diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 51d4b5c10da1..43d820ea0f66 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@c656f5d5851037b2b38fb5db2691a03fa229e3b2 # v4.0.1
+        uses: korthout/backport-action@01619ebc9a6e3f6820274221b9956b3e7365000a # v4.1.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 42e95a07a3c1..48d69eeaea4a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 8ce770139c9b..a99236d2e7c4 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -85,7 +85,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 6928e9ae7d32..307ba4442540 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -132,7 +132,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - name: Load supported versions
         id: versions
@@ -180,7 +180,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - name: Combine all output paths and eval stats
         run: |
@@ -451,7 +451,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0941cedf98b5..fee21209f727 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
+      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index 4ea169118542..3cc6daa32863 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -54,7 +54,7 @@ stdenvNoCC.mkDerivation (
     };
   in
   {
-    inherit (lib.trivial) version;
+    version = lib.trivial.release;
     pname = "nixpkgs-manual";
 
     nativeBuildInputs = [ nixos-render-docs ];
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 71ca3bf93feb..f02920bb1911 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17088,7 +17088,7 @@
     githubId = 22659757;
   };
   metalmatze = {
-    email = "matthias.loibl@polarsignals.com";
+    email = "mail@matthiasloibl.com";
     name = "Matthias Loibl";
     github = "metalmatze";
     githubId = 872251;
@@ -19529,6 +19529,12 @@
     github = "nullishamy";
     githubId = 99221043;
   };
+  numbleroot = {
+    email = "hello@lennartoldenburg.de";
+    name = "Lennart Oldenburg";
+    github = "numbleroot";
+    githubId = 1864826;
+  };
   numinit = {
     email = "me+nixpkgs@numin.it";
     name = "Morgan Jones";
@@ -24636,6 +24642,13 @@
     github = "Silver-Golden";
     githubId = 7858375;
   };
+  silverhadch = {
+    email = "hadichokr@icloud.com";
+    matrix = "@silverhadch07:matrix.org";
+    name = "Hadi Chokr";
+    github = "silverhadch";
+    githubId = 158838697;
+  };
   simarra = {
     name = "simarra";
     email = "loic.martel@protonmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index e203185e178e..8dbdfc28138c 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -42,6 +42,8 @@
 
 - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
 
+- [cocoon](https://github.com/haileyok/cocoon), is a PDS (personal data server) that is a alternative to the bluesky pds. Available as [services.cocoon](#opt-services.cocoon.enable).
+
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
 
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9d81f8a6b674..e4313e029e8a 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1598,6 +1598,7 @@
   ./services/web-apps/changedetection-io.nix
   ./services/web-apps/chhoto-url.nix
   ./services/web-apps/cloudlog.nix
+  ./services/web-apps/cocoon.nix
   ./services/web-apps/code-server.nix
   ./services/web-apps/coder.nix
   ./services/web-apps/collabora-online.nix
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index db7cadd89abd..7745572e89bd 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -24,7 +24,7 @@ let
       else if (cfg.passwordFile != null) then
         "password=@password_placeholder@"
       else if (cfg.secretsFile != null) then
-        "password=@secrets_placeholder@"
+        "@secrets_placeholder@"
       else
         ""
     }
diff --git a/nixos/modules/services/web-apps/cocoon.nix b/nixos/modules/services/web-apps/cocoon.nix
new file mode 100644
index 000000000000..3a30a96bb374
--- /dev/null
+++ b/nixos/modules/services/web-apps/cocoon.nix
@@ -0,0 +1,210 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.cocoon;
+
+  inherit (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    optional
+    ;
+in
+{
+  options.services.cocoon = {
+    enable = mkEnableOption "cocoon";
+
+    package = mkPackageOption pkgs "cocoon" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (types.nullOr (types.either types.str types.path));
+
+        options = {
+          COCOON_ADDR = mkOption {
+            type = types.str;
+            default = ":8080";
+            example = ":3000";
+            description = "Address to bind the Cocoon instance to";
+          };
+
+          COCOON_DID = mkOption {
+            type = types.nullOr types.str;
+            example = "did:web:cocoon.example.com";
+            description = "DID web address for the Cocoon instance";
+          };
+
+          COCOON_HOSTNAME = mkOption {
+            type = types.nullOr types.str;
+            example = "cocoon.example.com";
+            description = "Hostname for the Cocoon instance";
+          };
+
+          COCOON_ROTATION_KEY_PATH = mkOption {
+            type = types.either types.path types.str;
+            default = "/var/lib/cocoon/rotation.key";
+            description = ''
+              Path to the rotation key file.
+
+              Generate it with:
+              ```
+              cocoon create-rotation-key --out /var/lib/cocoon/rotation.key
+              ```
+            '';
+          };
+
+          COCOON_JWK_PATH = mkOption {
+            type = types.either types.path types.str;
+            default = "/var/lib/cocoon/jwk.key";
+            description = ''
+              Path to the JWK key file
+
+              Generate it with:
+              ```
+              cocoon create-private-jwk --out /var/lib/cocoon/jwk.key
+              ```
+            '';
+          };
+
+          COCOON_CONTACT_EMAIL = mkOption {
+            type = types.str;
+            example = "me@example.com";
+            description = "Contact email for the Cocoon instance";
+          };
+
+          COCOON_RELAYS = mkOption {
+            type = types.str;
+            default = "https://bsky.network";
+            description = "Comma-separated list of Nostr relays to connect to";
+          };
+
+          COCOON_SESSION_COOKIE_KEY = mkOption {
+            type = types.str;
+            default = "session";
+            description = "Name of the session cookie";
+          };
+
+          COCOON_DB_TYPE = mkOption {
+            type = types.str;
+            default = "sqlite";
+            description = "Type of database to use (sqlite or postgres)";
+          };
+
+          COCOON_DB_NAME = mkOption {
+            type = types.str;
+            default = "/var/lib/cocoon/cocoon.db";
+            description = "Name of the SQLite database file (if using sqlite)";
+          };
+
+          COCOON_DATABASE_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "postgres://cocoon:password@localhost:5432/cocoon?sslmode=disable";
+            description = "Database connection URL";
+          };
+        };
+      };
+
+      description = ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+
+        Refer to <https://github.com/haileyok/cocoon/blob/main/.env.example>
+        and <https://github.com/haileyok/cocoon/blob/main/README.md> for
+        available environment variables.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      description = ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+
+        Use it to set values of `COCOON_ADMIN_PASSWORD` and `COCOON_SESSION_SECRE`.
+
+        Generate `COCOON_ADMIN_PASSWORD` with
+        ```
+        openssl rand -hex 16
+        ```
+
+        Generate `COCOON_SESSION_SECRET` with
+        ```
+        openssl rand -hex 32
+        ```
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.cocoon = {
+      description = "cocoon";
+
+      after = [
+        "network-online.target"
+      ]
+      ++ optional (cfg.settings.COCOON_DB_TYPE == "postgres") "postgresql.service";
+      wants = [
+        "network-online.target"
+      ]
+      ++ optional (cfg.settings.COCOON_DB_TYPE == "postgres") "postgresql.service";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = "${getExe cfg.package} run";
+        Environment = lib.mapAttrsToList (k: v: "${k}=${if builtins.isInt v then toString v else v}") (
+          lib.filterAttrs (_: v: v != null) cfg.settings
+        );
+
+        EnvironmentFile = cfg.environmentFiles;
+        StateDirectory = "cocoon";
+        StateDirectoryMode = "0755";
+        Restart = "always";
+
+        # Hardening
+        RemoveIPC = true;
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = [ "native" ];
+        MemoryDenyWriteExecute = true;
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictRealtime = true;
+        DeviceAllow = [ "" ];
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectHome = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ isabelroses ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 835d8616a690..0b93146d2471 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -382,6 +382,7 @@ in
   };
   cockpit = runTest ./cockpit.nix;
   cockroachdb = runTestOn [ "x86_64-linux" ] ./cockroachdb.nix;
+  cocoon = runTest ./cocoon.nix;
   code-server = runTest ./code-server.nix;
   coder = runTest ./coder.nix;
   collectd = runTest ./collectd.nix;
diff --git a/nixos/tests/cocoon.nix b/nixos/tests/cocoon.nix
new file mode 100644
index 000000000000..0d0cd0e6446e
--- /dev/null
+++ b/nixos/tests/cocoon.nix
@@ -0,0 +1,37 @@
+{ lib, ... }:
+{
+  name = "cocoon";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.cocoon = {
+        enable = true;
+        settings = {
+          COCOON_DID = "did:web:cocoon.example.com";
+          COCOON_HOSTNAME = "cocoon.example.com";
+          COCOON_CONTACT_EMAIL = "test@example.com";
+
+          # Snake oil testing credentials
+          COCOON_ADMIN_PASSWORD = "84f54c1229e02b662214e2af2df97cb6";
+          COCOON_SESSION_SECRET = "8ed099b41bb67939bf4e796fd4bd618add775a9265bcb32c63d00341a0f71b6c";
+          COCOON_ROTATION_KEY_PATH =
+            pkgs.runCommand "rotation-key" { nativeBuildInputs = [ pkgs.cocoon ]; }
+              ''
+                cocoon create-rotation-key --out $out
+              '';
+          COCOON_JWK_PATH = pkgs.runCommand "jwk-key" { nativeBuildInputs = [ pkgs.cocoon ]; } ''
+            cocoon create-private-jwk --out $out
+          '';
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("cocoon.service")
+    machine.wait_for_open_port(8080)
+    machine.succeed("curl --fail http://localhost:8080")
+  '';
+
+  meta.maintainers = [ lib.maintainers.isabelroses ];
+}
diff --git a/pkgs/applications/networking/instant-messengers/discord/darwin.nix b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
index 0c8a22e54022..87cce491f157 100644
--- a/pkgs/applications/networking/instant-messengers/discord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
@@ -82,25 +82,25 @@ stdenv.mkDerivation {
 
