diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3e80958859b7..067a99e948b2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9902,6 +9902,12 @@
     githubId = 155722885;
     name = "Joachim Ernst";
   };
+  hemera = {
+    email = "neikos@neikos.email";
+    github = "TheNeikos";
+    githubId = 1631166;
+    name = "Marcel Müller";
+  };
   henkery = {
     email = "jim@reupload.nl";
     github = "henkery";
@@ -17298,6 +17304,12 @@
     githubId = 144328493;
     keys = [ { fingerprint = "D89F 440C 6CD7 4753 090F  EC7A 4682 C5CB 4D9D EA3C"; } ];
   };
+  naora = {
+    name = "Joris Gundermann";
+    email = "jorisgundermann@gmail.com";
+    github = "Naora";
+    githubId = 2221163;
+  };
   naphta = {
     github = "naphta";
     githubId = 6709831;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8345103d24fc..6cb04827cb77 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -768,7 +768,7 @@ in
   lomiri = discoverTests (import ./lomiri.nix);
   lomiri-calculator-app = runTest ./lomiri-calculator-app.nix;
   lomiri-calendar-app = runTest ./lomiri-calendar-app.nix;
-  lomiri-camera-app = runTest ./lomiri-camera-app.nix;
+  lomiri-camera-app = discoverTests (import ./lomiri-camera-app.nix);
   lomiri-clock-app = runTest ./lomiri-clock-app.nix;
   lomiri-docviewer-app = runTest ./lomiri-docviewer-app.nix;
   lomiri-filemanager-app = runTest ./lomiri-filemanager-app.nix;
diff --git a/nixos/tests/lomiri-camera-app.nix b/nixos/tests/lomiri-camera-app.nix
index ec3442966982..24824a30cd4b 100644
--- a/nixos/tests/lomiri-camera-app.nix
+++ b/nixos/tests/lomiri-camera-app.nix
@@ -1,155 +1,257 @@
-{ lib, ... }:
-{
-  name = "lomiri-camera-app-standalone";
-  meta.maintainers = lib.teams.lomiri.members;
-
-  nodes.machine =
-    { config, pkgs, ... }:
-    {
-      imports = [ ./common/x11.nix ];
-
-      services.xserver.enable = true;
-
-      environment = {
-        systemPackages =
-          with pkgs;
-          [
-            feh # view photo result
-            ffmpeg # fake webcam stream
-            gnome-text-editor # somewhere to paste QR result
-            (imagemagick.override { ghostscriptSupport = true; }) # add label for OCR
-            qrtool # generate QR code
-            xdotool # clicking on QR button
-          ]
-          ++ (with pkgs.lomiri; [
-            suru-icon-theme
-            lomiri-camera-app
-          ]);
-        variables = {
-          UITK_ICON_THEME = "suru";
-        };
-      };
-
-      i18n.supportedLocales = [ "all" ];
-
-      fonts = {
-        packages = with pkgs; [
-          # Intended font & helps with OCR
-          ubuntu-classic
+let
+  makeTest = import ./make-test-python.nix;
+  feedLabel = "Image";
+  feedQrContent = "Test";
+  feedImageFile = "feed.png";
+  makeFeedImage =
+    pkgs:
+    pkgs.runCommand feedImageFile
+      {
+        nativeBuildInputs = with pkgs; [
+          (imagemagick.override { ghostscriptSupport = true; }) # add label for OCR
+          qrtool # generate QR code
         ];
-      };
+      }
+      ''
+        qrtool encode '${feedQrContent}' -s 20 -m 10 > qr.png
 
-      # Fake camera
-      boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
-    };
+        # Horizontal flip, add text, flip back. Camera displays image mirrored, so need reversed text for OCR
+        magick qr.png \
+          -flop \
+          -pointsize 30 -fill black -annotate +100+100 '${feedLabel}' \
+          -flop \
+          $out
+      '';
+in
+{
+  basic = makeTest (
+    { lib, ... }:
+    {
+      name = "lomiri-camera-app-basic";
+      meta.maintainers = lib.teams.lomiri.members;
 
-  enableOCR = true;
+      nodes.machine =
+        { config, pkgs, ... }:
+        {
+          imports = [ ./common/x11.nix ];
 
-  testScript =
-    let
-      qrLabel = "Feed";
-      qrContent = "Test";
-    in
-    ''
-      machine.wait_for_x()
+          services.xserver.enable = true;
 
-      with subtest("lomiri camera launches"):
-          machine.succeed("lomiri-camera-app >&2 &")
-          machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+          environment = {
+            systemPackages = with pkgs.lomiri; [
+              suru-icon-theme
+              lomiri-camera-app
+            ];
+            variables = {
+              UITK_ICON_THEME = "suru";
+            };
+          };
+
+          i18n.supportedLocales = [ "all" ];
+
+          fonts = {
+            packages = with pkgs; [
+              # Intended font & helps with OCR
+              ubuntu-classic
+            ];
+          };
+        };
+
+      enableOCR = true;
+
+      testScript =
+        let
+          qrLabel = "Feed";
+          qrContent = "Test";
+        in
+        ''
+          machine.wait_for_x()
+
+          with subtest("lomiri camera launches"):
+              machine.succeed("lomiri-camera-app >&2 &")
+              # emitted twice
+              machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+              machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+              machine.sleep(10)
+              machine.send_key("alt-f10")
+              machine.sleep(5)
+              machine.wait_for_text("Cannot access")
+              machine.screenshot("lomiri-camera_open")
+
+          machine.succeed("pgrep -afx lomiri-camera-app >&2")
+          machine.succeed("pkill -efx lomiri-camera-app >&2")
+          machine.wait_until_fails("pgrep -afx lomiri-camera-app >&2")
+
+          # Sometimes, GStreamer errors out on camera init with: CameraBin error: "Failed to allocate required memory."
+          # Adding more VM memory didn't affect this. Maybe flaky in general?
+          # Current assumption: Camera access gets requested in a weird/still-in-use state, so sleep abit
           machine.sleep(10)
-          machine.send_key("alt-f10")
-          machine.sleep(5)
-          machine.wait_for_text("Cannot access")
-          machine.screenshot("lomiri-camera_open")
 
-      machine.succeed("pkill -f lomiri-camera-app")
+          with subtest("lomiri camera localisation works"):
+              machine.succeed("env LANG=de_DE.UTF-8 lomiri-camera-app >&2 &")
+              # emitted twice
+              machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+              machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+              machine.sleep(10)
+              machine.send_key("alt-f10")
+              machine.sleep(5)
+              machine.wait_for_text("Zugriff auf")
+              machine.screenshot("lomiri-camera_localised")
+        '';
+    }
+  );
 
-      # Setup fake v4l2 camera
-      machine.succeed("modprobe v4l2loopback video_nr=10 card_label=Video-Loopback exclusive_caps=1")
-      machine.succeed("qrtool encode '${qrContent}' -s 20 -m 10 > qr.png")
-      # Horizontal flip, add text, flip back. Camera displays image mirrored, so need reversed text for OCR
-      machine.succeed("magick qr.png -flop -pointsize 30 -fill black -annotate +100+100 '${qrLabel}' -flop output.png")
-      machine.succeed("ffmpeg -re -loop 1 -i output.png -vf format=yuv420p -f v4l2 /dev/video10 -loglevel fatal >&2 &")
+  v4l2-photo = makeTest (
+    { lib, ... }:
+    {
+      name = "lomiri-camera-app-v4l2-photo";
+      meta.maintainers = lib.teams.lomiri.members;
 
-      with subtest("lomiri camera uses camera"):
-          machine.succeed("lomiri-camera-app >&2 &")
-          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
-          machine.sleep(10)
-          machine.send_key("alt-f10")
-          machine.sleep(5)
-          machine.wait_for_text("${qrLabel}")
-          machine.screenshot("lomiri-camera_feed")
+      nodes.machine =
+        { config, pkgs, ... }:
+        {
+          imports = [ ./common/x11.nix ];
 
