diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e168e7913842..16e0a385c0b8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1903,6 +1903,12 @@
     matrix = "@schuelermine:matrix.org";
     keys = [ { fingerprint = "CDBF ECA8 36FE E340 1CEB  58FF BA34 EE1A BA3A 0955"; } ];
   }; # currently on hiatus, please do not ping until this notice is removed (or if it’s been like two years)
+  anstylian = {
+    email = "agathangelos.stylianidis@gmail.com";
+    github = "anstylian";
+    githubId = 11269403;
+    name = "Angelos Stylinidis";
+  };
   anthonyroussel = {
     email = "anthony@roussel.dev";
     github = "anthonyroussel";
@@ -10815,7 +10821,7 @@
   };
   husjon = {
     name = "Jon Erling Hustadnes";
-    email = "jonerling.hustadnes+nixpkgs@gmail.com";
+    email = "jonerling.hustadnes+nixpkgs@proton.me";
     github = "husjon";
     githubId = 554229;
   };
@@ -12076,6 +12082,11 @@
     githubId = 1198065;
     name = "Jeffrey David Johnson";
   };
+  jeffcshelton = {
+    github = "jeffcshelton";
+    githubId = 77426854;
+    name = "Jeff Shelton";
+  };
   jefferyoo = {
     email = "oojefferywm@proton.me";
     github = "jefferyoo";
@@ -14529,6 +14540,12 @@
     github = "juuyokka";
     githubId = 15185244;
   };
+  Ladas552 = {
+    email = "l.tokshalov@gmail.com";
+    github = "Ladas552";
+    githubId = 94762349;
+    name = "Ladas552";
+  };
   lafrenierejm = {
     email = "joseph@lafreniere.xyz";
     github = "lafrenierejm";
@@ -21556,6 +21573,12 @@
     githubId = 12017109;
     name = "Rabindra Dhakal";
   };
+  qb114514 = {
+    name = "qb114514";
+    email = "GNUqb114514@outlook.com";
+    github = "GNUqb114514";
+    githubId = 110373832;
+  };
   qbisi = {
     name = "qbisicwate";
     email = "qbisicwate@gmail.com";
@@ -24510,6 +24533,12 @@
     github = "siph";
     githubId = 6619112;
   };
+  siphc = {
+    name = "siphc";
+    github = "siphc";
+    githubId = 42943030;
+    email = "ayfpan@ucla.edu";
+  };
   sir4ur0n = {
     github = "sir4ur0n";
     githubId = 1204125;
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 0344a0aa2f3c..89800b309fe9 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -76,6 +76,18 @@
   "module-services-tandoor-recipes-migrating-media-option-disallow-access": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-disallow-access"
   ],
+  "module-virtualisation-xen": [
+    "index.html#module-virtualisation-xen"
+  ],
+  "module-virtualisation-xen-installation-dom0": [
+    "index.html#module-virtualisation-xen-installation-dom0"
+  ],
+  "module-virtualisation-xen-installation-domU": [
+    "index.html#module-virtualisation-xen-installation-domU"
+  ],
+  "module-virtualisation-xen-introduction": [
+    "index.html#module-virtualisation-xen-introduction"
+  ],
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 6625d7876ed7..d1fe153f0df1 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -133,6 +133,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
 
+- Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
+
 - `services.frp` now supports multiple instances through `services.frp.instances` to make it possible to run multiple frp clients or servers at the same time.
 
 - `hyphen` now supports over 40 language variants through `hyphenDicts` and now allows to enable all supported languages through `hyphenDicts.all`.
diff --git a/nixos/modules/services/desktop-managers/budgie.nix b/nixos/modules/services/desktop-managers/budgie.nix
index 80511c4e9116..a32caa838779 100644
--- a/nixos/modules/services/desktop-managers/budgie.nix
+++ b/nixos/modules/services/desktop-managers/budgie.nix
@@ -156,15 +156,19 @@ in
       fi
     '';
 
+    # https://docs.buddiesofbudgie.org/10.10/developer/workflow/building-budgie-desktop/#compositor-recommendations
+    programs.labwc.enable = mkDefault true;
+    programs.gtklock.enable = mkDefault true;
+
     environment.systemPackages =
       with pkgs;
       [
         # Budgie Desktop.
         budgie-backgrounds
         budgie-control-center'
+        budgie-desktop-services
         (budgie-desktop-with-plugins.override { plugins = cfg.extraPlugins; })
         budgie-desktop-view
-        budgie-screensaver
         budgie-session
 
         # Required by Budgie Menu.
@@ -190,6 +194,17 @@ in
         mate.mate-system-monitor
         vlc
 
+        # Supplemental tooling.
+        # See budgie-desktop's with-runtime-dependencies meson option.
+        gammastep
+        grim
+        killall
+        slurp
+        swaybg
+        swayidle
+        wdisplays
+        wlopm
+
         # Desktop themes.
         qogir-theme
         qogir-icon-theme
@@ -224,9 +239,6 @@ in
     services.xserver.updateDbusEnvironment = true;
     programs.dconf.enable = true;
 
-    # Required by Budgie Screensaver.
-    security.pam.services.budgie-screensaver = { };
-
     # Required by Budgie's Polkit Dialog.
     security.polkit.enable = mkDefault true;
 
@@ -240,6 +252,7 @@ in
     xdg.portal.enable = mkDefault true; # for BCC's Applications panel.
     xdg.portal.extraPortals = with pkgs; [
       xdg-desktop-portal-gtk # provides a XDG Portals implementation.
+      xdg-desktop-portal-wlr # for screenshot and screencast.
     ];
     xdg.portal.configPackages = mkDefault [ pkgs.budgie-desktop ];
 
@@ -274,11 +287,7 @@ in
     # Register packages for DBus.
     services.dbus.packages = [
       budgie-control-center'
-    ];
-
-    # Register packages for udev.
-    services.udev.packages = with pkgs; [
-      magpie
+      pkgs.budgie-desktop-services
     ];
 
     # Shell integration for MATE Terminal.
diff --git a/nixos/modules/services/games/archisteamfarm.nix b/nixos/modules/services/games/archisteamfarm.nix
index d04261df013a..a64a821b5883 100644
--- a/nixos/modules/services/games/archisteamfarm.nix
+++ b/nixos/modules/services/games/archisteamfarm.nix
@@ -60,7 +60,7 @@ in
             description = "Whether to start the web-ui. This is the preferred way of configuring things such as the steam guard token.";
           };
 
-          package = lib.mkPackageOption pkgs [ "ArchiSteamFarm" "ui" ] {
+          package = lib.mkPackageOption pkgs [ "archisteamfarm" "ui" ] {
             extraDescription = ''
               ::: {.note}
               Contents must be in lib/dist
@@ -78,7 +78,7 @@ in
       description = "The Web-UI hosted on 127.0.0.1:1242.";
     };
 
-    package = lib.mkPackageOption pkgs "ArchiSteamFarm" {
+    package = lib.mkPackageOption pkgs "archisteamfarm" {
       extraDescription = ''
         ::: {.warning}
         Should always be the latest version, for security reasons,
diff --git a/nixos/modules/services/misc/polaris.nix b/nixos/modules/services/misc/polaris.nix
index c6aebe1cc66c..e326e33b6549 100644
--- a/nixos/modules/services/misc/polaris.nix
+++ b/nixos/modules/services/misc/polaris.nix
@@ -87,6 +87,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = rec {
+        Type = "notify";
         User = cfg.user;
         Group = cfg.group;
         DynamicUser = true;
diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 8b7cfce32514..4d16ddfd9a22 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -13,7 +13,6 @@ let
     mkOptionDefault
     mkIf
     literalExpression
-    optionalString
     types
     ;
   inherit (lib.generators)
@@ -79,7 +78,6 @@ let
       mkSection = (
         depth: attrs:
         let
-          atoms = extractAtoms attrs;
           sections = extractSections attrs;
           sectionHeadingLeft = lib.concatStrings (lib.replicate (depth + 1) "[");
           sectionHeadingRight = lib.concatStrings (lib.replicate (depth + 1) "]");
@@ -103,7 +101,8 @@ let
     else
       (configObjIni { }).generate "public-settings.ini" allSettings;
 
-  sabnzbdIniPath = "/var/lib/${cfg.stateDir}/sabnzbd.ini";
+  sabnzbdIniPath =
+    if cfg.configFile != null then cfg.configFile else "/var/lib/${cfg.stateDir}/sabnzbd.ini";
 in
 
 {
@@ -115,8 +114,12 @@ in
 
       configFile = mkOption {
         type = types.nullOr types.path;
-        default = null;
-        description = "Path to config file (deprecated, use `settings` instead)";
+        default =
+          if lib.versionOlder config.system.stateVersion "26.05" then
+            "/var/lib/sabnzbd/sabnzbd.ini"
+          else
+            null;
+        description = "Path to config file (deprecated, use `settings` instead and set this value to null)";
       };
 
       stateDir = mkOption {
@@ -511,7 +514,10 @@ in
     systemd.services.sabnzbd =
       let
         files =
-          (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
+          if cfg.configFile != null then
+            [ sabnzbdIniPath ]
+          else
+            (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
         iniPathQuoted = lib.escapeShellArg sabnzbdIniPath;
       in
       {
@@ -531,11 +537,20 @@ in
 
           ${lib.toShellVar "files" files}
 
+          tmpfile=$(mktemp)
+
           ${lib.getExe (pkgs.python3.withPackages (py: [ py.configobj ]))} \
             ${./config_merge.py} \
-            "''${files[@]}" | \
-          install -D -m ${if cfg.allowConfigWrite then "600" else "400"} \
-            -o '${cfg.user}' -g '${cfg.group}' /dev/stdin ${iniPathQuoted}
+            "''${files[@]}" \
+            > "$tmpfile"
+
+          install -D \
+            -m ${if cfg.allowConfigWrite then "600" else "400"} \
+            -o '${cfg.user}' -g '${cfg.group}' \
+            "$tmpfile" \
+            ${iniPathQuoted}
+
+          rm "$tmpfile"
         '';
       };
 
diff --git a/nixos/modules/services/system/userborn.nix b/nixos/modules/services/system/userborn.nix
index f9595fe72654..5649b438965b 100644
--- a/nixos/modules/services/system/userborn.nix
+++ b/nixos/modules/services/system/userborn.nix
@@ -38,6 +38,7 @@ let
   userbornStaticFiles =
     pkgs.runCommand "static-userborn" { }
       "mkdir -p $out; ${lib.getExe cfg.package} ${userbornConfigJson} $out";
+  previousConfigPath = "/var/lib/userborn/previous-userborn.json";
 
   immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
   # The filenames created by userborn.
@@ -155,6 +156,10 @@ in
         # This way we don't have to re-declare all the dependencies to other
         # services again.
         aliases = [ "systemd-sysusers.service" ];
+        environment = {
+          USERBORN_MUTABLE_USERS = lib.boolToString userCfg.mutableUsers;
+          USERBORN_PREVIOUS_CONFIG = lib.mkIf userCfg.mutableUsers previousConfigPath;
+        };
 
         unitConfig = {
           Description = "Manage Users and Groups";
@@ -165,6 +170,7 @@ in
           Type = "oneshot";
           RemainAfterExit = true;
           TimeoutSec = "90s";
+          StateDirectory = "userborn";
 
           ExecStart = "${lib.getExe cfg.package} ${userbornConfigJson} ${cfg.passwordFilesLocation}";
 
@@ -179,13 +185,18 @@ in
             ))
           ];
 
-          # Make the source files read-only after userborn has finished.
-          ExecStartPost = lib.mkIf (!userCfg.mutableUsers) (
-            lib.map (
-              file:
-              "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
-            ) passwordFiles
-          );
+          ExecStartPost =
+            if userCfg.mutableUsers then
+              # Store the config somewhere for the next invocation
+              [
+                "${pkgs.coreutils}/bin/ln -sf ${userbornConfigJson} ${previousConfigPath}"
+              ]
+            else
+              # Make the source files read-only after userborn has finished.
+              (lib.map (
+                file:
+                "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
+              ) passwordFiles);
         };
       };
     };
diff --git a/nixos/modules/services/x11/window-managers/wmii.nix b/nixos/modules/services/x11/window-managers/wmii.nix
index a2363eee6056..8ca65f0e6543 100644
--- a/nixos/modules/services/x11/window-managers/wmii.nix
+++ b/nixos/modules/services/x11/window-managers/wmii.nix
@@ -8,7 +8,7 @@
 with lib;
 let
   cfg = config.services.xserver.windowManager.wmii;
-  wmii = pkgs.wmii_hg;
+  wmii = pkgs.wmii;
 in
 {
   options = {
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index 11fd5d705760..bbd6bfb57751 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -1,5 +1,3 @@
-# Xen Project Hypervisor (Dom0) support.
-
 {
   config,
   lib,
@@ -8,35 +6,40 @@
 }:
 
 let
-  inherit (builtins) readFile;
-  inherit (lib.meta) hiPrio;
-  inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule mkIf;
-  inherit (lib.options)
-    mkOption
-    mkEnableOption
+  inherit (lib)
+    boolToString
+    getExe
+    hasSuffix
+    hiPrio
     literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
     mkPackageOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    optional
+    optionalAttrs
+    optionalString
+    optionals
+    singleton
+    teams
+    types
     ;
-  inherit (lib.types)
-    listOf
-    str
+  inherit (types)
+    addCheck
+    bool
+    enum
+    float
+    int
     ints
     lines
-    enum
-    path
-    submodule
-    addCheck
-    float
-    bool
-    int
+    listOf
     nullOr
+    path
+    str
+    submodule
     ;
-  inherit (lib.lists) optional optionals;
-  inherit (lib.strings) hasSuffix optionalString;
-  inherit (lib.meta) getExe;
-  inherit (lib.attrsets) optionalAttrs;
-  inherit (lib.trivial) boolToString;
-  inherit (lib.teams.xen) members;
 
   cfg = config.virtualisation.xen;
 
@@ -59,14 +62,12 @@ let
           diffutils
         ]
       );
-    runtimeEnv = {
-      efiMountPoint = config.boot.loader.efi.efiSysMountPoint;
-    };
+    runtimeEnv.efiMountPoint = config.boot.loader.efi.efiSysMountPoint;
 
     # We disable SC2016 because we don't want to expand the regexes in the sed commands.
     excludeShellChecks = [ "SC2016" ];
 
-    text = readFile ./xen-boot-builder.sh;
+    text = builtins.readFile ./xen-boot-builder.sh;
   };
 in
 
@@ -224,7 +225,7 @@ in
     boot = {
       params = mkOption {
         default = [ ];
-        example = ''
+        example = literalExpression ''
           [
             "iommu=force:true,qinval:true,debug:true"
             "noreboot=true"
@@ -234,8 +235,11 @@ in
         type = listOf str;
         description = ''
           Xen Command Line parameters passed to Domain 0 at boot time.
-          Note: these are different from `boot.kernelParams`. See
+
+          ::: {.note}
+          Note: these are different from {option}`boot.kernelParams`. See
           the [Xen documentation](https://xenbits.xenproject.org/docs/unstable/misc/xen-command-line.html) for more information.
+          :::
         '';
       };
       builderVerbosity = mkOption {
@@ -267,7 +271,7 @@ in
           type = path;
           default = "${cfg.package.boot}/${cfg.package.multiboot}";
           defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.multiboot}";
-          example = literalExpression "\${config.virtualisation.xen.package}/boot/xen-\${config.virtualisation.xen.package.version}";
+          example = literalExpression "\${config.virtualisation.xen.package}/boot/xen-\${config.virtualisation.xen.package.upstreamVersion}";
           description = ''
             Path to the Xen `multiboot` binary used for BIOS booting.
             Unless you're building your own Xen derivation, you should leave this
@@ -280,7 +284,7 @@ in
           type = path;
           default = "${cfg.package.boot}/${cfg.package.efi}";
           defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
-          example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
+          example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.upstreamVersion}.efi";
           description = ''
             Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file
             on `$boot/boot/xen.efi`, but an unpatched Xen build may install it
@@ -333,7 +337,7 @@ in
       extraConfig = mkOption {
         type = lines;
         default = "";
-        example = ''
+        example = literalExpression ''
           XENDOMAINS_SAVE=/persist/xen/save
           XENDOMAINS_RESTORE=false
           XENDOMAINS_CREATE_USLEEP=10000000
@@ -674,12 +678,15 @@ in
       }
       {
         assertion = config.boot.initrd.systemd.enable;
-        message = "Xen does not support the legacy script-based Stage 1 initrd.";
+        message = ''
+          Xen does not support the legacy script-based stage 1 initial ramdisk.
+          Please set 'boot.initrd.systemd.enable' to 'true'.
+        '';
       }
       {
         assertion = cfg.dom0Resources.maxMemory >= cfg.dom0Resources.memory;
         message = ''
-          You have allocated more memory to dom0 than virtualisation.xen.dom0Resources.maxMemory
+          You have allocated more memory to dom0 than 'virtualisation.xen.dom0Resources.maxMemory'
           allows for. Please increase the maximum memory limit, or decrease the default memory allocation.
         '';
       }
@@ -690,12 +697,19 @@ in
       {
         assertion = cfg.store.settings.quota.maxWatchEvents >= cfg.store.settings.quota.maxOutstanding;
         message = ''
-          Upstream Xen recommends that maxWatchEvents be equal to or greater than maxOutstanding,
+          Upstream Xen recommends that 'virtualisation.xen.store.settings.quota.maxWatchEvents'
+          be equal to or greater than 'virtualisation.xen.store.settings.quota.maxOutstanding',
           in order to mitigate denial of service attacks from malicious frontends.
         '';
       }
     ];
 
+    warnings = lib.optional ((config.boot ? lanzaboote) && config.boot.lanzaboote.enable) ''
+      Xen support has not yet been merged into Lanzaboote.
+      Ensure that your Lanzaboote configuration includes PR #387:
+      https://github.com/nix-community/lanzaboote/pull/387
+    '';
+
     virtualisation.xen.boot.params =
       optionals cfg.trace [
         "loglvl=all"
@@ -752,9 +766,7 @@ in
       };
 
       # See the `xenBootBuilder` script in the main `let...in` statement of this file.
-      loader.systemd-boot.extraInstallCommands = ''
-        ${getExe xenBootBuilder} ${cfg.boot.builderVerbosity}
-      '';
+      loader.systemd-boot.extraInstallCommands = "${getExe xenBootBuilder} ${cfg.boot.builderVerbosity}";
     };
 
     # Domain 0 requires a pvops-enabled kernel.
@@ -854,21 +866,18 @@ in
       # Xen provides systemd units.
       packages = [ cfg.package ];
 
-      mounts = [
-        {
-          description = "Mount /proc/xen files";
-          what = "xenfs";
-          where = "/proc/xen";
-          type = "xenfs";
-          unitConfig = {
-            ConditionPathExists = "/proc/xen";
-            RefuseManualStop = "true";
-          };
-        }
-      ];
+      mounts = singleton {
+        description = "Mount /proc/xen files";
+        what = "xenfs";
+        where = "/proc/xen";
+        type = "xenfs";
+        unitConfig = {
+          ConditionPathExists = "/proc/xen";
+          RefuseManualStop = "true";
+        };
+      };
 
       services = {
-
         # While this service is installed by the `xen` package, it shouldn't be used in dom0.
         xendriverdomain.enable = false;
 
@@ -926,5 +935,8 @@ in
       };
     };
   };
-  meta.maintainers = members;
+  meta = {
+    doc = ./xen.md;
+    maintainers = teams.xen.members;
+  };
 }
diff --git a/nixos/modules/virtualisation/xen.md b/nixos/modules/virtualisation/xen.md
new file mode 100644
index 000000000000..89a0fa55237a
--- /dev/null
+++ b/nixos/modules/virtualisation/xen.md
@@ -0,0 +1,62 @@
+# Xen Project Hypervisor {#module-virtualisation-xen}
+
+## Introduction {#module-virtualisation-xen-introduction}
+
+The [**Xen Project Hypervisor**](https://xenproject.org/) is an open-source
+type-1 virtual machine manager which allows multiple virtual machines, known as
+*domains*, to run concurrently with the host on the physical machine. This is
+unlike a typical type-2 hypervisor, such as QEMU, where the virtual machines run
+as applications on top of the host. NixOS runs as the privileged *Domain 0*, and
+can paravirtualise (PV Mode) or fully virtualise (HVM Mode) unprivileged domains
+(`domUs`).
+
+Xen is security-supported in NixOS. All
+[Xen Security Advisories](https://xenbits.xenproject.org/xsa) are patched within
+hours of release, and generally reach the binary cache channels within a couple
+of days.
+
+## Domain 0 Installation {#module-virtualisation-xen-installation-dom0}
+
+Xen may be used as a Domain 0 since
+[NixOS 24.11](#sec-release-24.11-highlights), using the
+{option}`virtualisation.xen.enable` option. There are various hardware and
+software requirements to running a Xen Domain 0; the module is configured to
+prevent running Xen on a NixOS system that does not meet the software
+requirements. (i.e. a NixOS system that uses the legacy, scripted initial
+ramdisk.) The module does not yet check if the hardware requirements are met:
+please manually ensure that the target machine supports
+[SLAT](Second_Level_Address_Translation) and
+[IOMMU](https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit),
+the latter being required only for non-PV domains to be virtualised.
+
+The boot menu on a Xen-enabled NixOS system will show duplicate entries for each
+generation: one boots a normal NixOS system, and the other boots into the Xen
+Project Hypervisor. The [`systemd-boot`](#opt-boot.loader.systemd-boot.enable)
+and [Limine](#opt-boot.loader.limine.enable) bootloaders are the only supported
+boot methods at this time.
+
+Xen may be managed through various frontend configuration systems. `libxenlight`
+is one such configuration system, and is built into all Xen systems. The `xl`
+command is the primary command-line interface to `libxenlight`, and is capable
+of managing a NixOS Domain 0.
+
+## Unprivileged Domain Installation {#module-virtualisation-xen-installation-domU}
+
+Known generically as guests, unprivileged domains running NixOS may import the
+[`xen-domU.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/xen-domU.nix)
+profile in their configurations to automatically enable various recommended
+optimisations which are relevant for unprivileged domains.
+
+:::{.example}
+
+# Import the Xen Unprivileged Domain profile into a NixOS configuration
+
+```nix
+{
+  imports = [
+    <nixpkgs/nixos/modules/virtualisation/xen-domU.nix>
+  ];
+}
+```
+
+:::
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ea5d8f453797..20b4dc35995a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1408,6 +1408,7 @@ in
   rspamd-trainer = runTest ./rspamd-trainer.nix;
   rss-bridge = handleTest ./web-apps/rss-bridge { };
   rss2email = handleTest ./rss2email.nix { };
+  rstp = runTest ./rstp.nix;
   rstudio-server = runTest ./rstudio-server.nix;
   rsync = runTest ./rsync.nix;
   rsyncd = runTest ./rsyncd.nix;
diff --git a/nixos/tests/budgie.nix b/nixos/tests/budgie.nix
index a9bb55756797..b1aa2798e8b0 100644
--- a/nixos/tests/budgie.nix
+++ b/nixos/tests/budgie.nix
@@ -29,37 +29,38 @@
           pkgs.budgie-analogue-clock-applet
         ];
       };
+
+      environment.systemPackages = [ pkgs.wlrctl ];
     };
 
+  enableOCR = true;
+
   testScript =
     { nodes, ... }:
     let
       user = nodes.machine.users.users.alice;
-      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
-      su = command: "su - ${user.name} -c '${env} ${command}'";
+      env = "XDG_RUNTIME_DIR=/run/user/${toString user.uid}";
     in
     ''
       with subtest("Wait for login"):
-          machine.wait_for_x()
+          machine.wait_for_unit("display-manager.service")
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
           machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"')
-          machine.wait_for_file("${user.home}/.Xauthority")
-          machine.succeed("xauth merge ${user.home}/.Xauthority")
+          machine.wait_until_succeeds('journalctl --grep "Compositor is fully initialized"')
 
       with subtest("Check that logging in has given the user ownership of devices"):
           # Change back to /dev/snd/timer after systemd-258.1
           machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Budgie session components actually start"):
-          for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "bsd-media-keys", "gsd-xsettings"]:
+          for i in ["budgie-daemon", "budgie-panel", "labwc", "budgie-session", "swaybg", "swayidle"]:
               machine.wait_until_succeeds(f"pgrep {i}")
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.gnome-settings-daemon}/libexec/gsd-sound")
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.budgie-desktop-services}/bin/org.buddiesofbudgie.Services")
           machine.wait_until_succeeds("pgrep -xf /run/current-system/sw/bin/org.buddiesofbudgie.budgie-desktop-view")
-          # We don't check xwininfo for budgie-wm.
-          # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754
-          machine.wait_for_window("budgie-daemon")
-          machine.wait_for_window("budgie-panel")
 
       with subtest("Check if various environment variables are set"):
-          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ"
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-panel)/environ"
           machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie'")
           machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'")
           # From the nixos/budgie module
@@ -67,28 +68,22 @@
 
       with subtest("Open run dialog"):
           machine.send_key("alt-f2")
-          machine.wait_for_window("budgie-run-dialog")
+          machine.wait_until_succeeds("pgrep -xf budgie-run-dialog")
           machine.sleep(2)
           machine.screenshot("run_dialog")
           machine.send_key("esc")
 
       with subtest("Open Budgie Control Center"):
-          machine.succeed("${su "budgie-control-center >&2 &"}")
-          machine.wait_for_window("Budgie Control Center")
-
-      with subtest("Lock the screen"):
-          machine.succeed("${su "budgie-screensaver-command -l >&2 &"}")
-          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is active'")
-          machine.sleep(2)
-          machine.send_chars("${user.password}", delay=0.5)
-          machine.screenshot("budgie_screensaver")
-          machine.send_chars("\n")
-          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is inactive'")
-          machine.sleep(2)
+          machine.succeed("su - ${user.name} -c '${env} budgie-control-center >&2 &'")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} wlrctl toplevel list | grep org.buddiesofbudgie.ControlCenter'")
+          machine.wait_for_text("Network|Ethernet|Control|Connected")
 
       with subtest("Open GNOME terminal"):
-          machine.succeed("${su "gnome-terminal"}")
-          machine.wait_for_window("${user.name}@machine: ~")
+          machine.succeed("su - ${user.name} -c '${env} gnome-terminal >&2 &'")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} wlrctl toplevel list | grep ${user.name}@machine'")
+
+      with subtest("Check if labwc bridge is working"):
+          machine.wait_until_succeeds("cat /home/${user.name}/.config/budgie-desktop/labwc/rc.xml | grep Qogir")
 
       with subtest("Check if Budgie has ever coredumped"):
           machine.fail("coredumpctl --json=short | grep budgie")
diff --git a/nixos/tests/containers-restart_networking.nix b/nixos/tests/containers-restart_networking.nix
index aef845a90ed8..42b8351afdf7 100644
--- a/nixos/tests/containers-restart_networking.nix
+++ b/nixos/tests/containers-restart_networking.nix
@@ -55,24 +55,6 @@
           ];
         };
       };
-
-      specialisation.eth1-rstp.configuration = {
-        networking.bridges.br0 = {
-          interfaces = [ "eth1" ];
-          rstp = lib.mkForce true;
-        };
-
-        networking.interfaces = {
-          eth1.ipv4.addresses = lib.mkForce [ ];
-          eth1.ipv6.addresses = lib.mkForce [ ];
-          br0.ipv4.addresses = [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
-        };
-      };
     };
   };
 
@@ -100,19 +82,6 @@
             "grep eth1 /run/br0.interfaces >&2",
         )
 
-    #  activating rstp needs another service, therefore the bridge will restart and the container will lose its connectivity
-    # with subtest("Bridged configuration with STP"):
-    #     client.succeed("/run/booted-system/specialisation/eth1-rstp/bin/switch-to-configuration test >&2")
-    #     client.execute("ip -4 a >&2")
-    #     client.execute("ip l >&2")
-    #
-    #     client.succeed(
-    #         "ping 192.168.1.122 -c 1 -n >&2",
-    #         "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
-    #         "ip l show eth1 |grep 'master br0' >&2",
-    #         "grep eth1 /run/br0.interfaces >&2",
-    #     )
-
     with subtest("Reverting to initial configuration preserves connectivity"):
         client.succeed(
             "/run/booted-system/bin/switch-to-configuration test >&2"
diff --git a/nixos/tests/earlyoom.nix b/nixos/tests/earlyoom.nix
index 35415bed87a3..efe2b52942e4 100644
--- a/nixos/tests/earlyoom.nix
+++ b/nixos/tests/earlyoom.nix
@@ -2,7 +2,6 @@
 {
   name = "earlyoom";
   meta.maintainers = with lib.maintainers; [
-    ncfavier
     oxalica
   ];
 
diff --git a/nixos/tests/rstp.nix b/nixos/tests/rstp.nix
new file mode 100644
index 000000000000..23477f5a63d8
--- /dev/null
+++ b/nixos/tests/rstp.nix
@@ -0,0 +1,66 @@
+{ pkgs, lib, ... }:
+{
+  name = "rstp";
+
+  nodes = {
+    client = {
+      containers = {
+        peer = {
+          autoStart = true;
+          privateNetwork = true;
+          hostBridge = "br0";
+
+          config = {
+            networking = {
+              interfaces = {
+                eth0 = {
+                  ipv4.addresses = [
+                    {
+                      address = "192.168.1.122";
+                      prefixLength = 24;
+                    }
+                  ];
+                };
+              };
+            };
+          };
+        };
+      };
+
+      networking = {
+        bridges = {
+          br0 = {
+            interfaces = [ ];
+            rstp = true;
+          };
+        };
+
+        interfaces = {
+          eth1 = {
+            ipv4.addresses = lib.mkForce [ ];
+            ipv6.addresses = lib.mkForce [ ];
+          };
+
+          br0 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.1.2";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+      };
+
+      virtualisation = {
+        vlans = [ 1 ];
+      };
+    };
+  };
+
+  testScript = ''
+    client.start()
+    client.wait_for_unit("default.target")
+    client.wait_until_succeeds("journalctl | grep 'Port vb-peer : up'", timeout=10)
+  '';
+}
diff --git a/nixos/tests/userborn-immutable-etc.nix b/nixos/tests/userborn-immutable-etc.nix
index b4b1b56fc2fd..dc34537b9b51 100644
--- a/nixos/tests/userborn-immutable-etc.nix
+++ b/nixos/tests/userborn-immutable-etc.nix
@@ -21,7 +21,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -38,7 +38,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-immutable-users.nix b/nixos/tests/userborn-immutable-users.nix
index 887d2d312eb7..46ea6d4a4be2 100644
--- a/nixos/tests/userborn-immutable-users.nix
+++ b/nixos/tests/userborn-immutable-users.nix
@@ -16,7 +16,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -33,7 +33,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-mutable-etc.nix b/nixos/tests/userborn-mutable-etc.nix
index 6199b84ce71d..020c29a048b9 100644
--- a/nixos/tests/userborn-mutable-etc.nix
+++ b/nixos/tests/userborn-mutable-etc.nix
@@ -20,7 +20,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -37,7 +37,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
diff --git a/nixos/tests/userborn-mutable-users.nix b/nixos/tests/userborn-mutable-users.nix
index e2b9c3df4953..8f23afce9b9a 100644
--- a/nixos/tests/userborn-mutable-users.nix
+++ b/nixos/tests/userborn-mutable-users.nix
@@ -16,7 +16,7 @@ in
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine =
-    { config, ... }:
+    { pkgs, ... }:
     {
       imports = [ common ];
 
@@ -34,7 +34,7 @@ in
         inheritParentConfig = false;
         configuration = {
           nixpkgs = {
-            inherit (config.nixpkgs) hostPlatform;
+            inherit pkgs;
           };
           imports = [ common ];
 
@@ -42,6 +42,10 @@ in
             new-normalo = {
               isNormalUser = true;
             };
+            mutable-to-declarative = {
+              isNormalUser = true;
+              description = "I'm now declaratively managed";
+            };
           };
         };
       };
@@ -54,16 +58,25 @@ in
       assert 1000 == int(machine.succeed("id --user normalo")), "normalo user doesn't have UID 1000"
       assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
 
-    with subtest("Add new user manually"):
+    with subtest("Add new user manual-normalo manually"):
       machine.succeed("useradd manual-normalo")
       assert 1001 == int(machine.succeed("id --user manual-normalo")), "manual-normalo user doesn't have UID 1001"
 
-    with subtest("Delete manual--normalo user manually"):
-      machine.succeed("userdel manual-normalo")
-
+    with subtest("Add new user mutable-to-declarative manually"):
+      machine.succeed("useradd --comment 'I was created imperatively' mutable-to-declarative")
+      assert 1002 == int(machine.succeed("id --user mutable-to-declarative")), "mutable-to-declarative user doesn't have UID 1002"
 
     machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
 
+    with subtest("manual-normalo user is still enabled"):
+      manual_normalo_shadow = machine.succeed("getent shadow manual-normalo")
+      print(manual_normalo_shadow)
+      t.assertNotIn("!*", manual_normalo_shadow, "manual-normalo user is falsely disabled")
+
+    with subtest("mutable-to-declarative user description has changed"):
+      mutable_to_declarative_passwd = machine.succeed("getent passwd mutable-to-declarative")
+      print(mutable_to_declarative_passwd)
+      t.assertIn("I'm now declaratively managed", mutable_to_declarative_passwd, "mutable-to-declarative user description is unchanged")
 
     with subtest("normalo user is disabled"):
       print(machine.succeed("getent shadow normalo"))
@@ -71,6 +84,9 @@ in
 
     with subtest("new-normalo user is created after switching to new generation"):
       print(machine.succeed("getent passwd new-normalo"))
-      assert 1001 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1001"
+      assert 1003 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1003"
+
+    with subtest("Delete manual-normalo user manually"):
+      machine.succeed("userdel manual-normalo")
   '';
 }
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index e8e44c3560d4..c5d26cd14a66 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.55";
+  version = "7.59";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-meTuaGH9zwx/sT+h0I7JRSCRPD8AryGPvoHUKbyzpHA="
+        "sha256-S4RAXWss1tPzmO0zzKfkXPrcgBqwNN5EE1jpjEZ5mYk="
       else
         {
-          x86_64-linux = "sha256-BOjS39GySB6ptiEJvwlShL4ZcDot2nsKXCAU/CeMEIc=";
-          aarch64-linux = "sha256-oqEwEQKFhpaFMqzcSc28v0njuiMi5CAGjP3fLDECUXU=";
+          x86_64-linux = "sha256-II2QOv7eHD4JtE5We1uuEuCt5RZmK6VFtZFyLEArUSc=";
+          aarch64-linux = "sha256-/iDQBnYf+1xYJ+JFFT5ikGWDmQdhe2L1o+lZr8pB+Q0=";
         }
         .${stdenv.hostPlatform.system};
   };
diff --git a/pkgs/applications/display-managers/sddm/default.nix b/pkgs/applications/display-managers/sddm/default.nix
index 6492b9c1684e..c36e7ee6325c 100644
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@@ -8,6 +8,7 @@
 }:
 runCommand "sddm-wrapped"
   {
+    pname = "sddm";
     inherit (sddm-unwrapped) version outputs;
 
     buildInputs = sddm-unwrapped.buildInputs ++ extraPackages;
diff --git a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
index 6b7b656535b9..4b493103e290 100644
--- a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.108.0";
-    hash = "sha256-cJ6Qi/ut4MgGuTBU9/Gw051i3VvPC+lvxgPGxJzzZ5c=";
+    version = "1.109.0";
+    hash = "sha256-y7iUWFKYTLZVS9Zjoy9NtqtgfQTJLWij9JD20pjyTXY=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index f782672bc5ef..e87c52979760 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -5093,8 +5093,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-test";
-          version = "0.43.1";
-          hash = "sha256-yiKBG1A5ahvB6iTqh2yzFzcKJlU1lu4dqd+4cygWVQ4=";
+          version = "0.44.0";
+          hash = "sha256-Qr4Ms15Nq+/yygWYBDvN5dHIKpQ0yYQjI1p/RNFMWjw=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index f21fe82b67ff..602bf7f817f1 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-01-19";
+  version = "0-unstable-2026-01-28";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "f86e195017fb1595c2622bca3c95e88198194784";
-    hash = "sha256-Cd3vFpB66Bymv/Zjzd4XO3qJn5vaSnkWV1i5IxtaXXc=";
+    rev = "21eb24f86d785b1c631161f03057b22c160182c0";
+    hash = "sha256-gGjSbkhy6ykEin8Bci6xHNII2MdEzLcUPr/dU6IwlIw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 830601e189cf..6309889d9d91 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -145,14 +145,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
 
-  # The build system uses custom logic - defined in
-  # cmake/modules/FindNLopt.cmake in the package source - for finding the nlopt
-  # library, which doesn't pick up the package in the nix store.  We
-  # additionally need to set the path via the NLOPT environment variable.
-  NLOPT = nlopt;
-
-  # prusa-slicer uses dlopen on `libudev.so` at runtime
-  NIX_LDFLAGS = lib.optionalString withSystemd "-ludev";
+  env = {
+    # The build system uses custom logic - defined in
+    # cmake/modules/FindNLopt.cmake in the package source - for finding the nlopt
+    # library, which doesn't pick up the package in the nix store.  We
+    # additionally need to set the path via the NLOPT environment variable.
+    NLOPT = nlopt;
+  }
+  // lib.optionalAttrs withSystemd {
+    # prusa-slicer uses dlopen on `libudev.so` at runtime
+    NIX_LDFLAGS = "-ludev";
+  };
 
   prePatch = ''
     # Since version 2.5.0 of nlopt we need to link to libnlopt, as libnlopt_cxx
diff --git a/pkgs/applications/networking/browsers/nyxt/default.nix b/pkgs/applications/networking/browsers/nyxt/default.nix
index c1f16bda6aa1..84cae74b7ff8 100644
--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # for cffi
-  LD_LIBRARY_PATH = lib.makeLibraryPath [
+  env.LD_LIBRARY_PATH = lib.makeLibraryPath [
     glib
     gobject-introspection
     gdk-pixbuf
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index 067e29a5770a..56f49b92f8dd 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "datovka";
-  version = "4.26.0";
+  version = "4.28.0";
 
   src = fetchurl {
     url = "https://gitlab.nic.cz/datovka/datovka/-/archive/v${version}/datovka-v${version}.tar.gz";
-    sha256 = "sha256-pEdjh/c4vhirj2R9bYDdi2FL7N9x67kTOyfXiJDzMKE=";
+    sha256 = "sha256-vTfmJEwbfaPFnZE8o3YnZhjwfMZ0At7eZ0iMoh4/HQE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/pothos/default.nix b/pkgs/applications/radio/pothos/default.nix
index 3fc19a371219..005f44c14a6a 100644
--- a/pkgs/applications/radio/pothos/default.nix
+++ b/pkgs/applications/radio/pothos/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   '';
 
   # poco 1.14 requires c++17
-  NIX_CFLAGS_COMPILE = [ "-std=gnu++17" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=gnu++17" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/science/math/wolfram-engine/default.nix b/pkgs/applications/science/math/wolfram-engine/default.nix
index 69a276ba762c..13ae237970a1 100644
--- a/pkgs/applications/science/math/wolfram-engine/default.nix
+++ b/pkgs/applications/science/math/wolfram-engine/default.nix
@@ -45,7 +45,9 @@ let
   dirName = "WolframEngine";
 in
 stdenv.mkDerivation rec {
-  inherit (l10n) version name src;
+  pname = "wolfram-engine";
+
+  inherit (l10n) version src;
 
   nativeBuildInputs = [
     autoPatchelfHook
diff --git a/pkgs/applications/version-management/sublime-merge/default.nix b/pkgs/applications/version-management/sublime-merge/default.nix
index 6e91361e1d03..7526a19f0dba 100644
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@@ -11,9 +11,9 @@ in
   } { };
 
   sublime-merge-dev = common {
-    buildVersion = "2111";
+    buildVersion = "2120";
     dev = true;
-    aarch64sha256 = "ZDERtZ1NbYdc/rZYfiFPkjwSQVMvacVElRAW/PBrgCg=";
-    x64sha256 = "NgHRF8Wh3ktr0Z+efL2FTwFAdF3c0yaXNFEwcvefSy0=";
+    aarch64sha256 = "3JKxLke1l7l+fxhIJWbXbMHK5wPgjZTEWcZd9IvrdPM=";
+    x64sha256 = "N8lhSmQnj+Ee1A2eIOkhdhQnHBK3B6vFA3vrPAbYtaI=";
   } { };
 }
diff --git a/pkgs/applications/version-management/svn-all-fast-export/default.nix b/pkgs/applications/version-management/svn-all-fast-export/default.nix
index d62d83c117ab..71b450f442bb 100644
--- a/pkgs/applications/version-management/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/svn-all-fast-export/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     "SVN_INCLUDE=${subversion.dev}/include/subversion-1"
   ];
 
-  NIX_LDFLAGS = "-lsvn_fs-1";
+  env.NIX_LDFLAGS = "-lsvn_fs-1";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 7a017714b26a..edc86454c5ef 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.32";
+  version = "2.2.34";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-Wxzv1iLJ+OWw+g6ndBX36AR2v9cSu2uZysegz97+XaM=";
+    hash = "sha256-58NFlB6viWXG13J+RBzMj6LlYFClpWpGQ/aCNxJ5wKQ=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index 57fc0c91c474..fdf4f39b017d 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -243,19 +243,29 @@ stdenv.mkDerivation {
     echo CONFIG_MPEGAUDIODSP=yes >> config.mak
   '';
 
-  # Fixes compilation with newer versions of clang that make these warnings errors by default.
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion -Wno-incompatible-function-pointer-types";
-
-  NIX_LDFLAGS = toString (
-    lib.optional fontconfigSupport "-lfontconfig"
-    ++ lib.optional fribidiSupport "-lfribidi"
-    ++ lib.optionals x11Support [
-      "-lX11"
-      "-lXext"
-    ]
-    ++ lib.optional x264Support "-lx264"
-    ++ [ "-lfreetype" ]
-  );
+  env =
+    lib.optionalAttrs stdenv.cc.isClang {
+      # Fixes compilation with newer versions of clang that make these warnings errors by default.
+      NIX_CFLAGS_COMPILE = "-Wno-int-conversion -Wno-incompatible-function-pointer-types";
+    }
+    // {
+      NIX_LDFLAGS = toString (
+        lib.optionals fontconfigSupport [
+          "-lfontconfig"
+        ]
+        ++ lib.optionals fribidiSupport [
+          "-lfribidi"
+        ]
+        ++ lib.optionals x11Support [
+          "-lX11"
+          "-lXext"
+        ]
+        ++ lib.optionals x264Support [
+          "-lx264"
+        ]
+        ++ [ "-lfreetype" ]
+      );
+    };
 
   installTargets = [ "install" ] ++ lib.optional x11Support "install-gui";
 
diff --git a/pkgs/by-name/_4/_4ti2/package.nix b/pkgs/by-name/_4/_4ti2/package.nix
index 65ad8e3b7611..55b0cd1709ce 100644
--- a/pkgs/by-name/_4/_4ti2/package.nix
+++ b/pkgs/by-name/_4/_4ti2/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "4ti2";
-  version = "1.6.13";
+  version = "1.6.14";
 
   src = fetchFromGitHub {
     owner = "4ti2";
     repo = "4ti2";
-    rev = "Release_${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-gbYG55LfVhjJJFJu0L8AWIAnFDViHIW2N1qtS8xOFAc=";
+    tag = "Release_${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    hash = "sha256-bFvq90hLLGty7p6NLxOARVvKdizg3bp2NkP9nZpVFzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/_9/_9base/package.nix b/pkgs/by-name/_9/_9base/package.nix
index 2b4f76e55f42..47e81a9b919e 100644
--- a/pkgs/by-name/_9/_9base/package.nix
+++ b/pkgs/by-name/_9/_9base/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchgit,
   pkg-config,
+  unstableGitUpdater,
   patches ? [ ],
   pkgsBuildHost,
   enableStatic ? stdenv.hostPlatform.isStatic,
@@ -10,7 +11,7 @@
 
 stdenv.mkDerivation {
   pname = "9base";
-  version = "unstable-2019-09-11";
+  version = "6-unstable-2019-09-13";
 
   src = fetchgit {
     url = "https://git.suckless.org/9base";
@@ -70,6 +71,8 @@ stdenv.mkDerivation {
     "troff"
   ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     homepage = "https://tools.suckless.org/9base/";
     description = "Port of various original Plan 9 tools for Unix, based on plan9port";
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
index 33ed2e4d6ba6..255ddb95d1e1 100644
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ab-av1";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     tag = "v${version}";
-    hash = "sha256-HSWu3gHpgCUkmr63mAi2Hd67Rap5vDZ/oHRh6O7y6uA=";
+    hash = "sha256-EPQUm51H/yY0O1x6QAx1a+VeCgTYoJ19BAcEY52Oduo=";
   };
 
-  cargoHash = "sha256-jzEwblYsA7tgoJE6HhdtdDyOS50DyL87/J/T+cNKB3M=";
+  cargoHash = "sha256-uGvEWQUIRqb0Xpwywh3M26cKtuzm59uvH9bjZlvMPEk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ac/accelergy/package.nix b/pkgs/by-name/ac/accelergy/package.nix
index f151bbe41e0f..e071addd7197 100644
--- a/pkgs/by-name/ac/accelergy/package.nix
+++ b/pkgs/by-name/ac/accelergy/package.nix
@@ -2,18 +2,19 @@
   lib,
   fetchFromGitHub,
   python3Packages,
+  unstableGitUpdater,
 }:
 
 python3Packages.buildPythonApplication {
   pname = "accelergy";
-  version = "unstable-2022-05-03";
+  version = "0.1-unstable-2025-05-26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Accelergy-Project";
     repo = "accelergy";
-    rev = "34df8e87a889ae55cecba58992d4573466b40565";
-    hash = "sha256-SRtt1EocHy5fKszpoumC+mOK/qhreoA2/Ff1wcu5WKo=";
+    rev = "6911d15686ee7efdceba7d95605102df4472ae3a";
+    hash = "sha256-YgJbmxJfuw7jk+Ssj5r3cmJYSSepf7aw+Ti3a9brm6o=";
   };
 
   build-system = with python3Packages; [
@@ -24,8 +25,16 @@ python3Packages.buildPythonApplication {
     pyyaml
     yamlordereddictloader
     pyfiglet
+    ruamel-yaml
+    deepdiff
+    jinja2
   ];
 
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+    tagFormat = "v*";
+  };
+
   meta = {
     description = "Architecture-level energy/area estimator for accelerator designs";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/ae/aefs/package.nix b/pkgs/by-name/ae/aefs/package.nix
index 962a1e817a1a..09e0face1105 100644
--- a/pkgs/by-name/ae/aefs/package.nix
+++ b/pkgs/by-name/ae/aefs/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
   autoreconfHook,
   fuse,
   git,
@@ -9,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "aefs";
-  version = "unstable-2015-05-06";
+  version = "0-unstable-2015-05-06";
 
   src = fetchFromGitHub {
     owner = "edolstra";
@@ -40,6 +41,10 @@ stdenv.mkDerivation {
 
   buildInputs = [ fuse ];
 
+  passthru.updateScript = unstableGitUpdater {
+    hardcodeZeroVersion = true;
+  };
+
   meta = {
     homepage = "https://github.com/edolstra/aefs";
     description = "Cryptographic filesystem implemented in userspace using FUSE";
diff --git a/pkgs/by-name/ag/age-plugin-se/package.nix b/pkgs/by-name/ag/age-plugin-se/package.nix
index 3d3fb847dc20..54fc939d053a 100644
--- a/pkgs/by-name/ag/age-plugin-se/package.nix
+++ b/pkgs/by-name/ag/age-plugin-se/package.nix
@@ -26,8 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
     swiftpm
   ];
 
-  # Can't find libdispatch without this on NixOS. (swift 5.8)
-  LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isLinux "${swiftPackages.Dispatch}/lib";
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # Can't find libdispatch without this on NixOS. (swift 5.8)
+    LD_LIBRARY_PATH = "${swiftPackages.Dispatch}/lib";
+  };
 
   postPatch =
     let
diff --git a/pkgs/by-name/ag/agg/package.nix b/pkgs/by-name/ag/agg/package.nix
index d027f6215301..9eb7dd218ac8 100644
--- a/pkgs/by-name/ag/agg/package.nix
+++ b/pkgs/by-name/ag/agg/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--x-libraries=${lib.getLib libX11}/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
   # libtool --tag=CXX --mode=link g++ -g -O2 libexamples.la ../src/platform/X11/libaggplatformX11.la ../src/libagg.la -o alpha_mask2 alpha_mask2.o
   # libtool: error: cannot find the library 'libexamples.la'
diff --git a/pkgs/by-name/al/alsa-scarlett-gui/package.nix b/pkgs/by-name/al/alsa-scarlett-gui/package.nix
index 5e7773229026..e96089a715c6 100644
--- a/pkgs/by-name/al/alsa-scarlett-gui/package.nix
+++ b/pkgs/by-name/al/alsa-scarlett-gui/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-DkfpMK0T67B4mnriignf4hx6Ifddls0rN0SxyfEsPZg=";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=deprecated-declarations" ];
 
   makeFlags = [
     "DESTDIR=\${out}"
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.json b/pkgs/by-name/ar/archisteamfarm/deps.json
similarity index 100%
rename from pkgs/applications/misc/ArchiSteamFarm/deps.json
rename to pkgs/by-name/ar/archisteamfarm/deps.json
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/by-name/ar/archisteamfarm/package.nix
similarity index 96%
rename from pkgs/applications/misc/ArchiSteamFarm/default.nix
rename to pkgs/by-name/ar/archisteamfarm/package.nix
index 97de6046e270..1d18d7cd471b 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/by-name/ar/archisteamfarm/package.nix
@@ -19,7 +19,7 @@ let
   ];
 in
 buildDotnetModule rec {
-  pname = "ArchiSteamFarm";
+  pname = "archisteamfarm";
   # nixpkgs-update: no auto update
   version = "6.3.1.6";
 
@@ -42,6 +42,7 @@ buildDotnetModule rec {
   testProjectFile = "ArchiSteamFarm.Tests";
 
   executable = "ArchiSteamFarm";
+  installPath = "${placeholder "out"}/lib/ArchiSteamFarm";
 
   enableParallelBuilding = false;
 
@@ -95,7 +96,7 @@ buildDotnetModule rec {
   '';
 
   passthru = {
-    # nix-shell maintainers/scripts/update.nix --argstr package ArchiSteamFarm
+    # nix-shell maintainers/scripts/update.nix --argstr package archisteamfarm
     updateScript = ./update.sh;
     ui = callPackage ./web-ui { };
   };
diff --git a/pkgs/applications/misc/ArchiSteamFarm/update.sh b/pkgs/by-name/ar/archisteamfarm/update.sh
similarity index 77%
rename from pkgs/applications/misc/ArchiSteamFarm/update.sh
rename to pkgs/by-name/ar/archisteamfarm/update.sh
index 53d3ee664191..f8df57756a6f 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/update.sh
+++ b/pkgs/by-name/ar/archisteamfarm/update.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 new_version="$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/JustArchiNET/ArchiSteamFarm/releases" | jq -r  'map(select(.prerelease == false)) | .[0].tag_name')"
-old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./package.nix)"
 
 if [[ "$new_version" == "$old_version" ]]; then
   echo "Already up to date!"
@@ -17,10 +17,10 @@ asf_path=$PWD
 cd ../../../..
 
 if [[ "${1:-}" != "--deps-only" ]]; then
-    update-source-version ArchiSteamFarm "$new_version"
+    update-source-version archisteamfarm "$new_version"
 fi
 
