtTiLP3mgod9lDzFrPxMXq88NTOAM=";
   };
 
-  cargoHash = "sha256-v7B2W9SSQvUlJQzP/AAffsJq+fP4Ghxr4C5+gB1LE9k=";
+  cargoHash = "sha256-WDe75Sg7y4GfH3dSfY48aXrIBe89skj1VW0NcgtLEVU=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 2e420a04a186..5718f91fa25a 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-12-19";
+  version = "11.7-unstable-2025-12-27";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "7fb6a59b5150e6146c6d3df3bb9e9cba7ae449bc";
-    hash = "sha256-nZMvdlaVyI2zH0r8yrZn1ESN+7/Wk2D+OWujzPahnZU=";
+    rev = "3cccb2a354966fc4b7e30182b1b0956a8a84523c";
+    hash = "sha256-uLo/DvTfOU615wMm/Qgp89wdqTeSlAt0Vqv99fUPwjw=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index d1ce92a2bc34..21b5ebd51736 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2025-12-24";
 
   outputs = [
     "out"
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "f1ca8cfefba8f32095861bbcf2a4f4d773f0fbb4";
-    hash = "sha256-q0iEoN8+f438ScgAvobDh7evulfaZ3Cd8zkc19kRT54=";
+    rev = "feec623003c01a9fff5b30e114c38f550255b511";
+    hash = "sha256-AGfuUYUGbea3LDgGiwxq6XBMgLeatsdWDpciL4JeTWU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/si/sillytavern/package.nix b/pkgs/by-name/si/sillytavern/package.nix
index 821ace818dd6..ca81a2dabe7e 100644
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@@ -5,15 +5,15 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "sillytavern";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "SillyTavern";
     repo = "SillyTavern";
     tag = finalAttrs.version;
-    hash = "sha256-5bml7PwmlfJag8DzbR5qdNJ6ddKmZsEUD155VwkJhjI=";
+    hash = "sha256-yx1vPnKxhQTRnBDOTR4jEcDaU8DDDOW7P98LI3hOTHc=";
   };
-  npmDepsHash = "sha256-cqS8UFyXNql/SE1nrWhZlIXhz0SO3JUSDThsfAOHP7E=";
+  npmDepsHash = "sha256-fKFt10eg72C5wBeAQ6SQH6mBF1Lf/EADN/wCrHkDf3U=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 8145a5d2b3c3..e23f7000aa5a 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h7oYlxz9Loh4HiZDeQdWV9ycWfCaNNifgFLo1d5zOJk=";
+    hash = "sha256-7fKvSK3gatEdIHAZuOzL6LdzLz4k97G+ZKpQh39yhbs=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-Q6Bpcgav9ClM+d723jYmuunybEP5iHt9nF5ssQ1kokQ=";
+    vendorHash = "sha256-SqPegOTdjd8HrnXNIRUMAbDhKKrFR+xWZUuqblrZ10c=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
diff --git a/pkgs/by-name/sk/skia-aseprite/deps.nix b/pkgs/by-name/sk/skia-aseprite/deps.nix
index a51fe82d9bce..de50c8fa2c69 100644
--- a/pkgs/by-name/sk/skia-aseprite/deps.nix
+++ b/pkgs/by-name/sk/skia-aseprite/deps.nix
@@ -2,22 +2,33 @@
 {
   angle2 = fetchgit {
     url = "https://chromium.googlesource.com/angle/angle.git";
-    rev = "8718783526307a3fbb35d4c1ad4e8101262a0d73";
-    hash = "sha256-UXYCqn++WCyncwNyuuq8rIkxlB7koMK9Ynx7TRzCIDE=";
+    rev = "21d124c4bf321a18dae1dc94602aa262fc346a8b";
+    hash = "sha256-Cz9n2ya4l3L1lvF4elHYJCfxr3l+h5UYOEhrhtw6WJg=";
+    fetchSubmodules = false;
   };
   dng_sdk = fetchgit {
     url = "https://android.googlesource.com/platform/external/dng_sdk.git";
     rev = "c8d0c9b1d16bfda56f15165d39e0ffa360a11123";
     hash = "sha256-lTtvBUGaia0jhrxpw7k7NIq2SVyGmBJPCvjIqAQCmNo=";
   };
+  icu = fetchgit {
+    url = "https://chromium.googlesource.com/chromium/deps/icu.git";
+    rev = "a0718d4f121727e30b8d52c7a189ebf5ab52421f";
+    hash = "sha256-BI3f/gf9GNDvSfXWeRHKBvznSz4mjXY8rM24kK7QvOM=";
+  };
+  icu4x = fetchgit {
+    url = "https://chromium.googlesource.com/external/github.com/unicode-org/icu4x.git";
+    rev = "bcf4f7198d4dc5f3127e84a6ca657c88e7d07a13";
+    hash = "sha256-Lha5m97zwTBFJZZUwewCv1blQh/VgDR0G2h+GMMAzME=";
+  };
   piex = fetchgit {
     url = "https://android.googlesource.com/platform/external/piex.git";
     rev = "bb217acdca1cc0c16b704669dd6f91a1b509c406";
     hash = "sha256-IhAfxlu0UmllihBP9wbg7idT8azlbb9arLKUaZ6qNxY=";
   };
-  sfntly = fetchgit {
-    url = "https://chromium.googlesource.com/external/github.com/googlei18n/sfntly.git";
-    rev = "b55ff303ea2f9e26702b514cf6a3196a2e3e2974";
-    hash = "sha256-/zp1MsR31HehoC5OAI4RO8QBlm7mldQNiTI7Xr/LJeI=";
+  wuffs = fetchgit {
+    url = "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git";
+    rev = "e3f919ccfe3ef542cfc983a82146070258fb57f8";
+    hash = "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw=";
   };
 }
diff --git a/pkgs/by-name/sk/skia-aseprite/package.nix b/pkgs/by-name/sk/skia-aseprite/package.nix
index 446556a126b8..1f5aaf9ebda3 100644
--- a/pkgs/by-name/sk/skia-aseprite/package.nix
+++ b/pkgs/by-name/sk/skia-aseprite/package.nix
@@ -7,7 +7,6 @@
   fontconfig,
   gn,
   harfbuzzFull,
-  icu,
   lib,
   libglvnd,
   libjpeg,
@@ -26,13 +25,13 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "skia-aseprite";
-  version = "m102-861e4743af";
+  version = "m124-08a5439a6b";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "skia";
     rev = finalAttrs.version;
-    hash = "sha256-IlZbalmHl549uDUfPG8hlzub8TLWhG0EsV6HVAPdsl0=";
+    hash = "sha256-D79Z/deJsDVclcUTZXUrNZdTPW2TFNaVF4mTeHO8I+U=";
   };
 
   nativeBuildInputs = [
@@ -45,13 +44,15 @@ clangStdenv.mkDerivation (finalAttrs: {
     mkdir -p third_party/externals
     ln -s ${angle2} third_party/externals/angle2
     ln -s ${dng_sdk} third_party/externals/dng_sdk
+    ln -s ${icu} third_party/externals/icu
+    ln -s ${icu4x} third_party/externals/icu4x
     ln -s ${piex} third_party/externals/piex
-    ln -s ${sfntly} third_party/externals/sfntly
+    ln -s ${wuffs} third_party/externals/wuffs
   '';
 
   configurePhase = ''
     runHook preConfigure
-    gn gen lib --args="is_debug=false is_official_build=true extra_cflags=[\"-I${harfbuzzFull.dev}/include/harfbuzz\"]"
+    gn gen lib --args="is_debug=false is_official_build=true skia_use_system_icu=false extra_cflags=[\"-I${harfbuzzFull.dev}/include/harfbuzz\"]"
     runHook postConfigure
   '';
 
@@ -59,7 +60,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     expat
     fontconfig
     harfbuzzFull
-    icu
     libglvnd
     libjpeg
     libpng
@@ -84,20 +84,26 @@ clangStdenv.mkDerivation (finalAttrs: {
 