-          machine.succeed("xdotool mousemove 510 670 click 1") # take photo
-          machine.wait_until_succeeds("ls /root/Pictures/camera.ubports | grep '\\.jpg$'")
+          services.xserver.enable = true;
 
-          # Check that the image is correct
-          machine.send_key("ctrl-alt-right")
-          machine.succeed("magick /root/Pictures/camera.ubports/IMG_00000001.jpg -flop photo_flip.png")
-          machine.succeed("feh photo_flip.png >&2 &")
-          machine.sleep(10)
-          machine.wait_for_text("${qrLabel}")
-          machine.screenshot("lomiri-camera_photo")
+          environment = {
+            etc."${feedImageFile}".source = makeFeedImage pkgs;
+            systemPackages =
+              with pkgs;
+              [
+                feh # view photo result
+                ffmpeg # fake webcam stream
+                imagemagick # unflip webcam photo
+                xdotool # clicking on camera button
+              ]
+              ++ (with pkgs.lomiri; [
+                suru-icon-theme
+                lomiri-camera-app
+              ]);
+            variables = {
+              UITK_ICON_THEME = "suru";
+            };
+          };
 
-      machine.succeed("pkill -f feh")
-      machine.send_key("ctrl-alt-left")
-      machine.succeed("pkill -f lomiri-camera-app")
+          i18n.supportedLocales = [ "all" ];
 
-      with subtest("lomiri barcode scanner uses camera"):
-          machine.succeed("lomiri-camera-app --mode=barcode-reader >&2 &")
-          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
-          machine.sleep(10)
-          machine.send_key("alt-f10")
-          machine.sleep(5)
-          machine.wait_for_text("${qrLabel}")
-          machine.succeed("xdotool mousemove 510 670 click 1") # open up QR decode result
+          fonts = {
+            packages = with pkgs; [
+              # Intended font & helps with OCR
+              ubuntu-classic
+            ];
+          };
 
-          # OCR is struggling to recognise the text. Click the clipboard button and paste the result somewhere else
-          machine.sleep(5)
-          machine.screenshot("lomiri-barcode_decode")
-          machine.succeed("xdotool mousemove 540 590 click 1")
-          machine.sleep(5)
+          # Fake camera
+          boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
+        };
 
-          # Need to make a new window without closing camera app, otherwise clipboard content gets lost?
-          machine.send_key("ctrl-alt-right")
-          machine.succeed("gnome-text-editor >&2 &")
-          machine.sleep(10)
-          machine.send_key("alt-f10")
-          machine.sleep(5)
-          machine.wait_for_text("New")
+      enableOCR = true;
 
-          # Font size up to help with OCR
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
-          machine.send_key("ctrl-kp_add")
+      testScript = ''
+        machine.wait_for_x()
 
-          machine.send_key("ctrl-v")
-          machine.wait_for_text("${qrContent}")
+        # Setup fake v4l2 camera
+        machine.succeed("modprobe v4l2loopback video_nr=10 card_label=Video-Loopback exclusive_caps=1")
+        machine.succeed("ffmpeg -re -loop 1 -i /etc/${feedImageFile} -vf format=yuv420p -f v4l2 /dev/video10 -loglevel fatal >&2 &")
 
-      machine.succeed("pkill -f gnome-text-editor")
-      machine.send_key("ctrl-alt-left")
-      machine.succeed("pkill -f lomiri-camera-app")
+        with subtest("lomiri camera uses camera"):
+            machine.succeed("lomiri-camera-app >&2 &")
+            # emitted twice
+            machine.wait_for_console_text("No flash control support")
+            machine.wait_for_console_text("No flash control support")
+            machine.sleep(10)
+            machine.send_key("alt-f10")
+            machine.sleep(5)
+            machine.wait_for_text("${feedLabel}")
+            machine.screenshot("lomiri-camera_feed")
 
-      with subtest("lomiri camera localisation works"):
-          machine.succeed("env LANG=de_DE.UTF-8 lomiri-camera-app >&2 &")
-          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
-          machine.sleep(10)
-          machine.send_key("alt-f10")
-          machine.sleep(5)
-          machine.wait_for_text("Kamera")
-          machine.screenshot("lomiri-camera_localised")
-    '';
+            machine.succeed("xdotool mousemove 510 670 click 1") # take photo
+            machine.wait_until_succeeds("ls /root/Pictures/camera.ubports | grep '\\.jpg$'")
+
+            # Check that the image is correct
+            machine.send_key("ctrl-alt-right")
+            machine.succeed("magick /root/Pictures/camera.ubports/IMG_00000001.jpg -flop photo_flip.png")
+            machine.succeed("feh photo_flip.png >&2 &")
+            machine.sleep(10)
+            machine.send_key("alt-f10")
+            machine.sleep(5)
+            machine.wait_for_text("${feedLabel}")
+            machine.screenshot("lomiri-camera_photo")
+      '';
+    }
+  );
+
+  v4l2-qr = makeTest (
+    { lib, ... }:
+    {
+      name = "lomiri-camera-app-v4l2-qr";
+      meta.maintainers = lib.teams.lomiri.members;
+
+      nodes.machine =
+        { config, pkgs, ... }:
+        {
+          imports = [ ./common/x11.nix ];
+
+          services.xserver.enable = true;
+
+          environment = {
+            etc."${feedImageFile}".source = makeFeedImage pkgs;
+            systemPackages =
+              with pkgs;
+              [
+                ffmpeg # fake webcam stream
+                xclip # inspect QR contents copied into clipboard
+                xdotool # clicking on QR button
+              ]
+              ++ (with pkgs.lomiri; [
+                suru-icon-theme
+                lomiri-camera-app
+              ]);
+            variables = {
+              UITK_ICON_THEME = "suru";
+            };
+          };
+
+          i18n.supportedLocales = [ "all" ];
+
+          fonts = {
+            packages = with pkgs; [
+              # Intended font & helps with OCR
+              ubuntu-classic
+            ];
+          };
+
+          # Fake camera
+          boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
+        };
+
+      enableOCR = true;
+
+      testScript = ''
+        machine.wait_for_x()
+
+        # Setup fake v4l2 camera
+        machine.succeed("modprobe v4l2loopback video_nr=10 card_label=Video-Loopback exclusive_caps=1")
+        machine.succeed("ffmpeg -re -loop 1 -i /etc/${feedImageFile} -vf format=yuv420p -f v4l2 /dev/video10 -loglevel fatal >&2 &")
+
+        with subtest("lomiri barcode scanner uses camera"):
+            machine.succeed("lomiri-camera-app --mode=barcode-reader >&2 &")
+            # emitted twice
+            machine.wait_for_console_text("No flash control support")
+            machine.wait_for_console_text("No flash control support")
+            machine.sleep(10)
+            machine.send_key("alt-f10")
+            machine.sleep(5)
+            machine.wait_for_text("${feedLabel}")
+            machine.succeed("xdotool mousemove 510 670 click 1") # open up QR decode result
+
+            # OCR is struggling to recognise the text. Click the clipboard button, check what got copied
+            machine.sleep(5)
+            machine.screenshot("lomiri-barcode_decode")
+            machine.succeed("xdotool mousemove 540 590 click 1")
+            machine.wait_until_succeeds("env DISPLAY=:0 xclip -selection clipboard -o | grep -q '${feedQrContent}'")
+      '';
+    }
+  );
 }
diff --git a/nixos/tests/morph-browser.nix b/nixos/tests/morph-browser.nix
index d75b3444be5a..04857ceeeb10 100644
--- a/nixos/tests/morph-browser.nix
+++ b/nixos/tests/morph-browser.nix
@@ -36,7 +36,10 @@
     machine.wait_for_x()
 
     with subtest("morph browser launches"):
-        machine.execute("morph-browser >&2 &")
+        machine.succeed("morph-browser >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
         machine.screenshot("morph_open")
 
