diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index dcee09968bc1..e57d853bb8cf 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1058,24 +1058,22 @@ in
         ++ (lib.optional (lib.versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
         ++ (lib.optional (lib.versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));
 
-      services.nextcloud.package =
-        with pkgs;
-        lib.mkDefault (
-          if pkgs ? nextcloud then
-            throw ''
-              The `pkgs.nextcloud`-attribute has been removed. If it's supposed to be the default
-              nextcloud defined in an overlay, please set `services.nextcloud.package` to
-              `pkgs.nextcloud`.
-            ''
-          else if versionOlder stateVersion "24.05" then
-            nextcloud27
-          else if versionOlder stateVersion "24.11" then
-            nextcloud29
-          else if versionOlder stateVersion "25.05" then
-            nextcloud30
-          else
-            nextcloud31
-        );
+      services.nextcloud.package = lib.mkDefault (
+        if pkgs ? nextcloud then
+          throw ''
+            The `pkgs.nextcloud`-attribute has been removed. If it's supposed to be the default
+            nextcloud defined in an overlay, please set `services.nextcloud.package` to
+            `pkgs.nextcloud`.
+          ''
+        else if lib.versionOlder stateVersion "24.05" then
+          pkgs.nextcloud27
+        else if lib.versionOlder stateVersion "24.11" then
+          pkgs.nextcloud29
+        else if lib.versionOlder stateVersion "25.05" then
+          pkgs.nextcloud30
+        else
+          pkgs.nextcloud31
+      );
 
       services.nextcloud.phpOptions = mkMerge [
         (lib.mapAttrs (lib.const lib.mkOptionDefault) defaultPHPSettings)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 82d53c0613c6..b24bc4d7d7af 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -699,6 +699,7 @@ in
     imports = [ ./odoo.nix ];
     _module.args.package = pkgs.odoo16;
   };
+  oku = runTest ./oku.nix;
   oncall = runTest ./web-apps/oncall.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
diff --git a/nixos/tests/oku.nix b/nixos/tests/oku.nix
new file mode 100644
index 000000000000..c63b343eab4c
--- /dev/null
+++ b/nixos/tests/oku.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "oku";
+
+  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];
+
+  nodes.machine = {
+    imports = [ ./common/x11.nix ];
+
+    environment.systemPackages = with pkgs; [ oku ];
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.wait_for_x()
+
+    with subtest("Wait until Oku has finished loading the Valgrind docs page"):
+      machine.execute("xterm -e 'oku -n file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' >&2 &");
+      machine.wait_for_window("oku")
+  '';
+
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index f05385ef4448..8ecedcffa4fb 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2972,8 +2972,8 @@ let
         mktplcRef = {
           name = "marp-vscode";
           publisher = "marp-team";
-          version = "3.2.0";
-          hash = "sha256-SSkmvm9NJnLw38luZWF6K7g5caaivtP+v+39qPR/oyo=";
+          version = "3.2.1";
+          hash = "sha256-c3e4vWmnR/enummRSfwlulPEAjZ9TlncnAU3SJcUEaI=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock
index 7f9606804dc9..eba2152740f9 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock
@@ -1,18 +1,18 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "anyhow"
-version = "1.0.91"
+version = "1.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c042108f3ed77fd83760a5fd79b53be043192bb3b9dba91d8c574c0ada7850c8"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
 
 [[package]]
 name = "goblin"
-version = "0.9.2"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53ab3f32d1d77146981dea5d6b1e8fe31eedcb7013e5e00d6ccd1259a4b4d923"
+checksum = "0e961b33649994dcf69303af6b3a332c1228549e604d455d61ec5d2ab5e68d3a"
 dependencies = [
  "log",
  "plain",
@@ -21,21 +21,21 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "plain"
@@ -45,18 +45,18 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.89"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -74,9 +74,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "same-file"
@@ -89,18 +89,18 @@ dependencies = [
 
 [[package]]
 name = "scroll"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+checksum = "c1257cd4248b4132760d6524d6dda4e053bc648c9070b960929bf50cfb1e7add"
 dependencies = [
  "scroll_derive",
 ]
 
 [[package]]
 name = "scroll_derive"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
+checksum = "22fc4f90c27b57691bbaf11d8ecc7cfbfe98a4da6dbe60226115d322aa80c06e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -109,18 +109,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.213"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.213"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -129,9 +129,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.132"
+version = "1.0.141"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+checksum = "30b9eff21ebe718216c6ec64e1d9ac57087aad11efc64e32002bce4a0d4c03d3"
 dependencies = [
  "itoa",
  "memchr",
@@ -141,9 +141,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.85"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -152,9 +152,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.13"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "walkdir"
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs
index 4aebfe276520..ab11ba807350 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs
@@ -43,6 +43,8 @@ struct PriorityKey {
     root_index: usize,
 }
 
+const FHSENV_MARKER_FILE: &str = "nix-support/is-fhsenv";
+
 fn build_reference_map(refs: Vec<RefGraphNode>) -> HashMap<PathBuf, Vec<PathBuf>> {
     refs.into_iter()
         .map(|mut gn| {
@@ -119,6 +121,11 @@ fn collect_candidate_paths(
     let mut candidates: HashMap<_, Vec<_>> = HashMap::new();
 
     for (path, priority) in paths {
+        if path.join(FHSENV_MARKER_FILE).exists() {
+            // is another fhsenv, skip it
+            continue;
+        }
+
         for entry in WalkDir::new(&path).follow_links(true) {
             let entry: PathBuf = match entry {
                 Ok(ent) => {
@@ -134,7 +141,7 @@ fn collect_candidate_paths(
                         // could be a broken symlink, that's fine, we still want to handle those
                         Some(_) => e
                             .path()
-                            .ok_or_else(|| anyhow!("I/O error when walking {path:?}"))?
+                            .ok_or_else(|| anyhow!("I/O error when walking {}", path.display()))?
                             .into(),
                         None => {
                             // symlink loop
@@ -256,14 +263,30 @@ fn build_env(out: &Path, plan: HashMap<PathBuf, PathBuf>) -> anyhow::Result<()>
             .parent()
             .ok_or(anyhow!("destination directory is root"))
             .with_context(|| {
-                format!("When trying to determine destination directory for {full_dest:?}")
+                format!(
+                    "When trying to determine destination directory for {}",
+                    full_dest.display()
+                )
             })?;
         fs::create_dir_all(dest_dir)
-            .with_context(|| format!("When trying to create directory {dest_dir:?}"))?;
-        ufs::symlink(&src, &full_dest)
-            .with_context(|| format!("When symlinking {src:?} to {full_dest:?}"))?;
+            .with_context(|| format!("When trying to create directory {}", dest_dir.display()))?;
+        ufs::symlink(&src, &full_dest).with_context(|| {
+            format!(
+                "When symlinking {} to {}",
+                src.display(),
+                full_dest.display()
+            )
+        })?;
     }
 
+    let marker = out.join(FHSENV_MARKER_FILE);
+    fs::create_dir_all(
+        marker
+            .parent()
+            .ok_or(anyhow!("marker file is in root, this should never happen"))?,
+    )?;
+    fs::write(marker, [])?;
+
     Ok(())
 }
 
@@ -283,7 +306,7 @@ fn main() -> anyhow::Result<()> {
 
         paths = extend_to_closure(paths, &refs)?;
         paths32 = extend_to_closure(paths32, &refs)?;
-    };
+    }
 
     let plan = build_plan(paths, paths32)?;
 
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 808447d76002..60926ec7c778 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "16.4.0";
+  version = "17.0.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Y0TvzOjkq/9/NG87iGhazLSZFnFCEG/S+lI4AJDAw0M=";
+    hash = "sha256-CMsvkASFVqmvIxvixoXYwvyAgp4Vq9rj17o50M8Fw1Q=";
   };
 
-  cargoHash = "sha256-PD6HycP6+/tKafirCc2Oj0MffHizLqTmDIrdIOmXY/w=";
+  cargoHash = "sha256-kp9liu8ZGL9Q+rH9XKWMgsA9hvkYEim90RdMp2+dVPg=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ch/changie/package.nix b/pkgs/by-name/ch/changie/package.nix
index ca9913242849..66afca7ebe98 100644
--- a/pkgs/by-name/ch/changie/package.nix
+++ b/pkgs/by-name/ch/changie/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "changie";
-  version = "1.22.0";
+  version = "1.22.1";
 
   src = fetchFromGitHub {
     owner = "miniscruff";
     repo = "changie";
     rev = "v${version}";
-    hash = "sha256-tq29L9YlzhjbHkUfE0ZZhSrH+rcAwgYjcEAUjP/lHm8=";
+    hash = "sha256-JXVrOZKm8whmc3LkCDsbZkNcYMgiolp9dgnZFPYCtAs=";
   };
 
