diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 6b310d8c3de6..33b558f27149 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -34,6 +34,8 @@
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
+- `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index aecb6f56a428..408d0e11ef17 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24106,6 +24106,12 @@
     githubId = 64620440;
     name = "RoGreat";
   };
+  rohan-datar = {
+    email = "me@rohandatar.com";
+    github = "rohan-datar";
+    githubId = 37545071;
+    name = "Rohan Datar";
+  };
   rohanssrao = {
     email = "rohanssrao@gmail.com";
     github = "rohanssrao";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 1eaef0621fbd..7c3844bff12e 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -136,6 +136,7 @@ mpack,,,,,,
 neorg,,,,,5.1,GaetanLepage
 neorg-interim-ls,,,,,,
 neotest,,,,,5.1,mrcjkb
+neotest-nix,,,,,,khaneliman
 nginx-lua-prometheus,,,,,,ulysseszhan
 nlua,,,,,,teto
 nui.nvim,,,,,5.1,mrcjkb
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
index 22ff6038d4c8..d099fc1a9e5d 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -77,7 +77,10 @@ melpaBuild {
   meta = {
     homepage = "https://github.com/dakra/ghostel";
     description = "Terminal emulator powered by libghostty";
-    maintainers = with lib.maintainers; [ vonfry ];
+    maintainers = with lib.maintainers; [
+      rohan-datar
+      vonfry
+    ];
     license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix b/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix
index 5bac2daba0b2..64ccb6cfc6b6 100644
--- a/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix
+++ b/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix
@@ -29,6 +29,7 @@ let
     "neorg"
     "neorg-interim-ls"
     "neotest"
+    "neotest-nix"
     "nui-nvim"
     "nvim-cmp"
     "nvim-nio"
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 62b1442404c2..fb4fe9b74ddb 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -396,8 +396,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.16.14";
-          hash = "sha256-WuDsYSQ5B2xA3LnU1fiXBx8yqOplGstZO0qYaLtPF0A=";
+          version = "2.16.17";
+          hash = "sha256-k54hpRlzjtNWv0mIUBKFxJYc5T2jpWxB9U8nuXXmjJ0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
@@ -1215,8 +1215,8 @@ let
         mktplcRef = {
           name = "flutter";
           publisher = "dart-code";
-          version = "3.136.0";
-          hash = "sha256-RK493qHjEK/k8oy/OIzO3bvNnFo+ZftQhZMIAmBCaJk=";
+          version = "3.138.0";
+          hash = "sha256-FkaUKApoN6e8ET2o/71GVhyNWdZ34t6fqEzlraH7QBc=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1346,8 +1346,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.29.6";
-          hash = "sha256-CHpRetKZnGzShIePnbVUdR06/1AAO2I1RX7NiZ7GBNs=";
+          version = "2.29.7";
+          hash = "sha256-l0CTWC16Aw2u8uob5tKauYIT3KaDsptV/L8WR54eN64=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
diff --git a/pkgs/applications/emulators/libretro/cores/mame2015.nix b/pkgs/applications/emulators/libretro/cores/mame2015.nix
index 6165afd0b93d..a537e03e5633 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2015.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2015.nix
@@ -22,7 +22,8 @@ mkLibretroCore {
   extraBuildInputs = [ alsa-lib ];
   makefile = "Makefile";
   # Build failures when this is set to a bigger number
-  NIX_BUILD_CORES = 8;
+  env.NIX_BUILD_CORES = 8;
+
   meta = {
     description = "Port of MAME ~2015 to libretro, compatible with MAME 0.160 sets";
     homepage = "https://github.com/libretro/mame2015-libretro";
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 64f2b04b613c..ae0950b70b13 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  protobuf,
   wrapQtAppsHook,
   python3,
   zbar,
@@ -21,14 +20,14 @@ let
     else
       "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
 in
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "electrum";
-  version = "4.7.2";
+  version = "4.8.0";
   pyproject = true;
 
   src = fetchurl {
-    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    hash = "sha256-qzA/HLw+QPTdE6qsg8TNqr0DuOgfMrs8UcEnfp1uBpc=";
+    url = "https://download.electrum.org/${finalAttrs.version}/Electrum-${finalAttrs.version}.tar.gz";
+    hash = "sha256-z14bzs81eJNTMSWSBLTyCmsljDNztG54SVkoTcSqvsM=";
   };
 
   build-system = with python3.pkgs; [
@@ -36,7 +35,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    protobuf
     python3.pkgs.pythonRelaxDepsHook
   ]
   ++ lib.optionals enableQt [
@@ -101,11 +99,7 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_qml_types.py"
   ];
 
-  postPatch = ''
-    # Upstream tarball omits regenerated protobuf bindings in some releases.
-    protoc --python_out=. electrum/paymentrequest.proto
-  ''
-  + (
+  postPatch =
     if enableQt then
       ''
         substituteInPlace ./electrum/qrscanner.py \
@@ -114,8 +108,7 @@ python3.pkgs.buildPythonApplication rec {
     else
       ''
         sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
-      ''
-  );
+      '';
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $out/share/applications/electrum.desktop \
@@ -175,4 +168,4 @@ python3.pkgs.buildPythonApplication rec {
     ];
     mainProgram = "electrum";
   };
-}
+})
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index 005f177374f4..7000d9505809 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.9";
+  version = "3.15.10";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-dZ2bXouzjX0rw9NoUJjtF4KzTuZVdHm2ik6puiOg2Tc=";
+    hash = "sha256-c0sbFd19cDGm7VJbbfT+FKzUbeyAO1kCgh1eYV11C3I=";
   };
 
   vendorHash = "sha256-GanQBm/g+PcMHaXA5gAaqacpOuv6kES6ng/CmH8/0j4=";
diff --git a/pkgs/build-support/coq/default.nix b/pkgs/build-support/coq/default.nix
index 33305b6dd1a0..3c9670f4f65e 100644
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@@ -98,6 +98,7 @@ let
       "dropAttrs"
       "dropDerivationAttrs"
       "keepAttrs"
+      "env"
     ]
     ++ dropAttrs
   ) keepAttrs;
@@ -162,8 +163,8 @@ let
     "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
   ];
   docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
+  COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
 in
-
 stdenv.mkDerivation (
   removeAttrs (
     {
@@ -187,6 +188,15 @@ stdenv.mkDerivation (
         args.overrideBuildInputs or ([ coq ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
       inherit enableParallelBuilding;
 
+      env =
+        optionalAttrs setCOQBIN {
+          COQBIN = "${coq}/bin/";
+        }
+        // optionalAttrs (args ? useMelquiondRemake) {
+          inherit COQUSERCONTRIB;
+        }
+        // (args.env or { });
+
       meta =
         (
           {
@@ -208,7 +218,6 @@ stdenv.mkDerivation (
         // (args.meta or { });
 
