Merge release-25.11 into staging-next-25.11staging-next-25.11

27 files changed, 311 insertions, 97 deletions

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 85561029c86a..45a55eb45dce 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -38,10 +38,3 @@ For new packages please briefly describe the package or provide a link to its ho
 [nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
 [pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
 [pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
-
----
-
-Add a :+1: [reaction] to [pull requests you find important].
-
-[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-[pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f67af84e0922..cbe76a67aaac 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28916,7 +28916,7 @@
     githubId = 102890144;
   };
   yiyu = {
-    email = "yiyuzhou19@gmail.com";
+    email = "yiyu@yiyuzhou.io";
     name = "Yiyu Zhou";
     github = "yzhou216";
     githubId = 50000936;
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 66a79a253ccf..7f13314ab351 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -68,6 +68,7 @@
   alsa-lib,
   desktopToDarwinBundle,
   fetchpatch,
+  qoi,
 }:
 
 let
@@ -192,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib-networking
     libmypaint
     mypaint-brushes1
+    qoi
 
     # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
     adwaita-icon-theme
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 7b9178ab9343..dfacf296ab60 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "146.0.1-1",
+  "packageVersion": "147.0-1",
   "source": {
-    "rev": "146.0.1-1",
-    "hash": "sha256-MYp0PEAbUSJwrvaXYaie7eXj3XRw/EyGrQvsFdVT/Y0="
+    "rev": "147.0-1",
+    "hash": "sha256-LZE4d1z4djtGSrnFsh1i9GXvFbK55RQMcqyID9ui0Ng="
   },
   "firefox": {
-    "version": "146.0.1",
-    "hash": "sha512-rpW4bkg/6/jf7INHdI3ZBI7X1/hFJQ4HqoBI4rNR2mH288X4O7DQxy4adexhtg5Zu+aWOfDzNTKRD/i/XKBzlA=="
+    "version": "147.0",
+    "hash": "sha512-rJAXsaLaey8Tk5LDlMNjQf00duPU6ho8fl578QDcMNGFEy75JWvn5rD52/xpI0rFceofxtudhFQ7FXcvTshRYQ=="
   }
 }
diff --git a/pkgs/by-name/ch/changedetection-io/package.nix b/pkgs/by-name/ch/changedetection-io/package.nix
index 777fb073314b..a5c23a274c93 100644
--- a/pkgs/by-name/ch/changedetection-io/package.nix
+++ b/pkgs/by-name/ch/changedetection-io/package.nix
@@ -91,7 +91,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "Self-hosted free open source website change detection tracking, monitoring and notification service";
     homepage = "https://github.com/dgtlmoon/changedetection.io";
     changelog = "https://github.com/dgtlmoon/changedetection.io/releases/tag/${src.tag}";
-    license = lib.licenses.asl20;
+    license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       mikaelfangel
       thanegill
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 58884dd9b516..8c8f35d1000e 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -53,6 +53,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./patches/0002-tests-replace-hardcoded-paths.patch
     ./patches/0003-tests-linux-no-chown.patch
     ./patches/0004-tests-darwin-fixes.patch
+    # CVE-2026-22863: prevent cipher operations after finalize
+    # https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v
+    ./patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
   ];
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
diff --git a/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch b/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
new file mode 100644
index 000000000000..6dbfffaee572
--- /dev/null
+++ b/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
@@ -0,0 +1,193 @@
+From 446c4c8d36b9b9d3a8eccbb1486ac6e644aed930 Mon Sep 17 00:00:00 2001
+From: Divy <dj.srivastava23@gmail.com>
+Date: Tue, 9 Dec 2025 16:03:37 +0530
+Subject: [PATCH] fix(ext/node): prevent cipher operations after finalize
+ (#31533)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Throw a state error for operations if the cipher is already finalized.
+
+(cherry picked from commit 0bc213b15b819597d935be6cb04cec03659d146b)
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ ext/node/polyfills/internal/crypto/cipher.ts | 25 ++++++++
+ tests/unit_node/crypto/crypto_cipher_test.ts | 63 ++++++++++++++++++++
+ 2 files changed, 88 insertions(+)
+
+diff --git a/ext/node/polyfills/internal/crypto/cipher.ts b/ext/node/polyfills/internal/crypto/cipher.ts
+index d4c790706..ac2a32118 100644
+--- a/ext/node/polyfills/internal/crypto/cipher.ts
++++ b/ext/node/polyfills/internal/crypto/cipher.ts
+@@ -184,6 +184,8 @@ export class Cipheriv extends Transform implements Cipher {
+ 
+   #autoPadding = true;
+ 
++  #finalized = false;
++
+   constructor(
+     cipher: string,
+     key: CipherKey,
+@@ -213,12 +215,17 @@ export class Cipheriv extends Transform implements Cipher {
+   }
+ 
+   final(encoding: string = getDefaultEncoding()): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("final");
++    }
++