   postInstall =
     lib.strings.optionalString withOpenASAR ''
-      cp -f ${openasar} $out/Applications/${desktopName}.app/Contents/Resources/app.asar
+      cp -f ${openasar} "$out/Applications/${desktopName}.app/Contents/Resources/app.asar"
     ''
     + lib.strings.optionalString withVencord ''
-      mv $out/Applications/${desktopName}.app/Contents/Resources/app.asar $out/Applications/${desktopName}.app/Contents/Resources/_app.asar
-      mkdir $out/Applications/${desktopName}.app/Contents/Resources/app.asar
-      echo '{"name":"discord","main":"index.js"}' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json
-      echo 'require("${vencord}/patcher.js")' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/index.js
+      mv "$out/Applications/${desktopName}.app/Contents/Resources/app.asar" "$out/Applications/${desktopName}.app/Contents/Resources/_app.asar"
+      mkdir "$out/Applications/${desktopName}.app/Contents/Resources/app.asar"
+      echo '{"name":"discord","main":"index.js"}' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json"
+      echo 'require("${vencord}/patcher.js")' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/index.js"
     ''
     + lib.strings.optionalString withEquicord ''
-      mv $out/Applications/${desktopName}.app/Contents/Resources/app.asar $out/Applications/${desktopName}.app/Contents/Resources/_app.asar
-      mkdir $out/Applications/${desktopName}.app/Contents/Resources/app.asar
-      echo '{"name":"discord","main":"index.js"}' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json
-      echo 'require("${equicord}/desktop/patcher.js")' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/index.js
+      mv "$out/Applications/${desktopName}.app/Contents/Resources/app.asar" "$out/Applications/${desktopName}.app/Contents/Resources/_app.asar"
+      mkdir "$out/Applications/${desktopName}.app/Contents/Resources/app.asar"
+      echo '{"name":"discord","main":"index.js"}' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json"
+      echo 'require("${equicord}/desktop/patcher.js")' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/index.js"
     ''
     + lib.strings.optionalString withMoonlight ''
-      mv $out/Applications/${desktopName}.app/Contents/Resources/app.asar $out/Applications/${desktopName}.app/Contents/Resources/_app.asar
-      mkdir $out/Applications/${desktopName}.app/Contents/Resources/app.asar
-      echo '{"name":"discord","main":"injector.js","private": true}' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json
-      echo 'require("${moonlight}/injector.js").inject(require("path").join(__dirname, "../_app.asar"));' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/injector.js
+      mv "$out/Applications/${desktopName}.app/Contents/Resources/app.asar" "$out/Applications/${desktopName}.app/Contents/Resources/_app.asar"
+      mkdir "$out/Applications/${desktopName}.app/Contents/Resources/app.asar"
+      echo '{"name":"discord","main":"injector.js","private": true}' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json"
+      echo 'require("${moonlight}/injector.js").inject(require("path").join(__dirname, "../_app.asar"));' > "$out/Applications/${desktopName}.app/Contents/Resources/app.asar/injector.js"
     '';
 
   passthru = {
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
index 187b1a8c1219..6a05fd4e76ff 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation {
   pname = "tg_owt";
-  version = "0-unstable-2025-06-02";
+  version = "0-unstable-2025-12-12";
 
   src = fetchFromGitHub {
     owner = "desktop-app";
     repo = "tg_owt";
-    rev = "62321fd7128ab2650b459d4195781af8185e46b5";
-    hash = "sha256-l6EdHJLd42TU+4pLakdU3a5PLVxrxjta0CSRy5hVBFU=";
+    rev = "d888bc3f79b4aa80333d8903410fa439db5f6696";
+    hash = "sha256-ZiZ0HD4UNPJj1ZtoGroJRQBYeL/nwpp4B9GtXFcCA7M=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
index 0d93c3d9b056..d7c6822049e5 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -42,14 +42,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "6.4.1";
+  version = "6.5.1";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-jmUj0kTyok5CsOe/to6bTN3jH/RMF7jE+AnFJi2nW90=";
+    hash = "sha256-y2sf2wDJ6dYxRdDLKIr78z9tPBIoh2WICg4zJBmb85Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/qsstv/default.nix b/pkgs/applications/radio/qsstv/default.nix
index f0536ad67ba9..4cee9ac0820f 100644
--- a/pkgs/applications/radio/qsstv/default.nix
+++ b/pkgs/applications/radio/qsstv/default.nix
@@ -13,14 +13,15 @@
   hamlib,
   libv4l,
   fftwFloat,
+  imagemagick,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "9.5.8";
   pname = "qsstv";
 
   src = fetchurl {
-    url = "https://www.qsl.net/o/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
+    url = "https://www.qsl.net/o/on4qz/qsstv/downloads/qsstv_${finalAttrs.version}.tar.gz";
     sha256 = "0s3sivc0xan6amibdiwfnknrl3248wzgy98w6gyxikl0qsjpygy0";
   };
 
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
     qmake
     pkg-config
     wrapQtAppsHook
+    imagemagick
   ];
 
   buildInputs = [
@@ -43,7 +45,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # Install desktop icon
-    install -D icons/qsstv.png $out/share/pixmaps/qsstv.png
+    mkdir -p $out/share/icons/hicolor/32x32/apps
+    magick icons/qsstv.png -resize 32x32 $out/share/icons/hicolor/32x32/apps/qsstv.png
     install -D qsstv.desktop $out/share/applications/qsstv.desktop
   '';
 
@@ -55,4 +58,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ hax404 ];
   };
-}
+})
diff --git a/pkgs/applications/virtualization/qtemu/default.nix b/pkgs/applications/virtualization/qtemu/default.nix
index bc415d463712..354bcbfcd72c 100644
--- a/pkgs/applications/virtualization/qtemu/default.nix
+++ b/pkgs/applications/virtualization/qtemu/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
     # upstream lacks an install method
     install -D -t $out/share/applications qtemu.desktop
-    install -D -t $out/share/pixmaps qtemu.png
+    install -D -t $out/share/icons/hicolor/32x32/apps qtemu.png
     install -D -t $out/bin qtemu
 
     # make sure that the qemu-* executables are found
diff --git a/pkgs/build-support/dlang/dub-to-nix/default.nix b/pkgs/build-support/dlang/dub-to-nix/default.nix
index ca947e7f6050..e7672023979f 100644
--- a/pkgs/build-support/dlang/dub-to-nix/default.nix
+++ b/pkgs/build-support/dlang/dub-to-nix/default.nix
@@ -16,7 +16,7 @@ in
 runCommand "dub-to-nix"
   {
     pname = "dub-to-nix";
-    version = lib.trivial.version;
+    version = lib.trivial.release;
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ python3 ];
   }
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index e1ae8203cd59..9bce7d2f628d 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -31,7 +31,7 @@ in
 {
   prefetch-yarn-deps = stdenv.mkDerivation {
     pname = "prefetch-yarn-deps";
-    inherit (lib.trivial) version;
+    version = lib.trivial.release;
 
     dontUnpack = true;
     dontBuild = true;
@@ -68,7 +68,7 @@ in
 
   fixup-yarn-lock = stdenv.mkDerivation {
     pname = "fixup-yarn-lock";
-    inherit (lib.trivial) version;
+    version = lib.trivial.release;
 
     dontUnpack = true;
     dontBuild = true;
@@ -136,8 +136,11 @@ in
               prefetch-yarn-deps
               cacert
             ];
-            GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-            NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+            env = {
+              GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+              NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+            };
 
             buildPhase = ''
               runHook preBuild
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 36da837f31cf..84a769e14d37 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -572,69 +572,76 @@ rec {
     other derivations.  A derivation created with linkFarm is often used in CI
     as a easy way to build multiple derivations at once.
   */
-  symlinkJoin =
-    args_@{
-      name ?
-        assert lib.assertMsg (
-          args_ ? pname && args_ ? version
-        ) "symlinkJoin requires either a `name` OR `pname` and `version`";
-        "${args_.pname}-${args_.version}",
-      paths,
-      stripPrefix ? "",
-      preferLocalBuild ? true,
-      allowSubstitutes ? false,
-      postBuild ? "",
-      failOnMissing ? stripPrefix == "",
-      ...
-    }:
-    assert lib.assertMsg (stripPrefix != "" -> (hasPrefix "/" stripPrefix && stripPrefix != "/")) ''
-      stripPrefix must be either an empty string (disable stripping behavior), or relative path prefixed with /.
+  symlinkJoin = lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
 
-      Ensure that the path starts with / and specifies path to the subdirectory.
-    '';
+    excludeDrvArgNames = [
+      "postBuild"
+      "stripPrefix"
+      "paths"
+      "failOnMissing"
+    ];
 
-    let
-      mapPaths =
-        f: paths:
-        map (
-          path:
-          if path == null then
-            null
-          else if isList path then
-            mapPaths f path
-          else
-            f path
-        ) paths;
-      args =
-        removeAttrs args_ [
-          "name"
-          "postBuild"
-          "stripPrefix"
-          "paths"
-          "failOnMissing"
-        ]
-        // {
-          # Allow getting the proper position of the output derivation.
-          # Since one of these are required, it should be fairly accurate.
-          pos =
-            if args_ ? pname then
-              builtins.unsafeGetAttrPos "pname" args_
+    extendDrvArgs =
+      finalAttrs:
+      args@{
+        name ?
+          assert lib.assertMsg (
+            finalAttrs ? pname && finalAttrs ? version
+          ) "symlinkJoin requires either a `name` OR `pname` and `version`";
+          "${finalAttrs.pname}-${finalAttrs.version}",
+        paths,
+        stripPrefix ? "",
+        preferLocalBuild ? true,
+        allowSubstitutes ? false,
+        postBuild ? "",
+        failOnMissing ? stripPrefix == "",
+        ...
+      }:
+      assert lib.assertMsg (stripPrefix != "" -> (hasPrefix "/" stripPrefix && stripPrefix != "/")) ''
+        stripPrefix must be either an empty string (disable stripping behavior), or relative path prefixed with /.
+
+        Ensure that the path starts with / and specifies path to the subdirectory.
+      '';
+      let
+        mapPaths =
+          f:
+          map (
+            path:
+            if path == null then
+              null
+            else if isList path then
+              mapPaths f path
             else
-              builtins.unsafeGetAttrPos "name" args_;
-          inherit preferLocalBuild allowSubstitutes;
-          paths = mapPaths (path: "${path}${stripPrefix}") paths;
-          passAsFile = [ "paths" ];
-        }; # pass the defaults
-    in
-    runCommand name args ''
-      mkdir -p $out
-      for i in $(cat $pathsPath); do
-        ${optionalString (!failOnMissing) "if test -d $i; then "}${lndir}/bin/lndir -silent $i $out${
-          optionalString (!failOnMissing) "; fi"
-        }
-      done
-      ${postBuild}
-    '';
+              f path
+          );
+      in
+      {
+        enableParallelBuilding = true;
+        inherit name allowSubstitutes preferLocalBuild;
+        passAsFile = [
+          "buildCommand"
+          "paths"
+        ];
+        paths = mapPaths (path: "${path}${stripPrefix}") paths;
+        buildCommand = ''
+          mkdir -p $out
+          for i in $(cat $pathsPath); do
+            ${optionalString (!failOnMissing) "if test -d $i; then "}${lndir}/bin/lndir -silent $i $out${
+              optionalString (!failOnMissing) "; fi"
+            }
+          done
+          ${postBuild}
+        '';
+      }
+      // lib.optionalAttrs (!args ? meta) {
+        pos =
+          if args ? pname then
+            builtins.unsafeGetAttrPos "pname" args
+          else
+            builtins.unsafeGetAttrPos "name" args;
+      };
+  };
 