     }
-    // (optionalAttrs setCOQBIN { COQBIN = "${coq}/bin/"; })
     // (optionalAttrs (!args ? installPhase && !args ? useMelquiondRemake) {
       installFlags = coqlib-flags ++ docdir-flags ++ extraInstallFlags;
     })
@@ -226,8 +235,7 @@ stdenv.mkDerivation (
         runHook postInstall
       '';
     })
-    // (optionalAttrs (args ? useMelquiondRemake) rec {
-      COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
+    // (optionalAttrs (args ? useMelquiondRemake) {
       preConfigurePhases = [ "autoconf" ];
       configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
       buildPhase = "./remake -j$NIX_BUILD_CORES";
diff --git a/pkgs/build-support/rocq/default.nix b/pkgs/build-support/rocq/default.nix
index a6b751a53b23..7a7c5fba7b25 100644
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -98,6 +98,7 @@ let
       "dropAttrs"
       "dropDerivationAttrs"
       "keepAttrs"
+      "env"
     ]
     ++ dropAttrs
   ) keepAttrs;
@@ -162,6 +163,7 @@ let
     "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
   ];
   docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${rocq-core.rocq-version}/user-contrib" ];
+  COQUSERCONTRIB = "$out/lib/coq/${rocq-core.rocq-version}/user-contrib";
 in
 
 stdenv.mkDerivation (
@@ -187,6 +189,15 @@ stdenv.mkDerivation (
         args.overrideBuildInputs or ([ rocq-core ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
       inherit enableParallelBuilding;
 
+      env =
+        optionalAttrs setROCQBIN {
+          ROCQBIN = "${rocq-core}/bin/";
+        }
+        // optionalAttrs (args ? useMelquiondRemake) {
+          inherit COQUSERCONTRIB;
+        }
+        // (args.env or { });
+
       meta =
         (
           {
@@ -208,7 +219,6 @@ stdenv.mkDerivation (
         // (args.meta or { });
 
     }
-    // (optionalAttrs setROCQBIN { ROCQBIN = "${rocq-core}/bin/"; })
     // (optionalAttrs (!args ? installPhase && !args ? useMelquiondRemake) {
       installFlags = rocqlib-flags ++ docdir-flags ++ extraInstallFlags;
     })
@@ -226,8 +236,7 @@ stdenv.mkDerivation (
         runHook postInstall
       '';
     })
-    // (optionalAttrs (args ? useMelquiondRemake) rec {
-      COQUSERCONTRIB = "$out/lib/coq/${rocq-core.rocq-version}/user-contrib";
+    // (optionalAttrs (args ? useMelquiondRemake) {
       preConfigurePhases = [ "autoconf" ];
       configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
       buildPhase = "./remake -j$NIX_BUILD_CORES";
diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index 03e840cd3223..7cf5a8c46657 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "9.2.0";
+  version = "9.2.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-28v36+sbgt/xaE8N7w4o0WTMYd95QsW190VPhOgL3+8=";
+    hash = "sha256-gBlS5co1LUu07Xz+JZWi4zNOPtPHGfl+StpFPauOFG4=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];
diff --git a/pkgs/by-name/an/anydesk/pin.json b/pkgs/by-name/an/anydesk/pin.json
index 5c5c41eb883e..943ff7bee6d9 100644
--- a/pkgs/by-name/an/anydesk/pin.json
+++ b/pkgs/by-name/an/anydesk/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "8.0.3",
-  "x86_64-linux": "sha256-Mjl17hh5A/pwRAi7giL1SJYlQ61O0SXX+KeH8STZ4bs=",
-  "aarch64-linux": "sha256-MhAj5cy81uBMoNeFPvOyhBOlJzBgNRHXyCXrpdvF8nE="
+  "version": "8.0.4",
+  "x86_64-linux": "sha256-fg3sLcushu5zDvsBakHLP/FRqhvauICx86rlpK4YkW8=",
+  "aarch64-linux": "sha256-TFV1VQdFIlGYIf4iYtAw42cVkaiWvsdCcSjdS/qugX0="
 }
diff --git a/pkgs/by-name/as/asdf-vm/package.nix b/pkgs/by-name/as/asdf-vm/package.nix
index f50ad776b394..59e5688f9162 100644
--- a/pkgs/by-name/as/asdf-vm/package.nix
+++ b/pkgs/by-name/as/asdf-vm/package.nix
@@ -8,18 +8,18 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "asdf-vm";
-  version = "0.18.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "asdf-vm";
     repo = "asdf";
 
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nc9fsahzOKlGtg1oA/0hnBUEkQ0BPeDWyPpl3KoDjqA=";
+    hash = "sha256-WUHNr9AaCOYh0mZS5zZqWwuq8uw6bgGtj5mPgIvNGUE=";
 
   };
 
-  vendorHash = "sha256-ru0/VvtoUMw9beycgh+TOO/FN2kqszynT4I4iDuS1Lo=";
+  vendorHash = "sha256-RSKenTwSgseEpvT6K36kWRfmIMPymYEGOTPcEHU7o2E=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/br/brutus/package.nix b/pkgs/by-name/br/brutus/package.nix
index ae79c20a6525..cb47e2affa73 100644
--- a/pkgs/by-name/br/brutus/package.nix
+++ b/pkgs/by-name/br/brutus/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "brutus";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "brutus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kb5+ue83YEHUG6Ezi7e7WmljHUPRXXD7/bT2ypTZVg4=";
+    hash = "sha256-iZ0oUYlrcPxPGuJvHXqHX+R4dXKS7pLgZgNhBuBVWtc=";
   };
 
   vendorHash = "sha256-XpwwFz8PfyTksLD0SomC5BE0tzUL9D/qtBSed4mrsXQ=";
diff --git a/pkgs/by-name/ce/certspotter/package.nix b/pkgs/by-name/ce/certspotter/package.nix
index 369b70cc1886..f9da2caba12a 100644
--- a/pkgs/by-name/ce/certspotter/package.nix
+++ b/pkgs/by-name/ce/certspotter/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "certspotter";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "SSLMate";
     repo = "certspotter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yV0IiTHGEMsdTafrw/juu/vsCq/Ofoxik7vS2huwIKw=";
+    hash = "sha256-0GwESNuwvwC3HgNy+1dXxgGshlj5sFCnPj25TnDXbFw=";
   };
 
   vendorHash = "sha256-JA/HZrbeauCD0TA2Egy49nYWXHqVRkOs9OmgaAR1z/c=";
diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index a32cc8bb88ea..81d9f1a9c08a 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudfoundry-cli";
-  version = "8.18.3";
+  version = "8.18.4";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-0+osaSI+qOBGMbkVBvoT69qbXLZLHHOs6ML3kx6OIMQ=";
+    sha256 = "sha256-qbNRferh8AEo3Y7zCgaQKQ1IZHSbhDYzy7OqZahiBfA=";
   };
-  vendorHash = "sha256-8ozKd8kT+QDgk1t86AIdlRObZPooO77mEFGKcpGCy3s=";
+  vendorHash = "sha256-zkv7ZuEKp6Nlw1NQqr0A6HX4Jx/yFR4wpo7tyD6VoXY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/du/dutctl/package.nix b/pkgs/by-name/du/dutctl/package.nix
index dfaf7fadd47a..e1359750f38d 100644
--- a/pkgs/by-name/du/dutctl/package.nix
+++ b/pkgs/by-name/du/dutctl/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dutctl";
-  version = "1.0.0-alpha.1-unstable-2026-06-25";
+  version = "1.0.0-alpha.1-unstable-2026-07-05";
 
   src = fetchFromGitHub {
     owner = "BlindspotSoftware";
     repo = "dutctl";
-    rev = "9f57498b4ebf99cc1960015832986f059673020b";
-    hash = "sha256-Xif0qngaMtje67QTvLANlfMAuQZNVJMDGtnDAwznyO8=";
+    rev = "1ee4c9baee1b088154fd3b94cf1023ef88f8cd0a";
+    hash = "sha256-45C4ktDKiz4wkisKTSUCqlR5n5TI13IYPKAbsj5bekY=";
   };
 