+     this.#lazyInitDecoder(encoding);
+ 
+     const buf = new FastBuffer(16);
+     if (this.#cache.cache.byteLength == 0) {
+       const maybeTag = op_node_cipheriv_take(this.#context);
+       if (maybeTag) this.#authTag = Buffer.from(maybeTag);
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+ 
+@@ -233,9 +240,11 @@ export class Cipheriv extends Transform implements Cipher {
+     );
+     if (maybeTag) {
+       this.#authTag = Buffer.from(maybeTag);
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+ 
++    this.#finalized = true;
+     if (encoding !== "buffer") {
+       return this.#decoder!.end(buf);
+     }
+@@ -270,6 +279,10 @@ export class Cipheriv extends Transform implements Cipher {
+     inputEncoding?: Encoding,
+     outputEncoding: Encoding = getDefaultEncoding(),
+   ): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("update");
++    }
++
+     // TODO(kt3k): throw ERR_INVALID_ARG_TYPE if data is not string, Buffer, or ArrayBufferView
+     let buf = data;
+     if (typeof data === "string") {
+@@ -391,6 +404,8 @@ export class Decipheriv extends Transform implements Cipher {
+ 
+   #authTag?: BinaryLike;
+ 
++  #finalized = false;
++
+   constructor(
+     cipher: string,
+     key: CipherKey,
+@@ -427,6 +442,10 @@ export class Decipheriv extends Transform implements Cipher {
+   }
+ 
+   final(encoding: string = getDefaultEncoding()): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("final");
++    }
++
+     this.#lazyInitDecoder(encoding);
+ 
+     let buf = new FastBuffer(16);
+@@ -439,6 +458,7 @@ export class Decipheriv extends Transform implements Cipher {
+     );
+ 
+     if (!this.#needsBlockCache || this.#cache.cache.byteLength === 0) {
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+     if (this.#cache.cache.byteLength != 16) {
+@@ -446,6 +466,7 @@ export class Decipheriv extends Transform implements Cipher {
+     }
+ 
+     buf = buf.subarray(0, 16 - buf.at(-1)); // Padded in Pkcs7 mode
++    this.#finalized = true;
+     if (encoding !== "buffer") {
+       return this.#decoder!.end(buf);
+     }
+@@ -480,6 +501,10 @@ export class Decipheriv extends Transform implements Cipher {
+     inputEncoding?: Encoding,
+     outputEncoding: Encoding = getDefaultEncoding(),
+   ): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("update");
++    }
++
+     // TODO(kt3k): throw ERR_INVALID_ARG_TYPE if data is not string, Buffer, or ArrayBufferView
+     let buf = data;
+     if (typeof data === "string") {
+diff --git a/tests/unit_node/crypto/crypto_cipher_test.ts b/tests/unit_node/crypto/crypto_cipher_test.ts
+index 4d96a11d8..a15032dea 100644
+--- a/tests/unit_node/crypto/crypto_cipher_test.ts
++++ b/tests/unit_node/crypto/crypto_cipher_test.ts
+@@ -569,3 +569,66 @@ Deno.test({
+     assertEquals(decryptedText, text);
+   },
+ });
++
++
++Deno.test({
++  name: "createCipheriv - cipher lockdown after final()",
++  fn() {
++    const key = crypto.randomBytes(32);
++    const iv = crypto.randomBytes(16);
++    const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
++
++    // Call final() to lock down the cipher
++    cipher.final();
++
++    assertThrows(
++      () => {
++        cipher.update("test data");
++      },
++      Error,
++      "Invalid state for operation update",
++    );
++
++    assertThrows(
++      () => {
++        cipher.final();
++      },
++      Error,
++      "Invalid state for operation final",
++    );
++  },
++});
++
++Deno.test({
++  name: "createDecipheriv - decipher lockdown after final()",
++  fn() {
++    const key = crypto.randomBytes(32);
++    const iv = crypto.randomBytes(16);
++
++    const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
++    const encrypted = Buffer.concat([
++      cipher.update("test data"),
++      cipher.final(),
++    ]);
++
++    const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
++    decipher.update(encrypted);
++    decipher.final();
++
++    assertThrows(
++      () => {
++        decipher.update(encrypted);
++      },
++      Error,
++      "Invalid state for operation update",
++    );
++
++    assertThrows(
++      () => {
++        decipher.final();
++      },
++      Error,
++      "Invalid state for operation final",
++    );
++  },
++});
+-- 
+2.52.0
+
diff --git a/pkgs/by-name/di/dioxus-cli/package.nix b/pkgs/by-name/di/dioxus-cli/package.nix
index d3be3f661a3d..4e6c1d5ac365 100644
--- a/pkgs/by-name/di/dioxus-cli/package.nix
+++ b/pkgs/by-name/di/dioxus-cli/package.nix
@@ -7,7 +7,7 @@
   openssl,
   rustfmt,
   makeWrapper,
-  wasm-bindgen-cli_0_2_106,
+  wasm-bindgen-cli_0_2_108,
   testers,
   dioxus-cli,
   withTelemetry ? false,
@@ -15,15 +15,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dioxus-cli";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchCrate {
     pname = "dioxus-cli";
     version = finalAttrs.version;
-    hash = "sha256-VCoTxZKFYkGBCu1X/9US/OCFpp6zc5ojmXWJfzozCxc=";
+    hash = "sha256-6uG737MNk+wTKqNWgFEd8MsOOvllZLDnIrJPAn5Wjuw=";
   };
 