-  vendorHash = "sha256-nAwBVa+UssbfFbcOWFcsWUllBTeW89xPcgS+ofXDPf0=";
+  vendorHash = "sha256-bUopfHd6/0dd3OuxQMW9ZNsZtVqnRSDRqZLkfaQq12I=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 8d61f121b2ce..bf48ac6ccfc9 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -44,6 +44,7 @@ buildNpmPackage rec {
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       malo
+      markus1189
       omarjatoi
     ];
     mainProgram = "claude";
diff --git a/pkgs/by-name/dd/ddev/package.nix b/pkgs/by-name/dd/ddev/package.nix
index 85d1f0e837e8..4f16cf3970c8 100644
--- a/pkgs/by-name/dd/ddev/package.nix
+++ b/pkgs/by-name/dd/ddev/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "ddev";
-  version = "1.24.6";
+  version = "1.24.7";
 
   src = fetchFromGitHub {
     owner = "ddev";
     repo = "ddev";
     rev = "v${version}";
-    hash = "sha256-vOf500/HdOWn24MdXDfbetqAyKbEsaut707O+Rndks8=";
+    hash = "sha256-1BlipTmpjoHjzDz5ueCYn410qzsVePikA1c5Z93Rboo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 7978a08926db..03b67dee3e2b 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -30,7 +30,7 @@ let
         __intentionallyOverridingVersion = true;
       });
 
-  version = "1.8";
+  version = "1.8.1";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
@@ -40,10 +40,10 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-Cg4DxHCZiXiSlbwveJpyCFzWIblWi467I2/pmsAWiAw=";
+    hash = "sha256-YsSFlVWUu4RSYnObqcBJ4Mr3bJVVhuFhaQAktHytBAI=";
   };
 
-  cargoHash = "sha256-uUI0O60x8AVG85MJYzEbNdsO818yFu4w66WuozboWso=";
+  cargoHash = "sha256-zJorGAsp5k5oBuXogYqEPVexcNsYCeiTmrQqySd1AGs=";
 
   buildAndTestSubdir = "devenv";
 
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index 792dc071f795..a3712886f8db 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -106,12 +106,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "301";
+  version = "302";
   format = "setuptools";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-piTdP812LgcxvvgvUOKUrkxVXCbclyQW8dp84beT7H4=";
+    hash = "sha256-PngiG+nPaPrGHt+uTeH7R+MlKjPXFxfkFiDo6+pssTw=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fi/figma-agent/0001-update-time.patch b/pkgs/by-name/fi/figma-agent/0001-update-time.patch
deleted file mode 100644
index b136a02d49eb..000000000000
--- a/pkgs/by-name/fi/figma-agent/0001-update-time.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From aaa07b6430c555a8c41f458ccf0eca2213e82317 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Sat, 28 Sep 2024 11:06:40 +0800
-Subject: [PATCH] update time
-
----
- Cargo.lock | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/Cargo.lock b/Cargo.lock
-index 282fe41..8b308d5 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -952,6 +952,12 @@ dependencies = [
-  "minimal-lexical",
- ]
- 
-+[[package]]
-+name = "num-conv"
-+version = "0.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-+
- [[package]]
- name = "object"
- version = "0.32.2"
-@@ -1313,12 +1319,13 @@ dependencies = [
- 
- [[package]]
- name = "time"
--version = "0.3.31"
-+version = "0.3.36"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
-+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
- dependencies = [
-  "deranged",
-  "itoa",
-+ "num-conv",
-  "powerfmt",
-  "serde",
-  "time-core",
-@@ -1333,10 +1340,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
- 
- [[package]]
- name = "time-macros"
--version = "0.2.16"
-+version = "0.2.18"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
-+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
- dependencies = [
-+ "num-conv",
-  "time-core",
- ]
- 
--- 
-2.46.0
-
diff --git a/pkgs/by-name/fi/figma-agent/package.nix b/pkgs/by-name/fi/figma-agent/package.nix
index 352768e95c92..f4c6bd2a27a5 100644
--- a/pkgs/by-name/fi/figma-agent/package.nix
+++ b/pkgs/by-name/fi/figma-agent/package.nix
@@ -6,22 +6,18 @@
   fontconfig,
   freetype,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "figma-agent";
-  version = "0.3.2";
+  version = "0.3.2-unstable-2024-11-16";
 
   src = fetchFromGitHub {
     owner = "neetly";
     repo = "figma-agent-linux";
-    tag = version;
-    sha256 = "sha256-iXLQOc8gomOik+HIIoviw19II5MD6FM0W5DT3aqtIcM=";
+    rev = "6709a1b7ffcbfb227472d8f017bfbbda77ddca7d";
+    sha256 = "sha256-Cq+ivyrj6wt7DEUM730BG44sMkpOMt4qxb+J3itVar4=";
   };
 
-  cargoPatches = [
-    ./0001-update-time.patch
-  ];
-
-  cargoHash = "sha256-4OAce76XCLlngC7BrX8eiQlHo+Mi2Tfrb9t1Rc/gSFA=";
+  cargoHash = "sha256-QdEs1zaQ2CQT50nIhKxtp7zpJfa64xQgOy3sTOUGmxk=";
 
   nativeBuildInputs = [
     pkg-config
@@ -33,11 +29,17 @@ rustPlatform.buildRustPackage rec {
     freetype
   ];
 
+  checkFlags = [
+    # All tests fail due to unavailable bindings
+    "--skip=figma-agent-freetype-sys"
+  ];
+
   meta = {
+    description = "Figma Agent for Linux with a focus on performance";
     homepage = "https://github.com/neetly/figma-agent-linux";
-    description = "Figma Agent for Linux (a.k.a. Font Helper)";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ];
     mainProgram = "figma-agent";
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/go/go-jsonschema/package.nix b/pkgs/by-name/go/go-jsonschema/package.nix
new file mode 100644
index 000000000000..791122bbe7a9
--- /dev/null
+++ b/pkgs/by-name/go/go-jsonschema/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "go-jsonschema";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "omissis";
+    repo = "go-jsonschema";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e1eL5Blf9l4cSR7Tg740eTFza3ViJEiwLaoUsUZzQu4=";
+  };
+
+  vendorHash = "sha256-vHtigJ2YNFFWGxv6/pGwmmGE0Fn+2S7NguyrhVME7ak=";
+
+  ldflags = [
+    "-X main.version=v${finalAttrs.version}"
+    "-s"
+    "-w"
+  ];
+
+  env.GOWORK = "off";
+
+  # Tests are in a nested Go module which makes things difficult.
+  preBuild = ''
+    rm -rf tests
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A tool to generate Go data types from JSON Schema definitions.";
+    homepage = "https://github.com/omissis/go-jsonschema";
+    changelog = "https://github.com/omissis/go-jsonschema/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      shellhazard
+    ];
+    mainProgram = "go-jsonschema";
+  };
+})
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index 82bf5dd47c73..d0a1441a0600 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -15,6 +15,7 @@
   legendary-heroic,
   nile,
   comet-gog,
+  umu-launcher,
 }:
 
 let
@@ -90,6 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper "${electron}/bin/electron" "$out/bin/heroic" \
       --inherit-argv0 \
       --set ELECTRON_FORCE_IS_PACKAGED 1 \
+      --suffix PATH ":" "${umu-launcher}/bin" \
       --add-flags --disable-gpu-compositing \
       --add-flags $out/opt/heroic/resources/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
diff --git a/pkgs/by-name/he/heroic/package.nix b/pkgs/by-name/he/heroic/package.nix
index d9410e5d606f..77dc9a494db8 100644
--- a/pkgs/by-name/he/heroic/package.nix
+++ b/pkgs/by-name/he/heroic/package.nix
@@ -1,160 +1,22 @@
 {
-  buildFHSEnv,
+  steam,
   heroic-unwrapped,
   extraPkgs ? pkgs: [ ],
   extraLibraries ? pkgs: [ ],
 }:
 
-buildFHSEnv {
+steam.buildRuntimeEnv {
   pname = "heroic";
-  inherit (heroic-unwrapped) version;
+  inherit (heroic-unwrapped) version meta;
 
   runScript = "heroic";
 