@@ -47,8 +50,14 @@
 
     machine.succeed("pkill -f morph-browser")
 
+    # Get rid of saved tabs, to show localised start page
+    machine.succeed("rm -r /root/.local/share/morph-browser")
+
     with subtest("morph browser localisation works"):
-        machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
+        machine.succeed("env LANG=de_DE.UTF-8 morph-browser >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
         machine.screenshot("morph_localised")
   '';
diff --git a/nixos/tests/teleports.nix b/nixos/tests/teleports.nix
index 613ad5a7fc84..84a880f9ad50 100644
--- a/nixos/tests/teleports.nix
+++ b/nixos/tests/teleports.nix
@@ -36,7 +36,7 @@
     with subtest("teleports launches"):
         machine.succeed("teleports >&2 &")
         machine.wait_for_console_text("authorizationStateWaitPhoneNumber")
-        machine.send_key("alt-f10")
+        # Not fullscreening, because main app colour makes OCR stuck
         machine.sleep(2)
         machine.wait_for_text(r"(TELEports|Phone Number)")
         machine.screenshot("teleports_open")
@@ -46,7 +46,7 @@
     with subtest("teleports localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 teleports >&2 &")
         machine.wait_for_console_text("authorizationStateWaitPhoneNumber")
-        machine.send_key("alt-f10")
+        # Not fullscreening, because main app colour makes OCR stuck
         machine.sleep(2)
         machine.wait_for_text("Telefonnummer")
         machine.screenshot("teleports_localised")
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
index 0655fef98a6e..198b9270c2e0 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-05-30";
+  version = "0-unstable-2025-06-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "67c0bb961e7679aa8f1882ee6411ce34cef084db";
-    hash = "sha256-4hkKf61h/0FVE9nQub2YN0mOpql7dwmVngckagWLCuc=";
+    rev = "271a967e78dfe2e5936523e3ba52ce6f3c2fa870";
+    hash = "sha256-P8SAX/JujHRnPSSIb9m2fXLHUt20RTJbfjsCrP9jh/U=";
   };
 
   extraBuildInputs = lib.optionals withHw [
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index 74ace5a4e00b..72a45c909cfd 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -83,9 +83,9 @@
 
   containerapp = mkAzExtension rec {
     pname = "containerapp";
-    version = "1.1.0b5";
+    version = "1.2.0b1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
-    hash = "sha256-gC75NiDDRw4DVIDGiyfdCcFSAzdUgVNjyTfrgGgRd90=";
+    hash = "sha256-tayDzAbvPjCRjJMdV6BOSd9Sgcj8bnEuZI9khKGCyrM=";
     description = "Microsoft Azure Command-Line Tools Containerapp Extension";
     propagatedBuildInputs = with python3Packages; [
       docker
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index 65305271b53c..fca565659a73 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.0.5";
+  version = "22.1.0";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-CJZY7mcWKYzB3+ifsm8/g+XcKPaIc7ca2Za7Qb/GbBE=";
+    hash = "sha256-qL+hC3ydKJSzceJVbaLy+a2jpXMLsgGC++PEreZDF0k=";
   };
 
-  npmDepsHash = "sha256-x9pQqX/nLL4rykA6jgL4f0tHKWEJmR2QUeg3Lfy78D0=";
+  npmDepsHash = "sha256-bLYKMWiXwvpMhnTHa0RPhzEpvtTFcWnqX8zXDNCY4uk=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/applications/misc/bikeshed/default.nix b/pkgs/by-name/bi/bikeshed/package.nix
similarity index 68%
rename from pkgs/applications/misc/bikeshed/default.nix
rename to pkgs/by-name/bi/bikeshed/package.nix
index 3d66432a50f7..41e9b1ffaaa6 100644
--- a/pkgs/applications/misc/bikeshed/default.nix
+++ b/pkgs/by-name/bi/bikeshed/package.nix
@@ -1,56 +1,24 @@
 {
   lib,
-  buildPythonApplication,
   fetchPypi,
-  # build inputs
-  about-time,
-  aiofiles,
-  aiohttp,
-  aiosignal,
-  alive-progress,
-  async-timeout,
-  attrs,
-  certifi,
-  charset-normalizer,
-  cssselect,
-  frozenlist,
-  html5lib,
-  idna,
-  isodate,
-  json-home-client,
-  kdl-py,
-  lxml,
-  multidict,
-  pillow,
-  pygments,
-  requests,
-  result,
-  setuptools,
-  six,
-  tenacity,
-  typing-extensions,
-  uri-template,
-  urllib3,
-  webencodings,
-  widlparser,
-  yarl,
+  python3Packages,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.1.2";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QIADVcxgJreH2pvXRVIBE5p6nEEYZtTiSo00RrpFT+E=";
+    hash = "sha256-HUPkLEpwLRnrffUMN62WPqsZX2UsGqPfjEa91UMbUMM=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ python3Packages.setuptools ];
 
   pythonRelaxDeps = true;
 
-  dependencies = [
+  dependencies = with python3Packages; [
     about-time
     aiofiles
     aiohttp
@@ -58,6 +26,7 @@ buildPythonApplication rec {
     alive-progress
     async-timeout
     attrs
+    cddlparser
     certifi
     charset-normalizer
     cssselect
@@ -102,6 +71,9 @@ buildPythonApplication rec {
     '';
     homepage = "https://tabatkins.github.io/bikeshed/";
     license = licenses.cc0;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      matthiasbeyer
+      hemera
+    ];
   };
 }
diff --git a/pkgs/by-name/bl/blackfire/php-probe.nix b/pkgs/by-name/bl/blackfire/php-probe.nix
index d319d6574404..4fcdad5cb2ad 100644
--- a/pkgs/by-name/bl/blackfire/php-probe.nix
+++ b/pkgs/by-name/bl/blackfire/php-probe.nix
@@ -16,50 +16,50 @@ let
   phpMajor = lib.versions.majorMinor php.version;
   inherit (stdenv.hostPlatform) system;
 
