diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index b8156c5b3bcc..4f6fbd9a55c5 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -66,7 +66,11 @@
   zlib,
 
   # Boolean flags
-  withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+
+  # FIXME: Native compilation breaks build and runtime on macOS 15.4;
+  # see <https://github.com/NixOS/nixpkgs/issues/395169>.
+  withNativeCompilation ?
+    stdenv.buildPlatform.canExecute stdenv.hostPlatform && !stdenv.hostPlatform.isDarwin,
   noGui ? false,
   srcRepo ? true,
   withAcl ? false,
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index d5e34fc625a5..38bbca910c7a 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -65,6 +65,23 @@ let
     source ${./update-lib.sh}
   '';
 
+  # Needed for wine versions < 10.2 to fix compatibility with binutils 2.44
+  # https://github.com/NixOS/nixpkgs/issues/399714
+  # https://bugs.winehq.org/show_bug.cgi?id=57819
+  # https://gitlab.winehq.org/wine/wine/-/merge_requests/7328
+  patches-binutils-2_44-fix-wine-older-than-10_2 = [
+    (pkgs.fetchpatch {
+      name = "ntdll-use-signed-type";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/fd59962827a715d321f91c9bdb43f3e61f9ebbc.patch";
+      hash = "sha256-PvFom9NJ32XZO1gYor9Cuk8+eaRFvmG572OAtNx1tks=";
+    })
+    (pkgs.fetchpatch {
+      name = "winebuild-avoid using-idata-section";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/c9519f68ea04915a60704534ab3afec5ec1b8fd7.patch";
+      hash = "sha256-vA58SfAgCXoCT+NB4SRHi85AnI4kj9S2deHGp4L36vI=";
+    })
+  ];
+
   inherit (pkgs) writeShellScript;
 in
 rec {
@@ -96,7 +113,7 @@ rec {
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
-    ];
+    ] ++ patches-binutils-2_44-fix-wine-older-than-10_2;
 
     updateScript = writeShellScript "update-wine-stable" (''
       ${updateScriptPreamble}
@@ -118,7 +135,11 @@ rec {
     version = "10.5";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
     hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
-    inherit (stable) patches;
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ];
 
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
@@ -177,7 +198,11 @@ rec {
     version = "9.21";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
     hash = "sha256-REK0f/2bLqRXEA427V/U5vTYKdnbeaJeYFF1qYjKL/8=";
-    inherit (stable) patches;
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ] ++ patches-binutils-2_44-fix-wine-older-than-10_2;
 
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index 3467f1f9943e..79b2e0745b44 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "138.0b5";
+  version = "138.0b9";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "07da38a6aa19de812539ba9b286d5189607ef45e7d8665a0f42facdcf7b3f7854561ad3cb54dce7e049199574b7d6dff01dba03763730e49306efb82833270fb";
+    sha512 = "cf737b8c394150430cda512a84ebdf04426db0c413863eb37a327c44fc952db7de1be07956aaded3ddb769480fb307a102c1f4f7dab4ba8a38f2371fdd35a961";
   };
 
   meta = {
diff --git a/pkgs/by-name/cl/clightning/package.nix b/pkgs/by-name/cl/clightning/package.nix
index 2484b659a4a8..0cd9776b4cf2 100644
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "24.11.1";
+  version = "25.02.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-FdrD+FA0t90oJnXjUA8oalU7DDjUv70fAteNxbhscgk=";
+    hash = "sha256-0eRLc/bR4sjnNIKzhkX9yVCAoypf1TVhpa884mmVC54=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool
@@ -95,11 +95,6 @@ stdenv.mkDerivation rec {
     stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
   ) "-Wno-error=gnu-folding-constant";
 
-  # The `clnrest` plugin requires a Python environment to run
-  postInstall = ''
-    rm -r $out/libexec/c-lightning/plugins/clnrest
-  '';
-
   meta = with lib; {
     description = "Bitcoin Lightning Network implementation in C";
     longDescription = ''
diff --git a/pkgs/by-name/fu/furnace/package.nix b/pkgs/by-name/fu/furnace/package.nix
index 286a7e51dc4f..1ca6761b33c2 100644
--- a/pkgs/by-name/fu/furnace/package.nix
+++ b/pkgs/by-name/fu/furnace/package.nix
@@ -12,6 +12,7 @@
   freetype,
   libsndfile,
   libX11,
+  libGL,
   rtmidi,
   SDL2,
   zlib,
@@ -63,16 +64,19 @@ stdenv.mkDerivation (finalAttrs: {
       libsndfile
       rtmidi
       SDL2
-      libX11
       zlib
       portaudio
     ]
+    ++ lib.optionals withGL [
+      libGL
+    ]
     ++ lib.optionals withJACK [
       libjack2
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # portaudio pkg-config is pulling this in as a link dependency, not set in propagatedBuildInputs
       alsa-lib
+      libX11
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (
       with darwin.apple_sdk.frameworks;
diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index 6a6f48c67f6d..639d0718a22b 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -9,11 +9,11 @@ let
   owner = "superseriousbusiness";
   repo = "gotosocial";
 