   # TODO: move linkFarm docs to the Nixpkgs manual
   /*
@@ -1021,76 +1028,69 @@ rec {
       ];
     }
   */
-  applyPatches =
-    {
-      src,
-      name ?
-        (
-          if builtins.typeOf src == "path" then
-            baseNameOf src
-          else if builtins.isAttrs src && builtins.hasAttr "name" src then
-            src.name
-          else
-            throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
-        )
-        + "-patched",
-      patches ? [ ],
-      prePatch ? "",
-      postPatch ? "",
-      ...
-    }@args:
-    assert lib.assertMsg (
-      !args ? meta
-    ) "applyPatches will not merge 'meta', change it in 'src' instead";
-    assert lib.assertMsg (
-      !args ? passthru
-    ) "applyPatches will not merge 'passthru', change it in 'src' instead";
-    if patches == [ ] && prePatch == "" && postPatch == "" then
-      src # nothing to do, so use original src to avoid additional drv
-    else
+  applyPatches = lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
+
+    extendDrvArgs =
+      finalAttrs:
+      {
+        src,
+        ...
+      }@args:
+      assert lib.assertMsg (
+        !args ? meta
+      ) "applyPatches will not merge 'meta', change it in 'src' instead";
+      assert lib.assertMsg (
+        !args ? passthru
+      ) "applyPatches will not merge 'passthru', change it in 'src' instead";
       let
         keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
         # enables tools like nix-update to determine what src attributes to replace
-        extraPassthru = lib.optionalAttrs (lib.isAttrs src) (
+        extraPassthru = lib.optionalAttrs (lib.isAttrs finalAttrs.src) (
           keepAttrs [
             "rev"
             "tag"
             "url"
             "outputHash"
             "outputHashAlgo"
-          ] src
+          ] finalAttrs.src
         );
       in
-      stdenvNoCC.mkDerivation (
-        {
-          inherit
-            name
-            src
-            patches
-            prePatch
-            postPatch
-            ;
-          preferLocalBuild = true;
-          allowSubstitutes = false;
-          phases = "unpackPhase patchPhase installPhase";
-          installPhase = "cp -R ./ $out";
-        }
+      {
+        name =
+          args.name or (
+            if builtins.isPath finalAttrs.src then
+              baseNameOf finalAttrs.src + "-patched"
+            else if builtins.isAttrs finalAttrs.src && (finalAttrs.src ? name) then
+              finalAttrs.src.name + "-patched"
+            else
+              throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
+          );
+
+        # Manually setting `name` can mess up positioning.
+        # This should fix it.
+        pos = builtins.unsafeGetAttrPos "src" args;
+
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+
+        # unconditionally disable phases that are we don't want
+        phases = [
+          "unpackPhase"
+          "patchPhase"
+          "installPhase"
+        ];
+
+        installPhase = "cp -R ./ $out";
+
+        # passthru the git and hash info for nix-update, as well
+        # as all the src's passthru attrs.
+        passthru = extraPassthru // finalAttrs.src.passthru or { };
+
         # Carry (and merge) information from the underlying `src` if present.
-        // (optionalAttrs (src ? meta) {
-          inherit (src) meta;
-        })
-        // (optionalAttrs (extraPassthru != { } || src ? passthru) {
-          passthru = extraPassthru // src.passthru or { };
-        })
-        # Forward any additional arguments to the derivation
-        // (removeAttrs args [
-          "src"
-          "name"
-          "patches"
-          "prePatch"
-          "postPatch"
-        ])
-      );
+        meta = lib.optionalAttrs (src ? meta) (removeAttrs finalAttrs.src.meta [ "position" ]);
+      };
+  };
 
   # TODO: move docs to Nixpkgs manual
   # An immutable file in the store with a length of 0 bytes.
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index 4cccacc22e35..7895f7ebc385 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -212,7 +212,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir -p $out/bin
     ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
-    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/pixmaps/2s2h.png
+    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/icons/hicolor/512x512/apps/2s2h.png
 
     install -Dm644 -t $out/share/licenses/2ship2harkinian ../LICENSE
     install -Dm644 -t $out/share/licenses/2ship2harkinian/OTRExporter ../OTRExporter/LICENSE
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index d0e5002c6115..61861c856227 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -10,13 +10,13 @@ telegram-desktop.override {
   inherit withWebkit;
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
     pname = "64gram-unwrapped";
-    version = "1.1.93";
+    version = "1.1.94";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       tag = "v${version}";
-      hash = "sha256-AwzTmEaN6MsJNq1W+cyAbg+QkYrPaV2LXmt3NzKc/vQ=";
+      hash = "sha256-pMcG0B3YxrvvaLsC2yWJsm9wHpv5+xLtp+wQhRtJ38Q=";
       fetchSubmodules = true;
     };
 
diff --git a/pkgs/by-name/a-/a-keys-path/package.nix b/pkgs/by-name/a-/a-keys-path/package.nix
index f8110e3b1cb8..ef202b520e1b 100644
--- a/pkgs/by-name/a-/a-keys-path/package.nix
+++ b/pkgs/by-name/a-/a-keys-path/package.nix
@@ -93,8 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
       --set-rpath ${lib.makeLibraryPath finalAttrs.buildInputs} \
       $out/share/a-keys-path/a-keys-path
 
-    mkdir -p $out/share/pixmaps
-    cp icon.png $out/share/pixmaps/a-keys-path.png
+    install -D icon.png $out/share/icons/hicolor/256x256/apps/a-keys-path.png
 
     install -Dm644 ${finalAttrs.desktopItem}/share/applications/a-keys-path.desktop \
       $out/share/applications/a-keys-path.desktop
diff --git a/pkgs/by-name/ab/abuse/package.nix b/pkgs/by-name/ab/abuse/package.nix
index b74f320485da..924d995fc586 100644
--- a/pkgs/by-name/ab/abuse/package.nix
+++ b/pkgs/by-name/ab/abuse/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteAll "${./abuse.sh}" $out/bin/abuse
     chmod +x $out/bin/abuse
 
-    install -Dm644 ${finalAttrs.data}/doc/abuse.png $out/share/pixmaps/abuse.png
+    install -Dm644 ${finalAttrs.data}/doc/abuse.png -t $out/share/icons/hicolor/32x32/apps
   '';
 
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2";
diff --git a/pkgs/by-name/al/alisthelper/package.nix b/pkgs/by-name/al/alisthelper/package.nix
index e13e899ed337..abc9520e1a88 100644
--- a/pkgs/by-name/al/alisthelper/package.nix
+++ b/pkgs/by-name/al/alisthelper/package.nix
@@ -7,6 +7,7 @@
   makeDesktopItem,
   runCommand,
   yq-go,
+  imagemagick,
   _experimental-update-script-combinators,
   nix-update-script,
 }:
@@ -26,7 +27,10 @@ flutter332.buildFlutterApplication {
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
-  nativeBuildInputs = [ copyDesktopItems ];
+  nativeBuildInputs = [
+    imagemagick
+    copyDesktopItems
+  ];
 
   buildInputs = [ libayatana-appindicator ];
 
@@ -44,7 +48,8 @@ flutter332.buildFlutterApplication {
   ];
 
   postInstall = ''
-    install -D --mode=0644 assets/alisthelper.png -t $out/share/pixmaps
+    mkdir -p $out/share/icons/hicolor/1024x1024/apps
+    magick assets/alisthelper.png -resize 1024x1024 $out/share/icons/hicolor/1024x1024/apps/alisthelper.png
   '';
 
   passthru = {
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 248387e340ad..1adc4f6dca7d 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -151,11 +151,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/libexec $out/share/applications $out/share/pixmaps $out/lib/systemd/system
+    mkdir -p $out/bin $out/libexec $out/share/applications $out/lib/systemd/system
     install -m555 client/AmneziaVPN service/server/AmneziaVPN-service $out/bin/
     install -m555 ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/libexec/
     install -m444 ../AppDir/AmneziaVPN.desktop $out/share/applications/
-    install -m444 ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
+    install -Dm444 ../deploy/data/linux/AmneziaVPN.png -t $out/share/icons/hicolor/512x512/apps
     install -m444 ../deploy/data/linux/AmneziaVPN.service $out/lib/systemd/system/
 
     runHook postInstall
diff --git a/pkgs/by-name/as/asmjit/package.nix b/pkgs/by-name/as/asmjit/package.nix
index abe474d92140..58e0967616c9 100644
--- a/pkgs/by-name/as/asmjit/package.nix
+++ b/pkgs/by-name/as/asmjit/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "asmjit";
-  version = "0-unstable-2026-01-03";
+  version = "0-unstable-2026-02-10";
 
   src = fetchFromGitHub {
     owner = "asmjit";
     repo = "asmjit";
-    rev = "f64c90818ff2ef87ec4f73f44d0a7e73fbff3229";
-    hash = "sha256-+tDWV25KxC+0hhnyC/9b7ixpP7PZsUHzTZB8KmpWtO8=";
+    rev = "5fe1940275d04432da841896bac0a66cc2375551";
+    hash = "sha256-Oj8VP9rJXHQYP3aV8sm+XbyHXLvmC+7e+OGy5YQqFzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/as/assaultcube/package.nix b/pkgs/by-name/as/assaultcube/package.nix
index 5a4e9393f4ed..f0a7bd15e211 100644
--- a/pkgs/by-name/as/assaultcube/package.nix
+++ b/pkgs/by-name/as/assaultcube/package.nix
@@ -83,8 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     if (test -e source/src/ac_client) then
       cp source/src/ac_client $out/bin
       mkdir -p $out/share/applications
-      install -Dpm644 packages/misc/icon.png $out/share/icons/assaultcube.png
-      install -Dpm644 packages/misc/icon.png $out/share/pixmaps/assaultcube.png
+      install -Dpm644 packages/misc/icon.png $out/share/icons/hicolor/32x32/apps/assaultcube.png
 
       makeWrapper $out/bin/ac_client $out/bin/assaultcube \
         --chdir "$out/share/games/assaultcube" --add-flags "--home=\$HOME/.assaultcube/v1.2next --init"
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index 769adc484c43..5e406a8ef485 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -92,7 +92,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ''
       install -D -m444 ${packagingDir}/atlauncher.desktop -t $out/share/applications
       install -D -m444 ${packagingDir}/atlauncher.metainfo.xml -t $out/share/metainfo
-      install -D -m444 ${packagingDir}/atlauncher.png -t $out/share/pixmaps
+      install -D -m444 ${packagingDir}/atlauncher.png -t $out/share/icons/hicolor/128x128/apps
       install -D -m444 ${packagingDir}/atlauncher.svg -t $out/share/icons/hicolor/scalable/apps
     '';
 
diff --git a/pkgs/by-name/az/azuredatastudio/package.nix b/pkgs/by-name/az/azuredatastudio/package.nix
index 39ba55d10e8c..6c1aa4a1bb77 100644
--- a/pkgs/by-name/az/azuredatastudio/package.nix
+++ b/pkgs/by-name/az/azuredatastudio/package.nix
@@ -129,8 +129,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/pixmaps
-    cp ${targetPath}/resources/app/resources/linux/code.png $out/share/pixmaps/azuredatastudio.png
+    install -D ${targetPath}/resources/app/resources/linux/code.png $out/share/icons/hicolor/1024x1024/apps/azuredatastudio.png
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 111fd54dd3ed..4c507ed8b152 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -14,18 +14,18 @@
 
 buildNpmPackage rec {
   pname = "cinny-unwrapped";
-  version = "4.10.2";
+  version = "4.10.3";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${version}";
-    hash = "sha256-RPFEquxMRnNW+L6azcDmrIKXG27DAF2PxDmSB3ErOHk=";
+    hash = "sha256-ZztZ/znJUwgYlvv5h9uxNZvQrkUMVbMG6R+HbRtSXHM=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-h4Ipmmo0Jf6/rzCAKtLLCYrUi1anVKZSgy/kcEKDQJg=";
+  npmDepsHash = "sha256-Spt2+sQcoPwy1tU8ztqJHZS9ITX9avueYDVKE7BFYy4=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/by-name/co/cocoon/package.nix b/pkgs/by-name/co/cocoon/package.nix
index b282d33e26c5..dc819eba7a26 100644
--- a/pkgs/by-name/co/cocoon/package.nix
+++ b/pkgs/by-name/co/cocoon/package.nix
@@ -2,6 +2,8 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
+  stdenvNoCC,
   nix-update-script,
 }:
 buildGoModule (finalAttrs: {
@@ -23,7 +25,10 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-bux3OfHT8f1FVpBAZUP23vo8M6h8nPTJbi/GTUzhdc4=";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux { inherit (nixosTests) cocoon; };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "ATProtocol Personal Data Server written in Go with a SQLite block and blob store";
diff --git a/pkgs/by-name/co/codeberg-cli/package.nix b/pkgs/by-name/co/codeberg-cli/package.nix
index f36197d13024..9ab51d274a81 100644
--- a/pkgs/by-name/co/codeberg-cli/package.nix
+++ b/pkgs/by-name/co/codeberg-cli/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codeberg-cli";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromCodeberg {
     owner = "Aviac";
     repo = "codeberg-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-o+Jf9JKDGsnSVV8sJcJddZG+9DBn6DB4HfaxLxxwa+U=";
+    hash = "sha256-yjWAL4Tu9nuQsy8fDhga5lsxYwooE0fW70zfp7Dqq3Y=";
   };
 