-$(nix-build -A ArchiSteamFarm.fetch-deps --no-out-link)
+$(nix-build -A archisteamfarm.fetch-deps --no-out-link)
 
 cd "$asf_path/web-ui"
 ./update.sh
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore b/pkgs/by-name/ar/archisteamfarm/web-ui/.gitignore
similarity index 100%
rename from pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore
rename to pkgs/by-name/ar/archisteamfarm/web-ui/.gitignore
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/by-name/ar/archisteamfarm/web-ui/default.nix
similarity index 91%
rename from pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
rename to pkgs/by-name/ar/archisteamfarm/web-ui/default.nix
index 0d074397b63c..bc6a61c0107f 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/by-name/ar/archisteamfarm/web-ui/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   buildNpmPackage,
-  ArchiSteamFarm,
+  archisteamfarm,
 }:
 
 buildNpmPackage rec {
@@ -33,6 +33,6 @@ buildNpmPackage rec {
     description = "Official web interface for ASF";
     license = lib.licenses.asl20;
     homepage = "https://github.com/JustArchiNET/ASF-ui";
-    inherit (ArchiSteamFarm.meta) maintainers platforms;
+    inherit (archisteamfarm.meta) maintainers platforms;
   };
 }
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh b/pkgs/by-name/ar/archisteamfarm/web-ui/update.sh
similarity index 85%
rename from pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
rename to pkgs/by-name/ar/archisteamfarm/web-ui/update.sh
index 6fa8e67a1217..eb7e67f5346d 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
+++ b/pkgs/by-name/ar/archisteamfarm/web-ui/update.sh
@@ -3,14 +3,14 @@
 set -eou pipefail
 
 cd "$(dirname "$0")"/../../../../..
-version=$(nix-instantiate --strict --eval -A ArchiSteamFarm.version | jq -r)
+version=$(nix-instantiate --strict --eval -A archisteamfarm.version | jq -r)
 cd -
 ui=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/JustArchiNET/ArchiSteamFarm/contents/ASF-ui?ref=$version" | jq -r .sha)
 
 curl "https://raw.githubusercontent.com/JustArchiNET/ASF-ui/$ui/package-lock.json" -o package-lock.json
 
 cd -
-update-source-version ArchiSteamFarm.ui "$ui"
+update-source-version archisteamfarm.ui "$ui"
 cd -
 
 npmDepsHash=$(prefetch-npm-deps ./package-lock.json)
diff --git a/pkgs/by-name/as/ashuffle/package.nix b/pkgs/by-name/as/ashuffle/package.nix
index 2d9995a419af..fbcb48a746e4 100644
--- a/pkgs/by-name/as/ashuffle/package.nix
+++ b/pkgs/by-name/as/ashuffle/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ashuffle";
-  version = "3.14.9";
+  version = "3.14.10";
 
   src = fetchFromGitHub {
     owner = "joshkunz";
     repo = "ashuffle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HQ4+vyTvX0mhfuRclbiC+MvllV3300ztAwL0IxrUiC8=";
+    hash = "sha256-nvmyup9hW/kI7Wwo5+1/FEoHd4kfMvYbttI8nJkLfVE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/au/auto-cpufreq/package.nix b/pkgs/by-name/au/auto-cpufreq/package.nix
index b2c5c3443e91..4c4206a4f59c 100644
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "auto-cpufreq";
-  version = "2.6.0";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AdnanHodzic";
     repo = "auto-cpufreq";
     tag = "v${version}";
-    hash = "sha256-DEs6jbWYJFJgpaPtF5NT3DQs3erjzdm2brLNHpjrEPA=";
+    hash = "sha256-X+2RxD4+F8LBqvJNRh6FduRLU4a2SnZQ8a9BCN6Ty1E=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ba/bambu-studio/package.nix b/pkgs/by-name/ba/bambu-studio/package.nix
index 982a8259d7f7..a245a414b1bc 100644
--- a/pkgs/by-name/ba/bambu-studio/package.nix
+++ b/pkgs/by-name/ba/bambu-studio/package.nix
@@ -136,23 +136,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   separateDebugInfo = true;
 
-  # The build system uses custom logic - defined in
-  # cmake/modules/FindNLopt.cmake in the package source - for finding the nlopt
-  # library, which doesn't pick up the package in the nix store.  We
-  # additionally need to set the path via the NLOPT environment variable.
-  NLOPT = nlopt;
+  env = {
+    # The build system uses custom logic - defined in
+    # cmake/modules/FindNLopt.cmake in the package source - for finding the nlopt
+    # library, which doesn't pick up the package in the nix store.  We
+    # additionally need to set the path via the NLOPT environment variable.
+    NLOPT = nlopt;
 
-  NIX_CFLAGS_COMPILE = toString [
-    "-DBOOST_TIMER_ENABLE_DEPRECATED"
-    # Disable compiler warnings that clutter the build log.
-    # It seems to be a known issue for Eigen:
-    # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
-    "-Wno-ignored-attributes"
-    "-I${opencv}/include/opencv4"
-  ];
+    NIX_CFLAGS_COMPILE = toString [
+      "-DBOOST_TIMER_ENABLE_DEPRECATED"
+      # Disable compiler warnings that clutter the build log.
+      # It seems to be a known issue for Eigen:
+      # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
+      "-Wno-ignored-attributes"
+      "-I${opencv}/include/opencv4"
+    ];
 
-  # prusa-slicer uses dlopen on `libudev.so` at runtime
-  NIX_LDFLAGS = lib.optionalString withSystemd "-ludev" + " -L${opencv}/lib -lopencv_imgcodecs";
+    # prusa-slicer uses dlopen on `libudev.so` at runtime
+    NIX_LDFLAGS = lib.optionalString withSystemd "-ludev" + " -L${opencv}/lib -lopencv_imgcodecs";
+  };
 
   # TODO: macOS
   prePatch = ''
diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index e9ca8fc99436..cd0c7fcdaba1 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -23,7 +23,7 @@ let
       echo "export function registerLinuxConfig() {}" > $linuxConfigFilename
 
       # disable auto update
-      sed -i 's/[^=]*\.auto_update_disabled/true/' $out/resources/app/build/main/main-entry-*.mjs
+      sed -i 's/auto_update_disabled:[^,}]*/auto_update_disabled:true/g' $out/resources/app/build/main/main-entry-*.mjs
 
       # prevent updates
       sed -i -E 's/executeDownload\([^)]+\)\{/executeDownload(){return;/g' $out/resources/app/build/main/main-entry-*.mjs
diff --git a/pkgs/by-name/bi/bitwuzla/package.nix b/pkgs/by-name/bi/bitwuzla/package.nix
index d85d0eed9f47..62a0a657d3ec 100644
--- a/pkgs/by-name/bi/bitwuzla/package.nix
+++ b/pkgs/by-name/bi/bitwuzla/package.nix
@@ -11,6 +11,7 @@
   gtest,
   gmp,
   cadical,
+  cadical' ? cadical.override { version = "2.1.3"; },
   cryptominisat,
   kissat,
   zlib,
@@ -26,11 +27,12 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "bitwuzla";
     repo = "bitwuzla";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-v5r+BWXUUbKtkos6qmGMC9MMytS/h759SHY6lsTHU1k=";
   };
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   nativeBuildInputs = [
     meson
@@ -41,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    cadical
+    cadical'
     cryptominisat
     btor2tools
     symfpu
diff --git a/pkgs/by-name/bp/bpflinter/package.nix b/pkgs/by-name/bp/bpflinter/package.nix
new file mode 100644
index 000000000000..c20e970d9e3f
--- /dev/null
+++ b/pkgs/by-name/bp/bpflinter/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchpatch,
+  nix-update-script,
+  fetchCrate,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bpflinter";
+  version = "0.1.5";
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-oX4fgUKOASiI/NMFSjr6afmyg1VBK44lqni+xBXlZLo=";
+  };
+
+  cargoHash = "sha256-3TIWrqgePnBMEJFB5fkch5ycU4NXE6JlbUpq9/8DbHc=";
+
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    mainProgram = "bpflinter";
+    description = "Linting functionality for BPF C programs";
+    homepage = "https://github.com/d-e-s-o/bpflint";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ fzakaria ];
+  };
+})
diff --git a/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix b/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
index d050b32d7ff1..67a757efa13d 100644
--- a/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
+++ b/pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-analogue-clock-applet";
-  version = "2.2";
+  version = "2.2-unstable-2026-01-13";
 
   src = fetchFromGitHub {
     owner = "samlane-ma";
     repo = "analogue-clock-applet";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-8kqDEzcUqg/TvwpazYQt1oQDVC00fOxFLVsKYMDuV9I=";
+    rev = "22b04faeea8f95eb83ad96ae89529560811d76d9";
+    hash = "sha256-8ZFExgE1aJ8XN4+ugSzI34UjdPHbtbhJ+3xetcLZ6sg=";
   };
 
   nativeBuildInputs = [
@@ -38,18 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
     libpeas2
   ];
 
-  postPatch = ''
-    # https://github.com/samlane-ma/analogue-clock-applet/issues/7
-    substituteInPlace budgie-analogue-clock-widget/src/meson.build \
-      --replace-fail "dependency('budgie-raven-plugin-1.0')" "dependency('budgie-raven-plugin-2.0')"
-  '';
-
-  mesonFlags = [
-    # The meson option actually enables libpeas2 support
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
-    "-Dfor-wayland=true"
-  ];
-
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/bu/budgie-control-center/introduction.list b/pkgs/by-name/bu/budgie-control-center/introduction.list
new file mode 100644
index 000000000000..520e673a2c03
--- /dev/null
+++ b/pkgs/by-name/bu/budgie-control-center/introduction.list
@@ -0,0 +1,5 @@
+# Introduction panel default applications
+# This file contains full paths to .desktop files to display
+# Lines starting with # are comments
+@wdisplays@/share/applications/network.cycles.wdisplays.desktop
+@budgie_desktop@/share/applications/org.buddiesofbudgie.BudgieDesktopSettings.desktop
diff --git a/pkgs/by-name/bu/budgie-control-center/package.nix b/pkgs/by-name/bu/budgie-control-center/package.nix
index 1dc34f6398af..341af1c971dc 100644
--- a/pkgs/by-name/bu/budgie-control-center/package.nix
+++ b/pkgs/by-name/bu/budgie-control-center/package.nix
@@ -4,11 +4,8 @@
   fetchFromGitHub,
   replaceVars,
   accountsservice,
-  adwaita-icon-theme,
   budgie-desktop,
   cheese,
-  clutter,
-  clutter-gtk,
   colord,
   colord-gtk,
   cups,
@@ -25,14 +22,11 @@
   gnome-bluetooth_1_0,
   gnome-color-manager,
   gnome-desktop,
-  gnome-remote-desktop,
   gnome-settings-daemon,
-  gnome-user-share,
   gsettings-desktop-schemas,
   gsound,
   gtk3,
   ibus,
-  libcanberra-gtk3,
   libepoxy,
   libgnomekbd,
   libgtop,
@@ -49,7 +43,6 @@
   libxslt,
   meson,
   modemmanager,
-  mutter,
   networkmanager,
   networkmanagerapplet,
   ninja,
@@ -63,21 +56,30 @@
   tzdata,
   udisks,
   upower,
+  wdisplays,
   webp-pixbuf-loader,
   wrapGAppsHook3,
   enableSshSocket ? false,
 }:
 
+let
+  introduction_list = (
+    replaceVars ./introduction.list {
+      budgie_desktop = budgie-desktop;
+      inherit wdisplays;
+    }
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-control-center";
-  version = "1.4.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-control-center";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Je3X1V4U2t0LMxWwtoYZKEI56IS4zK/w6OL615tqKkk=";
+    hash = "sha256-sdAzReZVAZ5omLOhly/l3buiw01eem+k9+3RbVPzS2g=";
   };
 
   patches = [
@@ -106,8 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     accountsservice
-    clutter
-    clutter-gtk
     colord
     colord-gtk
     fontconfig
@@ -117,18 +117,13 @@ stdenv.mkDerivation (finalAttrs: {
     glib-networking
     gnome-desktop
     gst_all_1.gstreamer
-    adwaita-icon-theme
     cheese
     gnome-bluetooth_1_0
-    gnome-remote-desktop
     gnome-settings-daemon
-    gnome-user-share
-    mutter
     gsettings-desktop-schemas
     gsound
     gtk3
     ibus
-    libcanberra-gtk3
     libepoxy
     libgtop
     libgudev
@@ -137,7 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
     libnma
     libpulseaudio
     libpwquality
-    librsvg
     libsecret
     libwacom
     libxml2
@@ -167,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: {
         ];
       }
     }"
+
+    install -Dm644 ${introduction_list} $out/share/budgie-control-center/introduction/introduction.list
   '';
 
   preFixup = ''
@@ -176,18 +172,11 @@ stdenv.mkDerivation (finalAttrs: {
       # Thumbnailers (for setting user profile pictures)
       --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
       --prefix XDG_DATA_DIRS : "${librsvg}/share"
-      # WM keyboard shortcuts
-      --prefix XDG_DATA_DIRS : "${mutter}/share"
     )
   '';
 
   separateDebugInfo = true;
 
-  # Fix GCC 14 build.
-  # cc-display-panel.c:962:41: error: passing argument 1 of 'gtk_widget_set_sensitive'
-  # from incompatible pointer type [-Wincompatible-pointer-types]
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
-
   passthru = {
     tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/bu/budgie-desktop-services/package.nix b/pkgs/by-name/bu/budgie-desktop-services/package.nix
new file mode 100644
index 000000000000..4bf24d317998
--- /dev/null
+++ b/pkgs/by-name/bu/budgie-desktop-services/package.nix
@@ -0,0 +1,50 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitea,
+  cmake,
+  kdePackages,
+  qt6,
+  toml11,
+  buildPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "budgie-desktop-services";
+  version = "1.0.2";
+
+  src = fetchFromGitea {
+    domain = "forge.moderndesktop.dev";
+    owner = "BuddiesOfBudgie";
+    repo = "budgie-desktop-services";
+    tag = finalAttrs.version;
+    hash = "sha256-YOa2pUePp33d1xKF7HrBX2EkjEQsRmzoiJMq72fl3CE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    kdePackages.extra-cmake-modules
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    kdePackages.kwayland
+    qt6.qtbase
+    toml11
+  ];
+
+  postPatch = ''
+    substituteInPlace cmake/ECMFindModuleHelpersStub.cmake --replace-fail \
+      '/usr/share/ECM/modules//ECMFindModuleHelpers.cmake' \
+      '${buildPackages.kdePackages.extra-cmake-modules}/share/ECM/modules/ECMFindModuleHelpers.cmake'
+  '';
+
+  meta = {
+    description = "Future central hub and orchestrator for Budgie Desktop";
+    mainProgram = "org.buddiesofbudgie.Services";
+    homepage = "https://forge.moderndesktop.dev/BuddiesOfBudgie/budgie-desktop-services";
+    license = lib.licenses.mpl20;
+    teams = [ lib.teams.budgie ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/bu/budgie-desktop-view/package.nix b/pkgs/by-name/bu/budgie-desktop-view/package.nix
index f59d65b5d73e..3256db4b1240 100644
--- a/pkgs/by-name/bu/budgie-desktop-view/package.nix
+++ b/pkgs/by-name/bu/budgie-desktop-view/package.nix
@@ -5,7 +5,9 @@
   desktop-file-utils,
   glib,
   gtk3,
+  gtk-layer-shell,
   intltool,
+  libxfce4windowing,
   meson,
   ninja,
   nix-update-script,
@@ -16,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-desktop-view";
-  version = "1.3";
+  version = "10.10.1";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop-view";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k6VfAGWvUarhBFnREasOvWH3M9uuT5SFUpMFmKo1fmE=";
+    hash = "sha256-ro+/Aqsyr9py3SEdsRg+eiQLDkFI0wI4MMdCyH02E3U=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     glib
     gtk3
+    gtk-layer-shell
+    libxfce4windowing
   ];
 
   mesonFlags = [ (lib.mesonBool "werror" false) ];
diff --git a/pkgs/by-name/bu/budgie-desktop/package.nix b/pkgs/by-name/bu/budgie-desktop/package.nix
index 29e729bfa3d3..0eb71d8165a3 100644
--- a/pkgs/by-name/bu/budgie-desktop/package.nix
+++ b/pkgs/by-name/bu/budgie-desktop/package.nix
@@ -4,58 +4,61 @@
   fetchFromGitHub,
   accountsservice,
   alsa-lib,
-  budgie-screensaver,
+  budgie-desktop-services,
+  budgie-session,
   docbook-xsl-nons,
   glib,
   gnome-desktop,
   gnome-settings-daemon,
   gobject-introspection,
-  graphene,
   gst_all_1,
   gtk-doc,
   gtk3,
+  gtk-layer-shell,
   ibus,
   intltool,
   libcanberra-gtk3,
   libgee,
-  libGL,
-  libgudev,
   libnotify,
   libpeas2,
   libpulseaudio,
   libuuid,
   libwacom,
   libwnck,
-  magpie,
-  libgbm,
+  libxfce4windowing,
   meson,
   mutter,
   ninja,
   nix-update-script,
-  nixosTests,
   pkg-config,
-  polkit,
+  python3,
   sassc,
   testers,
-  udev,
   upower,
   vala,
   validatePkgConfig,
-  libxfce4windowing,
   wrapGAppsHook3,
-  zenity,
 }:
 
+let
+  pythonEnv = python3.withPackages (
+    pp: with pp; [
+      psutil
+      pygobject3
+      systemd-python
+    ]
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-desktop";
-  version = "10.9.4";
+  version = "10.10.1";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-e1kkmzSYX8TwiY0IIZYIK/FgMbZ/8PqkUn8pk3CcXHU=";
+    hash = "sha256-6SRnub0FMRE9AcHwsnYH4WMdG2kqEpl5dfHy56FwrGU=";
   };
 
   outputs = [
@@ -76,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    sassc
     vala
     validatePkgConfig
     wrapGAppsHook3
@@ -84,54 +88,50 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     accountsservice
     alsa-lib
-    budgie-screensaver
     glib
     gnome-desktop
     gnome-settings-daemon
-    mutter
-    zenity
-    graphene
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gtk3
+    gtk-layer-shell
     ibus
     libcanberra-gtk3
     libgee
-    libGL
-    libgudev
     libnotify
     libpulseaudio
     libuuid
     libwacom
     libwnck
-    magpie
-    libgbm
-    polkit
-    sassc
-    udev
-    upower
     libxfce4windowing
+    mutter # org.gnome.mutter.keybindings
+    pythonEnv
+    upower
   ];
 
   propagatedBuildInputs = [
-    # budgie-1.0.pc, budgie-raven-plugin-1.0.pc
+    # budgie-3.0.pc, budgie-raven-plugin-3.0.pc
     libpeas2
   ];
 
   mesonFlags = [
-    # FIXME: The meson option name is confusing
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/739#discussion_r2359421711
-    "-Dbsd-libexecdir=${gnome-settings-daemon}/libexec"
+    "-Dgsd-libexecdir=${gnome-settings-daemon}/libexec"
+    "-Dwith-runtime-dependencies=false"
   ];
 
+  postPatch = ''
+    substituteInPlace src/session/budgie-desktop.in \
+      --replace-fail "@bindir@/org.buddiesofbudgie.Services" "${lib.getExe budgie-desktop-services}" \
+      --replace-fail "@gsd_libexecdir@/budgie-session-compositor-ready" "${budgie-session}/libexec/budgie-session-compositor-ready"
+
+    chmod +x src/bridges/labwc/labwc_bridge.py
+    substituteInPlace src/bridges/labwc/org.buddiesofbudgie.labwc-bridge.desktop.in \
+      --replace-fail "Exec=python3 @libexecdir@/labwc_bridge.py" "Exec=@libexecdir@/labwc_bridge.py"
+  '';
+
   passthru = {
     providedSessions = [ "budgie-desktop" ];
-
-    tests = {
-      inherit (nixosTests) budgie;
-      pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
-    };
-
+    tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
     updateScript = nix-update-script { };
   };
 
@@ -147,8 +147,8 @@ stdenv.mkDerivation (finalAttrs: {
     teams = [ lib.teams.budgie ];
     platforms = lib.platforms.linux;
     pkgConfigModules = [
-      "budgie-2.0"
-      "budgie-raven-plugin-2.0"
+      "budgie-3.0"
+      "budgie-raven-plugin-3.0"
       "budgie-theme-1.0"
     ];
   };
diff --git a/pkgs/by-name/bu/budgie-screensaver/package.nix b/pkgs/by-name/bu/budgie-screensaver/package.nix
deleted file mode 100644
index 59c6b9dbbe44..000000000000
--- a/pkgs/by-name/bu/budgie-screensaver/package.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  dbus-glib,
-  glib,
-  gnome-desktop,
-  gtk3,
-  intltool,
-  libgnomekbd,
-  libX11,
-  linux-pam,
-  meson,
-  ninja,
-  nix-update-script,
-  pkg-config,
-  systemd,
-  testers,
-  wrapGAppsHook3,
-  libxxf86vm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "budgie-screensaver";
-  version = "5.1.0";
-
-  src = fetchFromGitHub {
-    owner = "BuddiesOfBudgie";
-    repo = "budgie-screensaver";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-N8x9hdbaMDisTbQPJedNO4UMLnCn+Q2hhm4udJZgQlc=";
-  };
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    intltool
-    meson
-    ninja
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    dbus-glib
-    glib
-    gnome-desktop
-    gtk3
-    libgnomekbd
-    libX11
-    linux-pam
-    systemd
-    libxxf86vm
-  ];
-
-  # Fix GCC 14 build.
-  # https://hydra.nixos.org/build/282164464/nixlog/3
-  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE -Wno-error=implicit-function-declaration";
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "budgie-screensaver-command --version";
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Fork of old GNOME Screensaver for purposes of providing an authentication prompt on wake";
-    homepage = "https://github.com/BuddiesOfBudgie/budgie-screensaver";
-    changelog = "https://github.com/BuddiesOfBudgie/budgie-screensaver/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl2Only;
-    teams = [ lib.teams.budgie ];
-    mainProgram = "budgie-screensaver";
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/bu/budgie-session/fix-paths.patch b/pkgs/by-name/bu/budgie-session/fix-paths.patch
index 1c011d26b549..00e4d772fa3e 100644
--- a/pkgs/by-name/bu/budgie-session/fix-paths.patch
+++ b/pkgs/by-name/bu/budgie-session/fix-paths.patch
@@ -27,9 +27,9 @@ index 327c7c7f..301ec7ee 100644
 @@ -219,7 +219,7 @@ require_dbus_session (int      argc,
          }
          new_argv[i + 2] = NULL;
-         
+ 
 -        if (!execvp ("dbus-launch", new_argv)) {
 +        if (!execvp ("@dbusLaunch@", new_argv)) {
-                 g_set_error (error, 
+                 g_set_error (error,
                               G_SPAWN_ERROR,
                               G_SPAWN_ERROR_FAILED,
diff --git a/pkgs/by-name/bu/budgie-session/package.nix b/pkgs/by-name/bu/budgie-session/package.nix
index 307d6febde4a..2aae236f1527 100644
--- a/pkgs/by-name/bu/budgie-session/package.nix
+++ b/pkgs/by-name/bu/budgie-session/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-session";
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-session";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mz+Yh3NK2Tag+MWVofFFXYYXspxhmYBD6YCiuATpZSI=";
+    hash = "sha256-KBNX1jbQ2yv+5rymoB9/w5V3bRZhBdZIJoysp9cNgn4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix b/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
index 462a6daa5bf8..3c6aefe451c5 100644
--- a/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
+++ b/pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   glib,
   gtk3,
+  gtk-layer-shell,
   libgee,
   libgtop,
   libpeas2,
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     budgie-desktop
     glib
     gtk3
+    gtk-layer-shell
     libgee
     libgtop
     libpeas2
@@ -53,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     # https://github.com/prateekmedia/budgie-systemmonitor-applet/issues/4
     substituteInPlace meson.build \
       --replace-fail "dependency('libpeas-1.0', version: '>= 1.8.0')" "dependency('libpeas-2')" \
-      --replace-fail "dependency('budgie-1.0', version: '>= 2')" "dependency('budgie-2.0')"
+      --replace-fail "dependency('budgie-1.0', version: '>= 2')" "dependency('budgie-3.0')"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix b/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
index 1da60058ec24..b98c03ccff4d 100644
--- a/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
+++ b/pkgs/by-name/bu/budgie-user-indicator-redux/package.nix
@@ -5,6 +5,7 @@
   accountsservice,
   budgie-desktop,
   gtk3,
+  gtk-layer-shell,
   intltool,
   libgee,
   libpeas2,
@@ -39,11 +40,17 @@ stdenv.mkDerivation (finalAttrs: {
     accountsservice
     budgie-desktop
     gtk3
+    gtk-layer-shell
     libgee
     libpeas2
     sassc
   ];
 
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "dependency('budgie-2.0', version: '>= 3')" "dependency('budgie-3.0')"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/bu/butt/package.nix b/pkgs/by-name/bu/butt/package.nix
index 3050588c06b8..309673814511 100644
--- a/pkgs/by-name/bu/butt/package.nix
+++ b/pkgs/by-name/bu/butt/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "butt";
-  version = "1.45.0";
+  version = "1.46.0";
 
   src = fetchurl {
     url = "https://danielnoethen.de/butt/release/${finalAttrs.version}/butt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-iEmFEJRsTvHeKGYvnhzYXSC/q0DSw0Z/YgK4buDtg2Q=";
+    hash = "sha256-3RIC2H5HMn/e5Bl4XCPxxpv+FET9RgV7MxtcOuscXzs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/by/byobu/package.nix b/pkgs/by-name/by/byobu/package.nix
index df1b769f2b7d..95db27a77ca8 100644
--- a/pkgs/by-name/by/byobu/package.nix
+++ b/pkgs/by-name/by/byobu/package.nix
@@ -69,6 +69,13 @@ stdenv.mkDerivation (finalAttrs: {
       # scripts points to the filename and byobu matches against this to know
       # which backend to start with
       bname="$(basename $file)"
+
+      # Don't wrap byobu-launch to fix failing automatic byobu launches
+      # See: https://github.com/NixOS/nixpkgs/issues/131353
+      if [ $bname == "byobu-launch" ]; then
+        continue
+      fi
+
       mv "$file" "$out/bin/.$bname"
       makeWrapper "$out/bin/.$bname" "$out/bin/$bname" \
         --argv0 $bname \
diff --git a/pkgs/by-name/ca/caido/package.nix b/pkgs/by-name/ca/caido/package.nix
index fee8b0c6ade5..7d9d7e37fe05 100644
--- a/pkgs/by-name/ca/caido/package.nix
+++ b/pkgs/by-name/ca/caido/package.nix
@@ -16,7 +16,7 @@ let
     "cli"
     "desktop"
   ];
-  version = "0.53.1";
+  version = "0.55.1";
 
   system = stdenv.hostPlatform.system;
   isLinux = stdenv.isLinux;
@@ -26,19 +26,19 @@ let
   cliSources = {
     x86_64-linux = {
       url = "https://caido.download/releases/v${version}/caido-cli-v${version}-linux-x86_64.tar.gz";
-      hash = "sha256-qSrgEg0iEx5Mpe+meHnkrOgM9zcQJBzoH5KlMy8FE5Q=";
+      hash = "sha256-4xRkEN/ZA+JUFMB2qoEZT0Bzv2Qc7Y9kcj251MCAhKE=";
     };
     aarch64-linux = {
       url = "https://caido.download/releases/v${version}/caido-cli-v${version}-linux-aarch64.tar.gz";
-      hash = "sha256-mgIjo+1y2jxC7lPUkLjuwIq4F8SagjQAyfeqaoeQX9w=";
+      hash = "sha256-gMQkF0+mq2nRBy0oBenFvp69byWCkqmt8E4ZpKuNxKw=";
     };
     x86_64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-cli-v${version}-mac-x86_64.zip";
-      hash = "sha256-iPDYQXWaxt32MxbAWL0496i7IO0FEt8di4E0msagfEo=";
+      hash = "sha256-C+EfmSBJMyxYXLfzxCrY7ZVtg8nwtie8w0Lj1Dy7o/k=";
     };
     aarch64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-cli-v${version}-mac-aarch64.zip";
-      hash = "sha256-5b9TrR5ZqlN17OgIaQ9vPIccwOiELNcidjinF3rf6Zc=";
+      hash = "sha256-b0cBS3RwsiLgJNqHWxi672MVZNfTYNOEJ2k0h2qNnP0=";
     };
   };
 
@@ -46,19 +46,19 @@ let
   desktopSources = {
     x86_64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-      hash = "sha256-/puWhX5ooz994f1COw356HSfqcOmJaAweccTIWl9KCo=";
+      hash = "sha256-zfts2h8QWTxe/dISwgKRQiSx2nD6vtE1atPfREyGX/U=";
     };
     aarch64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-aarch64.AppImage";
-      hash = "sha256-iYaWN6Nu0+zPSUzlhUS5EIuYO32BVkBLZrPA9h7DpfM=";
+      hash = "sha256-fYqzukRptCB466LIPbVre2EwBFt4Bsq9amQ4kjQuV2Q=";
     };
     x86_64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-x86_64.dmg";
-      hash = "sha256-iPDYQXWaxt32MxbAWL0496i7IO0FEt8di4E0msagfEo=";
+      hash = "sha256-UsGT5n0MGVwWCXACo74Harb4J/qt/3TyD0+EFYNmPxw=";
     };
     aarch64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-aarch64.dmg";
-      hash = "sha256-5b9TrR5ZqlN17OgIaQ9vPIccwOiELNcidjinF3rf6Zc=";
+      hash = "sha256-iZHZayj2VYjMY9+p+xrlX+vP/DcbCRPQizQEqtF39EU=";
     };
   };
 
diff --git a/pkgs/by-name/ca/cargo-binstall/package.nix b/pkgs/by-name/ca/cargo-binstall/package.nix
index 89e6c17e9de0..a6935009914c 100644
--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     tag = "v${version}";
-    hash = "sha256-8017nujJ/nHSy1xkzfObj30ffAsg7W2pbHzrto5ThH0=";
+    hash = "sha256-X5zRAuBxey450bstp/AyaCQkMrqsFTcTD2xfpX3K/t0=";
   };
 
-  cargoHash = "sha256-NpnwtoTJs+xkedDEspDOQdZpIhuEhI3tRvH3hroIoIc=";
+  cargoHash = "sha256-4B51DmJCv4dv5vKgJNFmjAGP4CDB1gdrbGrnqt/s2Lk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index 051194a2553c..cbe27fcec99d 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.72";
+  version = "1.0.73";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-YkjRCP6VAp2Az0iM5HIG984ScJ3b3iKm34j4YuIs0kQ=";
+    hash = "sha256-aYVo/mI4YoohwxXoIL9vpuPN526sPnQMV1PnUqJEO2U=";
   };
 
-  cargoHash = "sha256-SAO1VqlYzySIiBV3j6PCo7gknekmULpG/Two/8R0pv4=";
+  cargoHash = "sha256-+TIYJn0BvFBmhVkldOTtAvQv5Uj5sLsJ4OGNH3ic8lU=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";
diff --git a/pkgs/by-name/ca/cargo-temp/package.nix b/pkgs/by-name/ca/cargo-temp/package.nix
index e697ffe5c069..aa29c790d2a2 100644
--- a/pkgs/by-name/ca/cargo-temp/package.nix
+++ b/pkgs/by-name/ca/cargo-temp/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-temp";
-  version = "0.3.5";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "yozhgoor";
     repo = "cargo-temp";
     rev = "v${version}";
-    hash = "sha256-kCiw3a9C78mcJ2/bX+E5gXZKYcfLXF0crMIZu4cJsdY=";
+    hash = "sha256-F7KIYEWZN4KAVoBRquL7/VH0p+MSFGO0n2PkbXljyPM=";
   };
 
-  cargoHash = "sha256-7S7L/OKHTOAP9tbM7+xWhvcYBZScvX6SBW3U1AyFGrs=";
+  cargoHash = "sha256-ho5HriiViW2FxxPz4RA1nCkmlG7cdt5VuhVrSdGzzuY=";
 
   meta = {
     description = "CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";
diff --git a/pkgs/by-name/cc/ccls/package.nix b/pkgs/by-name/cc/ccls/package.nix
index c6c7f597277a..c4d554e3968c 100644
--- a/pkgs/by-name/cc/ccls/package.nix
+++ b/pkgs/by-name/cc/ccls/package.nix
@@ -3,29 +3,32 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  llvmPackages_19,
+  llvmPackages,
   rapidjson,
   runtimeShell,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ccls";
-  version = "0.20241108";
+  version = "0.20250815.1";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
-    rev = finalAttrs.version;
-    sha256 = "sha256-0hZ4VnscnKYBrXy58IjeoeDxja1oNq0mNaQGPmej5BA=";
+    tag = finalAttrs.version;
+    hash = "sha256-3Wi8hsjFtFa0/HCZtli2omOskIlxV7FndbJv9MOWhMo=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
-    llvmPackages_19.llvm.dev
+    llvmPackages.clang
+    llvmPackages.llvm.dev
   ];
-  buildInputs = with llvmPackages_19; [
-    libclang
-    llvm
+  buildInputs = [
+    llvmPackages.libclang
+    llvmPackages.llvm
     rapidjson
   ];
 
@@ -35,13 +38,13 @@ stdenv.mkDerivation (finalAttrs: {
     cmakeFlagsArray+=(-DCMAKE_CXX_FLAGS="-fvisibility=hidden -fno-rtti")
   '';
 
-  clang = llvmPackages_19.clang;
-  shell = runtimeShell;
-
   postFixup = ''
     export wrapped=".ccls-wrapped"
     mv $out/bin/ccls $out/bin/$wrapped
-    substituteAll ${./wrapper} $out/bin/ccls
+    substitute ${./wrapper} $out/bin/ccls \
+      --replace-fail '@clang@' '${llvmPackages.clang}' \
+      --replace-fail '@shell@' '${runtimeShell}' \
+      --replace-fail '@wrapped@' "$wrapped"
     chmod --reference=$out/bin/$wrapped $out/bin/ccls
   '';
 
@@ -51,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/MaskRay/ccls";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [
-      mic92
-      tobim
+    maintainers = [
+      lib.maintainers.mic92
+      lib.maintainers.tobim
     ];
   };
 })
diff --git a/pkgs/by-name/cc/ccls/wrapper b/pkgs/by-name/cc/ccls/wrapper
index 294b60893a3f..703bd88cfaed 100644
--- a/pkgs/by-name/cc/ccls/wrapper
+++ b/pkgs/by-name/cc/ccls/wrapper
@@ -1,9 +1,11 @@
 #! @shell@ -e
 
+dirpath=$(CDPATH=  cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
 printf -v extraArgs ',\"%s\"' \
   $(cat @clang@/nix-support/libc-cflags \
         @clang@/nix-support/libcxx-cxxflags) \
   ${NIX_CFLAGS_COMPILE}
 initString="--init={\"clang\":{\"extraArgs\":[${extraArgs:1}],\"resourceDir\":\"@clang@/resource-root\"}}"
 
-exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
+exec -a "$0" "$dirpath/@wrapped@" "${initString}" "$@"
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index 5feee2664fa6..a78d7384890f 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -37,14 +37,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.499";
+  version = "3.2.500";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-1jb+ot8m7MS+BvXL7QakBHoViEmk+eORVmlmBJDfAtM=";
+    hash = "sha256-pjoWUEJbB5onlprYOjl8diVolM29kXf0GS9eebV+o9o=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index d2bbfcbea610..3a52e1378bf7 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.12.3.21-stable";
-  rev = "7c3f65751609dab4f2f66de305cbc96dbeb1c4f2";
-  hash = "sha256-1cPAEh8CuKGLcQhUSAMXE8sR3pStzVEtPpgUTj2z0cw=";
+  version = "25.12.4.35-stable";
+  rev = "4b2fbdcba83cf43fcf641e8dc492dfe0eaddce1a";
+  hash = "sha256-XC6Mt+XmCcRp4V0U8RPBIqPNZdN3KdSz8IDh49ZcWBE=";
   lts = false;
 }
diff --git a/pkgs/by-name/co/cockpit-files/package.nix b/pkgs/by-name/co/cockpit-files/package.nix
index 5b1ac0e97489..fdcebd486a01 100644
--- a/pkgs/by-name/co/cockpit-files/package.nix
+++ b/pkgs/by-name/co/cockpit-files/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-files";
-  version = "34";
+  version = "35";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-files";
     tag = finalAttrs.version;
-    hash = "sha256-nxlPzNrX3mAwhR8mpRfoZ7d6tdfVOBEaTtzEHU14p68=";
+    hash = "sha256-ziFtsWZPdzkqc3UEaoIfwsIe8q/H0lyLtEropA2w+pc=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/cockpit-machines/package.nix b/pkgs/by-name/co/cockpit-machines/package.nix
index 742f72328bac..4b4d0d544ae1 100644
--- a/pkgs/by-name/co/cockpit-machines/package.nix
+++ b/pkgs/by-name/co/cockpit-machines/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-machines";
-  version = "346";
+  version = "347";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-machines";
     tag = finalAttrs.version;
-    hash = "sha256-fsEmxJ/9w4NbjgKhb4JTFY94FFTc735+ZQ8YieLQVpA=";
+    hash = "sha256-VXxR6/6nPaWA2FwT/bViu1FQAgqs0Jya1IyN5Oodfow=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/cockpit-podman/package.nix b/pkgs/by-name/co/cockpit-podman/package.nix
index d4cd27c96f5c..d4e0d7c6191c 100644
--- a/pkgs/by-name/co/cockpit-podman/package.nix
+++ b/pkgs/by-name/co/cockpit-podman/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-podman";
-  version = "119.1";
+  version = "120";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-podman";
     tag = finalAttrs.version;
-    hash = "sha256-XAOHkul9oh1mUJ27ghJgZLtriBGjofyoGhQ3gb7Gunc=";
+    hash = "sha256-1PXz+zHuj5fjzDe194+sgBlLhQnS9jzv9FbM9RfNIVc=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/complgen/package.nix b/pkgs/by-name/co/complgen/package.nix
index 7dede6691e85..3adb08a269ad 100644
--- a/pkgs/by-name/co/complgen/package.nix
+++ b/pkgs/by-name/co/complgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "complgen";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DNmStSwuAFsLGC4pLU6dO2qhBQgxObPiUJxZoJf1d5A=";
+    hash = "sha256-5fEownFj5cyLL+4ZPN80qlkw3xu6xspsKfruk7KBhrI=";
   };
 
-  cargoHash = "sha256-whve1rNmqOLWjrM8gqxgocRTTWpEQ/VxT/0t+12uSKw=";
+  cargoHash = "sha256-wGbf1UiCwjOzUbR0k45EAuGjEg9+x14d8kKpz7pHQN8=";
 
   meta = {
     changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";
diff --git a/pkgs/by-name/co/corepack/package.nix b/pkgs/by-name/co/corepack/package.nix
index ed4bc2bc3d3a..6b20aacfe413 100644
--- a/pkgs/by-name/co/corepack/package.nix
+++ b/pkgs/by-name/co/corepack/package.nix
@@ -3,13 +3,16 @@
   stdenvNoCC,
   cacert,
   yarn-berry,
-  nodejs,
+  nodejs-slim, # no need for NPM
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,
   fetchpatch2,
 }:
 
+let
+  nodejs = nodejs-slim;
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "corepack";
   version = "0.34.6";
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 22e004a969dd..ebd4a3f3d846 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.6.3";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-J9h4G+4jv02/gbpHd/THLAxxII/hlmsFuaJUTU8TMgQ=";
+    hash = "sha256-aH2sm7GkHbjy0/KwgyCIpAFNHDmJURd4xyn+51MCr+Y=";
   };
 
   # Fix CMake 4 compatibility
diff --git a/pkgs/by-name/cu/curv/package.nix b/pkgs/by-name/cu/curv/package.nix
index f69186b22704..d67ac22ec02f 100644
--- a/pkgs/by-name/cu/curv/package.nix
+++ b/pkgs/by-name/cu/curv/package.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation {
 
   # force char to be unsigned on aarch64
   # https://codeberg.org/doug-moen/curv/issues/227
-  NIX_CFLAGS_COMPILE = [ "-fsigned-char" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fsigned-char" ];
 
   # GPU tests do not work in sandbox, instead we do this for sanity
   doInstallCheck = true;
diff --git a/pkgs/by-name/cv/cvc5/package.nix b/pkgs/by-name/cv/cvc5/package.nix
index 93a36acc5bbc..34c960f16558 100644
--- a/pkgs/by-name/cv/cvc5/package.nix
+++ b/pkgs/by-name/cv/cvc5/package.nix
@@ -6,6 +6,7 @@
   cmake,
   flex,
   cadical,
+  cadical' ? cadical.override { version = "2.1.3"; },
   symfpu,
   gmp,
   python3,
@@ -26,19 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Um1x+XgQ5yWSoqtx1ZWbVAnNET2C4GVasIbn0eNfico=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     cmake
     flex
-  ];
-  buildInputs = [
-    cadical.dev
-    symfpu
-    gmp
-    gtest
-    boost
-    jdk
-    libpoly
     (python3.withPackages (
       ps: with ps; [
         pyparsing
@@ -46,6 +41,15 @@ stdenv.mkDerivation (finalAttrs: {
       ]
     ))
   ];
+  buildInputs = [
+    cadical'.dev
+    symfpu
+    gmp
+    gtest
+    boost
+    jdk
+    libpoly
+  ];
 
   preConfigure = ''
     patchShebangs ./src/
diff --git a/pkgs/by-name/cw/cwiid/package.nix b/pkgs/by-name/cw/cwiid/package.nix
index eccda1e63962..2d7391811e6e 100644
--- a/pkgs/by-name/cw/cwiid/package.nix
+++ b/pkgs/by-name/cw/cwiid/package.nix
@@ -45,8 +45,10 @@ stdenv.mkDerivation {
     flex
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
-  NIX_LDFLAGS = "-lbluetooth";
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+    NIX_LDFLAGS = "-lbluetooth";
+  };
 
   postInstall = ''
     # Some programs (for example, cabal-install) have problems with the double 0
diff --git a/pkgs/by-name/de/dejavu_fontsEnv/package.nix b/pkgs/by-name/de/dejavu_fontsEnv/package.nix
new file mode 100644
index 000000000000..2e215d31f691
--- /dev/null
+++ b/pkgs/by-name/de/dejavu_fontsEnv/package.nix
@@ -0,0 +1,9 @@
+{
+  buildEnv,
+  dejavu_fonts,
+}:
+
+buildEnv {
+  inherit (dejavu_fonts) pname version;
+  paths = [ dejavu_fonts.out ];
+}
diff --git a/pkgs/by-name/de/delly/package.nix b/pkgs/by-name/de/delly/package.nix
index 7e9777ad1777..b85de53d7b2c 100644
--- a/pkgs/by-name/de/delly/package.nix
+++ b/pkgs/by-name/de/delly/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "delly";
-  version = "1.5.0";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "dellytools";
     repo = "delly";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OoQivDDoYtYYPsl5U4hJGE7b+IU/jrqWejiXY5Py4n4=";
+    hash = "sha256-wlaRHCRcbj4Hw7PVYeB6N1bMS4FL3gPo1uC1OOmJwuA=";
   };
 
   postPatch = lib.optionalString stdenv.cc.isClang ''
diff --git a/pkgs/by-name/de/denemo/package.nix b/pkgs/by-name/de/denemo/package.nix
index ac500882d15f..2dc1d61a776f 100644
--- a/pkgs/by-name/de/denemo/package.nix
+++ b/pkgs/by-name/de/denemo/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   ];
 
   # error by default in GCC 14
-  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   preFixup = ''
     gappsWrapperArgs+=(
diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index cf5419c434aa..87ea62df7ab7 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.81.0";
+  version = "1.82.0";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:d26fd269228ce287141aef81ef54e23a0001d2c6c6a3e16db286488c7d769c8c";
-  updateJobProxy.hash = "sha256-6mmiI2AjKxopeC5SfTa9XOR4hatxEu6M/28wycRnz2w=";
+  updateJobProxy.imageDigest = "sha256:70cf9a8f006db9cde732faf9e33a4f60af895532bbe803268fc8fd2f70aa3202";
+  updateJobProxy.hash = "sha256-HTqXW+q/kdOVRplh1b23uQIJ6D9Xf2i1Gtv6dlRPPYc=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:5964979027fe1d6fc358e89774074bfe34fa89b2b53ce7d45b44b4ebf71b7953";
-  updaterGitHubActions.hash = "sha256-dmMq/T7DLomvzPtOGIBQnrv+k5/NpfxbcXFxxo5ij6o=";
+  updaterGitHubActions.imageDigest = "sha256:16b379590f4eda319c618de70e0e9cd29f49a10d9b80b905e4aa05df78389c1a";
+  updaterGitHubActions.hash = "sha256-/kWULJVxOPK22pMctd9QPi3nld0qOnJE0pWwVO/nIsQ=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,7 +34,7 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-9//TW+56UM/5J6psJWcS6lJqyKwQUEOWftTOJxEaCcQ=";
+    hash = "sha256-ZMMpOrOMuqheoUyTPEx2J7AMQ32yfhwW4u4PtoSuuBE=";
   };
 
   vendorHash = "sha256-dD48OKpuGAJAro7qV4tqpf/uENV2X1VQ2kUvAuJLXc0=";
@@ -61,6 +61,10 @@ buildGoModule {
     "-skip=TestDependabot"
   ];
 
+  # Some tests fail on *-darwin because they require host port binding or a Docker environment.
+  # So, we skip the test entirely on *-darwin.
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/dependabot --help
diff --git a/pkgs/by-name/di/di/package.nix b/pkgs/by-name/di/di/package.nix
index 0e37012325dd..fe45f1438216 100644
--- a/pkgs/by-name/di/di/package.nix
+++ b/pkgs/by-name/di/di/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "6.0.0";
+  version = "6.2.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/diskinfo-di/${pname}-${version}.tar.gz";
-    sha256 = "sha256-e2Y+TbBEsfpJhr0Bj4J8GOlv5tH5o2cy3LsEUOf1GMs=";
+    sha256 = "sha256-Ge7rfrytMGGueBTNrlWTrM+yuyYc4keVpgSigsv8YP4=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/di/discordo/package.nix b/pkgs/by-name/di/discordo/package.nix
index ea83a11a4100..1df45ca5ab3b 100644
--- a/pkgs/by-name/di/discordo/package.nix
+++ b/pkgs/by-name/di/discordo/package.nix
@@ -4,31 +4,36 @@
   buildGoModule,
   fetchFromGitHub,
   nix-update-script,
+  libx11,
   makeWrapper,
-  xsel,
   wl-clipboard,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "discordo";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2026-01-28";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = "discordo";
-    rev = "a9359209369cf816bdab76d4feeb8270a5410040";
-    hash = "sha256-Dudlghaz3RGZaHSExyzmeVUZufU8w1ONSE3nh/GINHQ=";
+    rev = "415c534674064305625f97a8ba42c4da0ad8f2e9";
+    hash = "sha256-epodX3renaAdzqKsYux65LX671M6u3uHvh/EViQqAQg=";
   };
 
-  vendorHash = "sha256-IFZcBq58qLRmU0eDrPNh/vEL3L+FZX1AHS09vtWmRaQ=";
+  vendorHash = "sha256-2Y+IBDklxro75rFImKjMecr/eK6jSquKidy4hfpguYY=";
 
-  env.CGO_ENABLED = 0;
+  env.CGO_ENABLED = 1;
 
   ldflags = [
     "-s"
   ];
 
-  # Clipboard support on X11 and Wayland
+  # Clipboard support on X11
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    libx11
+  ];
+
+  # Clipboard support on Wayland
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     makeWrapper
   ];
@@ -37,7 +42,6 @@ buildGoModule (finalAttrs: {
     wrapProgram $out/bin/discordo \
       --prefix PATH : ${
         lib.makeBinPath [
-          xsel
           wl-clipboard
         ]
       }
@@ -51,7 +55,10 @@ buildGoModule (finalAttrs: {
     description = "Lightweight, secure, and feature-rich Discord terminal client";
     homepage = "https://github.com/ayn2op/discordo";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ arian-d ];
+    maintainers = with lib.maintainers; [
+      arian-d
+      siphc
+    ];
     mainProgram = "discordo";
   };
 })
diff --git a/pkgs/by-name/dn/dnf5/package.nix b/pkgs/by-name/dn/dnf5/package.nix
index d96b43ee8438..aeb44bb88b58 100644
--- a/pkgs/by-name/dn/dnf5/package.nix
+++ b/pkgs/by-name/dn/dnf5/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # workaround for https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105329
-  NIX_CFLAGS_COMPILE = "-Wno-restrict -Wno-maybe-uninitialized";
+  env.NIX_CFLAGS_COMPILE = "-Wno-restrict -Wno-maybe-uninitialized";
 
   cmakeFlags = [
     "-DWITH_PERL5=OFF"
diff --git a/pkgs/by-name/dr/dracula-theme/package.nix b/pkgs/by-name/dr/dracula-theme/package.nix
index eef87ed5ab0e..58a1d41e608b 100644
--- a/pkgs/by-name/dr/dracula-theme/package.nix
+++ b/pkgs/by-name/dr/dracula-theme/package.nix
@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2026-01-22";
+  version = "4.0.0-unstable-2026-01-31";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "0a573d38280bec3e576f4be9d12a716b02254f7a";
-    hash = "sha256-Nyp6hLP8eAawiQMPuwZfg0FMR7HGDBb+TDozrE8VygQ=";
+    rev = "1282a6806d568b736fddf783263fc96ccd34a8ce";
+    hash = "sha256-6fYbe3CVfCw/CZaFX5Mc1DPb4+uiQLIZlirx+2/jUzw=";
   };
 
   propagatedUserEnvPkgs = [
diff --git a/pkgs/by-name/ee/ee/package.nix b/pkgs/by-name/ee/ee/package.nix
index 0b4707c79499..f0e2f5a32c8e 100644
--- a/pkgs/by-name/ee/ee/package.nix
+++ b/pkgs/by-name/ee/ee/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     substituteInPlace create.make --replace-fail "-lcurses" "-lncurses"
   '';
 