     # All these paths are used in some way when building Aseprite.
     cp -r --parents -t $out/ \
-      include/codec \
-      include/config \
-      include/core \
-      include/effects \
-      include/gpu \
-      include/private \
-      include/utils \
-      include/third_party/skcms/*.h \
+      include/codec/**/*.h \
+      include/config/**/*.h \
+      include/core/**/*.h \
+      include/effects/**/*.h \
+      include/gpu/**/*.h \
+      include/private/**/*.h \
+      include/utils/**/*.h \
+      include/ports/**/*.h \
+      include/sksl/**/*.h \
       lib/*.a \
-      modules/skshaper/include/*.h \
+      modules/skshaper/**/*.h \
+      modules/skcms/**/*.h \
+      modules/skunicode/**/*.h \
       src/core/*.h \
       src/gpu/**/*.h \
+      src/image/*.h \
+      src/sksl/**/*.h \
+      src/base/**/*.h \
       third_party/externals/angle2/include \
-      third_party/skcms/**/*.h
+      third_party/externals/icu/flutter/icudtl.dat
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/sk/skia-aseprite/update.sh b/pkgs/by-name/sk/skia-aseprite/update.sh
index 78f7e67da6e9..605387d5a122 100755
--- a/pkgs/by-name/sk/skia-aseprite/update.sh
+++ b/pkgs/by-name/sk/skia-aseprite/update.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell --pure -i bash
-#!nix-shell -p cacert curl git jq nix-prefetch-git
+#!nix-shell -p cacert curl git jq nix-prefetch-git nix
 # shellcheck shell=bash
 # vim: set tabstop=2 shiftwidth=2 expandtab:
 set -euo pipefail
@@ -12,17 +12,17 @@ shopt -s inherit_errexit
 }
 
 pkgpath=$(git rev-parse --show-toplevel)/pkgs/by-name/sk/skia-aseprite
-depfilter=$(tr ' ' '|' <<< "$*")
+depfilter=$(tr ' ' '|' <<<"$*")
 depfile=$pkgpath/deps.nix
 pkgfile=$pkgpath/package.nix
 
 update_deps() {
   local deps third_party_deps name url rev hash prefetch
 
-  version=$(sed -n 's|.*version = "\(.*\)".*|\1|p' < "$pkgfile")
+  version=$(sed -n 's|.*version = "\(.*\)".*|\1|p' <"$pkgfile")
   deps=$(curl -fsS https://raw.githubusercontent.com/aseprite/skia/$version/DEPS)
-  third_party_deps=$(sed -n 's|[ ",]||g; s|:| |; s|@| |; s|^third_party/externals/||p' <<< "$deps")
-  filtered=$(grep -E -- "$depfilter" <<< "$third_party_deps")
+  third_party_deps=$(sed -n 's|[ ",]||g; s|:| |; s|@| |; s|^third_party/externals/||p' <<<"$deps")
+  filtered=$(grep -E -- "$depfilter" <<<"$third_party_deps")
   if [[ -z $filtered ]]; then
     printf >&2 '%s: error: filter "%s" matched nothing' "$0" "$depfilter"
     return 1
@@ -32,16 +32,20 @@ update_deps() {
   while read -r name url rev; do
     printf >&2 'Fetching %s@%s\n' "$name" "$rev"
     prefetch=$(nix-prefetch-git --quiet --rev "$rev" "$url")
-    hash=$(jq -r '.hash' <<< "$prefetch")
+    hash=$(jq -r '.hash' <<<"$prefetch")
 
-    cat << EOF
+    cat <<EOF
   $name = fetchgit {
     url = "$url";
     rev = "$rev";
     hash = "$hash";
-  };
 EOF
-  # `read` could exit with a non-zero code without a newline at the end
+    # Avoid accidentally pulling in submodules during fetch.
+    if [[ $name == angle2 ]]; then
+      printf '    fetchSubmodules = false;\n'
+    fi
+    echo "  };"
+    # `read` could exit with a non-zero code without a newline at the end
   done < <(printf '%s\n' "$filtered")
   printf '}\n'
 }
@@ -53,8 +57,8 @@ update_version() {
       --header 'Accept: application/vnd.github+json' \
       --location --show-error --silent \
       ${GITHUB_TOKEN:+ --user \":$GITHUB_TOKEN\"} \
-      https://api.github.com/repos/aseprite/skia/releases/latest \
-      | jq -r .tag_name
+      https://api.github.com/repos/aseprite/skia/releases/latest |
+      jq -r .tag_name
   )
   newhash=$(nix-prefetch-git --quiet --rev "$newver" https://github.com/aseprite/skia.git | jq -r '.hash')
   sed \
@@ -65,7 +69,7 @@ update_version() {
 
 temp=$(mktemp)
 trap 'ret=$?; rm -rf -- "$temp"; exit $ret' EXIT
-update_version > "$temp"
+update_version >"$temp"
 cp "$temp" "$pkgfile"
-update_deps > "$temp"
+update_deps >"$temp"
 cp "$temp" "$depfile"
diff --git a/pkgs/by-name/so/soco-cli/package.nix b/pkgs/by-name/so/soco-cli/package.nix
index 80d9f25b0856..00296b38637a 100644
--- a/pkgs/by-name/so/soco-cli/package.nix
+++ b/pkgs/by-name/so/soco-cli/package.nix
@@ -6,16 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "soco-cli";
-  version = "0.4.81";
+  version = "0.4.82";
   pyproject = true;
 
-  disabled = python3.pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "avantrec";
     repo = "soco-cli";
-    rev = "v${version}";
-    hash = "sha256-Be/NzaO6EmpJC5NjNXhcp1K2ObXUduheqPWhsXI/Jc8=";
+    tag = "v${version}";
+    hash = "sha256-kD+78dNQ/dff8y9/A3qdIrARStkal3Eu7/plG0T1CrQ=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -31,14 +29,13 @@ python3.pkgs.buildPythonApplication rec {
   # Tests wants to communicate with hardware
   doCheck = false;
 
-  pythonImportsCheck = [
-    "soco_cli"
-  ];
+  pythonImportsCheck = [ "soco_cli" ];
 
   meta = {
     description = "Command-line interface to control Sonos sound systems";
     homepage = "https://github.com/avantrec/soco-cli";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/avantrec/soco-cli/blob/${src.tag}/CHANGELOG.txt";
+    license = lib.licenses.asl20;
     mainProgram = "sonos";
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/by-name/sp/spaceship-prompt/package.nix b/pkgs/by-name/sp/spaceship-prompt/package.nix
index af3a9ed7a845..72b08a20bdcb 100644
--- a/pkgs/by-name/sp/spaceship-prompt/package.nix
+++ b/pkgs/by-name/sp/spaceship-prompt/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spaceship-prompt";
-  version = "4.19.3";
+  version = "4.21.0";
 
   src = fetchFromGitHub {
     owner = "denysdovhan";
     repo = "spaceship-prompt";
     rev = "v${version}";
-    sha256 = "sha256-2RWU341FFGPOUBz86O+ocAWgER8V8yxXzWc8K1PG1CE=";
+    sha256 = "sha256-6riMk22gsLhy3LmWu9TbUCl59fli54+uLo5mWUkU9wc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sp/spearspray/package.nix b/pkgs/by-name/sp/spearspray/package.nix
new file mode 100644
index 000000000000..6ed536a4af2f
--- /dev/null
+++ b/pkgs/by-name/sp/spearspray/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "spearspray";
+  version = "2.0.0-unstable-2025-08-25";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sikumy";
+    repo = "spearspray";
+    rev = "bccb64fb672e503d2c8bf8997feb46b5ed60f3d1";
+    hash = "sha256-6CSVWUOdpv7GyD8qoTbQAqqf6GHitifsV0n5GOuFawU=";
+  };
+
+  pythonRelaxDeps = [ "neo4j" ];
+
+  build-system = with python3.pkgs; [ poetry-core ];
+
+  dependencies = with python3.pkgs; [
+    argcomplete
+    colorama
+    gssapi
+    ldap3
+    neo4j
+    questionary
+    unidecode
+  ];
+
+  pythonImportsCheck = [ "spearspray" ];
+
+  # Project has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Tool for doing Password Spraying with User Intelligence";
+    homepage = "https://github.com/sikumy/spearspray";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "spearspray";
+  };
+}
diff --git a/pkgs/by-name/sp/splitcode/package.nix b/pkgs/by-name/sp/splitcode/package.nix
index 15e5973ee38c..ab3d6fe420dd 100644
--- a/pkgs/by-name/sp/splitcode/package.nix
+++ b/pkgs/by-name/sp/splitcode/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "splitcode";
-  version = "0.31.5";
+  version = "0.31.6";
 