-  cargoHash = "sha256-HBVswxako/Djv8ayhEfgGVaFWblNn6ngtbQh9jNaxcQ=";
+  cargoHash = "sha256-AD4VLGsxkfl1UwJmZhR183Gk7ltjEyH9tlt+iKNs5J0=";
   nativeBuildInputs = [
     pkg-config
     installShellFiles
diff --git a/pkgs/by-name/co/copyparty/package.nix b/pkgs/by-name/co/copyparty/package.nix
index 1aabd4802e6d..63d9f3a4f872 100644
--- a/pkgs/by-name/co/copyparty/package.nix
+++ b/pkgs/by-name/co/copyparty/package.nix
@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.6";
+  version = "1.20.7";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-wWVuB6D9SZg7scqpPF1elRmooItdheZb7z7qdhrQbTA=";
+    hash = "sha256-oFrgImxhcVUdCvDo27u/bWwy+hnsBkRrX1ZybczhuMQ=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/co/cosmic-ext-applet-minimon/package.nix b/pkgs/by-name/co/cosmic-ext-applet-minimon/package.nix
index 248945e9d132..9b3add660dc0 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-minimon/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-minimon/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-ext-applet-minimon";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "minimon-applet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vxbzg7LHD+gYOeS+KHbV1zo17O0BsDLgQayYS0yBIOM=";
+    hash = "sha256-7XF2+6guu/DPY5IASS6BZPp2SfF2EDAkwTtkPfFbzfw=";
   };
 
-  cargoHash = "sha256-VmpzzEe6rE2LbaH1wZH37FoLJ93y4VIK8KiVDzT/Wj8=";
+  cargoHash = "sha256-pwoJP9vfyMKxvFQ4Rabl3VKtP14ks5jlUw0xz1OTl3A=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/cy/cyclonedx-cli/deps.json b/pkgs/by-name/cy/cyclonedx-cli/deps.json
index 63ede3c42f13..d83d3a609d9b 100644
--- a/pkgs/by-name/cy/cyclonedx-cli/deps.json
+++ b/pkgs/by-name/cy/cyclonedx-cli/deps.json
@@ -16,23 +16,23 @@
   },
   {
     "pname": "CycloneDX.Core",
-    "version": "8.0.3",
-    "hash": "sha256-d9GiOXYxQ1Sv35rN5jywhgTS+HKHSydHVcJNbKs7Htg="
+    "version": "11.0.0",
+    "hash": "sha256-i1H/+oH4yljhvXg0PnM87F9qu2RtvPco7adZ2uxzOpY="
   },
   {
     "pname": "CycloneDX.Spdx",
-    "version": "8.0.3",
-    "hash": "sha256-86E8rIXeE6gu+W3yK33abZ5w5zwuDR0Qv5texxJnsv0="
+    "version": "11.0.0",
+    "hash": "sha256-JOY+PjDApeXdJlCXhcr91lUiC6DOQEcjoYuQbBaaiog="
   },
   {
     "pname": "CycloneDX.Spdx.Interop",
-    "version": "8.0.3",
-    "hash": "sha256-WpM0VZAjhN2f/IckRIzIeMIkpir9ZNAW+0ZGxL2cBNY="
+    "version": "11.0.0",
+    "hash": "sha256-N682Lern6x18EJlRuJDR+T7/n5+2DWXp4Kz1MNuGqEM="
   },
   {
     "pname": "CycloneDX.Utils",
-    "version": "8.0.3",
-    "hash": "sha256-CW6e3uPmCP1U98fcQsiDvn3fLkQOGcchPiUNq4aXDbQ="
+    "version": "11.0.0",
+    "hash": "sha256-3rBD3lAzQiv0TghEbfxCVUQoWNOX8tzFew7V0s4NRpE="
   },
   {
     "pname": "JetBrains.Annotations",
@@ -64,11 +64,6 @@
     "version": "4.0.1",
     "hash": "sha256-0huoqR2CJ3Z9Q2peaKD09TV3E6saYSqDGZ290K8CrH8="
   },
-  {
-    "pname": "Microsoft.CSharp",
-    "version": "4.4.1",
-    "hash": "sha256-7/gsQHWAuFWrcVpVharASTNL+Mvl6Gw+AAw41k0MzXw="
-  },
   {
     "pname": "Microsoft.NET.Test.Sdk",
     "version": "17.3.2",
@@ -391,8 +386,13 @@
   },
   {
     "pname": "System.CommandLine",
-    "version": "2.0.0-beta1.21308.1",
-    "hash": "sha256-14pgyMy3F86XickXZB+AMX6uMTkVvBg5tV90p1G+4yY="
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  },
+  {
+    "pname": "System.CommandLine.NamingConventionBinder",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-Ffzs51XiFraSX1efQRO1IyiNraIgi8aOdkRRzCT6DB4="
   },
   {
     "pname": "System.Console",
@@ -529,11 +529,6 @@
     "version": "4.3.0",
     "hash": "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="
   },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.4",
-    "hash": "sha256-3sCEfzO4gj5CYGctl9ZXQRRhwAraMQfse7yzKoRe65E="
-  },
   {
     "pname": "System.Net.Http",
     "version": "4.3.0",
@@ -664,11 +659,6 @@
     "version": "4.3.0",
     "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
   },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "6.0.0",
-    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
-  },
   {
     "pname": "System.Runtime.Extensions",
     "version": "4.1.0",
@@ -809,15 +799,10 @@
     "version": "4.3.0",
     "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
   },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "6.0.0",
-    "hash": "sha256-UemDHGFoQIG7ObQwRluhVf6AgtQikfHEoPLC6gbFyRo="
-  },
   {
     "pname": "System.Text.Json",
-    "version": "6.0.2",
-    "hash": "sha256-YLpB48NRiQ8oCuUx0AHJzqUHYgUwXW/60shFkkN/5tM="
+    "version": "8.0.5",
+    "hash": "sha256-yKxo54w5odWT6nPruUVsaX53oPRe+gKzGvLnnxtwP68="
   },
   {
     "pname": "System.Text.RegularExpressions",
diff --git a/pkgs/by-name/cy/cyclonedx-cli/package.nix b/pkgs/by-name/cy/cyclonedx-cli/package.nix
index 448f1c7c5506..7769ef30c367 100644
--- a/pkgs/by-name/cy/cyclonedx-cli/package.nix
+++ b/pkgs/by-name/cy/cyclonedx-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "cyclonedx-cli";
-  version = "0.27.2";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-cli";
     tag = "v${version}";
-    hash = "sha256-QU/MaT8iIf/9VpOb2mixOfOtG/J+sE7S0mT6BKYQnlI=";
+    hash = "sha256-a9jUJqj/h2u2SrIQkQV8aFSzys+RVEI2yNlHTJpll+M=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
@@ -24,11 +24,6 @@ buildDotnetModule rec {
     find . ! -name 'cyclonedx' -type f -exec rm -f {} +
   '';
 
-  postPatch = ''
-    substituteInPlace src/cyclonedx/cyclonedx.csproj tests/cyclonedx.tests/cyclonedx.tests.csproj \
-      --replace-fail 'net6.0' 'net8.0'
-  '';
-
   meta = {
     description = "CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions";
     homepage = "https://github.com/CycloneDX/cyclonedx-cli";
diff --git a/pkgs/by-name/db/dbmail/package.nix b/pkgs/by-name/db/dbmail/package.nix
new file mode 100644
index 000000000000..76d1f84bbf15
--- /dev/null
+++ b/pkgs/by-name/db/dbmail/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+
+  pkg-config,
+  curlMinimal,
+  glib,
+  gmime3,
+  libevent,
+  libmhash,
+  libxcrypt,
+  libzdb,
+  openssl,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dbmail";
+  version = "3.5.5";
+
+  src = fetchFromGitHub {
+    owner = "dbmail";
+    repo = "dbmail";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uoK+sj/CQ2CcliQ+vtE9Q3BWVbzpQ5MP8xHVIxe6w2o=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    curlMinimal
+    glib
+    gmime3
+    libmhash
+    libevent
+    libxcrypt
+    libzdb
+    openssl
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
+  configureFlags = [ "--with-zdb=${libzdb}" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Highly available Message Delivery Agent using SQL storage";
+    homepage = "https://dbmail.org";
+    downloadPage = "https://github.com/dbmail/dbmail";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "dbmail-imapd";
+    maintainers = with lib.maintainers; [ maevii ];
+  };
+})
diff --git a/pkgs/by-name/di/discordchatexporter-cli/package.nix b/pkgs/by-name/di/discordchatexporter-cli/package.nix
index 8d3dce59c8ac..eab6a0f87f73 100644
--- a/pkgs/by-name/di/discordchatexporter-cli/package.nix
+++ b/pkgs/by-name/di/discordchatexporter-cli/package.nix
@@ -23,6 +23,12 @@ buildDotnetModule rec {
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.runtime_8_0;
 