-  version = "1.92.37";
+  version = "1.92.38";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-NuWxVeVueKz64jDIE1KPzLEco+MoUyuc/9/hsTaRrAI=";
-        "8.2" = "sha256-NJlrEwSY55INO7q5GAvPojnLdkAYJ4eCIjxFH55Pdmg=";
-        "8.3" = "sha256-KGpNPp2bOAmY/GUPnUxTJ4z6X8AdvZAG6YC3pLTjbGI=";
-        "8.4" = "sha256-3HrbezGcdVMtdPrfRpLEhY/1AXlGUIMraeie7LEmiC8=";
+        "8.1" = "sha256-W8VlvHa6vmNbDX5r5FG8pB0vpXRn5hPu61td9aARecA=";
+        "8.2" = "sha256-f3AKwh9mUCoFDaXM+EwTORk0/TFyArtEa+sv7cMZmDs=";
+        "8.3" = "sha256-6zigke1VY439IIxrQg5Dxcggn+7Q0BE/spPycvxdyik=";
+        "8.4" = "sha256-n89OCTUGsWhpc61P9WvKyjdJ52wJHoj6NEb2mcs0whA=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-Z9D6yoDSTdvzAQw+LhCk37J+LPMLEthUzbB1YQdr7AY=";
-        "8.2" = "sha256-ES2Y2RewFSP0R5wuYF2sm7NAVlCRvRPSpfPt7X2uYqs=";
-        "8.3" = "sha256-jqcS97JcHU/LzdU08MwNXDepH7OzIa4Fo7s3hg+x6hA=";
-        "8.4" = "sha256-xel7bbb4S16YddLuw0sDINbKQ0zoJeeRSI4g+tpqYz0=";
+        "8.1" = "sha256-31lJOGL9i8kL22zH8zzYZtxB94ssJiw+qXQRmQilR+c=";
+        "8.2" = "sha256-f+D7DZvLQk6ebLfJ43qFSqWzU6YQoP/7nVGajLRll5g=";
+        "8.3" = "sha256-56/+604Vymb+otL7oria3d/w4b1o8Pt199aXK4nfJC4=";
+        "8.4" = "sha256-K26Dy0S9w0uWTX7GkIjh0jUtaa768B+ls9gq8LXNZUA=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-l3mz8n1PjBUTcLN4Kyjg573Ip20dFV85yNT2krYq6Z0=";
-        "8.2" = "sha256-EyxrVMitvupQzAwhFDwMO56PUhyLb35aqWgJeH+211E=";
-        "8.3" = "sha256-T6UkTtQl1Ce95tA4/J9mSk/pBWAZJJz0pHb3xMIGYvc=";
-        "8.4" = "sha256-udvqUMbbVcFOocu1F0rSgi0+bg5VPq2Qw2LrRqNRQHw=";
+        "8.1" = "sha256-aSjOxMZdP+Lrd4FaXgkbHykmKBn9WuzGumrYpJEKpS8=";
+        "8.2" = "sha256-ckhHA/EYeRlhSrc5nMUl6jS0iAaW1q1sZAYYxjcGOwQ=";
+        "8.3" = "sha256-p3P94uPTbekbxgICuC72NEA5XFpYng2MZI+9L+0R/Ew=";
+        "8.4" = "sha256-KCMRNpS2A5Tb5Td8fpBusu70FNIOfJ+6pYRUgw/5kDg=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-PoXihk7e+xT6fat48dnD/3lZqQKpgBHs4Eao08J4dMs=";
-        "8.2" = "sha256-lLham3VjXvszjOU8NvxZsjz5vfEK58QG1tE4X06luzQ=";
-        "8.3" = "sha256-rAsJ71P+yM939JqhhwDbxfL0EwB4q7SNqvSdN0n6ES0=";
+        "8.1" = "sha256-5JPn9lNsh6NJemCRmrBrTIvhEUQfjmIGbASaoiKoZDo=";
+        "8.2" = "sha256-e9tsXi3SML9HZ81XD5LhGcm7L8Ag9fOvyTo0Gy42YRw=";
+        "8.3" = "sha256-RCmYyrcSi7hfkbGOSp8ywFkm1IFGy0bgu8tmdrTID6c=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-6RoANqMjuyaLcMzg5R0unhTwOSbsQhEXCkjQ2kjnnCg=";
-        "8.2" = "sha256-PjvLjRsnhHgXOEj7J7ekWM0fFuaOuiYJhXbINClaFtU=";
-        "8.3" = "sha256-NoY788iBgeVMrQp3tm6vbAnwBZB7yMjCVmH7jr32HWU=";
+        "8.1" = "sha256-SuD9iDjxMBt2GZtDXPIjCCl1mEt9K2GciuC7S9ppNZQ=";
+        "8.2" = "sha256-om1L/VQiwdV4D2awuz98ko7Oz9h1GYRtqYZrQRZpy7E=";
+        "8.3" = "sha256-H1xkneOLk7DCPqtbknLlQX2iKe/U6/ilmToOOtiRabs=";
       };
     };
   };
diff --git a/pkgs/by-name/ch/chrony/package.nix b/pkgs/by-name/ch/chrony/package.nix
index cfa7806285f3..c772779bf757 100644
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "chrony";
-  version = "4.6.1";
+  version = "4.7";
 
   src = fetchurl {
     url = "https://chrony-project.org/releases/${pname}-${version}.tar.gz";
-    hash = "sha256-Vx/3P78K4wl/BgTsouALHYuy6Rr/4aNJR4X/IdYZnFw=";
+    hash = "sha256-wN5BqMBR5dMrEBtfcBS5jKl4sY5ZLzDOaEC21GAtlHs=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index e3b8f72ee830..16980f6624db 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.8.20";
+  version = "0.9.0";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-pDZmrPLIppMMj8KqNGQLUM4ue43vSwVyEKCYrN0G2LM=";
-        aarch64-linux = "sha256-GraqtexpHN+bpArA1HQDYC7DG2QHK1P7o9QDXyFEir4=";
-        x86_64-darwin = "sha256-X/Gf4OipbUM8FwAYfA1+yMBVbsZK5UYz4HFiOYYaTdA=";
-        aarch64-darwin = "sha256-jmsj1VPpxTgly0xIB5pxl79NBZe1zp9rqAYePScMe80=";
+        x86_64-linux = "sha256-snmMDzZ11pAV0UkPWpl74B/ifsTUv91PXBJzQU7a1oI=";
+        aarch64-linux = "sha256-sAD5jnxmMzfb37qleOCeNr1zveqU06slTFtd/E6BZf0=";
+        x86_64-darwin = "sha256-90afw69lf7SjANRadum4GxW3ZAr6eDDnFVhyV3qtWt4=";
+        aarch64-darwin = "sha256-LoCRM6t9ditZfwgmWJGkijpFvC/s2lBItH7j3Qqlfp0=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index ebbc5c69f9b6..c99ebbb4f028 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "filebeat";
-  version = "8.18.0";
+  version = "8.18.2";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${version}";
-    hash = "sha256-bVM4qHw/YZcJEykB7zZuS8SHmk3YluS2IJxuGExfm5Y=";
+    hash = "sha256-8gpmrWBiJr5ibVNMqz/RYyOH7vIVTW1IPAsuDTn1BKc=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-gRyKgg1kIKkk6iFw6NCwmwHwExj8zS3+r1V3uzFMIXA=";
+  vendorHash = "sha256-wBh6mWg1xuhcaDA3guWTWjs4WgSHkNGPW/6KWuZ5L7w=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index 0da332f659bb..ff797e6f26da 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "jjui";
-  version = "0.8.8";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5gDEcwS14Hur/Mw/vALPU+EVC5BJxdgjFbpzz1kcSKM=";
+    hash = "sha256-pDK2ZjnhSlLepOdr7QEnj2+0vMvL2LPaWw1miA1oMSA=";
   };
 
   vendorHash = "sha256-YlOK+NvyH/3uvvFcCZixv2+Y2m26TP8+ohUSdl3ppro=";
diff --git a/pkgs/by-name/li/libqalculate/package.nix b/pkgs/by-name/li/libqalculate/package.nix
index 1df23ea66396..66fccfc6152f 100644
--- a/pkgs/by-name/li/libqalculate/package.nix
+++ b/pkgs/by-name/li/libqalculate/package.nix
@@ -14,7 +14,15 @@
   libxml2,
   mpfr,
   icu,
+  # Upstream's `plot` UX is not ideal - it doesn't write a good message
+  # suggesting the user to install this optional dependency when they write
+  # `plot(..)`. Not to mention support for non-x dependent `gnuplot_qt`
+  # executable. Hence we hardcode a path to a gnuplot binary by default, and
+  # changing this is possible via putting an empty string as a `gnuplotBinary`
+  # - to let `libqalculate` pick it from $PATH during runtime. See also:
+  # https://github.com/Qalculate/libqalculate/issues/796
   gnuplot,
+  gnuplotBinary ? lib.getExe gnuplot,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -24,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-sjVvsgDQbKXU+N7JrA36zezDfAGcDbyQ0fn1zMThYXQ=";
   };
 
@@ -61,16 +69,11 @@ stdenv.mkDerivation (finalAttrs: {
     intltoolize -f
   '';
 