-  NIX_CFLAGS_COMPILE = "-DHAS_UNISTD=1 -DHAS_STDLIB=1 -DHAS_SYS_WAIT=1";
+  env.NIX_CFLAGS_COMPILE = "-DHAS_UNISTD=1 -DHAS_STDLIB=1 -DHAS_SYS_WAIT=1";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/el/elmerfem/package.nix b/pkgs/by-name/el/elmerfem/package.nix
index c26c30e89687..d5be0d806fe7 100644
--- a/pkgs/by-name/el/elmerfem/package.nix
+++ b/pkgs/by-name/el/elmerfem/package.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
     patchShebangs ./
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   cmakeFlags = [
     (lib.cmakeFeature "ELMER_INSTALL_LIB_DIR" "${placeholder "out"}/lib")
diff --git a/pkgs/by-name/en/en-croissant/en-croissant-update-tauri-utils.patch b/pkgs/by-name/en/en-croissant/en-croissant-update-tauri-utils.patch
deleted file mode 100644
index d4e8f40e5602..000000000000
--- a/pkgs/by-name/en/en-croissant/en-croissant-update-tauri-utils.patch
+++ /dev/null
@@ -1,166 +0,0 @@
-diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
-index f4bc16e..cae6562 100644
---- a/src-tauri/Cargo.lock
-+++ b/src-tauri/Cargo.lock
-@@ -545,6 +545,17 @@ dependencies = [
-  "brotli-decompressor",
- ]
- 
-+[[package]]
-+name = "brotli"
-+version = "7.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cc97b8f16f944bba54f0433f07e30be199b6dc2bd25937444bbad560bcea29bd"
-+dependencies = [
-+ "alloc-no-stdlib",
-+ "alloc-stdlib",
-+ "brotli-decompressor",
-+]
-+
- [[package]]
- name = "brotli-decompressor"
- version = "4.0.1"
-@@ -690,16 +701,16 @@ dependencies = [
- 
- [[package]]
- name = "cargo_metadata"
--version = "0.18.1"
-+version = "0.19.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
-+checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
- dependencies = [
-  "camino",
-  "cargo-platform",
-  "semver",
-  "serde",
-  "serde_json",
-- "thiserror 1.0.63",
-+ "thiserror 2.0.17",
- ]
- 
- [[package]]
-@@ -2661,7 +2672,19 @@ version = "2.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "5b1fb8864823fad91877e6caea0baca82e49e8db50f8e5c9f9a453e27d3330fc"
- dependencies = [
-- "jsonptr",
-+ "jsonptr 0.4.7",
-+ "serde",
-+ "serde_json",
-+ "thiserror 1.0.63",
-+]
-+
-+[[package]]
-+name = "json-patch"
-+version = "3.0.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
-+dependencies = [
-+ "jsonptr 0.6.3",
-  "serde",
-  "serde_json",
-  "thiserror 1.0.63",
-@@ -2678,6 +2701,16 @@ dependencies = [
-  "serde_json",
- ]
- 
-+[[package]]
-+name = "jsonptr"
-+version = "0.6.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
-+dependencies = [
-+ "serde",
-+ "serde_json",
-+]
-+
- [[package]]
- name = "keyboard-types"
- version = "0.7.0"
-@@ -4614,13 +4647,15 @@ dependencies = [
- 
- [[package]]
- name = "serde_json"
--version = "1.0.114"
-+version = "1.0.149"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
-+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
- dependencies = [
-  "itoa 1.0.10",
-- "ryu",
-+ "memchr",
-  "serde",
-+ "serde_core",
-+ "zmij",
- ]
- 
- [[package]]
-@@ -5237,7 +5272,7 @@ dependencies = [
-  "dirs",
-  "glob",
-  "heck 0.5.0",
-- "json-patch",
-+ "json-patch 2.0.0",
-  "schemars",
-  "semver",
-  "serde",
-@@ -5255,9 +5290,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "95d7443dd4f0b597704b6a14b964ee2ed16e99928d8e6292ae9825f09fbcd30e"
- dependencies = [
-  "base64 0.22.1",
-- "brotli",
-+ "brotli 6.0.0",
-  "ico",
-- "json-patch",
-+ "json-patch 2.0.0",
-  "plist",
-  "png",
-  "proc-macro2",
-@@ -5573,18 +5608,19 @@ dependencies = [
- 
- [[package]]
- name = "tauri-utils"
--version = "2.0.1"
-+version = "2.1.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c38b0230d6880cf6dd07b6d7dd7789a0869f98ac12146e0d18d1c1049215a045"
-+checksum = "96fb10e7cc97456b2d5b9c03e335b5de5da982039a303a20d10006885e4523a0"
- dependencies = [
-- "brotli",
-+ "brotli 7.0.0",
-  "cargo_metadata",
-  "ctor",
-  "dunce",
-  "glob",
-  "html5ever",
-+ "http 1.1.0",
-  "infer",
-- "json-patch",
-+ "json-patch 3.0.1",
-  "kuchikiki",
-  "log",
-  "memchr",
-@@ -5599,7 +5635,7 @@ dependencies = [
-  "serde_json",
-  "serde_with",
-  "swift-rs",
-- "thiserror 1.0.63",
-+ "thiserror 2.0.17",
-  "toml 0.8.2",
-  "url",
-  "urlpattern",
-@@ -7031,6 +7067,12 @@ dependencies = [
-  "zstd",
- ]
- 
-+[[package]]
-+name = "zmij"
-+version = "1.0.12"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2fc5a66a20078bf1251bde995aa2fdcc4b800c70b5d92dd2c62abc5c60f679f8"
-+
- [[package]]
- name = "zopfli"
- version = "0.8.1"
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index 38f2cc31b26e..20d4f704dc23 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -27,13 +27,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "en-croissant";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "franciscoBSalgueiro";
     repo = "en-croissant";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ef6O8C1PPjCmF5lashpBQXWwjsEEKCl5R98QMOFDIBM=";
+    hash = "sha256-+s774MtqbfOhL2qco+i9uBMQPn30EGvOYtqw1nZ9KkY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -43,22 +43,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
       src
       ;
     inherit pnpm;
-    fetcherVersion = 2;
-    hash = "sha256-p2j886NRBw/8c2UJ94o6w7YtKnOfm7hU9SgEUrzAwco=";
+    fetcherVersion = 3;
+    hash = "sha256-/gue4iQG8xySxsH3l5ri+GjmNr/9sow20CLVxxQo7Gs=";
   };
 
-  cargoPatches = [
-    # Bump the tauri-utils package to at least 2.1.0, to fix resource path resolution on NixOS.
-    ./en-croissant-update-tauri-utils.patch
-  ];
-
   postPatch = ''
     jq '.plugins.updater.endpoints = [ ] | .bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json | sponge src-tauri/tauri.conf.json
   '';
 
   cargoRoot = "src-tauri";
 
-  cargoHash = "sha256-cTb6nKHlazyOu3cpwAAp20j3QmrDxC507ZRpYT5fgQs=";
+  cargoHash = "sha256-4gtGHexyR6TkI8tmtLMT2xUAn9+Bd9l3hRq43aL94yI=";
 
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 04fedc522b2f..b050554f54cc 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-01-18";
+  version = "2026-02-03";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-ZV8CcpZzxK1uts8RzUmzp4mKXvS/xv8D02Jsv7DzByQ=";
+    hash = "sha256-NEav9U7rqPRtDTZPRIP7UTa/cbbRRz5G2YOWZmAabO8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fa/fairymax/package.nix b/pkgs/by-name/fa/fairymax/package.nix
index 18ad0a8cbf94..a28e8eed65ca 100644
--- a/pkgs/by-name/fa/fairymax/package.nix
+++ b/pkgs/by-name/fa/fairymax/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   # errors by default in GCC 14
-  NIX_CFLAGS_COMPILE = "-Wno-error=return-mismatch -Wno-error=implicit-int";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=return-mismatch -Wno-error=implicit-int";
 
   installPhase = ''
     mkdir -p "$out"/{bin,share/fairymax}
diff --git a/pkgs/by-name/fa/fanficfare/package.nix b/pkgs/by-name/fa/fanficfare/package.nix
index cbc910efa1bb..8a01553ce3ad 100644
--- a/pkgs/by-name/fa/fanficfare/package.nix
+++ b/pkgs/by-name/fa/fanficfare/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "fanficfare";
-  version = "4.50.0";
+  version = "4.53.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+4hasWmQx//HzKwOmtlGqutw95rKFvWL97Ec1xLE1Js=";
+    hash = "sha256-lUeMP7wWs5+ZzP4pEr0BUvzAIo+NKAqs4bGSGcSmi/k=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/fi/figma-agent/package.nix b/pkgs/by-name/fi/figma-agent/package.nix
index b20d9f077246..1145ec9e2a7c 100644
--- a/pkgs/by-name/fi/figma-agent/package.nix
+++ b/pkgs/by-name/fi/figma-agent/package.nix
@@ -2,37 +2,19 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
-  fontconfig,
-  freetype,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "figma-agent";
-  version = "0.3.2-unstable-2024-11-16";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "neetly";
     repo = "figma-agent-linux";
-    rev = "6709a1b7ffcbfb227472d8f017bfbbda77ddca7d";
-    sha256 = "sha256-Cq+ivyrj6wt7DEUM730BG44sMkpOMt4qxb+J3itVar4=";
+    tag = finalAttrs.version;
+    hash = "sha256-eP2C/u4CWdf7ABHdxapFcrmI1Un405wIHE0kpvz7y7A=";
   };
 
-  cargoHash = "sha256-QdEs1zaQ2CQT50nIhKxtp7zpJfa64xQgOy3sTOUGmxk=";
-
-  nativeBuildInputs = [
-    pkg-config
-    rustPlatform.bindgenHook
-  ];
-
-  buildInputs = [
-    fontconfig
-    freetype
-  ];
-
-  checkFlags = [
-    # All tests fail due to unavailable bindings
-    "--skip=figma-agent-freetype-sys"
-  ];
+  cargoHash = "sha256-KmoTsriLnYvEI+yOOV9sLQ6qPRKqYRDzaYj7Kp72sP0=";
 
   meta = {
     description = "Figma Agent for Linux with a focus on performance";
@@ -42,4 +24,4 @@ rustPlatform.buildRustPackage {
     mainProgram = "figma-agent";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 8154a047e795..97b1630bfe10 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -150,13 +150,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.3.3";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-mAEsqAXwge5FUuYD4yge7TfwrmAyhpzjrbjPOoQKQDo=";
+    hash = "sha256-vUNmlEVQ5nxXSDfpgQ3l/+dzYW/MllhcfJhmFx4kY/A=";
   };
 
   env = {
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-fwERCvGfBOXlVFHQl6moZV8kNmHA7N/PkS3eDaLKPkA=";
+    hash = "sha256-9Wi9KlMzTrecEkHyfW/H9WPHpQDEMpdGB8snFs7zFb4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fl/flashrom/package.nix b/pkgs/by-name/fl/flashrom/package.nix
index bce0af5e1847..4eb29859cebc 100644
--- a/pkgs/by-name/fl/flashrom/package.nix
+++ b/pkgs/by-name/fl/flashrom/package.nix
@@ -70,9 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 $NIX_BUILD_TOP/$sourceRoot/util/flashrom_udev.rules $out/lib/udev/rules.d/flashrom.rules
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.cc.isClang && !stdenv.hostPlatform.isDarwin
-  ) "-Wno-gnu-folding-constant";
+  env = lib.optionalAttrs (stdenv.cc.isClang && !stdenv.hostPlatform.isDarwin) {
+    NIX_CFLAGS_COMPILE = "-Wno-gnu-folding-constant";
+  };
 
   meta = {
     homepage = "https://www.flashrom.org";
diff --git a/pkgs/by-name/fl/flink/package.nix b/pkgs/by-name/fl/flink/package.nix
index 006f23c9811b..a837b051d18c 100644
--- a/pkgs/by-name/fl/flink/package.nix
+++ b/pkgs/by-name/fl/flink/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "flink";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.12.tgz";
-    sha256 = "sha256-B/EhLtDKve1SKoayDy6E64Lk4FTln3FL79kh3CcHLEU=";
+    sha256 = "sha256-tmx9xuGVNyCd3DlDDWvn54XUjcB41rLSaapgFQlbSF8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
index 7854e67964ef..a29f47c045be 100644
--- a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
+++ b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "12.10.2",
+  "version": "12.10.3",
   "sources": {
     "aarch64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.2/floorp-linux-aarch64.tar.xz",
-      "sha256": "a6c0919ff1ba5099d7efcc595aa943ea26fb1614c9fdc8099dda5d7cdd2c902b"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-linux-aarch64.tar.xz",
+      "sha256": "b2f62db7941f819375a9f8627bd55442c30310e93cb270621fdf9e5c707801e3"
     },
     "x86_64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.2/floorp-linux-x86_64.tar.xz",
-      "sha256": "8014ec6416b70a6a762c9109aa70a28fc305c08711493691fb8b00a2f53bc910"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-linux-x86_64.tar.xz",
+      "sha256": "fb866cd00da594c5c6435238e32ac2c13eaca40ead4936656aee88ea3446983f"
     },
     "aarch64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.2/floorp-macOS-universal.dmg",
-      "sha256": "d225e9f6f1d81c6049905699ff08a64fb67496a16c31a2634af4c4f2e96f7a6d"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-macOS-universal.dmg",
+      "sha256": "56477ebaae97aee37c0a93294f8770ae901bf2e35d2be03540daf0a779db6dae"
     },
     "x86_64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.2/floorp-macOS-universal.dmg",
-      "sha256": "d225e9f6f1d81c6049905699ff08a64fb67496a16c31a2634af4c4f2e96f7a6d"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-macOS-universal.dmg",
+      "sha256": "56477ebaae97aee37c0a93294f8770ae901bf2e35d2be03540daf0a779db6dae"
     }
   }
 }
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index 12eec85f538a..6d2578e3cf39 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -6,7 +6,6 @@
   php,
   brotli,
   watcher,
-  testers,
   frankenphp,
   cctools,
   darwin,
@@ -15,6 +14,7 @@
   makeBinaryWrapper,
   runCommand,
   writeText,
+  versionCheckHook,
 }:
 
 let
@@ -34,7 +34,7 @@ buildGoModule rec {
   version = "1.11.1";
 
   src = fetchFromGitHub {
-    owner = "dunglas";
+    owner = "php";
     repo = "frankenphp";
     tag = "v${version}";
     hash = "sha256-JzZXg/tkSZqLZn56RyLb8Q8SaeG/tHA8Sqxu99s5ks0=";
@@ -60,6 +60,7 @@ buildGoModule rec {
     pkg-config
     cctools
     darwin.autoSignDarwinBinariesHook
+    libiconv
   ];
 
   subPackages = [ "frankenphp" ];
@@ -87,11 +88,6 @@ buildGoModule rec {
     export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${version} \
       $(${phpConfig} --ldflags) \
       $(${phpConfig} --libs)"
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # replace hard-code homebrew path
-    substituteInPlace ../frankenphp.go \
-      --replace "-L/opt/homebrew/opt/libiconv/lib" "-L${libiconv}/lib"
   '';
 
   preFixup = ''
@@ -103,15 +99,14 @@ buildGoModule rec {
 
   doCheck = false;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
   passthru = {
     php = phpEmbedWithZts;
     tests = {
       # TODO: real NixOS test with Symfony application
-      version = testers.testVersion {
-        inherit version;
-        package = frankenphp;
-        command = "frankenphp version";
-      };
       phpinfo =
         runCommand "php-cli-phpinfo"
           {
@@ -126,12 +121,12 @@ buildGoModule rec {
   };
 
   meta = {
-    changelog = "https://github.com/dunglas/frankenphp/releases/tag/v${version}";
+    changelog = "https://github.com/php/frankenphp/releases/tag/v${version}";
     description = "Modern PHP app server";
-    homepage = "https://github.com/dunglas/frankenphp";
+    homepage = "https://github.com/php/frankenphp";
     license = lib.licenses.mit;
     mainProgram = "frankenphp";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.piotrkwiecinski ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/ft/ft2-clone/package.nix b/pkgs/by-name/ft/ft2-clone/package.nix
index 76a75f49da0a..ae5ba97bacce 100644
--- a/pkgs/by-name/ft/ft2-clone/package.nix
+++ b/pkgs/by-name/ft/ft2-clone/package.nix
@@ -29,6 +29,17 @@ stdenv.mkDerivation (finalAttrs: {
     libiconv
   ];
 
+  postInstall = ''
+    install -Dm444 "$src/release/other/Freedesktop.org Resources/Fasttracker II clone.desktop" \
+      $out/share/applications/ft2-clone.desktop
+    install -Dm444 "$src/release/other/Freedesktop.org Resources/Fasttracker II clone.png" \
+      $out/share/icons/hicolor/512x512/apps/ft2-clone.png
+    # gtk-update-icon-cache does not like whitespace. Note that removing this
+    # will not make the build fail, but it will make the NixOS test fail.
+    substituteInPlace $out/share/applications/ft2-clone.desktop \
+      --replace-fail "Icon=Fasttracker II clone" Icon=ft2-clone
+  '';
+
   passthru.tests = {
     ft2-clone-starts = nixosTests.ft2-clone;
   };
diff --git a/pkgs/by-name/gi/gif2apng/package.nix b/pkgs/by-name/gi/gif2apng/package.nix
index e0b0eb854ba2..8388dc9e3263 100644
--- a/pkgs/by-name/gi/gif2apng/package.nix
+++ b/pkgs/by-name/gi/gif2apng/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}c++" ];
 
-  NIX_CFLAGS_COMPILE = "-DENABLE_LOCAL_ZOPFLI";
+  env.NIX_CFLAGS_COMPILE = "-DENABLE_LOCAL_ZOPFLI";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 31cf5440fc04..3aab70fbac23 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitify";
-  version = "6.16.0";
+  version = "6.17.0";
 
   src = fetchFromGitHub {
     owner = "gitify-app";
     repo = "gitify";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yNgVcf7V1TPc6L5SaKhMulUlGJeBnqs/gZGeaz1AtW8=";
+    hash = "sha256-A9LeitceqDGictQbB7OYOI/pggrW9u8A7TUMblK/LHM=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-l61t3UKNAoBldquzXJPomrKDbiXXJMSdcsk43pQpcgc=";
+    hash = "sha256-uK3CNyPewUVAmqBJq1WMCrNeMP5I18BEBkZIBP0qPsI=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/gn/gnmic/package.nix b/pkgs/by-name/gn/gnmic/package.nix
index a11b22ddf86a..03c1b7ee00f0 100644
--- a/pkgs/by-name/gn/gnmic/package.nix
+++ b/pkgs/by-name/gn/gnmic/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.42.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = "gnmic";
     tag = "v${version}";
-    hash = "sha256-mcgre0HmAR2L92HBlK8jdqlOqINI/NswgZUrSI//c8k=";
+    hash = "sha256-+5f4SxAmpZrOmIr8MUR3ImmoPbzFQ0bh/4qnqkpfs1g=";
   };
 
-  vendorHash = "sha256-u4tLuD8CuS3BzWJHDpphtkjgB0zkzBpP3FWrRWNgyJM=";
+  vendorHash = "sha256-zsb+Tky2yVyEUSKjvnS8YkRFMUf/01VIX2Vl6mB5mpw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gopls/package.nix b/pkgs/by-name/go/gopls/package.nix
index 52a0b10e9ec8..2e7979f6822c 100644
--- a/pkgs/by-name/go/gopls/package.nix
+++ b/pkgs/by-name/go/gopls/package.nix
@@ -36,6 +36,7 @@ buildGoLatestModule (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckKeepEnvironment = [ "TMPDIR" ];
   versionCheckProgramArg = "version";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=gopls/(.*)" ]; };
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index b2b3f4a553a5..d380045183f0 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -55,7 +55,15 @@ buildGoModule (finalAttrs: rec {
   ]
   ++ lib.optionals useLLD [ lld ];
 
-  env = lib.optionalAttrs useLLD { NIX_CFLAGS_LINK = "-fuse-ld=lld"; };
+  env =
+    lib.optionalAttrs useLLD {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    }
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
+      # uses go-systemd, which uses libsystemd headers
+      # https://github.com/coreos/go-systemd/issues/351
+      NIX_CFLAGS_COMPILE = "-I${lib.getDev systemd}/include";
+    };
 
   ldflags =
     let
@@ -87,15 +95,11 @@ buildGoModule (finalAttrs: rec {
     "."
   ];
 
-  # uses go-systemd, which uses libsystemd headers
-  # https://github.com/coreos/go-systemd/issues/351
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.hostPlatform.isLinux [
-    "-I${lib.getDev systemd}/include"
-  ];
-
   checkFlags = [
-    "-tags nonetwork" # disable network tests
-    "-tags nodocker" # disable docker tests
+    "-tags"
+    "nonetwork" # disable network tests
+    "-tags"
+    "nodocker" # disable docker tests
   ];
 
   # go-systemd uses libsystemd under the hood, which does dlopen(libsystemd) at
diff --git a/pkgs/by-name/gr/grasp-backend/package.nix b/pkgs/by-name/gr/grasp-backend/package.nix
new file mode 100644
index 000000000000..a77bf53a999d
--- /dev/null
+++ b/pkgs/by-name/gr/grasp-backend/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "grasp-backend";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "karlicoss";
+    repo = "grasp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4eHY58ulvLGkKHfEishRlWPI52juxWP2zzUDwRmTM/k=";
+  };
+
+  build-system = with python3Packages; [
+    hatch-vcs
+    hatchling
+  ];
+
+  pythonImportsCheck = [ "grasp_backend" ];
+
+  # Tests do not seem possible to run with pytest:
+  # RuntimeError: ("Couldn't determine path for ", PosixPath('/build/source/tests/webdriver_utils.py'))
+  doCheck = false;
+
+  meta = {
+    description = "Backend for grasp browser extension";
+    mainProgram = "grasp_backend";
+    maintainers = with lib.maintainers; [ hiro98 ];
+    homepage = "https://github.com/karlicoss/grasp/";
+    changelog = "https://github.com/karlicoss/grasp/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/by-name/gr/gravit/package.nix b/pkgs/by-name/gr/gravit/package.nix
index b763b0e74dc5..ea3216dba79a 100644
--- a/pkgs/by-name/gr/gravit/package.nix
+++ b/pkgs/by-name/gr/gravit/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-DSDL_INCLUDE_GLU_H"
   ];
 
diff --git a/pkgs/by-name/gu/guacamole-server/package.nix b/pkgs/by-name/gu/guacamole-server/package.nix
index c9c7fefe3ae0..c79a68bdc5f7 100644
--- a/pkgs/by-name/gu/guacamole-server/package.nix
+++ b/pkgs/by-name/gu/guacamole-server/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-OjTwAQzKUuXfwZXLsL9XjrJc/0be38CmAGG+CoCeNwk=";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=format-truncation"
     "-Wno-error=format-overflow"
     "-Wno-error=deprecated-declarations"
diff --git a/pkgs/by-name/ha/hal-hardware-analyzer/package.nix b/pkgs/by-name/ha/hal-hardware-analyzer/package.nix
index c61f8c3d8500..89bdf10118a6 100644
--- a/pkgs/by-name/ha/hal-hardware-analyzer/package.nix
+++ b/pkgs/by-name/ha/hal-hardware-analyzer/package.nix
@@ -87,7 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeBuildType = "MinSizeRel";
 
   # https://github.com/emsec/hal/issues/598
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.hostPlatform.isAarch64 "-flax-vector-conversions";
+  env = lib.optionalAttrs stdenv.hostPlatform.isAarch64 {
+    NIX_CFLAGS_COMPILE = "-flax-vector-conversions";
+  };
 
   # some plugins depend on other plugins and need to be able to load them
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/ha/hatch/package.nix b/pkgs/by-name/ha/hatch/package.nix
index 7bc8326f3a6c..f3a3d3948f51 100644
--- a/pkgs/by-name/ha/hatch/package.nix
+++ b/pkgs/by-name/ha/hatch/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.16.1";
+  version = "1.16.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "hatch";
     tag = "hatch-v${version}";
-    hash = "sha256-HreVb+RZzQV3p9TaoHDZLHBQFifyH+hocP01u5yU+ms=";
+    hash = "sha256-A91tpoNBTerB2e09dmvgwealId8mnjxcyiVyCkMxQlY=";
   };
 
   patches = [ (replaceVars ./paths.patch { uv = lib.getExe python3Packages.uv; }) ];
diff --git a/pkgs/by-name/he/heroku/package.nix b/pkgs/by-name/he/heroku/package.nix
index d9e80ea96bcd..2885810fe8fc 100644
--- a/pkgs/by-name/he/heroku/package.nix
+++ b/pkgs/by-name/he/heroku/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation {
   pname = "heroku";
-  version = "10.13.2";
+  version = "10.16.0";
 
   src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/10.13.2/82c0564/heroku-v10.13.2-82c0564-linux-x64.tar.xz";
-    hash = "sha256-JfaOnVaN60MG4dDJ8IdmRucfCIb9EtWdJy+90fG6zuw=";
+    url = "https://cli-assets.heroku.com/versions/10.16.0/3f0b8a2/heroku-v10.16.0-3f0b8a2-linux-x64.tar.xz";
+    hash = "sha256-WvabMaOvkaizRxA0d4Lk6pi693tpVd9VH7x77xuMzKU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/hu/hugs/package.nix b/pkgs/by-name/hu/hugs/package.nix
index af99f2617fc6..790d486a90a8 100644
--- a/pkgs/by-name/hu/hugs/package.nix
+++ b/pkgs/by-name/hu/hugs/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ bison ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=implicit-int"
     "-Wno-error=implicit-function-declaration"
   ];
diff --git a/pkgs/by-name/hy/hyperrogue/package.nix b/pkgs/by-name/hy/hyperrogue/package.nix
index d213abef5867..e6b287554de2 100644
--- a/pkgs/by-name/hy/hyperrogue/package.nix
+++ b/pkgs/by-name/hy/hyperrogue/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyperrogue";
-  version = "13.1f";
+  version = "13.1i";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-HJer4CUtpJDI0aRbays9vhNTnmOYHl3eODDaLdxwjyE=";
+    sha256 = "sha256-JFSPbcbPuTKq9TNMCwpjDOEaI3SdAfcnSIi/uZkYT7w=";
   };
 
   env = {
diff --git a/pkgs/by-name/ib/ibmcloud-cli/package.nix b/pkgs/by-name/ib/ibmcloud-cli/package.nix
index 1fea5163733b..8042e9afd4a0 100644
--- a/pkgs/by-name/ib/ibmcloud-cli/package.nix
+++ b/pkgs/by-name/ib/ibmcloud-cli/package.nix
@@ -31,19 +31,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ibmcloud-cli";
-  version = "2.37.1";
+  version = "2.40.0";
 
   src = fetchurl {
     url = "https://download.clis.cloud.ibm.com/ibm-cloud-cli/${finalAttrs.version}/binaries/IBM_Cloud_CLI_${finalAttrs.version}_${platform}.tgz";
     hash =
       {
-        "x86_64-darwin" = "sha256-NqohbUj+FcReQr3ouq7QNdZOREk0nyCTug2bC4G2kOw=";
-        "aarch64-darwin" = "sha256-SYGela1vfxohcqPzk2DtqBNGaubHFoIgK14L/jwX0gc=";
-        "x86_64-linux" = "sha256-8W3QMLNcDDgb0V8j2HH0iNO+XqVHUsFw7Mmw7WCHsVY=";
-        "aarch64-linux" = "sha256-VtXLIPqDDovptQ83fjxQ4Ggk6WjTN18Z4hWwPuaY/dU=";
-        "i686-linux" = "sha256-qqlumSDuhD9G7dpVx9BCrA1wK96tqGvxDAvgtb4fW1o=";
-        "powerpc64le-linux" = "sha256-oyX2j55ywJdR4lOGSjfI/OcISGJXO7g2t1LI5/89y9w=";
-        "s390x-linux" = "sha256-XC8bMrDlR3dFFpMx/zjjMZz3d37jr9sNRWJEe56IqjE=";
+        "x86_64-darwin" = "sha256-/sekaJxa8+inOBsHucyPE3yWM+Z+64jArGwCht8Corc=";
+        "aarch64-darwin" = "sha256-JrTFbufKjX9uUwUcfxCDjqbZx6drgSmqn0F/xtce/mE=";
+        "x86_64-linux" = "sha256-Zu6XFQeD9Dlny6cex7X6P428MiQftwn9RR4QL3H/0AU=";
+        "aarch64-linux" = "sha256-pfHhAszhbbLKkJnwP94dCaDZNFTLr+2tnO3aHxOch+U=";
+        "i686-linux" = "sha256-v8azVYFa6bBAPJZoOnLr3W+spQZlPFmR92wNTvtRS34=";
+        "powerpc64le-linux" = "sha256-L3cBkNV0iMNhk6b/v1i3JcQJ1SxbffOrs5xqMEOTMY8=";
+        "s390x-linux" = "sha256-UIBu8konMu8Y2U4mix8H9T6Y/2plVVnoiJJgKhGgGs4=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/in/intel-gpu-tools/package.nix b/pkgs/by-name/in/intel-gpu-tools/package.nix
index 508a673cced8..276c675a0cc1 100644
--- a/pkgs/by-name/in/intel-gpu-tools/package.nix
+++ b/pkgs/by-name/in/intel-gpu-tools/package.nix
@@ -43,14 +43,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-gpu-tools";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "drm";
     repo = "igt-gpu-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Lt/mqx13nHyD5QiDl8oWGiYIiK006uQvbbzHH44LB/0=";
+    hash = "sha256-CkVBImPPM93Q2SVpKzRAREd7cK+SmUgySiuq3LfO2O8=";
   };
 
   nativeBuildInputs = [
@@ -107,6 +107,9 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "i686-linux"
     ];
-    maintainers = with lib.maintainers; [ pSub ];
+    maintainers = with lib.maintainers; [
+      pSub
+      ilkecan
+    ];
   };
 })
diff --git a/pkgs/by-name/ip/ipscan/package.nix b/pkgs/by-name/ip/ipscan/package.nix
index 8497ae57c9cf..61704697e931 100644
--- a/pkgs/by-name/ip/ipscan/package.nix
+++ b/pkgs/by-name/ip/ipscan/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipscan";
-  version = "3.9.2";
+  version = "3.9.3";
 
   src = fetchurl {
     url = "https://github.com/angryip/ipscan/releases/download/${finalAttrs.version}/ipscan_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-5H6QCT7Z3EOJks/jLBluTCgJbqpRMW5iheds9nl4ktU=";
+    hash = "sha256-RLdlcrtpWcO4z7cKSN+y9UJzMBtnli2mAvuJSXCMoJU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ja/jailer/package.nix b/pkgs/by-name/ja/jailer/package.nix
index 573a8701e610..090591f33797 100644
--- a/pkgs/by-name/ja/jailer/package.nix
+++ b/pkgs/by-name/ja/jailer/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jailer";
-  version = "16.9.3";
+  version = "16.11";
 
   src = fetchFromGitHub {
     owner = "Wisser";
     repo = "Jailer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4uXJZZ528Bc4vL8NUQDjoWGPBu/Bd9jhOMxC3e+s9hc=";
+    hash = "sha256-bSwLxO7UtKv82WoF/OcFROtbLfkdeupLtoR2/ELzO1U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/jb/jbang/package.nix b/pkgs/by-name/jb/jbang/package.nix
index 84e8fdee14fa..2826f63533a8 100644
--- a/pkgs/by-name/jb/jbang/package.nix
+++ b/pkgs/by-name/jb/jbang/package.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.132.1";
+  version = "0.135.1";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-+JqToH2DHfExu0HtGK1M/YobgjTApWxyp9Hp6VjdRvI=";
+    sha256 = "sha256-7MUiUi7Q4tTCN8RUkO0FM9ZwIqAnTD6yJqUr3199FKQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index ca2e117371cb..c34485efbfa0 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -45,10 +45,12 @@ buildNpmPackage rec {
 
   makeCacheWritable = true;
 
-  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
-
-  # disable code signing on Darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+    # disable code signing on Darwin
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  };
 
   preBuild = ''
     # remove some prebuilt binaries
@@ -74,8 +76,6 @@ buildNpmPackage rec {
         -c.electronVersion=${electron.version}
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/ju/junicode/package.nix b/pkgs/by-name/ju/junicode/package.nix
index 000c3bbf2658..fbf232c6c2f7 100644
--- a/pkgs/by-name/ju/junicode/package.nix
+++ b/pkgs/by-name/ju/junicode/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "junicode";
-  version = "2.220";
+  version = "2.222";
 
   src = fetchzip {
     url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-NZdNWnWMWscAI0p878mQ8rOoo5TlEDrKYzfiqGeo4lc=";
+    hash = "sha256-fAhK6IAw1UL0Q2CusNmN+LedySZnBrfUAHMQJoHTRl4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ka/kahip/package.nix b/pkgs/by-name/ka/kahip/package.nix
index 17f12f7725aa..41b140ed8bf1 100644
--- a/pkgs/by-name/ka/kahip/package.nix
+++ b/pkgs/by-name/ka/kahip/package.nix
@@ -2,51 +2,56 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   mpi,
   metis,
+  llvmPackages,
   python3Packages,
   pythonSupport ? false,
   isILP64 ? false,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kahip";
-  version = "3.18";
+  version = "3.21";
 
   src = fetchFromGitHub {
     owner = "KaHIP";
     repo = "KaHIP";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l8DhVb2G6pQQcH3Wq4NsKw30cSK3sG+gCYRdpibw4ZI=";
+    hash = "sha256-FVbJJpz3ecfME0KZN/5AHuqCkPl/UpR+kHHMyxFzErY=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/KaHIP/KaHIP/commit/9d4978c7540a1ccbc9807367d6e3852114e86567.patch?full_index=1";
-      hash = "sha256-nIJL0YmVp9+JUhzEXjoabD1qNEnhtrBnjMWnitYt0eU=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
   ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.python
-    python3Packages.pybind11
-  ];
+  ++ lib.optional pythonSupport python3Packages.python;
 
   buildInputs = [
     mpi
     metis
-  ];
+  ]
+  ++ lib.optional pythonSupport python3Packages.pybind11
+  ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  # create meta package providing dist-info for python3Pacakges.kahip that common cmake build does not do
+  propagatedBuildInputs = lib.optional pythonSupport (
+    python3Packages.mkPythonMetaPackage {
+      inherit (finalAttrs) pname version meta;
+    }
+  );
 
   cmakeFlags = [
     (lib.cmakeBool "64BITMODE" isILP64)
+    (lib.cmakeBool "NONATIVEOPTIMIZATIONS" true)
     (lib.cmakeBool "BUILDPYTHONMODULE" pythonSupport)
     (lib.cmakeFeature "CMAKE_INSTALL_PYTHONDIR" python3Packages.python.sitePackages)
   ];
 
+  postInstall = lib.optionalString pythonSupport ''
+    cp ../python/kahip/* $out/${python3Packages.python.sitePackages}/kahip
+    echo "__version__= '${finalAttrs.version}'" > $out/${python3Packages.python.sitePackages}/kahip/_version.py
+  '';
+
   doInstallCheck = pythonSupport;
 
   nativeInstallCheckInputs = lib.optionals pythonSupport [
diff --git a/pkgs/by-name/ka/kaminpar/package.nix b/pkgs/by-name/ka/kaminpar/package.nix
index 41e402054f1e..1a7cfeef3a90 100644
--- a/pkgs/by-name/ka/kaminpar/package.nix
+++ b/pkgs/by-name/ka/kaminpar/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaminpar";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "KaHIP";
     repo = "KaMinPar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g343iIpKRclQ+hKdWEVbA7JVuHGBLSq40rK9YUBIy+o=";
+    hash = "sha256-yuceZE3o5dvK7Q8y8nbq7DLMx51GLk2lRh2hMTLdbRc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ku/kuttl/package.nix b/pkgs/by-name/ku/kuttl/package.nix
index c5ce5f1aae7c..d9b125fea802 100644
--- a/pkgs/by-name/ku/kuttl/package.nix
+++ b/pkgs/by-name/ku/kuttl/package.nix
@@ -6,24 +6,24 @@
 
 buildGoModule rec {
   pname = "kuttl";
-  version = "0.22.0";
+  version = "0.24.0";
   cli = "kubectl-kuttl";
 
   src = fetchFromGitHub {
     owner = "kudobuilder";
     repo = "kuttl";
     rev = "v${version}";
-    sha256 = "sha256-M9sZNrze7v1dj0j+hOo30kB87YKxFF/hZJ7R2C/Pzwg=";
+    sha256 = "sha256-Hkq1VukyImRLSQrOtH7IJyt2S8Zl+SNiWJfX4HpiOI4=";
   };
 
-  vendorHash = "sha256-WhgmseJVfhvVHARI2XaMkRE/sIfpeJj0JzYiAgza6jQ=";
+  vendorHash = "sha256-et/52c++8pgVgguCbPidVg0zFm9p7SVYI97N8sQ2KYQ=";
 
   subPackages = [ "cmd/kubectl-kuttl" ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/kudobuilder/kuttl/pkg/version.gitVersion=${version}"
+    "-X github.com/kudobuilder/kuttl/internal/version.gitVersion=${version}"
   ];
 
   meta = {
diff --git a/pkgs/by-name/la/languagetool-rust/package.nix b/pkgs/by-name/la/languagetool-rust/package.nix
index 55764d9e6739..fe61993f910e 100644
--- a/pkgs/by-name/la/languagetool-rust/package.nix
+++ b/pkgs/by-name/la/languagetool-rust/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "languagetool-rust";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "jeertmans";
     repo = "languagetool-rust";
     rev = "v${version}";
-    hash = "sha256-LHlM+PJbBqsgOwK9Mw8oVVP+dq4IBFhxjRaXLIGxZPg=";
+    hash = "sha256-zH93Pi/zVnCLo8O/1HnSTfUOu9vtzF3JSzn+1/1/Oz0=";
   };
 
-  cargoHash = "sha256-VfvdIjNIHpvN370/3y2XXxaIyEL9+tG0OcnONhs9Z2I=";
+  cargoHash = "sha256-e75srZlKx/WfxbguyIu7MWZm33WuOfDubGqfvviN1HA=";
 
   buildFeatures = [ "full" ];
 
diff --git a/pkgs/by-name/la/lazyjournal/package.nix b/pkgs/by-name/la/lazyjournal/package.nix
index 93389946a374..7a5b014e8ed7 100644
--- a/pkgs/by-name/la/lazyjournal/package.nix
+++ b/pkgs/by-name/la/lazyjournal/package.nix
@@ -5,7 +5,7 @@
   nix-update-script,
 }:
 let
-  version = "0.8.1";
+  version = "0.8.4";
 in
 buildGoModule {
   pname = "lazyjournal";
@@ -15,7 +15,7 @@ buildGoModule {
     owner = "Lifailon";
     repo = "lazyjournal";
     tag = version;
-    hash = "sha256-QHVwEesJZiySwEPeDZaU56uY+PJEJXCybvAezhwa59g=";
+    hash = "sha256-7/eQZUht8xs8JoivLR3UNxRQ4Gajyp4vhxF4wM0GpPg=";
   };
 
   vendorHash = "sha256-Wl8DmEBt1YtTk9QEvWybSWRQm0Lnfd5q3C/wg+gP33g=";
diff --git a/pkgs/by-name/ld/ldb/package.nix b/pkgs/by-name/ld/ldb/package.nix
index 529e0c8e0e97..04d9e7d645bd 100644
--- a/pkgs/by-name/ld/ldb/package.nix
+++ b/pkgs/by-name/ld/ldb/package.nix
@@ -74,15 +74,18 @@ stdenv.mkDerivation (finalAttrs: {
     "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
 
-  # python-config from build Python gives incorrect values when cross-compiling.
-  # If python-config is not found, the build falls back to using the sysconfig
-  # module, which works correctly in all cases.
-  PYTHON_CONFIG = "/invalid";
-
-  # https://reviews.llvm.org/D135402
-  NIX_LDFLAGS = lib.optional (
-    stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
-  ) "--undefined-version";
+  env = {
+    # python-config from build Python gives incorrect values when cross-compiling.
+    # If python-config is not found, the build falls back to using the sysconfig
+    # module, which works correctly in all cases.
+    PYTHON_CONFIG = "/invalid";
+  }
+  //
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://reviews.llvm.org/D135402
+        NIX_LDFLAGS = "--undefined-version";
+      };
 
   stripDebugList = [
     "bin"
diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index 26b1d665be6e..268364b71480 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.137.0";
+  version = "2.139.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-G9wuefSt4OEFIM8rHLSyBY8t+jxgKPt4T+KQF6Jh3Tk=";
+    hash = "sha256-sTqa/UOKkZodwSPnxkjxjz15xrr1VSCuAiO3bmzsbQU=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch b/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch
new file mode 100644
index 000000000000..bbccb5392c24
--- /dev/null
+++ b/pkgs/by-name/le/leo-lang/0001-remove-update-subcommand.patch
@@ -0,0 +1,59 @@
+diff --git i/errors/src/errors/cli/cli_errors.rs w/errors/src/errors/cli/cli_errors.rs
+index 9e3995743b..89617d451d 100644
+--- i/errors/src/errors/cli/cli_errors.rs
++++ w/errors/src/errors/cli/cli_errors.rs
+@@ -328,6 +328,13 @@ create_messages!(
+         help: None,
+     }
+ 
++    @backtraced
++    nix_update_build_error {
++       args: (),
++       msg: format!("Self update is not supported on Nix."),
++       help: Some("Package must be updated via Nix".to_string()),
++    }
++
+     @backtraced
+     custom {
+         args: (msg: impl Display),
+diff --git i/leo/cli/commands/update.rs w/leo/cli/commands/update.rs
+index 156e3ccce3..83dad3139b 100644
+--- i/leo/cli/commands/update.rs
++++ w/leo/cli/commands/update.rs
+@@ -15,7 +15,6 @@
+ // along with the Leo library. If not, see <https://www.gnu.org/licenses/>.
+ 
+ use super::*;
+-use crate::cli::helpers::updater::Updater;
+ 
+ /// Update Leo to the latest version
+ #[derive(Debug, Parser)]
+@@ -47,27 +46,6 @@ impl Command for LeoUpdate {
+     where
+         Self: Sized,
+     {
+-        match self.list {
+-            true => match Updater::show_available_releases() {
+-                Ok(output) => tracing::info!("{output}"),
+-                Err(error) => tracing::info!("Failed to list the available versions of Leo\n{error}\n"),
+-            },
+-            false => {
+-                let result = Updater::update(!self.quiet, self.name);
+-                if !self.quiet {
+-                    match result {
+-                        Ok(status) => {
+-                            if status.uptodate() {
+-                                tracing::info!("\nLeo is already on the latest version")
+-                            } else if status.updated() {
+-                                tracing::info!("\nLeo has updated to version {}", status.version())
+-                            }
+-                        }
+-                        Err(e) => tracing::info!("\nFailed to update Leo to the latest version\n{e}\n"),
+-                    }
+-                }
+-            }
+-        }
+-        Ok(())
++        return Err(CliError::nix_update_build_error().into());
+     }
+ }
diff --git a/pkgs/by-name/le/leo-lang/package.nix b/pkgs/by-name/le/leo-lang/package.nix
new file mode 100644
index 000000000000..a6e900ac47b4
--- /dev/null
+++ b/pkgs/by-name/le/leo-lang/package.nix
@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
+  curl,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "leo-lang";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ProvableHQ";
+    repo = "leo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VDhD2devY2GPa2vGbZ0hSg1tIc6WJ5pgyDM6RsSb12U=";
+    fetchSubmodules = true;
+  };
+
+  patches = [ ./0001-remove-update-subcommand.patch ];
+
+  cargoHash = "sha256-PI2DviLVtlNFohRSOkGx7SQd2sh4jMKZKzw7RMKNw+o=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ curl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/leo";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  checkFlags = [
+    "--skip=cli::cli::tests::nested_local_dependency_run_test"
+    "--skip=cli::cli::tests::relaxed_shadowing_run_test"
+    "--skip=cli::cli::tests::relaxed_struct_shadowing_run_test"
+  ];
+
+  meta = {
+    description = "Functional, statically-typed programming language built for writing private applications";
+    homepage = "https://github.com/ProvableHQ/leo";
+    changelog = "https://github.com/ProvableHQ/leo/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ anstylian ];
+    mainProgram = "leo";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libHX/package.nix b/pkgs/by-name/li/libHX/package.nix
index ef813680172c..f4da20d36771 100644
--- a/pkgs/by-name/li/libHX/package.nix
+++ b/pkgs/by-name/li/libHX/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libHX";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchFromCodeberg {
     tag = "v${finalAttrs.version}";
     owner = "jengelh";
     repo = "libhx";
-    hash = "sha256-z1/D5dkcDc2VIoGCvunUYsLGq3AV6jZ01Edf1vuUx9o=";
+    hash = "sha256-q9cIZhQx1BjD7Py0VEevKwFflJ1cdFn9RcW6q52t/h8=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index 87c0887f3845..98fe0d0af9da 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libfyaml";
-  version = "0.9";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "pantoniou";
     repo = "libfyaml";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Id5pdFzjA9q67okfESO3LZH8jIz93mVgIEEuBbPjuGI=";
+    hash = "sha256-bq8ikZMI92Cn0TMGmQwyZpKt+8D4E8FrbrwAD7dK6Ws=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libgig/package.nix b/pkgs/by-name/li/libgig/package.nix
index b52ae3934cf8..af935114ac84 100644
--- a/pkgs/by-name/li/libgig/package.nix
+++ b/pkgs/by-name/li/libgig/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgig";
-  version = "4.5.0";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://download.linuxsampler.org/packages/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-CHnSi5tjktpZhYJtvdjZyVeyoDKi8QGQUGrvLiLzxUo=";
+    sha256 = "sha256-yivozl4JafkMLfduA9SZ9eJ/tQIe28WH3hgv8n6O/d0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libisds/package.nix b/pkgs/by-name/li/libisds/package.nix
index 07be0efe9917..7eb02cfdb981 100644
--- a/pkgs/by-name/li/libisds/package.nix
+++ b/pkgs/by-name/li/libisds/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     docbook_xsl
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=deprecated-declarations" ];
 
   meta = {
     description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
diff --git a/pkgs/by-name/li/libkrunfw/package.nix b/pkgs/by-name/li/libkrunfw/package.nix
index a9b55cec19d4..ae029136b150 100644
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -65,7 +65,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Fixes https://github.com/containers/libkrunfw/issues/55
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.targetPlatform.isAarch64 "-march=armv8-a+crypto";
+  env = lib.optionalAttrs stdenv.targetPlatform.isAarch64 {
+    NIX_CFLAGS_COMPILE = "-march=armv8-a+crypto";
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/li/libnop/package.nix b/pkgs/by-name/li/libnop/package.nix
index fab806cb10d8..c626e0833fc8 100644
--- a/pkgs/by-name/li/libnop/package.nix
+++ b/pkgs/by-name/li/libnop/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ gtest ];
 
   # Add optimization flags to address _FORTIFY_SOURCE warning
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-O1"
     "-std=c++17"
   ];
diff --git a/pkgs/by-name/li/libwtk-sdl2/package.nix b/pkgs/by-name/li/libwtk-sdl2/package.nix
index ecf04c300478..41bb6d85ca6a 100644
--- a/pkgs/by-name/li/libwtk-sdl2/package.nix
+++ b/pkgs/by-name/li/libwtk-sdl2/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2_image
   ];
   # From some reason, this is needed as otherwise SDL.h is not found
-  NIX_CFLAGS_COMPILE = "-I${lib.getInclude SDL2}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getInclude SDL2}/include/SDL2";
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/li/libx86emu/package.nix b/pkgs/by-name/li/libx86emu/package.nix
index 2578e1f01a59..f3a87fe9e53b 100644
--- a/pkgs/by-name/li/libx86emu/package.nix
+++ b/pkgs/by-name/li/libx86emu/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/li/linyaps/package.nix b/pkgs/by-name/li/linyaps/package.nix
index b21f0f3a125c..2ef353ecb731 100644
--- a/pkgs/by-name/li/linyaps/package.nix
+++ b/pkgs/by-name/li/linyaps/package.nix
@@ -24,6 +24,7 @@
   uncrustify,
   xz,
   yaml-cpp,
+  versionCheckHook,
   bash,
   binutils,
   coreutils,
@@ -38,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linyaps";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "OpenAtom-Linyaps";
     repo = finalAttrs.pname;
     tag = finalAttrs.version;
-    hash = "sha256-iGdZc+i1l/+raI7Pjpj3LOtxvSJ37fUth3VsKaV54u0=";
+    hash = "sha256-FpmsrH4Xphf4QKtAJEaoVdE9S7hWlCayDbEnYZ9o4iI=";
   };
 
   patches = [
@@ -99,6 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CPM_LOCAL_PACKAGES_ONLY" true)
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   postInstall = ''
     # move to the right location for systemd.packages option
     # https://github.com/NixOS/nixpkgs/blob/85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054/nixos/modules/system/boot/systemd.nix#L605
diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix
index 7d1cef370770..13d0d60d328f 100644
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "CMAKE_OSX_ARCHITECTURES" stdenv.hostPlatform.darwinArch)
diff --git a/pkgs/by-name/lu/lurk/package.nix b/pkgs/by-name/lu/lurk/package.nix
index ad43e981d6b0..079087d9bf4a 100644
--- a/pkgs/by-name/lu/lurk/package.nix
+++ b/pkgs/by-name/lu/lurk/package.nix
@@ -2,31 +2,22 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lurk";
-  version = "0.3.11";
+  version = "0.3.12";
 
   src = fetchFromGitHub {
     owner = "jakwai01";
     repo = "lurk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Sng+mMMKDuI1aSgusJDRFMT5iKNUlp9arp9ruRn0bb0=";
+    hash = "sha256-gVxul9LeNbsP2eP0j5T6AL7pQh8Ls2lht3ki5JQ9kZM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-aarch64-build.patch";
-      url = "https://github.com/JakWai01/lurk/commit/132e6557ddeafbdb1bb1d4d1411099f0d7df7a51.patch?full_index=1";
-      hash = "sha256-B5rNLipnFFWxIhTm+eCacJkw38D7stQ27WIHzgj7Vy0=";
-    })
-  ];
-
-  cargoHash = "sha256-Cmlhhda35FmNg/OvfMRPHBLPRXF5bs0ebBYT7KfierA=";
+  cargoHash = "sha256-NNwcc4rUol9M59XzoQBNw/MfHw3LP6pUtNjw6OY6bMc=";
 
   postPatch = ''
     substituteInPlace src/lib.rs \
diff --git a/pkgs/by-name/ma/magpie/package.nix b/pkgs/by-name/ma/magpie/package.nix
deleted file mode 100644
index a63fd4dfff81..000000000000
--- a/pkgs/by-name/ma/magpie/package.nix
+++ /dev/null
@@ -1,188 +0,0 @@
-{
-  fetchFromGitHub,
-  runCommand,
-  lib,
-  fetchpatch,
-  stdenv,
-  pkg-config,
-  gnome-settings-daemon,
-  gettext,
-  gobject-introspection,
-  cairo,
-  colord,
-  lcms2,
-  pango,
-  json-glib,
-  libstartup_notification,
-  libcanberra,
-  ninja,
-  xvfb-run,
-  xkeyboard_config,
-  libxcvt,
-  libxkbfile,
-  libXdamage,
-  libxkbcommon,
-  libXtst,
-  libinput,
-  libdrm,
-  libgbm,
-  gsettings-desktop-schemas,
-  glib,
-  gtk3,
-  gnome-desktop,
-  pipewire,
-  libgudev,
-  libwacom,
-  mesa-gl-headers,
-  meson,
-  nix-update-script,
-  validatePkgConfig,
-  xorgserver,
-  python3,
-  wrapGAppsHook3,
-  gi-docgen,
-  sysprof,
-  testers,
-  libsysprof-capture,
-  desktop-file-utils,
-  libcap_ng,
-  graphene,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "magpie";
-  version = "0.9.4";
-
-  outputs = [
-    "out"
-    "dev"
-    "devdoc"
-  ];
-
-  src = fetchFromGitHub {
-    owner = "BuddiesOfBudgie";
-    repo = "magpie";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-a8e0uzbS0HEH/0sOOnwIiQI0/BizKbpdlVdfb3IbmcU=";
-  };
-
-  patches = [
-    # Fix build with separate sysprof.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2572
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/285a5a4d54ca83b136b787ce5ebf1d774f9499d5.patch";
-      hash = "sha256-/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
-    })
-  ];
-
-  mesonFlags = [
-    "-Degl_device=true"
-    "-Dprofiler=true"
-    "-Ddocs=true"
-  ];
-
-  propagatedBuildInputs = [
-    # required for pkg-config to detect magpie-clutter
-    json-glib
-    libXtst
-    libcap_ng
-    graphene
-    mesa-gl-headers
-  ];
-
-  nativeBuildInputs = [
-    desktop-file-utils
-    gettext
-    libxcvt
-    meson
-    ninja
-    xvfb-run
-    pkg-config
-    python3
-    validatePkgConfig
-    wrapGAppsHook3
-    gi-docgen
-    xorgserver
-  ];
-
-  buildInputs = [
-    cairo
-    glib
-    gnome-desktop
-    gnome-settings-daemon
-    gobject-introspection
-    gsettings-desktop-schemas
-    gtk3
-    libcanberra
-    libdrm
-    libgbm
-    libgudev
-    libinput
-    libstartup_notification
-    libwacom
-    libxkbcommon
-    libxkbfile
-    libXdamage
-    colord
-    lcms2
-    pango
-    pipewire
-    sysprof # for D-Bus interfaces
-    libsysprof-capture
-    xkeyboard_config
-  ];
-
-  postPatch = ''
-    patchShebangs src/backends/native/gen-default-modes.py
-    # Magpie does not install any .desktop files
-    substituteInPlace scripts/mesonPostInstall.sh --replace "update-desktop-database" "# update-desktop-database"
-
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3187
-    substituteInPlace meson.build \
-      --replace "dependency('sysprof-4')" "dependency('sysprof-6')"
-  '';
-
-  postFixup = ''
-    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-    # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/magpie-0/doc" "$devdoc"
-  '';
-
-  # Install udev files into our own tree.
-  env.PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
-
-  separateDebugInfo = true;
-
-  passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/magpie-0";
-
-    tests = {
-      libdirExists = runCommand "magpie-libdir-exists" { } ''
-        if [[ ! -d ${finalAttrs.finalPackage.libdir} ]]; then
-          echo "passthru.libdir should contain a directory, “${finalAttrs.finalPackage.libdir}” is not one."
-          exit 1
-        fi
-        touch $out
-      '';
-
-      pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
-    };
-
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Softish fork of Mutter 43.x";
-    homepage = "https://github.com/BuddiesOfBudgie/magpie";
-    changelog = "https://github.com/BuddiesOfBudgie/magpie/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl2Plus;
-    teams = [ lib.teams.budgie ];
-    platforms = lib.platforms.linux;
-    pkgConfigModules = [
-      "libmagpie-0"
-      "magpie-clutter-0"
-      "magpie-cogl-0"
-      "magpie-cogl-pango-0"
-    ];
-  };
-})
diff --git a/pkgs/by-name/ma/mailsend/package.nix b/pkgs/by-name/ma/mailsend/package.nix
index 11972b36023e..6d847cd07759 100644
--- a/pkgs/by-name/ma/mailsend/package.nix
+++ b/pkgs/by-name/ma/mailsend/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index cacd8bdc86a1..b850532bf8d5 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,21 +18,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DfgGh8KAXnGrq2W7V/QWnBF7b3Z26mIWeFQ2tEIPqa4=";
+    hash = "sha256-Cw7EPjN9PLmMxRTHV2DeUWM/BVNrDIQfy//Cn++C98o=";
   };
 