   src = fetchFromGitHub {
     owner = "pachterlab";
     repo = "splitcode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x2N+IQHB6gbEKTEofsWy7SwVf1lvRxh5f93avtAs8fM=";
+    hash = "sha256-80XrLr6gk398a/JVSpb8j0i2pMEDKn0EnTiSw7cWS2c=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -25,12 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
-  postPatch = ''
-    # https://github.com/pachterlab/splitcode/pull/46
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 2.8.12 3.10
-  '';
-
   doCheck = true;
   checkPhase = ''
     mkdir func_tests
@@ -44,7 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool for flexible, efficient parsing, interpreting, and editing of technical sequences in sequencing reads";
     homepage = "https://github.com/pachterlab/splitcode";
     license = lib.licenses.bsd2;
-    platforms = lib.platforms.all;
+    # also compiles on macos, but since it seems to return invalid results.
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ zimward ];
     mainProgram = "splitcode";
     badPlatforms = [
diff --git a/pkgs/by-name/sp/spraycharles/package.nix b/pkgs/by-name/sp/spraycharles/package.nix
new file mode 100644
index 000000000000..f252fd0bef02
--- /dev/null
+++ b/pkgs/by-name/sp/spraycharles/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "spraycharles";
+  version = "2.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Tw1sm";
+    repo = "spraycharles";
+    tag = "v${version}";
+    hash = "sha256-HQ57+LBBlpjPnmgbh4+esRoIgTSE7+4JYRwHE8CTb1c=";
+  };
+
+  pythonRelaxDeps = true;
+
+  build-system = with python3.pkgs; [ poetry-core ];
+
+  dependencies = with python3.pkgs; [
+    discord-webhook
+    impacket
+    numpy
+    pymsteams
+    pyyaml
+    requests
+    requests-ntlm
+    rich
+    typer
+    typer-config
+  ];
+
+  pythonImportsCheck = [ "spraycharles" ];
+
+  # Project has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Low and slow password spraying tool";
+    homepage = "https://github.com/Tw1sm/spraycharles";
+    changelog = "https://github.com/Tw1sm/spraycharles/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "spraycharles";
+  };
+}
diff --git a/pkgs/by-name/ta/taskhound/package.nix b/pkgs/by-name/ta/taskhound/package.nix
new file mode 100644
index 000000000000..367465d81fcf
--- /dev/null
+++ b/pkgs/by-name/ta/taskhound/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "taskhound";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "1r0BIT";
+    repo = "TaskHound";
+    tag = "v${version}";
+    hash = "sha256-qQ1OpJCgMcRKGkZCRjLiUO+u4SSIA/qExzq2K7m7BD8=";
+  };
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
+    bhopengraph
+    dnspython
+    impacket
+    ldap3
+    neo4j
+    pycryptodome
+    requests
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "taskhound" ];
+
+  meta = {
+    description = "Tool to enumerate privileged Scheduled Tasks on Remote Systems";
+    homepage = "https://github.com/1r0BIT/TaskHound";
+    changelog = "https://github.com/1r0BIT/TaskHound/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "taskhound";
+  };
+}
diff --git a/pkgs/by-name/ti/ticker/package.nix b/pkgs/by-name/ti/ticker/package.nix
index cd82a0449d96..19bf92d11418 100644
--- a/pkgs/by-name/ti/ticker/package.nix
+++ b/pkgs/by-name/ti/ticker/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "ticker";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "achannarasappa";
     repo = "ticker";
     tag = "v${version}";
-    hash = "sha256-/W/BZzrIkz/3F2jzQGJ79UycrdEBVTMF+YncCS5TibE=";
+    hash = "sha256-GH+2as3aK462cTguGekbB4HchVzC1HdBsXwJHwAh47Q=";
   };
 
   vendorHash = "sha256-EKc9QRDSOD4WetCXORjMUlaFqh0+B3Aa3m5SR1WiKN4=";
diff --git a/pkgs/by-name/tu/tuios/package.nix b/pkgs/by-name/tu/tuios/package.nix
index 9592da19d55d..18447a1e17a2 100644
--- a/pkgs/by-name/tu/tuios/package.nix
+++ b/pkgs/by-name/tu/tuios/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tuios";
-  version = "0.4.4";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "Gaurav-Gosain";
     repo = "tuios";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GptP8iw3yqXKJiYv7cJEdNCTib7HAhveFCwMKvfv+3I=";
+    hash = "sha256-OBdVnKt3XkuzztgNcwla/EGqmAhNuRGkT6boJw5UITQ=";
   };
 
-  vendorHash = "sha256-uhqa850dHRHNZLXUMGg9Hb8skEY/5CrGmxSmnBytW/s=";
+  vendorHash = "sha256-kDZRT/Ua+SaxyZ6RI9ZY2tqBgQBWo755fvQVRupBsUc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 9d71a46a6f1c..8be945c009fb 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-HSmRRSsti0TcGaidmYJ7zAzdDpbbitEP+GpqQU2HgMw=";
+    hash = "sha256-PSw+yRAj6i2qld+10FEMWRxOaqzqu+4CYJcO0PAgG0g=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-d5F9xp770b4M5T5k04/1DiMsXm9RwkL6IZuaSrACfvM=";
+  cargoHash = "sha256-XRiIngGFG8j3zQd6QMAFoZ64M7X4NkXCwYiUKA6oefA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ui/uiua/unstable.nix b/pkgs/by-name/ui/uiua/unstable.nix
index 923f9ff07ce5..531b52fbd5d7 100644
--- a/pkgs/by-name/ui/uiua/unstable.nix
+++ b/pkgs/by-name/ui/uiua/unstable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.18.0-dev.3";
+  version = "0.18.0-dev.4";
   tag = version;
-  hash = "sha256-0xQIbKLvdoFfh0Kxgopb4z0K2HCueEGm0Mq1erpcITc=";
-  cargoHash = "sha256-34FaXwBUtbF4V9hJjud3gQKpqOZm3FG2fEF/QLYUqXY=";
+  hash = "sha256-/uM92x0jBgfbkBY5/NFPBDHgH+caISEtJiiXAFQj61A=";
+  cargoHash = "sha256-MsoLvwFlVBJnbWMA8Z7wCjQKJ9VHYhAV1HpNVmM+MEo=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/va/varunastra/package.nix b/pkgs/by-name/va/varunastra/package.nix
new file mode 100644
index 000000000000..7b2d9f1046e6
--- /dev/null
+++ b/pkgs/by-name/va/varunastra/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "varunastra";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "redhuntlabs";
+    repo = "Varunastra";
+    tag = "v${version}";
+    hash = "sha256-nyvTbfKEwUwHwuKSRaABigM6eG6LFGd9HwGpATUg/5E=";
+  };
+
+  vendorHash = "sha256-gt33THFCJWTqnhX1+O0WZJH2sbskM/NEZru7QUDFgQs=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Tool to enhance the security of Docker environments";
+    homepage = "https://github.com/redhuntlabs/Varunastra";
+    changelog = "https://github.com/redhuntlabs/Varunastra/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "varunastra";
+  };
+}
diff --git a/pkgs/by-name/wi/witr/package.nix b/pkgs/by-name/wi/witr/package.nix
index d418d3fd4144..f1cc59446a06 100644
--- a/pkgs/by-name/wi/witr/package.nix
+++ b/pkgs/by-name/wi/witr/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "witr";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "pranshuparmar";
     repo = "witr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RA3dTTprYL6kmSiADqm2uR2QbFebpKPoOE3oyfGiNuI=";
+    hash = "sha256-U93fdcJ6Xdo2Z9WMVCFR2wxo1dhXVFd5MWGTF8B9a3M=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -26,11 +26,6 @@ buildGoModule (finalAttrs: {
 
   vendorHash = null;
 