-  patchPhase =
-    ''
-      substituteInPlace libqalculate/Calculator-plot.cc \
-        --replace 'commandline = "gnuplot"' 'commandline = "${gnuplot}/bin/gnuplot"' \
-        --replace '"gnuplot - ' '"${gnuplot}/bin/gnuplot - '
-    ''
-    + lib.optionalString stdenv.cc.isClang ''
-      substituteInPlace src/qalc.cc \
-        --replace 'printf(_("aborted"))' 'printf("%s", _("aborted"))'
-    '';
+  postPatch = lib.optionalString (gnuplotBinary != "") ''
+    substituteInPlace libqalculate/Calculator-plot.cc \
+      --replace-fail 'commandline = "gnuplot"' 'commandline = "${gnuplotBinary}"' \
+      --replace-fail '"gnuplot - ' '"${gnuplotBinary} - '
+  '';
 
   preBuild = ''
     pushd docs/reference
@@ -78,15 +81,15 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Advanced calculator library";
     homepage = "http://qalculate.github.io";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
       doronbehar
       pentane
     ];
     mainProgram = "qalc";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 56dc3fdade1f..6d3d19cf0dce 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -17,18 +17,18 @@
 rustPlatform.buildRustPackage rec {
   pname = "lux-cli";
 
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "nvim-neorocks";
     repo = "lux";
-    tag = "v0.6.0";
-    hash = "sha256-bGG/W0ESiBAorcZrc34JrIF7pPAKatqOCeE8/jM9t7g=";
+    tag = "v0.7.0";
+    hash = "sha256-I0e9nOkY6+tYNORrS1AhgaFM2WtNNV2vFq6gh0YNOYE=";
   };
 
   buildAndTestSubdir = "lux-cli";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UXiEicwQ/GnKAel3PlgpoZBfHNURmRi+Urjszlwz8mU=";
+  cargoHash = "sha256-qtkyuTJNik+B9zaUgpKXBTAEqPbFQoPxqmlVJ/y0i7o=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/na/narsil/package.nix b/pkgs/by-name/na/narsil/package.nix
index 7041e75064fa..70e4a30afb66 100644
--- a/pkgs/by-name/na/narsil/package.nix
+++ b/pkgs/by-name/na/narsil/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "narsil";
-  version = "1.4.0-50-g6cd6ce985";
+  version = "1.4.0-61-gb724a9e67";
 
   src = fetchFromGitHub {
     owner = "NickMcConnell";
     repo = "NarSil";
     tag = version;
-    hash = "sha256-6JrlhDZRzDrYs8iBzWeKLT+DYaWPiWYpPHA1VBkdOkM=";
+    hash = "sha256-fRGSlgtbjDyhbEJEMG8eTMCxeIbA/tBO+MplCXTgWm8=";
   };
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/on/onedrive/package.nix b/pkgs/by-name/on/onedrive/package.nix
index 2d5ca17c04ee..afc54bbde022 100644
--- a/pkgs/by-name/on/onedrive/package.nix
+++ b/pkgs/by-name/on/onedrive/package.nix
@@ -1,30 +1,36 @@
 {
   lib,
-  autoreconfHook,
-  coreutils,
-  curl,
+  stdenv,
   fetchFromGitHub,
+
+  # native
+  autoreconfHook,
   installShellFiles,
   ldc,
-  libnotify,
   pkg-config,
+
+  # host
+  coreutils,
+  curl,
+  dbus,
+  libnotify,
   sqlite,
-  stdenv,
   systemd,
   testers,
+
   # Boolean flags
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "onedrive";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = "onedrive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SoTkphmxWVAeSfqO7Vqm8bdPAP1hK57zFNR6N5elEOM=";
+    hash = "sha256-AFaz1RkrtsdTZfaWobdcADbzsAhbdCzJPkQX6Pa7hN8=";
   };
 
   outputs = [
@@ -42,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     curl
+    dbus
     libnotify
     sqlite
   ] ++ lib.optionals withSystemd [ systemd ];
@@ -55,12 +62,15 @@ stdenv.mkDerivation (finalAttrs: {
   # we could also pass --enable-completions to configure but we would then have to
   # figure out the paths manually and pass those along.
   postInstall = ''
-    installShellCompletion --bash --name onedrive contrib/completions/complete.bash
-    installShellCompletion --fish --name onedrive contrib/completions/complete.fish
-    installShellCompletion --zsh --name _onedrive contrib/completions/complete.zsh
+    installShellCompletion --cmd onedrive \
+      --bash contrib/completions/complete.bash \
+      --fish contrib/completions/complete.fish \
+      --zsh contrib/completions/complete.zsh
 
-    substituteInPlace $out/lib/systemd/user/onedrive.service --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
-    substituteInPlace $out/lib/systemd/system/onedrive@.service --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
+    for s in $out/lib/systemd/user/onedrive.service $out/lib/systemd/system/onedrive@.service; do
+      substituteInPlace $s \
+        --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
+    done
   '';
 