-  vendorHash = "sha256-6ne0gvVbdb4OIQmc0nHa7I4ms4gb0CXO8c1GuFqmefc=";
+  vendorHash = "sha256-RJviv/FMfU6COdwUcsQb13cETAVOINYEGZNv5y4tKD0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ea/easyeffects/package.nix b/pkgs/by-name/ea/easyeffects/package.nix
index 59527ac76503..eeace37ecfb3 100644
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -61,13 +61,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easyeffects";
-  version = "8.2.5";
+  version = "8.2.7";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VyfLoQPBZAXurS1/HxTLNioo/OT1LsQLZZXu9kDeP5Y=";
+    hash = "sha256-YYwVoqCRVAZVu8vCTN3ZSicy1Fzw3l+hQbooGAE/AEI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index 59b024995149..0c7ece0dba16 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -38,7 +38,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freefilesync";
-  version = "14.9";
+  version = "14.10";
 
   src = fetchurl {
     url = "https://freefilesync.org/download/FreeFileSync_${finalAttrs.version}_Source.zip";
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       rm -f "$out"
       tryDownload "$url" "$out"
     '';
-    hash = "sha256-TY41DJIvp7CNR8U12q2YUhiyHZuL9FcfLTVDQWTIfQA=";
+    hash = "sha256-tjyJ4+sc4nZxP7NQnBlISODsqDHKSKfpw8P8RixZj80=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/go/gopher64/package.nix b/pkgs/by-name/go/gopher64/package.nix
index 023bdd0b0f95..abb9740accc7 100644
--- a/pkgs/by-name/go/gopher64/package.nix
+++ b/pkgs/by-name/go/gopher64/package.nix
@@ -56,6 +56,12 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
 
   cargoHash = "sha256-rmt2b8lk/9ts8v33yguuSFcbFvUX00icg1onmhCbDTQ=";
 
+  # don't use lld on aarch64-linux
+  postPatch = ''
+    substituteInPlace .cargo/config.toml \
+      --replace-fail 'rustflags = ["-C", "link-arg=-fuse-ld=lld"]' ""
+  '';
+
   env = {
     # See pkgs/by-name/ne/neovide/package.nix
     SKIA_SOURCE_DIR =
diff --git a/pkgs/by-name/he/headscale/package.nix b/pkgs/by-name/he/headscale/package.nix
index 6eb54176001a..95c7c9e616d5 100644
--- a/pkgs/by-name/he/headscale/package.nix
+++ b/pkgs/by-name/he/headscale/package.nix
@@ -11,13 +11,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "headscale";
-  version = "0.28.0";
+  version = "0.29.2";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gR5kOFv4/+87mOhMYjejBMhZlrwYhABZpG0zjIL5vtI=";
+    hash = "sha256-zQ3dmb96fLhFwZjZUiifI73F+CRvDz6aiVafHaTuU/c=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
       --replace-fail 'Commit:    "unknown"' 'Commit: "${finalAttrs.src.tag}"'
   '';
 
-  vendorHash = "sha256-jkeB9XUTEGt58fPOMpE4/e3+JQoMQTgf0RlthVBmfG0=";
+  vendorHash = "sha256-fzKyXNMw/2yAEhaTZu0n1NXatPO2IP0HFA2ey1vZIYM=";
 
   subPackages = [ "cmd/headscale" ];
 
@@ -76,6 +76,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       kradalby
       misterio77
+      debtquity
     ];
   };
 })
diff --git a/pkgs/by-name/he/heimdall-proxy/package.nix b/pkgs/by-name/he/heimdall-proxy/package.nix
index 5420bd567024..6e39ce56f0d2 100644
--- a/pkgs/by-name/he/heimdall-proxy/package.nix
+++ b/pkgs/by-name/he/heimdall-proxy/package.nix
@@ -4,7 +4,7 @@
   lib,
 }:
 let
-  version = "0.17.16";
+  version = "0.17.17";
 in
 buildGoModule {
   pname = "heimdall-proxy";
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "dadrus";
     repo = "heimdall";
     tag = "v${version}";
-    hash = "sha256-M1aaY32ykfzKGkH1D8U8yBeEPEM20IWuJHUiHIj9IPE=";
+    hash = "sha256-LRanZw1LCt1ICrQcnxFHHr89ryT6GdkO/xwkd7rlPTI=";
   };
 
-  vendorHash = "sha256-ZNKNsiiCHlEp5JVVwHTvQLgxBNWIFAgI8vpYGOCb0RY=";
+  vendorHash = "sha256-efDG99grxfm+uIHVzYK0O/51NsaIk70E2LO2fjJ8Hxs=";
 
   tags = [ "sqlite" ];
 
diff --git a/pkgs/by-name/je/jellyfin-desktop/package.nix b/pkgs/by-name/je/jellyfin-desktop/package.nix
index 0c62dc24ed2d..4a2c0f1251aa 100644
--- a/pkgs/by-name/je/jellyfin-desktop/package.nix
+++ b/pkgs/by-name/je/jellyfin-desktop/package.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
   qtWrapperArgs = [
     "--set QT_STYLE_OVERRIDE Fusion"
     "--set NIX_SSL_CERT_FILE ${cacert}/etc/ssl/certs/ca-bundle.crt"
+    # Disable hardware acceleration to fix severe flickering in video playback.
+    "--set-default QTWEBENGINE_FORCE_USE_GBM 0"
   ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index b28209fc08ab..869a75a62a25 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.530";
+  version = "0.0.531";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-pfa/337lqSXVu6nGhv4deXXiqSo5eojWXESk6+Y/DN8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HlCyUwGwc261p2e4DK8J0VEN5EIO1UpbnxQ5f6oxaSs=";
   };
 
   vendorHash = "sha256-joxaA0x1Ldn82O5k+H9A1rsirBkfpOw+83E4GHCwKb8=";
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 109883fc5e67..f0482f3ad3e3 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.12.3";
+    version = "0.12.4";
 
     __structuredAttrs = true;
 
@@ -112,7 +112,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-JjDU3GZf+wvsMyDjIfu1btTUBkOlpp6E1HFLqBLR9po=";
+      hash = "sha256-KSLFsrnoEOV712cnUtA8s4EoISp+ON36jslKxSvDthQ=";
     };
 
     strictDeps = true;
diff --git a/pkgs/by-name/no/nova-password/package.nix b/pkgs/by-name/no/nova-password/package.nix
index 7684b270ee00..edf02bcf0117 100644
--- a/pkgs/by-name/no/nova-password/package.nix
+++ b/pkgs/by-name/no/nova-password/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nova-password";
-  version = "0.5.10";
+  version = "0.5.11";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = "nova-password";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-73o/dSS/cmLnie4Rbc3FOzRS2clw17GI7gk2nW1u3/I=";
+    hash = "sha256-qWpZChgND4M4x1L0/38DSeJyJ0jKkDttzfWzAukROgo=";
   };
 
-  vendorHash = "sha256-8eBS4kczObQZksK/bS/guv8nBNY0DInJ4Dk1Hlr2B7A=";
+  vendorHash = "sha256-s0Abw8lCL3hzil+m/K6CZqVNycnP669Uhv4l4nkMSfc=";
 
   meta = {
     description = "Decrypt the admin password generated for the VM in OpenStack";
diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index 30720ee27663..e29430a782c4 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nuclei";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AS+LL8EUGEH1KDB76IGRV7WYSdHG2Gs8iB2nW/oxPlI=";
+    hash = "sha256-1cEOdL/SKoG4wVt5sYOXHAbO5Id+OpV4FdPjA5Apc8c=";
   };
 