-  cargoHash = "sha256-r1fG+9mUYKbcAPc7CUUYvFf/Lhjnt6/MDCdCn/uiJU8=";
+  cargoHash = "sha256-aQ6zGaHVEGgrNMhbx2tnb4yQ4B31Nr2gf4BKyJsnP0U=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-UbaUx2wZi/bUVbdphCTcFBCaFQ8tkuvdYkSduCBRzzU=";
+    hash = "sha256-CXS5o1qYXPS5armoT9jLq4vv5ni3hht3ZCMXtNAGBQY=";
   };
 
   npmRoot = "frontend";
diff --git a/pkgs/by-name/mb/mbuffer/package.nix b/pkgs/by-name/mb/mbuffer/package.nix
index eeffaae5fb52..e50da5de9adb 100644
--- a/pkgs/by-name/mb/mbuffer/package.nix
+++ b/pkgs/by-name/mb/mbuffer/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mbuffer";
-  version = "20250809";
+  version = "20251025";
   outputs = [
     "out"
     "man"
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "http://www.maier-komor.de/software/mbuffer/mbuffer-${finalAttrs.version}.tgz";
-    sha256 = "sha256-mGXa5CRSQ3oZrkSEZ4EKA6pG1PJeKZlettbU85xnzR4=";
+    sha256 = "sha256-R+UWtBFgOZlnN8T4iV9m563iS37sXpN1SGY3psirNgE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mc/mcphost/package.nix b/pkgs/by-name/mc/mcphost/package.nix
index 44c15231ba31..5743b4cb0038 100644
--- a/pkgs/by-name/mc/mcphost/package.nix
+++ b/pkgs/by-name/mc/mcphost/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcphost";
-  version = "0.33.2";
+  version = "0.33.3";
 
   src = fetchFromGitHub {
     owner = "mark3labs";
     repo = "mcphost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AQ+qKbvi3TywDrvc2xnw3gTwEi/Qxb3EJdT+1TWjVpM=";
+    hash = "sha256-c+DGu2Re/R7IjMI7nKRJjNBWktDuoMENLRCzxSv23zw=";
   };
 
-  vendorHash = "sha256-oQEMrd1Lp9oMUCoQc674AyftMx7Tb+1rUoEGhu/ck7U=";
+  vendorHash = "sha256-K/Y6iZS7gcy1ut/idfgfcjb2YeSFNaukRADn4pjJeeA=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/me/melonDS/package.nix b/pkgs/by-name/me/melonDS/package.nix
index 344f0a82db11..edd77825b4b3 100644
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "1.0-unstable-2025-11-06";
+  version = "1.1-unstable-2026-01-20";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "220b238ec06692ee144bb1f50867a2edb8795de1";
-    hash = "sha256-Vnrg+6fSnzQKy+3ZU6LKSkkgc04H9KPsE/M2Iu9Wudw=";
+    rev = "73b38200fd0fa81b0bd4b3c1d2f9395a6ec5ac0b";
+    hash = "sha256-/JnAf+qknOaGl3RcRzCFIh4dFIcHxTwu8Woju+d0nUw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/mercure/package.nix b/pkgs/by-name/me/mercure/package.nix
index df031e5b6242..74c3b765e4d2 100644
--- a/pkgs/by-name/me/mercure/package.nix
+++ b/pkgs/by-name/me/mercure/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "mercure";
-  version = "0.21.6";
+  version = "0.21.7";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "mercure";
     rev = "v${version}";
-    hash = "sha256-hCEoEs6NiShssKER1Z8IVQPF+Ir7wbreGInWmcdnqzE=";
+    hash = "sha256-Dns8rzZJTnALhP8O9HDSjRfdesNYH3Qt/xrK4dMCGS4=";
   };
 
   sourceRoot = "${src.name}/caddy";
 
-  vendorHash = "sha256-GTHJtNO4JqTEDxVMe0yTgnjhfK2aGZpjMTfSFtL29IU=";
+  vendorHash = "sha256-UcCtK7qcwvc54wXr9DpfeMWzqrVz5zdEy4Mv2Qc+PNw=";
 
   subPackages = [ "mercure" ];
   excludedPackages = [ "../cmd/mercure" ];
diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index c3aa49b23ecd..9ea578c719c3 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
-  version = "0.56.10";
+  version = "0.58.2";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
-    hash = "sha256-otpNh9TJnUoHjAVVCkrsJO93nIeEfaNC8amZdTvreIE=";
+    hash = "sha256-stMlL0QSM4Py5xh2CsAV53v1FSc9u6NBQ+i5oLfewoQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/minizip-ng/package.nix b/pkgs/by-name/mi/minizip-ng/package.nix
index 862ef3c9c2e4..e58665f269d3 100644
--- a/pkgs/by-name/mi/minizip-ng/package.nix
+++ b/pkgs/by-name/mi/minizip-ng/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DMZ_LIBCOMP=OFF"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-register";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-register";
 
   postInstall = ''
     # make lib findable as libminizip-ng even if compat is enabled
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 1256a9cad649..899f1b7cc46d 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2026.1.8";
+  version = "2026.2.1";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-D2WTKMjxUCunp5GDA0TG1P9lilLoytk1KWJiI+ht3XM=";
+    hash = "sha256-7TsSK3mk6tSxvWPNYq8Viyc8x4BYmR/QrqRT/sfetz4=";
   };
 
-  cargoHash = "sha256-2Fv+kRWtDAgAvqehgdqWfznKY4UhUdEj2NRN9MD2vy4=";
+  cargoHash = "sha256-/gltCohAPGdCpcCvou7HBG0yioiOaGjnIF60FQzkB+s=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mm/mmh/package.nix b/pkgs/by-name/mm/mmh/package.nix
index 2dbcea7045ce..1618352e38ab 100644
--- a/pkgs/by-name/mm/mmh/package.nix
+++ b/pkgs/by-name/mm/mmh/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   # mhl.c:1031:58: error: pointer type mismatch in conditional expression []
   #  1031 |                 putstr((c1->c_flags & RTRIM) ? rtrim(cp) : cp);
-  NIX_CFLAGS_COMPILE = [ " -Wno-error=incompatible-pointer-types" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=incompatible-pointer-types" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/ms/msmtp/package.nix b/pkgs/by-name/ms/msmtp/package.nix
index f1ce73f1f959..fd0cd9a9e1f5 100644
--- a/pkgs/by-name/ms/msmtp/package.nix
+++ b/pkgs/by-name/ms/msmtp/package.nix
@@ -158,7 +158,7 @@ let
 in
 if withScripts then
   symlinkJoin {
-    name = "msmtp-${version}";
+    pname = "msmtp";
     inherit version meta;
     paths = [
       binaries
diff --git a/pkgs/by-name/ms/mstpd/package.nix b/pkgs/by-name/ms/mstpd/package.nix
index 8ac547aa902a..6851c95f2646 100644
--- a/pkgs/by-name/ms/mstpd/package.nix
+++ b/pkgs/by-name/ms/mstpd/package.nix
@@ -8,32 +8,39 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mstpd";
-  version = "0.0.8";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "mstpd";
     repo = "mstpd";
     rev = finalAttrs.version;
-    sha256 = "1xkfydxljdnj49p5r3mirk4k146428b6imfc9bkfps9yjn64mkgb";
+    hash = "sha256-m4gbVXAPIYGQvTFaSziFuOO6say5kgUsk7NSdqXgKmA=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-strncpy-gcc9.patch";
-      url = "https://github.com/mstpd/mstpd/commit/d27d7e93485d881d8ff3a7f85309b545edbe1fc6.patch";
-      sha256 = "19456daih8l3y6m9kphjr7pj7slrqzbj6yacnlgznpxyd8y4d86y";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook ];
 
   configureFlags = [
     "--prefix=$(out)"
     "--sysconfdir=$(out)/etc"
-    "--sbindir=$(out)/sbin"
+    "--sbindir=$(out)/bin"
     "--libexecdir=$(out)/lib"
+    "--with-bashcompletiondir=$(out)/share/bash-completion/completions"
   ];
 
+  # bridge-stp is a helper called by the kernel whenever STP is enabled/disabled
+  # on a bridge - the built-in version is incompatible with NixOS, so there's no
+  # point keeping it around.
+  #
+  # An alternative script gets automatically generated by NixOS network module
+  # whenever a bridge needs mstpd (grep for `bridgeStp`).
+  postInstall = ''
+    rm $out/bin/bridge-stp
+
+    # Remove now-dangling symlinks, too
+    rm $out/bin/mstp_restart
+    rm $out/lib/mstpctl-utils/mstpctl_restart_config
+  '';
+
   meta = {
     description = "Multiple Spanning Tree Protocol daemon";
     homepage = "https://github.com/mstpd/mstpd";
diff --git a/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix b/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
index aa9c3c7b3a3d..d2f86e7797d9 100644
--- a/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
+++ b/pkgs/by-name/n8/n8n-nodes-carbonejs/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "n8n-nodes-carbonejs";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jreyesr";
     repo = "n8n-nodes-carbonejs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dvl+Kc04i+hQ8rciT7n3oS4rtgke+HEqUszJnQa7UA0=";
+    hash = "sha256-QWErVquOEYCkoHIF6XSaDGzDbbkaNNoE70H/UvdZh6E=";
   };
 
-  npmDepsHash = "sha256-3VwejuSFGvJWNsitLKfVVpB8GnkTrrf/LLobNCpy8gU=";
+  npmDepsHash = "sha256-h780VxvDMUC5tv3JhDxYOZGJ+j40BAhmo4pRczlByKs=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index c73bcc270134..a3ce966c235f 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.475";
+  version = "0.0.478";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-2Vr36G4KEGDM1fTifZhMOr33B513bVFsOvWGU5usCVU=";
+    hash = "sha256-AGERHGA2jPEXZqueMzVRtVF3UJIEGxX0glVxjS4OuiU=";
   };
 
-  vendorHash = "sha256-jeH5/x4hIh2Q5bi6o7c0tcQLmyrMp0NJ641fZDPCHkw=";
+  vendorHash = "sha256-FfQMnZD+H0LDLPThOz8BJ6FN/B9pDVT5nt84AmpawO0=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/na/nawk/package.nix b/pkgs/by-name/na/nawk/package.nix
index d607a03bf4d3..c73ca513597b 100644
--- a/pkgs/by-name/na/nawk/package.nix
+++ b/pkgs/by-name/na/nawk/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://awk.dev";
+    homepage = "https://github.com/onetrueawk/awk";
     description = "One, true implementation of AWK";
     longDescription = ''
       This is the version of awk described in "The AWK Programming Language",
diff --git a/pkgs/by-name/ne/nethoscope/package.nix b/pkgs/by-name/ne/nethoscope/package.nix
index 5344351681b5..279b0681d6b6 100644
--- a/pkgs/by-name/ne/nethoscope/package.nix
+++ b/pkgs/by-name/ne/nethoscope/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
     libpcap
   ];
 
-  LD_LIBRARY_PATH = lib.makeLibraryPath [
+  env.LD_LIBRARY_PATH = lib.makeLibraryPath [
     libpcap
     alsa-lib
   ];
diff --git a/pkgs/by-name/nf/nfs-utils/package.nix b/pkgs/by-name/nf/nfs-utils/package.nix
index a6d056e03bec..642cca819f63 100644
--- a/pkgs/by-name/nf/nfs-utils/package.nix
+++ b/pkgs/by-name/nf/nfs-utils/package.nix
@@ -40,11 +40,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-utils";
-  version = "2.8.4";
+  version = "2.8.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/nfs-utils/${finalAttrs.version}/nfs-utils-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EcTMWYpDTX00C60+Byo3O6HcwsSfhV1EsgIiK3js2/U=";
+    hash = "sha256-sTykqd9EGGvb4QdRSyJzLUJD94X5Xa8vuGr8HtuhW7s=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
diff --git a/pkgs/by-name/ni/nibtools/package.nix b/pkgs/by-name/ni/nibtools/package.nix
index b2169a01757b..2083fcbb0aff 100644
--- a/pkgs/by-name/ni/nibtools/package.nix
+++ b/pkgs/by-name/ni/nibtools/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     hash = "sha256-0skAavJe01b+4Z7LEfS2qIhqkwj8XhOwmflhYPEynw4=";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
 
   nativeBuildInputs = [
     cc65
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index 7f525b9ddf78..b8cccfb94058 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -16,7 +16,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "0.1.1-beta";
+  version = "0.2.1-beta";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -25,7 +25,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-8HrW7VH2LAcTyduGfToC3+oqU7apILdvgd76c8r8NIw=";
+    hash = "sha256-ZiOTFVg/jyvoN8YrEvW66BcUKYwgiqxJyXifcFZmAXk=";
   };
 
   nativeBuildInputs = [
@@ -93,14 +93,14 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     mainProgram = "nixtamal";
     homepage = "https://nixtamal.toast.al";
     changelog = "https://nixtamal.toast.al/changelog/";
-    description = "Fulfilling, pure input pinning for Nix";
+    description = "Fulfilling input pinning for Nix";
     longDescription = ''
       Nixtamal’s keys features
 
       • Automate the manual work of input pinning, allowing to lock & refresh inputs
       • Declaritive KDL manifest file over imperative CLI flags
       • Host, forge, VCS-agnostic
-      • Fetchers from Nixpkgs not supported by the builtins (currently Darcs, Pijul)
+      • Choose eval time fetchers (builtins) or build time fetchers (Nixpkgs, default) — which opens up fetching Darcs & Pijul
       • Supports mirrors
       • Override hash algorithm on a per-project & per-input basis — including BLAKE3 support
       • Custom freshness commands
diff --git a/pkgs/by-name/nm/nmon/package.nix b/pkgs/by-name/nm/nmon/package.nix
index 392641dcb867..6f1e527f9fed 100644
--- a/pkgs/by-name/nm/nmon/package.nix
+++ b/pkgs/by-name/nm/nmon/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nmon";
-  version = "16q";
+  version = "16s";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${finalAttrs.version}.c";
-    sha256 = "sha256-G3ioFnLBkpGz0RpuMZ3ZsjoCKiYtuh786gCNbfUaylE=";
+    hash = "sha256-BzbOD3KeSMEkp7pWbAacWiNFEcycasknfakvi7RPKxE=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/by-name/no/noctalia-shell/package.nix b/pkgs/by-name/no/noctalia-shell/package.nix
index f622042c6b11..a4e2a474ca73 100644
--- a/pkgs/by-name/no/noctalia-shell/package.nix
+++ b/pkgs/by-name/no/noctalia-shell/package.nix
@@ -64,13 +64,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noctalia-shell";
-  version = "4.2.5";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHavMqGRv78sND/wQ53OhBBE2VBhgE3bSNRxxo5z7FE=";
+    hash = "sha256-u+M2dCw9PznZTgn51DwHpX4VcU9ZC9Acub7qKhCpr3c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/norgolith/package.nix b/pkgs/by-name/no/norgolith/package.nix
new file mode 100644
index 000000000000..2163555e2f77
--- /dev/null
+++ b/pkgs/by-name/no/norgolith/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libgit2,
+  openssl,
+  zlib,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "norgolith";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "NTBBloodbath";
+    repo = "norgolith";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-n9Obf2PoTQ8EyxF/i5YU9/AlN9IizWYW/sG89Z8qp1k=";
+  };
+
+  cargoHash = "sha256-1DOys3N42jlC/tc5D0Ixg+yXV/RRMIi4qcXzUwpl7XQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
+
+  useNextest = true;
+
+  env = {
+    LIBGIT2_NO_VENDOR = true;
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "The monolithic Norg static site generator built with Rust";
+    homepage = "https://norgolith.amartin.beer";
+    changelog = "https://github.com/NTBBloodbath/norgolith/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ Ladas552 ];
+    mainProgram = "lith";
+  };
+})
diff --git a/pkgs/by-name/nu/numcpp/package.nix b/pkgs/by-name/nu/numcpp/package.nix
index ffcfe74331a0..9471260ddb98 100644
--- a/pkgs/by-name/nu/numcpp/package.nix
+++ b/pkgs/by-name/nu/numcpp/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "\''${PACKAGE_PREFIX_DIR}/" ""
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = {
     description = "Templatized Header Only C++ Implementation of the Python NumPy Library";
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 9e43272ea303..9373549cb020 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -138,13 +138,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.15.2";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hfEuVWMmayAO26EV6fu7lRWEL3Es9wyN9sMdm5I+NJE=";
+    hash = "sha256-5dkikrp7jVGnfFwiGkbsGsRnrsS0zcZzWQ7shOn3alw=";
   };
 
   vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc=";
diff --git a/pkgs/by-name/ol/olvid/package.nix b/pkgs/by-name/ol/olvid/package.nix
index ef016788850a..d1f591ec3938 100644
--- a/pkgs/by-name/ol/olvid/package.nix
+++ b/pkgs/by-name/ol/olvid/package.nix
@@ -62,14 +62,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "olvid";
-  version = "2.5.1";
+  version = "2.7.0";
 
   dontUnpack = true;
   dontWrapGApps = true;
 
   src = fetchurl {
     url = "https://static.olvid.io/linux/${repo}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6QEr9mB9UI+rgrG4QxxBs5hOT26Yxcmjwode+pRwYfU=";
+    hash = "sha256-5qpsi31Z2aDIlEZ/lhsj8VjxSwfVvAOiwPbSWcRdby0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openboard/package.nix b/pkgs/by-name/op/openboard/package.nix
index dc9d6fdecde4..5117c2e7f18f 100644
--- a/pkgs/by-name/op/openboard/package.nix
+++ b/pkgs/by-name/op/openboard/package.nix
@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openboard";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "OpenBoard-org";
     repo = "OpenBoard";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CeW8G4aHo+IlB4F/ty48jIjhD7Nc7HFgudVbxrzZ2LU=";
+    hash = "sha256-mu7bhJx+Mv6Megq2jYK1s8oVt8QCMvD6sd2nnxI3VsA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/openttd-jgrpp/package.nix b/pkgs/by-name/op/openttd-jgrpp/package.nix
index edb4f837ce72..4d0794d4d7d9 100644
--- a/pkgs/by-name/op/openttd-jgrpp/package.nix
+++ b/pkgs/by-name/op/openttd-jgrpp/package.nix
@@ -6,13 +6,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.67.1";
+  version = "0.69.2";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-GMkcf3XBotPXjZC4TdtOXzutyyIiW4haE+jNIfgozbg=";
+    hash = "sha256-D9Oh05Isf7Atsih6tZBA8xS04aCuE8VS5Ghf0FvrU5A=";
   };
   patches = [ ];
 
diff --git a/pkgs/by-name/or/orca-slicer/package.nix b/pkgs/by-name/or/orca-slicer/package.nix
index be7edd5c9f3c..25240b2c63a2 100644
--- a/pkgs/by-name/or/orca-slicer/package.nix
+++ b/pkgs/by-name/or/orca-slicer/package.nix
@@ -142,41 +142,43 @@ stdenv.mkDerivation (finalAttrs: {
 
   separateDebugInfo = true;
 
-  NLOPT = nlopt;
+  env = {
+    NLOPT = nlopt;
 
-  NIX_CFLAGS_COMPILE = toString (
-    [
-      "-Wno-ignored-attributes"
-      "-I${opencv.out}/include/opencv4"
-      "-Wno-error=incompatible-pointer-types"
-      "-Wno-template-id-cdtor"
-      "-Wno-uninitialized"
-      "-Wno-unused-result"
-      "-Wno-deprecated-declarations"
-      "-Wno-use-after-free"
-      "-Wno-format-overflow"
-      "-Wno-stringop-overflow"
-      "-DBOOST_ALLOW_DEPRECATED_HEADERS"
-      "-DBOOST_MATH_DISABLE_STD_FPCLASSIFY"
-      "-DBOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS"
-      "-DBOOST_MATH_DISABLE_FLOAT128"
-      "-DBOOST_MATH_NO_QUAD_SUPPORT"
-      "-DBOOST_MATH_MAX_FLOAT128_DIGITS=0"
-      "-DBOOST_CSTDFLOAT_NO_LIBQUADMATH_SUPPORT"
-      "-DBOOST_MATH_DISABLE_FLOAT128_BUILTIN_FPCLASSIFY"
-    ]
-    # Making it compatible with GCC 14+, see https://github.com/SoftFever/OrcaSlicer/pull/7710
-    ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "14") [
-      "-Wno-error=template-id-cdtor"
-    ]
-  );
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-Wno-ignored-attributes"
+        "-I${opencv.out}/include/opencv4"
+        "-Wno-error=incompatible-pointer-types"
+        "-Wno-template-id-cdtor"
+        "-Wno-uninitialized"
+        "-Wno-unused-result"
+        "-Wno-deprecated-declarations"
+        "-Wno-use-after-free"
+        "-Wno-format-overflow"
+        "-Wno-stringop-overflow"
+        "-DBOOST_ALLOW_DEPRECATED_HEADERS"
+        "-DBOOST_MATH_DISABLE_STD_FPCLASSIFY"
+        "-DBOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS"
+        "-DBOOST_MATH_DISABLE_FLOAT128"
+        "-DBOOST_MATH_NO_QUAD_SUPPORT"
+        "-DBOOST_MATH_MAX_FLOAT128_DIGITS=0"
+        "-DBOOST_CSTDFLOAT_NO_LIBQUADMATH_SUPPORT"
+        "-DBOOST_MATH_DISABLE_FLOAT128_BUILTIN_FPCLASSIFY"
+      ]
+      # Making it compatible with GCC 14+, see https://github.com/SoftFever/OrcaSlicer/pull/7710
+      ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "14") [
+        "-Wno-error=template-id-cdtor"
+      ]
+    );
 
-  NIX_LDFLAGS = toString [
-    (lib.optionalString withSystemd "-ludev")
-    "-L${boost186}/lib"
-    "-lboost_log"
-    "-lboost_log_setup"
-  ];
+    NIX_LDFLAGS = toString [
+      (lib.optionalString withSystemd "-ludev")
+      "-L${boost186}/lib"
+      "-lboost_log"
+      "-lboost_log_setup"
+    ];
+  };
 
   prePatch = ''
     sed -i 's|nlopt_cxx|nlopt|g' cmake/modules/FindNLopt.cmake
diff --git a/pkgs/by-name/os/osslsigncode/package.nix b/pkgs/by-name/os/osslsigncode/package.nix
index b6f01f87275f..0785e5965500 100644
--- a/pkgs/by-name/os/osslsigncode/package.nix
+++ b/pkgs/by-name/os/osslsigncode/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osslsigncode";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "mtrojnar";
     repo = "osslsigncode";
     rev = finalAttrs.version;
-    sha256 = "sha256-ua/4OouuMWTvfFbdOVVZpf1Z43JoPiptlFl+THaef58=";
+    sha256 = "sha256-UVm0lpw5l8gw+qNGfE57SdvT0Wwo75dUlolwBjBVCwA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/pacparser/package.nix b/pkgs/by-name/pa/pacparser/package.nix
index e2a400e9e1ad..52e050bebaf0 100644
--- a/pkgs/by-name/pa/pacparser/package.nix
+++ b/pkgs/by-name/pa/pacparser/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pacparser";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "manugarg";
     repo = "pacparser";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-X842+xPjM404aQJTc2JwqU4vq8kgyKhpnqVu70pNLks=";
+    hash = "sha256-rHRW/zzQS2vV+rQeZBQNSp2id0Gir1yFPwN2OPMOvVo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pa/pan-bindings/package.nix b/pkgs/by-name/pa/pan-bindings/package.nix
index b26acdd8a56e..d7501b2667ca 100644
--- a/pkgs/by-name/pa/pan-bindings/package.nix
+++ b/pkgs/by-name/pa/pan-bindings/package.nix
@@ -27,7 +27,7 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "pan-bindings";
+  pname = "pan-bindings";
 
   inherit src version;
 
diff --git a/pkgs/by-name/pa/pax/package.nix b/pkgs/by-name/pa/pax/package.nix
index bf38bcd5c4b6..b63849172338 100644
--- a/pkgs/by-name/pa/pax/package.nix
+++ b/pkgs/by-name/pa/pax/package.nix
@@ -16,7 +16,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-lfts";
+  env = lib.optionalAttrs stdenv.hostPlatform.isMusl {
+    NIX_LDFLAGS = "-lfts";
+  };
 
   buildPhase = ''
     sh Build.sh -r -tpax
diff --git a/pkgs/by-name/pd/pdf4qt/package.nix b/pkgs/by-name/pd/pdf4qt/package.nix
index b9f61091c42f..a28323500944 100644
--- a/pkgs/by-name/pd/pdf4qt/package.nix
+++ b/pkgs/by-name/pd/pdf4qt/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # `blend2d.h` moved to `blend2d/blend2d.h` in blend2d >= 0.21.2
-  NIX_CFLAGS_COMPILE = "-I${blend2d.dev}/include/blend2d";
+  env.NIX_CFLAGS_COMPILE = "-I${blend2d.dev}/include/blend2d";
 
   cmakeFlags = [
     (lib.cmakeBool "PDF4QT_INSTALL_TO_USR" false)
diff --git a/pkgs/by-name/pg/pgloader/package.nix b/pkgs/by-name/pg/pgloader/package.nix
index a2c806acc6a7..753560fefbe1 100644
--- a/pkgs/by-name/pg/pgloader/package.nix
+++ b/pkgs/by-name/pg/pgloader/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ];
 
-  LD_LIBRARY_PATH = lib.makeLibraryPath [
+  env.LD_LIBRARY_PATH = lib.makeLibraryPath [
     sqlite
     libzip
     curl
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     install -Dm755 pgloader-bundle-${finalAttrs.version}/bin/pgloader "$out/bin/pgloader"
-    wrapProgram $out/bin/pgloader --prefix LD_LIBRARY_PATH : "${finalAttrs.LD_LIBRARY_PATH}"
+    wrapProgram $out/bin/pgloader --prefix LD_LIBRARY_PATH : "${finalAttrs.env.LD_LIBRARY_PATH}"
     mkdir -p $out/bin $out/man/man1
     installManPage source/docs/_build/man/*.1
   '';
diff --git a/pkgs/by-name/ph/phash/package.nix b/pkgs/by-name/ph/phash/package.nix
index 656a89b2e832..3e9e961d2941 100644
--- a/pkgs/by-name/ph/phash/package.nix
+++ b/pkgs/by-name/ph/phash/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-frISiZ89ei7XfI5F2nJJehfQZsk0Mlb4n91q/AiZ2vA=";
   };
 
-  NIX_LDFLAGS = "-lfftw3_threads";
+  env.NIX_LDFLAGS = "-lfftw3_threads";
 
   patches = [
     # proper pthread return value (https://github.com/clearscene/pHash/pull/20)
diff --git a/pkgs/by-name/ph/phodav/package.nix b/pkgs/by-name/ph/phodav/package.nix
index a5bb57ae66d0..c965f5856213 100644
--- a/pkgs/by-name/ph/phodav/package.nix
+++ b/pkgs/by-name/ph/phodav/package.nix
@@ -45,7 +45,9 @@ stdenv.mkDerivation rec {
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
   ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lintl";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-lintl";
+  };
 
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/pk/pktgen/package.nix b/pkgs/by-name/pk/pktgen/package.nix
index bfb3aa43a347..2c7cf0cc9f32 100644
--- a/pkgs/by-name/pk/pktgen/package.nix
+++ b/pkgs/by-name/pk/pktgen/package.nix
@@ -45,15 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
     gtk2
   ];
 
-  RTE_SDK = dpdk;
-  GUI = lib.optionalString withGtk "true";
+  env = {
+    RTE_SDK = dpdk;
+    GUI = lib.optionalString withGtk "true";
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=sign-compare"
-  ];
-
-  # requires symbols from this file
-  NIX_LDFLAGS = "-lrte_net_bond";
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=sign-compare"
+    ];
+    # requires symbols from this file
+    NIX_LDFLAGS = "-lrte_net_bond";
+  };
 
   postPatch = ''
     substituteInPlace lib/common/lscpu.h --replace /usr/bin/lscpu ${util-linux}/bin/lscpu
diff --git a/pkgs/by-name/pl/plasticscm-client-gui-unwrapped/package.nix b/pkgs/by-name/pl/plasticscm-client-gui-unwrapped/package.nix
index b1e3e6fb9725..d3360dafffde 100644
--- a/pkgs/by-name/pl/plasticscm-client-gui-unwrapped/package.nix
+++ b/pkgs/by-name/pl/plasticscm-client-gui-unwrapped/package.nix
@@ -11,11 +11,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasticscm-client-gui-unwrapped";
-  version = "11.0.16.9872";
+  version = "11.0.16.9915";
 
   src = fetchurl {
     url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-gui_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-gLu0r7eo7XrYwquZurduj1NiKIB7EnRky5vYKW9fks4=";
+    hash = "sha256-T5032/pM30LTQWi55YQEFSeglnnxXlJsZUCXL4JCpnw=";
     nativeBuildInputs = [ dpkg ];
     downloadToTemp = true;
     recursiveHash = true;
diff --git a/pkgs/by-name/pl/plasticscm-theme/package.nix b/pkgs/by-name/pl/plasticscm-theme/package.nix
index 1139d9c0f18c..8cf946687d52 100644
--- a/pkgs/by-name/pl/plasticscm-theme/package.nix
+++ b/pkgs/by-name/pl/plasticscm-theme/package.nix
@@ -11,7 +11,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasticscm-theme";
-  version = "11.0.16.9890";
+  version = "11.0.16.9915";
 
   src = fetchurl {
     url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-theme_${finalAttrs.version}_amd64.deb";
diff --git a/pkgs/by-name/pl/plugdata/package.nix b/pkgs/by-name/pl/plugdata/package.nix
index 66d9c571e179..d64452d3c066 100644
--- a/pkgs/by-name/pl/plugdata/package.nix
+++ b/pkgs/by-name/pl/plugdata/package.nix
@@ -92,18 +92,16 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   patches = [
     # fiddle~.c prevents building with gcc15. Upstream puredata has fixed this issue,
diff --git a/pkgs/by-name/po/postfix/package.nix b/pkgs/by-name/po/postfix/package.nix
index 8cbd827770bc..0989e9622ef7 100644
--- a/pkgs/by-name/po/postfix/package.nix
+++ b/pkgs/by-name/po/postfix/package.nix
@@ -147,7 +147,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
+  env = lib.optionalAttrs withLDAP {
+    NIX_LDFLAGS = "-llber";
+  };
 
   installTargets = [ "non-interactive-package" ];
 
diff --git a/pkgs/by-name/po/poutine/package.nix b/pkgs/by-name/po/poutine/package.nix
index d4ea3d73bd1b..d18ce939d2b8 100644
--- a/pkgs/by-name/po/poutine/package.nix
+++ b/pkgs/by-name/po/poutine/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "poutine";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "boostsecurityio";
     repo = "poutine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mtlwxqJnNANiONPi5AkgQoeG4Xed56by4JykNme8LqA=";
+    hash = "sha256-cz6EBgCPUtuVTAEv36fNtw+8GTXD0jcCD6x9iVa9V9k=";
   };
 
   vendorHash = "sha256-qp3Ko+01kk9AH0oCT2Si/si+74gT5KFtPFslwih/IBE=";
diff --git a/pkgs/by-name/pp/ppp/package.nix b/pkgs/by-name/pp/ppp/package.nix
index a4c577d4c015..547c7ee8f7dd 100644
--- a/pkgs/by-name/pp/ppp/package.nix
+++ b/pkgs/by-name/pp/ppp/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
-  NIX_LDFLAGS = "-lcrypt";
+  env.NIX_LDFLAGS = "-lcrypt";
 
   installFlags = [
     "sysconfdir=$(out)/etc"
diff --git a/pkgs/by-name/pr/prevo/package.nix b/pkgs/by-name/pr/prevo/package.nix
index 0c04592008e5..b8da0bff10ca 100644
--- a/pkgs/by-name/pr/prevo/package.nix
+++ b/pkgs/by-name/pr/prevo/package.nix
@@ -7,8 +7,8 @@
   makeWrapper,
 }:
 
-symlinkJoin rec {
-  name = "prevo-${version}";
+symlinkJoin {
+  pname = "prevo";
   inherit (prevo-tools) version;
 
   paths = [ prevo-tools ];
diff --git a/pkgs/by-name/pr/profile-cleaner/package.nix b/pkgs/by-name/pr/profile-cleaner/package.nix
index f8c9bd840372..1d9f77898739 100644
--- a/pkgs/by-name/pr/profile-cleaner/package.nix
+++ b/pkgs/by-name/pr/profile-cleaner/package.nix
@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.45";
+  version = "2.46";
   pname = "profile-cleaner";
 
   src = fetchFromGitHub {
     owner = "graysky2";
     repo = "profile-cleaner";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-10e1S+li7SXKJX2lETSdx84GavWqQYQqyLoBIVToTBI=";
+    sha256 = "sha256-gY6fmm6B6H7tg3xENnqaoy1QEMIf+a3k/C+JcnkyZwo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
index 4dd8c42d22b6..af73b1487eaf 100644
--- a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
   ];
 
   # poco 1.14 requires c++17
-  NIX_CFLAGS_COMPILE = [ "-std=gnu++17" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=gnu++17" ];
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/pr/protoc-gen-swift/package.nix b/pkgs/by-name/pr/protoc-gen-swift/package.nix
index c725f9afe1ca..c7bb3501b08f 100644
--- a/pkgs/by-name/pr/protoc-gen-swift/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-swift/package.nix
@@ -31,12 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
     swiftPackages.Dispatch
   ];
 
-  # swiftpm fails to found libdispatch.so on Linux
-  LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isLinux (
-    lib.makeLibraryPath [
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # swiftpm fails to found libdispatch.so on Linux
+    LD_LIBRARY_PATH = lib.makeLibraryPath [
       swiftPackages.Dispatch
-    ]
-  );
+    ];
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/pr/prow/package.nix b/pkgs/by-name/pr/prow/package.nix
index 0d8756e802de..8eefeb47415d 100644
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2026-01-26";
-  rev = "a0e74f2f7661a5ce8ecae738314ec0b4d4a182b0";
+  version = "0-unstable-2026-02-01";
+  rev = "a50f011ce108985726aa0d8ecbc65524292f7940";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-EKWd0G6ONOWNYZCyp4UlY4lalfhB27sV5HwkKmyRscs=";
+    hash = "sha256-tWd9Zj8nwAjlnuqfCU2VtCNcP8+p17yX876AsQJI4U4=";
   };
 
   vendorHash = "sha256-Pv9LznRh7Nzm74gMKT2Q/VLIMIIc93en0qX6YA6TwK4=";
diff --git a/pkgs/by-name/pr/prqlc/package.nix b/pkgs/by-name/pr/prqlc/package.nix
index 8bae52076728..0b50018c612e 100644
--- a/pkgs/by-name/pr/prqlc/package.nix
+++ b/pkgs/by-name/pr/prqlc/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "prqlc";
-  version = "0.13.5";
+  version = "0.13.10";
 
   src = fetchFromGitHub {
     owner = "prql";
     repo = "prql";
     rev = version;
-    hash = "sha256-XMxwxg7ij8PBKDWgEfyqCNNPz+a2D5GjIwIS8TMDSHo=";
+    hash = "sha256-SYIrME3iE1SpqjLvP/TxXXeiURfdrRSedN3FlcTwrt8=";
   };
 
-  cargoHash = "sha256-Rw3BZ+l6NiFIhH2zD4UG2hW9st0XP5/UPl1xtvm0XzE=";
+  cargoHash = "sha256-4426LQ8X5iGPyjtyHnlmOQmYNHwmTvf6TowpCa463O4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index 810710ef26f2..5e0b12fb1e32 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.270.0";
+  version = "0.271.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-oqfefPcGav1TwCq5F+r1eg/hx0CZoyc21rULg9cYquA=";
+    sha256 = "sha256-VSHeHruqGD2cgF5XYlyeGYhcSBlGIC+lgO6Qqrhtb0Q=";
   };
 
-  vendorHash = "sha256-1rBQdT2bSQxOL3vWWWSwaMH8K9op6x7t5asj+qJM/sA=";
+  vendorHash = "sha256-DbxciJXGcjQJZUmCbK8mFAtmKzRkWcMCWgU0SBrKTH0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/qt/qtgreet/package.nix b/pkgs/by-name/qt/qtgreet/package.nix
index 508e4a5f4d23..497777b37023 100644
--- a/pkgs/by-name/qt/qtgreet/package.nix
+++ b/pkgs/by-name/qt/qtgreet/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "dynpath" "${placeholder "out"}/var/lib/qtgreet")
   ];
 
-  NIX_LDFLAGS = "-lwayqt-utils-qt6";
+  env.NIX_LDFLAGS = "-lwayqt-utils-qt6";
 
   meta = {
     description = "Qt based greeter for greetd, to be run under wayfire or similar wlr-based compositors";
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index a0929652b3ca..44a4bc2d9518 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.30.5";
+  version = "3.31.1";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-x+G4DwqRMNEO75NND5r388pWnDZMjG7o/6MoCfVZyvk=";
+    hash = "sha256-wKNFWIm/BDkGyerafKskekhfgn5QBcxecUDSw4hhwCY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/rapidraw/package.nix b/pkgs/by-name/ra/rapidraw/package.nix
index 81bd053a8391..95e27c462fe1 100644
--- a/pkgs/by-name/ra/rapidraw/package.nix
+++ b/pkgs/by-name/ra/rapidraw/package.nix
@@ -42,13 +42,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rapidraw";
-  version = "1.4.5";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "CyberTimon";
     repo = "RapidRAW";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WG9Dlo7yRt+QZGA5112+BX3HHhjV0XW5nrj7PUORUFE=";
+    hash = "sha256-Jd/t3PWvUaQuTHqd4A4vqAfzR2QpZ/j1352gLyuqRxQ=";
     fetchSubmodules = true;
 
     # darwin/linux hash mismatch in rawler submodule
@@ -58,11 +58,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-6oI88cvlCR6TBiAAUka+Q8bkoYyTXvpMDNMfwlPjtIU=";
+  cargoHash = "sha256-ijyrq2BwNeJM8eM6yc5jmCicpLndhtKVlwHviMwpFS4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-w806JHqy2ZLFcfYVm09VKnLd7BpLI1houfMYbY3sHe0=";
+    hash = "sha256-jenSEANarab/oQnC80NoM1jWmvdeXF3bJ9I/vOGcBb0=";
   };
 
   nativeBuildInputs = [
@@ -125,10 +125,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'if !is_valid' 'if false'
   '';
 
+  # Fix dyld error about onnxruntime not being loaded on darwin during cargo test
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${onnxruntime}/lib:$DYLD_LIBRARY_PATH"
+  '';
+
   dontWrapGApps = true;
 
-  # needs to be declared twice annoyingly
-  ORT_STRATEGY = "system";
+  env = {
+    ORT_STRATEGY = "system";
+  };
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     # Patch the .desktop file to set the Categories field
@@ -139,16 +145,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # link the .so file
     ln -sf ${onnxruntime}/lib/libonnxruntime.so $out/lib/RapidRAW/resources/libonnxruntime.so
-
-    # remove the .dylib file
-    rm -rf $out/lib/RapidRAW/resources/libonnxruntime.dylib
   '';
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapGApp $out/bin/rapidraw \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath finalAttrs.buildInputs} \
-      --set ORT_STRATEGY "system" \
-      --set ORT_DYLIB_PATH "${onnxruntime}/lib/libonnxruntime.so"
+      --set ORT_STRATEGY "system"
   '';
 
   meta = {
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 853e0869c624..1ee0b06f346b 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-01-23";
+  version = "0-unstable-2026-01-27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "778be81b48eeeeb7991a49a816b350e4a88e0be1";
-    hash = "sha256-Bmfty8W02RVTFU5yhIhkcDmO2yE8ECV87kbAsNNRGcY=";
+    rev = "23efee6616cf3b45e519702363bb1c0748312a6f";
+    hash = "sha256-toAx1+ZjrlAq7wbCm2OcEJxEN+9vfTV1ypikQcbkskU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ri/ripplerx/package.nix b/pkgs/by-name/ri/ripplerx/package.nix
index 670b2cff797d..edbc55fd9a41 100644
--- a/pkgs/by-name/ri/ripplerx/package.nix
+++ b/pkgs/by-name/ri/ripplerx/package.nix
@@ -52,28 +52,30 @@ stdenv.mkDerivation (finalAttrs: {
     libXrandr
   ];
 
-  # JUCE dlopens these at runtime, standalone executable crashes without them
-  NIX_LDFLAGS = [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ];
+  env = {
+    # JUCE dlopens these at runtime, standalone executable crashes without them
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ];
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
 
-  # Fontconfig error: Cannot load default config file: No such file: (null)
-  env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+    # Fontconfig error: Cannot load default config file: No such file: (null)
+    FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/ro/roccat-tools/package.nix b/pkgs/by-name/ro/roccat-tools/package.nix
index 959637eff371..52490fd76c06 100644
--- a/pkgs/by-name/ro/roccat-tools/package.nix
+++ b/pkgs/by-name/ro/roccat-tools/package.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roccat-tools";
-  version = "5.9.0";
+  version = "5.9.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/roccat/${pname}-${version}.tar.bz2";
-    sha256 = "12j02rzbz3iqxprz8cj4kcfcdgnqlva142ci177axqmckcq6crvg";
+    sha256 = "sha256-6bgyr5l7FF1HzPjT5aJSL7xickHJ9jZ73Ulrx3+tQ1o=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ro/rox-filer/package.nix b/pkgs/by-name/ro/rox-filer/package.nix
index 6a71a3a856eb..5e362ccdaef9 100644
--- a/pkgs/by-name/ro/rox-filer/package.nix
+++ b/pkgs/by-name/ro/rox-filer/package.nix
@@ -30,8 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     shared-mime-info
     libSM
   ];
-  NIX_LDFLAGS = "-lm";
-  NIX_CFLAGS_COMPILE = " -fpermissive";
+
+  env = {
+    NIX_LDFLAGS = "-lm";
+    NIX_CFLAGS_COMPILE = "-fpermissive";
+  };
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/by-name/rs/rss-bridge-cli/package.nix b/pkgs/by-name/rs/rss-bridge-cli/package.nix
index 33dcc91e3ef7..51b1fc079646 100644
--- a/pkgs/by-name/rs/rss-bridge-cli/package.nix
+++ b/pkgs/by-name/rs/rss-bridge-cli/package.nix
@@ -27,6 +27,8 @@ in
   ${phpBin} ${rss-bridge}/index.php "$@"
 '').overrideAttrs
   (oldAttrs: {
+    pname = "rss-bridge-cli";
+
     version = rss-bridge.version;
 
     meta = {
diff --git a/pkgs/by-name/rt/rtabmap/package.nix b/pkgs/by-name/rt/rtabmap/package.nix
index 1eab3525a7ca..fadba4004586 100644
--- a/pkgs/by-name/rt/rtabmap/package.nix
+++ b/pkgs/by-name/rt/rtabmap/package.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Configure environment variables
-  NIX_CFLAGS_COMPILE = "-Wno-c++20-extensions";
+  env.NIX_CFLAGS_COMPILE = "-Wno-c++20-extensions";
 
   cmakeFlags = [
     (lib.cmakeFeature "CMAKE_INCLUDE_PATH" "${pcl'}/include/pcl-${lib.versions.majorMinor pcl'.version}")
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index 69737b07249a..2f0952354a48 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0.2.0-nightly-2026-01-12";
+  version = "0.2.0-nightly-2026-02-02";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-hEfxvRcjxj3ND/qM8WQQVTgOLR7Rf0P9Wfhyx38kxY4=";
+    hash = "sha256-oVo7AFCuaIxBfN2SsreanLUw/J+KuLi07Ds7iDD7ifw=";
   };
 
   postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                        "OpenH264Version(${major}, ${minor}, ${patch})"
     '';
 