   passthru = {
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index c0bfcb5bc5e0..cd4e687f2168 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -161,7 +161,7 @@ python.pkgs.buildPythonApplication rec {
       channels-redis
       concurrent-log-handler
       dateparser
-      django_5
+      django
       django-allauth
       django-auditlog
       django-celery-results
diff --git a/pkgs/by-name/qr/qr-backup/package.nix b/pkgs/by-name/qr/qr-backup/package.nix
new file mode 100644
index 000000000000..0d59ac4044b3
--- /dev/null
+++ b/pkgs/by-name/qr/qr-backup/package.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  pkgs,
+  installShellFiles,
+  nix-update-script,
+  versionCheckHook,
+  dejavu_fonts,
+  fetchpatch,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "qr-backup";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "za3k";
+    repo = "qr-backup";
+    tag = "v${version}";
+    hash = "sha256-Sre8cHbrRqJTX6+3HiLj6Ky8Bw+hg6UXItwRUtLzHZA=";
+  };
+
+  pyproject = false;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  dependencies = with pkgs; [
+    python3Packages.pillow
+    python3Packages.qrcode
+    python3Packages.reedsolo
+    which
+    zbar
+    imagemagickBig
+    gnupg
+  ];
+
+  patches = [
+    # Backported from the upstream master branch so we can `doCheck` on
+    # the latest release version without needing to vendor a patch to
+    # disable the fragile regression tests
+    (fetchpatch {
+      name = "0001-Rename-from-regression-to-reproducibility-tests.patch";
+      url = "https://github.com/za3k/qr-backup/commit/ec8ab373110de62d2e1f6f47c9a34e9e1a73c571.patch";
+      hash = "sha256-93wxmCeH3qxZkDLZa9giMGUmVHdXSitXzet6WnAbQRw=";
+    })
+    (fetchpatch {
+      name = "0002-Add-fast-option-to-tests.patch";
+      url = "https://github.com/za3k/qr-backup/commit/e7d028eb4fddaa7f8628c88e1604d5e64f546389.patch";
+      hash = "sha256-5Ib+bs+ciqH1z0kvHBD7PrefTTwD6nWk+6pEPqxc9uU=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace qr-backup \
+      --replace-fail '"DejaVuSansMono.ttf"' "'${dejavu_fonts}/share/fonts/truetype/DejaVuSansMono.ttf'" \
+      --replace-fail '"python3", sys.argv[0]' "'$out/bin/qr-backup'"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 755 qr-backup "$out/bin/qr-backup"
+    mv docs/qr-backup.1{.man,} # remove .man suffix
+    installManPage docs/qr-backup.1
+
+    runHook postInstall
+  '';
+
+  doCheck = true;
+  doInstallCheck = true;
+  nativeCheckInputs = with pkgs; [
+    versionCheckHook
+    which
+    zbar
+  ];
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    substituteInPlace tests/test.py \
+      --replace-fail '"python3", "qr-backup"' "'$out/bin/qr-backup'"
+    export GNUPGHOME="$(mktemp -d)"
+    make test-fast
+
+    runHook postInstallCheck
+  '';
+  versionCheckProgramArg = [ "--version" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Utility to generate paper backup of files using QR codes";
+    homepage = "https://github.com/za3k/qr-backup";
+    changelog = "https://github.com/za3k/qr-backup/blob/v${version}/docs/CHANGELOG";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [
+      acuteaangle
+    ];
+    mainProgram = "qr-backup";
+  };
+}
diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
index 01e3c58d2206..f9b32eb054cb 100644
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.11.1-etke43";
+  version = "0.11.1-etke44";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mubONaT4qnbPlnYY15UtHGEp45k5mIxWt1shHRdwwTA=";
+    hash = "sha256-8IL81rMohPNss0ZTKgyxvx4FNcgFtDoJGZ6uyM/nJgg=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-WFE2mtyK3xBOVIgJ0ODsv1C0pjpGdBM3+TtIiZUpj58=";
+    hash = "sha256-6TVVYitLtpNjyMOUXaMYlhOskSZCb/eWW91S69RTeFo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index 520c3728fbce..fb2fd947c810 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.22.2";
+  version = "1.22.3";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.2/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-YQxTMOqwtqEXfjRsEfpFGaFJIHox/CSNTUJ5YuFTMvk=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.3/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-OEx0dMW0OLRskW0j34mEiXgVZDLDUKshz4uxIrshlZ0=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.2/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-pz31MLVFn8Pv94wAGujuQK7b0AMjIQn+hTrTFpR5DeM=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.3/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-4+pI3rHMUR1a7YhB127eaJWXzNU9wOGn4pOUmW4Faek=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.2/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-Op8Z06UZIDOnjB6Vv4/TKMcRbseA/b+Z96sAbINSB04=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.3/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-qtFhkCcR1SuCP66lvVZu4UzvZ7HZImAZD/pvWVaOxzg=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.2/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-hink42tCUHCa7vHJzfLgMseofp+YaBdVX2HO7T8NFJo=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.3/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-iGpsoLs7zZ8+QT4AB3xZDIQ88p39W9I8sHNK9KPUJyM=";
   };
 }
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index c0dfe093055b..23c412a3ceb4 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.1.8";
+  version = "4.1.10";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-GeUnkdNW3VnbaCdK42pYebqwzp2sI8x7Dxn8e3wdN6I=";
-      aarch64-linux = "sha256-KKd9Hlmw5FtBaDweOUdiH9/nP2iVsF23w09j8/SJjo0=";
-      x86_64-darwin = "sha256-SmyyYNdcS9ygck+8w7I6WttScVrW14WVRjyGEoyhwyk=";
-      x86_64-linux = "sha256-j4TOgQvf8iXlmXgdHi2qgrQoIikCHIZ6cbQZ9Z+aqDY=";
+      aarch64-darwin = "sha256-80qFp1sfLeLH5Kn7xPuXbmSieAmA6EPfh9nBP1VfSkw=";
+      aarch64-linux = "sha256-Z+tiC7QEwgRtPBJ9vy1/mSFZUGVHXn0tUo45wbszybY=";
+      x86_64-darwin = "sha256-R6EwxfY5OERW4KyKDWC5XXSQYYcxSk28N+fB3b63E64=";
+      x86_64-linux = "sha256-CoWj5TPy55g725HAjqRPDqs77MJ15gs7qt3xj3HTkL8=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index 8b5bce45bb76..1fa0c05faa6f 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.28";
+  version = "3.0.29";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZAzj0KMGtm0817zKur088fAoYDMcnrlDXY+DjP5PIVY=";
+    hash = "sha256-D0cvYOaZZDXNknMlTwBjcJKkkkvCUoo05ozZaWUAilE=";
   };
 
-  vendorHash = "sha256-5cuOUGoSuuc5Ro1XVQGgW+flp3rqaXNhDewzeErq4k0=";
+  vendorHash = "sha256-k9gYJpg9wb0w5TLP15sY9SD6S7v8+pBSdeDyAzME0us=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index cc4e589eb38e..dcf44fab3ee5 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   dotnetCorePackages,
   technitium-dns-server-library,
+  libmsquic,
   nixosTests,
   nix-update-script,
 }:
@@ -36,6 +37,10 @@ buildDotnetModule rec {
     mv $out/bin/DnsServerApp $out/bin/technitium-dns-server
   '';
 
+  runtimeDeps = [
+    libmsquic
+  ];
+
   passthru.tests = {
     inherit (nixosTests) technitium-dns-server;
   };
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 2b8bdffb4de9..f945349ac638 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-1U24bdd4tvkzZmsRrrc4AUwxm9IhxHNAcPtxxX5ZO2w=";
-    "x86_64-linux" = "sha256-DCEqAePHkNj0bfgW5l83DyZG5+bre6C6C7AMbhxwytQ=";
-    "aarch64-linux" = "sha256-jKpt7hqCbgcBv9npR7IhryaCgrdOlX40Icq9T10/Af0=";
+    "universal-macos" = "sha256-47glX5O8MALXv8JFrbIGaj6LKJyRuZcR8yapwKmzWbc=";
+    "x86_64-linux" = "sha256-5HIxbswZV94Tem8LUVtGcx8cb00J5qGLBsNZR077Bm4=";
+    "aarch64-linux" = "sha256-wXiSL3hJ6yulrGagb5TflJSWujAQqpUGZtz+GJWcy0M=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.42";
+  version = "0.16.44";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 8982061c2f66..86d18be0fa64 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -60,6 +60,8 @@
   # Whether to use graphene-hardened-malloc
   useHardenedMalloc ? null,
 
+  # Whether to use IPC for communicating with Tor
+  useIPCTorService ? false,
   # Whether to disable multiprocess support
   disableContentSandbox ? false,
 
@@ -261,11 +263,13 @@ lib.warnIf (useHardenedMalloc != null)
         lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults");
         lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor");
 
-        // Insist on using IPC for communicating with Tor
+        // Optionally use IPC for communicating with Tor
         //
-        // Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
-        lockPref("extensions.torlauncher.control_port_use_ipc", true);
-        lockPref("extensions.torlauncher.socks_port_use_ipc", true);
+        // Sockets are created at \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
+        ${lib.optionalString useIPCTorService ''
+          lockPref("extensions.torlauncher.control_port_use_ipc", true);
+          lockPref("extensions.torlauncher.socks_port_use_ipc", true);
+        ''}
 
         // Optionally disable multiprocess support.  We always set this to ensure that
         // toggling the pref takes effect.
diff --git a/pkgs/by-name/vb/vbetool/package.nix b/pkgs/by-name/vb/vbetool/package.nix
deleted file mode 100644
index 9cf71be3c852..000000000000
--- a/pkgs/by-name/vb/vbetool/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pciutils,
-  libx86,
-  zlib,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "vbetool";
-  version = "1.1";
-
-  src = fetchurl {
-    url = "https://www.codon.org.uk/~mjg59/vbetool/download/${pname}-${version}.tar.gz";
-    sha256 = "0m7rc9v8nz6w9x4x96maza139kin6lg4hscy6i13fna4672ds9jd";
-  };
-
-  buildInputs = [
-    pciutils
-    libx86
-    zlib
-  ];
-
-  patchPhase = ''
-    substituteInPlace Makefile.in --replace '$(libdir)/libpci.a' ""
-  '';
-
-  configureFlags = [ "LDFLAGS=-lpci" ];
-
-  meta = with lib; {
-    description = "Video BIOS execution tool";
-    homepage = "https://www.codon.org.uk/~mjg59/vbetool/";
-    maintainers = [ maintainers.raskin ];
-    platforms = platforms.linux;
-    license = licenses.gpl2Only;
-    mainProgram = "vbetool";
-  };
-}
diff --git a/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix b/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
index 6497a0571c2f..8238f1fcbdeb 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
@@ -132,7 +132,13 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests.vm = nixosTests.lomiri-camera-app;
+    tests = {
+      inherit (nixosTests.lomiri-camera-app)
+        basic
+        v4l2-photo
+        v4l2-qr
+        ;
+    };
     updateScript = gitUpdater { rev-prefix = "v"; };
   };
 