-  vendorHash = "sha256-SIt+OgxHYjK3X6rJbyaMwZVkNJPRKVkmvMzzCKHFx28=";
+  vendorHash = "sha256-CKb1RUk3Qdmj6umXBWfoQSaqIwNMbcia5XeO08xNCa4=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
diff --git a/pkgs/by-name/nv/nvs/package.nix b/pkgs/by-name/nv/nvs/package.nix
index c6b507222363..da7c8a0b2be9 100644
--- a/pkgs/by-name/nv/nvs/package.nix
+++ b/pkgs/by-name/nv/nvs/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nvs";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "y3owk1n";
     repo = "nvs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cQTcaFEu94BYfJ4vbensbbEpOFWEQXfwIbajSnp9+0A=";
+    hash = "sha256-Mz5ScSWC0vAavWS2ZKn58b+k4IxlMLxhaxI1B9v76jg=";
   };
 
   vendorHash = "sha256-KQVszK0LLMvi+5aWUVmTTGdUsqJrTWRLe2meb2qV2G0=";
diff --git a/pkgs/by-name/op/openclaw/package.nix b/pkgs/by-name/op/openclaw/package.nix
index 2daf7fb4c817..304026eaf6fb 100644
--- a/pkgs/by-name/op/openclaw/package.nix
+++ b/pkgs/by-name/op/openclaw/package.nix
@@ -11,7 +11,7 @@
   versionCheckHook,
   rolldown,
   installShellFiles,
-  version ? "2026.6.5",
+  version ? "2026.6.11",
 }:
 let
   pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_22; };
@@ -24,10 +24,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "openclaw";
     repo = "openclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hiYbIhE13XMFIeB0zmb6AHlfw8le6vpJgCqN81YWGsE=";
+    hash = "sha256-Ryj+aJ4Daql/ILs3Z/Gi+ltBGQfOdtXKJoOqr3YNoQ0=";
   };
 
-  pnpmDepsHash = "sha256-7RQJAVWqhauG8JrF8AD1VU1IJRM+SH05aHAfmFaXraU=";
+  pnpmDepsHash = "sha256-WvMphvtdimFXIx6kTQ5DMW9dcXS1tcFu2v3W1aiiW+4=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
diff --git a/pkgs/by-name/qr/qrcode/package.nix b/pkgs/by-name/qr/qrcode/package.nix
index e434447b055a..af015347b069 100644
--- a/pkgs/by-name/qr/qrcode/package.nix
+++ b/pkgs/by-name/qr/qrcode/package.nix
@@ -3,9 +3,10 @@
   stdenv,
   fetchFromGitHub,
   unstableGitUpdater,
+  testers,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qrcode";
   version = "0-unstable-2025-04-29";
 
@@ -16,25 +17,38 @@ stdenv.mkDerivation {
     hash = "sha256-WQeZB8G9Nm68mYmLr0ksZdFDcQxF54X0yJxigJZWvMo=";
   };
 
+  strictDeps = true;
+  enableParallelBuilding = true;
+
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
+  # Upstream Makefile has no install target.
   installPhase = ''
-    mkdir -p "$out"/{bin,share/doc/qrcode}
-    cp qrcode "$out/bin"
-    cp DOCUMENTATION LICENCE "$out/share/doc/qrcode"
+    runHook preInstall
+    install -Dm755 qrcode -t "$out/bin"
+    install -Dm644 DOCUMENTATION LICENCE -t "$out/share/doc/qrcode"
+    runHook postInstall
   '';
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      # Upstream exits non-zero even on successful -V.
+      command = "{ qrcode -V || true; }";
+      version = "0.1";
+    };
+  };
 
   meta = {
-    description = "Small QR-code tool";
+    description = "QR-code encoder and decoder";
     homepage = "https://github.com/qsantos/qrcode";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       raskin
       lucasew
     ];
-    platforms = with lib.platforms; unix;
+    platforms = lib.platforms.unix;
     mainProgram = "qrcode";
   };
-}
+})
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index fd2b5d4818d2..d8dd8722f7aa 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.36.3";
+  version = "3.37.1";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qb93KrBzoAe6Kt9GPH3jZ3jnBOnWxrY+d9FmYz5RM/c=";
+    hash = "sha256-onBKpybQaiEQwvI+/hliztu5QgmaE6/oMTMdG3alQ7E=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sb/sbomnix/package.nix b/pkgs/by-name/sb/sbomnix/package.nix
index 0e1560768102..6220091fb1bf 100644
--- a/pkgs/by-name/sb/sbomnix/package.nix
+++ b/pkgs/by-name/sb/sbomnix/package.nix
@@ -4,7 +4,6 @@
   git,
   grype,
   nix,
-  nixVersions,
   nix-visualize,
   python3,
   vulnix,
@@ -31,9 +30,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "--prefix PATH : ${
       lib.makeBinPath [
         git
-        # nix
-        # TODO: remove once sbomnix support new JSON format: https://github.com/tiiuae/sbomnix/issues/267
-        nixVersions.nix_2_31
+        nix
         python3.pkgs.graphviz
         nix-visualize
         vulnix
diff --git a/pkgs/by-name/sc/schemacrawler/package.nix b/pkgs/by-name/sc/schemacrawler/package.nix
index b552e4c9a967..9e150843f327 100644
--- a/pkgs/by-name/sc/schemacrawler/package.nix
+++ b/pkgs/by-name/sc/schemacrawler/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "schemacrawler";
-  version = "17.11.3";
+  version = "17.11.4";
 
   src = fetchzip {
     url = "https://github.com/schemacrawler/SchemaCrawler/releases/download/v${finalAttrs.version}/schemacrawler-${finalAttrs.version}-bin.zip";
-    hash = "sha256-8xE8mGLMtU90wJtCVMTf0kstFnh2Bxr9Ld2PkiUpQuw=";
+    hash = "sha256-BiTGq5tGQZTglSQlssdHw7AuawwNdO1qNDPvYHLb2aw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/st/stalwart-vandelay/package.nix b/pkgs/by-name/st/stalwart-vandelay/package.nix
index e3ff46155964..7b9e4fc45efa 100644
--- a/pkgs/by-name/st/stalwart-vandelay/package.nix
+++ b/pkgs/by-name/st/stalwart-vandelay/package.nix
@@ -8,14 +8,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vandelay";
-  version = "1.0.4";
+  version = "1.0.5";
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "vandelay";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5ByuCsKi0fFHwSWsYgjJcVo072buHiCFKHodAdF6Mrw=";
+    hash = "sha256-ePOh2lJWJvZ5sV8KQ4n9A5pV7UhDBkN+RQ37LLoMm+o=";
   };
-  cargoHash = "sha256-BI5O55KeHhQ9dFjLkRX4cK7DWaPJx6/NYH/F6IXec7E=";
+  cargoHash = "sha256-KlAarYv8Vzp0bpR2jhC4bG0iVyG5YPGvsa8GHRsscJg=";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
   # called `Result::unwrap()` on an `Err` value: Tls("rustls platform verifier: unexpected error: No CA certificates were loaded from the system")
diff --git a/pkgs/by-name/su/supercronic/package.nix b/pkgs/by-name/su/supercronic/package.nix
index 95eec57bb9ed..5c76bf3f13e5 100644
--- a/pkgs/by-name/su/supercronic/package.nix
+++ b/pkgs/by-name/su/supercronic/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "supercronic";
-  version = "0.2.46";
+  version = "0.2.47";
 
   src = fetchFromGitHub {
     owner = "aptible";
     repo = "supercronic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gjfQQcp7hKjkK7hQ922jgxizqu1l5aPbgna6ciovaiA=";
+    hash = "sha256-/TPU5Qynfmz0MD0ulWb8EGLF9XjPTZdZjcRNeGtRoSY=";
   };
 
