diff --git a/ci/default.nix b/ci/default.nix
index 2be2a17c6f2c..c91c82867e8e 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -30,128 +30,7 @@ let
         inherit (pinned.treefmt-nix) url;
         sha256 = pinned.treefmt-nix.hash;
       };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
diff --git a/ci/treefmt.nix b/ci/treefmt.nix
new file mode 100644
index 000000000000..9575e99d8680
--- /dev/null
+++ b/ci/treefmt.nix
@@ -0,0 +1,122 @@
+{ pkgs, ... }: {
+  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+  # which creates trees within the Git repository under `.git-rewrite/t`,
+  # notably without having a `.git` themselves.
+  # So if this projectRootFile were the default `.git/config`,
+  # having the auto-rebase script use treefmt on such a tree would make it
+  # format all files in the _parent_ Git tree as well.
+  projectRootFile = ".git-blame-ignore-revs";
+
+  # Be a bit more verbose by default, so we can see progress happening
+  settings.verbose = 1;
+
+  # By default it's info, which is too noisy since we have many unmatched files
+  settings.on-unmatched = "debug";
+
+  programs.actionlint.enable = true;
+
+  programs.biome = {
+    enable = true;
+    # Disable settings validation because its inputs are liable to hash mismatch
+    validate.enable = false;
+    settings.formatter = {
+      useEditorconfig = true;
+    };
+    settings.javascript.formatter = {
+      quoteStyle = "single";
+      semicolons = "asNeeded";
+    };
+    settings.json.formatter.enabled = false;
+  };
+  settings.formatter.biome.excludes = [
+    "*.min.js"
+    "pkgs/*"
+  ];
+
+  programs.keep-sorted.enable = true;
+
+  # This uses nixfmt underneath, the default formatter for Nix code.
+  # See https://github.com/NixOS/nixfmt
+  programs.nixfmt = {
+    enable = true;
+    package = pkgs.nixfmt;
+  };
+
+  programs.yamlfmt = {
+    enable = true;
+    settings.formatter = {
+      retain_line_breaks = true;
+    };
+  };
+  settings.formatter.yamlfmt.excludes = [
+    # Aligns comments with whitespace
+    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+    # TODO: Fix formatting for auto-generated file
+    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+  ];
+
+  programs.nixf-diagnose = {
+    enable = true;
+    ignore = [
+      # Rule names can currently be looked up here:
+      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+      # TODO: Remove the following and fix things.
+      "sema-unused-def-lambda-noarg-formal"
+      "sema-unused-def-lambda-witharg-arg"
+      "sema-unused-def-lambda-witharg-formal"
+      "sema-unused-def-let"
+      # Keep this rule, because we have `lib.or`.
+      "or-identifier"
+      # TODO: remove after outstanding prelude diagnostics issues are fixed:
+      # https://github.com/nix-community/nixd/issues/761
+      # https://github.com/nix-community/nixd/issues/762
+      "sema-primop-removed-prefix"
+      "sema-primop-overridden"
+      "sema-constant-overridden"
+      "sema-primop-unknown"
+    ];
+  };
+  settings.formatter.nixf-diagnose = {
+    # Ensure nixfmt cleans up after nixf-diagnose.
+    priority = -1;
+    excludes = [
+      # Auto-generated; violates sema-extra-with
+      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+      # https://github.com/inclyc/nixf-diagnose/issues/13
+      "pkgs/servers/home-assistant/component-packages.nix"
+      # https://github.com/nix-community/nixd/issues/708
+      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+    ];
+  };
+
+  settings.formatter.editorconfig-checker = {
+    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+    options = [
+      "-disable-indent-size"
+      # TODO: Remove this once this upstream issue is fixed:
+      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+      "-disable-charset"
+    ];
+    includes = [ "*" ];
+    priority = 1;
+  };
+
+  # TODO: Upstream this into treefmt-nix eventually:
+  #   https://github.com/numtide/treefmt-nix/issues/387
+  settings.formatter.markdown-code-runner = {
+    command = pkgs.lib.getExe pkgs.markdown-code-runner;
+    options =
+      let
+        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+          presets.nixfmt = {
+            language = "nix";
+            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+          };
+        };
+      in
+      [ "--config=${config}" ];
+    includes = [ "*.md" ];
+  };
+
+  programs.zizmor.enable = true;
+}
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 932b66b9cfb6..7dae595c9e39 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -1612,13 +1612,15 @@ rec {
       binaryMerge =
         start: end:
         # assert start < end; # Invariant
-        if end - start >= 2 then
-          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
-          # The invariant is satisfied because each half will have at least 1 element
-          binaryMerge start (start + (end - start) / 2) // binaryMerge (start + (end - start) / 2) end
+        if end - start == 1 then
+          # Base case - there will be exactly 1 element due to the invariant, in
+          # which case we just return it directly
+          elemAt list start
         else
-          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
-          elemAt list start;
+          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
+          # Relies on floor for odd results
+          # The invariant is satisfied because each half will have at least 1 element
+          binaryMerge start ((start + end) / 2) // binaryMerge ((start + end) / 2) end;
     in
     if list == [ ] then
       # Calling binaryMerge as below would not satisfy its invariant
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index bb338bc992c9..3c27f0b3e268 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -370,12 +370,16 @@ in
                   "sleep.target"
                 ];
 