-  cargoHash = "sha256-MY+K/KZP2xxewoh413+mjjPj+40gq2GhzdMKteJhRLc=";
+  cargoHash = "sha256-KCiqKn4X2w68nMY8fZ+n/FyJb7m3iNILdzpzYWemKcg=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =
diff --git a/pkgs/by-name/ru/runapp/package.nix b/pkgs/by-name/ru/runapp/package.nix
index 4a255a51bbd4..2be5bdb336c9 100644
--- a/pkgs/by-name/ru/runapp/package.nix
+++ b/pkgs/by-name/ru/runapp/package.nix
@@ -8,13 +8,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "runapp";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "c4rlo";
     repo = "runapp";
     tag = finalAttrs.version;
-    hash = "sha256-+dIawnBTf8QU0dv93NQUCgW60BrlUXljaoNnRQjfJZQ=";
+    hash = "sha256-/i3IJf/KWfYmu9ISp97au5hAhcZCVDhb/t6cyat0JlE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/s-/s-tui/package.nix b/pkgs/by-name/s-/s-tui/package.nix
index 13bf0474af85..edec1af068c6 100644
--- a/pkgs/by-name/s-/s-tui/package.nix
+++ b/pkgs/by-name/s-/s-tui/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "s-tui";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "amanusk";
     repo = "s-tui";
     tag = "v${version}";
-    hash = "sha256-VdQSDRDdRO6jHSuscOQZXnVM6nWHaXRfR4sZ3x5lriI=";
+    hash = "sha256-B5KQz+/RG+IROJah0jq+2e94DtnILwY2aH9qulWzHns=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/sb/sbom-tool/deps.json b/pkgs/by-name/sb/sbom-tool/deps.json
index 780917fa27ee..3a536e95217f 100644
--- a/pkgs/by-name/sb/sbom-tool/deps.json
+++ b/pkgs/by-name/sb/sbom-tool/deps.json
@@ -24,25 +24,30 @@
     "version": "2.1.1",
     "hash": "sha256-j6AbGSipxLcKSAMibc0uyUJHTa8odrgONaA4DXL4/Bo="
   },
+  {
+    "pname": "Microsoft.Bcl.Cryptography",
+    "version": "9.0.6",
+    "hash": "sha256-lfxx9rXXD8PxlUkl9109r1B+bPv/zsyzcp0Yf/iBMY0="
+  },
   {
     "pname": "Microsoft.ComponentDetection.Common",
-    "version": "6.0.0",
-    "hash": "sha256-F01KCIqxFa4049bzvKGh59kpdk5UykSFFKaHEPQGVY4="
+    "version": "6.2.6",
+    "hash": "sha256-ItHNgemiRUciaYs17dwbUI+pawOl3ftfcEfo1QMc5oM="
   },
   {
     "pname": "Microsoft.ComponentDetection.Contracts",
-    "version": "6.0.0",
-    "hash": "sha256-yRmgJVLDDMGlq550sqve7f+0/iwwHCT/GMb0/6837Y4="
+    "version": "6.2.6",
+    "hash": "sha256-eAUYM3C2PJ9ERbiYDMqpnDcXGH8r80Y6WJ1xdBRYKME="
   },
   {
     "pname": "Microsoft.ComponentDetection.Detectors",
-    "version": "6.0.0",
-    "hash": "sha256-JeXHB0XY003CpFDmgRzdgGRTcqFABywvEoxXHvlo8b0="
+    "version": "6.2.6",
+    "hash": "sha256-MkQQgeSWMlUJPKmFaCHpfFHwAW6IzQL+n4JJWtmLF24="
   },
   {
     "pname": "Microsoft.ComponentDetection.Orchestrator",
-    "version": "6.0.0",
-    "hash": "sha256-+rSRgh0V5WEtZ/SqRGvPI9J4k1hPGczBwJfxx5mmWg0="
+    "version": "6.2.6",
+    "hash": "sha256-BtX97RDa1MbMD1IhZ9QmKFL5eXKmzrDumPJXNwpHhcU="
   },
   {
     "pname": "Microsoft.CSharp",
@@ -109,11 +114,6 @@
     "version": "8.0.0",
     "hash": "sha256-+qIDR8hRzreCHNEDtUcPfVHQdurzWPo/mqviCH78+EQ="
   },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "8.0.0-rc.2.23479.6",
-    "hash": "sha256-GIErPwEhlblyAQfEDv+uDPn3RhJnmVMiTGj7l2wNCTk="
-  },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
     "version": "8.0.1",
@@ -306,8 +306,8 @@
   },
   {
     "pname": "morelinq",
-    "version": "4.2.0",
-    "hash": "sha256-BQ2ypkR5S4LuvxKkP6GrZuzckSiTFPVdR8VZ+DRn9g4="
+    "version": "4.4.0",
+    "hash": "sha256-6ITnfYABvcfk7uwLxDLgcsXspI4nKuBlrFNdMATGoUI="
   },
   {
     "pname": "NETStandard.Library",
@@ -321,53 +321,48 @@
   },
   {
     "pname": "NuGet.Common",
-    "version": "6.10.0",
-    "hash": "sha256-cM3Q7srAykk6KA/FThZkDjs+MIIjiUJSXZjRSqPNP1o="
-  },
-  {
-    "pname": "NuGet.Common",
-    "version": "6.14.0",
-    "hash": "sha256-jDOwt3veI1GSG8CfBnf2+dJxD3E/Nmlc+vHtD4J76Ms="
+    "version": "7.0.1",
+    "hash": "sha256-7nxlUHxM99xKGZwoen5P7uoXvvG3uK5TGMD2k6/xkP0="
   },
   {
     "pname": "NuGet.Configuration",
-    "version": "6.14.0",
-    "hash": "sha256-1PN9s6fhCw3wd2260U6hQ4vG3jIvcG8GIn1oQgxMXA0="
+    "version": "7.0.1",
+    "hash": "sha256-dhXJNWDR43YzJntM4Xoysnq4+hHWzaiUx/MgM21wOhU="
   },
   {
     "pname": "NuGet.DependencyResolver.Core",
-    "version": "6.10.0",
-    "hash": "sha256-3/dapzgXuqd+1RQlR+1iLS1lFpg7g1FDrkDzD5ahW+Y="
+    "version": "7.0.1",
+    "hash": "sha256-C0hwFrVf1KD/edUDZxlMoCPxOF9h50ICaUUuI0z6fQg="
   },
   {
     "pname": "NuGet.Frameworks",
-    "version": "6.14.0",
-    "hash": "sha256-3ViM3R1ucQMEL2hQYsivT86kI6veMQK2xDsiAcFcVQk="
+    "version": "7.0.1",
+    "hash": "sha256-ko+dIa2uwaVTBqPsE3VYXmbW+W2rqzYssVYsA99Gogc="
   },
   {
     "pname": "NuGet.LibraryModel",
-    "version": "6.10.0",
-    "hash": "sha256-DVxnItAizUQ4sVY8kcGuAchTtKMXWQrGJqM1ywqjkL0="
+    "version": "7.0.1",
+    "hash": "sha256-x7/Va8o9dPsSV3CyGoj+JXBa30YO3E8Ico7ZCU4UYrM="
   },
   {
     "pname": "NuGet.Packaging",
-    "version": "6.10.0",
-    "hash": "sha256-RK18XuOdmXPXhmBLRGjw00QsLiKuYawqjDQUlzcbRaM="
+    "version": "7.0.1",
+    "hash": "sha256-nOpGQ5ZP0PLKBGAGHkagjIX4ivCdcfeTjQDcBASYRSQ="
   },
   {
     "pname": "NuGet.ProjectModel",
-    "version": "6.10.0",
-    "hash": "sha256-LKdvGDGxqK1/QVVlsTUMFznEuoAsD2B/3dG+sx/e/78="
+    "version": "7.0.1",
+    "hash": "sha256-Yo0QJmer/Tw/PwPx6ZAjuCBzswNcUSG+PovAv/SqDe4="
   },
   {
     "pname": "NuGet.Protocol",
-    "version": "6.10.0",
-    "hash": "sha256-TPWWce4FhI3VaDhAR6mUYydFA6AjrPtcJSMmPQEmu0I="
+    "version": "7.0.1",
+    "hash": "sha256-KtTVt/d3apuUJcBS/Saz74yjh4v0BOeClkaJtx1aQnA="
   },
   {
     "pname": "NuGet.Versioning",
-    "version": "6.10.0",
-    "hash": "sha256-r8w4/bin+ZQK6AzkuFXhWbteQlzRFY++S1yDTrq0KfQ="
+    "version": "7.0.1",
+    "hash": "sha256-A3d7xyPaDS3tps9TkeCqJVxsPVE0Qvkz44KWSmxL9fI="
   },
   {
     "pname": "packageurl-dotnet",
@@ -376,13 +371,13 @@
   },
   {
     "pname": "Polly",
-    "version": "8.4.0",
-    "hash": "sha256-9KfX2swvws/z2HL31gdRL9WMm3fDZthW1EPeD1Ix+P4="
+    "version": "8.6.5",
+    "hash": "sha256-2YRacrP3b3C6EBCb5Pjg6fQdGj+SgbTeaWHN/oZ1d8s="
   },
   {
     "pname": "Polly.Core",
-    "version": "8.4.0",
-    "hash": "sha256-6M2ql3bQj/T6w3G1i0mZC4HtViLWJG5J5nzjP0A25r4="
+    "version": "8.6.5",
+    "hash": "sha256-m12obNfMZdWQWJoCaF03H5qEbFDdp9FSdHTHcIIsACQ="
   },
   {
     "pname": "PowerArgs",
@@ -696,18 +691,23 @@
   },
   {
     "pname": "Spectre.Console",
-    "version": "0.49.1",
-    "hash": "sha256-tqSVojyuQjuB34lXo759NOcyLgNIw815mKXJPq5JFDo="
+    "version": "0.53.1",
+    "hash": "sha256-uj/DD9y9MFWh5ugfQ1nTpbDP5xj55Sa8KX06B8CluMc="
+  },
+  {
+    "pname": "Spectre.Console",
+    "version": "0.54.0",
+    "hash": "sha256-qlZQkT5KzACqJ1bLgBOylq9qO0L7XCh/RY8L8PnkpcU="
   },
   {
     "pname": "Spectre.Console.Cli",
-    "version": "0.49.1",
-    "hash": "sha256-sar9rhft1ivDMj1kU683+4KxUPUZL+Fb++ewMA6RD4Q="
+    "version": "0.53.1",
+    "hash": "sha256-WN79g+F9jRsqXAwVFLYS/lfaQish2yFwL40GB/PpdTo="
   },
   {
     "pname": "Spectre.Console.Cli.Extensions.DependencyInjection",
-    "version": "0.2.0",
-    "hash": "sha256-kcVQM8qJGNuDwlGpKiI1nBsocz1yPS0NkUV7ppbtUm4="
+    "version": "0.17.0",
+    "hash": "sha256-0y5mJ3CGW2AFqbOFs0TFkbl4mKsYi8c65HO/SkcZeLI="
   },
   {
     "pname": "Sprache",
@@ -749,11 +749,6 @@
     "version": "4.3.0",
     "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
   },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "8.0.0",
-    "hash": "sha256-F7OVjKNwpqbUh8lTidbqJWYi476nsq9n+6k0+QVRo3w="
-  },
   {
     "pname": "System.Console",
     "version": "4.3.0",
@@ -791,8 +786,8 @@
   },
   {
     "pname": "System.Formats.Asn1",
-    "version": "6.0.1",
-    "hash": "sha256-gfGxcaWpVO92BJrl24pXi09KSgW2rSy3HGv0+V8hGgo="
+    "version": "9.0.10",
+    "hash": "sha256-hPvY9hKsDEbNyyzaaMImebYTQWLWD/AOjtru+a4NsIc="
   },
   {
     "pname": "System.Globalization",
@@ -841,8 +836,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "9.0.9",
-    "hash": "sha256-bRMt0ib0KwKzHXgeAXZgegou5eX8lsm80Eu38bHBxBs="
+    "version": "9.0.10",
+    "hash": "sha256-Hu4g9QfEzNW71/zX0vP+Knqu6WizhSzWASy1cxANOr0="
   },
   {
     "pname": "System.Linq",
@@ -856,8 +851,8 @@
   },
   {
     "pname": "System.Memory",
-    "version": "4.5.5",
-    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
+    "version": "4.6.3",
+    "hash": "sha256-JgeK63WMmumF6L+FH5cwJgYdpqXrSDcgTQwtIgTHKVU="
   },
   {
     "pname": "System.Net.Http",
@@ -891,8 +886,8 @@
   },
   {
     "pname": "System.Reactive",
-    "version": "6.0.1",
-    "hash": "sha256-Lo5UMqp8DsbVSUxa2UpClR1GoYzqQQcSxkfyFqB/d4Q="
+    "version": "6.1.0",
+    "hash": "sha256-zACYoZmKxHo0qKY8FOVa7jIsw7dN7WjdXdRRV95qY2Y="
   },
   {
     "pname": "System.Reflection",
@@ -1016,8 +1011,8 @@
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "6.0.4",
-    "hash": "sha256-2e0aRybote+OR66bHaNiYpF//4fCiaO3zbR2e9GABUI="
+    "version": "9.0.6",
+    "hash": "sha256-+Q7vAp+uOf/aqldFvsZuXw/0UHXtfFdNRMpqCZ1/Hwo="
   },
   {
     "pname": "System.Security.Cryptography.Primitives",
@@ -1026,8 +1021,8 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "4.4.0",
-    "hash": "sha256-Ri53QmFX8I8UH0x4PikQ1ZA07ZSnBUXStd5rBfGWFOE="
+    "version": "9.0.6",
+    "hash": "sha256-WMa3KDeFuOLyIZduYd+9PCyx7usJMRu/q2x3eOw9MAQ="
   },
   {
     "pname": "System.Security.Cryptography.X509Certificates",
@@ -1061,18 +1056,13 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "9.0.9",
-    "hash": "sha256-euYrJAKiTDCj/Rf1KVWI6IophDX828x5T9As9vAf81A="
+    "version": "9.0.10",
+    "hash": "sha256-rTef4Wzfcjzx+ZToxTN6VfalIjnpU74TOCmOsIx08hY="
   },
   {
     "pname": "System.Text.Json",
-    "version": "8.0.5",
-    "hash": "sha256-yKxo54w5odWT6nPruUVsaX53oPRe+gKzGvLnnxtwP68="
-  },
-  {
-    "pname": "System.Text.Json",
-    "version": "9.0.9",
-    "hash": "sha256-I+GCgXZZUtgAta94BIBqy72HnZJ3egzNBOTxnVy2Ur8="
+    "version": "9.0.10",
+    "hash": "sha256-wqeobpRw3PqOw21q8oGvauj5BkX1pS02Cm78E6c742w="
   },
   {
     "pname": "System.Text.RegularExpressions",
@@ -1131,8 +1121,8 @@
   },
   {
     "pname": "Tomlyn.Signed",
-    "version": "0.17.0",
-    "hash": "sha256-C5+2mVihp64KiytpgvI0BaMwK+vhKz2/h2XqaT24bYg="
+    "version": "0.19.0",
+    "hash": "sha256-nOlE1a3wj0LN0IlCgxrdtyx9z/TUYJZEgiLm38N7iZU="
   },
   {
     "pname": "Validation",
@@ -1146,7 +1136,7 @@
   },
   {
     "pname": "YamlDotNet",
-    "version": "15.1.6",
-    "hash": "sha256-C9IGS9HNuEKgpUozkfuzA0pNWsS/LVwgHzPEmU2sw8Y="
+    "version": "15.3.0",
+    "hash": "sha256-2rdemzEc4cGKfmYRTRfT0HXjllRs22qXac+UE400klU="
   }
 ]
diff --git a/pkgs/by-name/sb/sbom-tool/package.nix b/pkgs/by-name/sb/sbom-tool/package.nix
index 58690cdbcb6b..f5d27de56e48 100644
--- a/pkgs/by-name/sb/sbom-tool/package.nix
+++ b/pkgs/by-name/sb/sbom-tool/package.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "sbom-tool";
-  version = "4.1.6";
+  version = "4.1.7";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "sbom-tool";
     tag = "v${version}";
-    hash = "sha256-Bx/wPksPpedR7hyK6puqZ1uU74zqJV5j33NQzvJXyzY=";
+    hash = "sha256-Ls+IaqaWZOjEWvomV9q4JBdZkaevVtI6lCOG8l44AQM=";
   };
 
   projectFile = "src/Microsoft.Sbom.Tool/Microsoft.Sbom.Tool.csproj";
diff --git a/pkgs/by-name/sc/sc-controller/package.nix b/pkgs/by-name/sc/sc-controller/package.nix
index e53757448b1e..8f4bff2936d2 100644
--- a/pkgs/by-name/sc/sc-controller/package.nix
+++ b/pkgs/by-name/sc/sc-controller/package.nix
@@ -70,7 +70,7 @@ python3Packages.buildPythonApplication rec {
     substituteInPlace scc/device_monitor.py --replace "find_library('bluetooth')" "'libbluetooth.so.3'"
   '';
 
-  LD_LIBRARY_PATH = lib.makeLibraryPath [
+  env.LD_LIBRARY_PATH = lib.makeLibraryPath [
     libX11
     libXext
     libXfixes
diff --git a/pkgs/by-name/sc/scorched3d/package.nix b/pkgs/by-name/sc/scorched3d/package.nix
index 0df07831a439..8d781d15d676 100644
--- a/pkgs/by-name/sc/scorched3d/package.nix
+++ b/pkgs/by-name/sc/scorched3d/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [ "--with-fftw=${fftwSinglePrec.dev}" ];
 
-  NIX_LDFLAGS = "-lopenal";
+  env.NIX_LDFLAGS = "-lopenal";
 
   meta = {
     homepage = "http://scorched3d.co.uk/";
diff --git a/pkgs/by-name/sc/scummvm/package.nix b/pkgs/by-name/sc/scummvm/package.nix
index a489cfb4e026..e1d96694b65e 100644
--- a/pkgs/by-name/sc/scummvm/package.nix
+++ b/pkgs/by-name/sc/scummvm/package.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail ${stdenv.hostPlatform.config}-ranlib ${cctools}/bin/ranlib
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 6ca9d8588e76..8a4c2d073d3d 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.07";
+  version = "4.08";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     tag = finalAttrs.version;
-    hash = "sha256-MeMB5YuRVWL9bR2LUvSzRcaNpSu+D5IwLqPI/OKvjoI=";
+    hash = "sha256-i+CBU1aKx6ZTgtSSDZHefQ96sgqSNtqCglhj7hHH6fI=";
   };
 
-  vendorHash = "sha256-m3rOw41lJA9rRd5788V0H9tlJf10BDzKJNAZepMQ9oI=";
+  vendorHash = "sha256-77KoE0gbybWpRLiaiqD+ZC0zH3BcYuZ1TkC7aPFkAv8=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libredirect.hook ];
 
diff --git a/pkgs/by-name/se/semantic-release/package.nix b/pkgs/by-name/se/semantic-release/package.nix
index 7287e7a67d55..16d07edb37e3 100644
--- a/pkgs/by-name/se/semantic-release/package.nix
+++ b/pkgs/by-name/se/semantic-release/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "25.0.1";
+  version = "25.0.2";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-6OgqZh9OXITPwOtCD209H7KjPGf2MK/sCcrzZgpasyE=";
+    hash = "sha256-iucXpzB9Rd7HuAxg7ZYLuY8j7zRCYxjly5zhyFOmDak=";
   };
 
-  npmDepsHash = "sha256-/Ba4udEUZAEfUmMcUHykkLGPvH9lr8Wxb+6FkJKYiWQ=";
+  npmDepsHash = "sha256-FrwwER5/QNBV7Ppby7bJMBV8bfgTCWjeORPv9/KjeNo=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/si/siege/package.nix b/pkgs/by-name/si/siege/package.nix
index c3e5901b6477..0e074b880f96 100644
--- a/pkgs/by-name/si/siege/package.nix
+++ b/pkgs/by-name/si/siege/package.nix
@@ -15,9 +15,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-7BQM7dFZl5OD1g2+h6AVHCwSraeHkQlaj6hK5jW5MCY=";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux [
-    "-lgcc_s"
-  ];
+  env =
+    lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      NIX_LDFLAGS = toString [ "-lgcc_s" ];
+    }
+    // lib.optionalAttrs stdenv.cc.isClang {
+      # Borrowed solution from homebrew: https://github.com/Homebrew/homebrew-core/blob/1c7c95183c0984a84b1680422afab6578c300a27/Formula/s/siege.rb#L31
+      CFLAGS = "-Wno-int-conversion";
+    };
 
   buildInputs = [
     openssl
@@ -33,9 +38,6 @@ stdenv.mkDerivation rec {
     "--with-zlib=${zlib.dev}"
   ];
 
-  # Borrowed solution from homebrew: https://github.com/Homebrew/homebrew-core/blob/1c7c95183c0984a84b1680422afab6578c300a27/Formula/s/siege.rb#L31
-  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
-
   meta = {
     description = "HTTP load tester";
     homepage = "https://www.joedog.org/siege-home/";
diff --git a/pkgs/by-name/si/siesta/package.nix b/pkgs/by-name/si/siesta/package.nix
index 36a6c07e3b82..7c6dd18d31c0 100644
--- a/pkgs/by-name/si/siesta/package.nix
+++ b/pkgs/by-name/si/siesta/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     scalapack
   ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   cmakeFlags = [
     "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index 205e0e3970bc..a47674c4b90c 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "signalbackup-tools";
-  version = "20260118-1";
+  version = "20260126";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = finalAttrs.version;
-    hash = "sha256-3pwIRhTpYk3Vq0C4BNHle7/6QWrEuo0/hMqFRH6zw6A=";
+    hash = "sha256-gmS1aZxdCPn3o+bYa5/NKEo9JZ3jq71l55t6enNxeEE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/silver-searcher/package.nix b/pkgs/by-name/si/silver-searcher/package.nix
index 87151fd393e2..6015d39697c6 100644
--- a/pkgs/by-name/si/silver-searcher/package.nix
+++ b/pkgs/by-name/si/silver-searcher/package.nix
@@ -22,13 +22,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [ ./bash-completion.patch ];
 
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: src/zfile.o:/build/source/src/log.h:12: multiple definition of
-  #     `print_mtx'; src/ignore.o:/build/source/src/log.h:12: first defined here
-  # TODO: remove once next release has https://github.com/ggreer/the_silver_searcher/pull/1377
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux "-lgcc_s";
+  env = {
+    # Workaround build failure on -fno-common toolchains like upstream
+    # gcc-10. Otherwise build fails as:
+    #   ld: src/zfile.o:/build/source/src/log.h:12: multiple definition of
+    #     `print_mtx'; src/ignore.o:/build/source/src/log.h:12: first defined here
+    # TODO: remove once next release has https://github.com/ggreer/the_silver_searcher/pull/1377
+    NIX_CFLAGS_COMPILE = "-fcommon";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    NIX_LDFLAGS = "-lgcc_s";
+  };
 
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/by-name/si/sitespeed-io/package.nix b/pkgs/by-name/si/sitespeed-io/package.nix
index e78e793b8252..0173b666fdc6 100644
--- a/pkgs/by-name/si/sitespeed-io/package.nix
+++ b/pkgs/by-name/si/sitespeed-io/package.nix
@@ -27,13 +27,13 @@ assert
   (!withFirefox && !withChromium) -> throw "Either `withFirefox` or `withChromium` must be enabled.";
 buildNpmPackage (finalAttrs: {
   pname = "sitespeed-io";
-  version = "39.3.1";
+  version = "39.4.1";
 
   src = fetchFromGitHub {
     owner = "sitespeedio";
     repo = "sitespeed.io";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Qgw1rqUZ/2znTmvqSCSyTyzQWpHtxsG/tHNXDphT/Ng=";
+    hash = "sha256-Dpg/UsuCfiTcSnDDCpsYh+T/JGbC1r+gUegzZJdtycw=";
   };
 
   env = {
@@ -49,7 +49,7 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--omit=dev" ];
-  npmDepsHash = "sha256-/SzoscPVDhOlAPKSCNkGnAbXjCXVD6KRD1MglM3ExAQ=";
+  npmDepsHash = "sha256-R2i05VBhhOTbk+tXjlet01coBMpXB1h6aSqewscCQls=";
 
   postInstall = ''
     mv $out/bin/sitespeed{.,-}io
diff --git a/pkgs/by-name/sk/skyscraper/package.nix b/pkgs/by-name/sk/skyscraper/package.nix
index 55ce287b7c3a..c44e61b2406a 100644
--- a/pkgs/by-name/sk/skyscraper/package.nix
+++ b/pkgs/by-name/sk/skyscraper/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "skyscraper";
-  version = "3.18.0";
+  version = "3.18.3";
 
   src = fetchFromGitHub {
     owner = "Gemba";
     repo = "skyscraper";
     tag = finalAttrs.version;
-    hash = "sha256-z6Y5JUKvwxYgE7sdXvRNOsbUTON5i/DX1q9y4wRXixE=";
+    hash = "sha256-3Yo6aRmduIhTYwaxgL5fpKuNycM+VzgLPe/7VdaePo8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sm/smpeg/package.nix b/pkgs/by-name/sm/smpeg/package.nix
index c25a0c09ad77..53b2612f4e46 100644
--- a/pkgs/by-name/sm/smpeg/package.nix
+++ b/pkgs/by-name/sm/smpeg/package.nix
@@ -93,7 +93,9 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
   '';
 
-  NIX_LDFLAGS = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-lX11";
+  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+    NIX_LDFLAGS = "-lX11";
+  };
 
   meta = {
     homepage = "https://icculus.org/smpeg/";
diff --git a/pkgs/by-name/sn/snd/package.nix b/pkgs/by-name/sn/snd/package.nix
index a150e002ae55..006c68c41e53 100644
--- a/pkgs/by-name/sn/snd/package.nix
+++ b/pkgs/by-name/sn/snd/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snd";
-  version = "25.8";
+  version = "26.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ha8f7vBRUNEHXc0/E0L714jPFDVhMSCluKPrrdQYOTM=";
+    hash = "sha256-8b1jyf/6Jo/0NVy+Zvwb4gJ48j5Z94JFtVMgYB03CYc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/so/socalabs-papu/package.nix b/pkgs/by-name/so/socalabs-papu/package.nix
index 31632fc4ee2c..70ca9f7137e3 100644
--- a/pkgs/by-name/so/socalabs-papu/package.nix
+++ b/pkgs/by-name/so/socalabs-papu/package.nix
@@ -120,18 +120,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   meta = {
     description = "Socalabs Nintendo Gameboy PAPU Emulation Plugin";
diff --git a/pkgs/by-name/so/socalabs-rp2a03/package.nix b/pkgs/by-name/so/socalabs-rp2a03/package.nix
index 64b38d9c86f0..7bee247d80ac 100644
--- a/pkgs/by-name/so/socalabs-rp2a03/package.nix
+++ b/pkgs/by-name/so/socalabs-rp2a03/package.nix
@@ -117,18 +117,16 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   meta = {
     description = "Socalabs NES Ricoh 2A03 Emulation Plugin";
diff --git a/pkgs/by-name/so/socalabs-sid/package.nix b/pkgs/by-name/so/socalabs-sid/package.nix
index bc9a6d7dcdaf..792b529a75b4 100644
--- a/pkgs/by-name/so/socalabs-sid/package.nix
+++ b/pkgs/by-name/so/socalabs-sid/package.nix
@@ -152,18 +152,16 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   meta = {
     description = "Socalabs Commodore 64 SID Emulation Plugin";
diff --git a/pkgs/by-name/so/socalabs-sn76489/package.nix b/pkgs/by-name/so/socalabs-sn76489/package.nix
index aaf32ae6a205..a54c6b796bc2 100644
--- a/pkgs/by-name/so/socalabs-sn76489/package.nix
+++ b/pkgs/by-name/so/socalabs-sn76489/package.nix
@@ -127,18 +127,16 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/so/socalabs-voc/package.nix b/pkgs/by-name/so/socalabs-voc/package.nix
index 3de5e6148c9c..3be3fdd55677 100644
--- a/pkgs/by-name/so/socalabs-voc/package.nix
+++ b/pkgs/by-name/so/socalabs-voc/package.nix
@@ -130,18 +130,16 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcomposite"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-      "-lXtst"
-      "-lXdmcp"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcomposite"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+    "-lXtst"
+    "-lXdmcp"
+  ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/so/socklog/package.nix b/pkgs/by-name/so/socklog/package.nix
index 523a9f03aebf..56731a2d8ec6 100644
--- a/pkgs/by-name/so/socklog/package.nix
+++ b/pkgs/by-name/so/socklog/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "socklog";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "https://smarden.org/socklog/socklog-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6xk3JB1seyoEArSf/evwIrsvzaPgDBsaF66Lzx5KObo=";
+    hash = "sha256-e8ej+ejhWn55EoHAV0GkwM8N6G50hw/SxvTX55QrleY=";
   };
 
   sourceRoot = "admin/socklog-${finalAttrs.version}";
diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index 97fd607200b5..60b8b5aea133 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -4,32 +4,32 @@
   fetchFromGitHub,
   pkg-config,
   wrapGAppsHook4,
+  nix-update-script,
   cairo,
   gdk-pixbuf,
+  gettext,
   glib,
   gtk4,
   pango,
   polkit,
 }:
-let
-  version = "0.2.0";
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "soteria";
-  inherit version;
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "imvaskel";
     repo = "soteria";
-    tag = "v${version}";
-    hash = "sha256-bZhxz6aycx7J3itInSsl2glbIs6OpIEkfSp3nYfPojk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g6DGb8PWfc5YyjUpO9q3q0MxcPUbMjatOi6POFcZEE4=";
   };
 
-  cargoHash = "sha256-rxZRDx+5srBbMTVLMNH8liOqjyg90FvTaTT7g+3fq7E=";
+  cargoHash = "sha256-6Pk60J2RAInRgCiIk9thZRwwAyCQvychh5nVHmKU7Iw=";
 
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook4
+    gettext
   ];
 
   buildInputs = [
@@ -40,15 +40,22 @@ rustPlatform.buildRustPackage {
     pango
   ];
 
-  # From upstream packaging:
-  #  Takes advantage of nixpkgs manually editing PACKAGE_PREFIX by grabbing it from
-  #  the binary itself.
-  #  https://github.com/NixOS/nixpkgs/blob/9b5328b7f761a7bbdc0e332ac4cf076a3eedb89b/pkgs/development/libraries/polkit/default.nix#L142
-  #  https://github.com/polkit-org/polkit/blob/d89c3604e2a86f4904566896c89e1e6b037a6f50/src/polkitagent/polkitagentsession.c#L599
   preBuild = ''
-    export POLKIT_AGENT_HELPER_PATH="$(strings ${polkit.out}/lib/libpolkit-agent-1.so | grep "polkit-agent-helper-1")"
+    export SOTERIA_DEFAULT_LOCALE_DIR=$out/share/locale
   '';
 
+  postInstall = ''
+    mkdir -p $SOTERIA_DEFAULT_LOCALE_DIR
+    for file in po/*.po; do
+      lang=''${file%.*}
+      lang=''${lang#po/}
+      mkdir -p "$SOTERIA_DEFAULT_LOCALE_DIR/$lang/LC_MESSAGES"
+      msgfmt "$file" -o "$SOTERIA_DEFAULT_LOCALE_DIR/$lang/LC_MESSAGES/soteria.mo"
+    done
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Polkit authentication agent written in GTK designed to be used with any desktop environment";
     homepage = "https://github.com/ImVaskel/soteria";
@@ -59,4 +66,4 @@ rustPlatform.buildRustPackage {
     ];
     inherit (polkit.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/sp/spaghettikart/package.nix b/pkgs/by-name/sp/spaghettikart/package.nix
index d1a61649a1a5..feaf3696cbb2 100644
--- a/pkgs/by-name/sp/spaghettikart/package.nix
+++ b/pkgs/by-name/sp/spaghettikart/package.nix
@@ -173,7 +173,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Recent builds enabled LTO which won't build with nix
-  NIX_CFLAGS_COMPILE = "-fno-lto";
+  env.NIX_CFLAGS_COMPILE = "-fno-lto";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/sp/speed-dreams/package.nix b/pkgs/by-name/sp/speed-dreams/package.nix
index cae6668477f7..9db2623d7374 100644
--- a/pkgs/by-name/sp/speed-dreams/package.nix
+++ b/pkgs/by-name/sp/speed-dreams/package.nix
@@ -85,7 +85,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-ZY/0tf0wFbepEUNqpaBA4qgkWDij/joqPtbiF/48oN4=";
     fetchSubmodules = true;
   };
-  NIX_CFLAGS_COMPILE = "-I${finalAttrs.src}/src/libs/tgf -I${finalAttrs.src}/src/libs/tgfdata -I${finalAttrs.src}/src/interfaces -I${finalAttrs.src}/src/libs/math -I${finalAttrs.src}/src/libs/portability";
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-I${finalAttrs.src}/src/libs/tgf"
+    "-I${finalAttrs.src}/src/libs/tgfdata"
+    "-I${finalAttrs.src}/src/interfaces"
+    "-I${finalAttrs.src}/src/libs/math"
+    "-I${finalAttrs.src}/src/libs/portability"
+  ];
 
   patches = [
     ./darwin-gl-compat.patch
diff --git a/pkgs/by-name/sp/spicy-parser-generator/package.nix b/pkgs/by-name/sp/spicy-parser-generator/package.nix
index 3e418cf9b8e8..226d8d05066f 100644
--- a/pkgs/by-name/sp/spicy-parser-generator/package.nix
+++ b/pkgs/by-name/sp/spicy-parser-generator/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spicy";
-  version = "1.14.0";
+  version = "1.15.0";
 
   strictDeps = true;
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "zeek";
     repo = "spicy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pc4BqQiaifB/kAbcaHYyTUeUE/HLlvg0qDSPdC/gMko=";
+    hash = "sha256-vZSqUcJoFleZM9sqLdc/g2M+UQrns3kys4eHOfs4Cvk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/sq/sqlcl/package.nix b/pkgs/by-name/sq/sqlcl/package.nix
index 3261295e4e12..6a0b3aebb078 100644
--- a/pkgs/by-name/sq/sqlcl/package.nix
+++ b/pkgs/by-name/sq/sqlcl/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlcl";
-  version = "25.3.0.274.1210";
+  version = "25.4.1.022.0618";
 
   src = fetchurl {
     url = "https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-${finalAttrs.version}.zip";
-    hash = "sha256-TOKTvBFoUFDqN7qjq6yYYBh0bfS66kks243q6+5+i6c=";
+    hash = "sha256-txfYOqGnraLKOOfIvls2nqai+fUMX9tV4Y0mO0ceyrk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ss/ssdfs-utils/package.nix b/pkgs/by-name/ss/ssdfs-utils/package.nix
index f718534b05cf..5fc2b0420c55 100644
--- a/pkgs/by-name/ss/ssdfs-utils/package.nix
+++ b/pkgs/by-name/ss/ssdfs-utils/package.nix
@@ -13,13 +13,13 @@ stdenv.mkDerivation {
   # as ssdfs-utils, not ssdfs-tools.
   pname = "ssdfs-utils";
   # The version is taken from `configure.ac`, there are no tags.
-  version = "4.67";
+  version = "4.68";
 
   src = fetchFromGitHub {
     owner = "dubeyko";
     repo = "ssdfs-tools";
-    rev = "f6410a78b182fc06d3f7894994883455ab63e922";
-    hash = "sha256-dbWWVSyX438dZ9Gcxe5crNELPGFpHXGU8EJWy74d5Mw=";
+    rev = "cfcb45f4029bc3caee2a48f54c54bbd7458ecf23";
+    hash = "sha256-qJQ74VowTQNV0WINcq9A0il1gfzsDXZgWXL6YU3/Rcw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch b/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
index c12bf9d857d3..5ba8592c29a7 100644
--- a/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
+++ b/pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch
@@ -1,38 +1,25 @@
-From e246c4f87c1af78be5f5a76f79bd66c27d63918f Mon Sep 17 00:00:00 2001
-From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Date: Wed, 3 Jul 2024 21:38:15 +0200
-Subject: [PATCH] module support
-
-Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
----
- go.mod | 26 ++++++++++++++++++++++++++
- go.sum | 42 ++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 68 insertions(+)
- create mode 100644 go.mod
- create mode 100644 go.sum
-
 diff --git a/go.mod b/go.mod
 new file mode 100644
-index 00000000..51c79d4c
+index 0000000..99454d8
 --- /dev/null
 +++ b/go.mod
 @@ -0,0 +1,26 @@
 +module github.com/aws/session-manager-plugin
 +
-+go 1.22.3
++go 1.25.5
 +
 +require (
-+	github.com/aws/aws-sdk-go v1.54.14
++	github.com/aws/aws-sdk-go v1.55.8
 +	github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575
 +	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
-+	github.com/fsnotify/fsnotify v1.7.0
++	github.com/fsnotify/fsnotify v1.9.0
 +	github.com/gorilla/websocket v1.5.3
-+	github.com/stretchr/testify v1.9.0
++	github.com/stretchr/testify v1.11.1
 +	github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19
-+	github.com/xtaci/smux v1.5.24
-+	golang.org/x/crypto v0.24.0
-+	golang.org/x/sync v0.7.0
-+	golang.org/x/sys v0.21.0
++	github.com/xtaci/smux v1.5.55
++	golang.org/x/crypto v0.47.0
++	golang.org/x/sync v0.19.0
++	golang.org/x/sys v0.40.0
 +)
 +
 +require (
@@ -40,17 +27,17 @@ index 00000000..51c79d4c
 +	github.com/jmespath/go-jmespath v0.4.0 // indirect
 +	github.com/pmezard/go-difflib v1.0.0 // indirect
 +	github.com/stretchr/objx v0.5.2 // indirect
-+	golang.org/x/term v0.21.0 // indirect
++	golang.org/x/term v0.39.0 // indirect
 +	gopkg.in/yaml.v3 v3.0.1 // indirect
 +)
 diff --git a/go.sum b/go.sum
 new file mode 100644
-index 00000000..ca623749
+index 0000000..7c72807
 --- /dev/null
 +++ b/go.sum
 @@ -0,0 +1,42 @@
-+github.com/aws/aws-sdk-go v1.54.14 h1:llJ60MzLzovyDE/rEDbUjS1cICh7krk1PwQwNlKRoeQ=
-+github.com/aws/aws-sdk-go v1.54.14/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
++github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
++github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 +github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 h1:kHaBemcxl8o/pQ5VM1c8PVE1PubbNx3mjUr09OqWGCs=
 +github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575/go.mod h1:9d6lWj8KzO/fd/NrVaLscBKmPigpZpn5YawRPw+e3Yo=
 +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -58,8 +45,8 @@ index 00000000..ca623749
 +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 +github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
 +github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
-+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
++github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
++github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 +github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 +github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 +github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -71,26 +58,23 @@ index 00000000..ca623749
 +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
++github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
++github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 +github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19 h1:HlxV0XiEKMMyjS3gGtJmmFZsxQ22GsLvA7F980il+1w=
 +github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19/go.mod h1:mMgcE1RHFUFqe5AfiwlINXisXfDGro23fWdPUfOMjRY=
-+github.com/xtaci/smux v1.5.24 h1:77emW9dtnOxxOQ5ltR+8BbsX1kzcOxQ5gB+aaV9hXOY=
-+github.com/xtaci/smux v1.5.24/go.mod h1:OMlQbT5vcgl2gb49mFkYo6SMf+zP3rcjcwQz7ZU7IGY=
-+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
++github.com/xtaci/smux v1.5.55 h1:BdOj0tHZmiZOeZ8VQaOKpBcuL2MIMed5Ubhn5G3xDlo=
++github.com/xtaci/smux v1.5.55/go.mod h1:IGQ9QYrBphmb/4aTnLEcJby0TNr3NV+OslIOMrX825Q=
++golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
++golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
++golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
++golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
++golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
++golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
++golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
++golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 +gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 +gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- 
-2.45.1
-
diff --git a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
index a58b01a34cda..b0a3636ea924 100644
--- a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
+++ b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
@@ -41,7 +41,8 @@ buildGoModule rec {
     rm -rf vendor
   '';
 
-  vendorHash = "sha256-wK+aWRC5yrPtdihXAj6RlYC9ZTTPuGUg9wLY33skzeE=";
+  proxyVendor = true;
+  vendorHash = "sha256-pQAet0dYsLeXwpbCHSbqiIWXQ0mM2X/cKHqkx0BuwLY=";
 
   subPackages = [ "src/sessionmanagerplugin-main" ];
 
diff --git a/pkgs/by-name/su/sundials/package.nix b/pkgs/by-name/su/sundials/package.nix
index 29ca0a19b99a..2fac59ab8d93 100644
--- a/pkgs/by-name/su/sundials/package.nix
+++ b/pkgs/by-name/su/sundials/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sundials";
-  version = "7.5.0";
+  version = "7.6.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "LLNL";
     repo = "sundials";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZyUTFaMEbfNtR9oGIy0fQ+qQwb3hQ7CxTv9IevkeidE=";
+    hash = "sha256-DdVZXFfQXpJ9z5ikaK1ZQ/ZkL/vAGdlNsE9MJsIkLdM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/surge-XT/package.nix b/pkgs/by-name/su/surge-XT/package.nix
index 82ec458255eb..daee093f35c0 100644
--- a/pkgs/by-name/su/surge-XT/package.nix
+++ b/pkgs/by-name/su/surge-XT/package.nix
@@ -77,15 +77,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = (
-    toString [
-      "-lX11"
-      "-lXext"
-      "-lXcursor"
-      "-lXinerama"
-      "-lXrandr"
-    ]
-  );
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+  ];
 
   passthru = {
     rev-prefix = "release_xt_";
diff --git a/pkgs/by-name/sv/svelte-language-server/package.nix b/pkgs/by-name/sv/svelte-language-server/package.nix
index c0c89f5b63c8..416f05b9b1b3 100644
--- a/pkgs/by-name/sv/svelte-language-server/package.nix
+++ b/pkgs/by-name/sv/svelte-language-server/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "svelte-language-server";
-  version = "0.17.21";
+  version = "0.17.25";
 
   src = fetchFromGitHub {
     owner = "sveltejs";
     repo = "language-tools";
     tag = "svelte-language-server@${finalAttrs.version}";
-    hash = "sha256-HNd4M7bFTN0oFdO44w8Rgz45mDLrJ/ksZKB0iPw6t1s=";
+    hash = "sha256-N20OAIepguiPZ3EqAB/AUgx7VGrmywbLTXv/M6URbJk=";
   };
 
   pnpmWorkspaces = [ "svelte-language-server..." ];
diff --git a/pkgs/by-name/sv/svnfs/package.nix b/pkgs/by-name/sv/svnfs/package.nix
index 2c07913c63d2..d955b25b5a41 100644
--- a/pkgs/by-name/sv/svnfs/package.nix
+++ b/pkgs/by-name/sv/svnfs/package.nix
@@ -41,12 +41,20 @@ stdenv.mkDerivation (finalAttrs: {
     export LD_LIBRARY_PATH=${subversion.out}/lib
   '';
 
-  # -fcommon: workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: svnclient.o:/build/svnfs-0.4/src/svnfs.h:40: multiple definition of
-  #     `dirbuf'; svnfs.o:/build/svnfs-0.4/src/svnfs.h:40: first defined here
-  env.NIX_CFLAGS_COMPILE = "-I ${subversion.dev}/include/subversion-1 -fcommon";
-  NIX_LDFLAGS = "-lsvn_client-1 -lsvn_subr-1";
+  env = {
+    # -fcommon: workaround build failure on -fno-common toolchains like upstream
+    # gcc-10. Otherwise build fails as:
+    #   ld: svnclient.o:/build/svnfs-0.4/src/svnfs.h:40: multiple definition of
+    #     `dirbuf'; svnfs.o:/build/svnfs-0.4/src/svnfs.h:40: first defined here
+    NIX_CFLAGS_COMPILE = toString [
+      "-I ${subversion.dev}/include/subversion-1"
+      "-fcommon"
+    ];
+    NIX_LDFLAGS = toString [
+      "-lsvn_client-1"
+      "-lsvn_subr-1"
+    ];
+  };
 
   meta = {
     description = "FUSE filesystem for accessing Subversion repositories";
diff --git a/pkgs/by-name/sw/swt/package.nix b/pkgs/by-name/sw/swt/package.nix
index b08b779814ff..db2f8ad1b41d 100644
--- a/pkgs/by-name/sw/swt/package.nix
+++ b/pkgs/by-name/sw/swt/package.nix
@@ -76,19 +76,24 @@ stdenv.mkDerivation (finalAttrs: {
     libGLU
   ];
 
-  SWT_JAVA_HOME = jdk;
-  AWT_LIB_PATH = "${jdk}/lib/openjdk/lib";
-  # Used by the makefile which is responsible for the shared objects only
-  OUTPUT_DIR = "${placeholder "out"}/lib";
   # GTK4 is not supported yet. See:
   # https://github.com/eclipse-platform/eclipse.platform.swt/issues/652
   makeFlags = lib.optionals stdenv.hostPlatform.isLinux [ "gtk3" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux "-std=gnu17";
+  env = {
+    SWT_JAVA_HOME = jdk;
+    AWT_LIB_PATH = "${jdk}/lib/openjdk/lib";
+    # Used by the makefile which is responsible for the shared objects only
+    OUTPUT_DIR = "${placeholder "out"}/lib";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux "substituteInPlace library/make_linux.mak --replace-fail 'CFLAGS += -Werror' ''";
   preBuild = lib.optionalString stdenv.hostPlatform.isLinux ''
     cd library
-    mkdir -p ${finalAttrs.OUTPUT_DIR}
+    mkdir -p $OUTPUT_DIR
   '';
 
   # Build the jar (Linux only, Darwin uses prebuilt)
diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index d165241db53f..1bd55fc5d4ab 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${version}";
-    hash = "sha256-ytABOKqW1wUl715JW9QD3twwXLq77x0PlIlFwQbfjjc=";
+    hash = "sha256-2mNGKftkqRGrAstjEmVuzix4Ls75vYsop+E9EyBWwrw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/sy/sylpheed/package.nix b/pkgs/by-name/sy/sylpheed/package.nix
index f6149e7e9b6f..f30cee26dba6 100644
--- a/pkgs/by-name/sy/sylpheed/package.nix
+++ b/pkgs/by-name/sy/sylpheed/package.nix
@@ -54,7 +54,9 @@ stdenv.mkDerivation rec {
   configureFlags = lib.optional gpgSupport "--enable-gpgme" ++ lib.optional sslSupport "--enable-ssl";
 
   # Undefined symbols for architecture arm64: "_OBJC_CLASS_$_NSAutoreleasePool"
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework Foundation";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework Foundation";
+  };
 
   meta = {
     homepage = "https://sylpheed.sraoss.jp/en/";
diff --git a/pkgs/by-name/ta/talloc/package.nix b/pkgs/by-name/ta/talloc/package.nix
index ac7cd1b5d6ba..54d20c9aaeb5 100644
--- a/pkgs/by-name/ta/talloc/package.nix
+++ b/pkgs/by-name/ta/talloc/package.nix
@@ -60,15 +60,18 @@ stdenv.mkDerivation rec {
     "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
 
-  # python-config from build Python gives incorrect values when cross-compiling.
-  # If python-config is not found, the build falls back to using the sysconfig
-  # module, which works correctly in all cases.
-  PYTHON_CONFIG = "/invalid";
-
-  # https://reviews.llvm.org/D135402
-  NIX_LDFLAGS = lib.optional (
-    stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
-  ) "--undefined-version";
+  env = {
+    # python-config from build Python gives incorrect values when cross-compiling.
+    # If python-config is not found, the build falls back to using the sysconfig
+    # module, which works correctly in all cases.
+    PYTHON_CONFIG = "/invalid";
+  }
+  //
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://reviews.llvm.org/D135402
+        NIX_LDFLAGS = "--undefined-version";
+      };
 
   # this must not be exported before the ConfigurePhase otherwise waf whines
   preBuild = lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/by-name/ta/taskflow/package.nix b/pkgs/by-name/ta/taskflow/package.nix
index cfe18e3c20a6..14e3cb8176e2 100644
--- a/pkgs/by-name/ta/taskflow/package.nix
+++ b/pkgs/by-name/ta/taskflow/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taskflow";
-  version = "3.11.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GIP/69JlygdmryRA4uiyXM3FZZ0wkvP3DceYGkn4+QY=";
+    hash = "sha256-cWnKA6tCsKRfkleBJ38NRP2ciJu4sHtyTS8y5bBTfcA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/td/tdb/package.nix b/pkgs/by-name/td/tdb/package.nix
index 7d30160aac5d..51242259b991 100644
--- a/pkgs/by-name/td/tdb/package.nix
+++ b/pkgs/by-name/td/tdb/package.nix
@@ -83,15 +83,18 @@ stdenv.mkDerivation rec {
     else
       null;
 
-  # python-config from build Python gives incorrect values when cross-compiling.
-  # If python-config is not found, the build falls back to using the sysconfig
-  # module, which works correctly in all cases.
-  PYTHON_CONFIG = "/invalid";
-
-  # https://reviews.llvm.org/D135402
-  NIX_LDFLAGS = lib.optional (
-    stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
-  ) "--undefined-version";
+  env = {
+    # python-config from build Python gives incorrect values when cross-compiling.
+    # If python-config is not found, the build falls back to using the sysconfig
+    # module, which works correctly in all cases.
+    PYTHON_CONFIG = "/invalid";
+  }
+  //
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://reviews.llvm.org/D135402
+        NIX_LDFLAGS = "--undefined-version";
+      };
 
   meta = {
     description = "Trivial database";
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index 4cdfa2971b2f..e7ecedc183e0 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.37.1";
+  version = "1.37.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-UXJxIgqhbqGPSHdGHQLyi6EFngZjfptmCnhfhAwqKEg=";
+    hash = "sha256-5sgDhA9+Z33dvYlhYq80T12JSJOC5QXejms8COsGiQA=";
   };
 
-  vendorHash = "sha256-7tVxLeIz5wl5+Qvcq96bFixfwqDmlHlvB7hnzI3DolI=";
+  vendorHash = "sha256-xpPYXHDL0h2P3trH5SlWTvLKqjbb5mClwfd5TU0lKQc=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/te/terraria-server/package.nix b/pkgs/by-name/te/terraria-server/package.nix
index a19b3c102f92..2e3ada02c8aa 100644
--- a/pkgs/by-name/te/terraria-server/package.nix
+++ b/pkgs/by-name/te/terraria-server/package.nix
@@ -5,26 +5,26 @@
 
   autoPatchelfHook,
   unzip,
-  zlib,
+  sdl3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "terraria-server";
-  version = "1.4.5.0";
-  urlVersion = lib.replaceStrings [ "." ] [ "" ] version;
+  version = "1.4.5.3";
+  urlVersion = lib.replaceStrings [ "." ] [ "" ] finalAttrs.version;
 
   src = fetchurl {
-    url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${urlVersion}.zip";
-    hash = "sha256-PRA7cCFL2WJlT5Bat24PSgs9rhLu4C2mu5zWbut3kdQ=";
+    url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${finalAttrs.urlVersion}.zip";
+    hash = "sha256-5W6XpGaWQTs9lSy1UJq60YR6mfvb3LTts9ppK05XNCg=";
   };
 
   nativeBuildInputs = [
     autoPatchelfHook
     unzip
   ];
+
   buildInputs = [
     stdenv.cc.cc.libgcc
-    zlib
   ];
 
   installPhase = ''
@@ -35,6 +35,10 @@ stdenv.mkDerivation rec {
     chmod +x "$out/Linux/TerrariaServer.bin.x86_64"
     ln -s "$out/Linux/TerrariaServer.bin.x86_64" $out/bin/TerrariaServer
 
+    # use our own SDL3 library
+    rm $out/Linux/lib64/libSDL3.so.0
+    ln -s ${lib.getLib sdl3}/lib/libSDL3.so.0 $out/Linux/lib64/libSDL3.so.0
+
     runHook postInstall
   '';
 
@@ -45,8 +49,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.unfree;
     mainProgram = "TerrariaServer";
     maintainers = with lib.maintainers; [
-      ncfavier
       tomasajt
     ];
   };
-}
+})
diff --git a/pkgs/by-name/th/thttpd/package.nix b/pkgs/by-name/th/thttpd/package.nix
index 0b41027b0926..d6cccdf080e1 100644
--- a/pkgs/by-name/th/thttpd/package.nix
+++ b/pkgs/by-name/th/thttpd/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   # Work around failures with GCC 14, upstream is inactive unfortunately
   # https://gcc.gnu.org/gcc-14/porting_to.html#warnings-as-errors
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=implicit-int"
     "-Wno-error=implicit-function-declaration"
   ];
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 4c19300ac27d..d1af82448e81 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-+zyLB0kQNXgAxSK0mN6U8oVtzzjBoCrUHaUtuKh6gIE=";
-    "x86_64-linux" = "sha256-I5sfkiM+BVoeatsdgqOoT+vd/sFO1E+ecWlmsWhE41o=";
-    "aarch64-linux" = "sha256-vXriDBY4pE/gFqec7hPLTX5ymyQge5wTjnIMe5CWDd4=";
+    "universal-macos" = "sha256-xYntVFki+UgunpqTdo6PREWl7Lv+KnaMRwOUwQ24OmU=";
+    "x86_64-linux" = "sha256-OKb32S6uSTuhVSbLXrV9MhYO+ot8BaPQOBeibFKlbnI=";
+    "aarch64-linux" = "sha256-7/zZ3fXypypXT8ck++mT3InmUG1RHtbme6B2cVUx074=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.68";
+  version = "0.16.69";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/tl/tlsinfo/package.nix b/pkgs/by-name/tl/tlsinfo/package.nix
index ae800d52fbcc..61118ac74922 100644
--- a/pkgs/by-name/tl/tlsinfo/package.nix
+++ b/pkgs/by-name/tl/tlsinfo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tlsinfo";
-  version = "0.1.52";
+  version = "0.1.53";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "tlsinfo";
     tag = "v${version}";
-    hash = "sha256-ZAK8F6qQo3lAwtal1fh7OVLYC3gjBTeLQPQQjrmfTSM=";
+    hash = "sha256-ZP9juaZ2jsXSnvz1RxJ/841QgYvSYupdG2OqOOm55U4=";
   };
 
-  vendorHash = "sha256-2jO7pd90gD0CWrj18gOwK7vBVKDeWARzvkcutOlmggc=";
+  vendorHash = "sha256-rxTiIGIdSSwS1UdBjWmNz5iUlkUb1htDCa5XRpFLUw8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 55ee5d1f6b75..96f229f1885c 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "16.8.0";
+  version = "16.9.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${version}";
-    hash = "sha256-6TimSkPxmDvXAPDlLbPYpnXg20dTbBKzv1Lj0tI973U=";
+    hash = "sha256-jWjyW/CYrPt8gEgCa1T56+5sBtaNpnV6RZz30S6nYIs=";
   };
 