-  vendorHash = "sha256-n22rFA4M4QBpZGTF9FVuqCEWTBZvof8Df1ZmTilbWjI=";
+  vendorHash = "sha256-fkq6ow5sxzX26cR6mmGnb+xhwFl82VkW9zdVIkgX/ZE=";
 
   excludedPackages = [ "cronexpr/cronexpr" ];
 
diff --git a/pkgs/by-name/tf/tfupdate/package.nix b/pkgs/by-name/tf/tfupdate/package.nix
index 39979df903c6..aaa1a2d6cfbb 100644
--- a/pkgs/by-name/tf/tfupdate/package.nix
+++ b/pkgs/by-name/tf/tfupdate/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tfupdate";
-  version = "0.9.4";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfupdate";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-r5z7xR/Dq4opmOHUzYRzcFqdiCFiYIhNeeuL1532Ht8=";
+    sha256 = "sha256-aS+0piQbV4Lh5vJzzgpxQ3uoK9ENP1j4KpuMW+XosA4=";
   };
 
   vendorHash = "sha256-0odAvB2VqYZnPu4wlXpPeR2ioEq3WOGyvpRm72/GWsg=";
diff --git a/pkgs/by-name/th/thruster/package.nix b/pkgs/by-name/th/thruster/package.nix
index d62b200a099c..8a17723640d7 100644
--- a/pkgs/by-name/th/thruster/package.nix
+++ b/pkgs/by-name/th/thruster/package.nix
@@ -7,16 +7,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "thruster";
-  version = "0.1.21";
+  version = "0.1.22";
 
   src = fetchFromGitHub {
     owner = "basecamp";
     repo = "thruster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gFYVbvcXpy03rddB3MbYeT6V1Iex2TtdpC2VeUhO6vo=";
+    hash = "sha256-d+zdzzT+47y9WOFARlQ/wCrc9tnyS/4HsE0a6aQl/KA=";
   };
 
-  vendorHash = "sha256-i5u1quR5V0ceFwRDW0Vym+9/dFUwzp9Wc1JrM0KGgY8=";
+  vendorHash = "sha256-veXgGs6+TauExVAaNnkIZwylQWZ4um3rrG8of/dYCv0=";
 
   subPackages = [ "cmd/thrust" ];
 
diff --git a/pkgs/by-name/tr/tradingview/package.nix b/pkgs/by-name/tr/tradingview/package.nix
index 654d37ab94dc..577b894661dd 100644
--- a/pkgs/by-name/tr/tradingview/package.nix
+++ b/pkgs/by-name/tr/tradingview/package.nix
@@ -26,12 +26,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tradingview";
-  version = "2.14.0";
-  revision = "68";
+  version = "3.2.0";
+  revision = "71";
 
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/nJdITJ6ZJxdvfu8Ch7n5kH5P99ClzBYV_${finalAttrs.revision}.snap";
-    hash = "sha512-wuMQBfJfMbQdq4eUNl9bitf4IGcpczX0FDdnQAgyALBpHI7CbcIF9Aq4hIy0dblYgeISM1HFqPiSIcFCS+VuSQ==";
+    hash = "sha512-hT4U+RGqZ4OliAiLqWKkuv/OxeOpKHmFY0/ia9V7MZz1ZhogIaCLUUXXCmlfX1zhQDA1Xrw1uiwl/aeijgdq7g==";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 601293797c4e..d592ee94167e 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1543,7 +1543,7 @@
   };
 
   lua = {
-    version = "0.0.19-unstable-2026-02-26";
+    version = "0.5.0-unstable-2026-02-26";
     url = "github:tree-sitter-grammars/tree-sitter-lua";
     rev = "10fe0054734eec83049514ea2e718b2a56acd0c9";
     hash = "sha256-VzaaN5pj7jMAb/u1fyyH6XmLI+yJpsTlkwpLReTlFNY=";
@@ -1579,7 +1579,7 @@
   };
 
   make = {
-    version = "0-unstable-2026-02-26";
+    version = "1.1.1-unstable-2026-02-26";
     url = "github:tree-sitter-grammars/tree-sitter-make";
     rev = "70613f3d812cbabbd7f38d104d60a409c4008b43";
     hash = "sha256-gyshhqVYiL0qSsMp38BM20FYc4uPgr2de5/DWsAJZGc=";
@@ -2791,7 +2791,7 @@
   };
 
   toml = {
-    version = "0.5.1-unstable-2024-12-03";
+    version = "0.7.0-unstable-2024-12-03";
     url = "github:tree-sitter-grammars/tree-sitter-toml";
     rev = "64b56832c2cffe41758f28e05c756a3a98d16f41";
     hash = "sha256-m9RlGkHiOL/PNENrdEPqtPlahSqGymsx7gZrCoN/Lsk=";
@@ -2992,7 +2992,7 @@
   };
 
   vim = {
-    version = "0.2.0-unstable-2026-02-26";
+    version = "0.8.1-unstable-2026-02-26";
     url = "github:tree-sitter-grammars/tree-sitter-vim";
     rev = "3092fcd99eb87bbd0fc434aa03650ba58bd5b43b";
     hash = "sha256-MnLBFuJCJbetcS07fG5fkCwHtf/EcNP+Syf0Gn0K39c=";
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index fd0dc8d39cfe..45746fc8744e 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -21,23 +21,23 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.22.0";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f1d88cdqe1PfeuzY90JIRCoHKLV1Uuakc4TpSNvNBKA=";
+    hash = "sha256-1c6rl+PMI61l3H2a8Ks1qbFGW2psHs0FamJd/Vzq6NY=";
   };
 
   apiDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/src/typescript/api";
-    hash = "sha256-Ki/l3PiBY3R0Bzd6leqx2OxA7c+jckjr+YD4GHHaSqI=";
+    hash = "sha256-Im8fSG9sbaSynrN5gLsWVaPgH5g4Zp+x+FUPIBXrKjg=";
   };
 
   extensionManagerDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/src/typescript/extension-manager";
-    hash = "sha256-6Kz7I8cGm1lnGPOI/gju3t5/imnbBFlDEKzWar5O770=";
+    hash = "sha256-pEgqFgvdz7Bcc+LznCI+KlD1XEfUuWFWjS24MJ7sx3k=";
   };
 
   cmakeFlags = lib.mapAttrsToList lib.cmakeFeature {
diff --git a/pkgs/by-name/wa/warmup-s3-archives/package.nix b/pkgs/by-name/wa/warmup-s3-archives/package.nix
index cde22e2238e2..c3f720666d18 100644
--- a/pkgs/by-name/wa/warmup-s3-archives/package.nix
+++ b/pkgs/by-name/wa/warmup-s3-archives/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "warmup-s3-archives";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     owner = "philipmw";
     repo = "warmup-s3-archives";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AI/PD7Kkzzg5IqBy0uRM1QG7+pzhjECo+ad2I0pUkKo=";
+    hash = "sha256-B/8OSqKA3tJhjdShiqAqJrTOc8OuSBLfZ1U9xvvP6vQ=";
   };
 