-  # Many Wine and native games need 32-bit libraries.
-  multiArch = true;
-
-  # required by Electron
-  unshareIpc = false;
-
-  targetPkgs =
-    pkgs:
-    with pkgs;
-    [
-      heroic-unwrapped
-      gamemode
-      curl
-      gawk
-      zenity
-      kdePackages.kdialog
-      mangohud
-      net-tools
-      opencl-headers
-      p7zip
-      pciutils
-      perl
-      psmisc
-      python3
-      umu-launcher
-      unzip
-      which
-      xorg.xrandr
-      zstd
-    ]
-    ++ extraPkgs pkgs;
-
-  multiPkgs =
-    let
-      xorgDeps =
-        pkgs: with pkgs.xorg; [
-          libICE
-          libpthreadstubs
-          libSM
-          libX11
-          libXaw
-          libxcb
-          libXcomposite
-          libXcursor
-          libXdmcp
-          libXext
-          libXfixes
-          libXi
-          libXinerama
-          libXmu
-          libXrandr
-          libXrender
-          libXScrnSaver
-          libXt
-          libXtst
-          libXv
-          libXxf86vm
-        ];
-      gstreamerDeps =
-        pkgs: with pkgs.gst_all_1; [
-          gstreamer
-          gst-plugins-base
-          gst-plugins-good
-          gst-plugins-ugly
-          gst-plugins-bad
-          gst-libav
-        ];
-    in
-    pkgs:
-    with pkgs;
-    [
-      alsa-lib
-      alsa-plugins
-      bash
-      cabextract
-      cairo
-      coreutils
-      cups
-      dbus
-      freealut
-      freetype
-      fribidi
-      giflib
-      glib
-      gnutls
-      gtk3
-      icu
-      lcms2
-      libevdev
-      libgcrypt
-      libGLU
-      libglvnd
-      libgpg-error
-      libgudev
-      libjpeg
-      libkrb5
-      libmpeg2
-      libogg
-      libopus
-      libpng
-      libpulseaudio
-      libselinux
-      libsndfile
-      libtheora
-      libtiff
-      libunwind
-      libusb1
-      libv4l
-      libva
-      libvdpau
-      libvorbis
-      libvpx
-      libwebp
-      libxkbcommon
-      libxml2
-      mpg123
-      ncurses
-      ocl-icd
-      openal
-      openldap
-      openssl
-      pango
-      pipewire
-      samba4
-      sane-backends
-      SDL2
-      speex
-      sqlite
-      udev
-      unixODBC
-      util-linux
-      vulkan-loader
-      wayland
-      zlib
-    ]
-    ++ xorgDeps pkgs
-    ++ gstreamerDeps pkgs
-    ++ extraLibraries pkgs;
+  extraPkgs = pkgs: [ heroic-unwrapped ] ++ extraPkgs pkgs;
+  inherit extraLibraries;
 
   extraInstallCommands = ''
     mkdir -p $out/share
     ln -s ${heroic-unwrapped}/share/applications $out/share
     ln -s ${heroic-unwrapped}/share/icons $out/share
   '';
-
-  meta = heroic-unwrapped.meta;
 }
diff --git a/pkgs/by-name/hu/hugo/package.nix b/pkgs/by-name/hu/hugo/package.nix
index d73afb063612..d36b2d63f092 100644
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hugo";
-  version = "0.148.1";
+  version = "0.148.2";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EGga3tSaq+95s+3iamiCZ0qfdLE6Nw3hhZ7t54OIRjU=";
+    hash = "sha256-6ILQRihdVkDrL5sEITfGzzMzXFmvYpO39s/QeUAVW6o=";
   };
 
   vendorHash = "sha256-vckvhw1kpcI2SXSNjUR6u5o21qz9ZcWw+namDglpwxc=";
diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index a155b272b2af..fc6aa4731167 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-07-18";
+  version = "0.1-unstable-2025-07-23";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "481175e17e155f19a3b31416530b6edf725e7034";
-    hash = "sha256-usBNOT/uzFdsKDe5Ik+C36zqL+BfT7Lp2rqKWrpQuqk=";
+    rev = "6839b23345b71db17cd408373de4f5605bf589b8";
+    hash = "sha256-PFAJoEqQWMlo1J+yZb+4HixmhbRVmmNl58e/AkLYDDI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";
diff --git a/pkgs/by-name/jf/jfrog-cli/package.nix b/pkgs/by-name/jf/jfrog-cli/package.nix
index 89c944735b6e..838055c897a5 100644
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.77.0";
+  version = "2.78.1";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${version}";
-    hash = "sha256-CUmx2hQppay8S+zBs4XEXle8pF5mVXPyCJhtYyZ1N8M=";
+    hash = "sha256-9lhoAgu7y+JbZk/Cee2G74nhEJ4C2KKStcBistuIRtE=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-TmOzexlojVF+9WqbEVzKFfbdgjGVzyBgeKjFEX5UobI=";
+  vendorHash = "sha256-8Aaxwysbuzo2n2w4OPn7jooqrjEGwrZAlgec3j/pN2A=";
 
   checkFlags = "-skip=^TestReleaseBundle";
 
diff --git a/pkgs/by-name/ju/juju/package.nix b/pkgs/by-name/ju/juju/package.nix
index 352c49a86c62..38ebbc9ea81e 100644
--- a/pkgs/by-name/ju/juju/package.nix
+++ b/pkgs/by-name/ju/juju/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "juju";
-  version = "3.6.7";
+  version = "3.6.8";
 
   src = fetchFromGitHub {
     owner = "juju";
     repo = "juju";
     rev = "v${version}";
-    hash = "sha256-FJ6LZcsokno+VTj+mXO0YD8Q9qC5qG3CgXqnrPNokRY=";
+    hash = "sha256-Y+sUR8HURkiICa6lffz0u3CeX9bzOjtbFOdvy7PaZfU=";
   };
 
-  vendorHash = "sha256-blzjN9UknamoffR5Kpd1HmGhB+bWb+zL0SnzelW40M0=";
+  vendorHash = "sha256-ghgXwaSyOVW3Viw+xA9r6KogKWJp0IWMByVdWCbE6hY=";
 
   subPackages = [
     "cmd/juju"
diff --git a/pkgs/by-name/li/lianad/package.nix b/pkgs/by-name/li/lianad/package.nix
index 07d7f1c65c14..e4590334f008 100644
--- a/pkgs/by-name/li/lianad/package.nix
+++ b/pkgs/by-name/li/lianad/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lianad";
-  version = "11.1"; # keep in sync with liana
+  version = "12.0"; # keep in sync with liana
 
   src = fetchFromGitHub {
     owner = "wizardsardine";
     repo = "liana";
     rev = "v${version}";
-    hash = "sha256-trP6jnhMPASPkV7VwSHCl7gUhmx4F+68YK/QK+SPPZg=";
+    hash = "sha256-TZUNYr7p4P/++eX9ZNU/d1IurPrkZn/PJmJOsB01VMY=";
   };
 
-  cargoHash = "sha256-Zmxb4ZxuIyyKWrGaX3/1UHgkmo/XtqIHuP9luAnzgm4=";
+  cargoHash = "sha256-Hb5icOKgQiDzFLWwUfkwXcr1vn80QcAr+fKwG37PkYc=";
 
   buildInputs = [ udev ];
 
diff --git a/pkgs/by-name/ok/oku/package.nix b/pkgs/by-name/ok/oku/package.nix
index 08dcd44594a9..8b2a87d90e2f 100644
--- a/pkgs/by-name/ok/oku/package.nix
+++ b/pkgs/by-name/ok/oku/package.nix
@@ -12,6 +12,7 @@
   pango,
   webkitgtk_6_0,
   nix-update-script,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -55,7 +56,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cp -r ${finalAttrs.src}/data/hicolor $out/share/icons
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) oku; };
+  };
 