+  dotnetBuildFlags = [
+    # workaround for https://github.com/belav/csharpier/pull/1696
+    # remove when csharpier is updated
+    "-p:FirstTargetFrameworks=workaround-for-csharpier-pr-1696"
+  ];
+
   postFixup = ''
     ln -s $out/bin/DiscordChatExporter.Cli $out/bin/discordchatexporter-cli
   '';
diff --git a/pkgs/by-name/el/element-desktop/element-desktop-pin.nix b/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
index 4d97a1db6c19..9c28e4b7f199 100644
--- a/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
+++ b/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
@@ -1,7 +1,7 @@
 {
-  "version" = "1.12.9";
+  "version" = "1.12.10";
   "hashes" = {
-    "desktopSrcHash" = "sha256-VBlKFknwafXar05kEpwv0+9EwUPe9WQRMn8S8uhX2U8=";
-    "desktopYarnHash" = "sha256-tBO8rtz5/8OxmGsPmMEATqNVuBEcNp6L6lJCaJdPlNY=";
+    "desktopSrcHash" = "sha256-2LQBT3+2JTR3XHO3DynOp8cw2m2SB/mGH01e3SFD/IM=";
+    "desktopYarnHash" = "sha256-QIzuVKmUS4tqXAzhpfLZOp51kLbfC1M2nrff8e+sdg4=";
   };
 }
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index 5cd9ff13ecae..453b13c768f4 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -5,7 +5,7 @@
   makeWrapper,
   makeDesktopItem,
   nodejs,
-  electron_39,
+  electron_40,
   element-web,
   sqlcipher,
   callPackage,
@@ -24,7 +24,7 @@ let
   pinData = import ./element-desktop-pin.nix;
   inherit (pinData.hashes) desktopSrcHash desktopYarnHash;
   executableName = "element-desktop";
-  electron = electron_39;
+  electron = electron_40;
   seshat = callPackage ./seshat { };
 in
 stdenv.mkDerivation (
diff --git a/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix b/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
index bd10d6850309..982b477e1225 100644
--- a/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
@@ -1,8 +1,8 @@
 {
-  "version" = "1.12.9";
+  "version" = "1.12.10";
   "hashes" = {
-    "webSrcHash" = "sha256-txG91VN4b0ZtUnQp4IfN47YAn1WBI9UUxemReachcDo=";
-    "webYarnHash" = "sha256-Y2AvBlS7qdVUXalKet3Ud4a6MA4MKHM4ffRhB7Uq8Co=";
-    "webSharedComponentsYarnHash" = "sha256-yeFFVVMWyPN3BqOY46KAxPv7VRVrsFvPan5arTNd/GM";
+    "webSrcHash" = "sha256-qc17AK2HvTJi0r03VTH0D2QitdYcGNRObji9cm6XsFU=";
+    "webYarnHash" = "sha256-qdmdwjVXA+ZnNG3S9Pnm3JOrJXYXVdH+w7mccNjRmVM=";
+    "webSharedComponentsYarnHash" = "sha256-0sOF3w6BnY1WenDP+zqZAo1W4C91glMQSMQ22iYajTw=";
   };
 }
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 9611303664ab..9e048cc48d36 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -49,8 +49,8 @@ let
       depsHash
     else
       {
-        x86_64-linux = "sha256-cUpCkmJmFyd2mTImMKt5Cgi+A4bAWAXLYjJjMnV6haQ=";
-        aarch64-linux = "sha256-f1FbdFDunlF7uhCpkb5AqmKN5uimuKnFYBzXjIcRabk=";
+        x86_64-linux = "sha256-CMd8dIyvuYFoHg1+AdkkyBj5P367ZcklCOgih+7uQIA=";
+        aarch64-linux = "sha256-NJIkiTIJBZFPb+FpTYo6pQQQt8++VuCHHj0Y0AjqWGo=";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -144,14 +144,14 @@ buildBazelPackage rec {
         --replace-fail 'crates_repository(' 'crates_repository(generator="@@cargo_bazel_bootstrap//:cargo-bazel", '
     '';
     preInstall = ''
+      # Envoy uses --noenable_bzlmod so BCR modules are not needed.
+      # Populate the repository cache with entries the build needs from the empty
+      # workspace.  Use `bazel sync` (which fetches WORKSPACE repos) rather than
+      # `bazel fetch` (which requires bzlmod for its --all mode).
       mkdir $NIX_BUILD_TOP/empty
       pushd $NIX_BUILD_TOP/empty
-      touch MODULE.bazel
-      # Unfortunately, we need to fetch a lot of irrelevant junk to make this work.
-      # This really bloats the size of the FOD.
-      # TODO: lukegb - figure out how to make this suck less.
-      bazel fetch --repository_cache="$bazelOut/external/repository_cache"
-      bazel sync --repository_cache="$bazelOut/external/repository_cache"
+      touch MODULE.bazel WORKSPACE
+      bazel sync --noenable_bzlmod --repository_cache="$bazelOut/external/repository_cache"
       popd
 
       # Strip out the path to the build location (by deleting the comment line).
diff --git a/pkgs/by-name/ex/extract-dtb/package.nix b/pkgs/by-name/ex/extract-dtb/package.nix
index 22d672e32ec3..9b5094fdb27e 100644
--- a/pkgs/by-name/ex/extract-dtb/package.nix
+++ b/pkgs/by-name/ex/extract-dtb/package.nix
@@ -23,7 +23,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     homepage = "https://github.com/PabloCastellano/extract-dtb";
     changelog = "https://github.com/PabloCastellano/extract-dtb/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ungeskriptet ];
     mainProgram = "extract-dtb";
   };
diff --git a/pkgs/by-name/gi/gitlab-art/package.nix b/pkgs/by-name/gi/gitlab-art/package.nix
new file mode 100644
index 000000000000..e569672da9bb
--- /dev/null
+++ b/pkgs/by-name/gi/gitlab-art/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "gitlab-art";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kosma";
+    repo = "gitlab-art";
+    tag = "v${version}";
+    hash = "sha256-j1MdkZUGMfrzowdhjJKhZqwN07JusaJsGkFu78IFdTY=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    pyaml
+    platformdirs
+    click
+    python-gitlab
+  ];
+
+  meta = {
+    description = "Pull cross-project Gitlab artifact dependencies";
+    homepage = "https://github.com/kosma/gitlab-art";
+    changelog = "https://github.com/kosma/gitlab-art/releases/tag/${src.tag}";
+    license = lib.licenses.wtfpl;
+    maintainers = with lib.maintainers; [ tbaldwin ];
+    mainProgram = "art";
+  };
+}
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index 56a3b332e9ba..f25cfca0fed7 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -9,16 +9,16 @@
 
 buildGo125Module rec {
   pname = "go-camo";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = "go-camo";
     tag = "v${version}";
-    hash = "sha256-LP01sPTHDouUmp6iDxdPklunxYKak2vaL0gJZsO3QRM=";
+    hash = "sha256-qRGVqs1FsdAyXKxnOZdJU3dhy7Isa0SjQZQCSWtjqL0=";
   };
 
-  vendorHash = "sha256-lFpVlK5/LSRTxVD5Ve6DSACeyLFTJxDM2bDTxcUU73E=";
+  vendorHash = "sha256-tmCvBMQWhDFqtxWT6iy8r5EhG72B4hBok31GNEvgCVU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/he/hello-cpp/package.nix b/pkgs/by-name/he/hello-cpp/package.nix
index 0d17f17ad7e5..7e2259fb1aea 100644
--- a/pkgs/by-name/he/hello-cpp/package.nix
+++ b/pkgs/by-name/he/hello-cpp/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "hello-cpp";
-  version = lib.trivial.version;
+  version = lib.trivial.release;
   src = ./src;
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/in/inori/package.nix b/pkgs/by-name/in/inori/package.nix
index 9323060780cc..7fb2f357f152 100644
--- a/pkgs/by-name/in/inori/package.nix
+++ b/pkgs/by-name/in/inori/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inori";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "eshrh";
     repo = "inori";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w+UsG4CHdug6TITJLjhHsQeAhHenzDFnZLICDT0Z1UM=";
+    hash = "sha256-U1fNLqJYtTJK0WZ0sO7DADVDRPSik5vuE78zGnJt15A=";
   };
 
-  cargoHash = "sha256-AvYNeWyitoi9hDqiy5hl/VM4LO8J2xmLgl0y8P4xYNA=";
+  cargoHash = "sha256-EfRSFxu/F+ltkx3uQ353CRlMrZN4PbmFdcw7H9Tm3ss=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ka/kak-tree-sitter/package.nix b/pkgs/by-name/ka/kak-tree-sitter/package.nix
index e80edb2f369e..1eb57f91f955 100644
--- a/pkgs/by-name/ka/kak-tree-sitter/package.nix
+++ b/pkgs/by-name/ka/kak-tree-sitter/package.nix
@@ -6,10 +6,10 @@
   kak-tree-sitter-unwrapped,
 }:
 
-symlinkJoin rec {
+symlinkJoin (finalAttrs: {
   pname = lib.replaceStrings [ "-unwrapped" ] [ "" ] kak-tree-sitter-unwrapped.pname;
   inherit (kak-tree-sitter-unwrapped) version;
-  name = "${pname}-${version}";
+  name = "${finalAttrs.pname}-${finalAttrs.version}";
 
   paths = [ kak-tree-sitter-unwrapped ];
   nativeBuildInputs = [ makeWrapper ];
@@ -24,4 +24,4 @@ symlinkJoin rec {
   '';
 
   inherit (kak-tree-sitter-unwrapped) meta;
-}
+})
diff --git a/pkgs/by-name/kn/knossosnet/package.nix b/pkgs/by-name/kn/knossosnet/package.nix
index b392df89e27b..55751fa082af 100644
--- a/pkgs/by-name/kn/knossosnet/package.nix
+++ b/pkgs/by-name/kn/knossosnet/package.nix
@@ -25,6 +25,9 @@ buildDotnetModule rec {
   nugetDeps = ./deps.json;
   executables = [ "Knossos.NET" ];
 
+  # IO errors in build due to solution building race
+  enableParallelBuilding = false;
+
   runtimeDeps = [ openal ];
 
   nativeBuildInputs = [ copyDesktopItems ];
diff --git a/pkgs/by-name/kr/krep/package.nix b/pkgs/by-name/kr/krep/package.nix
index ce6e7d64e7ea..45865ff4b4e5 100644
--- a/pkgs/by-name/kr/krep/package.nix
+++ b/pkgs/by-name/kr/krep/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "1.5.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "davidesantangelo";
     repo = "krep";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yPrQwztqJQGWk/RFklsA3dnuk7GCflaF0WbTm0mx7Gw=";
+    hash = "sha256-/eYS+GGqWbUkMzjRSGU6OElRaUFQ2/xvyRywRcQ9F+s=";
   };
 
   makeFlags = [
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index f22c94fd115e..07a3b15eff0b 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -26,6 +26,8 @@ buildDotnetModule rec {
 
   sourceRoot = "${src.name}/Source";
 
+  env.AVALONIA_TELEMETRY_OPTOUT = "1";
+
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
 
   dotnet-runtime = dotnetCorePackages.runtime_10_0;
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index b850532bf8d5..f1a808f736c1 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Cw7EPjN9PLmMxRTHV2DeUWM/BVNrDIQfy//Cn++C98o=";
+    hash = "sha256-vP/4QzsuA+guUBNFJWytdPiAuHh5+D+UMpRwb/9Lbxc=";
   };
 