-  cargoHash = "sha256-2LOJ+f6SIkzPM+ucWU+7COUwo2Pvti7hL8k0+ry29SM=";
+  cargoHash = "sha256-31p6IfX5VFSz4tNrjgFigsuTsPA3iO6m3QV6KOb2GKQ=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/wd/wdt/package.nix b/pkgs/by-name/wd/wdt/package.nix
index d1081635faf5..1b09cd9fbf12 100644
--- a/pkgs/by-name/wd/wdt/package.nix
+++ b/pkgs/by-name/wd/wdt/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation {
   pname = "wdt";
-  version = "1.27.1612021-unstable-2026-06-09";
+  version = "1.27.1612021-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "wdt";
-    rev = "b3e21d71b2223fcecba58436f81a0ba7a56a6d6a";
-    hash = "sha256-H7/WJV5rvgdjwFAV2FCAbmkdsqO45LsDAfCroFbxTU4=";
+    rev = "ee01f20850558d5c6a0e1fc3cf9d12cd1702c18a";
+    hash = "sha256-YReA7lBSeWRZHpF4E7yY6HuabRUOT6Aipk9dgjlTuik=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/we/weaviate/package.nix b/pkgs/by-name/we/weaviate/package.nix
index dd982b682e41..ef498972eeaf 100644
--- a/pkgs/by-name/we/weaviate/package.nix
+++ b/pkgs/by-name/we/weaviate/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "weaviate";
-  version = "1.38.0";
+  version = "1.38.2";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dYApKcDW8Cs/T3uszohy0PQqKar9lkiNBMY0mnPr5xs=";
+    hash = "sha256-qWb1jTC3pmyK7WZ/mw5aF3spXL130WCKglYEoJVmsO8=";
   };
 
-  vendorHash = "sha256-1uOPet4HywajcPbZuT2ePRUrcT9mwNx0n2vFUkxUn6s=";
+  vendorHash = "sha256-+I7yxIql/ttC7zTcK870GX52LDfSbfCZvDW+eeCYnB0=";
 
   subPackages = [ "cmd/weaviate-server" ];
 
diff --git a/pkgs/by-name/ze/zeroclaw/package.nix b/pkgs/by-name/ze/zeroclaw/package.nix
index 4f4b16fe7ecc..f3931d524f9c 100644
--- a/pkgs/by-name/ze/zeroclaw/package.nix
+++ b/pkgs/by-name/ze/zeroclaw/package.nix
@@ -1,8 +1,10 @@
 {
   lib,
-  callPackage,
   rustPlatform,
   fetchFromGitHub,
+  fetchNpmDeps,
+  npmHooks,
+  nodejs,
   pkg-config,
   protobuf,
   sqlite,
@@ -11,38 +13,55 @@
   versionCheckHook,
   nix-update-script,
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeroclaw";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "zeroclaw-labs";
     repo = "zeroclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dB/M5QdAyql/WXxwkX9V/bkiRsAv0J+tIbQN0wKLJpM=";
+    hash = "sha256-mTH7DRaCHmYw3m9DguceP+nGGMYff7vsoIe3J0XNb/Q=";
   };
 
-  postPatch =
-    let
-      zeroclaw-web = callPackage ./zeroclaw-web { inherit (finalAttrs) src version; };
-    in
-    ''
-      mkdir -p web
-      ln -s ${zeroclaw-web} web/dist
-    '';
+  cargoHash = "sha256-6tLLt8cblYABOTli1LrrWbyTOJYGmmewHJgTxBAhJlE=";
 
-  cargoHash = "sha256-ZBmz877jEkTGopa5QxNUguxxKO45aZ6K5GXXAv4Ii4s=";
+  npmDeps = fetchNpmDeps {
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/web";
+    hash = "sha256-SKltlDJm39ZzVaEt1bbnoiXy+wlbq+fC3bO4mW5V15o=";
+  };
+  npmRoot = "web";
+
+  postPatch = ''
+    # build.rs runs `npm ci && npm run build` during compilation,
+    # skip and handle it ourselves in postBuild
+    substituteInPlace crates/zeroclaw-gateway/build.rs \
+      --replace-fail 'build_web_dashboard();' '// dashboard built via postBuild'
+
+    # upstream hardcodes a Debian cross toolchain name that doesn't exist in the Nix sandbox
+    substituteInPlace .cargo/config.toml \
+      --replace-fail 'linker = "aarch64-linux-gnu-gcc"' ""
+  '';
 
   nativeBuildInputs = [
     pkg-config
     protobuf
+    nodejs
+    npmHooks.npmConfigHook
   ];
 
   buildInputs = [
     sqlite
   ];
 
+  postBuild = ''
+    cargo run --frozen --release --package xtask --bin web -- gen-api
+    pushd web
+    npm run build
+    popd
+  '';
+
   nativeCheckInputs = [
     writableTmpDirAsHomeHook
     gitMinimal
@@ -55,19 +74,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=commands::update::tests::download_binary_verifies_checksum_before_writing"
     "--skip=tests::exchange_pairing_code_posts_code_and_returns_token"
     "--skip=tests::fetch_pairing_code_reads_gateway_pair_code_response"
+    "--skip=tests::gateway_addr_in_use_message_skips_occupied_restart_hint_port"
+    "--skip=tests::gateway_restart_hint_uses_gateway_bind_fallback_for_hostnames"
     "--skip=integration::telegram_attachment_fallback::"
     "--skip=integration::telegram_finalize_draft::"
   ];
 
   # The gateway serves the web dashboard from <binary_dir>/web/dist at runtime
-  postInstall =
-    let
-      zeroclaw-web = callPackage ./zeroclaw-web { inherit (finalAttrs) src version; };
-    in
-    ''
-      mkdir -p $out/bin/web
-      ln -s ${zeroclaw-web} $out/bin/web/dist
-    '';
+  postInstall = ''
+    mkdir -p $out/bin/web
+    cp -r web/dist $out/bin/web/dist
+  '';
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix b/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix
deleted file mode 100644
index 80e5eec334fd..000000000000
--- a/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  buildNpmPackage,
-  src,
-  version,
-  ...
-}:
-buildNpmPackage (finalAttrs: {
-  pname = "zeroclaw-web";
-  inherit src version;
-
-  sourceRoot = "${finalAttrs.src.name}/web";
-
-  npmDepsHash = "sha256-mwi93ZgXxb3xQnPPQHesR8YxQOxH8YaKBLGi/nEM8D4=";
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r dist $out
-
-    runHook postInstall
-  '';
-})
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index 927deb891416..483a7c3a80d4 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "1.2.5";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nyv+GAy+SeWbYrEfHLilgWGUqnVS0cUoOd4+4Ah8GeQ=";
+    hash = "sha256-7w6KLu5pauHfah+J9A+pa5mB3cbjNH4ADcc+Z5UPlmI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-Jsv/LDugP2Xp1zcCUvVmDHVkQNBoNlapMF3BRcWA3Q4=";
+  cargoHash = "sha256-2w0bLGvKq0VyQyMt911zFXA78cy5PYP7OgJAyxGVjUY=";
 
   nativeBuildInputs = [ cmake ];
 
@@ -29,6 +29,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTFLAGS = "--cfg tokio_unstable";
   };
 