   meta = {
     description = "Browser for the Oku Network and Peer-to-peer sites";
diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix
index 1d637fc6640b..51aee9311bcf 100644
--- a/pkgs/by-name/op/open-policy-agent/package.nix
+++ b/pkgs/by-name/op/open-policy-agent/package.nix
@@ -49,6 +49,10 @@ buildGoModule (finalAttrs: {
         "TestInterQueryCache_ClientError"
         "TestIntraQueryCache_ClientError"
         "TestSSOCredentialService"
+
+        # This test depends on the metrics available in go not changing. This is a bit
+        # too unstable for us updating go independently.
+        "TestJSONSerialization"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         # Skip tests that require network, not available in the darwin sandbox
diff --git a/pkgs/by-name/pr/prctl/package.nix b/pkgs/by-name/pr/prctl/package.nix
new file mode 100644
index 000000000000..bceefb5496df
--- /dev/null
+++ b/pkgs/by-name/pr/prctl/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  versionCheckHook,
+  nix-update-script,
+  bash,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prctl";
+  version = "1.7";
+
+  src = fetchFromGitHub {
+    owner = "hikerockies";
+    repo = "prctl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1b8SO70mp0ACL3hw/iwKpPUpI5G7hF7l84hlSDHB2oA=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  patches = [
+    # Eliminate unsafe strcpy() calls,
+    # cf. <https://github.com/hikerockies/prctl/pull/1>
+    ./prctl-strcpy-overflow.patch
+
+    # Correct option parsing,
+    # cf. <https://github.com/hikerockies/prctl/pull/2>
+    ./prctl-getopt.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace prctl.c \
+      --replace-fail '"/bin/bash"' '"${lib.getExe bash}"'
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool to query and modify process behaviour";
+    homepage = "https://tracker.debian.org/pkg/prctl";
+    changelog = "https://github.com/hikerockies/prctl/blob/v${finalAttrs.version}/ChangeLog";
+    mainProgram = "prctl";
+    maintainers = with lib.maintainers; [ mvs ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pr/prctl/prctl-getopt.patch b/pkgs/by-name/pr/prctl/prctl-getopt.patch
new file mode 100644
index 000000000000..2d1b0577c128
--- /dev/null
+++ b/pkgs/by-name/pr/prctl/prctl-getopt.patch
@@ -0,0 +1,55 @@
+From 6745b6362681f57823a57575a7949bd510767ac4 Mon Sep 17 00:00:00 2001
+From: Mikael Voss <mvs@nyantec.com>
+Date: Wed, 23 Jul 2025 18:37:10 +0200
+Subject: [PATCH 1/2] Replace unsound use of EOF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While getopt_long returns -1 on error, EOF is an implementation‐defined
+negative integer constant that just happens to be defined as -1 by most
+C standard libraries.
+---
+ prctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/prctl.c b/prctl.c
+index 38cbcd1..527584c 100644
+--- a/prctl.c
++++ b/prctl.c
+@@ -299,8 +299,8 @@ main(int argc, char **argv)
+ 		exit(1);
+ 	}
+ 	opterr = 0;
+-	while ((opt = getopt_long(argc, argv, "+qhv", longopts, 
+-					(int *) NULL)) != EOF) {
++	while ((opt = getopt_long(argc, argv, "+qhv", longopts,
++					(int *) NULL)) != -1) {
+ 		switch (opt) {
+ 		case 'u':
+ 			if (strcmp(optarg, "silent") == 0) {
+
+From 0c11b937c30e41e97c3fa852f6d65cd595bc193f Mon Sep 17 00:00:00 2001
+From: Mikael Voss <mvs@nyantec.com>
+Date: Wed, 23 Jul 2025 18:54:39 +0200
+Subject: [PATCH 2/2] Properly display invalid long options
+
+---
+ prctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/prctl.c b/prctl.c
+index 527584c..4c1d632 100644
+--- a/prctl.c
++++ b/prctl.c
+@@ -375,8 +375,8 @@ main(int argc, char **argv)
+ 			break;
+ 
+ 		case '?':
+-			fprintf(stderr, "%s: invalid option - %c\n", 
+-					progname, optopt);
++			fprintf(stderr, "%s: invalid option: %s\n",
++					progname, argv[optind - 1]);
+ 			exit(1);
+ 			break;
+ 		}
diff --git a/pkgs/by-name/pr/prctl/prctl-strcpy-overflow.patch b/pkgs/by-name/pr/prctl/prctl-strcpy-overflow.patch
new file mode 100644
index 000000000000..ccdeab089a26
--- /dev/null
+++ b/pkgs/by-name/pr/prctl/prctl-strcpy-overflow.patch
@@ -0,0 +1,138 @@
+From 079877486d9bbe170de2fbc3cba37713d11ab224 Mon Sep 17 00:00:00 2001
+From: Mikael Voss <mvs@nyantec.com>
+Date: Wed, 23 Jul 2025 17:33:04 +0200
+Subject: [PATCH 1/2] Avoid unnecessary copy of argv[0]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The programme is copying the contents of *argv[0] into a fixed‐size
+buffer of 512 bytes using strcpy(). This might result in a buffer
+overflow and is unnecessary as the contents are never modified.
+---
+ prctl.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/prctl.c b/prctl.c
+index 38cbcd1..b8cb85b 100644
+--- a/prctl.c
++++ b/prctl.c
+@@ -51,13 +51,13 @@ struct option longopts[] = {
+ int verbose=0;
+ 
+ void
+-print_version(char *progname)
++print_version(char const *progname)
+ {
+ 	printf("%s version %s\n", progname, VERSION);
+ }
+ 
+ void
+-usage(char *progname)
++usage(char const *progname)
+ {
+ 	print_version(progname);
+ 	printf("Usage: %s [-v] [-h|--help] [--version]\n", progname);
+@@ -273,8 +273,7 @@ int
+ main(int argc, char **argv)
+ {
+ 	int opt, cmd_start;
+-	char *progname;
+-	char fullpath[512];
++	char const *progname;
+ 	char shellname[128];
+ 	int unaligned_val = -99;
+ 	int fpemu_val = -99;
+@@ -284,11 +283,10 @@ main(int argc, char **argv)
+ 	int display_all = 0;
+ 	int umask;
+ 
+-	strcpy(fullpath, argv[0]);
+-	if ((progname = strrchr(fullpath, '/')) != NULL) {
++	if ((progname = strrchr(argv[0], '/')) != NULL) {
+ 		progname++;
+ 	} else {
+-		progname = fullpath;
++		progname = argv[0];
+ 	}
+ 
+ 	/*
+
+From c233d083cec389e10dc9e85b3a835cf81246c275 Mon Sep 17 00:00:00 2001
+From: Mikael Voss <mvs@nyantec.com>
+Date: Wed, 23 Jul 2025 17:57:59 +0200
+Subject: [PATCH 2/2] Avoid unnecessary copy of shell path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The programme tries getenv("SHELL") and getpwuid(getuid())->pw_shell to
+determine the preferred shell, falling back to DEFAULT_SHELL, and
+copies the contents pointed to into a fixed‐sized buffer of 128 bytes
+using strcpy().
+
+This could result in a buffer overflow and is not necessary: While both
+getenv() and getpwuid() return pointers to locations which might get
+modified by subsequent calls to their respective function families,
+they are only called once, so that these pointers can be aliased safely.
+
+In addition, getenv("SHELL") would return a null pointer if the variable
+is unset in the environment, resulting in a null pointer dereference in
+the enclosing strcpy() call.
+---
+ prctl.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/prctl.c b/prctl.c
+index b8cb85b..342419c 100644
+--- a/prctl.c
++++ b/prctl.c
+@@ -274,7 +274,7 @@ main(int argc, char **argv)
+ {
+ 	int opt, cmd_start;
+ 	char const *progname;
+-	char shellname[128];
++	char const *shellname;
+ 	int unaligned_val = -99;
+ 	int fpemu_val = -99;
+ 	int mcekill_val = -99;
+@@ -443,31 +443,27 @@ main(int argc, char **argv)
+ 		}
+ 
+ 		printf("Starting a shell\n");
+-		strcpy(shellname, getenv("SHELL"));
+-		
++		shellname = getenv("SHELL");
++
+ 		/*
+ 		 * Make sure SHELL environment variable is not unset. If it
+-		 * is, start bash.
++		 * is, start user login shell or bash.
+ 		 */
+-		if (shellname[0] == 0) {
++		if (shellname == NULL) {
+ 			struct passwd *pwd_entry;
+ 
+ 			pwd_entry = getpwuid(getuid());
+-			if (pwd_entry == NULL) {
+-				strcpy(shellname, DEFAULT_SHELL);
++			if (pwd_entry != NULL && pwd_entry->pw_shell != NULL) {
++				shellname = pwd_entry->pw_shell;
+ 			} else {
+-				if (pwd_entry->pw_shell != NULL) {
+-					strcpy(shellname, pwd_entry->pw_shell);
+-				} else {
+-					strcpy(shellname, DEFAULT_SHELL);
+-				}
++				shellname = DEFAULT_SHELL;
+ 			}
+ 		}
+ 
+ 		/*
+ 		 * Now exec the shell
+ 		 */
+-		if (execlp(shellname, (char *)shellname, (char *) 0) == -1) {
++		if (execlp(shellname, shellname, (char *) 0) == -1) {
+ 			fprintf(stderr, "Failed to exec the shell: %s\n",
+ 				strerror(errno));
+ 			exit(1);
diff --git a/pkgs/by-name/q2/q2pro/package.nix b/pkgs/by-name/q2/q2pro/package.nix
index 4b2a3126ef0e..8370fa110e02 100644
--- a/pkgs/by-name/q2/q2pro/package.nix
+++ b/pkgs/by-name/q2/q2pro/package.nix
@@ -32,18 +32,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "q2pro";
-  version = "0-unstable-2025-05-03";
+  version = "0-unstable-2025-07-21";
 
   src = fetchFromGitHub {
     owner = "skullernet";
     repo = "q2pro";
-    rev = "aba81ef8bc277e9a4e11733a449a29d07ea28c7a";
-    hash = "sha256-5iUvHmqhB8X9ylTMS1va4qTnPCRPI4yOg2L0Qp2d9hE=";
+    rev = "3aa0d40ba58935154b0d2a02116021bfbb4f17e8";
+    hash = "sha256-aqpOoECNKozbCWnCFpyTCbUlTx8tdpqjMAES7x9yEM0=";
   };
 