-  cargoHash = "sha256-de8z68uXnrzyxTJY53saJ6hT7rvYbSdsSA/WWQa6nl4=";
+  cargoHash = "sha256-BdPsdWah/f2pveQViPikIV2riSwjSo+qGOFoP+hHaiM=";
   buildFeatures = [
     "no-downloads"
   ]
@@ -68,7 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     wrapProgram $out/bin/dx \
-      --prefix PATH : ${lib.makeBinPath [ wasm-bindgen-cli_0_2_106 ]}
+      --prefix PATH : ${lib.makeBinPath [ wasm-bindgen-cli_0_2_108 ]}
   '';
 
   meta = {
diff --git a/pkgs/by-name/fa/fastmail-desktop/sources.nix b/pkgs/by-name/fa/fastmail-desktop/sources.nix
index 874ee15e85d2..4fd1a3f64b9c 100644
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-12-06
+# Last updated: 2025-12-19
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.6-arm64-mac.zip";
-      hash = "sha512-viKPE0LS4dQQxw9jimEGjAl65uSE7XeAcuoLzq7n4i/BEfNo9QjzOzDMbxhwkGY0Ba92coddwJRXaSdx48fTTw==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.7-arm64-mac.zip";
+      hash = "sha512-pH6m2BxP/y/A/DaPVNgwmd5HHVbyCVefYhJENyImsKQAKzn8RY9EI/kaybMHlQjv6N0Gmixpskvm0K74k3LUqg==";
     };
   };
   x86_64-linux = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.6.AppImage";
-      hash = "sha512-WKMhy7dLoFUqUkevkZAgxgxpz5jD4O9VVaKDYxQs0jXJVt5GUcIHDJ6aZIJG6jyinAC18NzF3vJnOftw8ZWdmg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.7.AppImage";
+      hash = "sha512-MFVqBuuruqDVOkK9NC5E60BPJnIHdiL4MhitWqmmUB+NidlBxQbeDeWZu5Pwhh878UXrNvA0mVCgTZAOK7e2Ew==";
     };
   };
 }
diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index d7e651d17baf..f1098d2df592 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+oc6FJwlixJ6PNQmZoZxUveR3h+zRopptMYm6ef9r/I=";
+    hash = "sha256-PeJf0b15865iz6q3vPNIIEg8UggP7OTukyRn3yLI25o=";
   };
 