+  checkFlags = [
+    # fails with NotPermitted inside the build sandbox
+    "--skip=zerofs_client_tests::metadata_operations"
+  ];
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/zi/zinit/package.nix b/pkgs/by-name/zi/zinit/package.nix
index a52156552a37..05b5ce1959e1 100644
--- a/pkgs/by-name/zi/zinit/package.nix
+++ b/pkgs/by-name/zi/zinit/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zinit";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "zdharma-continuum";
     repo = "zinit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cBMGmFrveBes30aCSLMBO8WrtoPZeMNjcEQoQEzBNvM=";
+    hash = "sha256-lVdia0iDGy7RDT3Ho4BBslwbng/NpsJWbbVBqgNccCg=";
   };
 
   outputs = [
diff --git a/pkgs/desktops/gnome-2/platform/libglade/default.nix b/pkgs/desktops/gnome-2/platform/libglade/default.nix
index 73a947414794..4287dc2bf946 100644
--- a/pkgs/desktops/gnome-2/platform/libglade/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libglade/default.nix
@@ -38,5 +38,5 @@ stdenv.mkDerivation rec {
       --replace "pkg-config" "$PKG_CONFIG"
   '';
 
-  NIX_LDFLAGS = "-lgmodule-2.0";
+  env.NIX_LDFLAGS = "-lgmodule-2.0";
 }
diff --git a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
index 3d6b8bc4188b..23dea04b6b0d 100644
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
@@ -74,13 +74,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-ui-toolkit";
-  version = "1.3.5906";
+  version = "1.3.5907";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-ui-toolkit";
     rev = finalAttrs.version;
-    hash = "sha256-OT3XH1NRnLHP80rgPllXfuos7vG3DHX95CXWm2fvwvI=";
+    hash = "sha256-hI04qw2r88862PB9sUJTiFi8ZM1iZ9rQXuoO9iEjViU=";
   };
 
   outputs = [
diff --git a/pkgs/development/compilers/ecl/default.nix b/pkgs/development/compilers/ecl/default.nix
index e1abbcf34c4c..14cc4f5b2466 100644
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -17,6 +17,7 @@
   threadSupport ? true,
   useBoehmgc ? false,
   boehmgc,
+  sbcl,
 }:
 
 let
@@ -80,6 +81,9 @@ stdenv.mkDerivation rec {
     }"
   '';
 
+  # ECL is used as a bootstrap compiler for SBCL.
+  passthru.tests.sbcl = sbcl;
+
   meta = {
     description = "Lisp implementation aiming to be small, fast and easy to embed";
     homepage = "https://common-lisp.net/project/ecl/";
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index bdff277120d0..d080d86e874f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -4903,6 +4903,42 @@ final: prev: {
     }
   ) { };
 
+  neotest-nix = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchurl,
+      fetchzip,
+      luaOlder,
+      neotest,
+      nvim-nio,
+    }:
+    buildLuarocksPackage {
+      pname = "neotest-nix";
+      version = "2.2.0-1";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/neotest-nix-2.2.0-1.rockspec";
+          sha256 = "07whvs4bwnlf4pf893r5y69246r9s3n1nypqgx5a1vlmmxinhx1v";
+        }).outPath;
+      src = fetchzip {
+        url = "https://github.com/khaneliman/neotest-nix/archive/61ba4c732ed5d685deb33b7f42963ff765752991.zip";
+        sha256 = "139fiir0q5s3b5vlchm1fyngz4mgz5hnbm1n1h7xk2w6yhrk43mc";
+      };
+
+      disabled = luaOlder "5.1";
+      propagatedBuildInputs = [
+        neotest
+        nvim-nio
+      ];
+
+      meta = {
+        homepage = "https://github.com/khaneliman/neotest-nix";
+        license = lib.licenses.mit;
+        description = "A Neotest adapter for Nix flakes.";
+      };
+    }
+  ) { };
+
   nginx-lua-prometheus = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/python-modules/aiocache/default.nix b/pkgs/development/python-modules/aiocache/default.nix
index c4af88bf2cbf..a5bfc179135c 100644
--- a/pkgs/development/python-modules/aiocache/default.nix
+++ b/pkgs/development/python-modules/aiocache/default.nix
@@ -77,6 +77,9 @@ buildPythonPackage rec {
 
     # TypeError: object MagicMock can't be used in 'await' expression
     "tests/ut/backends/test_redis.py::TestRedisBackend::test_close"
+
+    # flaky, see https://github.com/aio-libs/aiocache/issues/587
+    "tests/acceptance/test_lock.py::TestRedLock::test_locking_dogpile"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ale-py/default.nix b/pkgs/development/python-modules/ale-py/default.nix
index ec10c5decc26..3185b3d0057f 100644
--- a/pkgs/development/python-modules/ale-py/default.nix
+++ b/pkgs/development/python-modules/ale-py/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  config,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -17,6 +18,9 @@
   opencv,
   zlib,
 
+  # nativeBuildInputs
+  cudaPackages,
+
   # dependencies
   numpy,
 
@@ -39,6 +43,14 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-hFbreHk0i4h+JOyvDYcNX3TmwgvxNC5U0l5Xrqqz1zQ=";
   };
 
+  # disable lto on darwin, cmake cannot find llvm-ar
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/ale/CMakeLists.txt \
+      --replace-fail \
+        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION TRUE)' \
+        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION FALSE)'
+  '';
+
   build-system = [
     cmake
     ninja
@@ -49,13 +61,10 @@ buildPythonPackage (finalAttrs: {
     jax
   ];
 
-  # disable lto on darwin, cmake cannot find llvm-ar
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace src/ale/CMakeLists.txt \
-      --replace-fail \
-        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION TRUE)' \
-        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION FALSE)'
-  '';
+  nativeBuildInputs = lib.optionals config.cudaSupport [
+    # Required by opencv's cmake
+    cudaPackages.cuda_nvcc
+  ];
 
   dontUseCmakeConfigure = true;
 
@@ -102,7 +111,6 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTestPaths = [
-    #
     "tests/python/test_atari_vector_xla.py"
   ];
 
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 8462bb0f72dc..aa8f5dd55d12 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202607041";
+  version = "0.1.202607061";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X4RG1C5/ZPQCdekYfSWhsGTIzQkDsdVNThb0Dhnr8nY=";
+    hash = "sha256-IVJw7s3XvrYy1XlnKE9DMu5d39jWFKRiQTnqg5xANwM=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/internetarchive/default.nix b/pkgs/development/python-modules/internetarchive/default.nix
index 913fab612358..2db98133d285 100644
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "internetarchive";
-  version = "5.9.0";
+  version = "5.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jjjake";
     repo = "internetarchive";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K8JBDc0hbEIfxCihamfm4Vmt+QqmmJ02fyLOKRnKXmw=";
+    hash = "sha256-OVjvx7Ne2NLXl5eA1HP89HyoTttR9XAx2AJdXiWMkqY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index b7c7d6798901..730d26e74543 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -22,7 +22,11 @@
   openmpCheckPhaseHook,
 