-  cargoHash = "sha256-DehLOUrqxGvlNw/12PyDOtyGuZThx/jqqjmKltqk7Ck=";
+  cargoHash = "sha256-WScgutM8e/lwYQBjyZGG/9ieLoaPQA+X1IhRlz3Izew=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/to/touchosc/package.nix b/pkgs/by-name/to/touchosc/package.nix
index ff1072178e77..6844b75d4341 100644
--- a/pkgs/by-name/to/touchosc/package.nix
+++ b/pkgs/by-name/to/touchosc/package.nix
@@ -46,7 +46,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "touchosc";
-  version = "1.4.5.238";
+  version = "1.4.7.243";
 
   suffix =
     {
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
     url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-ITuIQfBw5LIN3sc11G78Pd5Ca4KDqxPhc9ArpGKBNzo=";
-        armv7l-linux = "sha256-DF7jTVp5Xieop6Q/EVznQmDlFFA5qaizXAoNwCXs/Hc=";
-        x86_64-linux = "sha256-6KpdwGXbyYwT0VhwPS9yP0c6HXUjKkGGmvZDiwQvlBw=";
+        aarch64-linux = "sha256-WHjtjxSLphODnYynKX5oYRirBWnv0wTh5mxCrw5DL3c=";
+        armv7l-linux = "sha256-g426dUSJ5UC4k2s/a8sFLNG0q0xyvPh824jXDHN+2SM=";
+        x86_64-linux = "sha256-MD3wxGM04x7gBoHS2J1I0hGGbgDZeEUTFCaEUsM/R6E=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 0efd23432ec7..719cac56141c 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.89.11";
+  version = "2.89.13";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RyIzWZScUmG3bApAazIlJ3M3KkOLFAC9JKAXFNkJyYA=";
+    hash = "sha256-XtZfLjyN3Ve8PiKTzePE7zwyI/wKV2GUMLOn6zQDdyk=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ts/tsgolint/package.nix b/pkgs/by-name/ts/tsgolint/package.nix
index d7ad26cc72d3..d9daa29e6f1a 100644
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tsgolint";
-  version = "0.11.2";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "tsgolint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gby8JW3bwVOIuNgLCIIt0y3egdljrR5cgbqAGqqqzpI=";
+    hash = "sha256-/1od2yijBSTi5PFhEQ95KTjQJYYgXRX4v6M/lIfQXtM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/tv/tvm/package.nix b/pkgs/by-name/tv/tvm/package.nix
index 237942231276..5bf348d96614 100644
--- a/pkgs/by-name/tv/tvm/package.nix
+++ b/pkgs/by-name/tv/tvm/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tvm";
-  version = "0.19.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "incubator-tvm";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-/5IpOraFTgg6sQ1TLHoepq/C8VHKg5BXKrNMBSyYajA=";
+    hash = "sha256-KcHUcblwtqxNofHKofuQHu2d7hIqS9FUvc41OkCVtnY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/uh/uhhyou-plugins-juce/package.nix b/pkgs/by-name/uh/uhhyou-plugins-juce/package.nix
index 71cb46c212b2..57539ddbc467 100644
--- a/pkgs/by-name/uh/uhhyou-plugins-juce/package.nix
+++ b/pkgs/by-name/uh/uhhyou-plugins-juce/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Disable LTO to avoid optimization mismatch issues
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-fno-lto"
   ];
 
diff --git a/pkgs/by-name/uk/ukmm/package.nix b/pkgs/by-name/uk/ukmm/package.nix
index 0c6361ede8e3..7bfc0796afef 100644
--- a/pkgs/by-name/uk/ukmm/package.nix
+++ b/pkgs/by-name/uk/ukmm/package.nix
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Force linking to libEGL, which is always dlopen()ed, and to
   # libwayland-client & libxkbcommon, which is dlopen()ed based on the
   # winit backend.
-  env.NIX_LDFLAGS = [
+  env.NIX_LDFLAGS = toString [
     "--push-state"
     "--no-as-needed"
     "-lEGL"
diff --git a/pkgs/by-name/up/upsies/package.nix b/pkgs/by-name/up/upsies/package.nix
index c7218760da58..7fbb97301e17 100644
--- a/pkgs/by-name/up/upsies/package.nix
+++ b/pkgs/by-name/up/upsies/package.nix
@@ -18,14 +18,14 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "upsies";
-  version = "2026.01.03";
+  version = "2026.01.26";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "plotski";
     repo = "upsies";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ya1v0DR5a4fPsFVJKVSDbgy+hWE136aRV3pFMExlRhU=";
+    hash = "sha256-gsWIyyUkpdUQjwZJXcevMLG0T1fgJj7brbVHfcks31w=";
   };
 
   patches = [
diff --git a/pkgs/by-name/us/userborn/package.nix b/pkgs/by-name/us/userborn/package.nix
index 331b44575634..0fa93590ebb3 100644
--- a/pkgs/by-name/us/userborn/package.nix
+++ b/pkgs/by-name/us/userborn/package.nix
@@ -9,18 +9,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "userborn";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nikstur";
     repo = "userborn";
     rev = version;
-    hash = "sha256-Zh2u7we/MAIM7varuJA4AmEWeSMuA/C+0NSIUJN7zTs=";
+    hash = "sha256-mXXakR75Iz6AFf/TYgIHE8SxOri2HyReYUYTT3lCEPA=";
   };
 
   sourceRoot = "${src.name}/rust/userborn";
 
-  cargoHash = "sha256-oLw/I8PEv75tz+KxbIJrwl8Wr0I/RzDh1SDZ6mRQpL8=";
+  cargoHash = "sha256-uAid5GsM9lasVQAYfeo9jwp4xg1MrXdJqtD0l6ME6OQ=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index a47b6d3e966c..8a99d4b75422 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -21,13 +21,13 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-U9godsxtyWOFhrE8CaQesWoeKWmitADp2jyJU/1fPKA=";
+    hash = "sha256-/GLDcqbNRO2NV+tW5yRZ0BdGJ+R3S3CPBPuBXpCIWuU=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-V53qD7SujN8bEdNwcBshdkNeYdk+4Whr+XiYHO1iLXs=";
+    hash = "sha256-DrDfbf7UMEeNRvCHsu1Kbr+4PWkckmMvy8sEpjEgJfg=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/ux/uxplay/package.nix b/pkgs/by-name/ux/uxplay/package.nix
index b68eb65092e7..a685b40dfaa6 100644
--- a/pkgs/by-name/ux/uxplay/package.nix
+++ b/pkgs/by-name/ux/uxplay/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxplay";
-  version = "1.72.3";
+  version = "1.73";
 
   src = fetchFromGitHub {
     owner = "FDH2";
     repo = "UxPlay";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c0uiMuilAoFMd2pCP9wFtPKJJWyYLZwmNiL8rPtfdQ8=";
+    hash = "sha256-cPewe1pO/PknEBogcXU5WdDOvqya7bC6aIt3itHsrEw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/va/vanillatd/package.nix b/pkgs/by-name/va/vanillatd/package.nix
index 7cff83871c5a..f700ef09d791 100644
--- a/pkgs/by-name/va/vanillatd/package.nix
+++ b/pkgs/by-name/va/vanillatd/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-iUF9UFc0FMvOwLkGqSyLYGy5E8YqNySqDp5VVUa+u4o=";
   };
   # TODO: Remove this. Just add this flag to ignore the format-security error temporarily.
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
 
   buildInputs = [
     SDL2
diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix
index ab3eac0ccdae..7ec0a9906f39 100644
--- a/pkgs/by-name/ve/vector/package.nix
+++ b/pkgs/by-name/ve/vector/package.nix
@@ -121,6 +121,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=sources::socket::test::multicast_udp_message"
     "--skip=sources::socket::test::multiple_multicast_addresses_udp_message"
     "--skip=sources::syslog::test::test_udp_syslog"
+
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
+    # Fails on aarch64-darwin (https://github.com/vectordotdev/vector/issues/23813)
+    "--skip=sources::file::tests::file_start_position_server_restart_unfinalized"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+    # Flakey on aarch64-linux
+    "--skip=topology::test::backpressure::buffer_drop_fan_out"
+    "--skip=topology::test::backpressure::default_fan_out"
+    "--skip=topology::test::backpressure::serial_backpressure"
   ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/ve/velocity/deps.json b/pkgs/by-name/ve/velocity/deps.json
index 055ea010c717..0d16db28b2a6 100644
--- a/pkgs/by-name/ve/velocity/deps.json
+++ b/pkgs/by-name/ve/velocity/deps.json
@@ -19,23 +19,23 @@
    "module": "sha256-IFNqlfL+sr9DBRKMaq7Lb9idxFeYqchfJgK4qAnXUNs=",
    "pom": "sha256-Q1z/VXiZht7arXF/aPuo1UgklHhWLc2EsirU1lZvRAs="
   },
-  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.2.0": {
-   "pom": "sha256-1nvChuPoUGCKeXA1XY4yL092A083D/D73dt77fivYns="
+  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.2.1": {
+   "pom": "sha256-MGt3fcOfRP7GK1C97+QbcWvrD9fNP4FXInOhNMLhVbk="
   },
-  "com/diffplug/spotless#spotless-lib-extra/4.2.0": {
-   "jar": "sha256-Zn7uviqjTQpRIc8koZdrPBRQytwKEdqw3BEWokXPScY=",
-   "module": "sha256-pUwFcWAoiUFDeZCuqzXavd6Ri/zfyNLPwWhDCp5cxTQ=",
-   "pom": "sha256-ZRIf+E/eD++jtNXrBKnPVka8z5JFqCfPzHyJFDr3t34="
+  "com/diffplug/spotless#spotless-lib-extra/4.3.0": {
+   "jar": "sha256-dU+ATAnfouuNU5YzEdK+aPG0pWIQEdy1UNcC6tKGUdk=",
+   "module": "sha256-yImJBeaSp+CHATV8PK0NT+JqogjNerDe2NcNOSnLoRI=",
+   "pom": "sha256-C5N93//pxrgmIDYU755aLQs8INjMa3kitIgdl9MbaJ0="
   },
-  "com/diffplug/spotless#spotless-lib/4.2.0": {
-   "jar": "sha256-8qOe5LxqmL29ariGw10jhSKs/j+wr5Wpyn+Nm2yi6JQ=",
-   "module": "sha256-2gdqn2UEezS5yUcJsbIWKqhF90EyBPtA8tmYWK5u1sY=",
-   "pom": "sha256-0P1S3Sgh90tZmdl1DnIzh3dyMY/6GEdbB6ItWDrjPcg="
+  "com/diffplug/spotless#spotless-lib/4.3.0": {
+   "jar": "sha256-Zp+ETsCpdJQcbaBLZwdI9DF4I5ttmf3bWwYs6dBtCTk=",
+   "module": "sha256-I1HAgP4kVTNGAv/QqCHYit9ipT5uoYTEOV9PVQXeNyM=",
+   "pom": "sha256-dPwsK8oRHUP/q/jWPYuegjpEOIWHevxxWInI6ckUaNM="
   },
-  "com/diffplug/spotless#spotless-plugin-gradle/8.2.0": {
-   "jar": "sha256-ohJ5aiQ3M5+oH1hCQ7WfBtUas6mjQPLN9rGUBEQXefY=",
-   "module": "sha256-NMCTxQIrGzueJvGDW6JYNKMV7a41/2bv+iE5528MEiw=",
-   "pom": "sha256-yZIwMm954KZ4M0gs0HWGn8qyIrf17xuZpnOH5RjyAio="
+  "com/diffplug/spotless#spotless-plugin-gradle/8.2.1": {
+   "jar": "sha256-2/RPjfGDKAAkHU8TUSn8khuoL7ItckMMxC1NPVu/nTw=",
+   "module": "sha256-OPb28k3QWmJskcwWOvTThnq9UPCGdnqmTaJfMg+ik5s=",
+   "pom": "sha256-s578nCtRfx6eiNa+IvYyYZ3oOqDi49F1RaAXUDtxNPg="
   },
   "com/google/code/gson#gson-parent/2.8.9": {
    "pom": "sha256-sW4CbmNCfBlyrQ/GhwPsN5sVduQRuknDL6mjGrC7z/s="
@@ -211,6 +211,9 @@
    "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
    "pom": "sha256-X0As+413MZW5ZwUBJMnom1+EsXJGThiUkpeJv1xMLyk="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.0": {
+   "pom": "sha256-36lkSmrluJjuR1ux9X6DC6H3cK7mycFfgRKqOBGAGEo="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.21": {
    "pom": "sha256-m7EH1dXjkwvFl38AekPNILfSTZGxweUo6m7g8kjxTTY="
   },
@@ -301,20 +304,20 @@
    "module": "sha256-IFNqlfL+sr9DBRKMaq7Lb9idxFeYqchfJgK4qAnXUNs=",
    "pom": "sha256-Q1z/VXiZht7arXF/aPuo1UgklHhWLc2EsirU1lZvRAs="
   },
-  "com/diffplug/spotless#spotless-lib-extra/4.2.0": {
-   "jar": "sha256-Zn7uviqjTQpRIc8koZdrPBRQytwKEdqw3BEWokXPScY=",
-   "module": "sha256-pUwFcWAoiUFDeZCuqzXavd6Ri/zfyNLPwWhDCp5cxTQ=",
-   "pom": "sha256-ZRIf+E/eD++jtNXrBKnPVka8z5JFqCfPzHyJFDr3t34="
+  "com/diffplug/spotless#spotless-lib-extra/4.3.0": {
+   "jar": "sha256-dU+ATAnfouuNU5YzEdK+aPG0pWIQEdy1UNcC6tKGUdk=",
+   "module": "sha256-yImJBeaSp+CHATV8PK0NT+JqogjNerDe2NcNOSnLoRI=",
+   "pom": "sha256-C5N93//pxrgmIDYU755aLQs8INjMa3kitIgdl9MbaJ0="
   },
-  "com/diffplug/spotless#spotless-lib/4.2.0": {
-   "jar": "sha256-8qOe5LxqmL29ariGw10jhSKs/j+wr5Wpyn+Nm2yi6JQ=",
-   "module": "sha256-2gdqn2UEezS5yUcJsbIWKqhF90EyBPtA8tmYWK5u1sY=",
-   "pom": "sha256-0P1S3Sgh90tZmdl1DnIzh3dyMY/6GEdbB6ItWDrjPcg="
+  "com/diffplug/spotless#spotless-lib/4.3.0": {
+   "jar": "sha256-Zp+ETsCpdJQcbaBLZwdI9DF4I5ttmf3bWwYs6dBtCTk=",
+   "module": "sha256-I1HAgP4kVTNGAv/QqCHYit9ipT5uoYTEOV9PVQXeNyM=",
+   "pom": "sha256-dPwsK8oRHUP/q/jWPYuegjpEOIWHevxxWInI6ckUaNM="
   },
-  "com/diffplug/spotless#spotless-plugin-gradle/8.2.0": {
-   "jar": "sha256-ohJ5aiQ3M5+oH1hCQ7WfBtUas6mjQPLN9rGUBEQXefY=",
-   "module": "sha256-NMCTxQIrGzueJvGDW6JYNKMV7a41/2bv+iE5528MEiw=",
-   "pom": "sha256-yZIwMm954KZ4M0gs0HWGn8qyIrf17xuZpnOH5RjyAio="
+  "com/diffplug/spotless#spotless-plugin-gradle/8.2.1": {
+   "jar": "sha256-2/RPjfGDKAAkHU8TUSn8khuoL7ItckMMxC1NPVu/nTw=",
+   "module": "sha256-OPb28k3QWmJskcwWOvTThnq9UPCGdnqmTaJfMg+ik5s=",
+   "pom": "sha256-s578nCtRfx6eiNa+IvYyYZ3oOqDi49F1RaAXUDtxNPg="
   },
   "com/electronwill/night-config#core/3.8.3": {
    "jar": "sha256-lx3IjBwiCFYR7hwwD1u/hZWTgXjoGb77temMPL0nK3k=",
@@ -426,10 +429,6 @@
    "jar": "sha256-xiIXY715xPHD3H91C18poLs4s2e4ExTE9xiW40DECCU=",
    "pom": "sha256-pTMaDstUj5lCq1uTx6xDw4oh6Jd2Pd4bzb8HdPQWym8="
   },
-  "com/google/errorprone#error_prone_annotations/2.11.0": {
-   "jar": "sha256-chy5GEK0b6BWhH0QTVIlyLjh6LYiY7mTBR4eWgE3t+w=",
-   "pom": "sha256-AmHKAfLS6awq4uznXULFYyOzhfspS2vJQ/Yu9Okt3wg="
-  },
   "com/google/errorprone#error_prone_annotations/2.18.0": {
    "jar": "sha256-nmgUy3GBaYik/RsHqZOo8hu3BY1SLBYrHehJ4ZvqVK4=",
    "pom": "sha256-kgE1eX3MpZF7WlwBdkKljTQKTNG80S9W+JKlZjvXvdw="
@@ -449,9 +448,6 @@
    "jar": "sha256-SCcudcFuH3vce9GVKcys1e4XBARwHX9aI0QbtYR5V/U=",
    "pom": "sha256-T2uIia+o3r2+Hj/ipfjmbiIWygtWPya05UE4cw7s3IA="
   },
-  "com/google/errorprone#error_prone_parent/2.11.0": {
-   "pom": "sha256-goPwy0TGJKedMwtv2AuLinFaaLNoXJqVHD3oN9RUBVE="
-  },
   "com/google/errorprone#error_prone_parent/2.18.0": {
    "pom": "sha256-R/Iumce/RmOR3vFvg3eYXl07pvW7z2WFNkSAVRPhX60="
   },
@@ -484,9 +480,6 @@
   "com/google/guava#guava-parent/27.1-jre": {
    "pom": "sha256-02EBZcbeK02NZBhIdxe2PFK1o5xeNaVT4khz7LYOBig="
   },
-  "com/google/guava#guava-parent/31.1-jre": {
-   "pom": "sha256-RDliZ4O0StJe8F/wdiHdS7eWzE608pZqSkYf6kEw4Pw="
-  },
   "com/google/guava#guava-parent/32.0.1-jre": {
    "pom": "sha256-Q+0ONrNT9B5et1zXVmZ8ni35fO8G6xYGaWcVih0DTSo="
   },
@@ -504,10 +497,6 @@
    "jar": "sha256-SlqnDMlopNE35ZmtN1U+XP7tImXowZNHbXEZA2xTb+c=",
    "pom": "sha256-vZnXUAYTGuJcmGCh1j6E42Nx8RL9sML+PV1qs46esnE="
   },
-  "com/google/guava#guava/31.1-jre": {
-   "jar": "sha256-pC7cnKt5Ljn+ObuU8/ymVe0Vf/h6iveOHWulsHxKAKs=",
-   "pom": "sha256-kZPQe/T2YBCNc1jliyfSG0TjToDWc06Y4hkWN28nDeI="
-  },
   "com/google/guava#guava/32.0.1-jre": {
    "jar": "sha256-vX+iJ1kfuFCWd9DREiz5UVjzuKn0VlP1goHYefbcSMU=",
    "pom": "sha256-QsJX9/c203ezGv7u6XirJtcwzXCvYN3nZi4YI1LiSCo="
@@ -539,10 +528,6 @@
    "jar": "sha256-KZSn63jycQvT07+2ObLJTiGc7awNTQhNUW54wW3d7PY=",
    "pom": "sha256-8MmMVx6Tp8tN0Y3w+jCPCWPnoGIKwtQkTmHnCdA61r4="
   },
-  "com/google/j2objc#j2objc-annotations/1.3": {
-   "jar": "sha256-Ia8wySJnvWEiwOC00gzMtmQaN+r5VsZUDsRx1YTmSns=",
-   "pom": "sha256-X6yoJLoRW+5FhzAzff2y/OpGui/XdNQwTtvzD6aj8FU="
-  },
   "com/google/j2objc#j2objc-annotations/2.8": {
    "jar": "sha256-8CqV+hpele2z7YWf0Pt99wnRIaNSkO/4t03OKrf01u0=",
    "pom": "sha256-N/h3mLGDhRE8kYv6nhJ2/lBzXvj6hJtYAMUZ1U2/Efg="
@@ -572,13 +557,9 @@
    "module": "sha256-/ccJZrzS41x5Tc4sF7mZwuZpUOFYUx6Z3BUfsOvCllM=",
    "pom": "sha256-oX8TWPGK17qq5NszR8IAtPOu3Q2cd25yrPYplNTH+9E="
   },
-  "com/moandjiezana/toml#toml4j/0.7.2": {
-   "jar": "sha256-9UdeY+fonl22IiNImux6Vr0wNUN3IHehfCy1TBnKOiA=",
-   "pom": "sha256-W3YhZzfy2pODlTrMybpY9uc500Rnh5nm1NCCz24da9M="
-  },
-  "com/puppycrawl/tools#checkstyle/10.9.3": {
-   "jar": "sha256-1X3pra1Cq2C7KXLlD4OhMcqm9iNHhPWUOjhxIAZhWR8=",
-   "pom": "sha256-qDfEUo/JqQ1oi8lQOcdSSCQPfG16GonZSDro+CWc508="
+  "com/puppycrawl/tools#checkstyle/13.0.0": {
+   "jar": "sha256-5svIBFeWwxyNmv9mq+G/EfmhmHyI6SKfFn4+yec14P8=",
+   "pom": "sha256-MayhsoVeDtilJ17lMfDBluWdGfILo2Ix2T3CRoDwclQ="
   },
   "com/spotify#completable-futures/0.3.6": {
    "jar": "sha256-n0HBSTwY6CiJMqGDBzzjnhiGUtKsQBPt6rXHO7DYMZ8=",
@@ -605,13 +586,13 @@
    "jar": "sha256-qtv9WlJFUb7vENP4kdMFuDuyfVRwPZpN56yioS2YR+I=",
    "pom": "sha256-ffmOk+i9xqjtuGMUrIujHyYMvUoOa4b16a/JMlEu8Mc="
   },
-  "commons-beanutils#commons-beanutils/1.9.4": {
-   "jar": "sha256-fZOMgXiQKARcCMBl6UvnX8KAUnYg1b1itRnVg4UyNoo=",
-   "pom": "sha256-w1zKe2HUZ42VeMvAuQG4cXtTmr+SVEQdp4uP5g3gZNA="
+  "commons-beanutils#commons-beanutils/1.11.0": {
+   "jar": "sha256-nkS6aOyaPyEob6Kou7ADtzXA9pEBu0MUS3n0+KqnRwk=",
+   "pom": "sha256-z/nqsddRJkvXdbbj6+0WUHlMrJzYvhxBa0jjpcYTnZM="
   },
-  "commons-codec#commons-codec/1.15": {
-   "jar": "sha256-s+n21jp5AQm/DQVmEfvtHPaQVYJt7+uYlKcTadJG7WM=",
-   "pom": "sha256-yG7hmKNaNxVIeGD0Gcv2Qufk2ehxR3eUfb5qTjogq1g="
+  "commons-codec#commons-codec/1.11": {
+   "jar": "sha256-5ZnVMY6Xqkj0ITaikn5t+k6Igd/w5sjjEJ3bv/Ude30=",
+   "pom": "sha256-wecUDR3qj981KLwePFRErAtUEpcxH0X5gGwhPsPumhA="
   },
   "commons-codec#commons-codec/1.20.0": {
    "jar": "sha256-avZllfn2p7tYzmZRjWiI1AtUfDZtImLwZnbu4ZUo/2Y=",
@@ -630,114 +611,118 @@
    "module": "sha256-pnYDnqavCPJXtG4Hwr8VcaRqTUtbnMuGw/yY0H+v6hs=",
    "pom": "sha256-arSo7K4qu9NrkZ0Lm5+yTBdxSPE+U2TJegxu4Ro/xCY="
   },
-  "info/picocli#picocli/4.7.1": {
-   "jar": "sha256-DnGR++Mk+5340tIHwHtma43CW7vib1OkxS4v7OYkqXY=",
-   "pom": "sha256-+pvmlFd2A+LUy1X0UjctP2wPk+XzjuXNf7Yos3k8qbw="
+  "info/picocli#picocli/4.7.7": {
+   "jar": "sha256-+G4w//0Q0rE7jKqNSyN6fuYfL/zPWxlB3nGLdl0jW/g=",
+   "pom": "sha256-GxjTYxNN9mYx0rn3R1Bo1zQiW6OJzfkIKhvYvakNV9M="
+  },
+  "io/hotmoka#toml4j/0.7.3": {
+   "jar": "sha256-LuLTLMaF/I+YfMBZUFnRh+MyykHhropRX+rQNvt3e8E=",
+   "pom": "sha256-5uON4WRKo2jb7IdQeTRT7eHsXUGXLUTkkCcBBS5rpzw="
   },
   "io/leangen/geantyref#geantyref/1.3.16": {
    "jar": "sha256-fx1ZEJLVFCtqqnz1n5TEx01X2+7wOy+CYpSfjza6xuM=",
    "pom": "sha256-JCgbY4MutO8QZOfd/b57eWquGr+IeYrb9NC5ZpurpKQ="
   },
-  "io/netty#netty-buffer/4.2.7.Final": {
-   "jar": "sha256-uBYTyO0iscw57M8qKL0MHUVh+y5eVCBhYX70zh0ii/U=",
-   "pom": "sha256-6mGx9EqNui22yX8iou5DGsVil430rDlUcei28oZtwH4="
+  "io/netty#netty-buffer/4.2.9.Final": {
+   "jar": "sha256-0BOpas6kiJvAHuA3ONU8LkoF4/rsFMJakrQiTHfXpAg=",
+   "pom": "sha256-0Fsmqy58aeaUCb5HuFEA7lLe/0ox5c486Cdz39NrnvA="
   },
-  "io/netty#netty-codec-base/4.2.7.Final": {
-   "jar": "sha256-Y2BBW3yHFgr83l59SUbDVTm58EPoFmyRp//5XMYGfZ8=",
-   "pom": "sha256-Mu41Sjk4YJqMC/Ay9GxwqzJ9eFVR0mmDdwyakDIJKPo="
+  "io/netty#netty-codec-base/4.2.9.Final": {
+   "jar": "sha256-KEoouE9Uus42qeYC49lpRpbSLFbycZevBG4aZUfysJM=",
+   "pom": "sha256-zTp/Ub4OeSb6iZCf3cCPF4gpOm15MYDjnG5nIxKNyFI="
   },
-  "io/netty#netty-codec-compression/4.2.7.Final": {
-   "jar": "sha256-7dU600mRgEMBpGVxET2P+01vZ+bYdGdNr7uRVyQnXLM=",
-   "pom": "sha256-uAzpd/6sX//UviPOI03TtvtMNXVrJRL7AdzcAdinSoc="
+  "io/netty#netty-codec-compression/4.2.9.Final": {
+   "jar": "sha256-RSOmX+lb9HSv3Pr34sIUsIjSN22sxDc3virPloUgvn4=",
+   "pom": "sha256-9GACbD9AEEUjZC0xvhto19Jk672//Z1MUbOETdxF1FQ="
   },
-  "io/netty#netty-codec-haproxy/4.2.7.Final": {
-   "jar": "sha256-bwnVN5FKpGWJE4TIpM8NuXfdkAmgtzqBoFDwpsv6lfc=",
-   "pom": "sha256-Rc/v9/EyJXbOPaHMuoo0i0ANceNu1UVGEm1q1ZcJBPo="
+  "io/netty#netty-codec-haproxy/4.2.9.Final": {
+   "jar": "sha256-4UOPOyqbTtxS8ibk+ngEgY/5eQj2E2yxgNl3o4v/KTY=",
+   "pom": "sha256-RGfxxJoD1gIPRuSkrGZMqCMkkE6AeyWltgsbChQm6vs="
   },
-  "io/netty#netty-codec-http/4.2.7.Final": {
-   "jar": "sha256-KYTdOEIKYcTdaPysxR/8Uo60b3P3eVza/bOk1vy3aGI=",
-   "pom": "sha256-hQc6wlleQUiRi1psLnAZMtedm+GNTx212S1qojlj4oA="
+  "io/netty#netty-codec-http/4.2.9.Final": {
+   "jar": "sha256-p2zLXTLJc9OkY3EMm/gzVJlTVNHDnh5LxhVcYotxogo=",
+   "pom": "sha256-84KznS+10O4TatoYqKe262GNdquSV5vG7azxtEgNygc="
   },
-  "io/netty#netty-codec-marshalling/4.2.7.Final": {
-   "jar": "sha256-5VCtt1jupDqkneAOdBiwmJMXEdSjHWLmXEGwmUyVsjc=",
-   "pom": "sha256-77XNFeXpIODSbygJ+aiRp5fxOJ9hEX5VFLfmNaOPmjM="
+  "io/netty#netty-codec-marshalling/4.2.9.Final": {
+   "jar": "sha256-R5m90xTiOtMsJWx/XnOKUtC9l7nV/n8ujwiIBn9qDfc=",
+   "pom": "sha256-F3mnWzjkqUjxCCpjCituGG1sa12QT+zRstlbzt1H7Ko="
   },
-  "io/netty#netty-codec-protobuf/4.2.7.Final": {
-   "jar": "sha256-SyUlm2916/x38BSgj2m60BkRbU9cpUj9xB89rYwN4zE=",
-   "pom": "sha256-Ub3X5EMhhkFp9Oqt7RQaaXLBhkh+/fAa59t/3jaQcSU="
+  "io/netty#netty-codec-protobuf/4.2.9.Final": {
+   "jar": "sha256-EFYZ4pUDY5fwd4a1b8fk9FqB4lhybLCfVh/pDBZ/PEA=",
+   "pom": "sha256-/enz9XoZkMY08yG4yp5nnRHZ0LOiuzSGfGvHzoqaTco="
   },
-  "io/netty#netty-codec/4.2.7.Final": {
-   "jar": "sha256-XzaWWDgXiZmMBCqY8C2nHZw5iEu7T3/VgoL3ZeCcoDE=",
-   "pom": "sha256-5FSK3jVlANmEy7jJP9iEZacPdWHlGbyV6y/O7s4bKjE="
+  "io/netty#netty-codec/4.2.9.Final": {
+   "jar": "sha256-4pF9hkc0rOOV74xnY5F7fmAZrVO4p8+PQKO9UiaN50Q=",
+   "pom": "sha256-hi3Qk8SJSXMHZEsOuja+PG4wf4Vn3/veyEe3/QfX/l8="
   },
-  "io/netty#netty-common/4.2.7.Final": {
-   "jar": "sha256-I0W8DtWEP6V6pJ66Z1KUhcOh1CD88EKTJMgiDHqA6aY=",
-   "pom": "sha256-/jMRoayD8KGH/n2+Be6B6Ef2JvmtkN2wx4WusJ0Y/DM="
+  "io/netty#netty-common/4.2.9.Final": {
+   "jar": "sha256-mdll1QewlZmrLSFelAxpDU986M2X/xN3aqF+tODZC4o=",
+   "pom": "sha256-17ECJZg72gPp+Kgz1TmmARv8s6KF4jF2k/T5g5vXdzw="
   },
-  "io/netty#netty-handler/4.2.7.Final": {
-   "jar": "sha256-IdBjQJwS287EbTgMiFag97altou18dAF6wZbTWQUbLM=",
-   "pom": "sha256-79QqDJKAKPlJsWREfBtOFt7eccgihRppL1hzEhTr0oM="
+  "io/netty#netty-handler/4.2.9.Final": {
+   "jar": "sha256-4WEmxxHByCFzQogswNkIYAeFLLD5mjUc/r53JejH4QA=",
+   "pom": "sha256-VCVp7nmpH2qrBJqIv7LEVZipM+P6A5s/5/9A0q93XuM="
   },
-  "io/netty#netty-parent/4.2.7.Final": {
-   "pom": "sha256-56FYFCV9GpaNpyU3yRUscw7d9uf9Wj581wJuVclladM="
+  "io/netty#netty-parent/4.2.9.Final": {
+   "pom": "sha256-fNer5MWD6zruhW9zr3eijbvfN+e6osbqhaDZ49aLfsI="
   },
-  "io/netty#netty-resolver/4.2.7.Final": {
-   "jar": "sha256-fk1WmGfmwIQ3+yGiIOoBwpSw448BFJtoPIlaG82ShDg=",
-   "pom": "sha256-F6vZjvgRyuBYbZ41xMUUZ3GXLrJy+Fek2eDDBe0hs5g="
+  "io/netty#netty-resolver/4.2.9.Final": {
+   "jar": "sha256-9MN0KqQ0cA4KJj64rp4LGugmhnQ+IdD8a6NI2lljYFM=",
+   "pom": "sha256-k3hoxxGqjzahYshXlZg71DwnIOhKlnrLtbGsw3B0tcY="
   },
-  "io/netty#netty-transport-classes-epoll/4.2.7.Final": {
-   "jar": "sha256-RJKUjmp2lDmOUZfPFe0uIdZmKnOdAQrmZvonbnIihTw=",
-   "pom": "sha256-RoQ5xbLK4wAXuv2XaqJJfEiA/aYSSyPBrUKQt5CMXA8="
+  "io/netty#netty-transport-classes-epoll/4.2.9.Final": {
+   "jar": "sha256-s48fDtpKBDE4joyhrbuk3fpEzkZg417V7iiqMG29AAY=",
+   "pom": "sha256-Sd/PCNdBUhe9zdm4tQNnbMX41GbqCKkAnJnyMtlJ5/U="
   },
-  "io/netty#netty-transport-classes-io_uring/4.2.7.Final": {
-   "jar": "sha256-/5ZodMYvU+0HKWLxv128Sf3dS9PGC/yafhfONLOax68=",
-   "pom": "sha256-fEFSqfVOcE6KSVjdiggLCaW3d6jqcxjxKNfOM4ayqic="
+  "io/netty#netty-transport-classes-io_uring/4.2.9.Final": {
+   "jar": "sha256-6fnQYHSNgpbfMHiZI7KLPdgDmoVgYc6nRsYndd4WsMQ=",
+   "pom": "sha256-8JA/Icqjzvkn3u3k7dNJUmAdwIIHhLfE0+sY41djQ1A="
   },
-  "io/netty#netty-transport-classes-kqueue/4.2.7.Final": {
-   "jar": "sha256-o+sclK4aa+nh0exSw/XFEKdbBLjvHqhrfnez8Sh648w=",
-   "pom": "sha256-mtwTZN1F7chJ933s8SVy3FR4XPbqx5wuhqdyXRGhczM="
+  "io/netty#netty-transport-classes-kqueue/4.2.9.Final": {
+   "jar": "sha256-qkLN0FzSvETe6qrjSamIaatTi3AQKB4ADWs01eBXcKY=",
+   "pom": "sha256-zDAhOh/3GjlIFb1JT5s6XAHFFoCOOt/AYf9iUK1IaWU="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final": {
-   "jar": "sha256-vc+Af3LZqbf5hklxcQdlLKcVMkVwLomTnM63D4zKsY8=",
-   "pom": "sha256-ygZltZ4tBvqQRF5G/UBaYumOhrFL9TwC0eyCUYE8Vto="
+  "io/netty#netty-transport-native-epoll/4.2.9.Final": {
+   "jar": "sha256-p3hrxbHVhOgmKUkdYwC5RcGUBaVC38oVn5Y+RHpU9mc=",
+   "pom": "sha256-DTjTPWo8sDka1+RkhwRqHXeNaoZ0ugHymnni0j7h7OI="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final/linux-aarch_64": {
-   "jar": "sha256-LwxzCdffSKiPs3TALPtEbhoeX7WX+wLXc8cKwH2iwmg="
+  "io/netty#netty-transport-native-epoll/4.2.9.Final/linux-aarch_64": {
+   "jar": "sha256-CPaBEynhlhJ0KZ85KXIPSqk/h7JZqU1gHC2ddm80WSo="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final/linux-x86_64": {
-   "jar": "sha256-fzlcj9vmmQ92ZECLV9kZBCQBuJMXj8uki+vxphv3hhg="
+  "io/netty#netty-transport-native-epoll/4.2.9.Final/linux-x86_64": {
+   "jar": "sha256-Kc4d3kCWN3kyedce1L4aru1Vr1emw0W0Y9ZZfhlU2K0="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final": {
-   "jar": "sha256-mKjWMVHe0xcscfhVIDrhlpgvAFIZaso7a6l9PoXUJgk=",
-   "pom": "sha256-Q543Rm1v45ZZHsS6JjVcjkRMOB0j9wVMIKL9isXJe0I="
+  "io/netty#netty-transport-native-io_uring/4.2.9.Final": {
+   "jar": "sha256-vrTFJGgnshkiv6dDXDWImC0oJZ5Zx0HoixY7dT41P1o=",
+   "pom": "sha256-bH8FRivEqxkzkTvhgFRo6BDr313Lg6WvMZHYZCurfE8="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final/linux-aarch_64": {
-   "jar": "sha256-hPw53BAZ9KbFJEsdealxTLZ/BFu9rk/vJvSYHm9nrb4="
+  "io/netty#netty-transport-native-io_uring/4.2.9.Final/linux-aarch_64": {
+   "jar": "sha256-llDBxCNF+1ZochGCXK0Ed1r6lAWYL4XeOtOiV7IE5dE="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final/linux-x86_64": {
-   "jar": "sha256-wjZQn1W/khZm8CMu/rdWMnm2y0YNnko2xKukDSIXv2I="
+  "io/netty#netty-transport-native-io_uring/4.2.9.Final/linux-x86_64": {
+   "jar": "sha256-+d4mzq7JD/2esBL9fMNx3c8y6HbR/tlSYK8I/CaXpg4="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final": {
-   "jar": "sha256-8BrzuSyghzja6ep5E3jCiF8wXSEK0W48VxZVueJr0Dw=",
-   "pom": "sha256-/0QzBLr/YGgE922pFg73w/Kh7mZcZe9it74n1vfAMqM="
+  "io/netty#netty-transport-native-kqueue/4.2.9.Final": {
+   "jar": "sha256-g8oA+SJLLctYKEUDfKw8tY4BSdMcipDbpYDR+vDdPII=",
+   "pom": "sha256-04EjBoO0kQyVXkjIobpnN2YSPNnAjG5nQohwr4Spaws="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final/osx-aarch_64": {
-   "jar": "sha256-dkemlVjj1Jo1J4HCroGpfha0QtfGVloGtK4PFSmEidU="
+  "io/netty#netty-transport-native-kqueue/4.2.9.Final/osx-aarch_64": {
+   "jar": "sha256-TXn53Ysk/48GFCq4RYUdvnJVDbixIsaTX1dlqzUbaz4="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final/osx-x86_64": {
-   "jar": "sha256-opwItolXRqrKeW5ypCm8cF9AJn/rNfdc2Pu81N5t6Z8="
+  "io/netty#netty-transport-native-kqueue/4.2.9.Final/osx-x86_64": {
+   "jar": "sha256-nBq1OxEYK2VcA9xkbUdzrqmtNfUcGH1gOgZ9XdoSmtU="
   },
-  "io/netty#netty-transport-native-unix-common/4.2.7.Final": {
-   "jar": "sha256-c2cDs/bRJ+GC9b6Ii24VcysMCNZjTgByU1KmqdGZdLI=",
-   "pom": "sha256-EnhcnEoH0qFDJYYWRWrqw6bgIqoXJBeYA04x+LDtHqk="
+  "io/netty#netty-transport-native-unix-common/4.2.9.Final": {
+   "jar": "sha256-STRaXcaN0yt/6dPSNkDZGMDo5drLs/wWngwjGh/H7eo=",
+   "pom": "sha256-2LwuDXbPD+zk+ZeqsD0dJo4NEznMGWsyHdMk3y41zn8="
   },
-  "io/netty#netty-transport/4.2.7.Final": {
-   "jar": "sha256-qtxvsFwU+3iTaMo/hUchVJxy9sDYF5i7zPneG7cWiSs=",
-   "pom": "sha256-zQTiYzq09WBE6aFdUV6ZyBY4iZ2vB9gJdhlzp8DPnqo="
+  "io/netty#netty-transport/4.2.9.Final": {
+   "jar": "sha256-CuLBawAmLrtdZy/J9qp76SuwY+vLCCbDwG4GoZvdHD4=",
+   "pom": "sha256-ud2qfeBju/KWMpl8hBtGSm4u5iW7v2qeZEIWWMpkv0g="
   },
-  "it/unimi/dsi#fastutil/8.5.15": {
-   "jar": "sha256-z/62ZzvfHm5Dd9aE3y9VrDWc9c9t9hPgXmLe7qUAk2o=",
-   "pom": "sha256-f2baEne0E7MncoaNO1C1XF/lTiZD8bVORZbk9Sofvtg="
+  "it/unimi/dsi#fastutil/8.5.18": {
+   "jar": "sha256-kJSuZ9AdCtJG+IbxGtVX/C55xyy/P+7YPhUSqK6Qp0o=",
+   "pom": "sha256-GE28pJp9A+Oh358Pl7RiCW6En1rQXFz3s4YibsFZ73k="
   },
   "jakarta/inject#jakarta.inject-api/2.0.1": {
    "jar": "sha256-99yYBi/M8UEmq7dRtk+rEsMSVm6MvchINZi//OqTr3w=",
@@ -872,29 +857,41 @@
    "jar": "sha256-3ybMWPI19HfbB/dTulo6skPr5Xidn4ns9o3WLqmmbCg=",
    "pom": "sha256-amd2O3avzZyAuV5cXiR4LRjMGw49m0VK0/h1THa3aBU="
   },
-  "net/sf/saxon#Saxon-HE/12.1": {
-   "jar": "sha256-IA8skvaHHVG8LhS3Br82TTvb8isnlgtu1rqH5BZk5VA=",
-   "pom": "sha256-0wqLQpc3MZf2YH5RpAppxVe7Ts7aweZU0bAiob/ZjYI="
+  "net/sf/saxon#Saxon-HE/12.9": {
+   "jar": "sha256-jzqSFqU3NnEyKT6su6nfBi6s6PixahhK9Z4uSDnUzUE=",
+   "pom": "sha256-+IDp0dQAyZwYkvWWTl/JIN0d7wViI1m5sFjzK1tCaXU="
   },
-  "org/antlr#antlr4-master/4.11.1": {
-   "pom": "sha256-cupd6Nq7ZhV4X9D+qqur1T3NrnD+FrzXx7lobApuAK0="
+  "org/antlr#antlr4-master/4.13.2": {
+   "pom": "sha256-Ct2gJmhYc/ZRNgF4v/xEbO7kgzCBc5466dbo8H6NkCo="
   },
-  "org/antlr#antlr4-runtime/4.11.1": {
-   "jar": "sha256-4GxlU8HMwU02BS7EsPxvE7gIz5V7Wx3D9hv0AZlq2lk=",
-   "pom": "sha256-xFbsKVkHjFkfvX72mtlACnJ5IAaNdGmJx0q4BO1oGzQ="
+  "org/antlr#antlr4-runtime/4.13.2": {
+   "jar": "sha256-3T6KE6LWab+E+42DTeNc5IdfJxV2mNIGJB7ISIqtyvc=",
+   "pom": "sha256-A84HonlsURsMlNwU/YbM3W44KMV5Z60jg94wTg0Runk="
   },
   "org/apache#apache/16": {
    "pom": "sha256-n4X/L9fWyzCXqkf7QZ7n8OvoaRCfmKup9Oyj9J50pA4="
   },
+  "org/apache#apache/18": {
+   "pom": "sha256-eDEwcoX9R1u8NrIK4454gvEcMVOx1ZMPhS1E7ajzPBc="
+  },
   "org/apache#apache/19": {
    "pom": "sha256-kfejMJbqabrCy69tAf65NMrAAsSNjIz6nCQLQPHsId8="
   },
+  "org/apache#apache/21": {
+   "pom": "sha256-rxDBCNoBTxfK+se1KytLWjocGCZfoq+XoyXZFDU3s4A="
+  },
   "org/apache#apache/23": {
    "pom": "sha256-vBBiTgYj82V3+sVjnKKTbTJA7RUvttjVM6tNJwVDSRw="
   },
+  "org/apache#apache/34": {
+   "pom": "sha256-NnGunU0GKuO7mFcxx2CIuy9vfXJU4tME7p9pC5dlEyg="
+  },
   "org/apache#apache/35": {
    "pom": "sha256-6il9zRFBNui46LYwIw1Sp2wvxp9sXbJdZysYVwAHKLg="
   },
+  "org/apache#apache/6": {
+   "pom": "sha256-Eu21CW4T9Aw2LQvUCQJYn6lYZQUSP6Jnmc5QsRb6W7M="
+  },
   "org/apache/ant#ant-launcher/1.10.15": {
    "jar": "sha256-XIVRmQMHoDIzbZjdrtVJo5ponwfU1Ma5UGAb8is9ahs=",
    "pom": "sha256-ea+EKil53F/gAivAc8SYgQ7q2DvGKD7t803E3+MNrJU="
@@ -906,42 +903,61 @@
    "jar": "sha256-djrNpKaViMnqiBepUoUf8ML8S/+h0IHCVl3EB/KdV5Q=",
    "pom": "sha256-R4DmHoeBbu4fIdGE7Jl7Zfk9tfS5BCwXitsp4j50JdY="
   },
+  "org/apache/commons#commons-lang3/3.8.1": {
+   "jar": "sha256-2sgH9lsHaY/zmxsHv+89h64/1G2Ru/iivAKyqDFhb2g=",
+   "pom": "sha256-7I4J91QRaFIFvQ2deHLMNiLmfHbfRKCiJ7J4vqBEWNU="
+  },
   "org/apache/commons#commons-parent/39": {
    "pom": "sha256-h80n4aAqXD622FBZzphpa7G0TCuLZQ8FZ8ht9g+mHac="
   },
+  "org/apache/commons#commons-parent/42": {
+   "pom": "sha256-zTE0lMZwtIPsJWlyrxaYszDlmPgHACNU63ZUefYEsJw="
+  },
+  "org/apache/commons#commons-parent/45": {
+   "pom": "sha256-nIhiPs+pHwEsZz7kYiwO60Nn5eDSItlg92zSCLGk/aY="
+  },
   "org/apache/commons#commons-parent/47": {
    "pom": "sha256-io7LVwVTv58f+uIRqNTKnuYwwXr+WSkzaPunvZtC/Lc="
   },
-  "org/apache/commons#commons-parent/52": {
-   "pom": "sha256-ddvo806Y5MP/QtquSi+etMvNO18QR9VEYKzpBtu0UC4="
+  "org/apache/commons#commons-parent/84": {
+   "pom": "sha256-kjn7lxAdsnBw5Jg9ENM6DpHPZ2ytkb9TgVQiw1Ye+bE="
   },
   "org/apache/commons#commons-parent/91": {
    "pom": "sha256-0vi2/UgAtqrxIPWjgibV+dX8bbg3r5ni+bMwZ4aLmHI="
   },
+  "org/apache/commons#commons-text/1.3": {
+   "jar": "sha256-gYWzpTEQktg+0fGEwtCTsxBdcmu9doZ8MrNRFUK7mag=",
+   "pom": "sha256-3usrqXAeSV3DHTJjPrhrlLJLCpbg3Gf7h+cGLxUwJ6o="
+  },
+  "org/apache/geronimo/genesis#genesis-default-flava/2.0": {
+   "pom": "sha256-CObhRvTiRSZt/53YALEodd0jZ9P2ejSrZgoSbIESFfg="
+  },
+  "org/apache/geronimo/genesis#genesis-java5-flava/2.0": {
+   "pom": "sha256-58U1i7u8J9qlsyf2O8EmUKdd3J+axtS/oSeJvh8sKds="
+  },
+  "org/apache/geronimo/genesis#genesis/2.0": {
+   "pom": "sha256-ue0vndQ0YxFY13MI7lZIYiwinM7OFyLF43ekKWkj2uY="
+  },
   "org/apache/groovy#groovy-bom/4.0.27": {
    "module": "sha256-1sIlTINHuEzahMr3SRShh8Lzd+QoTo2Ls/kBUhgQqos=",
    "pom": "sha256-qkTrUr/f5h0ns+RQ0rNI2I3qo0N6tNnUmoQJU0j59vs="
   },
-  "org/apache/httpcomponents#httpcomponents-parent/12": {
-   "pom": "sha256-QgnwlZMhKYfCnWgBkXMJ3V5vcbU7Kx0ODw77mErRH6E="
+  "org/apache/httpcomponents#httpclient/4.5.13": {
+   "jar": "sha256-b+kCalZsalABYIzz/DIZZkH2weXhmG0QN8zb1fMe90M=",
+   "pom": "sha256-eOua2nSSn81j0HrcT0kjaEGkXMKdX4F79FgB9RP9fmw="
   },
-  "org/apache/httpcomponents/client5#httpclient5-parent/5.1.3": {
-   "pom": "sha256-onsUE67OkqOqR3SRX3WJ4MYXnXKNKsailddY7k+iTMU="
+  "org/apache/httpcomponents#httpcomponents-client/4.5.13": {
+   "pom": "sha256-nLpZTAjbcnHQwg6YRdYiuznmlYORC0Xn1d+C9gWNTdk="
   },
-  "org/apache/httpcomponents/client5#httpclient5/5.1.3": {
-   "jar": "sha256-KMdZJU9ONTGeB4u2/+p1Z2YI3BLLJDsk+zyHMlIpd/4=",
-   "pom": "sha256-GYirPRva4PUfIsg9yXuI+gdWGttiRGedi49xRs3ROq8="
+  "org/apache/httpcomponents#httpcomponents-core/4.4.14": {
+   "pom": "sha256-IJ7ZMctXmYJS3+AnyqnAOtpiBhNkIylnkTEWX4scutE="
   },
-  "org/apache/httpcomponents/core5#httpcore5-h2/5.1.3": {
-   "jar": "sha256-0OeLoVqo6+d5grZgrEsJqV1uA129vqdiV33ByOKTWAc=",
-   "pom": "sha256-K8AxehSO3Jrv6j7BU1OU787T0TfWL3/1ZW0LA/lMB4Y="
+  "org/apache/httpcomponents#httpcomponents-parent/11": {
+   "pom": "sha256-qQH4exFcVQcMfuQ+//Y+IOewLTCvJEOuKSvx9OUy06o="
   },
-  "org/apache/httpcomponents/core5#httpcore5-parent/5.1.3": {
-   "pom": "sha256-pnU4hlrg83RLIekcpH1GEFRzfFUtH/KdpxTIYMmS1bs="
-  },
-  "org/apache/httpcomponents/core5#httpcore5/5.1.3": {
-   "jar": "sha256-8r8vLHdyFpyeMGmXGWZ60w+bRsTp14QZB96y0S2ZI/4=",
-   "pom": "sha256-f8K4BFgJ8/J6ydTZ6ZudNGIbY3HPk8cxPs2Epa8Om64="
+  "org/apache/httpcomponents#httpcore/4.4.14": {
+   "jar": "sha256-+VYgnkUMsdDFF3bfvSPlPp3Y25oSmO1itwvwlEumOyg=",
+   "pom": "sha256-VXFjmKl48QID+eJciu/AWA2vfwkHxu0K6tgexftrf9g="
   },
   "org/apache/logging/log4j#log4j-api/2.25.3": {
    "jar": "sha256-6IZoKSD6D7nW62OV3LTeCIRD+GRsicXlhG4WjjJ/QG8=",
@@ -982,15 +998,51 @@
    "jar": "sha256-8+OzZCNzxp1MdEHUDroHZeHXROmStiGURS9epUUd/bo=",
    "pom": "sha256-XxSOOelo08K3a4426hN3mJ8KeetDpqWa5yPZElzLXGE="
   },
+  "org/apache/maven#maven-parent/34": {
+   "pom": "sha256-Go+vemorhIrLJqlZlU7hFcDXnb51piBvs7jHwvRaI38="
+  },
   "org/apache/maven#maven-xml/4.0.0-rc-3": {
    "jar": "sha256-BjxCTLR/dRZBJdXuolFnuTHdaU40Jo1QJHN050IR3Rk=",
    "pom": "sha256-nZZekiyqwDYkl9J7v6UaRI+UydcTYjZnnGhSNwb3KYI="
   },
+  "org/apache/maven/doxia#doxia-core/1.12.0": {
+   "jar": "sha256-XknNgnvrvOpYKdOziD0XrRzhXr1jlK61CtUNff2Tn80=",
+   "pom": "sha256-sDiPdIoIheE+fCxFOSH4u53U+1sZBb50VoVHbPNFbqM="
+  },
+  "org/apache/maven/doxia#doxia-logging-api/1.12.0": {
+   "jar": "sha256-mFMGFiwKn0wwnUYQlEfzDwK/b8m8FqPgOdWeHavQGS8=",
+   "pom": "sha256-ndmbQ1AiOEZYUxBpTERjGLFpK6dG7XFzdtWWGaJxI7Q="
+  },
+  "org/apache/maven/doxia#doxia-module-xdoc/1.12.0": {
+   "jar": "sha256-6HMboApO3TSyDv+eSnKcIEXGLLeWw+SRaSYH3kR2qwE=",
+   "pom": "sha256-+2nZW+S1WvLzsKm2jj6OYgY+aVlMH86+cFpaTbCZbSU="
+  },
+  "org/apache/maven/doxia#doxia-modules/1.12.0": {
+   "pom": "sha256-q4/2u0eTz7pZsU+zg/81GjSbEJHQccZrH8vKco1QW9w="
+  },
+  "org/apache/maven/doxia#doxia-sink-api/1.12.0": {
+   "jar": "sha256-XcpqqqnnDYoHZuFD3c+dsJ3l/eD7zHjLY11052TfzKU=",
+   "pom": "sha256-JrUf3babXKbgRM2ii40cGje2+v0M+5v7FakZ3lfGcdU="
+  },
+  "org/apache/maven/doxia#doxia/1.12.0": {
+   "pom": "sha256-LQKgvWTzMbdnzudFWzGTxvuCEQFDoRmFiryWh5il/Ck="
+  },
+  "org/apache/xbean#xbean-reflect/3.7": {
+   "jar": "sha256-EE5em7WmafhnIvMigZYHAPfsjjIJ71GyPrm20j0WKcs=",
+   "pom": "sha256-l5XBUyLF0ZrzNu69nhZPp9WJfEsASn1m4hY1oXPnSKk="
+  },
+  "org/apache/xbean#xbean/3.7": {
+   "pom": "sha256-6nFxMt6EBLYvyQl6HzIVxwXVJdRXvppfEmU63GjDOrc="
+  },
   "org/apiguardian#apiguardian-api/1.1.2": {
    "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
    "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
    "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
   },
+  "org/bouncycastle#bc-jdk18on-bom/1.82": {
+   "module": "sha256-4eQ/lpTIXXlmi6ufoWyQ8VHTQ6dCcSKiHTvWxxN7AU0=",
+   "pom": "sha256-wkeqzeVkVYEHUJ6dl/HbfyH819C/bKHx7iu/2m1sQjE="
+  },
   "org/bstats#bstats-base/3.1.0": {
    "jar": "sha256-2g5RgIzYzCi+8wAOcctPoLBeU5Mag6f59NPEAoNvQKA=",
    "module": "sha256-QhHroRz++QjrgoSEtw37ii5EjZ9aaZX/Gu8gEeVquhg=",
@@ -1004,16 +1056,16 @@
    "jar": "sha256-ZLAmkci51OdwD47i50Lc5+osboHmYrdSLJ7jv1aMBAo=",
    "pom": "sha256-3EzUOKNkYtATwjOMjiBtECoyKgDzNynolV7iGYWcnt4="
   },
-  "org/checkerframework#checker-qual/3.27.0": {
-   "jar": "sha256-Jf2m8+su4hOf9dfTmSZn1Sbr8bD7h982/HWqNWeebas=",
-   "module": "sha256-H1L7VyqCR4PvVyPW0LejEUOz2JKpQerXur4OH/kWM30=",
-   "pom": "sha256-yXIt1Co1ywpkPGgAoo2sf8UXbYDkz2v4XBgjdzFjOrk="
-  },
   "org/checkerframework#checker-qual/3.33.0": {
    "jar": "sha256-4xYlW7/Nn+UNFlMUuFq7KzPLKmapPEkdtkjkmKgsLeE=",
    "module": "sha256-6FIddWJdQScsdn0mKhU6wWPMUFtmZEou9wX6iUn/tOU=",
    "pom": "sha256-9VqSICenj92LPqFaDYv+P+xqXOrDDIaqivpKW5sN9gM="
   },
+  "org/checkerframework#checker-qual/3.52.1": {
+   "jar": "sha256-k0ZBoYyEYb9m1+k5srBUvypRjtQYj9fWg2plsDj1Nko=",
+   "module": "sha256-+K1w2ZdntgVFD9uskX2UAHDuTjATTfrK6igJSPJNKrg=",
+   "pom": "sha256-4lY9U+Bw0yPAZmljQxhEMVwYWlP1gLzQ+6xI/lCBCjs="
+  },
   "org/checkerframework#checker-qual/3.53.0": {
    "jar": "sha256-fKACgV2S+teelms3XC7nsrS/lTAkvJpdXgxZ3xP/Wvg=",
    "module": "sha256-EZ1p1BNJeDzB69OSskth1vOAhgFHqAsohbj3/KOrE78=",
@@ -1029,6 +1081,25 @@
   "org/codehaus/mojo#mojo-parent/40": {
    "pom": "sha256-/GSNzcQE+L9m4Fg5FOz5gBdmGCASJ76hFProUEPLdV4="
   },
+  "org/codehaus/plexus#plexus-classworlds/2.6.0": {
+   "jar": "sha256-Uvd8XsSfeHycQX6+1dbv2ZIvRKIC8hc3bk+UwNdPNUk=",
+   "pom": "sha256-RppsWfku/6YsB5fOfVLSwDz47hA0uSPDYN14qfUFp7o="
+  },
+  "org/codehaus/plexus#plexus-component-annotations/2.1.0": {
+   "jar": "sha256-veNhfOm1vPlYQSYEYIAEOvaks7rqQKOxU/Aue7wyrKw=",
+   "pom": "sha256-BnC2BSVffcmkVNqux5EpGMzxtUdcv8o3Q2O1H8/U6gA="
+  },
+  "org/codehaus/plexus#plexus-container-default/2.1.0": {
+   "jar": "sha256-bc6xJGsYgVO9y2+WLVQ9Ud22csygfK2Up4+6vJ7fCjk=",
+   "pom": "sha256-i4wg5jC9zHlcyYUCTEwQRcFHvhFgUsLJdeMMYI9/O0U="
+  },
+  "org/codehaus/plexus#plexus-containers/2.1.0": {
+   "pom": "sha256-lNWu2zxGAjJlOWUnz4zn/JRLe9eeTrq5BzhkGOtaCNc="
+  },
+  "org/codehaus/plexus#plexus-utils/3.3.0": {
+   "jar": "sha256-dtF0eSVA4nda+U0D0Q+y08d24s0KwOv0J9PlcAcruc4=",
+   "pom": "sha256-ecl5IHP97jzb69YadrqMLdEWJKn4XRKLrla9oZ4gR1w="
+  },
   "org/codehaus/plexus#plexus-utils/4.0.2": {
    "jar": "sha256-iVcnTnX+LCeLFCjdFqDa7uHdOBUstu/4Fhd6wo/Mtpc=",
    "pom": "sha256-UVHBO918w6VWlYOn9CZzkvAT/9MRXquNtfht5CCjZq8="
@@ -1040,6 +1111,9 @@
   "org/codehaus/plexus#plexus/20": {
    "pom": "sha256-p7WUsAL8eRczyOlEcNCQRfT9aak61cN1dS8gV/hGM7Q="
   },
+  "org/codehaus/plexus#plexus/5.1": {
+   "pom": "sha256-o0PkT/V5au0OpgvhFFTJNc4gqxxfFkrMjaV0SC3Lx+k="
+  },
   "org/codehaus/woodstox#stax2-api/4.2.2": {
    "jar": "sha256-phxI1VPvrXi8Af/8SsUovruuZMuuwXCypeOc9h61Gr4=",
    "pom": "sha256-TpAuxVb8ZZi0HClS7BVz7cgVA35zMOxJIuq2GUImhuI="
@@ -1242,6 +1316,10 @@
    "module": "sha256-qaTye+lOmbnVcBYtJGqA9obSd9XTGutUgQR89R2vRuQ=",
    "pom": "sha256-GdS3R7IEgFMltjNFUylvmGViJ3pKwcteWTpeTE9eQRU="
   },
+  "org/junit#junit-bom/5.12.2": {
+   "module": "sha256-3nCsXZGlJlbYiQptI7ngTZm5mxoEAlMN7K1xvzGyc14=",
+   "pom": "sha256-zvgP7IZFT2gGv7DfJGabXG8y4styhTnqhZ9H39ybvBc="
+  },
   "org/junit#junit-bom/5.13.2": {
    "module": "sha256-7WfhUiFASsQrXlmBAu33Yt1qlS3JUAHpwMTudKBOgoM=",
    "pom": "sha256-Q7EQT7P9TvS3KpdR1B4Jwp8AHIvgD/OXIjjcFppzS0k="
@@ -1254,44 +1332,48 @@
    "module": "sha256-etPdstdOanfWWuiaykXUaMl7+ZFba8UvRJ1nXk5vmzU=",
    "pom": "sha256-9apHs2ZIPo0fm+8Q5noMZvZq/A8zHJ+WaxMQutYND28="
   },
-  "org/junit#junit-bom/5.14.2": {
-   "module": "sha256-XSb0RAOSMm3SSDz0kBQ+6hSV1QlUWaC5ZRp7GzjiTr8=",
-   "pom": "sha256-7S3MeFW9RgvMyTob8Mli5jtWb/fY8d7Q8fJZO6gYOq8="
+  "org/junit#junit-bom/6.0.1": {
+   "module": "sha256-xI2Y9e3P2cVeefrLugEB98G6CIY0ib6EqRYrmaGG0cI=",
+   "pom": "sha256-4xXFzLsIchbc4ErnDDK/F2K+KguKQ++B47p4MXpM1cg="
   },
-  "org/junit/jupiter#junit-jupiter-api/5.14.2": {
-   "jar": "sha256-cEzaGFcxa7eRGZsaG/gXOwd4uTioRFyFvhFUxfiBOgo=",
-   "module": "sha256-Cw9Y0AG0zPQduv9mL/CPBGQLn1FWshXS3FfO6TaS6CY=",
-   "pom": "sha256-NXvqCt8V4DrCyOrfIEW5NCUPr4SAlAmWNZm89HXeszg="
+  "org/junit#junit-bom/6.0.2": {
+   "module": "sha256-CXdtx1DgfltFk690n/aPkYB/nFTDMHUcn0tPHqZScdY=",
+   "pom": "sha256-w1iXvlPvCDmGw/CRGt53SctCrrQAyZH7ruUeRjn3uak="
   },
-  "org/junit/jupiter#junit-jupiter-engine/5.14.2": {
-   "jar": "sha256-Ak2bBtMbkPucWnwLxiz6LUnGc6aKenW+m1JUi6YoNQk=",
-   "module": "sha256-VB9i/FQLJZxofAveUbVBhLcvlGJIpA6C5J9kVXYSsGU=",
-   "pom": "sha256-2j/YDMHhYiWQKIDDwXB/O4laEdqcYjMISgSzlcDh/QE="
+  "org/junit/jupiter#junit-jupiter-api/6.0.2": {
+   "jar": "sha256-QHsgre1AeBrVRAMJY57wxCjnNbK2+IMcXS/5BBYTGV0=",
+   "module": "sha256-m0IZfs4uhSb/k97ysJ48tIACdjh9RzsIC9/8iKjANjA=",
+   "pom": "sha256-23UFjKyPW4WpVpNirMdghakehZNGaLbdCQVGi/s//jU="
   },
-  "org/junit/jupiter#junit-jupiter-params/5.14.2": {
-   "jar": "sha256-BthnOrFhdBF+uup8ydwIgJ23o5T12T79JANi2IPQHfA=",
-   "module": "sha256-9VHVeJrqNQzfsYFkyp2a/1bgyYIsfG32HTF3ZL6LQA0=",
-   "pom": "sha256-CuKLm95MW9YCVeCb7vGRXAfvL5gdO49HyLSIeVGJFuY="
+  "org/junit/jupiter#junit-jupiter-engine/6.0.2": {
+   "jar": "sha256-KnIBz0iQSDwbtQRekaWbcFKoGJspMKm+lRTGPh5Ys7Y=",
+   "module": "sha256-EE0f6yTeklH8eVpz1HenP6pXmpjYecftsZ/dGP20CJs=",
+   "pom": "sha256-MS3kqvSL6RZPiX8G1hFKkFK/W7ADRltOMzH5R6YFr3o="
   },
-  "org/junit/jupiter#junit-jupiter/5.14.2": {
-   "jar": "sha256-7gTJsMUyE2pLxKhTH+VKIsY3uTppC8BkcYNXWE0eca4=",
-   "module": "sha256-yjO7T4OBTaS6iffR9w0zNieo/Pab5G2cf9973XACpr8=",
-   "pom": "sha256-6IK8iSW+9JsonGrn/GcKd0zmT3eer9dHuKo9ioqGfjo="
+  "org/junit/jupiter#junit-jupiter-params/6.0.2": {
+   "jar": "sha256-TG9Yd+hSp7iRIHxujWpesZaA0lsMQB0JpknR6hcRe1k=",
+   "module": "sha256-fdfWnOPlTkDuM0Z1qEkNJIi5bo3xIPXgqteaXSegur8=",
+   "pom": "sha256-XjLbpZkb2lFqzpu8ZaFBfW4KiFIeiobTP9IQjSqJIV8="
   },
-  "org/junit/platform#junit-platform-commons/1.14.2": {
-   "jar": "sha256-kRf5qtxmOsVQrl6B2NOrnx4Juy40wW5goesWM6F7zAY=",
-   "module": "sha256-LIpzAEQQ2y0nkUEBq+hnLcackhHD0ziuNHHZSisratI=",
-   "pom": "sha256-b6pnFLuLb4V7Gz7Tthz5EOv9rZPyWDJ506T9RWVa+cU="
+  "org/junit/jupiter#junit-jupiter/6.0.2": {
+   "jar": "sha256-ylRmpDWgsPEAOCxad+kerm1MozD2C00kATqaPwzXQug=",
+   "module": "sha256-SdwJtzTvpDJHDO65Dhry0wviY/MBCXhlXDVA8qgeqtY=",
+   "pom": "sha256-f9YZ4a5GOpmfjblWj6h9EJltFZo1P/zNy9O/h18spjU="
   },
-  "org/junit/platform#junit-platform-engine/1.14.2": {
-   "jar": "sha256-WkXEMHY6JsbFVHHhktivu2RDlWvBFrfmeWuNeJpaFG0=",
-   "module": "sha256-rJRHEJU5b12sFYUmoSVj/dUEkq57Km9JH62ixRsHS+s=",
-   "pom": "sha256-k2qlp7HfWDlzoyJ/y9uV6nTjHhvrGOqGmS7JBlPwqGo="
+  "org/junit/platform#junit-platform-commons/6.0.2": {
+   "jar": "sha256-HEnquO09gSgEWePz4fEZuSj5z8Uwx1AMKhWpro560w0=",
+   "module": "sha256-kx7oBBhnzXyu/UQCYYAs7o1Vm5uPSbOUkI4XwEpk+p4=",
+   "pom": "sha256-bivMHUT1ckbR03duMQ5Ybg9fTQTjrsA3eOgBCmtiDS8="
   },
-  "org/junit/platform#junit-platform-launcher/1.14.2": {
-   "jar": "sha256-HfxXdiDdEx6Ddl9mKsqhCaLfV1KgOZ8DTIaKyHMyOvI=",
-   "module": "sha256-TlbYQ96bbUO3CC/Ux0IHDSp9+rUZL7oaKQCYDwa+MTk=",
-   "pom": "sha256-BFn8NaM0Pr/qeOt5MvpB7OdtgyQ3A1MAsEjnpC6A5wk="
+  "org/junit/platform#junit-platform-engine/6.0.2": {
+   "jar": "sha256-MUlbdUuogrppPBn6nYh+Ya9vOFD1h0G9WMPxKd7KVRc=",
+   "module": "sha256-mgE8iVsXgJnmIfvNuJ3rxldDqW1i7TL4xuWfzu/BN8M=",
+   "pom": "sha256-6tUsFcvLoTHf7NLSrVOFjwEdfHUwCMAU/pldUolaEeI="
+  },
+  "org/junit/platform#junit-platform-launcher/6.0.2": {
+   "jar": "sha256-vZkQ97ykqdQFC6heHwduO4VzI51F33lnOGKqsphZV5I=",
+   "module": "sha256-1SKe2c1l4Uoi2Lk4Z7H7lbg/drJUUHO04LxpxOnGyi0=",
+   "pom": "sha256-/8xw6oNXyJK5Bbr+/g+zOZ6uktqxxNSMxbJ9EYkKUnY="
   },
   "org/lanternpowered#lmbda/2.0.0": {
    "jar": "sha256-v7mL90YQgkvVbhDYJSM6Zg66M7qRXPlHJGJX9QPadfM=",
@@ -1360,6 +1442,10 @@
   "org/slf4j#slf4j-parent/2.0.17": {
    "pom": "sha256-lc1x6FLf2ykSbli3uTnVfsKy5gJDkYUuC1Rd7ggrvzs="
   },
+  "org/slf4j#slf4j-simple/2.0.17": {
+   "jar": "sha256-3f6lmsB0xtPiSsLDhiLS2WOJXhf3CzjtS9rk14C+aWQ=",
+   "pom": "sha256-+zDo4vauotKYQnmGd+1FQbmyJVcVwVg1DKLF9ce4ZLA="
+  },
   "org/sonatype/oss#oss-parent/5": {
    "pom": "sha256-FnjUEgpYXYpjATGu7ExSTZKDmFg7fqthbufVqH9SDT0="
   },
@@ -1421,13 +1507,13 @@
    "jar": "sha256-HT3hIYOiqJada8b/Wtdx3l1W0ISXxdk+FopctxDiy/E=",
    "pom": "sha256-yGRf/88P5qu8IVS8i/0Jysbgd2M4Kz6cGLXbmR7IFjk="
   },
-  "org/xmlresolver#xmlresolver/5.1.1": {
-   "jar": "sha256-MSL4rkDERq27MDzVUldoA/2/bq77hL985D0TNlsnymg=",
-   "module": "sha256-DaZVpENW8JhTRljd56tHCwOSc8Wc9NyU7HcQYnCpzV0=",
-   "pom": "sha256-pQDlCR85eXYVDo05n+tBDIXlfXyQl9Y5gdMeL27Bbtk="
+  "org/xmlresolver#xmlresolver/5.3.3": {
+   "jar": "sha256-H+TVuS9wjc24LbzhKRngFx5rXKYsbcpiIEg2JQmP618=",
+   "module": "sha256-DeilBgQ5G2UDnI/6PxQRiSJ+x5rFMyPhPiunKIy3no4=",
+   "pom": "sha256-JhradtnmZ2AI3Kw3ek1FiXSRZrYGVZ9Z8uRepi2Ldew="
   },
-  "org/xmlresolver#xmlresolver/5.1.1/data": {
-   "jar": "sha256-uvgjj/PdgGV2SHWvLkHeiw7kWF4AsC9R7JEb1l/TwcM="
+  "org/xmlresolver#xmlresolver/5.3.3/data": {
+   "jar": "sha256-sMSHrS8+VYvo2CnJFtJFjRCspqW6+npNBSS3CEXkilw="
   },
   "org/yaml#snakeyaml/1.26": {
    "jar": "sha256-2H1gflAIhTVsA8HK5h6MLgXWl9+Hh9WroTSEwut2qEQ=",
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 303729d84c46..ac7685ba001a 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.5.0-unstable-2026-01-25";
+  version = "3.5.0-unstable-2026-01-31";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "fe8dc5eaa2bdd9b7509f6f81e1c13fa6c571e324";
-    hash = "sha256-Eb1RytkncYFKJysEuGYe1wTawtxK9JCXw2E1F64U3Zs=";
+    rev = "7e01491e2f7952a3d2d798ddaaf0ffd396921329";
+    hash = "sha256-yKH5M1pN2/vm2cRKiasT3TwRMLjtBla/qR/71U595wQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wayscriber/package.nix b/pkgs/by-name/wa/wayscriber/package.nix
index 3aaee18373a9..1009c419be2d 100644
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wayscriber";
-  version = "0.9.9";
+  version = "0.9.9.1";
 