-  cargoHash = "sha256-aQ6zGaHVEGgrNMhbx2tnb4yQ4B31Nr2gf4BKyJsnP0U=";
+  cargoHash = "sha256-MLWjY+Rw4PkKb1zqZaDGpGsKPlGTDNpPRzyz/w1HfZ0=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
diff --git a/pkgs/by-name/my/myman/package.nix b/pkgs/by-name/my/myman/package.nix
new file mode 100644
index 000000000000..97f39fce714d
--- /dev/null
+++ b/pkgs/by-name/my/myman/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  ncurses,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "myman";
+  version = "0.7.0";
+
+  src = fetchurl {
+    url = "https://sourceforge.net/projects/myman/files/myman/myman-${finalAttrs.version}/myman-${finalAttrs.version}.tar.gz";
+    hash = "sha512-elJo+pqSdcjUa1fPcU6InCIVgaXL4Zs4jmpgI2Z/mUH3ZK9r5H+/HxGkMPFJ+/anoLtb4t2SsWwHAg+d6PyYtg==";
+  };
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  buildInputs = [ ncurses ];
+
+  configureFlags = [
+    "--with-xterm"
+    "--with-rxvt"
+    "--with-kterm"
+    "--with-ncurses"
+  ];
+
+  meta = {
+    description = "Pacman clone with an ncurses and a 'graphic' interface";
+    homepage = "http://myman.sourceforge.net/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ silverhadch ];
+    platforms = lib.platforms.unix;
+    mainProgram = "myman";
+  };
+})
diff --git a/pkgs/by-name/ni/nixmate/package.nix b/pkgs/by-name/ni/nixmate/package.nix
new file mode 100644
index 000000000000..0430c64b7cf0
--- /dev/null
+++ b/pkgs/by-name/ni/nixmate/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nixmate";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "daskladas";
+    repo = "nixmate";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Buabxhaq9P1u2zqRMGnFnCZczrxENa/Ux//F5wHkb1U=";
+  };
+
+  cargoHash = "sha256-c11NRt6qBNhj6JQeI7/80aYzuCY36ApsUWVnbRH7rRU=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "All your NixOS tools in one TUI — generations, rebuilds, services, errors, and more";
+    homepage = "https://github.com/daskladas/nixmate";
+    changelog = "https://github.com/daskladas/nixmate/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "nixmate";
+  };
+})
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 814d6c481c2f..baf0c57c93b2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -201,7 +201,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
         "--diff",
         action="store_true",
         help="prints out the diff between the current system "
-        "and the newly built one using nix store diff-closures"
+        "and the newly built one using nix store diff-closures",
     )
     main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 2804ea94a7b2..1e2bd91f71c5 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,7 +1,7 @@
-import sys
 import json
 import logging
 import os
+import sys
 import textwrap
 import uuid
 from concurrent.futures import ThreadPoolExecutor
@@ -314,6 +314,7 @@ def get_build_image_name_flake(
     r = run_wrapper(
         [
             "nix",
+            *FLAKE_FLAGS,
             "eval",
             "--json",
             flake.to_attr(
@@ -365,6 +366,7 @@ def get_build_image_variants_flake(
     r = run_wrapper(
         [
             "nix",
+            *FLAKE_FLAGS,
             "eval",
             "--json",
             flake.to_attr("config.system.build.images"),
@@ -538,12 +540,13 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             reverse=True,
         )
 
-def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
-    print(
-        f"<<< {current_config}\n"
-        f">>> {new_config}",
-        file=sys.stderr
-    )
+
+def diff_closures(
+    current_config: Path,
+    new_config: Path,
+    target_host: Remote | None = None,
+) -> None:
+    print(f"<<< {current_config}\n>>> {new_config}", file=sys.stderr)
     run_wrapper(
         [
             "nix",
@@ -554,7 +557,7 @@ def diff_closures(current_config: Path, new_config: Path, target_host: Remote |
             new_config,
         ],
         remote=target_host,
-        stdout=sys.stderr
+        stdout=sys.stderr,
     )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 4a03e86ed4e9..b3cea3b15d68 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -8,7 +8,7 @@ import subprocess
 from collections.abc import Sequence
 from dataclasses import dataclass
 from ipaddress import AddressValueError, IPv6Address
-from typing import Final, Self, TypedDict, Unpack
+from typing import Final, Self, TextIO, TypedDict, Unpack
 
 from . import tmpdir
 
@@ -85,8 +85,8 @@ class Remote:
 # Not exhaustive, but we can always extend it later.
 class RunKwargs(TypedDict, total=False):
     capture_output: bool
-    stderr: int | None
-    stdout: int | None
+    stderr: int | TextIO | None
+    stdout: int | TextIO | None
 
 
 def cleanup_ssh() -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 933c2f8de10e..f5b9609e14f7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -324,9 +324,15 @@ def build_and_activate_system(
     current_config = Path("/run/current-system")
     if args.diff:
         if current_config.exists():
-            nix.diff_closures(current_config=current_config.readlink(), new_config=path_to_config, target_host=target_host)
+            nix.diff_closures(
+                current_config=current_config.readlink(),
+                new_config=path_to_config,
+                target_host=target_host,
+            )
         else:
-            logger.warning(f"missing '{str(current_config)}', skipping configuration diff...")
+            logger.warning(
+                f"missing '{current_config!s}', skipping configuration diff..."
+            )
 
     _activate_system(
         path_to_config=path_to_config,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 8d922809b05d..5a9f61be1f25 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -386,6 +386,8 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
             call(
                 [
                     "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
                     "eval",
                     "--json",
                     '/path/to/config#nixosConfigurations."hostname".config.system.build.images',
@@ -412,6 +414,8 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
             call(
                 [
                     "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
                     "eval",
                     "--json",
                     '/path/to/config#nixosConfigurations."hostname".config.system.build.images.azure.passthru.filePath',
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 69d29422337a..524527f8f68d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -394,6 +394,8 @@ def test_get_build_image_variants_flake(mock_run: Mock) -> None:
     mock_run.assert_called_with(
         [
             "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
             "eval",
             "--json",
             "/flake.nix#myAttr.config.system.build.images",
@@ -554,11 +556,9 @@ def test_list_generations(mock_get_generations: Mock, tmp_path: Path) -> None:
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_diff_closures(mock_run: Mock) -> None:
 
-    assert n.diff_closures(
-        Path("/run/current-system"),
-        Path("/nix/var/nix/profiles/system"),
-        None
-    ) == None
+    n.diff_closures(
+        Path("/run/current-system"), Path("/nix/var/nix/profiles/system"), None
+    )
     mock_run.assert_called_with(
         [
             "nix",
@@ -570,7 +570,7 @@ def test_diff_closures(mock_run: Mock) -> None:
             Path("/nix/var/nix/profiles/system"),
         ],
         remote=None,
-        stdout=sys.stderr
+        stdout=sys.stderr,
     )
 
 
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index d7737bc0d174..9ab7c89b2021 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-eUkP5fLXzcoVz8HPnPr0qQOXN2iTYS/ZJ73c9PgjCiU=";
+    hash = "sha256-2n2JGgnWEGsWVLnkWc+RilTybt3KXah8UzUUPINxzfE=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-FifLj2Aj0cfUmGHm39N7HIpAUmTBgGH2cjwTH+ChlgA=";
+    npmDepsHash = "sha256-gaf4+/H3nqgebPtxnEeUw2uw5xVh+FE6UFqD3mRjhv0=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [
diff --git a/pkgs/by-name/po/pokefinder/package.nix b/pkgs/by-name/po/pokefinder/package.nix
index 5a2671ae2e73..3c30de2aab9e 100644
--- a/pkgs/by-name/po/pokefinder/package.nix
+++ b/pkgs/by-name/po/pokefinder/package.nix
@@ -7,7 +7,7 @@
   cmake,
   python3,
   qt6,
-  imagemagick,
+  iconConvTools,
   gitUpdater,
 }:
 
@@ -40,8 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     install -D Source/PokeFinder $out/bin/PokeFinder
-    mkdir -p $out/share/pixmaps
-    convert "$src/Source/Form/Images/pokefinder.ico[-1]" $out/share/pixmaps/pokefinder.png
+    icoFileToHiColorTheme $src/Source/Form/Images/pokefinder.ico pokefinder $out
   ''
   + ''
     runHook postInstall
@@ -54,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     copyDesktopItems
-    imagemagick
+    iconConvTools
   ];
 
   desktopItems = [
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index bd247161b4a7..d8788eca93cc 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -45,13 +45,13 @@ let
   };
 
   pname = "pretix";
-  version = "2026.1.0";
+  version = "2026.1.1";
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${version}";
-    hash = "sha256-XS4Kqgvg3Bu5S3gFJ4fvvezCtQEA26jUa+8pSx2saNw=";
+    hash = "sha256-iH8S7+2SMw4LJjHjJvHAQgNSWU/zuk0nOUY/YI96T3E=";
   };
 
   npmDeps = buildNpmPackage {
diff --git a/pkgs/by-name/py/pyrra/package.nix b/pkgs/by-name/py/pyrra/package.nix
new file mode 100644
index 000000000000..c51a47a16e3b
--- /dev/null
+++ b/pkgs/by-name/py/pyrra/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pyrra";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "pyrra-dev";
+    repo = "pyrra";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3eEnwS3nnDuIYfZCDUrWFeNmAHEGWtpxtSVoI+XIMVM=";
+  };
+
+  vendorHash = "sha256-E2/OrAC2Wkv7OYPjs9ROE1RL4UUXYTByJZRY1qZB3gE=";
+
+  ui = buildNpmPackage {
+    inherit (finalAttrs) version;
+
+    pname = "${finalAttrs.pname}-ui";
+    src = "${finalAttrs.src}/ui";
+
+    npmDepsHash = "sha256-1KSkYUIJy6uci+Cy2q4dXO2PGpnwKcXQmWaWmpjPneA=";
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/share/pyrra
+      mv build $out/share/pyrra/ui
+      runHook postInstall
+    '';
+  };
+
+  preBuild = ''
+    mkdir -p ui/build
+    cp -r ${finalAttrs.ui}/share/pyrra/ui/* ui/build
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "ui"
+    ];
+  };
+
+  meta = {
+    mainProgram = "pyrra";
+    description = "Making SLOs with Prometheus manageable, accessible, and easy to use for everyone!";
+    homepage = "https://github.com/pyrra-dev/pyrra";
+    changelog = "https://github.com/pyrra-dev/pyrra/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      metalmatze
+      numbleroot
+    ];
+  };
+})
diff --git a/pkgs/by-name/qm/qmapshack/package.nix b/pkgs/by-name/qm/qmapshack/package.nix
index 54f7ae79d30c..c22625ab6fad 100644
--- a/pkgs/by-name/qm/qmapshack/package.nix
+++ b/pkgs/by-name/qm/qmapshack/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qmapshack";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = "qmapshack";
     tag = "V_${finalAttrs.version}";
-    hash = "sha256-g/csg44pyjLCavRNu/WgNY3sXW0hncB1xpAPhvyuD60=";
+    hash = "sha256-OazG5BkgofNXWKoTpKEoyZ+Ew1u2w2i1Y/ovTYNrl+w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/rasm/package.nix b/pkgs/by-name/ra/rasm/package.nix
index 2a835149e323..83fc37a1a875 100644
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rasm";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "EdouardBERGE";
     repo = "rasm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YNdm30gw2ycKTFrW+5tE0Du5m258befh17HjAWnQsbc=";
+    hash = "sha256-zBT4msN5ffqwsGTQDmK6gZJ5InzAy+kTlB4xEJPCGlY=";
   };
 