-  # temporary, until go 1.25.5 is merged from staging-next to master
-  postPatch = ''
-    substituteInPlace go.mod --replace-fail 'go 1.25.5' 'go 1.25.4'
-  '';
-
   ldflags = [
     "-X main.version=v${finalAttrs.version}"
   ];
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index fb43d24ca732..9efa57b0d93f 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "25.5.31";
+  version = "25.12.29";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
-  cargoHash = "sha256-5oNhqiQYkzaNZ1vK3hV5vWQCNr6D9VPNoqkS8ZOLf/4=";
+  cargoHash = "sha256-AoUAAzbooKzaiMy9izYk7MSY/frfEuB9wMcdorXWIQw=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-05-30";
+  env.VERGEN_BUILD_DATE = "2025-12-29";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-Er9d/5F34c2Uw+DN/9j+j7TdeWiSxMQlZSgsATC04cM=";
+      hash = "sha256-xOltBlD5nU8kMzh7GPoTtkDD8sEDAzTtaR3LRPDWRS0=";
     };
 
     man_src = fetchFromGitHub {
diff --git a/pkgs/by-name/yk/ykush/package.nix b/pkgs/by-name/yk/ykush/package.nix
index 778f19deee39..f8507e20849f 100644
--- a/pkgs/by-name/yk/ykush/package.nix
+++ b/pkgs/by-name/yk/ykush/package.nix
@@ -8,15 +8,15 @@
 }:
 stdenv.mkDerivation (final: {
   pname = "ykushcmd";
-  version = "1.2.5";
+  version = "1.4.0";
 
   buildInputs = [ libusb1 ];
 
   src = fetchFromGitHub {
     owner = "yepkit";
     repo = "ykush";
-    tag = "${final.version}";
-    hash = "sha256-FbqlXh8A5hzpthBE3jZ1LLOMs4WcEGke3sOZi9vmZF8=";
+    tag = "v${final.version}";
+    hash = "sha256-+ssr1QHKjEdK8pFkmyHYwG9tY7YHaYcIIJUqaEXixOg=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/zs/zsh-you-should-use/package.nix b/pkgs/by-name/zs/zsh-you-should-use/package.nix
index cea990d28ef0..5a95dbf66104 100644
--- a/pkgs/by-name/zs/zsh-you-should-use/package.nix
+++ b/pkgs/by-name/zs/zsh-you-should-use/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zsh-you-should-use";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "MichaelAquilina";
     repo = "zsh-you-should-use";
     tag = finalAttrs.version;
-    hash = "sha256-dG6E6cOKu2ZvtkwxMXx/op3rbevT1QSOQTgw//7GmSk=";
+    hash = "sha256-u3abhv9ewq3m4QsnsxT017xdlPm3dYq5dqHNmQhhcpI=";
   };
 
   strictDeps = true;
@@ -33,6 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/MichaelAquilina/zsh-you-should-use";
+    changelog = "https://github.com/MichaelAquilina/zsh-you-should-use/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3;
     description = "ZSH plugin that reminds you to use existing aliases for commands you just typed";
     maintainers = with lib.maintainers; [ tomodachi94 ];
diff --git a/pkgs/development/compilers/fasm/bin.nix b/pkgs/development/compilers/fasm/bin.nix
index 2b496cfb1fa4..2d33d126edad 100644
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://flatassembler.net/download.php";
     license = lib.licenses.bsd2;
     mainProgram = "fasm";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.iamanaws ];
     platforms = [
       "i686-linux"
       "x86_64-linux"
diff --git a/pkgs/development/compilers/llvm/common/clang-tools/wrapper b/pkgs/development/compilers/llvm/common/clang-tools/wrapper
index 1008023fdc0d..2cb84ece693b 100755
--- a/pkgs/development/compilers/llvm/common/clang-tools/wrapper
+++ b/pkgs/development/compilers/llvm/common/clang-tools/wrapper
@@ -4,7 +4,7 @@ buildcpath() {
   local path after
   while (( $# )); do
     case $1 in
-        -isystem)
+        -isystem|-cxx-isystem)
             shift
             path=$path${path:+':'}$1
             ;;
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 90f237dbc1db..2493597be825 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -27,9 +27,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.2".officialRelease.sha256 = "sha256-SgZdBL0ivfv6/4EqmPQ+I57qT2t6i/rqnm20+T1BsFY=";
     "22.0.0-git".gitRelease = {
-      rev = "185f5fd5ce4c65116ca8cf6df467a682ef090499";
-      rev-version = "22.0.0-unstable-2025-12-21";
-      sha256 = "sha256-NcDH3JspWmq6B3wFy4wkbAzdpsKJojrJpQyAIm7qFdQ=";
+      rev = "2c72af88213c0f9c507d9c8b34a39de8173a6fcc";
+      rev-version = "22.0.0-unstable-2025-12-28";
+      sha256 = "sha256-R7WcZLas5+a4gUDzG0EBLL1S56PvUBZM6c91nYhmEsQ=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index 0565e578a7bb..c31d89f5b588 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -4,7 +4,7 @@
   fetchurl,
 }:
 let
-  version = "110.99.8";
+  version = "110.99.9";
   baseurl = "https://smlnj.cs.uchicago.edu/dist/working/${version}";
 