   # build date and rev number is displayed in the game's console
-  revCount = "3817"; # git rev-list --count ${src.rev}
-  SOURCE_DATE_EPOCH = "1746223027"; # git show -s --format=%ct ${src.rev}
+  revCount = "3832"; # git rev-list --count ${src.rev}
+  SOURCE_DATE_EPOCH = "1753090158"; # git show -s --format=%ct ${src.rev}
 
   nativeBuildInputs = [
     meson
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index e0ec3fc63f6d..13f123162263 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.24.4";
+  version = "3.24.5";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-MvLqKqFFrd3EV/9TEhYqn7lArWfNYzUg4UNUSFT2Nek=";
+    hash = "sha256-yO7sq4WZ39TtpZ6MD8rWZgJXl2P6IOLbnzxCN8caEN0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
index b084848360f8..ca30523c5e5d 100644
--- a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
+++ b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rabbitmqadmin-ng";
-  version = "2.2.1";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${version}";
-    hash = "sha256-F/AkkmGn6LvbCiSE3znl/U/YDYLGQ7SCe0lBDTBzqic=";
+    hash = "sha256-ifvSDtj+A9wR6tvM82bzP9I4ZpOYrIzqkGtL7jFfPvQ=";
   };
 
-  cargoHash = "sha256-ZldTiRsxJH3UYNC9KeQ4WtPM75CtcAB6sbo3yzzZ5xA=";
+  cargoHash = "sha256-7r44ouNmqycF9ZBccR0iN6qps1oc7sjQCgK0G19zzF0=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/si/signal-export/package.nix b/pkgs/by-name/si/signal-export/package.nix
index 83b12f5c6350..98cd13ae136b 100644
--- a/pkgs/by-name/si/signal-export/package.nix
+++ b/pkgs/by-name/si/signal-export/package.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "signal-export";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "signal_export";
-    hash = "sha256-lflRY6EC9fqgdYwQ9Incc2PJ22okZC9Juu6X7pxGJ8w=";
+    hash = "sha256-xaXU+SODijD/iq2owj5IPKL+L2nrVfi573P58Txz8io=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/st/steam/package.nix b/pkgs/by-name/st/steam/package.nix
index 57af5f00af64..06c08f7490ef 100644
--- a/pkgs/by-name/st/steam/package.nix
+++ b/pkgs/by-name/st/steam/package.nix
@@ -13,161 +13,191 @@
   privateTmp ? true, # if the steam bubblewrap should isolate /tmp
 }:
 let
-  steamEnv =
+  buildRuntimeEnv =
     {
-      name,
-      runScript,
-      passthru ? { },
-      meta ? { },
-    }:
-    buildFHSEnv {
-      inherit
-        name
-        runScript
-        passthru
-        meta
-        privateTmp
-        ;
+      extraPkgs ? pkgs: [ ],
+      extraLibraries ? pkgs: [ ],
+      extraProfile ? "",
+      extraPreBwrapCmds ? "",
+      extraBwrapArgs ? [ ],
+      extraEnv ? { },
+      ...
+    }@args:
+    buildFHSEnv (
+      (builtins.removeAttrs args [
+        "extraPkgs"
+        "extraLibraries"
+        "extraProfile"
+        "extraPreBwrapCmds"
+        "extraBwrapArgs"
+        "extraArgs"
+        "extraEnv"
+      ])
+      // {
+        inherit privateTmp;
 
-      multiArch = true;
-      includeClosures = true;
+        multiArch = true;
+        includeClosures = true;
 
-      # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#command-line-tools
-      targetPkgs =
-        pkgs:
-        with pkgs;
-        [
-          steam-unwrapped
+        # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#command-line-tools
+        targetPkgs =
+          pkgs:
+          with pkgs;
+          [
+            bash
+            coreutils
+            file
+            lsb-release # not documented, called from Big Picture
+            pciutils # not documented, complains about lspci on startup
+            glibc_multi.bin
+            xdg-utils # calls xdg-open occasionally
+            xz
+            zenity
 
-          bash
-          coreutils
-          file
-          lsb-release # not documented, called from Big Picture
-          pciutils # not documented, complains about lspci on startup
-          glibc_multi.bin
-          xdg-utils # calls xdg-open occasionally
-          xz
-          zenity
+            # Steam expects it to be /sbin specifically
+            (pkgs.runCommand "sbin-ldconfig" { } ''
+              mkdir -p $out/sbin
+              ln -s /bin/ldconfig $out/sbin/ldconfig
+            '')
 
-          # Steam expects it to be /sbin specifically
-          (pkgs.runCommand "sbin-ldconfig" { } ''
-            mkdir -p $out/sbin
-            ln -s /bin/ldconfig $out/sbin/ldconfig
-          '')
+            # crashes on startup if it can't find libX11 locale files
+            (pkgs.runCommand "xorg-locale" { } ''
+              mkdir -p $out
+              ln -s ${xorg.libX11}/share $out/share
+            '')
+          ]
+          ++ extraPkgs pkgs;
 
-          # crashes on startup if it can't find libX11 locale files
-          (pkgs.runCommand "xorg-locale" { } ''
-            mkdir -p $out
-            ln -s ${xorg.libX11}/share $out/share
-          '')
-        ]
-        ++ extraPkgs pkgs;
+        # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#shared-libraries
+        multiPkgs =
+          pkgs:
+          with pkgs;
+          [
+            glibc
+            libxcrypt
+            libGL
 
-      # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#shared-libraries
-      multiPkgs =
-        pkgs:
-        with pkgs;
-        [
-          glibc
-          libxcrypt
-          libGL
+            libdrm
+            libgbm
+            udev
+            libudev0-shim
+            libva
+            vulkan-loader
 
-          libdrm
-          libgbm
-          udev
-          libudev0-shim
-          libva
-          vulkan-loader
+            networkmanager
+            # not documented, used for network status things in Big Picture
+            # FIXME: figure out how to only build libnm?
+            libcap # not documented, required by srt-bwrap
+          ]
+          ++ extraLibraries pkgs;
 
-          networkmanager
-          # not documented, used for network status things in Big Picture
-          # FIXME: figure out how to only build libnm?
-          libcap # not documented, required by srt-bwrap
-        ]
-        ++ extraLibraries pkgs;
+        profile = ''
+          # prevents log spam from SteamRT GTK trying to load host GIO modules
+          unset GIO_EXTRA_MODULES
 
-      extraInstallCommands = lib.optionalString (steam-unwrapped != null) ''
-        ln -s ${steam-unwrapped}/share $out/share
-      '';
+          # udev event notifications don't work reliably inside containers.
+          # SDL2 already tries to automatically detect flatpak and pressure-vessel
+          # and falls back to inotify-based discovery [1]. We make SDL2 do the
+          # same by telling it explicitly.
+          #
+          # [1] <https://github.com/libsdl-org/SDL/commit/8e2746cfb6e1f1a1da5088241a1440fd2535e321>
+          export SDL_JOYSTICK_DISABLE_UDEV=1
 
-      profile = ''
-        # prevents log spam from SteamRT GTK trying to load host GIO modules
-        unset GIO_EXTRA_MODULES
+          # This is needed for IME (e.g. iBus, fcitx5) to function correctly on non-CJK locales
+          # https://github.com/ValveSoftware/steam-for-linux/issues/781#issuecomment-2004757379
+          export GTK_IM_MODULE='xim'
 
-        # udev event notifications don't work reliably inside containers.
-        # SDL2 already tries to automatically detect flatpak and pressure-vessel
-        # and falls back to inotify-based discovery [1]. We make SDL2 do the
-        # same by telling it explicitly.
-        #
-        # [1] <https://github.com/libsdl-org/SDL/commit/8e2746cfb6e1f1a1da5088241a1440fd2535e321>
-        export SDL_JOYSTICK_DISABLE_UDEV=1
+          # See https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#graphics-driver
+          export LIBGL_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri
+          export __EGL_VENDOR_LIBRARY_DIRS=/run/opengl-driver/share/glvnd/egl_vendor.d:/run/opengl-driver-32/share/glvnd/egl_vendor.d
+          export LIBVA_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri
+          export VDPAU_DRIVER_PATH=/run/opengl-driver/lib/vdpau:/run/opengl-driver-32/lib/vdpau
 