-  version = "0.18.3";
+  version = "0.19.0";
 
   web-assets = fetchurl {
     url = "https://github.com/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-60aSiWHHHDxZggreqTVHip2Ld/PyN9T4k+NGjX/ONQc=";
+    hash = "sha256-Ba497VKK30MWcLlR4CDDUrFZKWf/UXiSgeDr/f7fFkc=";
   };
 in
 buildGoModule rec {
@@ -23,7 +23,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     inherit owner repo;
     tag = "v${version}";
-    hash = "sha256-fn3QrfTrKYWABRMF3imyoeVEpARl13fcq6Fu2GwsrcE=";
+    hash = "sha256-ioIsa2L1w4z1b7tWFhHScmPwRRq0WLngIdm4r2eCveM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/re/redu/package.nix b/pkgs/by-name/re/redu/package.nix
index 5da1913d43a9..e81994bb9604 100644
--- a/pkgs/by-name/re/redu/package.nix
+++ b/pkgs/by-name/re/redu/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "redu";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "drdo";
     repo = "redu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3DcBTpog5tWv2qdmhOlDLHFY77Cug6mCpDQEAtViw74=";
+    hash = "sha256-iea3tt1WB0/5XPNeCAk38/UoCHVSngXfNmfZQyspmsw=";
   };
 
-  cargoHash = "sha256-Rp8y2tBnpzBVEoLP4fTMulIJpu1j2TpJNh5M9kjnuEo=";
+  cargoHash = "sha256-fiMZIFIVeFnBnRBgmdUB8E5A2pM5nrTfUgD1LS6a4LQ=";
 
   env.RUSTC_BOOTSTRAP = 1;
 
diff --git a/pkgs/by-name/sd/sdl3-image/package.nix b/pkgs/by-name/sd/sdl3-image/package.nix
index cf9a89d5a125..70754f72b4d0 100644
--- a/pkgs/by-name/sd/sdl3-image/package.nix
+++ b/pkgs/by-name/sd/sdl3-image/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   sdl3,
-  darwin,
   libavif,
   libtiff,
   libwebp,
@@ -9,8 +8,12 @@
   cmake,
   fetchFromGitHub,
   validatePkgConfig,
+  libpng,
+  libjpeg,
+  nix-update-script,
   # Boolean flags
   enableTests ? true,
+  enableSTB ? true,
   enableImageIO ? stdenv.hostPlatform.isDarwin,
 }:
 
@@ -39,29 +42,43 @@ stdenv.mkDerivation (finalAttrs: {
     validatePkgConfig
   ];
 
-  buildInputs = [
-    sdl3
-    libtiff
-    libwebp
-    libavif
-  ] ++ (lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Foundation);
+  buildInputs =
+    [
+      sdl3
+      libtiff
+      libwebp
+      libavif
+    ]
+    ++ (lib.optionals (!enableSTB) [
+      libpng
+      libjpeg
+    ]);
 
   cmakeFlags = [
     # fail when a dependency could not be found
     (lib.cmakeBool "SDLIMAGE_STRICT" true)
     # disable shared dependencies as they're opened at runtime using SDL_LoadObject otherwise.
     (lib.cmakeBool "SDLIMAGE_DEPS_SHARED" false)
+    # disable stbi
+    (lib.cmakeBool "SDLIMAGE_BACKEND_STB" enableSTB)
     # enable imageio backend
     (lib.cmakeBool "SDLIMAGE_BACKEND_IMAGEIO" enableImageIO)
     # enable tests
     (lib.cmakeBool "SDLIMAGE_TESTS" enableTests)
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "release-(3\\..*)"
+    ];
+  };
+
   meta = {
     description = "SDL image library";
     homepage = "https://github.com/libsdl-org/SDL_image";
     license = lib.licenses.zlib;
-    maintainers = with lib.maintainers; [ evythedemon ];
+    maintainers = [ lib.maintainers.evythedemon ];
     inherit (sdl3.meta) platforms;
   };
 })
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 988e2a5c7c7c..4275f28f8532 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "devito";
-  version = "4.8.14";
+  version = "4.8.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${version}";
-    hash = "sha256-NM60H8Fx0pe4JEF7K8A+1i1MbxKhgab5cGcCD8wl9l8=";
+    hash = "sha256-Eb8ndWtc8TxQGO/7BCa+gU/3SUVPaOvZQBtj7YHT3PA=";
   };
 