   src = fetchFromGitHub {
     owner = "devmobasa";
     repo = "wayscriber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ObAaR9PP8wY98ZP7nenyGhAXbyd+vb5hiR/cmJTD4CQ=";
+    hash = "sha256-t7BXAIYkebaf3DpcSUCFc1+0YyazhZfsJAzwyPaJ+aM=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pango
     libxkbcommon
   ];
-  cargoHash = "sha256-yPwtMuvulqgshbppxoZv3HtutvKPGskVRF+p5E+KFvI=";
+  cargoHash = "sha256-QCZ0izvrWqFbVk6Nu5La1wgYrG+vMIlhHxlMipjoInA=";
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/wo/workcraft/package.nix b/pkgs/by-name/wo/workcraft/package.nix
index 369ac3ce5701..6012fabf47eb 100644
--- a/pkgs/by-name/wo/workcraft/package.nix
+++ b/pkgs/by-name/wo/workcraft/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "workcraft";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "https://github.com/workcraft/workcraft/releases/download/v${finalAttrs.version}/workcraft-v${finalAttrs.version}-linux.tar.gz";
-    sha256 = "sha256-p0w65Y4W1ozFLFNVcqYldyZ78+kJPwZeLgrREpc9CLQ=";
+    hash = "sha256-+G4Z9GfyfdBL3qb8RqtmRPq6wC6et4P3S6Owy/L5sSU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/xa/xawtv/package.nix b/pkgs/by-name/xa/xawtv/package.nix
index f963a8b8d00d..8a176bc2ebe5 100644
--- a/pkgs/by-name/xa/xawtv/package.nix
+++ b/pkgs/by-name/xa/xawtv/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-Fix-build-for-glibc-2.32.patch
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   buildInputs = [
     ncurses
diff --git a/pkgs/by-name/xc/xcbuild/package.nix b/pkgs/by-name/xc/xcbuild/package.nix
index e9daa2ee4b7f..5515b87c117f 100644
--- a/pkgs/by-name/xc/xcbuild/package.nix
+++ b/pkgs/by-name/xc/xcbuild/package.nix
@@ -8,6 +8,8 @@
   makeBinaryWrapper,
   ninja,
   stdenv,
+  # xcbuild is included in the SDK. Avoid an infinite recursion by using a bootstrap stdenv
+  stdenv' ? if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv,
   zlib,
 
   # These are deprecated and do nothing. They’re needed for compatibility and will
@@ -56,7 +58,7 @@ let
     sha256 = "sha256-nKxwWuSqr89lvI9Y3QAW5Mo7/iFfMNj/OOQVeA/FWnE=";
   };
 in
-stdenv.mkDerivation (finalAttrs: {
+stdenv'.mkDerivation (finalAttrs: {
   pname = "xcbuild";
 
   outputs = [
@@ -101,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace Libraries/pbxbuild/Sources/Tool/ScriptResolver.cpp \
       --replace-fail "/bin/sh" "sh"
   ''
-  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+  + lib.optionalString (!stdenv'.hostPlatform.isDarwin) ''
     # Fix build on gcc-13 due to missing includes
     sed -e '1i #include <cstdint>' -i \
       Libraries/libutil/Headers/libutil/Permissions.h \
@@ -112,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     sed 1i'#include <sys/sysmacros.h>' \
       -i Libraries/xcassets/Headers/xcassets/Slot/SystemVersion.h
   ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  + lib.optionalString stdenv'.hostPlatform.isDarwin ''
     # Apple Open Sourced LZFSE, but not libcompression, and it isn't
     # part of an impure framework we can add
     substituteInPlace Libraries/libcar/Sources/Rendition.cpp \
diff --git a/pkgs/by-name/xe/xenia-canary/package.nix b/pkgs/by-name/xe/xenia-canary/package.nix
index 4b17bfab8c10..6befa0a556cb 100644
--- a/pkgs/by-name/xe/xenia-canary/package.nix
+++ b/pkgs/by-name/xe/xenia-canary/package.nix
@@ -47,7 +47,7 @@ llvmPackages_20.stdenv.mkDerivation {
       --replace-fail "cdialect(\"C17\")" ""
   ''; # Prevent build failure
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=unused-result"
   ];
 
diff --git a/pkgs/by-name/xk/xkbvalidate/package.nix b/pkgs/by-name/xk/xkbvalidate/package.nix
index b12390c1baa2..d22a16f1a226 100644
--- a/pkgs/by-name/xk/xkbvalidate/package.nix
+++ b/pkgs/by-name/xk/xkbvalidate/package.nix
@@ -6,6 +6,9 @@
 
 runCommandCC "xkbvalidate"
   {
+    pname = "xkbvalidate";
+    inherit (lib.trivial) version;
+
     buildInputs = [ libxkbcommon ];
     meta = {
       description = "NixOS tool to validate X keyboard configuration";
diff --git a/pkgs/by-name/ya/yandex-cloud/sources.json b/pkgs/by-name/ya/yandex-cloud/sources.json
index d8a47355bd61..2511389ba7f8 100644
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@@ -1,25 +1,25 @@
 {
-  "version": "0.174.0",
+  "version": "0.188.0",
   "binaries": {
     "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.174.0/darwin/arm64/yc",
-      "hash": "sha256-GzmDuKaZpIxdtDwKpJD/scDklHQWyOUpsYV4n4+TGj8="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/darwin/arm64/yc",
+      "hash": "sha256-/vr9q1Do9G+kaEq3L9tSQAk1kJw9pxGDF0B9jyLvvZg="
     },
     "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.174.0/linux/arm64/yc",
-      "hash": "sha256-RCd0/6TLGViH/jGUrXU2BPUUhwNftGUiG4LhsEtG/+8="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/arm64/yc",
+      "hash": "sha256-X07Y2ZgrLk1PCrX1fG0nn5OtucK8EHDvDIQ5xqKtXps="
     },
     "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.174.0/linux/386/yc",
-      "hash": "sha256-aFfk4onGgcMTO4QmmtlyfUJo9/z7DnJtNpLgNt9a5ds="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/386/yc",
+      "hash": "sha256-zFcQwG1lGINWTlr/Z8ZdQvOkgXLRP2eJLuEO5X+UZug="
     },
     "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.174.0/darwin/amd64/yc",
-      "hash": "sha256-O9AYZ6mx1Aoh1GfDcB7z6SUnHkLEFMhJSp9FH56Qzc4="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/darwin/amd64/yc",
+      "hash": "sha256-V2aGj6TMuYIpIYRQtl5lFDwZcpEYT7XreSRj0MoKA1E="
     },
     "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.174.0/linux/amd64/yc",
-      "hash": "sha256-smt6xE3YP9/j6HoVyvHA4u3rrpuHHOtS/qkINahjjaw="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.188.0/linux/amd64/yc",
+      "hash": "sha256-T2IaPbvNrehCT7VStjzrHLLemLeQqXjoX3fglt/5xX0="
     }
   }
 }
diff --git a/pkgs/by-name/zi/zimfw/package.nix b/pkgs/by-name/zi/zimfw/package.nix
index 51449fd11213..aed62c1e5957 100644
--- a/pkgs/by-name/zi/zimfw/package.nix
+++ b/pkgs/by-name/zi/zimfw/package.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zimfw";
-  version = "1.18.0";
+  version = "1.20.0";
   src = fetchFromGitHub {
     owner = "zimfw";
     repo = "zimfw";
     tag = "v${finalAttrs.version}";
     ## zim only needs this one file to be installed.
     sparseCheckout = [ "zimfw.zsh" ];
-    hash = "sha256-qQViaQOpLp8F4zvJETbNp0lxpdVhM1Meg7WcMKkjJRQ=";
+    hash = "sha256-fwpmeFDQRsTnWSoa9N3C+G/LDBCmDtbl+ckcyndMr7c=";
   };
   strictDeps = true;
   dontConfigure = true;
diff --git a/pkgs/by-name/zo/zoekt/package.nix b/pkgs/by-name/zo/zoekt/package.nix
index 096bf2606a3f..222788b00c75 100644
--- a/pkgs/by-name/zo/zoekt/package.nix
+++ b/pkgs/by-name/zo/zoekt/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule {
   pname = "zoekt";
-  version = "3.7.2-2-unstable-2025-11-20";
+  version = "0-unstable-2026-01-14";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "zoekt";
-    rev = "2e375df04f81c31c2ea62c23fcff48d98240e131";
-    hash = "sha256-tKuLJ/n9qI20FMmCtyuVeRfnB08ZY2KbRKdcjpe66u4=";
+    rev = "c747a3bccc2a4a427204ac08eea62a522df6d2ec";
+    hash = "sha256-fIvDxOTPbtRqBX39Lfezy/q235/nPhog/UIEncdV9UQ=";
   };
 
-  vendorHash = "sha256-uHCZNbP1zY8V+rtIB8xATWEci99sQkf8M01p3m789ZA=";
+  vendorHash = "sha256-1QM6OVFXS88IryKuNJKcbgYZcRZ+E6Na5NqItAlicXw=";
 
   nativeCheckInputs = [
     gitMinimal
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 9608a0daff3d..4534be6b4677 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.10.1";
+  version = "11.11.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-H9gtrYNk4W1OjjZwVX3ugDeqhW0rTvEJyhSRuz6XrYg=";
+    hash = "sha256-pxLpHeFBdmbuw4VtVgrOMfE8uPft2AyYcwdIyXpUz2s=";
   };
-  npmDepsHash = "sha256-oxa9JzbvXRvm+hfHrfhp5XBzTwcvW7yHJIvrKKu54B4=";
+  npmDepsHash = "sha256-BZnHHIjRbhMCq8miK4lPkhIfE13sEv4q0Ting/mmavQ=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/coq-modules/LibHyps/default.nix b/pkgs/development/coq-modules/LibHyps/default.nix
index 3ed3318a941c..9f8d47944ebf 100644
--- a/pkgs/development/coq-modules/LibHyps/default.nix
+++ b/pkgs/development/coq-modules/LibHyps/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   coq,
+  stdlib,
   version ? null,
 }:
 
@@ -9,13 +10,15 @@ mkCoqDerivation {
   pname = "LibHyps";
   owner = "Matafou";
   inherit version;
-  defaultVersion = if (lib.versions.range "8.11" "8.20") coq.version then "2.0.8" else null;
+  defaultVersion = if (lib.versions.range "8.11" "9.0") coq.version then "2.0.8" else null;
   release = {
     "2.0.8".sha256 = "sha256-u8T7ZWfgYNFBsIPss0uUS0oBvdlwPp3t5yYIMjYzfLc=";
   };
 
   configureScript = "./configure.sh";
 
+  propagatedBuildInputs = [ stdlib ];
+
   releaseRev = (v: "libhyps-${v}");
 
   meta = {
diff --git a/pkgs/development/coq-modules/aac-tactics/default.nix b/pkgs/development/coq-modules/aac-tactics/default.nix
index db8aca777402..46e8948abab1 100644
--- a/pkgs/development/coq-modules/aac-tactics/default.nix
+++ b/pkgs/development/coq-modules/aac-tactics/default.nix
@@ -11,6 +11,7 @@ mkCoqDerivation {
 
   releaseRev = v: "v${v}";
 
+  release."9.0.0".sha256 = "sha256-mln1182EOeXZCa1NzjAiovK93Xm+5JMZpGqJVrM67Jo=";
   release."8.20.0".sha256 = "sha256-VQzeINIZAfP3Qyh29uPqcNVlNJfIzzRLtN0Cm4EuGCk=";
   release."8.19.1".sha256 = "sha256-W/V57h+rjb3m0ktCG83PquMHfXiv6H1Nhvw9sVEPLqM=";
   release."8.19.0".sha256 = "sha256-IeCBd8gcu4bAXH5I/XIT7neQIILi+EWR6qqAA4GzQD0=";
@@ -34,6 +35,10 @@ mkCoqDerivation {
   defaultVersion =
 
     lib.switch coq.coq-version [
+      {
+        case = "9.0";
+        out = "9.0.0";
+      }
       {
         case = "8.20";
         out = "8.20.0";
diff --git a/pkgs/development/coq-modules/mtac2/default.nix b/pkgs/development/coq-modules/mtac2/default.nix
index d7fd6f4a36d8..ef06e17f2d7f 100644
--- a/pkgs/development/coq-modules/mtac2/default.nix
+++ b/pkgs/development/coq-modules/mtac2/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   coq,
+  stdlib,
   unicoq,
   version ? null,
 }:
@@ -14,14 +15,19 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.19" "8.19";
+        case = range "8.19" "9.0";
         out = "1.4-coq${coq.coq-version}";
       }
     ] null;
+  release."1.4-coq9.0".sha256 = "sha256-pAPBRCW7M46UZPJ+v/0xAT8mpQURN8czMmlrfYz/MVU=";
+  release."1.4-coq8.20".sha256 = "sha256-3nu/8zDvdnl6WzGtw46mVcdqgkRgc6Xy8/I+lUOrSIY=";
   release."1.4-coq8.19".sha256 = "sha256-G9eK0eLyECdT20/yf8yyz7M8Xq2WnHHaHpxVGP0yTtU=";
   releaseRev = v: "v${v}";
   mlPlugin = true;
-  propagatedBuildInputs = [ unicoq ];
+  propagatedBuildInputs = [
+    stdlib
+    unicoq
+  ];
   meta = {
     description = "Typed tactic language for Coq";
     license = lib.licenses.mit;
diff --git a/pkgs/development/coq-modules/paramcoq/default.nix b/pkgs/development/coq-modules/paramcoq/default.nix
index 3039d7092640..2687c890b740 100644
--- a/pkgs/development/coq-modules/paramcoq/default.nix
+++ b/pkgs/development/coq-modules/paramcoq/default.nix
@@ -12,7 +12,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.10" "8.20";
+        case = range "8.10" "9.0";
         out = "1.1.3+coq${coq.coq-version}";
       }
       {
@@ -23,6 +23,7 @@ mkCoqDerivation {
   displayVersion = {
     paramcoq = "...";
   };
+  release."1.1.3+coq9.0".sha256 = "sha256-zibQ9nBadSElpyI8iMTDRW/mqtxmxClaVb24o5W6ajE=";
   release."1.1.3+coq8.20".sha256 = "sha256-34xDOz/2xO39fnQW6Zb9CI2EKFuJZjrAdOpMEmwuzY0=";
   release."1.1.3+coq8.19".sha256 = "sha256-5NVsdLXaoz6qrr5ra5YfoHeuK4pEf8JX/X9+SZA0U+U=";
   release."1.1.3+coq8.18".sha256 = "sha256-hNBaj9hB+OzwXsOX+TOXtDLjA5oP4EmEgseLwxFxW+I=";
diff --git a/pkgs/development/coq-modules/rewriter/default.nix b/pkgs/development/coq-modules/rewriter/default.nix
index d7c4ff330e1f..42cc8f777125 100644
--- a/pkgs/development/coq-modules/rewriter/default.nix
+++ b/pkgs/development/coq-modules/rewriter/default.nix
@@ -16,12 +16,12 @@ mkCoqDerivation {
     in
     lib.switch coq.coq-version [
       {
-        case = range "8.17" "8.19";
-        out = "0.0.11";
+        case = range "8.17" "9.0";
+        out = "0.0.15";
       }
     ] null;
   release = {
-    "0.0.11".sha256 = "sha256-aYoO08nwItlOoE5BnKRGib2Zk4Fz4Ni/L4QaqkObPow=";
+    "0.0.15".sha256 = "sha256-zxNIMppFXUKShOXLbdZphy0Je5ii6cjcWUUcQMTcaHk=";
   };
   releaseRev = v: "v${v}";
 
diff --git a/pkgs/development/coq-modules/simple-io/default.nix b/pkgs/development/coq-modules/simple-io/default.nix
index 8b7209692f27..85c0e2fce056 100644
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@@ -18,10 +18,11 @@
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.17" "9.1") "1.10.0")
+      (case (range "8.17" "9.1") "1.11.0")
       (case (range "8.11" "8.19") "1.8.0")
       (case (range "8.7" "8.13") "1.3.0")
     ] null;
+  release."1.11.0".sha256 = "sha256-sgbH7eI4TPHOQ5qBvM6x7G3j8B40HSEMEzFaN1G9VEw=";
   release."1.10.0".sha256 = "sha256-67cBhLvRMWLWBL7NXK1zZTQC4PtSKu9qtesU4SqKkOw=";
   release."1.8.0".sha256 = "sha256-3ADNeXrBIpYRlfUW+LkLHUWV1w1HFrVc/TZISMuwvRY=";
   release."1.7.0".sha256 = "sha256:1a1q9x2abx71hqvjdai3n12jxzd49mhf3nqqh3ya2ssl2lj609ci";
diff --git a/pkgs/development/coq-modules/unicoq/default.nix b/pkgs/development/coq-modules/unicoq/default.nix
index aa9a84ac8315..401015b89dec 100644
--- a/pkgs/development/coq-modules/unicoq/default.nix
+++ b/pkgs/development/coq-modules/unicoq/default.nix
@@ -12,11 +12,16 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = range "8.20" "9.0";
+        out = "1.6-8.20";
+      }
       {
         case = range "8.19" "8.19";
-        out = "1.6-${coq.coq-version}";
+        out = "1.6-8.19";
       }
     ] null;
+  release."1.6-8.20".sha256 = "sha256-zne9LB0lGdqUfrBe8cDK8fwuxfBDFU4PqNlt9nl7rNI=";
   release."1.6-8.19".sha256 = "sha256-fDk60B8AzJwiemxHGgWjNu6PTu6NcJoI9uK7Ww2AT14=";
   releaseRev = v: "v${v}";
   mlPlugin = true;
diff --git a/pkgs/development/libraries/ipu6-camera-hal/default.nix b/pkgs/development/libraries/ipu6-camera-hal/default.nix
index 1b98caa3e5d1..a3f379b092ea 100644
--- a/pkgs/development/libraries/ipu6-camera-hal/default.nix
+++ b/pkgs/development/libraries/ipu6-camera-hal/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
     "-DUSE_PG_LITE_PIPE=ON"
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error"
   ];
 
diff --git a/pkgs/development/misc/msp430/mspdebug.nix b/pkgs/development/misc/msp430/mspdebug.nix
index 00aaa9b70511..ce3162fe9d03 100644
--- a/pkgs/development/misc/msp430/mspdebug.nix
+++ b/pkgs/development/misc/msp430/mspdebug.nix
@@ -17,13 +17,13 @@ assert enableReadline -> readline != null;
 assert enableMspds -> mspds != null;
 
 stdenv.mkDerivation rec {
-  version = "0.25";
+  version = "0.26";
   pname = "mspdebug";
   src = fetchFromGitHub {
     owner = "dlbeer";
     repo = "mspdebug";
     rev = "v${version}";
-    sha256 = "0prgwb5vx6fd4bj12ss1bbb6axj2kjyriyjxqrzd58s5jyyy8d3c";
+    sha256 = "sha256-4TisC0Nm3lYMWCJ3TtaHDAfLDejMQZJIruh2f7fCndU=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index de1a02ab7f70..55d96e0b4a93 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -540,7 +540,8 @@ let
     in
     stdenv.mkDerivation (
       {
-        name = "${name}${if version == null then "" else "-${version}"}";
+        pname = name;
+
         buildInputs = [
           tarWrapper
           python
diff --git a/pkgs/development/ocaml-modules/vg/default.nix b/pkgs/development/ocaml-modules/vg/default.nix
index 8f7dce667f8e..508e4055200f 100644
--- a/pkgs/development/ocaml-modules/vg/default.nix
+++ b/pkgs/development/ocaml-modules/vg/default.nix
@@ -17,17 +17,14 @@
 
 let
   inherit (lib) optionals versionOlder;
-
+in
+stdenv.mkDerivation (finalAttrs: {
+  name = "ocaml${ocaml.version}-${finalAttrs.pname}-${finalAttrs.version}";
   pname = "vg";
   version = "0.9.5";
-  webpage = "https://erratique.ch/software/${pname}";
-in
-stdenv.mkDerivation {
-
-  name = "ocaml${ocaml.version}-${pname}-${version}";
 
   src = fetchurl {
-    url = "${webpage}/releases/${pname}-${version}.tbz";
+    url = "https://erratique.ch/software/vg/releases/vg-${finalAttrs.version}.tbz";
     hash = "sha256-qcTtvIfSUwzpUZDspL+54UTNvWY6u3BTvfGWF6c0Jvw=";
   };
 
@@ -71,11 +68,11 @@ stdenv.mkDerivation {
       Renderers for PDF, SVG and the HTML canvas are distributed with the
       module. An API allows to implement new renderers.
     '';
-    homepage = webpage;
+    homepage = "https://erratique.ch/software/vg";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.jirkamarsik ];
     mainProgram = "vecho";
     inherit (ocaml.meta) platforms;
     broken = versionOlder ocaml.version "4.14";
   };
-}
+})
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index 9b2de4e56237..4c5863a035ca 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -21,10 +21,10 @@
   crcmod,
   cryptography,
   dill,
+  envoy-data-plane,
   fastavro,
   fasteners,
   grpcio,
-  hdfs,
   httplib2,
   numpy,
   objsize,
@@ -63,52 +63,33 @@
   pythonAtLeast,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "apache-beam";
-  version = "2.70.0";
+  version = "2.71.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
-    tag = "v${version}";
-    hash = "sha256-sySHoknK2FmiAEOpRdF9i3vA6NvnDrZyBCghVoyEzLw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pIuRaBN1lmC3EMuUnBovl/pBmNwsDZ/vh/OM/sD9SrI=";
   };
 
-  sourceRoot = "${src.name}/sdks/python";
+  sourceRoot = "${finalAttrs.src.name}/sdks/python";
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "==" ">=" \
-      --replace-fail ",<2.3.0" ""
+      --replace-fail "==" ">="
 
     substituteInPlace setup.py \
       --replace-fail "  copy_tests_from_docs()" ""
   '';
 
   pythonRelaxDeps = [
-    "beartype"
-    "grpcio"
+    "envoy-data-plane"
     "jsonpickle"
     "objsize"
-
-    # As of apache-beam v2.55.1, the requirement is cloudpickle~=2.2.1, but
-    # the current (2024-04-20) nixpkgs's pydot version is 3.0.0.
-    "cloudpickle"
-
-    # See https://github.com/NixOS/nixpkgs/issues/156957
-    "dill"
-
-    "numpy"
-
-    "protobuf"
-
-    # As of apache-beam v2.45.0, the requirement is pyarrow<10.0.0,>=0.15.1, but
-    # the current (2023-02-22) nixpkgs's pyarrow version is 11.0.0.
     "pyarrow"
-
-    "pydot"
-    "redis"
   ];
 
   build-system = [
@@ -129,10 +110,10 @@ buildPythonPackage rec {
     crcmod
     cryptography
     dill
+    envoy-data-plane
     fastavro
     fasteners
     grpcio
-    hdfs
     httplib2
     numpy
     objsize
@@ -258,6 +239,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # AssertionError: Lists differ:
+    # ['pickled_main_session', 'submission_environment_dependencies.txt'] != ['pickled_main_session']
+    "test_main_session_staged_when_using_cloudpickle"
+
+    # TypeError: NoneType takes no arguments
+    "test_run_inference_with_rate_limiter"
+    "test_run_inference_with_rate_limiter_exceeded"
+
     # RuntimeError: This pipeline runs with the pipeline option --update_compatibility_version=2.67.0 or earlier.
     # When running with this option on SDKs 2.68.0 or later, you must ensure dill==0.3.1.1 is installed. Error
     "test_reshuffle_custom_window_preserves_metadata_1"
@@ -328,13 +317,56 @@ buildPythonPackage rec {
 
     # TypeError: Expected Iterator in return type annotatio
     "test_get_output_batch_type"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # TypeError: Could not determine schema for type hint Any.
+    # Did you mean to create a schema-aware PCollection? See https://s.apache.org/beam-python-schemas
+    "test_dataframes"
+    "test_dataframes_same_cell_twice"
+
+    # AssertionError: 'OptionalUnionType(unnamed: int | str | None)' not found in ('OptionalUnionType(unnamed: typing.Union[int, str, NoneType])', 'OptionalUnionType(unnamed: typing.Union[str, int, NoneType])')
+    "test_pformat_namedtuple_with_unnamed_fields"
+
+    # AssertionError: Lists differ:
+    # ['ref[26 chars]_Coder_FastPrimitivesCoder_3', 'ref_Coder_GlobalWindowCoder_2']
+    # != ['ref[26 chars]_Coder_GlobalWindowCoder_2', 'ref_Coder_VersionedCoder_v269_3']
+    "test_coder_version_tag_included_in_runner_api_key"
+
+    # AttributeError: 'int' object has no attribute 'upper' [while running 'Map(<lambda at core_test.py:555>)']
+    "test_typecheck_with_default"
+
+    # AssertionError: Any != <class 'int'> (or similar type mismatches)
+    "test_child_without_output_hints_infers_partial_types_from_dofn"
+    "test_combine_properly_pipeline_type_checks_using_decorator"
+    "test_combine_properly_pipeline_type_checks_without_decorator"
+    "test_filter_typehint"
+    "test_mean_globally_pipeline_checking_satisfied"
+    "test_mean_globally_runtime_checking_satisfied"
+    "test_pardo_type_inference"
+    "test_pipeline_inference"
+    "test_ptransform_override_type_hints"
+    "test_type_inference"
+
+    # AssertionError: TypeCheckError not raised
+    "test_inferred_bad_kv_type"
+
+    # RuntimeError: NotImplementedError [while running 'WithKeys(<lambda at...y:232>)/Map(<lambda at util.py:1193>)']
+    "test_co_group_by_key_on_unpickled"
+
+    # TypeError: object of type 'member_descriptor' has no len()
+    "test_convert_bare_types_fail"
+    # TypeError: Parameter to List hint must be a non-sequence, a type, or a TypeConstraint.
+    # ForwardRef('int') is an instance of ForwardRef
+    "test_forward_reference"
+    # TypeError: Unable to deterministically encode ...
+    "test_deterministic_key"
   ];
 
   meta = {
     description = "Unified model for defining both batch and streaming data-parallel processing pipelines";
     homepage = "https://beam.apache.org/";
-    changelog = "https://github.com/apache/beam/blob/${src.tag}/CHANGES.md";
+    changelog = "https://github.com/apache/beam/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ndl ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/autopage/default.nix b/pkgs/development/python-modules/autopage/default.nix
index 7536d4d9e462..58f1a6d13250 100644
--- a/pkgs/development/python-modules/autopage/default.nix
+++ b/pkgs/development/python-modules/autopage/default.nix
@@ -1,29 +1,41 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
+  fixtures,
+  less,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "autopage";
-  version = "0.5.2";
-
+  version = "0.6.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-gmmW10xaqfS2kWGVVHMSrGOEusOBC4UXBj8pMkgle3I=";
+  src = fetchFromGitHub {
+    owner = "zaneb";
+    repo = "autopage";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oBZoGVvgUhrfcEUvmhIN7Wnsv+SvkC553LAhHGCVIBQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    fixtures
+    less
+    pytestCheckHook
+  ]
+  ++ fixtures.optional-dependencies.streams;
 
   pythonImportsCheck = [ "autopage" ];
 
   meta = {
+    changelog = "https://github.com/zaneb/autopage/releases/tag/${finalAttrs.src.tag}";
     description = "Library to provide automatic paging for console output";
     homepage = "https://github.com/zaneb/autopage";
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/dnfile/default.nix b/pkgs/development/python-modules/dnfile/default.nix
index 778bb36ce4af..b2a57234f64c 100644
--- a/pkgs/development/python-modules/dnfile/default.nix
+++ b/pkgs/development/python-modules/dnfile/default.nix
@@ -7,16 +7,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "dnfile";
-  version = "0.17.0";
+  version = "0.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "malwarefrank";
     repo = "dnfile";
-    tag = "v${version}";
-    hash = "sha256-JiJ7qvBP0SDGMynQuu2AyCwHU9aDI7Pq5/Z9IiWPWng=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lIhhiOtMZnYziGeLUK7awJSibP3k8JCYg43jvIl5Puw=";
     fetchSubmodules = true;
   };
 
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module to parse .NET executable files";
     homepage = "https://github.com/malwarefrank/dnfile";
-    changelog = "https://github.com/malwarefrank/dnfile/blob/${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/malwarefrank/dnfile/blob/${finalAttrs.src.tag}/HISTORY.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/doubleratchet/default.nix b/pkgs/development/python-modules/doubleratchet/default.nix
index 83abc30b3ee1..1c75a7d2a8a2 100644
--- a/pkgs/development/python-modules/doubleratchet/default.nix
+++ b/pkgs/development/python-modules/doubleratchet/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "doubleratchet";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-doubleratchet";
     tag = "v${version}";
-    hash = "sha256-TgkRityDMSzyF6ihM63lAGCSrCHCHrsbCyGYUaObvDU=";
+    hash = "sha256-iw0JIegwEiBpA/9blGKb0Oh1K3j74A3ZomtMRKgJL0E=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/envoy-data-plane/default.nix b/pkgs/development/python-modules/envoy-data-plane/default.nix
new file mode 100644
index 000000000000..f9f67018c486
--- /dev/null
+++ b/pkgs/development/python-modules/envoy-data-plane/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  betterproto,
+  grpcio-tools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "envoy-data-plane";
+  version = "1.0.3";
+  pyproject = true;
+
+  # Version 2.0.0 appears to be an empty archive and apache-beam requires envoy-data-planes<2.0.0
+  # nixpkgs-update: no auto update
+  src = fetchPypi {
+    pname = "envoy_data_plane";
+    inherit (finalAttrs) version;
+    hash = "sha256-UkSrtENDXjEtvEJldgZ5UHHkxK3rOqV3mmifrLGo538=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  pythonRelaxDeps = [
+    "betterproto"
+  ];
+  dependencies = [
+    betterproto
+    grpcio-tools
+  ];
+
+  pythonImportsCheck = [ "envoy_data_plane" ];
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Python dataclasses for the Envoy Data-Plane-API";
+    homepage = "https://pypi.org/project/envoy_data_plane/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/fastgit/default.nix b/pkgs/development/python-modules/fastgit/default.nix
index 659edadee631..1e2dba6e7bf4 100644
--- a/pkgs/development/python-modules/fastgit/default.nix
+++ b/pkgs/development/python-modules/fastgit/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastgit";
-  version = "0.0.1";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fastgit";
     tag = finalAttrs.version;
-    hash = "sha256-zpX8Y8Cuoeh8oeYJjZOD2KZByu7OUwOva546gBP5iZs=";
+    hash = "sha256-l843vKDC3RZGMhmnvPxAQPkvXPGQwmuqe310j/2e2pM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fava-portfolio-returns/default.nix b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
index b539d281c094..14948206ac10 100644
--- a/pkgs/development/python-modules/fava-portfolio-returns/default.nix
+++ b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   buildNpmPackage,
   fetchFromGitHub,
-  stdenv,
   fava,
   hatch-vcs,
   hatchling,
@@ -71,16 +70,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "fava_portfolio_returns" ];
 
-  # Stay in the root of the repository, so that relative paths to example files
-  # loaded by tests stay correct.
-  # Remove `src` to avoid `PYTHONPATH` issues related to `pytestCheckHook` ([1])
+  # Use importlib import mode to avoid `PYTHONPATH` issues related to `pytestCheckHook` ([1])
   # [1]: https://github.com/NixOS/nixpkgs/issues/255262
-  preCheck = ''
-    rm -rf src
-  '';
-
   pytestFlags = [
-    "${placeholder "out"}"
+    "--import-mode=importlib"
   ];
 
   passthru = {
diff --git a/pkgs/development/python-modules/fava/default.nix b/pkgs/development/python-modules/fava/default.nix
index c8c5f7c2461b..03337bf01f44 100644
--- a/pkgs/development/python-modules/fava/default.nix
+++ b/pkgs/development/python-modules/fava/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   buildNpmPackage,
+  fetchpatch2,
   fetchFromGitHub,
   stdenv,
   babel,
@@ -24,17 +25,17 @@
 let
   src = buildNpmPackage (finalAttrs: {
     pname = "fava-frontend";
-    version = "1.30.7";
+    version = "1.30.9";
 
     src = fetchFromGitHub {
       owner = "beancount";
       repo = "fava";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-gO6eJIFp/yWAXFWhUcqkkfk2pA8/vyTxgPRPBmv4a6Q=";
+      hash = "sha256-/Tnu1SgYhd22HVEzOtJ8YEHyxXuQ9xW0c/1oRyVePXw=";
     };
     sourceRoot = "${finalAttrs.src.name}/frontend";
 