   # Reverse dependency
+  astropy,
+  numba,
+  pandas,
   sage,
+  xarray,
 
   # tests
   hypothesis,
@@ -202,7 +206,17 @@ buildPythonPackage (finalAttrs: {
     coreIncludeInnerDir = "${python.sitePackages}/numpy/_core/include";
     coreIncludeDir = "${finalAttrs.finalPackage}/${finalAttrs.finalPackage.passthru.coreIncludeInnerDir}";
     tests = {
-      inherit sage;
+      # NOTE: It is important to check these central dependent packages when
+      # issuing Numpy PRs and especially version bumps (even minor version
+      # bumps) - evidently these have caused issues in staging-next in the
+      # past.
+      inherit
+        astropy
+        numba
+        pandas
+        sage
+        xarray
+        ;
     };
   };
 
diff --git a/pkgs/development/python-modules/pipcl/default.nix b/pkgs/development/python-modules/pipcl/default.nix
index 44a11dfafd3f..d32e93382386 100644
--- a/pkgs/development/python-modules/pipcl/default.nix
+++ b/pkgs/development/python-modules/pipcl/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pipcl";
-  version = "7";
+  version = "11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ArtifexSoftware";
     repo = "pipcl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z7tDWRxEsA0CREP2bjeNYkoS9pgpHL0Cr3wcCyMPIeg=";
+    hash = "sha256-Gefz+BUWojruztnb1zEJWqBNU3HzdPjl/pw9lce+R7Y=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index cfd7e8c72bd4..8ffb00e0f523 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plopp";
-  version = "26.6.0";
+  version = "26.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "plopp";
     tag = finalAttrs.version;
-    hash = "sha256-hM8Y5kusKUu54SYPjPwZ7YnxXFzX/IM28GFWcfkdnsA=";
+    hash = "sha256-TpoTOzdD8N9IcATmMRTfbSSBWwosxCW+MBa5MDtabf8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix b/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
index 25555998ed24..3d3adfe23108 100644
--- a/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
+++ b/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
@@ -3,26 +3,34 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  prometheus-client,
+  starlette,
+
+  # tests
   devtools,
   fastapi,
-  httpx,
-  poetry-core,
-  prometheus-client,
+  httpx2,
+  pytest-asyncio,
+  pytestCheckHook,
   requests,
-  starlette,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "prometheus-fastapi-instrumentator";
-  version = "7.1.0";
+  version = "8.0.2";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "trallnag";
     repo = "prometheus-fastapi-instrumentator";
-    tag = "v${version}";
-    hash = "sha256-54h/kwIdzFzxdYglwcEBPkLYno1YH2iWklg35qY2b00=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fTJjAM1jUZXfhjLo9xqlu45LaoqZ330ogOA6x7aByqw=";
   };
 
   build-system = [
@@ -37,20 +45,29 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     devtools
     fastapi
-    httpx
+    httpx2
+    pytest-asyncio
     pytestCheckHook
     requests
   ];
 
   # numerous test failures on Darwin
-  doCheck = stdenv.hostPlatform.isLinux;
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  # TODO: Cleanup when https://github.com/NixOS/nixpkgs/pull/538958 reaches
+  # `master`...
+  disabledTests = lib.optionals (lib.versionOlder fastapi.version "0.137") [
+    # Asserts that instrumentation works with fastapi 0.137+,
+    # fails on nixpkgs with fastapi 0.136.
+    "test_mount_inside_included_router_resolves_path"
+  ];
 
   pythonImportsCheck = [ "prometheus_fastapi_instrumentator" ];
 
   meta = {
     description = "Instrument FastAPI with Prometheus metrics";
     homepage = "https://github.com/trallnag/prometheus-fastapi-instrumentator";
-    changelog = "https://github.com/trallnag/prometheus-fastapi-instrumentator/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/trallnag/prometheus-fastapi-instrumentator/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [
       isc
       bsd3
@@ -58,4 +75,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ bcdarwin ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/sharedmem/default.nix b/pkgs/development/python-modules/sharedmem/default.nix
index 0615feb911df..bb32022ec263 100644
--- a/pkgs/development/python-modules/sharedmem/default.nix
+++ b/pkgs/development/python-modules/sharedmem/default.nix
@@ -1,27 +1,35 @@
 {
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   lib,
+  setuptools,
   numpy,
 }:
 
-buildPythonPackage rec {
-
+buildPythonPackage (finalAttrs: {
   pname = "sharedmem";
   version = "0.3.8";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "c654a6bee2e2f35c82e6cc8b6c262fcabd378f5ba11ac9ef71530f8dabb8e2f7";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rainwoodman";
+    repo = "sharedmem";
+    tag = finalAttrs.version;
+    hash = "sha256-sQYSIMLXhChBDKlb8x7kRo1ZKKXEdWSjvxp0SZGKems=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  build-system = [ setuptools ];
+
+  dependencies = [ numpy ];
+
+  pythonImportsCheck = [ "sharedmem" ];
 
   meta = {
     homepage = "http://rainwoodman.github.io/sharedmem/";
     description = "Easier parallel programming on shared memory computers";
     maintainers = with lib.maintainers; [ edwtjo ];
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Only;
   };
-}
+})
diff --git a/pkgs/development/python-modules/socialscan/default.nix b/pkgs/development/python-modules/socialscan/default.nix
index c97677dba1bc..073553c1e196 100644
--- a/pkgs/development/python-modules/socialscan/default.nix
+++ b/pkgs/development/python-modules/socialscan/default.nix
@@ -4,22 +4,25 @@
   buildPythonPackage,
   fetchFromGitHub,
   colorama,
+  setuptools,
   tqdm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "socialscan";
   version = "2.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iojw";
     repo = "socialscan";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-4JJVhB6x1NGagtfzE03Jae2GOr25hh+4l7gQ23zc7Ck=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     colorama
     tqdm
@@ -34,8 +37,8 @@ buildPythonPackage rec {
     description = "Python library and CLI for accurately querying username and email usage on online platforms";
     mainProgram = "socialscan";
     homepage = "https://github.com/iojw/socialscan";
-    changelog = "https://github.com/iojw/socialscan/releases/tag/v${version}";
+    changelog = "https://github.com/iojw/socialscan/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [ mpl20 ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchtitan/default.nix b/pkgs/development/python-modules/torchtitan/default.nix
index e7e16da4040f..3bf24a97c2bd 100644
--- a/pkgs/development/python-modules/torchtitan/default.nix
+++ b/pkgs/development/python-modules/torchtitan/default.nix
@@ -20,6 +20,7 @@
   tyro,
 
   # tests
+  expecttest,
   pytestCheckHook,
   tomli-w,
   triton,
@@ -30,6 +31,7 @@ buildPythonPackage (finalAttrs: {
   pname = "torchtitan";
   version = "0.2.2";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
@@ -58,6 +60,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "torchtitan" ];
 
   nativeCheckInputs = [
+    expecttest
     pytestCheckHook
     tomli-w
     transformers
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index d4af451e1b32..0ca8e075e7ec 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "xiaomi-ble";
-  version = "1.14.4";
+  version = "1.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SoB9sa3TkFLNomYuVZszKIIc0h/XDzRdfusWlruhDQ0=";
+    hash = "sha256-I0Lifki39TLbtnITADtmPygwKq11sugTDdveqpLQ/n0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 3ee51f489581..886f7bbece53 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -258,12 +258,12 @@ in
 
   dotbar = mkTmuxPlugin rec {
     pluginName = "dotbar";
-    version = "0.3.2";
+    version = "0.3.3";
     src = fetchFromGitHub {
       owner = "vaaleyard";
       repo = "tmux-dotbar";
       tag = version;
-      hash = "sha256-WaRKepmPqiE+W8Tm0dBc6hGiqqZP122eXjrG0rJnt0w=";
+      hash = "sha256-CAKEN8Sk3t0nonV2R9df/DFTTUrVnbso0ZVGgeeGINM=";
     };
     meta = {
       homepage = "https://github.com/vaaleyard/tmux-dotbar";
diff --git a/pkgs/pkgs-lib/formats/java-properties/test/default.nix b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
index 68cd5cfa1bcf..547292db45bf 100644
--- a/pkgs/pkgs-lib/formats/java-properties/test/default.nix
+++ b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation {
     "**/*.java"
   ];
   # On Linux, this can be C.UTF-8, but darwin + zulu requires en_US.UTF-8
-  LANG = "en_US.UTF-8";
+  env.LANG = "en_US.UTF-8";
   buildPhase = ''
     javac Main.java
   '';