   # by default the EXEC variable contains `rasm.exe`
diff --git a/pkgs/by-name/rs/rshim-user-space/package.nix b/pkgs/by-name/rs/rshim-user-space/package.nix
index 07e6450858f5..8a9dc794b8ab 100644
--- a/pkgs/by-name/rs/rshim-user-space/package.nix
+++ b/pkgs/by-name/rs/rshim-user-space/package.nix
@@ -23,26 +23,17 @@
   withBfbInstall ? true,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rshim-user-space";
-  version = "2.5.7";
+  version = "2.6.6";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "rshim-user-space";
-    rev = "rshim-${version}";
-    hash = "sha256-dXrReU6Wx8t6ObrrF3MeUWdFBSfn6tyQqQdGBAZsvDg=";
+    rev = "rshim-${finalAttrs.version}";
+    hash = "sha256-OdrJnOm0QegQ2ex1hFSWPfwYuBnXpGeMJ2YfvNyIwTU=";
   };
 
-  # came up shortly after 2.5.7 release, remove with next update
-  patches = [
-    (fetchpatch2 {
-      name = "rshim-fix-bfb-install.patch";
-      url = "https://github.com/Mellanox/rshim-user-space/commit/0b2b17eeb04d80b7efb20aa2a9dc24759680aaea.patch";
-      hash = "sha256-JqnCGWM6Wjg+WFQhqHv6h4VbawyCf75L4wfd7L+n7po=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoconf
     automake
@@ -107,8 +98,5 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       thillux
     ];
-    # Requires https://github.com/Mellanox/rshim-user-space/pull/276 for glibc-2.42,
-    # patch appears broken though.
-    broken = true;
   };
-}
+})
diff --git a/pkgs/by-name/sa/samfirm-js/package.nix b/pkgs/by-name/sa/samfirm-js/package.nix
index 60aadeaf15b3..600d1f6d52aa 100644
--- a/pkgs/by-name/sa/samfirm-js/package.nix
+++ b/pkgs/by-name/sa/samfirm-js/package.nix
@@ -27,7 +27,6 @@ buildNpmPackage {
     description = "Program for downloading Samsung firmware";
     homepage = "https://github.com/DavidArsene/samfirm.js";
     license = lib.licenses.gpl3;
-    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ungeskriptet ];
     mainProgram = "samfirm-js";
   };
diff --git a/pkgs/by-name/sb/sbom-tool/package.nix b/pkgs/by-name/sb/sbom-tool/package.nix
index f5d27de56e48..c3ff9d6e92f6 100644
--- a/pkgs/by-name/sb/sbom-tool/package.nix
+++ b/pkgs/by-name/sb/sbom-tool/package.nix
@@ -26,6 +26,8 @@ buildDotnetModule rec {
 
   dotnetBuildFlags = [
     "-p:MinVerVersionOverride=${version}"
+    # this is fragile with sdk updates
+    "-p:EnforceCodeStyleInBuild=false"
   ];
 
   dotnetInstallFlags = [
diff --git a/pkgs/by-name/sp/space-station-14-launcher/package.nix b/pkgs/by-name/sp/space-station-14-launcher/package.nix
index 5f419d4cc225..a777882775ae 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/package.nix
+++ b/pkgs/by-name/sp/space-station-14-launcher/package.nix
@@ -36,19 +36,22 @@
   # Path to set ROBUST_SOUNDFONT_OVERRIDE to, essentially the default soundfont used.
   soundfont-path ? "${soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2",
 }:
-buildDotnetModule rec {
+let
   pname = "space-station-14-launcher";
-  version = "0.36.1";
+  version = "0.37.1";
+in
+buildDotnetModule rec {
+  inherit pname;
 
   # Workaround to prevent buildDotnetModule from overriding assembly versions.
-  name = "space-station-14-launcher-${version}";
+  # If you inherit version it will break loading Robust.LoaderApi when connecting to a server!
+  name = "${pname}-${version}";
 
-  # A bit redundant but I don't trust this package to be maintained by anyone else.
   src = fetchFromGitHub {
     owner = "space-wizards";
     repo = "SS14.Launcher";
     tag = "v${version}";
-    hash = "sha256-6wH2CkTuwy+a3EGpKrdLDsIaQ7oZc2I1OLdmAREMazw=";
+    hash = "sha256-83eBAT+NuwwpC30Xc5bJEs++tTYlY3akMaizQgNHOsA=";
     fetchSubmodules = true;
   };
 
@@ -66,9 +69,7 @@ buildDotnetModule rec {
     inherit version;
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_10_0 // {
-    inherit (dotnetCorePackages.sdk_8_0) packages;
-  };
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
   dotnet-runtime = dotnetCorePackages.runtime_10_0;
 
   dotnetFlags = [
@@ -113,9 +114,9 @@ buildDotnetModule rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = "space-station-14-launcher";
+      name = pname;
       exec = meta.mainProgram;
-      icon = "space-station-14-launcher";
+      icon = pname;
       desktopName = "Space Station 14 Launcher";
       comment = meta.description;
       categories = [ "Game" ];
@@ -127,14 +128,14 @@ buildDotnetModule rec {
     mkdir -p $out/lib/space-station-14-launcher/loader
     cp -r SS14.Loader/bin/${buildType}/*/*/* $out/lib/space-station-14-launcher/loader/
 
-    icoFileToHiColorTheme SS14.Launcher/Assets/icon.ico space-station-14-launcher $out
+    icoFileToHiColorTheme SS14.Launcher/Assets/icon.ico ${pname} $out
   '';
 
   meta = {
     description = "Launcher for Space Station 14, a multiplayer game about paranoia and disaster";
     homepage = "https://spacestation14.io";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.coca ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "SS14.Launcher";
   };
diff --git a/pkgs/by-name/ss/sshwifty/package.nix b/pkgs/by-name/ss/sshwifty/package.nix
index 01e976f35945..dbd67332702c 100644
--- a/pkgs/by-name/ss/sshwifty/package.nix
+++ b/pkgs/by-name/ss/sshwifty/package.nix
@@ -69,7 +69,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/nirui/sshwifty";
     changelog = "https://github.com/nirui/sshwifty/releases/tag/${finalAttrs.version}";
     license = lib.licenses.agpl3Plus;
-    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ungeskriptet ];
     mainProgram = "sshwifty";
   };
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 7c36dc1a8a02..2ad9ab51c95b 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -18,7 +18,7 @@ let
 in
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "17.1.5";
+  version = "17.1.8";
 
   inherit nodejs;
 
@@ -26,7 +26,7 @@ buildNpmPackage rec {
     owner = "johannesjo";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-ECUn+0RFNYc5QgJYXMYQ0fWZ39WVErCNCIIkrual1P4=";
+    hash = "sha256-76rgW97ElM/6Sy3JwmrqA+nV5ONWqYBoK1uK+UEYf24=";
 
     postFetch = ''
       find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -69,7 +69,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-tDQd3HVktivwyPaLF88fLLDwU6H7yX03DWrpFVkdDXk=";
+      hash = "sha256-epDGYONJgLJsNG0f6GiIbXwoPdjAsLGGQa0giPiBMYs=";
     }
   );
 
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index ac7685ba001a..91e08e5682d7 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.5.0-unstable-2026-01-31";
+  version = "3.5.0-unstable-2026-02-11";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "7e01491e2f7952a3d2d798ddaaf0ffd396921329";
-    hash = "sha256-yKH5M1pN2/vm2cRKiasT3TwRMLjtBla/qR/71U595wQ=";
+    rev = "c2fd3c07ac1f317e2700aead1a2338fe11152ce2";
+    hash = "sha256-Nnrod7sEOqXCnHx6gkpnkXObt4FNE35vp6fvGN9988Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-cts/package.nix b/pkgs/by-name/vu/vulkan-cts/package.nix
index ab390744efa4..0bda21e4fa1d 100644
--- a/pkgs/by-name/vu/vulkan-cts/package.nix
+++ b/pkgs/by-name/vu/vulkan-cts/package.nix
@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-cts";
-  version = "1.4.5.0";
+  version = "1.4.5.1";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "VK-GL-CTS";
     rev = "vulkan-cts-${finalAttrs.version}";
-    hash = "sha256-cbXSelRPCCH52xczWaxqftbimHe4PyIKZqySQSFTHos=";
+    hash = "sha256-kGnOBEiZQuvRqqwx7pbOK2y3VpUlHVoXH1ntq+o5y5g=";
   };
 
   prePatch = ''
diff --git a/pkgs/by-name/vu/vulkan-cts/sources.nix b/pkgs/by-name/vu/vulkan-cts/sources.nix
index 1e4a7dc13e3b..f31539fcd5b6 100644
--- a/pkgs/by-name/vu/vulkan-cts/sources.nix
+++ b/pkgs/by-name/vu/vulkan-cts/sources.nix
@@ -60,8 +60,8 @@ rec {
   vulkan-video-samples = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Video-Samples";
-    rev = "v0.3.7";
-    hash = "sha256-vNdRAx4kgPHxhHB0bUUsvi6yJhNcm/H5pU24tkVshuM=";
+    rev = "v0.3.9";
+    hash = "sha256-SyW/OzDGPdRPYGG7jgFMp8AkvpZq8Yi/7QZKZugXKho=";
   };
 
   prePatch = ''
diff --git a/pkgs/by-name/wa/wavelib/package.nix b/pkgs/by-name/wa/wavelib/package.nix
new file mode 100644
index 000000000000..01d458c9ac6a
--- /dev/null
+++ b/pkgs/by-name/wa/wavelib/package.nix
@@ -0,0 +1,40 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation {
+  pname = "wavelib";
+  version = "0-unstable-2025-12-12";
+
+  src = fetchFromGitHub {
+    owner = "rafat";
+    repo = "wavelib";
+    rev = "7f61bf592f3c470b2a7d8199431fde821d7253ac";
+    hash = "sha256-M8HnyZ/ARnF7D7GuTx7vhuaJtpQVl5sV2qBe0LBynW4=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  checkPhase = ''
+    runHook preCheck
+    Bin/Release/wavelibLibTests
+    runHook postCheck
+  '';
+
+  # Don't install the test binary
+  postInstall = ''
+    rm -r $out/bin
+  '';
+
+  meta = {
+    description = "C Implementation of Discrete Wavelet Transform (DWT,SWT and MODWT)";
+    homepage = "https://github.com/rafat/wavelib";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rowanG077 ];
+  };
+}
diff --git a/pkgs/by-name/wi/winbox3/package.nix b/pkgs/by-name/wi/winbox3/package.nix
index 6f5ed0499fc5..381cacad82f8 100644
--- a/pkgs/by-name/wi/winbox3/package.nix
+++ b/pkgs/by-name/wi/winbox3/package.nix
@@ -44,9 +44,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/{bin,libexec,share/pixmaps}
+    mkdir -p $out/{bin,libexec}
 