-        # This is needed for IME (e.g. iBus, fcitx5) to function correctly on non-CJK locales
-        # https://github.com/ValveSoftware/steam-for-linux/issues/781#issuecomment-2004757379
-        export GTK_IM_MODULE='xim'
-
-        # See https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#graphics-driver
-        export LIBGL_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri
-        export __EGL_VENDOR_LIBRARY_DIRS=/run/opengl-driver/share/glvnd/egl_vendor.d:/run/opengl-driver-32/share/glvnd/egl_vendor.d
-        export LIBVA_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri
-        export VDPAU_DRIVER_PATH=/run/opengl-driver/lib/vdpau:/run/opengl-driver-32/lib/vdpau
-
-        # Steam gets confused by the symlinks to bind mounts to symlinks /etc/localtime ends up being, so help it out.
-        # See also: https://github.com/flathub/com.valvesoftware.Steam/blob/28481f09f33c12b6ac7421d13af9ed1523c54ec4/steam_wrapper/steam_wrapper.py#L160
-        if [ -z ''${TZ+x} ]; then
-          new_TZ="$(readlink -f /etc/localtime | grep -P -o '(?<=/zoneinfo/).*$')"
-          if [ $? -eq 0 ]; then
-            export TZ="$new_TZ"
+          # Steam gets confused by the symlinks to bind mounts to symlinks /etc/localtime ends up being, so help it out.
+          # See also: https://github.com/flathub/com.valvesoftware.Steam/blob/28481f09f33c12b6ac7421d13af9ed1523c54ec4/steam_wrapper/steam_wrapper.py#L160
+          if [ -z ''${TZ+x} ]; then
+            new_TZ="$(readlink -f /etc/localtime | grep -P -o '(?<=/zoneinfo/).*$')"
+            if [ $? -eq 0 ]; then
+              export TZ="$new_TZ"
+            fi
           fi
-        fi
 
-        set -a
-        ${lib.toShellVars extraEnv}
-        set +a
+          set -a
+          ${lib.toShellVars extraEnv}
+          set +a
 
-        ${extraProfile}
-      '';
+          ${extraProfile}
+        '';
 
-      inherit extraPreBwrapCmds;
+        inherit extraPreBwrapCmds;
 
-      extraBwrapArgs = [
-        # Steam will dump crash reports here, make those more accessible
-        "--bind-try /tmp/dumps /tmp/dumps"
-      ]
-      ++ extraBwrapArgs;
-    };
+        extraBwrapArgs = [
+          # Steam will dump crash reports here, make those more accessible
+          "--bind-try /tmp/dumps /tmp/dumps"
+        ]
+        ++ extraBwrapArgs;
+      }
+    );
 in
-steamEnv {
-  name = "steam";
+buildRuntimeEnv {
+  pname = "steam";
+  inherit (steam-unwrapped) version meta;
+
+  extraPkgs = pkgs: [ steam-unwrapped ] ++ extraPkgs pkgs;
+  inherit
+    extraLibraries
+    extraProfile
+    extraPreBwrapCmds
+    extraBwrapArgs
+    extraEnv
+    ;
 
   runScript = writeShellScript "steam-wrapped" ''
     exec steam ${extraArgs} "$@"
   '';
 
-  passthru.run = steamEnv {
-    name = "steam-run";
+  extraInstallCommands = ''
+    ln -s ${steam-unwrapped}/share $out/share
+  '';
 
-    runScript = writeShellScript "steam-run" ''
-      if [ $# -eq 0 ]; then
-        echo "Usage: steam-run command-to-run args..." >&2
-        exit 1
-      fi
+  passthru =
+    let
+      makeSteamRun =
+        package:
+        buildRuntimeEnv {
+          name = "steam-run";
 
-      exec "$@"
-    '';
+          extraPkgs = pkgs: package ++ extraPkgs pkgs;
 
-    meta = (steam-unwrapped.meta or { }) // {
-      description = "Run commands in the same FHS environment that is used for Steam";
-      mainProgram = "steam-run";
-      name = "steam-run";
-      # steam-run itself is just a script that lives in nixpkgs (which is licensed under MIT).
-      # steam is a dependency and already unfree, so normal steam-run will not install without
-      # allowing unfree packages or appropriate `allowUnfreePredicate` rules.
-      license = lib.licenses.mit;
+          inherit
+            extraLibraries
+            extraProfile
+            extraPreBwrapCmds
+            extraBwrapArgs
+            extraEnv
+            ;
+
+          runScript = writeShellScript "steam-run" ''
+            if [ $# -eq 0 ]; then
+              echo "Usage: steam-run command-to-run args..." >&2
+              exit 1
+            fi
+
+            exec "$@"
+          '';
+
+          meta = {
+            description = "Run commands in the same FHS environment that is used for Steam";
+            mainProgram = "steam-run";
+            name = "steam-run";
+            license = lib.licenses.mit;
+          };
+        };
+    in
+    {
+      inherit buildRuntimeEnv;
+
+      run = makeSteamRun [ steam-unwrapped ];
+      run-free = makeSteamRun [ ];
     };
-  };
-
-  meta = (steam-unwrapped.meta or { }) // {
-    description = "Steam dependencies (dummy package, do not use)";
-  };
 }
diff --git a/pkgs/by-name/st/storj-uplink/package.nix b/pkgs/by-name/st/storj-uplink/package.nix
index d3e9c728ca92..a8be93defec0 100644
--- a/pkgs/by-name/st/storj-uplink/package.nix
+++ b/pkgs/by-name/st/storj-uplink/package.nix
@@ -4,31 +4,31 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "storj-uplink";
-  version = "1.131.7";
+  version = "1.133.5";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
-    rev = "v${version}";
-    hash = "sha256-zZQOiYH2YN6pRwu2ddt+IEJ35RJ3rplbQ+T4/zKtv8w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MvaA8AkoP4FszEEM33QKDt5zeXMZ3XDt5uU1t6C6Q1I=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-8g5NZpw2T2NuyizSh/cA2seSChEGWzlZmR82Xg0ClKQ=";
+  vendorHash = "sha256-N1rEEM+oH2VVOvg9c8gICQ1aDO9FS/faVbQl0kj1jYM=";
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
-  meta = with lib; {
+  # Tests fail with 'listen tcp 127.0.0.1:0: bind: operation not permitted'.
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Command-line tool for Storj";
     homepage = "https://storj.io";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
     mainProgram = "uplink";
-    maintainers = with maintainers; [ felipeqq2 ];
+    maintainers = with lib.maintainers; [ felipeqq2 ];
   };
-}
+})
diff --git a/pkgs/by-name/te/terraform-local/package.nix b/pkgs/by-name/te/terraform-local/package.nix
index d5df70251297..1348c89ce956 100644
--- a/pkgs/by-name/te/terraform-local/package.nix
+++ b/pkgs/by-name/te/terraform-local/package.nix
@@ -5,12 +5,12 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "terraform_local";
-  version = "0.24.0";
+  version = "0.24.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w+Jd8OPA5XjLw5zp8AEwHlPT5Or4z+elaW9pFKMR9OA=";
+    hash = "sha256-LPrrKDoXUwg/P1m+Gi4I0iUoaRNjNpTWlbBLupkTrpE=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/um/umu-launcher/package.nix b/pkgs/by-name/um/umu-launcher/package.nix
index a282d7d3e2ab..6fcdd81b0036 100644
--- a/pkgs/by-name/um/umu-launcher/package.nix
+++ b/pkgs/by-name/um/umu-launcher/package.nix
@@ -1,5 +1,4 @@
 {
-  buildFHSEnv,
   lib,
   steam,
   umu-launcher-unwrapped,
@@ -7,39 +6,28 @@
   extraLibraries ? pkgs: [ ],
   extraProfile ? "", # string to append to shell profile
   extraEnv ? { }, # Environment variables to include in shell profile
-  withMultiArch ? true, # Many Wine games need 32-bit libraries.
 }:
-let
-  # Steam is not a dependency, but we re-use some of its implementation
-  steam' = steam.override {
-    inherit extraEnv extraProfile;
-  };
-in
-buildFHSEnv {
+steam.buildRuntimeEnv {
   pname = "umu-launcher";
   inherit (umu-launcher-unwrapped) version meta;
 
-  targetPkgs =
-    pkgs:
-    [
-      # Use umu-launcher-unwrapped from the package args, to support overriding
-      umu-launcher-unwrapped
-    ]
-    ++ extraPkgs pkgs;
-  multiPkgs = extraLibraries;
-  multiArch = withMultiArch;
+  extraPkgs = pkgs: [ umu-launcher-unwrapped ] ++ extraPkgs pkgs;
+  inherit
+    extraLibraries
+    extraProfile
+    extraEnv
+    ;
 
   executableName = umu-launcher-unwrapped.meta.mainProgram;
   runScript = lib.getExe umu-launcher-unwrapped;
 