-    npmDepsHash = "sha256-cXIhEzYFpLOxUEY7lhTWW7R3/ptkx7hB9K92Fd2m1Ng=";
+    npmDepsHash = "sha256-5ee044Ev2FoxcdChZwfHnLQiiP+Ag4bNSAlzEnenAa0=";
     makeCacheWritable = true;
 
     preBuild = ''
@@ -55,7 +56,15 @@ buildPythonPackage {
 
   inherit src;
 
-  patches = [ ./dont-compile-frontend.patch ];
+  patches = [
+    ./dont-compile-frontend.patch
+    # https://github.com/beancount/fava/pull/2176
+    (fetchpatch2 {
+      name = "fix-have-excel-replacement.patch";
+      url = "https://github.com/beancount/fava/commit/36eba34495d189cd391fae0276aa1b6c94940203.patch?full_index=1";
+      hash = "sha256-XSkzygnq8eHkIcp1TT7J3NdcLCIwUxDoyipO4M9M3nE=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace tests/test_cli.py \
diff --git a/pkgs/development/python-modules/gpiodevice/default.nix b/pkgs/development/python-modules/gpiodevice/default.nix
index 8f29837fb3e8..0cba569db157 100644
--- a/pkgs/development/python-modules/gpiodevice/default.nix
+++ b/pkgs/development/python-modules/gpiodevice/default.nix
@@ -11,14 +11,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "gpiodevice";
-  version = "0.0.4";
+  version = "0.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pimoroni";
     repo = "gpiodevice-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1vZHRCHUmG+t0TYxYzc2qwElKrcLa0WmQ+FI5GTN1A8=";
+    hash = "sha256-alff1qWxxcG6ooSQdAZ/T+ALYvWC41vX0mMu/xBeGb4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/growattserver/default.nix b/pkgs/development/python-modules/growattserver/default.nix
index 719ce3bd7989..58c2666c18e2 100644
--- a/pkgs/development/python-modules/growattserver/default.nix
+++ b/pkgs/development/python-modules/growattserver/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "growattserver";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "indykoning";
     repo = "PyPi_GrowattServer";
     tag = finalAttrs.version;
-    hash = "sha256-2Jgz/wN0k6ni+4PbQwfDg3uMvYxv5N3BVgdARHqQ0Yc=";
+    hash = "sha256-CTIc+LROas7RGf9BzGl8hasS512LsNXcDnzLu0DD+Bk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index afd82fd7e080..d92d524f4a77 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202602011";
+  version = "0.1.202602021";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oYGU8RrphOysbrZ002CF2kraAzWSZNnpLskDCZ66kHY=";
+    hash = "sha256-310x0g6TBy64Svj8aO5vvmCFWaL4txA6rZLXxSrxL2g=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index bcb1f0fcd6b8..71a672074f88 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "12.1.2";
+  version = "12.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "allenporter";
     repo = "ical";
     tag = version;
-    hash = "sha256-A3rFZUjUdDkkMhh3ytsBg89o1BtCYWFB0d/usmiuyec=";
+    hash = "sha256-L/shJ2FM0x4LDPHlnCfhbujeTYNRw+MOJt6yRqZZCok=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/incomfort-client/default.nix b/pkgs/development/python-modules/incomfort-client/default.nix
index 138cf9286f28..c332628c7d43 100644
--- a/pkgs/development/python-modules/incomfort-client/default.nix
+++ b/pkgs/development/python-modules/incomfort-client/default.nix
@@ -10,16 +10,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "incomfort-client";
-  version = "0.6.11";
+  version = "0.6.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zxdavb";
     repo = "incomfort-client";
-    tag = "v${version}";
-    hash = "sha256-HCawa+eFpC0t/dC8fQ+teMaPpuxrYBprEV8SxnhZ1ls=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5IP0R7NI+TXBOPwDZ26inVC6YxhYozo4ZM/V7w73EvQ=";
   };
 
   build-system = [ poetry-core ];
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module to poll Intergas boilers via a Lan2RF gateway";
     homepage = "https://github.com/zxdavb/incomfort-client";
-    changelog = "https://github.com/jbouwh/incomfort-client/releases/tag/${src.tag}";
+    changelog = "https://github.com/jbouwh/incomfort-client/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/json-repair/default.nix b/pkgs/development/python-modules/json-repair/default.nix
index 814e3466aa07..bc22f0b4c49e 100644
--- a/pkgs/development/python-modules/json-repair/default.nix
+++ b/pkgs/development/python-modules/json-repair/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "json-repair";
-  version = "0.55.1";
+  version = "0.55.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mangiucugna";
     repo = "json_repair";
     tag = "v${version}";
-    hash = "sha256-I3DYzD5hQn7toU6P8kbiuB+LsGr8PmMULQYwybkzHB4=";
+    hash = "sha256-CzoGu6JNOaqdLZK4DyDUv+TMIA+k9AlZZy1fKnpMbkE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 06c7f3043833..5c43ddfdb036 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2026.1.15.112308";
+  version = "2026.1.28.162006";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-Q+9BUS0A/e0hIBq8J2hRZi/L7LKhf7vSEIFkPI0RMj0=";
+    hash = "sha256-RbQYL33UtvhnU3EhwPeMTpUcH4c8+tfcp4Hk9uRIFMo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index ad359bd41e8a..669f951cf82b 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-anthropic";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${version}";
-    hash = "sha256-/CqnpeQXYdafkly8shen72dIZU3I9o/2TwM903Nw9DA=";
+    hash = "sha256-6zyigILq3aRT6CNzOlSGWE8MJUZIN5LUbsb/Xuev1so=";
   };
 
   sourceRoot = "${src.name}/libs/partners/anthropic";
diff --git a/pkgs/development/python-modules/lpips/default.nix b/pkgs/development/python-modules/lpips/default.nix
new file mode 100644
index 000000000000..5e52af91d503
--- /dev/null
+++ b/pkgs/development/python-modules/lpips/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  numpy,
+  scipy,
+  setuptools,
+  torch,
+  torchvision,
+  tqdm,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "lpips";
+  version = "0.1.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "richzhang";
+    repo = "PerceptualSimilarity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dIQ9B/HV/2kUnXLXNxAZKHmv/Xv37kl2n6+8IfwIALE=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    numpy
+    scipy
+    torch
+    torchvision
+    tqdm
+  ];
+
+  # Tests require network access to download pretrained models.
+  doCheck = false;
+
+  pythonImportsCheck = [ "lpips" ];
+
+  meta = {
+    description = "Learned Perceptual Image Patch Similarity metric";
+    homepage = "https://github.com/richzhang/PerceptualSimilarity";
+    changelog = "https://github.com/richzhang/PerceptualSimilarity/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ jeffcshelton ];
+  };
+})
diff --git a/pkgs/development/python-modules/lunatone-rest-api-client/default.nix b/pkgs/development/python-modules/lunatone-rest-api-client/default.nix
index 5f91cf2e06b8..8ddd33ad1248 100644
--- a/pkgs/development/python-modules/lunatone-rest-api-client/default.nix
+++ b/pkgs/development/python-modules/lunatone-rest-api-client/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "lunatone-rest-api-client";
-  version = "0.6.0";
+  version = "0.6.3";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "lunatone-public";
     repo = "lunatone-rest-api-client";
     tag = "v${version}";
-    hash = "sha256-kPvHyabiT+Vl+/yCGQxyD16HPoOKsL7ij3c0LO3qNe8=";
+    hash = "sha256-KP+i5TmvCkdyIiuGiP9H8GmRC2+/r7QCqmzD+/2+tU8=";
   };
 
   build-system = [ hatchling ];
@@ -27,7 +27,8 @@ buildPythonPackage rec {
   dependencies = [
     aiohttp
     pydantic
-  ];
+  ]
+  ++ aiohttp.optional-dependencies.speedups;
 
   pythonImportsCheck = [ "lunatone_rest_api_client" ];
 
diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index 9227fc73e081..a27f1be9e5da 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "netutils";
-  version = "1.16.0";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
     tag = "v${version}";
-    hash = "sha256-wcg6Ze/xjEA9vlby84kYO01lyh2YBtS00ZvcC569ejU=";
+    hash = "sha256-j5SSlbxQtJvjZoloB9eS7moiISfFcVZZPg6OG+LpyBI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/numericalunits/default.nix b/pkgs/development/python-modules/numericalunits/default.nix
index b4b463ddc5d8..b58fcf9cba67 100644
--- a/pkgs/development/python-modules/numericalunits/default.nix
+++ b/pkgs/development/python-modules/numericalunits/default.nix
@@ -1,20 +1,24 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
   setuptools,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "numericalunits";
   version = "1.26";
   pyproject = true;
 
+  # AttributeError: module 'ast' has no attribute 'Num'
+  disabled = pythonAtLeast "3.14";
+
   src = fetchFromGitHub {
     owner = "sbyrnes321";
     repo = "numericalunits";
-    tag = "numericalunits-${version}";
+    tag = "numericalunits-${finalAttrs.version}";
     hash = "sha256-vPB1r+j+p9n+YLnBjHuk2t+QSr+adEOjyC45QSbeb4M=";
   };
 
@@ -26,6 +30,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "numericalunits" ];
+
   enabledTestPaths = [
     "tests/tests.py"
   ];
@@ -36,4 +42,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/protego/default.nix b/pkgs/development/python-modules/protego/default.nix
index d5e66765082c..a732efb982ac 100644
--- a/pkgs/development/python-modules/protego/default.nix
+++ b/pkgs/development/python-modules/protego/default.nix
@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "protego";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scrapy";
     repo = "protego";
-    tag = version;
-    hash = "sha256-70/DPap3FgLfh4ldYSve5Pt8o7gM1lME/OmRFaew/38=";
+    tag = finalAttrs.version;
+    hash = "sha256-qyOY35gNFojewFMFVT58k1s5uM4j9IZzEURnPh+3htE=";
   };
 
   build-system = [ hatchling ];
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module to parse robots.txt files with support for modern conventions";
     homepage = "https://github.com/scrapy/protego";
-    changelog = "https://github.com/scrapy/protego/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/scrapy/protego/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/py-libzfs/default.nix b/pkgs/development/python-modules/py-libzfs/default.nix
index de4d805addf9..7161f2bfe109 100644
--- a/pkgs/development/python-modules/py-libzfs/default.nix
+++ b/pkgs/development/python-modules/py-libzfs/default.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   fetchpatch2,
   cython_0,
-  zfs,
+  zfs_2_3,
 }:
 
 buildPythonPackage rec {
@@ -30,14 +30,14 @@ buildPythonPackage rec {
   ];
 
   build-system = [ cython_0 ];
-  buildInputs = [ zfs ];
+  buildInputs = [ zfs_2_3 ];
 
   # Passing CFLAGS in configureFlags does not work, see https://github.com/truenas/py-libzfs/issues/107
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace configure \
       --replace-fail \
         'CFLAGS="-DCYTHON_FALLTHROUGH"' \
-        'CFLAGS="-DCYTHON_FALLTHROUGH -I${zfs.dev}/include/libzfs -I${zfs.dev}/include/libspl"' \
+        'CFLAGS="-DCYTHON_FALLTHROUGH -I${zfs_2_3.dev}/include/libzfs -I${zfs_2_3.dev}/include/libspl"' \
       --replace-fail 'zof=false' 'zof=true'
   '';
 
diff --git a/pkgs/development/python-modules/pydivsufsort/default.nix b/pkgs/development/python-modules/pydivsufsort/default.nix
new file mode 100644
index 000000000000..0679a1f228a3
--- /dev/null
+++ b/pkgs/development/python-modules/pydivsufsort/default.nix
@@ -0,0 +1,45 @@
+{
+  buildPythonPackage,
+  cmake,
+  cython,
+  fetchPypi,
+  lib,
+  numpy,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pydivsufsort";
+  version = "0.0.20";
+
+  pyproject = true;
+
+  # The repo hosted on github does not have tags, so we use fetchPypi, though
+  # we should replace with fetchFromGitHub when we have
+  # https://github.com/louisabraham/pydivsufsort/issues/52
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-aFpXkfrl4gDOi3pOXVFbYVP/3nF1MxvQ34GkIRCK1N8=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace-fail /bin/bash bash
+    patchShebangs build.sh
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  dontUseCmakeConfigure = true;
+
+  build-system = [ setuptools ];
+  dependencies = [
+    cython
+    numpy
+  ];
+
+  meta = {
+    description = "Bindings to `libdivsufsort`";
+    homepage = "https://github.com/louisabraham/pydivsufsort";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+})
diff --git a/pkgs/development/python-modules/pyhik/default.nix b/pkgs/development/python-modules/pyhik/default.nix
index 1b5944bb259a..f6ec9e71cd51 100644
--- a/pkgs/development/python-modules/pyhik/default.nix
+++ b/pkgs/development/python-modules/pyhik/default.nix
@@ -7,16 +7,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyhik";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mezz64";
     repo = "pyHik";
-    tag = version;
-    hash = "sha256-dDUaNeE0wjKsojeezKVWfMBPO+7O5e2QFOHnh3UoFbY=";
+    tag = finalAttrs.version;
+    hash = "sha256-ree2UbGfmz4Xs0aRiAWcOnCEpnrjR11PBmo/hMnbnlI=";
   };
 
   build-system = [
@@ -44,4 +44,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.jamiemagee ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymeteoclimatic/default.nix b/pkgs/development/python-modules/pymeteoclimatic/default.nix
index 9df87231b932..7db70a6145ad 100644
--- a/pkgs/development/python-modules/pymeteoclimatic/default.nix
+++ b/pkgs/development/python-modules/pymeteoclimatic/default.nix
@@ -8,21 +8,21 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymeteoclimatic";
-  version = "0.1.0";
+  version = "0.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adrianmo";
     repo = "pymeteoclimatic";
-    tag = version;
-    hash = "sha256-rP0+OYDnQ4GuoV7DzR6jtgH6ilTMLjdaEFJcz3L0GYQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-Yln+uUwnb5mlPS3uRRzpAH6kSc9hU2jEnhk/3ifiwWI=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     beautifulsoup4
     lxml
   ];
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper around the Meteoclimatic service";
     homepage = "https://github.com/adrianmo/pymeteoclimatic";
-    changelog = "https://github.com/adrianmo/pymeteoclimatic/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/adrianmo/pymeteoclimatic/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index ade8f0740fa1..fc42fdb4fa21 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -35,6 +35,12 @@ buildPythonPackage rec {
       url = "https://github.com/rapidfuzz/RapidFuzz/commit/0ef2a4980c41b852283e6db7a747a1632307c75e.patch";
       hash = "sha256-xb+J3PXwD51lZqIJcTzPJWrT/oqrIXxh1cLp91DhIPg=";
     })
+    # https://github.com/rapidfuzz/RapidFuzz/pull/470
+    (fetchpatch {
+      name = "support-taskflow-4.0.0.patch";
+      url = "https://github.com/rapidfuzz/RapidFuzz/commit/4b794e6168d98fff4c518a64c4d809238b17d8fe.patch";
+      hash = "sha256-F4gwV4ewcHfR7ptcEVAvbiNFIvXqFCIM/Qk8giv4jAc=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index e12f9a86cef5..db6d0e8bd133 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.1.10";
+  version = "2.1.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     tag = "v${version}";
-    hash = "sha256-k4Itd+x+1NbDsot2feunMKQVZA7ngAE4Bvy6+07gdaY=";
+    hash = "sha256-UaH3Uoq3unArgeY7jDcN8ZXxZfo31oneUz34cUMyNHg=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest
diff --git a/pkgs/development/python-modules/rmsd/default.nix b/pkgs/development/python-modules/rmsd/default.nix
index 969db3fb3f6b..5b752ff48fc8 100644
--- a/pkgs/development/python-modules/rmsd/default.nix
+++ b/pkgs/development/python-modules/rmsd/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "rmsd";
-  version = "1.6.4";
+  version = "1.6.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dhLsFGts45PitSVZxXw5FND3EOeHHWYrH8PZJEYoq+M=";
+    hash = "sha256-blEDbbrGtOz067Jq24QMBU5P8otmBwnUl8Tpjvc7TLo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/slither-analyzer/default.nix b/pkgs/development/python-modules/slither-analyzer/default.nix
index 045574b56631..2f53803f885c 100644
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@@ -1,16 +1,27 @@
 {
   lib,
   buildPythonPackage,
-  crytic-compile,
   fetchFromGitHub,
+
+  # build-system
   hatchling,
+
+  # nativeBuildInputs
   makeWrapper,
+
+  # dependencies
+  crytic-compile,
   packaging,
   prettytable,
-  solc,
-  testers,
-  versionCheckHook,
   web3,
+
+  # tests
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # postFixup
+  solc,
+
   withSolc ? false,
 }:
 
@@ -37,18 +48,17 @@ buildPythonPackage (finalAttrs: {
     web3
   ];
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
 
   postFixup = lib.optionalString withSolc ''
     wrapProgram $out/bin/slither \
       --prefix PATH : "${lib.makeBinPath [ solc ]}"
   '';
 
-  # required for pythonImportsCheck
-  postInstall = ''
-    export HOME="$TEMP"
-  '';
-
   pythonImportsCheck = [
     "slither"
     "slither.all_exceptions"
@@ -66,8 +76,6 @@ buildPythonPackage (finalAttrs: {
     "slither.vyper_parsing"
   ];
 
-  doInstallCheck = true;
-
   meta = {
     description = "Static Analyzer for Solidity";
     longDescription = ''
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index 15015e9e7ce7..5c72895951c4 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -17,7 +17,12 @@
 }:
 
 buildPythonPackage {
-  inherit (subunit) name src meta;
+  inherit (subunit)
+    pname
+    version
+    src
+    meta
+    ;
   pyproject = true;
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 77c446724991..8074e9d25c65 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.41";
+  version = "3.1.42";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-egzZfCjTeMViZKe7hoMcvQjexOsTNNkIQu+Ms0M3UnA=";
+    hash = "sha256-YUE0fppBbZ8ivBpeCsavRyU3DjqlhZA5zLwchfrCrJQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index 54d194d3fe57..0f40c9771197 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "testcontainers";
-  version = "4.14.0";
+  version = "4.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "testcontainers";
     repo = "testcontainers-python";
     tag = "testcontainers-v${finalAttrs.version}";
-    hash = "sha256-Zquh1tY9Z2BU6BPsEGR4eBjcHVB4KsxOQ81Tk6YTyTQ=";
+    hash = "sha256-BB09uQX33/MiCfEBOXHjhl/OB2S/zKxqxYYcfJqWysY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/twomemo/default.nix b/pkgs/development/python-modules/twomemo/default.nix
index 4dfbe7e1b9c4..bd5ee3c82763 100644
--- a/pkgs/development/python-modules/twomemo/default.nix
+++ b/pkgs/development/python-modules/twomemo/default.nix
@@ -13,14 +13,14 @@
 }:
 buildPythonPackage rec {
   pname = "twomemo";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-twomemo";
     tag = "v${version}";
-    hash = "sha256-TNM7CLxo4C55APuL5BAts8kTyCl2SDajqwkaXxwK19E=";
+    hash = "sha256-OVZmssJuufKwyEd8q25h9AcDprZZPm588khncBqTaJA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/ufo-extractor/default.nix b/pkgs/development/python-modules/ufo-extractor/default.nix
new file mode 100644
index 000000000000..0481b03888b9
--- /dev/null
+++ b/pkgs/development/python-modules/ufo-extractor/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  setuptools,
+  setuptools-scm,
+  fonttools,
+  fontfeatures,
+  pytestCheckHook,
+  fetchFromGitHub,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "ufo-extractor";
+  version = "0.8.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "robotools";
+    repo = "extractor";
+    tag = finalAttrs.version;
+    hash = "sha256-SzNNRC2UxjyypgiM0iIicfemC67D6GW2jszNak8yCSM=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    fonttools
+    fontfeatures
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "extractor" ];
+
+  meta = {
+    description = "Tools for extracting data from font binaries into UFO objects";
+    homepage = "https://github.com/robotools/extractor";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/robotools/extractor/releases/tag/${finalAttrs.src.tag}";
+    maintainers = with lib.maintainers; [
+      qb114514
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 54e62ce9af68..bfb7a1b1ecb2 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -40,23 +40,18 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uiprotect";
-  version = "10.0.1";
+  version = "10.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "uilibs";
     repo = "uiprotect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pxxl/NhvJh2Ur8g+25padewvshqSUZmB7vpGmVlH15k=";
+    hash = "sha256-tQeDZMukKg3xL/tGeQ7+Rm3lzNJQEcDkErbLfKnaxN8=";
   };
 
   build-system = [ poetry-core ];
 
-  pythonRelaxDeps = [
-    "aiofiles"
-    "pydantic"
-  ];
-
   dependencies = [
     aiofiles
     aiohttp
diff --git a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
index 79ecb0184fda..841bc5312442 100644
--- a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
+++ b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "whirlpool-sixth-sense";
-  version = "1.0.3";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abmantis";
     repo = "whirlpool-sixth-sense";
     tag = version;
-    hash = "sha256-SXa5Ccnng1McWgSWy85xCEr7odtBSJtJhjZoC/JfI/A=";
+    hash = "sha256-n+PZHk64F7azgqeio8F5b/AheaZMh5TjvUXTgTc7q4A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index 01c4e15df120..305336dd4f68 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@
 
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "1.10.0";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA=";
+    hash = "sha256-od7RWHhyFQ7l3HZaqpOkUVtiWKDQj/tUsd5lGi6m34I=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA=";
+    hash = "sha256-YW4Yi1gvMjTNAgsAlyX1KMlyQPHCXh/jAoO/Nkrn2Sc=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/VirusTotal/yara-x/tree/main/py";
     changelog = "https://github.com/VirusTotal/yara-x/tree/${src.tag}/py";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ ivyfanchiang ];
+    maintainers = with lib.maintainers; [
+      ivyfanchiang
+      lesuisse
+    ];
   };
 }
diff --git a/pkgs/development/rocm-modules/miopen/default.nix b/pkgs/development/rocm-modules/miopen/default.nix
index 13dbfa9d4dfc..77ac8cab1533 100644
--- a/pkgs/development/rocm-modules/miopen/default.nix
+++ b/pkgs/development/rocm-modules/miopen/default.nix
@@ -65,6 +65,15 @@ let
     "gfx1201"
   ] gpuTargets;
 
+  kdbTargets = lib.intersectLists [
+    "gfx900"
+    "gfx906"
+    "gfx908"
+    "gfx90a"
+    "gfx942"
+    "gfx1030"
+  ] gpuTargets;
+
   src = fetchFromGitHub {
     owner = "ROCm";
     repo = "MIOpen";
@@ -111,25 +120,20 @@ let
     )
   );
 
-  gfx900 = runCommand "miopen-gfx900.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx900.kdb.bz2 > $out
-  '';
+  kernelDatabases = lib.genAttrs kdbTargets (
+    target:
+    runCommand "miopen-${target}.kdb" { preferLocalBuild = true; } ''
+      ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/${target}.kdb.bz2 > $out
+    ''
+  );
 
-  gfx906 = runCommand "miopen-gfx906.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx906.kdb.bz2 > $out
-  '';
-
-  gfx908 = runCommand "miopen-gfx908.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx908.kdb.bz2 > $out
-  '';
-
-  gfx90a = runCommand "miopen-gfx90a.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx90a.kdb.bz2 > $out
-  '';
-
-  gfx1030 = runCommand "miopen-gfx1030.kdb" { preferLocalBuild = true; } ''
-    ${lbzip2}/bin/lbzip2 -ckd ${src}/src/kernels/gfx1030.kdb.bz2 > $out
-  '';
+  linkKDBsTo =
+    targetPath:
+    lib.concatStringsSep "" (
+      map (target: ''
+        ln -sf ${kernelDatabases.${target}} ${targetPath}/${target}.kdb
+      '') kdbTargets
+    );
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit version src;
@@ -254,19 +258,12 @@ stdenv.mkDerivation (finalAttrs: {
       return()'
 
     patchShebangs test src/composable_kernel fin utils install_deps.cmake
-
-    ln -sf ${gfx900} src/kernels/gfx900.kdb
-    ln -sf ${gfx906} src/kernels/gfx906.kdb
-    ln -sf ${gfx908} src/kernels/gfx908.kdb
-    ln -sf ${gfx90a} src/kernels/gfx90a.kdb
-    ln -sf ${gfx1030} src/kernels/gfx1030.kdb
+  ''
+  + linkKDBsTo "src/kernels"
+  + ''
     mkdir -p build/share/miopen/db/
-    ln -sf ${gfx900} build/share/miopen/db/gfx900.kdb
-    ln -sf ${gfx906} build/share/miopen/db/gfx906.kdb
-    ln -sf ${gfx908} build/share/miopen/db/gfx908.kdb
-    ln -sf ${gfx90a} build/share/miopen/db/gfx90a.kdb
-    ln -sf ${gfx1030} build/share/miopen/db/gfx1030.kdb
-  '';
+  ''
+  + linkKDBsTo "build/share/miopen/db";
 
   # Unfortunately, it seems like we have to call make on these manually
   postBuild =
@@ -279,12 +276,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     rm $out/libexec/miopen/install_precompiled_kernels.sh
-    ln -sf ${gfx900} $out/share/miopen/db/gfx900.kdb
-    ln -sf ${gfx906} $out/share/miopen/db/gfx906.kdb
-    ln -sf ${gfx908} $out/share/miopen/db/gfx908.kdb
-    ln -sf ${gfx90a} $out/share/miopen/db/gfx90a.kdb
-    ln -sf ${gfx1030} $out/share/miopen/db/gfx1030.kdb
   ''
+  + linkKDBsTo "$out/share/miopen/db"
   + lib.optionalString buildDocs ''
     mv ../doc/html $out/share/doc/miopen-hip
   ''
diff --git a/pkgs/development/rocq-modules/relation-algebra/default.nix b/pkgs/development/rocq-modules/relation-algebra/default.nix
new file mode 100644
index 000000000000..0bb2e1d289ad
--- /dev/null
+++ b/pkgs/development/rocq-modules/relation-algebra/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  mkRocqDerivation,
+  rocq-core,
+  stdlib,
+  version ? null,
+}:
+
+mkRocqDerivation {
+  pname = "relation-algebra";
+  owner = "damien-pous";
+
+  inherit version;
+  defaultVersion =
+    lib.switch
+      [ rocq-core.rocq-version ]
+      [
+        {
+          cases = [ (lib.versions.isEq "9.0") ];
+          out = "1.8.0";
+        }
+      ]
+      null;
+
+  releaseRev = v: "v${v}";
+
+  release."1.8.0".sha256 = "sha256-RnY+a57KnStACteaT5dKQoCCH0qp7/W+4qoaApIilj0=";
+
+  propagatedBuildInputs = [
+    stdlib
+  ];
+
+  dontConfigure = true;
+
+  mlPlugin = true;
+
+  meta = {
+    description = "Relation algebra library for Rocq";
+    maintainers = with lib.maintainers; [ siraben ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/tools/boomerang/default.nix b/pkgs/development/tools/boomerang/default.nix
index 9c97b3b82a80..8b1fd0e3b229 100644
--- a/pkgs/development/tools/boomerang/default.nix
+++ b/pkgs/development/tools/boomerang/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   # Boomerang usually compiles with -Werror but has not been updated for newer
   # compilers. Disable -Werror for now. Consider trying to remove this when
   # updating this derivation.
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 703712d2d597..7d8c31368ab7 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -364,8 +364,8 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_9 = mkGradle {
-    version = "9.3.0";
-    hash = "sha256-DVhfadoJH8Wyvs7Yd/6rVaMGTUO4odRq6weZawkV4OA=";
+    version = "9.3.1";
+    hash = "sha256-smbV/2uQ6tptw7IMsJDjcxMC5VOifF0+TfHw12vq/wY=";
     defaultJava = jdk21;
   };
   gradle_8 = mkGradle {
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 77a237432e71..ca91b9d69b2e 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -9,6 +9,7 @@
   brotli,
   c-ares,
   libuv,
+  lief,
   llhttp,
   nghttp2,
   nghttp3,
@@ -124,6 +125,7 @@ let
   # TODO: also handle MIPS flags (mips_arch, mips_fpu, mips_float_abi).
 
   useSharedAdaAndSimd = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.2";
+  useSharedLief = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "25.6";
   useSharedSQLite = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.5";
   useSharedZstd = !stdenv.hostPlatform.isStatic && lib.versionAtLeast version "22.15";
 
@@ -161,6 +163,9 @@ let
     // (lib.optionalAttrs useSharedSQLite {
       inherit sqlite;
     })
+    // (lib.optionalAttrs useSharedLief {
+      inherit lief;
+    })
     // (lib.optionalAttrs useSharedZstd {
       inherit zstd;
     });
diff --git a/pkgs/development/web/nodejs/v25.nix b/pkgs/development/web/nodejs/v25.nix
index 0387c253810b..91215b2a2c32 100644
--- a/pkgs/development/web/nodejs/v25.nix
+++ b/pkgs/development/web/nodejs/v25.nix
@@ -25,8 +25,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "25.5.0";
-  sha256 = "7e35efaf63c8fe7737b8c62792ec547e5a95a69f1f813fcfba28566aecc9fd92";
+  version = "25.6.0";
+  sha256 = "9db6848c802b1981c0faeb71a5b8cc79913f82a747f7f1d50260c6d2f781ef7e";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 25530140c90a..23bf1b462982 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -262,7 +262,6 @@ stdenv.mkDerivation {
       robbinch
       a1russell
       numinit
-      ncfavier
     ];
   };
 }
diff --git a/pkgs/games/dwarf-fortress/game.nix b/pkgs/games/dwarf-fortress/game.nix
index 1fd93ff69036..eb3469b519ab 100644
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@@ -196,7 +196,6 @@ stdenv.mkDerivation {
       roconnor
       numinit
       shazow
-      ncfavier
     ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
   };
diff --git a/pkgs/games/openloco/default.nix b/pkgs/games/openloco/default.nix
index d0106e40831b..acaf1a9fbcf1 100644
--- a/pkgs/games/openloco/default.nix
+++ b/pkgs/games/openloco/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     sed -i 's#URL \+${openloco-objects.url}#URL ${openloco-objects}#' CMakeLists.txt
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=null-dereference";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=null-dereference";
 
   cmakeFlags = [
     "-DOPENLOCO_BUILD_TESTS=NO"
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 3a675436029a..201c318f24a5 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -421,19 +421,19 @@ in
     };
   };
 
-  kanagawa = mkTmuxPlugin {
-    pluginName = "kanagawa";
-    version = "0-unstable-2025-12-17";
+  ukiyo = mkTmuxPlugin {
+    pluginName = "ukiyo";
+    version = "0-unstable-2026-01-30";
     src = fetchFromGitHub {
       owner = "Nybkox";
-      repo = "tmux-kanagawa";
-      rev = "10a59af0a50aacf7e68e6757fb42e94d1804246e";
-      hash = "sha256-ldc++p2PcYdzoOLrd4PGSrueAGNWncdbc5k6wmFM9kQ=";
+      repo = "tmux-ukiyo";
+      rev = "14fdf51ad16f7b81019c53b987877e78e697f51b";
+      hash = "sha256-ILQVOQ6cfG7I7hFN72mgSTc0AZZW4WWHSxwWKbK0piY=";
     };
     meta = {
-      homepage = "https://github.com/Nybkox/tmux-kanagawa";
-      downloadPage = "https://github.com/Nybkox/tmux-kanagawa";
-      description = "Feature packed kanagawa theme for tmux";
+      homepage = "https://github.com/Nybkox/tmux-ukiyo";
+      downloadPage = "https://github.com/Nybkox/tmux-ukiyo";
+      description = "Feature packed ukiyo theme for tmux";
       license = lib.licenses.mit;
       platforms = lib.platforms.unix;
       maintainers = with lib.maintainers; [ FKouhai ];
@@ -1204,4 +1204,6 @@ in
 }
 // lib.optionalAttrs config.allowAliases {
   mkDerivation = throw "tmuxPlugins.mkDerivation is deprecated, use tmuxPlugins.mkTmuxPlugin instead"; # added 2021-03-14
+
+  kanagawa = throw "'tmuxPlugins.kanagawa' has been renamed to/replaced by 'tmuxPlugins.ukiyo'"; # Converted to throw 2026-01-30
 }
diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
index e2b10dc5df6c..d6a25e26aa24 100644
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -141,7 +141,7 @@ stdenv.mkDerivation rec {
       --subst-var-by kerberos ${kerberos}
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
+  env.NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
   pythonPath = pythonInputs;
 
   # Building and installing the server fails with silent Rhino errors, skipping
diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index 1377a7d5454d..da7146611cd3 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -40,7 +40,7 @@ let
       icu73
     ];
 
-    LD_LIBRARY_PATH = lib.makeLibraryPath [ icu73 ];
+    env.LD_LIBRARY_PATH = lib.makeLibraryPath [ icu73 ];
 
     configureFlags = [
       "--with-system-editline"
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
index a09496ec23df..a9a32cc38724 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-pyroscope-app";
-  version = "1.15.1";
-  zipHash = "sha256-iEd7n/JNSadT8I+lS5TiXqw6EKeLVRrARLpv805+Ipg=";
+  version = "1.16.0";
+  zipHash = "sha256-wsDzFq5i4Nsud/tAuX5Lg7vxRR7ndDhAcD/zhrAEct8=";
   meta = {
     description = "Integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/sql/postgresql/ext/plperl.nix b/pkgs/servers/sql/postgresql/ext/plperl.nix
index c59758094175..fa9a345097a6 100644
--- a/pkgs/servers/sql/postgresql/ext/plperl.nix
+++ b/pkgs/servers/sql/postgresql/ext/plperl.nix
@@ -11,7 +11,8 @@ let
     let
       perl' = perl.withPackages f;
       finalPackage = buildEnv {
-        name = "${postgresql.pname}-plperl-${postgresql.version}";
+        pname = "${postgresql.pname}-plperl";
+        inherit (postgresql) version;
         paths = [ postgresql.plperl ];
         passthru = {
           inherit withPackages;
diff --git a/pkgs/servers/sql/postgresql/ext/plpython3.nix b/pkgs/servers/sql/postgresql/ext/plpython3.nix
index 01cbde394fbc..b9e6824c8658 100644
--- a/pkgs/servers/sql/postgresql/ext/plpython3.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpython3.nix
@@ -11,7 +11,8 @@ let
     let
       python = python3.withPackages f;
       finalPackage = buildEnv {
-        name = "${postgresql.pname}-plpython3-${postgresql.version}";
+        pname = "${postgresql.pname}-plpython3";
+        inherit (postgresql) version;
         paths = [ postgresql.plpython3 ];
         passthru = {
           inherit withPackages;
diff --git a/pkgs/servers/sql/postgresql/ext/pltcl.nix b/pkgs/servers/sql/postgresql/ext/pltcl.nix
index ab39df762c46..240eb9565d35 100644
--- a/pkgs/servers/sql/postgresql/ext/pltcl.nix
+++ b/pkgs/servers/sql/postgresql/ext/pltcl.nix
@@ -13,7 +13,8 @@ let
       pkgs = f tclPackages;
       paths = lib.concatMapStringsSep " " (pkg: "${pkg}/lib") pkgs;
       finalPackage = buildEnv {
-        name = "${postgresql.pname}-pltcl-${postgresql.version}";
+        pname = "${postgresql.pname}-pltcl";
+        inherit (postgresql) version;
         paths = [ postgresql.pltcl ];
         passthru = {
           inherit withPackages;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index ff4f9bf8900f..5b71b82a63c4 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.30.0";
+  version = "2.30.2";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-DFhWAHjvjaLch+OU5XZYEqpRZMa4LmYzn3oFgweKsEU=";
+    hash = "sha256-9Y8vHGYyUYG0Vu6nglZseA92kpgKEBiNFU7wmGsmPlc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/graylog/plugins.nix b/pkgs/tools/misc/graylog/plugins.nix
index 95b0c09039e6..49ae37312f11 100644
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -39,7 +39,7 @@ let
 in
 {
   aggregates = glPlugin rec {
-    name = "graylog-aggregates-${version}";
+    pname = "graylog-aggregates";
     pluginName = "graylog-plugin-aggregates";
     version = "2.4.0";
     src = fetchurl {
@@ -52,7 +52,7 @@ in
     };
   };
   auth_sso = glPlugin rec {
-    name = "graylog-auth-sso-${version}";
+    pname = "graylog-auth-sso";
     pluginName = "graylog-plugin-auth-sso";
     version = "3.3.0";
     src = fetchurl {
@@ -65,7 +65,7 @@ in
     };
   };
   dnsresolver = glPlugin rec {
-    name = "graylog-dnsresolver-${version}";
+    pname = "graylog-dnsresolver";
     pluginName = "graylog-plugin-dnsresolver";
     version = "1.2.0";
     src = fetchurl {
@@ -78,7 +78,7 @@ in
     };
   };
   enterprise-integrations = glPlugin rec {
-    name = "graylog-enterprise-integrations-${version}";
+    pname = "graylog-enterprise-integrations";
     pluginName = "graylog-plugin-enterprise-integrations";
     version = "3.3.9";
     src = fetchurl {
@@ -97,7 +97,7 @@ in
     };
   };
   filter-messagesize = glPlugin rec {
-    name = "graylog-filter-messagesize-${version}";
+    pname = "graylog-filter-messagesize";
     pluginName = "graylog-plugin-filter-messagesize";
     version = "0.0.2";
     src = fetchurl {
@@ -110,7 +110,7 @@ in
     };
   };
   integrations = glPlugin rec {
-    name = "graylog-integrations-${version}";
+    pname = "graylog-integrations";
     pluginName = "graylog-plugin-integrations";
     version = "3.3.9";
     src = fetchurl {
@@ -128,7 +128,7 @@ in
     };
   };
   internal-logs = glPlugin rec {
-    name = "graylog-internal-logs-${version}";
+    pname = "graylog-internal-logs";
     pluginName = "graylog-plugin-internal-logs";
     version = "2.4.0";
     src = fetchurl {
@@ -141,7 +141,7 @@ in
     };
   };
   ipanonymizer = glPlugin rec {
-    name = "graylog-ipanonymizer-${version}";
+    pname = "graylog-ipanonymizer";
     pluginName = "graylog-plugin-ipanonymizer";
     version = "1.1.2";
     src = fetchurl {
@@ -154,7 +154,7 @@ in
     };
   };
   jabber = glPlugin rec {
-    name = "graylog-jabber-${version}";
+    pname = "graylog-jabber";
     pluginName = "graylog-plugin-jabber";
     version = "2.4.0";
     src = fetchurl {
@@ -167,7 +167,7 @@ in
     };
   };
   metrics = glPlugin rec {
-    name = "graylog-metrics-${version}";
+    pname = "graylog-metrics";
     pluginName = "graylog-plugin-metrics";
     version = "1.3.0";
     src = fetchurl {
@@ -180,7 +180,7 @@ in
     };
   };
   mongodb-profiler = glPlugin rec {
-    name = "graylog-mongodb-profiler-${version}";
+    pname = "graylog-mongodb-profiler";
     pluginName = "graylog-plugin-mongodb-profiler";
     version = "2.0.1";
     src = fetchurl {
@@ -193,7 +193,7 @@ in
     };
   };
   pagerduty = glPlugin rec {
-    name = "graylog-pagerduty-${version}";
+    pname = "graylog-pagerduty";
     pluginName = "graylog-plugin-pagerduty";
     version = "2.0.0";
     src = fetchurl {
@@ -206,7 +206,7 @@ in
     };
   };
   redis = glPlugin rec {
-    name = "graylog-redis-${version}";
+    pname = "graylog-redis";
     pluginName = "graylog-plugin-redis";
     version = "0.1.1";
     src = fetchurl {
@@ -219,7 +219,7 @@ in
     };
   };
   slack = glPlugin rec {
-    name = "graylog-slack-${version}";
+    pname = "graylog-slack";
     pluginName = "graylog-plugin-slack";
     version = "3.1.0";
     src = fetchurl {
@@ -232,11 +232,11 @@ in
     };
   };
   smseagle = glPlugin rec {
-    name = "graylog-smseagle-${version}";
+    pname = "graylog-smseagle";
     pluginName = "graylog-plugin-smseagle";
     version = "1.0.1";
     src = fetchurl {
-      url = "https://bitbucket.org/proximus/smseagle-graylog/raw/b99cfc349aafc7c94d4c2503f7c3c0bde67684d1/jar/graylog-plugin-smseagle-1.0.1.jar";
+      url = "https://bitbucket.org/proximus/smseagle-graylog/raw/b99cfc349aafc7c94d4c2503f7c3c0bde67684d1/jar/${pluginName}-${version}.jar";
       sha256 = "sha256-rvvftzPskXRGs1Z9dvd/wFbQoIoNtEQIFxMIpSuuvf0=";
     };
     meta = {
@@ -246,7 +246,7 @@ in
     };
   };
   snmp = glPlugin rec {
-    name = "graylog-snmp-${version}";
+    pname = "graylog-snmp";
     pluginName = "graylog-plugin-snmp";
     version = "0.3.0";
     src = fetchurl {
@@ -259,7 +259,7 @@ in
     };
   };
   spaceweather = glPlugin rec {
-    name = "graylog-spaceweather-${version}";
+    pname = "graylog-spaceweather";
     pluginName = "graylog-plugin-spaceweather";
     version = "1.0";
     src = fetchurl {
@@ -272,11 +272,11 @@ in
     };
   };
   splunk = glPlugin rec {
-    name = "graylog-splunk-${version}";
+    pname = "graylog-splunk";
     pluginName = "graylog-plugin-splunk";
     version = "0.5.0-rc.1";
     src = fetchurl {
-      url = "https://github.com/graylog-labs/graylog-plugin-splunk/releases/download/0.5.0-rc.1/graylog-plugin-splunk-0.5.0-rc.1.jar";
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
       sha256 = "sha256-EwF/Dc8GmMJBTxH9xGZizUIMTGSPedT4bprorN6X9Os=";
     };
     meta = {
@@ -286,7 +286,7 @@ in
     };
   };
   twiliosms = glPlugin rec {
-    name = "graylog-twiliosms-${version}";
+    pname = "graylog-twiliosms";
     pluginName = "graylog-plugin-twiliosms";
     version = "1.0.0";
     src = fetchurl {
@@ -299,7 +299,7 @@ in
     };
   };
   twitter = glPlugin rec {
-    name = "graylog-twitter-${version}";
+    pname = "graylog-twitter";
     pluginName = "graylog-plugin-twitter";
     version = "2.0.0";
     src = fetchurl {
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index d5e18a1a8c2a..4820a367912c 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -62,11 +62,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2510.0";
+  version = "8.2512.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    hash = "sha256-pwqYNBhoWVOaak0cez9owjiX6AWCm3ZKRekssMyV5mo=";
+    hash = "sha256-k8UAJdkLbHlfo1DVaj2DK/zkUEPqm9aCQNnCqTlLxik=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e2af0c85873f..309fcbee2c81 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -311,6 +311,7 @@ mapAliases {
   arc-browser = throw "arc-browser was removed due to being unmaintained"; # Added 2025-09-03
   archi = throw "'archi' has been removed, since its upstream maintainers do not want it packaged"; # Added 2025-11-18
   archipelago-minecraft = throw "archipelago-minecraft has been removed, as upstream no longer ships minecraft as a default APWorld."; # Added 2025-07-15
+  ArchiSteamFarm = warnAlias "ArchiSteamFarm has been renamed to/replaced by 'archisteamfarm'" archisteamfarm; # Added 2026-01-31
   archivebox = throw "archivebox has been removed, since the packaged version was stuck on django 3."; # Added 2025-08-01
   archiver = throw "archiver has been removed, as it has been unmaintained upstream since November 2024"; # Added 2026-01-15
   ardour_7 = throw "ardour_7 has been removed because it relies on gtk2, please use ardour instead."; # Added 2025-10-04
@@ -390,6 +391,7 @@ mapAliases {
   brogue = warnAlias "Use 'brogue-ce' instead of 'brogue' for updated releases" brogue-ce; # Added 2025-10-04
   btanks = throw "'btanks' has been removed as it's been unmaintained since 2010 and fails to build"; # Added 2025-11-29
   buck = throw "'buck' has been removed has it was deprecated and archived upstream. Consider moving to buck2"; # Added 2026-01-16
+  budgie-screensaver = throw "'budgie-screensaver' has been removed, no longer used by budgie-desktop."; # Added 2025-11-19
   buildBowerComponents = throw "buildBowerComponents has been removed as bower was removed. It is recommended to migrate to yarn."; # Added 2025-09-17
   buildGo123Module = throw "Go 1.23 is end-of-life, and 'buildGo123Module' has been removed. Please use a newer builder version."; # Added 2025-08-13
   buildPlatform = warnAlias "'buildPlatform' has been renamed to/replaced by 'stdenv.buildPlatform'" stdenv.buildPlatform; # Converted to warning 2025-10-28
@@ -496,7 +498,7 @@ mapAliases {
   copilot-language-server-fhs = warnAlias "The package set `copilot-language-server-fhs` has been renamed to `copilot-language-server`." copilot-language-server; # Added 2025-09-07
   copper = throw "'copper' has been removed, as it was broken since 22.11"; # Added 2025-08-22
   cordless = throw "'cordless' has been removed due to being archived upstream. Consider using 'discordo' instead."; # Added 2025-06-07
-  corepack_latest = throw "'corepack_latest' has been removed, use 'corepack.override { nodejs = pkgs.nodejs_latest; }' instead"; # Added 2025-10-25
+  corepack_latest = throw "'corepack_latest' has been removed, use 'corepack.override { nodejs-slim = pkgs.nodejs-slim_latest; }' instead"; # Added 2025-10-25
   coreth = throw "'coreth' has been moved to 'avalanchego' by upstream"; # Added 2026-01-15
   cosmic-tasks = throw "'cosmic-tasks' has been renamed to/replaced by 'tasks'"; # Converted to throw 2025-10-27
   cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
@@ -1164,6 +1166,7 @@ mapAliases {
   MACS2 = throw "'MACS2' has been renamed to/replaced by 'macs2'"; # Converted to throw 2025-10-27
   magma_2_6_2 = throw "'magma_2_6_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
   magma_2_7_2 = throw "'magma_2_7_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
+  magpie = throw "'magpie' has been removed, no longer used by budgie-desktop."; # Added 2025-11-19
   mailcore2 = throw "'mailcore2' has been removed due to lack of upstream maintenance."; # Added 2025-06-09
   mailnag = throw "mailnag has been removed because it has been marked as broken since 2022."; # Added 2025-10-12
   mailnagWithPlugins = throw "mailnagWithPlugins has been removed because mailnag has been marked as broken since 2022."; # Added 2025-10-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index def170b146cd..f9c943df90e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1368,8 +1368,6 @@ with pkgs;
     };
   };
 
-  ArchiSteamFarm = callPackage ../applications/misc/ArchiSteamFarm { };
-
   arduino = arduino-core.override { withGui = true; };
 
   arduino-core = callPackage ../development/embedded/arduino/arduino-core/chrootenv.nix { };
@@ -6238,12 +6236,6 @@ with pkgs;
 
   watson-ruby = callPackage ../development/tools/misc/watson-ruby { };
 
-  xcbuild = callPackage ../by-name/xc/xcbuild/package.nix {
-    stdenv =
-      # xcbuild is included in the SDK. Avoid an infinite recursion by using a bootstrap stdenv.
-      if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
-  };
-
   xcbuildHook = makeSetupHook {
     name = "xcbuild-hook";
     propagatedBuildInputs = [ xcbuild ];
@@ -9489,12 +9481,6 @@ with pkgs;
 
   dejavu_fonts = lowPrio (callPackage ../data/fonts/dejavu-fonts { });
 
-  # solve collision for nix-env before https://github.com/NixOS/nix/pull/815
-  dejavu_fontsEnv = buildEnv {
-    name = dejavu_fonts.name;
-    paths = [ dejavu_fonts.out ];
-  };
-
   docbook_sgml_dtd_31 = callPackage ../data/sgml+xml/schemas/sgml-dtd/docbook/3.1.nix { };
 
   docbook_sgml_dtd_41 = callPackage ../data/sgml+xml/schemas/sgml-dtd/docbook/4.1.nix { };
@@ -12337,10 +12323,6 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_12;
   };
 
-  bitwuzla = callPackage ../by-name/bi/bitwuzla/package.nix {
-    cadical = cadical.override { version = "2.1.3"; };
-  };
-
   inherit
     (callPackage ./rocq-packages.nix {
       inherit (ocaml-ng)
@@ -12418,10 +12400,6 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
-  cvc5 = callPackage ../by-name/cv/cvc5/package.nix {
-    cadical = cadical.override { version = "2.1.3"; };
-  };
-
   ekrhyper = callPackage ../applications/science/logic/ekrhyper {
     ocaml = ocaml-ng.ocamlPackages_4_14_unsafe_string.ocaml;
   };
diff --git a/pkgs/top-level/haxe-packages.nix b/pkgs/top-level/haxe-packages.nix
index 0a50f31a6be4..609a13602b17 100644
--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@@ -43,7 +43,8 @@ let
     stdenv.mkDerivation (
       attrs
       // {
-        name = "${libname}-${version}";
+        pname = libname;
+        inherit version;
 
         buildInputs = (attrs.buildInputs or [ ]) ++ [
           haxe
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ba7043d0f868..2af888ba5d1d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4971,6 +4971,8 @@ self: super: with self; {
 
   envisage = callPackage ../development/python-modules/envisage { };
 
+  envoy-data-plane = callPackage ../development/python-modules/envoy-data-plane { };
+
   envoy-reader = callPackage ../development/python-modules/envoy-reader { };
 
   envoy-utils = callPackage ../development/python-modules/envoy-utils { };
@@ -9180,6 +9182,8 @@ self: super: with self; {
 
   lpc-checksum = callPackage ../development/python-modules/lpc-checksum { };
 
+  lpips = callPackage ../development/python-modules/lpips { };
+
   lrcalc-python = callPackage ../development/python-modules/lrcalc-python { };
 
   lrclibapi = callPackage ../development/python-modules/lrclibapi { };
@@ -13350,6 +13354,8 @@ self: super: with self; {
 
   pydispatcher = callPackage ../development/python-modules/pydispatcher { };
 
+  pydivsufsort = callPackage ../development/python-modules/pydivsufsort { };
+
   pydle = callPackage ../development/python-modules/pydle { };
 
   pydmd = callPackage ../development/python-modules/pydmd { };
@@ -20068,6 +20074,8 @@ self: super: with self; {
 
   ufmt = callPackage ../development/python-modules/ufmt { };
 
+  ufo-extractor = callPackage ../development/python-modules/ufo-extractor { };
+
   ufo2ft = callPackage ../development/python-modules/ufo2ft { };
 
   ufolib2 = callPackage ../development/python-modules/ufolib2 { };
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index 84f6f26bb8c4..ed0327ee96ec 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -46,6 +46,7 @@ let
       mathcomp-field = self.mathcomp.field;
       mathcomp-character = self.mathcomp.character;
       parseque = callPackage ../development/rocq-modules/parseque { };
+      relation-algebra = callPackage ../development/rocq-modules/relation-algebra { };
       rocq-elpi = callPackage ../development/rocq-modules/rocq-elpi { };
       stdlib = callPackage ../development/rocq-modules/stdlib { };
       vsrocq-language-server = callPackage ../development/rocq-modules/vsrocq-language-server { };