   buildInputs = [ php84 ];
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-y8tGv5dgGHV2moBgYKSvBoc0SfHvt7HbSrctoAdMQGE=";
+  vendorHash = "sha256-hNapeTzqsDqfnG3iea6+bOdb6wd/6fgyfMpEnj5lhB4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 868e15d61d4c..72e6cb96e78d 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "2.7.3";
-  srcHash = "sha256-nyMKlcJcDa532NqiT16eQJH0Z4dAO1MHkIzsrWlJS7Q=";
-  vendorHash = "sha256-0aQYOmH9CFv0gQ3PIEWr3OhC1jyQOIkNMp9lb7GQ40I=";
-  manifestsHash = "sha256-SQkMqcJY3FHLx6aAwWL0Nuz3fzPTevod4paz2H2srcI=";
+  version = "2.7.5";
+  srcHash = "sha256-vTb1YE73xxCC4GlR6UW5Ibu+ck+N+KKYUg50csb7eUA=";
+  vendorHash = "sha256-AgWDvlXVZXXprWCeoNeAMDb6LeYfa9yG5afc7TNISQs=";
+  manifestsHash = "sha256-CmYuHhEiKxkSRtN+fri2/4ILxpwRy2xGwGqCqcfsQwU=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index cc1d6df01c26..7240d478b9c2 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -49,17 +49,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "12.5.2";
+  version = "12.5.3";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-aL79wMzoqt1rqaOQyV28HSeZwjL3k60AyQOhOT/+BRY=";
+    hash = "sha256-qCk2GvPWKIQfEjYtx2Uc7GcVDehUu0/u4LP88FxoA9A=";
   };
 
-  vendorHash = "sha256-XNUhlGkW8bZ1cjODD6QIyRmmNdQ4Tq/hP2FToYfTq2k=";
+  vendorHash = "sha256-pGLZmSW7MKEy/K+njgcPv5a+7Qtf8mqUI4OwKhfEZXY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/fo/forgejo/lts.nix b/pkgs/by-name/fo/forgejo/lts.nix
index 7b6b3636237e..1e7ec7fdfe87 100644
--- a/pkgs/by-name/fo/forgejo/lts.nix
+++ b/pkgs/by-name/fo/forgejo/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "11.0.9";
-  hash = "sha256-1jp0FT/T+j1CAPc99lTRSUd4R4YhgLMjZr4k3jW6ho8=";
+  version = "11.0.10";
+  hash = "sha256-vATc7pBOejBfZKNj3WsQeFWr1xKpIB4ODv4TPRrwdg0=";
   npmDepsHash = "sha256-Qs1aZxgjlsjdxfBpa4pOrwEfDfb/96L49uJd29Ysn/I=";
   vendorHash = "sha256-TVp4WxrGBlKVaPIbsj4EP/3pt5iseXLY7xIVum71ZXU=";
   lts = true;
diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index d4227a77c1f4..71c18e592348 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "14.0.0";
-  hash = "sha256-kQaaRwVUYIYTTjWcHKb09CzygDR6lhEbnY3FOsnyYpg=";
-  npmDepsHash = "sha256-rdlVXdoov3zppDgoLODl22AKCdm+AXiV1O63dmo6trg=";
+  version = "14.0.1";
+  hash = "sha256-nnHpi2mb+QziEtahRVMUt7t+xKiylzLCalh+6ywcP7w=";
+  npmDepsHash = "sha256-gyEr5uNZfBELxbvQeZ48xqtay7ObQL4dQaFO9yPC2Hg=";
   vendorHash = "sha256-7xgm57IqsFOh3CPwGybPHLLlckGLplJpU7M5upYKBl8=";
   lts = false;
   nixUpdateExtraArgs = [
diff --git a/pkgs/by-name/gi/gitui/package.nix b/pkgs/by-name/gi/gitui/package.nix
index 8abe536cbb67..722cc86eb449 100644
--- a/pkgs/by-name/gi/gitui/package.nix
+++ b/pkgs/by-name/gi/gitui/package.nix
@@ -13,7 +13,7 @@
 }:
 let
   pname = "gitui";
-  version = "0.27.0";
+  version = "0.28.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
     owner = "extrawurst";
     repo = "gitui";
     rev = "v${version}";
-    hash = "sha256-jKJ1XnF6S7clyFGN2o3bHnYpC4ckl/lNXscmf6GRLbI=";
+    hash = "sha256-B3Cdhhu8ECfpc57TKe6u08Q/Kl4JzUlzw4vtJJ1YAUQ=";
   };
 