+  # Legendary spawns UMU, doesn't wait for it to exit,
+  # and immediately exits itself. This makes it so we can't
+  # die with parent, because parent is already dead.
+  dieWithParent = false;
+
   extraInstallCommands = ''
     ln -s ${umu-launcher-unwrapped}/lib $out/lib
     ln -s ${umu-launcher-unwrapped}/share $out/share
   '';
-
-  # For umu & proton, we need roughly the same environment as Steam.
-  # For simplicity, we use Steam's `profile` implementation.
-  # See https://github.com/NixOS/nixpkgs/pull/381047
-  # And https://github.com/NixOS/nixpkgs/issues/297662#issuecomment-2647656699
-  inherit (steam'.args) profile;
 }
diff --git a/pkgs/by-name/v2/v2ray/package.nix b/pkgs/by-name/v2/v2ray/package.nix
index 09e1c9ff7bd5..f3fb8ee71db5 100644
--- a/pkgs/by-name/v2/v2ray/package.nix
+++ b/pkgs/by-name/v2/v2ray/package.nix
@@ -16,18 +16,18 @@
 
 buildGoModule rec {
   pname = "v2ray-core";
-  version = "5.37.0";
+  version = "5.38.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    hash = "sha256-guALD7pXZUWE9eBYvjUhAE1QeodH3Nw30nVyRaNrRGw=";
+    hash = "sha256-vx0ttx7ACbgTeP7JCb+VHHBwPS97RVK9tZJaxf/bIyQ=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorHash = "sha256-zf2oalZB/5EDqo0lrKbiaYSt0uw7Qh9J5exgxGrvLUg=";
+  vendorHash = "sha256-P/QWkUXJPHHndN2yEVYl3mq55Vi5/ayNwMtDHyQygdQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vu/vulkan-cts/package.nix b/pkgs/by-name/vu/vulkan-cts/package.nix
index 25e96e69b812..b9f8dbcc9b67 100644
--- a/pkgs/by-name/vu/vulkan-cts/package.nix
+++ b/pkgs/by-name/vu/vulkan-cts/package.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-cts";
-  version = "1.4.3.1";
+  version = "1.4.3.2";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "VK-GL-CTS";
     rev = "vulkan-cts-${finalAttrs.version}";
-    hash = "sha256-DW9Js4eVC7I5pyjdmcP6TdLZ9RrFKfizAgOYuQmzF5Q=";
+    hash = "sha256-Ahp8Wcil0IWSMXXA0Hlm/4KtBCo4HFSQtYAjIlFGtgA=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 2721bf24f56f..0652049e66ad 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -34,9 +34,9 @@ let
     "20.1.6".officialRelease.sha256 = "sha256-PfCzECiCM+k0hHqEUSr1TSpnII5nqIxg+Z8ICjmMj0Y=";
     "21.1.0-rc1".officialRelease.sha256 = "sha256-EZMG3kNqGTvKSuvslbrtNnyqBCG5C2gN9Y2qHbiuh8Q=";
     "22.0.0-git".gitRelease = {
-      rev = "f3a3270dbca3649b7d56aaa42cb8481fb34e2d67";
-      rev-version = "22.0.0-unstable-2025-07-20";
-      sha256 = "sha256-rMiPa8T2n0IWtOv0SYb+eWWHRfPTBGEb4yCp11gVzRE=";
+      rev = "90de4a4ac96ef314e3af9c43c516d5aaf105777a";
+      rev-version = "22.0.0-unstable-2025-07-28";
+      sha256 = "sha256-zTxqMegoqoXHFLXZijWsTXny5y2WLdXTwMtiPnY9KLs=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 33eed93b7e88..b503379fb073 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.39.11";
+  version = "1.39.14";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-3Ig1yx4lbzCWAx5ehFVkNk0LKNXLT/7/5U7K99smaug=";
+    hash = "sha256-NNiQIr4JdELwK9Tpof51gDy2taP2tHY7tqXr191tfck=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index 3b854baab5e7..07b5c05d3173 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -3,12 +3,13 @@
   buildPythonPackage,
   fetchFromGitHub,
 
-  # build
+  # build-system
   setuptools,
 
-  # runtime
+  # dependencies
   looseversion,
   packaging,
+  tomlkit,
   typing-extensions,
 
   # tests
@@ -18,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "lightning-utilities";
-  version = "0.14.3";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "utilities";
     tag = "v${version}";
-    hash = "sha256-MI2dhcxYZJw+EMO05m+W/yE5UlNBB2AHltb0XDamxMc=";
+    hash = "sha256-4WCsaprtAvrKFbPCa1bZJzT0Fo5F9sMYT2A+bolEmwk=";
   };
 
   postPatch = ''
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   dependencies = [
     looseversion
     packaging
+    tomlkit
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 5f9271c16395..89e7859e36a3 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -106,8 +106,8 @@ rec {
       "sha256-etvr1Nu5aInbxZ7VINX0GAVSxymk11yWDPWiLcB+FXU=";
 
   mypy-boto3-appintegrations =
-    buildMypyBoto3Package "appintegrations" "1.39.0"
-      "sha256-HPiNjI2qR+n/M4n8/chH58CJqVT1aI+H9oJss3xjVCU=";
+    buildMypyBoto3Package "appintegrations" "1.39.14"
+      "sha256-SLOj38N3NbssE3apROhXjVYDN7NCyGVnyWKqywiBwSw=";
 
   mypy-boto3-application-autoscaling =
     buildMypyBoto3Package "application-autoscaling" "1.39.0"
@@ -178,8 +178,8 @@ rec {
       "sha256-MXS/FQkRYkWXS/ZCDnQkYnIgQ9k+JV9fAl8FZ9504cs=";
 
   mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.39.0"
-      "sha256-JH8+9lZOkcA3noyuVt0kQP5w04rlDy2W3wD6PzEauas=";
+    buildMypyBoto3Package "budgets" "1.39.14"
+      "sha256-Td+Do7vxVC/t9MHgx7DXNV0+ABddqCCOFoN2OPMHoJ0=";
 
   mypy-boto3-ce =
     buildMypyBoto3Package "ce" "1.39.0"
@@ -334,8 +334,8 @@ rec {
       "sha256-ZcXizvC4Y/WkJnyegLLdxkxvv3LD7A/XB6k7Lb7UkI4=";
 
   mypy-boto3-config =
-    buildMypyBoto3Package "config" "1.39.0"
-      "sha256-eZC2Lyb/xh+bQi7qskPjrrQymOXgAaT0UB20T/zUpNA=";
+    buildMypyBoto3Package "config" "1.39.14"
+      "sha256-FbsHEAA1wDmN3ne+NTnzxHTUgZCLVPYFCVuX0L4tH90=";
 
   mypy-boto3-connect =
     buildMypyBoto3Package "connect" "1.39.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-uYeekAsfyETYQYWR3L8S+uzlp6EQpvYEWsqiX+60b/Y=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.39.10"
-      "sha256-8fxtJZJnC0UDtEqRMdOzU92mht0oAg4zjxcS1kb6biw=";
+    buildMypyBoto3Package "ec2" "1.39.14"
+      "sha256-D3xsvpQ8CMGj6brwxwLNjlmSDLP4oW91WuZyvPJO9qw=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.39.0"
@@ -574,8 +574,8 @@ rec {
       "sha256-pKeTUtqqLKy5DX4ASRJK1LpRg7Y6KnrnKcY7twMXiHM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.39.7"
-      "sha256-/BVuh0ocQWpWcdlxFW6NIhp1pQ5hNp/Jiji9HMoGD7U=";
+    buildMypyBoto3Package "glue" "1.39.12"
+      "sha256-7k4hI6y282CI5Tm1i+smjIHO6N83mFlE2cY3SngekXo=";
 