   arch = if stdenv.hostPlatform.is64bit then "64" else "32";
diff --git a/pkgs/development/compilers/smlnj/hashes.json b/pkgs/development/compilers/smlnj/hashes.json
index 236174684457..0e9a1b551058 100644
--- a/pkgs/development/compilers/smlnj/hashes.json
+++ b/pkgs/development/compilers/smlnj/hashes.json
@@ -1,27 +1,27 @@
 {
-  "boot.amd64-unix.tgz": "sha256-udLexaSne+fK87rcEWauTL2RL7eyLAQclFlHf1348GQ=",
-  "boot.x86-unix.tgz": "sha256-pNPW12mc17QcLq+vg8l8nYmFOEy6VbdCAlRTFwOXL/o=",
-  "config.tgz": "sha256-63pvIXHI4XJ+R2mn7vcvcuxf8a6FYd1giICZeJjbAjs=",
-  "cm.tgz": "sha256-JBjG6OXw0F6DiDSd4O1wiGmRxxj4gXrs+baVevO4Xd0=",
-  "compiler.tgz": "sha256-GsEFh6XhEAi144+r2B0m5n7bWlPwnm5b89JxTBSAGGw=",
-  "runtime.tgz": "sha256-q4ViTS3/OuHkNChRrECOANWshmu0EGtFdSWF5jHIbcU=",
-  "system.tgz": "sha256-x7TzZKUNZFAmnv4iR4bJ0uK+pMVMKrt0F9NViJNw7s8=",
-  "MLRISC.tgz": "sha256-fKWObr2uulRF0HCUaG19xwUkHlSEyB2OmDvjsX9904o=",
-  "smlnj-lib.tgz": "sha256-79ExeRN/w/Tgi+L4FY6th5JKBh1Ga5SqlLZ7kErjYK0=",
-  "old-basis.tgz": "sha256-qkOFr+slwF/kMqH9346RHHqMCFUkhgt43JJedhNjHHI=",
-  "ckit.tgz": "sha256-VxeJBBJviCJGjiT0fb7nXKxPxrM5eZtOjHt9+Nw5wZ8=",
-  "nlffi.tgz": "sha256-miwWceBsB9M4iuFjgwPX1K6Ljx2NXPrL3YczbrSkEco=",
-  "cml.tgz": "sha256-pF0zZdSt8RMWKv7Yb6s3GTvfBiIIOfHqXLAs+tFH02c=",
-  "eXene.tgz": "sha256-XkaLMzyCTYD4vHrd83iZ40ETlZH8TQBO7c4WpqcSF3I=",
-  "ml-lpt.tgz": "sha256-vBZ7QUQSKaLN171usPGyORuxSg965egAwI2HgfylIWU=",
-  "ml-lex.tgz": "sha256-f2cSozI8QCZJByE4FFF8FAJPINAXkfTUeTLCebYS8yw=",
-  "ml-yacc.tgz": "sha256-eS7zzvEkkBg8teP3Kb8wMLXogUM6zLukkBXIEo0mm1Y=",
-  "ml-burg.tgz": "sha256-tRKoTgC0eGBvay6nfS+w8+XFnq2I6oaBltPhSNKCai4=",
-  "pgraph.tgz": "sha256-t7lrnIUHo9QPYP9VUxSc+BW98Ppc7JuBukjenvHy+jk=",
-  "trace-debug-profile.tgz": "sha256-ZEEY14wrAxayLUO7EKcnFRfsN78ZIoONXkNCJ0Wyggk=",
-  "heap2asm.tgz": "sha256-M94j6ElcXRjUYbRZGnvHORBdokEYomC2dB4hbFVOdOM=",
-  "smlnj-c.tgz": "sha256-ebZX6mgIPCBMA4ygCVMJrh8InqVFY/kNZEY0jwbFw6E=",
-  "doc.tgz": "sha256-Jml2Do2yufMtN80avD9ffRt5voTmLFIuMTOaiXLhHwo=",
-  "asdl.tgz": "sha256-nNiLcWjGqyEyp9JVrti+wT2LgxKqOV0GNK5z/NxKTG0=",
-  "version": "110.99.8"
+  "boot.amd64-unix.tgz": "sha256-K0wju05JvgQAQ6two9+OksJv/hy6ZS7YA0jNP+LRnGM=",
+  "boot.x86-unix.tgz": "sha256-IHv92S8Te+R5M1RcwfMw548B3HbCk2V5cdAvWJ+usdk=",
+  "config.tgz": "sha256-v0ebpRhlL8GTrAlU5GxyxTVqM8aYD5/La89uVcdzFBg=",
+  "cm.tgz": "sha256-Oufr7JPsZJs4Ycvzg7l3Q10mvA4bHBQnwI2mbJq43b8=",
+  "compiler.tgz": "sha256-s+TCoUIBB2oZUCD9uU+dl1oAT8BmNhESQwfNcNXzZ5Y=",
+  "runtime.tgz": "sha256-IW4Bk6GTri5ZKW0nxC5ho6p6Ft3ak206BqK5RZJ2t5I=",
+  "system.tgz": "sha256-mg69PE3c932D7hVX+/ijoTR8HJXkE+mfptWoNZpXq1Y=",
+  "MLRISC.tgz": "sha256-2U33ZeraqeyY3Kvh2NuymXWo00FSziKPPe/6fTtfdWA=",
+  "smlnj-lib.tgz": "sha256-68nW25FtS5mCk91AJHYAh5ZP2LNL8556pPknxAH6NKo=",
+  "old-basis.tgz": "sha256-sBwAX50UZir4TGiAAYR22A8tXkisN8o6kGiGuMXxw/s=",
+  "ckit.tgz": "sha256-FYb6ICqh8poWDewJ6lhxClK3S2FaYD+yysNhgwHVXZo=",
+  "nlffi.tgz": "sha256-Kcz408GxyGFPh+C3xu5bL2xux4z2MhY/Fk6Lcb2G4ME=",
+  "cml.tgz": "sha256-7+r63cQwe2AuXRPs92wtUiEkxeQDQdkEn5+RK8j2eu4=",
+  "eXene.tgz": "sha256-jEyNeCPP06ULU8fWaxwfYYVHfwRDEh63SzwwhQgFfis=",
+  "ml-lpt.tgz": "sha256-QbE7uExNE5vDdDxOq/ybGWW8YO93FHnmyKOB4Vlhf5g=",
+  "ml-lex.tgz": "sha256-JbE3lYH7mWpzLNWR0DLTiDOOXR2PlcThh6ImWyEO9oY=",
+  "ml-yacc.tgz": "sha256-ED4m5lQPN4ned/HpnPMVUGgsnqIsP8HwbxJRqNXSYzA=",
+  "ml-burg.tgz": "sha256-+aih2ysnlPavDivDeHinz5PKPxaXJ8XwFm7TYUCjOYs=",
+  "pgraph.tgz": "sha256-e+T6QI6J7zVZ6c3eb8J4BYdU7QtroYdpXFxdVADReR8=",
+  "trace-debug-profile.tgz": "sha256-r0X3H+0QjEAECI7HE127Zs/jguce2amSn/ql9pv06F8=",
+  "heap2asm.tgz": "sha256-HiIXN8bNZ1WtQVYICz3jVKpGISpTHcIwSwKBTF8Dbz4=",
+  "smlnj-c.tgz": "sha256-IWjIVlKuqw3eqzOSItJP75VqlgoVYBru2yutUe4F8FQ=",
+  "doc.tgz": "sha256-c6ZFpZVFQ4cz5av8TeSQJVOmg90XuERcrbb5PFzdEuY=",
+  "asdl.tgz": "sha256-OUBWt9G9uUwnni8FJXHNU8EsPRLxVM23y3sFiaVp490=",
+  "version": "110.99.9"
 }
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 3e1a38195ac4..e54a8077d761 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -1,8 +1,6 @@
 {
   lib,
   clangStdenv,
-  buildPackages,
-  runCommand,
   fetchurl,
   perl,
   python3,
@@ -65,7 +63,7 @@
   bubblewrap,
   libseccomp,
   libbacktrace,
-  systemd,
+  systemdLibs,
   xdg-dbus-proxy,
   replaceVars,
   glib,
@@ -74,7 +72,7 @@
   enableGeoLocation ? true,
   enableExperimental ? false,
   withLibsecret ? true,
-  systemdSupport ? lib.meta.availableOn clangStdenv.hostPlatform systemd,
+  systemdSupport ? lib.meta.availableOn clangStdenv.hostPlatform systemdLibs,
   testers,
   fetchpatch,
 }:
@@ -191,7 +189,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     xorg.libX11
   ]
   ++ lib.optionals systemdSupport [
-    systemd
+    systemdLibs
   ]
   ++ lib.optionals enableGeoLocation [
     geoclue2
diff --git a/pkgs/development/ocaml-modules/ezgzip/default.nix b/pkgs/development/ocaml-modules/ezgzip/default.nix
new file mode 100644
index 000000000000..49ec207f46b5
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ezgzip/default.nix
@@ -0,0 +1,37 @@
+{
+  alcotest,
+  astring,
+  buildDunePackage,
+  camlzip,
+  fetchurl,
+  lib,
+  ocplib-endian,
+  qcheck,
+  rresult,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "ezgzip";
+  version = "0.2.3";
+  src = fetchurl {
+    url = "https://github.com/hcarty/ezgzip/releases/download/v${finalAttrs.version}/ezgzip-v${finalAttrs.version}.tbz";
+    hash = "sha256-iGju25j4Oy1T8JGoJ9ubeltOm6U4u8CAyRtKxLr2edQ=";
+  };
+  propagatedBuildInputs = [
+    astring
+    camlzip
+    ocplib-endian
+    rresult
+  ];
+  checkInputs = [
+    alcotest
+    qcheck
+  ];
+  doCheck = true;
+  meta = {
+    description = "Simple gzip (de)compression library";
+    homepage = "https://github.com/hcarty/ezgzip";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+})
diff --git a/pkgs/development/ocaml-modules/qcheck/core.nix b/pkgs/development/ocaml-modules/qcheck/core.nix
index f80eff860259..19f8c8cf9ac5 100644
--- a/pkgs/development/ocaml-modules/qcheck/core.nix
+++ b/pkgs/development/ocaml-modules/qcheck/core.nix
@@ -7,13 +7,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "qcheck-core";
-  version = "0.27";
+  version = "0.91";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "qcheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UfBfFVSvDeVPUakj2GQCRy5G5IZBxrgdceYtj+VAYbg=";
+    hash = "sha256-ToF+bRbiq1P5YaGOKiW//onJDhxaxmnaz9/JbJ82OWM=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/reason-react/default.nix b/pkgs/development/ocaml-modules/reason-react/default.nix
index a447c3172d60..148a79fe5cee 100644
--- a/pkgs/development/ocaml-modules/reason-react/default.nix
+++ b/pkgs/development/ocaml-modules/reason-react/default.nix
@@ -5,7 +5,7 @@
   reason-react-ppx,
 }:
 
-buildDunePackage {
+buildDunePackage (finalAttrs: {
   pname = "reason-react";
   inherit (reason-react-ppx) version src;
   nativeBuildInputs = [
@@ -25,4 +25,4 @@ buildDunePackage {
   meta = reason-react-ppx.meta // {
     description = "Reason bindings for React.js";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/reason-react/ppx.nix b/pkgs/development/ocaml-modules/reason-react/ppx.nix
index d81cbf021849..578a35604678 100644
--- a/pkgs/development/ocaml-modules/reason-react/ppx.nix
+++ b/pkgs/development/ocaml-modules/reason-react/ppx.nix
@@ -3,18 +3,21 @@
   fetchurl,
   lib,
   ppxlib,
+  version ? if lib.versionAtLeast ppxlib.version "0.36" then "0.17.0" else "0.16.0",
 }:
 
