diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index fb5269e43d08..f0d3170dc5ac 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -332,6 +332,7 @@ let
 
         if [ $? == 0 ]; then
             echo -ne "$new_salt\n$new_iterations" > /crypt-storage${dev.yubikey.storage.path}
+            sync /crypt-storage${dev.yubikey.storage.path}
         else
             echo "Warning: Could not update LUKS key, current challenge persists!"
         fi
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index 012315a7d723..d37cec15ffcb 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "1rs1jy7zzfgqzr64ld8whn0wlw8n7rk1svxx0xfxm3ynmgc7sd68";
+    sha256 = "07qqs5q64zaxl3b2091vjihqb35fm0136cm4zibrgpx21akmbvr2";
   };
 
-  cargoSha256 = "10g7gdi1iz751wa60vr4fs0cvfsgs3pfcp8pnywicl0vsdp25fmc";
+  cargoSha256 = "0sdbba32f56z2q7kha5fxw2f00hikbz9sf4zl4wfl2i9b13j7mj0";
 
   cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
 
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 2eb45bcafa13..3d7057dd7d97 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -1,17 +1,15 @@
-{ stdenv
-, lib
-, buildPackages
+{ lib
+, importCargoLock
+, fetchCargoTarball
+, rust
+, stdenv
+, callPackage
 , cacert
+, git
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
 , cargoSetupHook
-, fetchCargoTarball
-, importCargoLock
-, rustPlatform
-, callPackage
-, git
-, rust
 , rustc
 , libiconv
 , windows
@@ -19,12 +17,6 @@
 
 { name ? "${args.pname}-${args.version}"
 
-  # SRI hash
-, cargoHash ? ""
-
-  # Legacy hash
-, cargoSha256 ? ""
-
   # Name for the vendored dependencies tarball
 , cargoDepsName ? name
 
@@ -56,7 +48,7 @@
 , buildAndTestSubdir ? null
 , ... } @ args:
 
-assert cargoVendorDir == null && cargoLock == null -> cargoSha256 == "" && cargoHash == ""
+assert cargoVendorDir == null && cargoLock == null -> !(args ? cargoSha256) && !(args ? cargoHash)
   -> throw "cargoSha256, cargoHash, cargoVendorDir, or cargoLock must be set";
 assert buildType == "release" || buildType == "debug";
 
@@ -68,15 +60,17 @@ let
     else fetchCargoTarball ({
       inherit src srcs sourceRoot unpackPhase cargoUpdateHook;
       name = cargoDepsName;
-      hash = cargoHash;
       patches = cargoPatches;
-      sha256 = cargoSha256;
+    } // lib.optionalAttrs (args ? cargoHash) {
+      hash = args.cargoHash;
+    } // lib.optionalAttrs (args ? cargoSha256) {
+      sha256 = args.cargoSha256;
     } // depsExtraArgs)
     else null;
 
   # If we have a cargoSha256 fixed-output derivation, validate it at build time
   # against the src fixed-output derivation to check consistency.
-  validateCargoDeps = !(cargoHash == "" && cargoSha256 == "");
+  validateCargoDeps = args ? cargoHash || args ? cargoSha256;
 
   target = rust.toRustTargetSpec stdenv.hostPlatform;
   targetIsJSON = lib.hasSuffix ".json" target;
@@ -88,7 +82,7 @@ let
       (lib.removeSuffix ".json" (builtins.baseNameOf "${target}"))
     else target;
 