-  cargoHash = "sha256-Le/dD8bTd5boz1IeEq4ItJZYC3MRW8uiT/3Zy1yv5L0=";
+  cargoHash = "sha256-dq5F7NJ0XcJ9x6hVWOboQQn8Liw8n8vkFgQSmTYIkSw=";
 
   nativeBuildInputs = [
     pkg-config
@@ -40,16 +40,6 @@ rustPlatform.buildRustPackage {
     libiconv
   ];
 
-  patches = [
-    # Fixes the build for rust 1.89
-    # Upstream PR: https://github.com/gitui-org/gitui/pull/2663
-    # TOREMOVE for gitui > 0.27.0
-    (fetchpatch {
-      url = "https://github.com/gitui-org/gitui/commit/950e703cab1dd37e3d02e7316ec99cc0dc70513c.patch";
-      sha256 = "sha256-KDgOPLKGuJaF0Nc6rw9FPFmcI07I8Gyp/KNX8x6+2xw=";
-    })
-  ];
-
   postPatch = ''
     # The cargo config overrides linkers for some targets, breaking the build
     # on e.g. `aarch64-linux`. These overrides are not required in the Nix
diff --git a/pkgs/by-name/je/jetbrains-runner/package.nix b/pkgs/by-name/je/jetbrains-runner/package.nix
index c5caba3c2a16..d2b399fd0cf2 100644
--- a/pkgs/by-name/je/jetbrains-runner/package.nix
+++ b/pkgs/by-name/je/jetbrains-runner/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jetbrains-runner";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "alex1701c";
     repo = "JetBrainsRunner";
     tag = version;
-    hash = "sha256-Jw86JFaaJ5kGB4dnOInAcdGsLmE4XO7O8/aBaV1zcNU=";
+    hash = "sha256-TaueSAxGiKiPVT26DSy1mzwsw2vBUK3D//vtOLtw2KQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index 082cd77da9c5..b6960bceed6b 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "jjui";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kBhEX6k/1vVhSqKeUcIQp6sOpKDnJfgUNKOTzbjG/VI=";
+    hash = "sha256-Hsuyf5VcSZcNi2gmubXS47uRarL17oPEtorisY75bbM=";
   };
 
   vendorHash = "sha256-jte0g+aUiGNARLi8DyfsX6wYYJnodHnILzmid6KvMiA=";
diff --git a/pkgs/by-name/ma/mask/package.nix b/pkgs/by-name/ma/mask/package.nix
index b82b4f42df79..4269d7b9fb74 100644
--- a/pkgs/by-name/ma/mask/package.nix
+++ b/pkgs/by-name/ma/mask/package.nix
@@ -7,36 +7,43 @@
   nix-update-script,
 
   # tests
+  lua,
   nodejs,
-  python3,
   php,
+  python3,
   ruby,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mask";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "jacobdeichert";
     repo = "mask";
     tag = "mask/${finalAttrs.version}";
-    hash = "sha256-xGD23pso5iS+9dmfTMNtR6YqUqKnzJTzMl+OnRGpL3g=";
+    hash = "sha256-jz2x3Do+fqDHS7vNdnZsNOj36dRFt/khFaF/ztyKji8=";
   };
 