-let
-  version = "0.16.0";
-in
-buildDunePackage {
+buildDunePackage (finalAttrs: {
   pname = "reason-react-ppx";
   inherit version;
   minimalOCamlVersion = "4.14";
   src = fetchurl {
-    url = "https://github.com/reasonml/reason-react/releases/download/${version}/reason-react-${version}.tbz";
-    hash = "sha256-esPB+mvHHTQ3mUYILrkOjMELJxRDIsWleFcxIwOPQ1w=";
+    url = "https://github.com/reasonml/reason-react/releases/download/${finalAttrs.version}/reason-react-${finalAttrs.version}.tbz";
+    hash =
+      {
+        "0.16.0" = "sha256-esPB+mvHHTQ3mUYILrkOjMELJxRDIsWleFcxIwOPQ1w=";
+        "0.17.0" = "sha256-ArZ6CL1UjcGYPBvGnvQX7Qa16+mQT3T8mETHprT/MYw=";
+      }
+      ."${finalAttrs.version}";
   };
   buildInputs = [ ppxlib ];
   doCheck = false; # Needs to run in reason-react, see default.nix
@@ -23,6 +26,5 @@ buildDunePackage {
     homepage = "https://github.com/reasonml/reason-react";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vog ];
-    broken = lib.versionAtLeast ppxlib.version "0.36";
   };
-}
+})
diff --git a/pkgs/development/python-modules/bhopengraph/default.nix b/pkgs/development/python-modules/bhopengraph/default.nix
new file mode 100644
index 000000000000..1a35ed31cd92
--- /dev/null
+++ b/pkgs/development/python-modules/bhopengraph/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "bhopengraph";
+  version = "1.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "p0dalirius";
+    repo = "bhopengraph";
+    tag = "v${version}";
+    hash = "sha256-rpJZhABYsiv3uZdb6zLEYGYMOv8Gyd6kZ9k0d9Ob1FQ=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonImportsCheck = [ "bhopengraph" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Library to create BloodHound OpenGraphs";
+    homepage = "https://github.com/p0dalirius/bhopengraph";
+    changelog = "https://github.com/p0dalirius/bhopengraph/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 72e44a39c631..4b5154187665 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -67,19 +67,19 @@
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "1.3.7";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = version;
-    hash = "sha256-4jnja4uGIH0+hua7YRIrsxWCRJLstCCcHodmaGZ0+x8=";
+    hash = "sha256-1saQEMaGuhXT+3bSlxl7yCXYptsOiYh3Uyn4Izn5Q4M=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-Vs/uoH6If8G5GoKpxnNC7HWBfP4VjLXb4ZziuAP63c8=";
+    hash = "sha256-zqE3NhTYrHol5Y6/CRMPQeq43Wo+ofic9SrMLqyJJPs=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
diff --git a/pkgs/development/python-modules/deltachat2/default.nix b/pkgs/development/python-modules/deltachat2/default.nix
index d7f7b7113812..d23e2f8b6105 100644
--- a/pkgs/development/python-modules/deltachat2/default.nix
+++ b/pkgs/development/python-modules/deltachat2/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "deltachat2";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adbenitez";
     repo = "deltachat2";
     tag = version;
-    hash = "sha256-RVEohIFILAaCGuOwq6VmK7qLOKKP4cTuTMX+9DBO+Ns=";
+    hash = "sha256-/Q524yoY25kcRNYgFw2k/lJJ3ydVN3hhoaC571nh1cw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dirigera/default.nix b/pkgs/development/python-modules/dirigera/default.nix
index 2f5faa833929..dc6af39b87a1 100644
--- a/pkgs/development/python-modules/dirigera/default.nix
+++ b/pkgs/development/python-modules/dirigera/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pydantic,
   pytestCheckHook,
-  pythonOlder,
   requests,
   setuptools,
   websocket-client,
@@ -12,15 +11,13 @@
 
 buildPythonPackage rec {
   pname = "dirigera";
-  version = "1.2.4";
+  version = "1.2.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "Leggin";
     repo = "dirigera";
-    tag = "v${version}";
+    tag = version;
     hash = "sha256-xFiAhlNbl20MPFNkl8J4vx+KgvINYS3P5EAQxc620/k=";
   };
 
@@ -39,10 +36,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module for controlling the IKEA Dirigera Smart Home Hub";
     homepage = "https://github.com/Leggin/dirigera";
-    changelog = "https://github.com/Leggin/dirigera/releases/tag/v${version}";
+    changelog = "https://github.com/Leggin/dirigera/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "generate-token";
-    broken = lib.versionOlder pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 94af8a7b0800..c5b254174737 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.9.5";
+  version = "1.9.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-7CnnvID4BCI53zrpXqaCu1ii+ZIE15BCbZGXtcfFkC0=";
+    hash = "sha256-alw1QQJ0w9LEWztCvY0gCfQVPGVkyl+IPd8+YgDWyr8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 570c096e224c..a5fcc3116566 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202512281";
+  version = "0.1.202512291";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-gv3E+bIZiWqSBB5zXjSz5RicZY9aGY+EVtMbcUNpDNU=";
+    hash = "sha256-mxnPrl9INy/PgSc0M9qPDTvI5vtlvpLvbity5YWqDeg=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/langchain-mistralai/default.nix b/pkgs/development/python-modules/langchain-mistralai/default.nix
index fb5812ecbd34..130f01f33fea 100644
--- a/pkgs/development/python-modules/langchain-mistralai/default.nix
+++ b/pkgs/development/python-modules/langchain-mistralai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-mistralai";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-mistralai==${version}";
-    hash = "sha256-dmuDgKQW1yAz/8tjQx7LaUiuz5Sh4cAyd9nt33mCPbI=";
+    hash = "sha256-cdUl6LusttH6c0tBvaxQR5UGHjwyubKELCDv61VQ6Qo=";
   };
 
   sourceRoot = "${src.name}/libs/partners/mistralai";
diff --git a/pkgs/development/python-modules/lcn-frontend/default.nix b/pkgs/development/python-modules/lcn-frontend/default.nix
index f77e574dff6e..0c9b2a2398d9 100644
--- a/pkgs/development/python-modules/lcn-frontend/default.nix
+++ b/pkgs/development/python-modules/lcn-frontend/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lcn-frontend";
-  version = "0.2.7";
+  version = "0.2.8";
   pyproject = true;
 
   src = fetchPypi {
     pname = "lcn_frontend";
     inherit version;
-    hash = "sha256-YymktD+w07A97KNmpdonrFrTf8w5J7FuDg4k1lIwxC8=";
+    hash = "sha256-1NOZGV2sLlJABBa3pzfOcBanSgqQ4DQGb61nkRgNVzw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 7ae45f470ff2..6d6a2f2eaad9 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "moyopy";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "moyo";
     tag = "v${version}";
-    hash = "sha256-jocBC0jP0gx8RsmLuV5RjQm3+XDMAEhO+v55ao5GIqE=";
+    hash = "sha256-3NL2++a2OxasgoEZbyo9/bfKDxH7e1J/kaKiwvygAZY=";
   };
 