   pythonRemoveDeps = [ "pip" ];
diff --git a/pkgs/development/python-modules/mlcroissant/default.nix b/pkgs/development/python-modules/mlcroissant/default.nix
new file mode 100644
index 000000000000..7711374c5370
--- /dev/null
+++ b/pkgs/development/python-modules/mlcroissant/default.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
+  etils,
+  jsonpath-rw,
+  networkx,
+  pandas,
+  pandas-stubs,
+  python-dateutil,
+  rdflib,
+  requests,
+  scipy,
+  tqdm,
+
+  # tests
+  apache-beam,
+  gitpython,
+  pillow,
+  pytestCheckHook,
+  pyyaml,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "mlcroissant";
+  version = "1.0.17";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mlcommons";
+    repo = "croissant";
+    tag = "v${version}";
+    hash = "sha256-jiyr8x+YRSsRwOVxDPaWemPqglTKVb5jg4rRzUXd3BE=";
+  };
+
+  sourceRoot = "${src.name}/python/mlcroissant";
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    absl-py
+    etils
+    jsonpath-rw
+    networkx
+    pandas
+    pandas-stubs
+    python-dateutil
+    rdflib
+    requests
+    scipy
+    tqdm
+  ] ++ etils.optional-dependencies.epath;
+
+  pythonImportsCheck = [ "mlcroissant" ];
+
+  nativeCheckInputs = [
+    apache-beam
+    gitpython
+    pillow
+    pytestCheckHook
+    pyyaml
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTests = [
+    # Requires internet access
+    "test_hermetic_loading_1_1"
+    "test_load_from_huggingface"
+    "test_nonhermetic_loading"
+    "test_nonhermetic_loading_1_0"
+
+    # AssertionError: assert {'records/aud...t32), 22050)'} == {'records/aud...t32), 22050)'}
+    "test_hermetic_loading"
+
+    # AttributeError: 'MaybeReshuffle' object has no attribute 'side_inputs'
+    "test_beam_hermetic_loading"
+  ];
+
+  meta = {
+    description = "High-level format for machine learning datasets that brings together four rich layers";
+    homepage = "https://github.com/mlcommons/croissant";
+    changelog = "https://github.com/mlcommons/croissant/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.all;
+    mainProgram = "mlcroissant";
+  };
+}
diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix
index 9f0710b79aef..b551b797c78e 100644
--- a/pkgs/development/python-modules/nanobind/default.nix
+++ b/pkgs/development/python-modules/nanobind/default.nix
@@ -27,14 +27,14 @@
 }:
 buildPythonPackage rec {
   pname = "nanobind";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wjakob";
     repo = "nanobind";
     tag = "v${version}";
-    hash = "sha256-1CU5aRhiVPGXLVYZzOM8ELgRwa3hz7kQSwlTYsvFE7s=";
+    hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/tenant-schemas-celery/default.nix b/pkgs/development/python-modules/tenant-schemas-celery/default.nix
index d08e47ef284a..0becc555d2a9 100644
--- a/pkgs/development/python-modules/tenant-schemas-celery/default.nix
+++ b/pkgs/development/python-modules/tenant-schemas-celery/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "tenant-schemas-celery";
-  version = "3.0.0";
+  version = "4.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maciej-gol";
     repo = "tenant-schemas-celery";
     tag = version;
-    hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg=";
+    hash = "sha256-SpjiVbgAXY+WzVpGYt3uislPn9u1buGN4z94Rg5MAwo=";
   };
 
   build-system = [ setuptools ];
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   meta = {
     description = "Celery application implementation that allows celery tasks to cooperate with multi-tenancy provided by django-tenant-schemas and django-tenants packages";
     homepage = "https://github.com/maciej-gol/tenant-schemas-celery";
-    changelog = "https://github.com/maciej-gol/tenant-schemas-celery/releases/tag/${version}";
+    changelog = "https://github.com/maciej-gol/tenant-schemas-celery/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jopejoe1 ];
   };
diff --git a/pkgs/development/python-modules/vfblib/default.nix b/pkgs/development/python-modules/vfblib/default.nix
index 4bd46a3f8fba..4a88c543569b 100644
--- a/pkgs/development/python-modules/vfblib/default.nix
+++ b/pkgs/development/python-modules/vfblib/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "vfblib";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LucasFonts";
     repo = "vfbLib";
     rev = "v${version}";
-    hash = "sha256-D37i4dJPWGruwhLVEEPY3mzu0ONM38JTbC3Pt+/35lQ=";
+    hash = "sha256-kXuaxdGj2dcenZ4SfRBiDjcLzA3Ehb25T7bKk4dXK9g=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index bd314e86a39d..55759722fec5 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -864,14 +864,14 @@ if [ -z "$rollback" ]; then
                     value = import \"$(realpath $buildFile)\";
                     set = if builtins.isFunction value then value {} else value;
                 in set.${attr:+$attr.}config.system.build.images.$imageVariant.v.passthru.filePath" \
-                "${extraBuildFlags[@]}"
+                "${extraBuildFlags[@]}" \
                 | jq -r .
             )"
         elif [[ -z $flake ]]; then
             imageName="$(
                 runCmd nix-instantiate --eval --strict --json --expr \
                 "with import <nixpkgs/nixos> {}; config.system.build.images.$imageVariant.passthru.filePath" \
-                "${extraBuildFlags[@]}"
+                "${extraBuildFlags[@]}" \
                 | jq -r .
             )"
         else
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b158c2b21768..9fa4de0a4e78 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8902,6 +8902,8 @@ self: super: with self; {
 
   ml-dtypes = callPackage ../development/python-modules/ml-dtypes { };
 
+  mlcroissant = callPackage ../development/python-modules/mlcroissant { };
+
   mlflow = callPackage ../development/python-modules/mlflow { };
 
   mlrose = callPackage ../development/python-modules/mlrose { };