-  cargoHash = "sha256-JaYr6J3NOwVIHzGO4wLkke5O/T/9WUDENPgLP5Fwyhg=";
+  cargoHash = "sha256-HnRNg1/ZVWr6JRIsBf2kH9Xys7Hth4fMI12dClsPKv0=";
 
   preCheck = ''
     export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType
   '';
 
   nativeCheckInputs = [
+    lua
     nodejs
-    python3
     php
+    python3
     ruby
   ];
 
+  checkFlags = [
+    # requires swift which currently fails to build
+    "--skip=swift"
+  ];
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
@@ -49,8 +56,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/jacobdeichert/mask";
     changelog = "https://github.com/jacobdeichert/mask/blob/mask/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      defelo
-    ];
+    maintainers = with lib.maintainers; [ defelo ];
   };
 })
diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix
index 31ac4a734c29..6e1c34fa9d60 100644
--- a/pkgs/by-name/ob/obfs4/package.nix
+++ b/pkgs/by-name/ob/obfs4/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "obfs4";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
     # will collide with lyrebird Gtk3 program.
     repo = "lyrebird";
     tag = "lyrebird-${finalAttrs.version}";
-    hash = "sha256-h4ZhjyWRovoEFEFjjJBHBWc3kup60MNFvaYN6UPPxOE=";
+    hash = "sha256-KI9tGQomqSbiW8itxQ72rPwL67LVTmP110FrYVELr5w=";
   };
 
-  vendorHash = "sha256-isquplrmgtR8Mn5M+XNRdeGJHrAm7V7h1etVmVmN60I=";
+  vendorHash = "sha256-AlLRJieCiCLQPbqT+0J3Zxe73ryNB8MQkAyHsU+wr2A=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/od/odhcp6c/package.nix b/pkgs/by-name/od/odhcp6c/package.nix
index fa6b0f113122..81fa2c16169c 100644
--- a/pkgs/by-name/od/odhcp6c/package.nix
+++ b/pkgs/by-name/od/odhcp6c/package.nix
@@ -3,23 +3,25 @@
   stdenv,
   fetchgit,
   cmake,
+  libubox,
   unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
   pname = "odhcp6c";
-  version = "0-unstable-2025-10-21";
+  version = "0-unstable-2025-12-29";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/odhcp6c.git";
-    rev = "77e1ae21e67f81840024ffe5bb7cf69a8fb0d2f0";
-    hash = "sha256-aOW0rOGd4YwnfXjsUj6HHy8zf0FJYFjsKMWJ5yhUl5g=";
+    rev = "8abb45065f5ef9d176efa6bd151a1209b05852c4";
+    hash = "sha256-xly6FAp8yddBnJeCSupVIq0Wec+sSFuuKH91MNKvHwM=";
   };
 
   nativeBuildInputs = [ cmake ];
+  buildInputs = [ libubox ];
 
   cmakeFlags = [
-    "-DCMAKE_INSTALL_PREFIX=$out"
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
   ];
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index fd068e38e525..8cbfa685838f 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -11,7 +11,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.65.2";
+  version = "2.65.4";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-W3HQ6x9WXYXCczVj+3MBhEnkoDgJUJ6oZal1N4iDjdg=";
+    hash = "sha256-dBJmtKZD2MvQjLhz2Jcn/ldAEbo0wllXDItQu5pyrW8=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/su/subunit/package.nix b/pkgs/by-name/su/subunit/package.nix
index 3342e4d58b46..98095c1720a7 100644
--- a/pkgs/by-name/su/subunit/package.nix
+++ b/pkgs/by-name/su/subunit/package.nix
@@ -1,7 +1,9 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  nix-update-script,
+  autoreconfHook,
   pkg-config,
   check,
   cppunit,
@@ -13,14 +15,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "subunit";
-  version = "1.4.2";
+  version = "1.4.5";
 