-  sysroot = (callPackage ./sysroot {}) {
+  sysroot = callPackage ./sysroot { } {
     inherit target shortTarget;
     RUSTFLAGS = args.RUSTFLAGS or "";
     originalCargoToml = src + /Cargo.toml; # profile info is later extracted
diff --git a/pkgs/build-support/rust/fetchCargoTarball.nix b/pkgs/build-support/rust/fetchCargoTarball.nix
index 2e8830b47574..c2be9aac82df 100644
--- a/pkgs/build-support/rust/fetchCargoTarball.nix
+++ b/pkgs/build-support/rust/fetchCargoTarball.nix
@@ -22,15 +22,13 @@ in
 , srcs ? []
 , patches ? []
 , sourceRoot ? ""
-, hash ? ""
-, sha256 ? ""
 , cargoUpdateHook ? ""
 , ...
 } @ args:
 
 let hash_ =
-  if hash != "" then { outputHashAlgo = null; outputHash = hash; }
-  else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
+  if args ? hash then { outputHashAlgo = null; outputHash = args.hash; }
+  else if args ? sha256 then { outputHashAlgo = "sha256"; outputHash = args.sha256; }
   else throw "fetchCargoTarball requires a hash for ${name}";
 in stdenv.mkDerivation ({
   name = "${name}-vendor.tar.gz";
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index 7e1d097ba5cb..2d1ef9853819 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -13,6 +13,7 @@
 , mpg123
 , opusfile
 , smpeg2
+, timidity
 }:
 
 stdenv.mkDerivation rec {
@@ -42,8 +43,16 @@ stdenv.mkDerivation rec {
     mpg123
     opusfile
     smpeg2
+    # MIDI patterns
+    timidity
   ];
 
+  # fix default path to timidity.cfg so MIDI files could be played
+  postPatch = ''
+    substituteInPlace timidity/options.h \
+      --replace "/usr/share/timidity" "${timidity}/share/timidity"
+  '';
+
   configureFlags = [
     "--disable-music-ogg-shared"
     "--disable-music-flac-shared"
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 9a4dbbab3745..802da2c68562 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -58,7 +58,13 @@ buildPythonPackage rec {
   # https://github.com/adobe-type-tools/afdko/issues/1216
   doCheck = stdenv.isx86_64;
   checkInputs = [ pytestCheckHook ];
-  preCheck = "export PATH=$PATH:$out/bin";
+  preCheck = ''
+    export PATH=$PATH:$out/bin
+
+    # Update tests to match ufinormalizer-0.6.1 expectations:
+    #   https://github.com/adobe-type-tools/afdko/issues/1418
+    find tests -name layerinfo.plist -delete
+  '';
   disabledTests = [
     # Disable slow tests, reduces test time ~25 %
     "test_report"
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index ee3d49792185..2d234aa9e003 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -171,6 +171,12 @@ in {
     filesToInstall = ["u-boot-spl.kwb"];
   };
 
+  ubootCubieboard2 = buildUBoot {
+    defconfig = "Cubieboard2_defconfig";
+    extraMeta.platforms = ["armv7l-linux"];
+    filesToInstall = ["u-boot-sunxi-with-spl.bin"];
+  };
+
   ubootGuruplug = buildUBoot {
     defconfig = "guruplug_defconfig";
     extraMeta.platforms = ["armv5tel-linux"];
diff --git a/pkgs/servers/hqplayerd/default.nix b/pkgs/servers/hqplayerd/default.nix
index 92ce3294f1c3..d2b46097ac10 100644
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hqplayerd";
-  version = "4.25.2-66";
+  version = "4.26.0-67";
 
   src = fetchurl {
     url = "https://www.signalyst.eu/bins/${pname}/fc34/${pname}-${version}.fc34.x86_64.rpm";
-    sha256 = "sha256-BZGtv/Bumkltk6fJw3+RG1LZc3pGpd8e4DvgLxOTvcQ=";
+    sha256 = "sha256-Wbtt1yO/CE2cewOE5RynwEm+fCdOV1cxzR/XiCwj0NU=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f2c96bde48d1..15c7a3d9904e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22425,6 +22425,7 @@ with pkgs;
     ubootBananaPim64
     ubootAmx335xEVM
     ubootClearfog
+    ubootCubieboard2
     ubootGuruplug
     ubootJetsonTK1
     ubootNanoPCT4