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.39.0"
@@ -762,8 +762,8 @@ rec {
       "sha256-4O3YwpoJd0hMIvNLIoH6pQfHAB+SXxGvuJ/ZBAXIizI=";
 
   mypy-boto3-kms =
-    buildMypyBoto3Package "kms" "1.39.0"
-      "sha256-G36mwjFKniqdiowwRj9T947p2mGIT2Wz1bJ2TREac/M=";
+    buildMypyBoto3Package "kms" "1.39.14"
+      "sha256-HKOO9AXAt3ZIj1dgftxszcfkJjGtrSPcZKufye/HKrQ=";
 
   mypy-boto3-lakeformation =
     buildMypyBoto3Package "lakeformation" "1.39.0"
@@ -878,8 +878,8 @@ rec {
       "sha256-m2GQMKzrBEiKkk8gBhRvETEe4SplH5l/GYpc86wwBG0=";
 
   mypy-boto3-mediapackagev2 =
-    buildMypyBoto3Package "mediapackagev2" "1.39.7"
-      "sha256-rVbM/wQ0NJ5K0LMIQWgAN4kW419f4mhiR8Sadog+aPA=";
+    buildMypyBoto3Package "mediapackagev2" "1.39.14"
+      "sha256-X5RvEr/I1Yj0IeCUGtNA92FzmqZY/grri8pgs0NVtqg=";
 
   mypy-boto3-mediastore =
     buildMypyBoto3Package "mediastore" "1.39.0"
@@ -966,8 +966,8 @@ rec {
       "sha256-FvlItvDTdy6snW2oENJGKnGQi/6FGytV+PVaJNXH7Nk=";
 
   mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.39.0"
-      "sha256-F3NyoF6+p+icDI14Ieb1Kv4lvL0Qlyxu4svExfcaRSU=";
+    buildMypyBoto3Package "omics" "1.39.13"
+      "sha256-iPx1rzAdu0DsTJRVWdJGCgSy+dzwykIQaXwiZt/zYxg=";
 
   mypy-boto3-opensearch =
     buildMypyBoto3Package "opensearch" "1.39.5"
@@ -1290,8 +1290,8 @@ rec {
       "sha256-pW6TPUN9BkawWJUe7Mkv/GCvguzEb15Q+hrp22oic4E=";
 
   mypy-boto3-sqs =
-    buildMypyBoto3Package "sqs" "1.39.0"
-      "sha256-J51InpuP+4YPLcY0lgjp6yia4MjDVYc56eYsWV5FaDQ=";
+    buildMypyBoto3Package "sqs" "1.39.14"
+      "sha256-YFcAbN+G8sLzZ27WV0xBKZD9EqRBKzoLlVanySJJPKc=";
 
   mypy-boto3-ssm =
     buildMypyBoto3Package "ssm" "1.39.9"
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 97425e6f3391..caaace3cc788 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20250719";
+  version = "1.0.2.20250724";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AEQ660tm0jEPMBxIpsIrni1GyxiQa12UlH87msEZzec=";
+    hash = "sha256-eZKPikda5WtjxSS+nZGftcMVFjFrZMeHVt9XAl5QQWs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index f2c5483d5f38..5d4eb0f66c2f 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.5.13";
+  version = "2.5.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "milvus-io";
     repo = "pymilvus";
     tag = "v${version}";
-    hash = "sha256-+sBOpGnvF6MPCCkaosUemow39Jdy/yNjfnJ+QGX7teI=";
+    hash = "sha256-h+HjDM+uhmcz7fKXE4RWtqD2+Evd9rqG3Zd5jsDyCNE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/srctools/default.nix b/pkgs/development/python-modules/srctools/default.nix
new file mode 100644
index 000000000000..117a97e5b39a
--- /dev/null
+++ b/pkgs/development/python-modules/srctools/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  meson,
+  meson-python,
+  cython_3_1,
+  attrs,
+  useful-types,
+  pytestCheckHook,
+  pillow,
+  pytest-regressions,
+  dirty-equals,
+}:
+let
+  pname = "srctools";
+  version = "2.6.0";
+in
+buildPythonPackage {
+  inherit pname version;
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-QHPRSgu3i443kLeLeJXVpPP0hqMbsi4lScAYHrrfWEM=";
+  };
+
+  build-system = [
+    meson
+    meson-python
+    cython_3_1
+  ];
+
+  dependencies = [
+    attrs
+    useful-types
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pillow
+    pytest-regressions
+    dirty-equals
+  ];
+
+  pythonImportsCheck = [ "srctools" ];
+
+  meta = {
+    description = "Modules for working with Valve's Source Engine file formats";
+    homepage = "https://github.com/TeamSpen210/srctools";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ different-name ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index ca4d2837da3f..acb21f2dfe24 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -321,6 +321,7 @@ let
       NET_CLS_BPF = module;
       NET_ACT_BPF = module;
       NET_SCHED = yes;
+      NET_SCH_BPF = whenAtLeast "6.16" yes;
       L2TP_V3 = yes;
       L2TP_IP = module;
       L2TP_ETH = module;
@@ -655,6 +656,8 @@ let
       # default to dual role mode
       USB_DWC2_DUAL_ROLE = yes;
       USB_DWC3_DUAL_ROLE = yes;
+
+      USB_XHCI_SIDEBAND = whenAtLeast "6.16" yes; # needed for audio offload
     };
 
     usb-serial = {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 2e159ff1e971..4207dbe6b729 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,5 +30,9 @@
     "6.15": {
         "version": "6.15.8",
         "hash": "sha256:19i87zpq3zhpg09sdirnzys2s2yrv9xn8mpibl1a6qmr2sy94znk"
+    },
+    "6.16": {
+        "version": "6.16",
+        "hash": "sha256:10ydzfzc3g0nhns6md08gpfshhjcyd58lylqr15alijjdgzf4jqs"
     }
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1ae05201e429..c997b2d40ca7 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1132,6 +1132,7 @@ mapAliases {
   linuxPackages_6_13 = linuxKernel.packages.linux_6_13;
   linuxPackages_6_14 = linuxKernel.packages.linux_6_14;
   linuxPackages_6_15 = linuxKernel.packages.linux_6_15;
+  linuxPackages_6_16 = linuxKernel.packages.linux_6_16;
   linuxPackages_ham = linuxKernel.packages.linux_ham;
   linuxPackages_rpi0 = linuxKernel.packages.linux_rpi1;
   linuxPackages_rpi02w = linuxKernel.packages.linux_rpi3;
@@ -1156,6 +1157,7 @@ mapAliases {
   linux_6_13 = linuxKernel.kernels.linux_6_13;
   linux_6_14 = linuxKernel.kernels.linux_6_14;
   linux_6_15 = linuxKernel.kernels.linux_6_15;
+  linux_6_16 = linuxKernel.kernels.linux_6_16;
   linux_ham = linuxKernel.kernels.linux_ham;
   linux_rpi0 = linuxKernel.kernels.linux_rpi1;
   linux_rpi02w = linuxKernel.kernels.linux_rpi3;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index db70ed116274..b942e86e6a4f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14916,11 +14916,7 @@ with pkgs;
   springLobby = callPackage ../games/spring/springlobby.nix { };
 
   steam-run = steam.run;
-
-  # This exists so Hydra tries to build all of Steam's dependencies.
-  steam-fhsenv-without-steam = steam.override { steam-unwrapped = null; };
-
-  steam-run-free = steam-fhsenv-without-steam.run;
+  steam-run-free = steam.run-free;
 
   steamback = python3.pkgs.callPackage ../tools/games/steamback { };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 837f2d3a51bb..8eecf46610d2 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -219,6 +219,14 @@ in
           ];
         };
 
+        linux_6_16 = callPackage ../os-specific/linux/kernel/mainline.nix {
+          branch = "6.16";
+          kernelPatches = [
+            kernelPatches.bridge_stp_helper
+            kernelPatches.request_key_helper
+          ];
+        };
+
         linux_testing =
           let
             testing = callPackage ../os-specific/linux/kernel/mainline.nix {
@@ -732,6 +740,7 @@ in
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
     linux_6_15 = recurseIntoAttrs (packagesFor kernels.linux_6_15);
+    linux_6_16 = recurseIntoAttrs (packagesFor kernels.linux_6_16);
   }
   // lib.optionalAttrs config.allowAliases {
     linux_4_19 = throw "linux 4.19 was removed because it will reach its end of life within 24.11"; # Added 2024-09-21
@@ -801,7 +810,7 @@ in
   packageAliases = {
     linux_default = packages.linux_6_12;
     # Update this when adding the newest kernel major version!
-    linux_latest = packages.linux_6_15;
+    linux_latest = packages.linux_6_16;
     linux_rt_default = packages.linux_rt_5_15;
     linux_rt_latest = packages.linux_rt_6_6;
   }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5cc3b618db4d..cc5ac684002c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17150,6 +17150,8 @@ self: super: with self; {
 
   squarify = callPackage ../development/python-modules/squarify { };
 
+  srctools = callPackage ../development/python-modules/srctools { };
+
   sre-yield = callPackage ../development/python-modules/sre-yield { };
 
   srp = callPackage ../development/python-modules/srp { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 700815d5034f..ce84a3b25f42 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -272,7 +272,9 @@ let
           jobs.tests.stdenv.hooks.patch-shebangs.x86_64-linux
         */
       ]
-      ++ collect isDerivation jobs.stdenvBootstrapTools
+      # FIXME: these are just temporarily omitted until fixed
+      # see https://hydra.nixos.org/build/303330677#tabs-constituents
+      #++ collect isDerivation jobs.stdenvBootstrapTools
       ++ optionals supportDarwin.x86_64 [
         jobs.stdenv.x86_64-darwin
         jobs.cargo.x86_64-darwin