-  src = fetchurl {
-    url = "https://launchpad.net/subunit/trunk/${finalAttrs.version}/+download/subunit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hlOOv6kIC97w7ICVsuXeWrsUbVu3tCSzEVKUHXYG2dI=";
+  src = fetchFromGitHub {
+    owner = "testing-cabal";
+    repo = "subunit";
+    tag = finalAttrs.version;
+    hash = "sha256-yM5mlYV7KyPRzPhnbDYBFLn4uiwxFFEotX2r6KcKAwA=";
   };
 
   nativeBuildInputs = [
+    autoreconfHook
     pkg-config
     perl
     python3Packages.wrapPython
@@ -38,13 +43,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  postFixup = "wrapPythonPrograms";
+  passthru.updateScript = nix-update-script;
 
   meta = {
     description = "Streaming protocol for test results";
-    mainProgram = "subunit-diff";
-    homepage = "https://launchpad.net/subunit";
-    license = lib.licenses.asl20;
+    homepage = "https://github.com/testing-cabal/subunit";
+    license = with lib.licenses; [
+      asl20
+      bsd3
+    ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ azey7f ];
   };
diff --git a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix
new file mode 100644
index 000000000000..9ec22500a2c3
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.108";
+    hash = "sha256-UsuxILm1G6PkmVw0I/JF12CRltAfCJQFOaT4hFwvR8E=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-iqQiWbsKlLBiJFeqIYiXo3cqxGLSjNM8SOWXGM9u43E=";
+  };
+}
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index d1dec1faaa66..d255cf862fbb 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -8,9 +8,9 @@
   pythonOlder,
 
   # python dependencies
-  extras,
   fixtures,
   hypothesis,
+  iso8601,
   pytestCheckHook,
   setuptools,
   testscenarios,
@@ -39,7 +39,7 @@ buildPythonPackage {
   ];
 
   propagatedBuildInputs = [
-    extras
+    iso8601
     testtools
   ];
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 9d8494c2be6d..1d98124cfc82 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,8 +5,8 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.160",
-        "hash": "sha256:15l4s87vyv4rnf5yagl6x7kz4yrlalh191ssxwbvwn3m8fl4d18f",
+        "version": "6.1.161",
+        "hash": "sha256:0aasgrq6mv5nj7b8ashzx0pxlaah5y0f3sq7d8w00di2lyync5ml",
         "lts": true
     },
     "5.15": {
@@ -20,18 +20,18 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.120",
-        "hash": "sha256:08fwwi9wjnhaj4ig0n0ycppzw384djh0gzv3i3blzp7fb4nk6p20",
+        "version": "6.6.121",
+        "hash": "sha256:1fhl9pr02s10j4b5nli0isy7ps644cpbmjqzkwf5mk14rr7rvbvn",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.65",
-        "hash": "sha256:1h9rl62lffwxan5ggz1vi9wmyzzsclg330gwdk80wp7kg9k55s2l",
+        "version": "6.12.66",
+        "hash": "sha256:1bvfadb5149sh927f8cbr1rnypn7v0h6znjdrc1mmc30q2hrff5s",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.5",
-        "hash": "sha256:0h6r5w7755gd8ys18zi9rgw95wrd2yalbq0h88ihv3ggki01z78q",
+        "version": "6.18.6",
+        "hash": "sha256:06x3z649mzwwkb1hvsy0yh7j5jk9qrnwqcmwy7dx8s1ggccrf927",
         "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f2679c376c9d..a60255c005cf 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.18.3"; # zen
+      version = "6.18.5"; # zen
       suffix = "zen1"; # zen
-      sha256 = "02iw0lsgb8b3yiqdcf90fn0dgbrlbalgdbzbgn6mpy44ycynl8jc"; # zen
+      sha256 = "1slclm2mgv7z3s0lcjrhqhzhbas4yq9yxkdjr27hlx7madplwbmi"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 78d84122776e..d5208534f4e1 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1649,7 +1649,7 @@ mapAliases {
   warmux = throw "'warmux' has been removed as it is unmaintained and broken"; # Added 2025-11-03
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
-  wasm-bindgen-cli = wasm-bindgen-cli_0_2_106;
+  wasm-bindgen-cli = wasm-bindgen-cli_0_2_108;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24
   wavm = throw "wavm has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10