diff --git a/pkgs/development/haskell-modules/with-packages-wrapper.nix b/pkgs/development/haskell-modules/with-packages-wrapper.nix
index d1b8aeebf4f8..528c87fef4b9 100644
--- a/pkgs/development/haskell-modules/with-packages-wrapper.nix
+++ b/pkgs/development/haskell-modules/with-packages-wrapper.nix
@@ -62,13 +62,6 @@ let
     else
       "$out/lib/${ghc.targetPrefix}${ghc.haskellCompilerName}"
       + lib.optionalString (ghc ? hadrian) "/lib";
-  # Boot libraries for GHC are present in a separate directory.
-  bootLibDir =
-    let
-      arch = if stdenv.targetPlatform.isAarch64 then "aarch64" else "x86_64";
-      platform = if stdenv.targetPlatform.isDarwin then "osx" else "linux";
-    in
-    "${ghc}/lib/${ghc.haskellCompilerName}/lib/${arch}-${platform}-${ghc.haskellCompilerName}";
   docDir = "$out/share/doc/ghc/html";
   packageCfgDir = "${libDir}/package.conf.d";
   paths = lib.concatLists (
@@ -154,14 +147,17 @@ else
           # symlinkJoin:
           rm -f $dynamicLinksDir/*
 
-          # Boot libraries are located differently than other libraries since GHC 9.6, so handle them separately.
-          if [[ -x "${bootLibDir}" ]]; then
-            find "${bootLibDir}" -name '*.dylib' -exec ln -s {} "$dynamicLinksDir" \;
-          fi
+          dynamicLibraryDirs=()
 
-          for d in $(grep -Poz "dynamic-library-dirs:\s*\K .+\n" $packageConfDir/*|awk '{print $2}'|sort -u); do
-            find "$d" -name '*.dylib' -exec ln -s {} "$dynamicLinksDir" \;
+          for pkg in $($out/bin/ghc-pkg list --simple-output); do
+            dynamicLibraryDirs+=($($out/bin/ghc-pkg --simple-output field "$pkg" dynamic-library-dirs))
           done
+
+          for dynamicLibraryDir in $(echo "''${dynamicLibraryDirs[@]}" | tr ' ' '\n' | sort -u); do
+            echo "Linking $dynamicLibraryDir/*.dylib from $dynamicLinksDir"
+            find "$dynamicLibraryDir" -name '*.dylib' -exec ln -s {} "$dynamicLinksDir" \;
+          done
+
           for f in $packageConfDir/*.conf; do
             # Initially, $f is a symlink to a read-only file in one of the inputs
             # (as a result of this symlinkJoin derivation).
diff --git a/pkgs/development/ocaml-modules/dream-html/default.nix b/pkgs/development/ocaml-modules/dream-html/default.nix
new file mode 100644
index 000000000000..30eb1d295781
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dream-html/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  buildDunePackage,
+  dream,
+  pure-html,
+}:
+
+buildDunePackage {
+  pname = "dream-html";
+  inherit (pure-html) src version;
+
+  propagatedBuildInputs = [
+    pure-html
+    dream
+  ];
+
+  meta = {
+    description = "Write HTML directly in your OCaml source files with editor support.";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.naora ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dream-html/pure.nix b/pkgs/development/ocaml-modules/dream-html/pure.nix
new file mode 100644
index 000000000000..468890756a77
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dream-html/pure.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  uri,
+}:
+
+buildDunePackage rec {
+  pname = "pure-html";
+  version = "3.10.1";
+
+  src = fetchFromGitHub {
+    owner = "yawaramin";
+    repo = "dream-html";
+    tag = "v${version}";
+    hash = "sha256-LywQG5AaQrrq8lW+aN1doB1MKPSMciZISOeo583Kr9k=";
+  };
+
+  propagatedBuildInputs = [ uri ];
+
+  meta = {
+    description = "Write HTML directly in your OCaml source files with editor support.";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.naora ];
+  };
+}
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 7e5bdb6fe4dc..e053c1d05e64 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.38.32";
+  version = "1.38.33";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-9XzbRPh7r1LiNpUdz50yuTqQbiHVwP45S0FmpcDhZzQ=";
+    hash = "sha256-Z8kVHow+dVvAMVvhSFPZq/j9FtHQ6AXnyvpdWFVUEL8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
index 5610ee08f322..a72d5a64746e 100644
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -5,7 +5,7 @@
   stdenv,
 
   # build-system
-  setuptools,
+  hatchling,
 
   # dependencies
   absl-py,
@@ -30,7 +30,7 @@
   pytinyrenderer,
   scipy,
   tensorboardx,
-  trimesh,
+  typing-extensions,
 
   # tests
   pytestCheckHook,
@@ -40,29 +40,27 @@
 
 buildPythonPackage rec {
   pname = "brax";
-  version = "0.12.1";
+  version = "0.12.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brax";
     tag = "v${version}";
-    hash = "sha256-whkkqTTy5CY6soyS5D7hWtBZuVHc6si1ArqwLgzHDkw=";
+    hash = "sha256-WshTiWK6XpwK2h/aw/YogA5pGo5U7RdZBz6UjD1Ft/4=";
   };
 
   build-system = [
-    setuptools
+    hatchling
   ];
 
   dependencies = [
     absl-py
-    # TODO: remove dm_env after dropping legacy v1 code
     dm-env
     etils
     flask
     flask-cors
     flax
-    # TODO: remove grpcio and gym after dropping legacy v1 code
     grpcio
     gym
     jax
@@ -76,11 +74,10 @@ buildPythonPackage rec {
     optax
     orbax-checkpoint
     pillow
-    # TODO: remove pytinyrenderer after dropping legacy v1 code
     pytinyrenderer
     scipy
     tensorboardx
-    trimesh
+    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/cddlparser/default.nix b/pkgs/development/python-modules/cddlparser/default.nix
new file mode 100644
index 000000000000..1737f4b85b48
--- /dev/null
+++ b/pkgs/development/python-modules/cddlparser/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # dependencies
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "cddlparser";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tidoust";
+    repo = pname;
+    tag = "v${version}";
+    sha256 = "sha256-Hrf6u5HeCICffgPAOcbb1FhybEVhgre7EXzQZhS8D9o=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  meta = {
+    homepage = "https://github.com/tidoust/cddlparser";
+    downloadPage = "https://github.com/tidoust/cddlparser/releases";
+    description = "Concise data definition language (RFC 8610) parser implementation in Python";
+    longDescription = ''
+      A CDDL parser in Python
+
+      Concise data definition language (RFC 8610) parser implementation in Python.
+    '';
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hemera ];
+  };
+}
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 6227c0cad43f..ba46d9c20872 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -134,8 +134,8 @@ rec {
       "sha256-0Ex+gq7lC3J1pxSpDZD6SJhxHnWosedNXMFMHdfG2Pc=";
 
   mypy-boto3-appsync =
-    buildMypyBoto3Package "appsync" "1.38.2"
-      "sha256-5hCTRhwqD1apJqpV/i2tLX09O6uA9Zn6c+gswBHO5H0=";
+    buildMypyBoto3Package "appsync" "1.38.33"
+      "sha256-M7OsH06ljwqo4U0f1gMpYmgZFvZIzLcm0DdwJa38IoM=";
 
   mypy-boto3-arc-zonal-shift =
     buildMypyBoto3Package "arc-zonal-shift" "1.38.0"
@@ -182,8 +182,8 @@ rec {
       "sha256-WXMpTKmBXa1q51tnLTE5sOxJyn0LLqOwpV2wdZfM1v0=";
 