-    ln -s "${icon}" "$out/share/pixmaps/winbox.png"
+    install -D "${icon}" "$out/share/icons/hicolor/128x128/apps/winbox.png"
 
     makeWrapper ${lib.getExe wine} $out/bin/winbox \
       --add-flags $src
diff --git a/pkgs/by-name/wi/winbox4/build-from-zip.nix b/pkgs/by-name/wi/winbox4/build-from-zip.nix
index a4986035dbe2..b8292df399b6 100644
--- a/pkgs/by-name/wi/winbox4/build-from-zip.nix
+++ b/pkgs/by-name/wi/winbox4/build-from-zip.nix
@@ -61,7 +61,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 "assets/img/winbox.png" "$out/share/pixmaps/winbox.png"
+    install -Dm644 "assets/img/winbox.png" -t "$out/share/icons/hicolor/1024x1024/apps"
     install -Dm755 "WinBox" "$out/bin/WinBox"
 
     wrapProgram "$out/bin/WinBox" --run "${lib.getExe finalAttrs.migrationScript}"
diff --git a/pkgs/by-name/xk/xkbvalidate/package.nix b/pkgs/by-name/xk/xkbvalidate/package.nix
index d22a16f1a226..63f1187d5af7 100644
--- a/pkgs/by-name/xk/xkbvalidate/package.nix
+++ b/pkgs/by-name/xk/xkbvalidate/package.nix
@@ -7,7 +7,7 @@
 runCommandCC "xkbvalidate"
   {
     pname = "xkbvalidate";
-    inherit (lib.trivial) version;
+    version = lib.trivial.release;
 
     buildInputs = [ libxkbcommon ];
     meta = {
diff --git a/pkgs/by-name/yo/youtrack/package.nix b/pkgs/by-name/yo/youtrack/package.nix
index 3407bb4f4c92..13cfc6f4c715 100644
--- a/pkgs/by-name/yo/youtrack/package.nix
+++ b/pkgs/by-name/yo/youtrack/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
+  dockerTools,
   makeBinaryWrapper,
   jdk21_headless,
   gawk,
@@ -10,12 +10,22 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "youtrack";
-  version = "2025.1.86199";
+  version = "2025.3.121962";
 
-  src = fetchzip {
-    url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
-    hash = "sha256-+sHxagy9+H6DEnpdtRTNMy6GLSSCopaeqlXWJodAim0=";
+  src = dockerTools.exportImage {
+    diskSize = 8192;
+    fromImage = dockerTools.pullImage {
+      imageName = "jetbrains/youtrack";
+      arch = "amd64";
+      imageDigest = "sha256:90b641d623cb30f4915bd4a0bdba088bab25cf14314231e0333b8564bc353161";
+      hash = "sha256-WkEKJKfG5lagfgn4hbpEqIUPXGJYcYbwMjb1c5BNvp8=";
+    };
   };
+  unpackPhase = ''
+    mkdir source
+    tar -C source -xvf $src ./opt/youtrack
+    cd source
+  '';
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
@@ -25,12 +35,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
     mkdir -p $out
-    cp -r * $out
+    cp -r opt/youtrack/* $out
     makeWrapper $out/bin/youtrack.sh $out/bin/youtrack \
       --prefix PATH : "${lib.makeBinPath [ gawk ]}" \
       --set JRE_HOME ${jdk21_headless}
     rm -rf $out/internal/java
     mv $out/conf $out/conf.orig
+    rmdir $out/{backups,data,logs,temp}
     ln -s ${statePath}/backups $out/backups
     ln -s ${statePath}/conf $out/conf
     ln -s ${statePath}/data $out/data
@@ -45,6 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Issue tracking and project management tool for developers";
     maintainers = [ lib.maintainers.leona ];
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    platforms = [ "x86_64-linux" ];
     # https://www.jetbrains.com/youtrack/buy/license.html
     license = lib.licenses.unfree;
   };
diff --git a/pkgs/development/interpreters/love/11.nix b/pkgs/development/interpreters/love/11.nix
index 2fe0d4bedc31..15ef843872fc 100644
--- a/pkgs/development/interpreters/love/11.nix
+++ b/pkgs/development/interpreters/love/11.nix
@@ -85,15 +85,14 @@ stdenv.mkDerivation rec {
     # Install Linux-specific files (desktop, mime, icons)
     mkdir -p $out/share/applications
     mkdir -p $out/share/mime/packages
-    mkdir -p $out/share/pixmaps
-    mkdir -p $out/share/icons/hicolor/scalable/mimetypes
+    mkdir -p $out/share/icons/hicolor/scalable/{apps,mimetypes}
 
     # Generate desktop file from template
     substitute $src/platform/unix/love.desktop.in $out/share/applications/love.desktop \
       --replace-fail '@bindir@' "$out/bin"
 
     cp $src/platform/unix/love.xml $out/share/mime/packages/
-    cp $src/platform/unix/love.svg $out/share/pixmaps/
+    cp $src/platform/unix/love.svg $out/share/icons/hicolor/scalable/apps
     cp $src/platform/unix/application-x-love-game.svg $out/share/icons/hicolor/scalable/mimetypes/
   ''
   + ''
diff --git a/pkgs/development/python-modules/liblp/default.nix b/pkgs/development/python-modules/liblp/default.nix
index 74a5154e4aa2..6757194573e2 100644
--- a/pkgs/development/python-modules/liblp/default.nix
+++ b/pkgs/development/python-modules/liblp/default.nix
@@ -28,7 +28,6 @@ buildPythonPackage rec {
     description = "Android logical partitions library ported from C++ to Python";
     homepage = "https://github.com/sebaubuntu-python/liblp";
     license = lib.licenses.asl20;
-    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ungeskriptet ];
     mainProgram = "lpunpack";
   };
diff --git a/pkgs/development/python-modules/libusb-package/default.nix b/pkgs/development/python-modules/libusb-package/default.nix
index 7cc3d6602712..154e3554e69b 100644
--- a/pkgs/development/python-modules/libusb-package/default.nix
+++ b/pkgs/development/python-modules/libusb-package/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/pyocd/libusb-package/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.brianmcgillion ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/development/python-modules/pymobiledevice3/default.nix b/pkgs/development/python-modules/pymobiledevice3/default.nix
index 025b76368341..d3f952cb6a5e 100644
--- a/pkgs/development/python-modules/pymobiledevice3/default.nix
+++ b/pkgs/development/python-modules/pymobiledevice3/default.nix
@@ -50,14 +50,14 @@
 
 buildPythonPackage rec {
   pname = "pymobiledevice3";
-  version = "7.5.1";
+  version = "7.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "doronz88";
     repo = "pymobiledevice3";
     tag = "v${version}";
-    hash = "sha256-j183S5H6jUnhOn/xMfeZtG9c4OowH/6HPpP2giko4dM=";
+    hash = "sha256-dBzBvwjto0pr0EWOKStEPXbdlX1mOxBFsU1CkmQLhNw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index bbc2c55aab77..a297b802a9a1 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tlds";
-  version = "2026020700";
+  version = "2026021400";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
     tag = finalAttrs.version;
-    hash = "sha256-cpm3x17B+w+Tq+ztQjd0Xttkyivv5Al+3w6RD+SU3T8=";
+    hash = "sha256-IyIZCBlH918let5qa/fi/SYampE3E+yAVMG17nHF7mk=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/rocm-modules/amdsmi/default.nix b/pkgs/development/rocm-modules/amdsmi/default.nix
index af24c68b8fd2..16647a728bb8 100644
--- a/pkgs/development/rocm-modules/amdsmi/default.nix
+++ b/pkgs/development/rocm-modules/amdsmi/default.nix
@@ -6,6 +6,7 @@
   cmake,
   pkg-config,
   libdrm,
+  python,
   wrapPython,
   autoPatchelfHook,
 }:
@@ -67,6 +68,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postInstall = ''
+    mkdir -p $out/${python.sitePackages}
+    ln -s $out/share/amd_smi/amdsmi $out/${python.sitePackages}/amdsmi
+
     makeWrapperArgs=(--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libdrm ]})
     wrapPythonProgramsIn $out
     rm $out/bin/amd-smi
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index b7c574ec171a..507fa59f3aee 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -20,10 +20,7 @@ assert stdenv.hostPlatform.libc == "musl" -> useMusl;
 let
   configParser = ''
     function parseconfig {
-        while read LINE; do
-            NAME=`echo "$LINE" | cut -d \  -f 1`
-            OPTION=`echo "$LINE" | cut -d \  -f 2`
-
+        while IFS=" " read NAME OPTION; do
             if ! [[ "$NAME" =~ ^CONFIG_ ]]; then continue; fi
 
             echo "parseconfig: removing $NAME"
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 140c3ecc04d0..a05e2ba66cd3 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,23 +20,23 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.125",
-        "hash": "sha256:0g88r1v5q0m1n1ii2f16awc8w9m471m6hqx7r5whad4a8dpkpqwf",
+        "version": "6.6.126",
+        "hash": "sha256:0bzfa31h4d3808a6kz1vqccyiiv3kpvkryq5jb6cizmbg172yx0n",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.72",
-        "hash": "sha256:0ybijkw2zadhlg49r0wvnvy3s2czj5jnb149cz8ybvzvp90qgxdi",
+        "version": "6.12.73",
+        "hash": "sha256:1fj1ggpp19vjk80wbv0l9sn0ji0cm2wf0dvdyf6m9sgqrfad6na0",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.11",
-        "hash": "sha256:1xrsc7s3kh7mipfs0v33n97gfi55ll83x4hxvwi969qh8293ibrq",
+        "version": "6.18.12",
+        "hash": "sha256:1spihc64pp1jd18i4ckvk0fzad0ia5cq5fvznxdsrhn2si52j0z0",
         "lts": false
     },
     "6.19": {
-        "version": "6.19.1",
-        "hash": "sha256:1vlki73j7m2khjl39hq4fy42qql9als18nmnjg00a8yklhqzb0qb",
+        "version": "6.19.2",
+        "hash": "sha256:0npfhawx99iwla9j29bnf6bz8g07h7cdk26nsk6vgkicb20ijqc8",
         "lts": false
     }
 }
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index 50c718b0cb89..cf0429f3fa7c 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -61,9 +61,9 @@ stdenv.mkDerivation {
     runHook preInstall
 
     d=$out/share/nifskope
-    mkdir -p $out/bin $out/share/applications $out/share/pixmaps $d/{shaders,lang}
+    mkdir -p $out/bin $out/share/applications $d/{shaders,lang}
     cp release/NifSkope $out/bin/
-    cp ./res/nifskope.png $out/share/pixmaps/
+    install -D ./res/nifskope.png -t $out/share/icons/hicolor/128x128/apps
     cp release/{nif.xml,kfm.xml,style.qss} $d/
     cp res/shaders/*.frag res/shaders/*.prog res/shaders/*.vert $d/shaders/
     cp ./res/lang/*.ts ./res/lang/*.tm $d/lang/
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 123ea0d71b94..498f7d3b7970 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -26,7 +26,7 @@ let
   mkPrefetchScript =
     tool: src: deps:
     stdenv.mkDerivation {
-      inherit (lib.trivial) version;
+      version = lib.trivial.release;
       pname = "nix-prefetch-${tool}";
 
       strictDeps = true;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7ff086620388..9ad0f243ec60 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -694,6 +694,12 @@ self: super: with self; {
 
   amcrest = callPackage ../development/python-modules/amcrest { };
 
+  amdsmi = toPythonModule (
+    pkgs.rocmPackages.amdsmi.override {
+      inherit python;
+    }
+  );
+
   ament-package = callPackage ../development/python-modules/ament-package { };
 
   amply = callPackage ../development/python-modules/amply { };