   sourceRoot = "${src.name}/moyopy";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-mGePfCIg2xREmFmIs05oAJvzL22XbLr3yG5VyV46/nQ=";
+    hash = "sha256-nNKc+U3T6Iv8UqrkKlgCsehBGzjCjvEhTJMLRge27h4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/niquests/default.nix b/pkgs/development/python-modules/niquests/default.nix
index e9e52639cd98..d6166512aac3 100644
--- a/pkgs/development/python-modules/niquests/default.nix
+++ b/pkgs/development/python-modules/niquests/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "niquests";
-  version = "3.15.2";
+  version = "3.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "niquests";
     tag = "v${version}";
-    hash = "sha256-QRVefE/85k6fT0zhAzX4wFB79ANf7LUshWsbi+fpSgk=";
+    hash = "sha256-SfHjzkVgoxLhqzFmR1PiPUHHrHgyHlFUfF0VPv6Ed3Y=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 1ec87b3943bd..d9873bbfde06 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-data";
-  version = "1.2.10";
+  version = "1.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = version;
-    hash = "sha256-9SxIslA/gfIe1lboWuK5/Ya7trMhVJokf7X3P0XyELE=";
+    hash = "sha256-Verxvo81rFphT1fV6fs6JaVM/kSVqni9Zn5rq5Yq3rU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyportainer/default.nix b/pkgs/development/python-modules/pyportainer/default.nix
index 77df3c0bdf02..40862ff174d8 100644
--- a/pkgs/development/python-modules/pyportainer/default.nix
+++ b/pkgs/development/python-modules/pyportainer/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyportainer";
-  version = "1.0.15";
+  version = "1.0.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwindouna";
     repo = "pyportainer";
     tag = "v${version}";
-    hash = "sha256-Lp2bX5+lsfSPEuc0q+tD8tBrMdKq7GZC+tG0cuieNOQ=";
+    hash = "sha256-sLjNCSPzEtws6mzvVYRPUq/TsJ6q4Oui5li6L0uU/Qg=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index e42ba01767db..9832b8f52abc 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     repo = "scs-python";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-MC63xCZxJsHOiarMsQYtXljTV8xdIfJHzkUG5mV63NA=";
+    hash = "sha256-ZxbQ1WbavDKKYBmGB2W0zMVCH/WZIk8bFJ5TmC+QqYc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 91faac1e6c6d..8a80140b10d3 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.20";
+  version = "3.1.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-ihuxIw3FUmZDyvIMkjhAgMIkZP+PFji33b21l9LaaI0=";
+    hash = "sha256-wyI6lsMPMbRINs2hQ9Pn2YtruA/VilAgjKbTptTfyfg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchio/default.nix b/pkgs/development/python-modules/torchio/default.nix
index 8411f4438727..c6c1c3d2899a 100644
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "torchio";
-  version = "0.21.0";
+  version = "0.21.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TorchIO-project";
     repo = "torchio";
     tag = "v${version}";
-    hash = "sha256-y3p5LdBC/O82GVroA5B0PNC5qRwVjNbiNroJrV1iU/A=";
+    hash = "sha256-ut1uRak87J5b1bjLkupUB2HZEog8WVFwLMHNtNhmC4s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 83322dd12397..332e980ce69f 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "7.6.7";
+  version = "7.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-S0Y+BylUR9BwOWZP524oCBskGRNHpQNDfwQqjDniGc4=";
+    hash = "sha256-F2sb3JgbNjbmgS5o9vUCWOBgII4Vv2E8Ml6ijTQA8D8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/typer-config/default.nix b/pkgs/development/python-modules/typer-config/default.nix
new file mode 100644
index 000000000000..b3447e2bfc9d
--- /dev/null
+++ b/pkgs/development/python-modules/typer-config/default.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pydantic,
+  pytestCheckHook,
+  python-dotenv,
+  pyyaml,
+  schema,
+  toml,
+  typer,
+  uv-build,
+}:
+
+buildPythonPackage rec {
+  pname = "typer-config";
+  version = "1.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "maxb2";
+    repo = "typer-config";
+    tag = version;
+    hash = "sha256-pR32E6zdlfNpzIS4u/WOCxuqrnjDWZYiroUu92RBHVM=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.7.19,<0.8.0" "uv_build"
+  '';
+
+  build-system = [ uv-build ];
+
+  dependencies = [ typer ];
+
+  optional-dependencies = {
+    all = [
+      python-dotenv
+      pyyaml
+      toml
+    ];
+    python-dotenv = [ python-dotenv ];
+    toml = [ toml ];
+    yaml = [ pyyaml ];
+  };
+
+  nativeCheckInputs = [
+    pydantic
+    pytestCheckHook
+    schema
+  ]
+  ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "typer_config" ];
+
+  disabledTestPaths = [
+    # Don't test the example
+    "tests/test_example.py"
+  ];
+
+  meta = {
+    description = "Utilities for working with configuration files in typer CLIs";
+    homepage = "https://github.com/maxb2/typer-config";
+    changelog = "https://github.com/maxb2/typer-config/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index 57a19c5a2e9e..ca44d1d9e78b 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -33,10 +33,10 @@
 }:
 let
   pname = "qtcreator";
-  version = "18.0.0";
+  version = "18.0.1";
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-x3O3QRTR+8pmyBuPt5mJKCfn4VQkke1FmqrSeeAlOXM=";
+    hash = "sha256-aQQ2lGfefL4swAk/K8LTfZ6NtNKqXTKblyraXrFzy1E=";
   };
   goModules =
     (buildGoModule {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 6672d00ec7b4..660526711ba8 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -29,11 +29,6 @@
         "hash": "sha256:1cvxvwlmnqw71nf6nizf0hpp710a8dsczz5bjwy3i55qwkzwa0lm",
         "lts": true
     },
-    "6.17": {
-        "version": "6.17.13",
-        "hash": "sha256:1fgdy9j90yfd4c2yqdciasdhda14pbfrpzkgriin2r6i7bf04s0i",
-        "lts": false
-    },
     "6.18": {
         "version": "6.18.2",
         "hash": "sha256:0smrmbnlhfivw2kx689wd52aff80gf0gw9wqz4s2nja9nyx6p32m",
diff --git a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
index 4211a2ce3bf4..496225940afc 100644
--- a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
@@ -3,6 +3,7 @@
   buildHomeAssistantComponent,
   fetchFromGitHub,
   beautifulsoup4,
+  cloudscraper,
   icalendar,
   icalevents,
   lxml,
@@ -13,17 +14,18 @@
 buildHomeAssistantComponent rec {
   owner = "mampfes";
   domain = "waste_collection_schedule";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hacs_waste_collection_schedule";
     tag = version;
-    hash = "sha256-qFeo2VE0sgBq4dwOUm26Vkgi+rv/0PsOyQhlVEJ45aE=";
+    hash = "sha256-+yt6kjUV+fqbOa7jj603XdGX7XtI8mXnCnmUjYFNA7c=";
   };
 
   dependencies = [
     beautifulsoup4
+    cloudscraper
     icalendar
     icalevents
     lxml
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 888110df1f1d..5267491438bc 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -368,6 +368,7 @@ mapAliases {
   blockbench-electron = throw "'blockbench-electron' has been renamed to/replaced by 'blockbench'"; # Converted to throw 2025-10-27
   bloomeetunes = throw "bloomeetunes is unmaintained and has been removed"; # Added 2025-08-26
   bmap-tools = throw "'bmap-tools' has been renamed to/replaced by 'bmaptool'"; # Converted to throw 2025-10-27
+  bob = throw "'bob' has been removed as it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-12-29
   botan2 = throw "botan2 has been removed as it is EOL"; # Added 2025-10-20
   bower2nix = throw "bower2nix has been removed as bower was removed. It is recommended to migrate to yarn."; # Added 2025-09-17
   brasero-original = throw "'brasero-original' has been renamed to/replaced by 'brasero-unwrapped'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a188cfffd790..7cd3d4b5c16c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -277,10 +277,6 @@ with pkgs;
 
   cve = with python3Packages; toPythonApplication cvelib;
 
-  basalt-monado = callPackage ../by-name/ba/basalt-monado/package.nix {
-    opencv = opencv.override { enableGtk3 = true; };
-  };
-
   bloodhound-py = with python3Packages; toPythonApplication bloodhound-py;
 
   # Zip file format only allows times after year 1980, which makes e.g. Python
@@ -323,15 +319,6 @@ with pkgs;
 
   chef-cli = callPackage ../tools/misc/chef-cli { };
 
-  clang-uml = callPackage ../by-name/cl/clang-uml/package.nix {
-    stdenv = clangStdenv;
-  };
-
-  cope = callPackage ../by-name/co/cope/package.nix {
-    perl = perl538;
-    perlPackages = perl538Packages;
-  };
-
   coolercontrol = recurseIntoAttrs (callPackage ../applications/system/coolercontrol { });
 
   cup-docker-noserver = cup-docker.override { withServer = false; };
@@ -974,21 +961,6 @@ with pkgs;
 
   opnplug = adlplug.override { type = "OPN"; };
 