   mypy-boto3-ce =
-    buildMypyBoto3Package "ce" "1.38.24"
-      "sha256-daz9r4KWlK/n3ZcxDRARlOlSKcUbhyW/12HPWja30RY=";
+    buildMypyBoto3Package "ce" "1.38.33"
+      "sha256-3VFyffSGPB1C/l4m7tLiDNYcuq+TU1K7gng+HETgDow=";
 
   mypy-boto3-chime =
     buildMypyBoto3Package "chime" "1.38.0"
@@ -366,8 +366,8 @@ rec {
       "sha256-lurpm+SfLFZKROAdMiPhthRnaihxDXTLO296JUQSbYc=";
 
   mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.38.0"
-      "sha256-EuS4aLejTOf1w1mkx1Yp9Rj2Dy10Rcrcrwnfe25/5cM=";
+    buildMypyBoto3Package "customer-profiles" "1.38.33"
+      "sha256-Gz5Qm83HTg5sjnqeMoM/mW+Qh7qq66vAnoc18l9Szjg=";
 
   mypy-boto3-databrew =
     buildMypyBoto3Package "databrew" "1.38.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-RQh46jrXqj4bXTRJ+tPR9sql7yUn7Ek9u4p0OU0A7b0=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.38.25"
-      "sha256-rtfXRsfGr34/dUJK1kgpp85blNyHERSkScQDraIpVMs=";
+    buildMypyBoto3Package "ec2" "1.38.33"
+      "sha256-XQf8ENX2gvhXAAC6U73sAO5JgXFQmUOHdFHCzMvDQaM=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.38.0"
@@ -466,8 +466,8 @@ rec {
       "sha256-f/ZRV3fRPB1B7xP8lJX/jPXVuFY+gdUm4lZJlZCj55k=";
 
   mypy-boto3-efs =
-    buildMypyBoto3Package "efs" "1.38.0"
-      "sha256-Z2LMQFtcTNqxsoWKGg4iBFtbwnXGVVXQrRa/bZdnl40=";
+    buildMypyBoto3Package "efs" "1.38.33"
+      "sha256-Yxumhn6IHvstfAvmJnRsf3Xpeq5j5l+cKnpYyMIOojY=";
 
   mypy-boto3-eks =
     buildMypyBoto3Package "eks" "1.38.28"
@@ -846,8 +846,8 @@ rec {
       "sha256-b9t29BqBHshYWb9g/GD6no1NXYVmsjwY6knE8cIZBEA=";
 
   mypy-boto3-marketplace-catalog =
-    buildMypyBoto3Package "marketplace-catalog" "1.38.0"
-      "sha256-thLr5C7nCa4NyRHIVIFGwWAfl572eUJ4Z7P22s52BDc=";
+    buildMypyBoto3Package "marketplace-catalog" "1.38.33"
+      "sha256-65S8wh5kDMdNXuPUJlwjXzt4SJ35P4nq/+UknulFMcQ=";
 
   mypy-boto3-marketplace-entitlement =
     buildMypyBoto3Package "marketplace-entitlement" "1.38.0"
diff --git a/pkgs/development/python-modules/scim2-models/default.nix b/pkgs/development/python-modules/scim2-models/default.nix
index 72b184d0ddd7..a3e2681e7ad9 100644
--- a/pkgs/development/python-modules/scim2-models/default.nix
+++ b/pkgs/development/python-modules/scim2-models/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "scim2-models";
-  version = "0.3.3";
+  version = "0.3.5";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "scim2_models";
-    hash = "sha256-od+1KaAwmZ1slsACYRYRpy92xz5s8hcopz0LiwVJhfA=";
+    hash = "sha256-nOLCYyyB7Si+KfwdWM7DCkDoaVEj/coUA//ZW3hKHuA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 852eacf43829..336ab08f6bae 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,16 +16,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.14.9"; # zen
+      version = "6.15.2"; # zen
       suffix = "zen1"; # zen
-      sha256 = "1v28cdv8dyn5181z242f63ns6b472jx8a7wmw77n5wijj8fv5ba1"; # zen
+      sha256 = "196vc361fqpiwqgpxa0kp1nfqs6gplah2qw48yrwlzxp08q9sfqn"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.14.9"; # lqx
+      version = "6.14.11"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "1f8sram3xabv119pznpixpm5igyxf33wkg4v8fm5nh9c9g91q19j"; # lqx
+      sha256 = "0gpg1rad2ljnnszpz78shsm98zw5bj6arr3xnsb2nanvx6axwbbw"; # lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 6bd33fcedf8e..0152be513915 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.20.2";
+  version = "2.20.3";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-GFM6smJv34IeDwOPdTDrHXfYFmHyPhdVxPB/0n4L3NE=";
+    hash = "sha256-Ma6h2ISMjBz14y5Pbx4T4QOMrrvUy5wkPyKawm9rpx0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3c3403991c8d..90b6166ded8b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2016,6 +2016,7 @@ mapAliases {
   varnish75Packages = throw "varnish 7.5 is EOL. Either use the LTS or upgrade."; # Added 2025-03-29
   varnish76 = throw "varnish 7.6 is EOL. Either use the LTS or upgrade."; # Added 2025-05-15
   varnish76Packages = throw "varnish 7.6 is EOL. Either use the LTS or upgrade."; # Added 2025-05-15
+  vbetool = throw "'vbetool' has been removed as it is broken and not maintained upstream."; # Added 2025-06-11
   vdirsyncerStable = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   ventoy-bin = ventoy; # Added 2023-04-12
   ventoy-bin-full = ventoy-full; # Added 2023-04-12
@@ -2055,7 +2056,7 @@ mapAliases {
     'wayfireApplications-unwrapped.wlroots' has been removed
   ''; # Add 2023-07-29
   waypoint = throw "waypoint has been removed from nixpkgs as the upstream project was archived"; # Added 2024-04-24
-  webkitgtk = lib.warnOnInstantiate "Explicitly set the ABI version of 'webkitgtk'" webkitgtk_4_0;
+  webkitgtk = throw "'webkitgtk' attribute has been removed from nixpkgs, use attribute with ABI version set explicitly"; # Added 2025-06-11
   webmetro = throw "'webmetro' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   wg-bond = throw "'wg-bond' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   whatsapp-for-linux = wasistlos; # Added 2025-01-30
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8c3d2dc9a9d6..e9fc8ca7f14b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1063,8 +1063,6 @@ with pkgs;
 
   auditwheel = with python3Packages; toPythonApplication auditwheel;
 
-  bikeshed = python3Packages.callPackage ../applications/misc/bikeshed { };
-
   davinci-resolve-studio = callPackage ../by-name/da/davinci-resolve/package.nix {
     studioVariant = true;
   };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f77338b65fb5..99509835f137 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -414,6 +414,8 @@ let
 
         dream = callPackage ../development/ocaml-modules/dream { };
 
+        dream-html = callPackage ../development/ocaml-modules/dream-html { };
+
         dream-httpaf = callPackage ../development/ocaml-modules/dream/httpaf.nix { };
 
         dream-pure = callPackage ../development/ocaml-modules/dream/pure.nix { };
@@ -1810,6 +1812,8 @@ let
           inherit (pkgs) pulseaudio;
         };
 
+        pure-html = callPackage ../development/ocaml-modules/dream-html/pure.nix { };
+
         pure-splitmix = callPackage ../development/ocaml-modules/pure-splitmix { };
 
         pyml = callPackage ../development/ocaml-modules/pyml { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 009db57172d6..242cba384997 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2318,6 +2318,8 @@ self: super: with self; {
 
   cdcs = callPackage ../development/python-modules/cdcs { };
 
+  cddlparser = callPackage ../development/python-modules/cddlparser { };
+
   celery = callPackage ../development/python-modules/celery { };
 
   celery-batches = callPackage ../development/python-modules/celery-batches { };