-  akkoma = callPackage ../by-name/ak/akkoma/package.nix {
-    beamPackages = beam_minimal.packages.erlang_26.extend (
-      self: super: {
-        elixir = self.elixir_1_16;
-        rebar3 = self.rebar3WithPlugins {
-          plugins = with self; [ pc ];
-        };
-      }
-    );
-  };
-
-  akkoma-admin-fe = callPackage ../by-name/ak/akkoma-admin-fe/package.nix {
-    python3 = python311;
-  };
-
   aegisub = callPackage ../by-name/ae/aegisub/package.nix (
     {
       luajit = luajit.override { enable52Compat = true; };
@@ -1968,10 +1940,6 @@ with pkgs;
     cairo = cairo.override { xcbSupport = true; };
   };
 
-  aquamarine = callPackage ../by-name/aq/aquamarine/package.nix {
-    stdenv = gcc15Stdenv;
-  };
-
   hyprshade = python3Packages.callPackage ../applications/window-managers/hyprwm/hyprshade { };
 
   hyprlandPlugins = recurseIntoAttrs (
@@ -3348,6 +3316,7 @@ with pkgs;
     nomad
     nomad_1_9
     nomad_1_10
+    nomad_1_11
     ;
 
   nth = with python3Packages; toPythonApplication name-that-hash;
@@ -4169,19 +4138,11 @@ with pkgs;
   adaptivecppWithCuda = adaptivecpp.override { cudaSupport = true; };
   adaptivecppWithRocm = adaptivecpp.override { rocmSupport = true; };
 
-  armips = callPackage ../by-name/ar/armips/package.nix {
-    stdenv = clangStdenv;
-  };
-
   binaryen = callPackage ../development/compilers/binaryen {
     nodejs = nodejs-slim;
     inherit (python3Packages) filecheck;
   };
 
-  bluespec = callPackage ../by-name/bl/bluespec/package.nix {
-    gmp-static = gmp.override { withStatic = true; };
-  };
-
   codon = callPackage ../development/compilers/codon {
     inherit (llvmPackages) lld stdenv;
   };
@@ -5945,13 +5906,6 @@ with pkgs;
 
   bazel = bazel_7;
 
-  bazel_7 = callPackage ../by-name/ba/bazel_7/package.nix {
-    inherit (darwin) sigtool;
-    buildJdk = jdk21_headless;
-    runJdk = jdk21_headless;
-    bazel_self = bazel_7;
-  };
-
   buildifier = bazel-buildtools;
   buildozer = bazel-buildtools;
   unused_deps = bazel-buildtools;
@@ -8557,12 +8511,6 @@ with pkgs;
 
   ### DEVELOPMENT / TESTING TOOLS
 
-  atf = callPackage ../by-name/at/atf/package.nix {
-    stdenv =
-      # atf is a dependency of libiconv. Avoid an infinite recursion with `pkgsStatic` by using a bootstrap stdenv.
-      if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
-  };
-
   ### DEVELOPMENT / LIBRARIES / AGDA
 
   agdaPackages = recurseIntoAttrs (
@@ -9563,10 +9511,6 @@ with pkgs;
 
   alfred = callPackage ../os-specific/linux/batman-adv/alfred.nix { };
 
-  alsa-utils = callPackage ../by-name/al/alsa-utils/package.nix {
-    fftw = fftwFloat;
-  };
-
   arm-trusted-firmware = callPackage ../misc/arm-trusted-firmware { };
   inherit (arm-trusted-firmware)
     buildArmTrustedFirmware
@@ -10426,10 +10370,6 @@ with pkgs;
     pinentry = pinentry-curses;
   };
 
-  blender = callPackage ../by-name/bl/blender/package.nix {
-    python3Packages = python311Packages;
-  };
-
   blender-hip = blender.override { hipSupport = true; };
 
   blucontrol = callPackage ../applications/misc/blucontrol/wrapper.nix {
@@ -12625,10 +12565,6 @@ with pkgs;
   anki-utils = callPackage ../by-name/an/anki/addons/anki-utils.nix { };
   ankiAddons = recurseIntoAttrs (callPackage ../by-name/an/anki/addons { });
 
-  art = callPackage ../by-name/ar/art/package.nix {
-    fftw = fftwSinglePrec;
-  };
-
   arx-libertatis = libsForQt5.callPackage ../games/arx-libertatis { };
 
   beancount-ing-diba = callPackage ../applications/office/beancount/beancount-ing-diba.nix {
@@ -13104,10 +13040,6 @@ with pkgs;
 
   siesta-mpi = callPackage ../applications/science/chemistry/siesta { useMpi = true; };
 
-  cp2k = callPackage ../by-name/cp/cp2k/package.nix {
-    libxc = pkgs.libxc_7;
-  };
-
   ### SCIENCE/BIOLOGY
 
   cd-hit = callPackage ../applications/science/biology/cd-hit {
@@ -14124,26 +14056,14 @@ with pkgs;
     fltk = fltk13;
   };
 
-  cantata = callPackage ../by-name/ca/cantata/package.nix {
-    ffmpeg = ffmpeg_6;
-  };
-
   libkazv = callPackage ../by-name/li/libkazv/package.nix {
     libcpr = libcpr_1_10_5;
   };
 
-  biblioteca = callPackage ../by-name/bi/biblioteca/package.nix {
-    webkitgtk = webkitgtk_6_0;
-  };
-
   libpostalWithData = callPackage ../by-name/li/libpostal/package.nix {
     withData = true;
   };
 
-  clash-verge-rev = callPackage ../by-name/cl/clash-verge-rev/package.nix {
-    libsoup = libsoup_3;
-  };
-
   gpac-unstable = callPackage ../by-name/gp/gpac/package.nix {
     releaseChannel = "unstable";
   };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 821abfb26474..96a9f223aa00 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -196,14 +196,6 @@ in
           ];
         };
 
-        linux_6_17 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.17";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
         linux_6_18 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "6.18";
           kernelPatches = [
@@ -293,6 +285,7 @@ in
         linux_6_14 = throw "linux 6.14 was removed because it has reached its end of life upstream";
         linux_6_15 = throw "linux 6.15 was removed because it has reached its end of life upstream";
         linux_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream";
+        linux_6_17 = throw "linux 6.17 was removed because it has reached its end of life upstream";
 
         linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
         linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
@@ -734,7 +727,6 @@ in
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
-    linux_6_17 = recurseIntoAttrs (packagesFor kernels.linux_6_17);
     linux_6_18 = recurseIntoAttrs (packagesFor kernels.linux_6_18);
   }
   // lib.optionalAttrs config.allowAliases {
@@ -747,6 +739,7 @@ in
     linux_6_14 = throw "linux 6.14 was removed because it reached its end of life upstream"; # Added 2025-06-22
     linux_6_15 = throw "linux 6.15 was removed because it reached its end of life upstream"; # Added 2025-08-23
     linux_6_16 = throw "linux 6.16 was removed because it reached its end of life upstream"; # Added 2025-10-22
+    linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22
   };
 
   rtPackages = {
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7635223d55dc..5bcdeeae5423 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -577,6 +577,8 @@ let
 
         extunix = callPackage ../development/ocaml-modules/extunix/default.nix { };
 
+        ezgzip = callPackage ../development/ocaml-modules/ezgzip { };
+
         ezjsonm = callPackage ../development/ocaml-modules/ezjsonm { };
 
         ezjsonm-encoding = callPackage ../development/ocaml-modules/ezjsonm-encoding { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index eaf0c9d72d73..bb80bf8f6c39 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1958,6 +1958,8 @@ self: super: with self; {
 
   bgutil-ytdlp-pot-provider = callPackage ../development/python-modules/bgutil-ytdlp-pot-provider { };
 
+  bhopengraph = callPackage ../development/python-modules/bhopengraph { };
+
   bibtexparser = callPackage ../development/python-modules/bibtexparser { };
 
   bibtexparser_2 = callPackage ../development/python-modules/bibtexparser/2.nix { };
@@ -19407,6 +19409,8 @@ self: super: with self; {
 
   typer = callPackage ../development/python-modules/typer { };
 
+  typer-config = callPackage ../development/python-modules/typer-config { };
+
   typer-shell = callPackage ../development/python-modules/typer-shell { };
 
   typer-slim = self.typer.override { package = "typer-slim"; };