-                script = "${lib.getExe cfg.package} data scrub ${fs}";
-
                 serviceConfig = {
                   Type = "oneshot";
                   Nice = 19;
                   IOSchedulingClass = "idle";
+
+                  ExecStart = lib.join " " [
+                    (lib.getExe cfg.package)
+                    (if lib.versionOlder cfg.package.version "v1.34.0" then "data scrub" else "scrub")
+                    (utils.escapeSystemdExecArg fs)
+                  ];
                 };
               };
           in
diff --git a/nixos/tests/restic.nix b/nixos/tests/restic.nix
index 68ce843879b3..3b3ef6380722 100644
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@@ -122,7 +122,7 @@ in
             ];
           };
           remote-from-file-backup = {
-            inherit passwordFile exclude pruneOpts;
+            inherit passwordFile pruneOpts;
             initialize = true;
             repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
             paths = [
@@ -130,7 +130,8 @@ in
               "/opt/a_dir/a_file_2"
             ];
             dynamicFilesFrom = ''
-              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
+              # all files in /opt except for a_dir and excluded_file_*
+              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir ! -name excluded_file_*
             '';
           };
           remote-from-command-backup = {
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index 65986e2fa395..e2dff1363b83 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-8EjKZl0fWpdgaYHeZDTbVS8EpwbVpt9pYWXq85u1bEQ=";
+    hash = "sha256-13/qw2BZ/WG+TYNVncJ/PuFLaUhlAn63zaa27JcLITE=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 5e78dcc72b84..112593d9d377 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -515,13 +515,25 @@ unset XDG_CONFIG_HOME
 export GIT_CONFIG_NOSYSTEM=1
 
 
-# Disable maintenance: it's not useful for a short-lived clone, and
-# background maintenance causes non-deterministic builds.
+# Append a config entry via the GIT_CONFIG_* environment variables. Unlike
+# `git config` (writes a single repo) or `git -c` (one invocation), these
+# propagate to every git invocation *and* its children, including (nested)
+# submodule fetches. Done additively so it composes with any GIT_CONFIG_* the
+# caller passes via `impureEnvVars`.
+git_config_env(){
+    export GIT_CONFIG_COUNT=$(( ${GIT_CONFIG_COUNT:-0} + 1 ))
+    export "GIT_CONFIG_KEY_$(( GIT_CONFIG_COUNT - 1 ))=$1"
+    export "GIT_CONFIG_VALUE_$(( GIT_CONFIG_COUNT - 1 ))=$2"
+}
+
+# Disable maintenance and auto-gc: they're not useful for a short-lived clone,
+# and their background/detached processes race the later `.git` removal,
+# producing non-deterministic output (and outright failures with nested
+# submodules, where the legacy gc.auto path still fires).
 # https://github.com/NixOS/nixpkgs/issues/524215
-export GIT_CONFIG_COUNT=$(( ${GIT_CONFIG_COUNT:-0} + 1 ))
-# Not the best but generic enough that it will work with `impureEnvVars`
-export "GIT_CONFIG_KEY_$(( GIT_CONFIG_COUNT - 1 ))=maintenance.auto"
-export "GIT_CONFIG_VALUE_$(( GIT_CONFIG_COUNT - 1 ))=false"
+git_config_env maintenance.auto false
+git_config_env gc.auto 0
+git_config_env gc.autoDetach false
 
 if test -n "$builder"; then
     test -n "$out" -a -n "$url" -a -n "$rev" || usage
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index 2ab9a7ad7180..f9c70c26f423 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.34.0";
+  version = "2.34.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-LuOI9r1VRnL9IGsK4vy4ENOS64xdpIZ+ZskIkUJ0s34=" "zip";
-    i686-linux = fetch "linux_386" "sha256-VvqEyDHEIY3BsgubiJKXql1WEnwXHkSHpFvCcKBIeYw=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-sbydXPoT0Vo3r2gyZBdl4OMtOejbhvra5JM4wB6Ex5s=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-uEukRq71eeayvNguD9XepvP1Br5AkE2Ag/Chv2idf4A=" "zip";
+    i686-linux = fetch "linux_386" "sha256-p/F3YZLJnlimrVE2qxTHvIB4m47kuwhoCWTC40VIvMs=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-oAABMlwwv5X91TT6FK2aPpg+e2CvmHT1rqIVRTjQNCQ=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-9h+Z7INYcJcWeVQ9QnXKjtT5QyV2J+dP857qSOpBAy8="
+      fetch "apple_universal" "sha256-vp1Y1M6DUanx1CAVhLrqgBovwws6Y/5jOgnwTZE8Hhc="
         "pkg";
     x86_64-darwin = aarch64-darwin;
   };
diff --git a/pkgs/by-name/ai/airwindows-lv2/package.nix b/pkgs/by-name/ai/airwindows-lv2/package.nix
index 770eed7eced4..e560a960b294 100644
--- a/pkgs/by-name/ai/airwindows-lv2/package.nix
+++ b/pkgs/by-name/ai/airwindows-lv2/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "airwindows-lv2";
-  version = "36.0";
+  version = "38.0";
   src = fetchFromSourcehut {
     owner = "~hannes";
     repo = "airwindows-lv2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zlrh/PkpiZDVHbLLN+Hk3llX27ahvNKAZKn/T/57tOs=";
+    hash = "sha256-M54HGcU1LxvV+KwOlnvI8gxeMxnCQ+2yAH8BPBM4/eg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix
index 24072b1dd68f..e039d2c5f30d 100644
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -8,16 +8,16 @@
 
 php83.buildComposerProject2 (finalAttrs: {
   pname = "bookstack";
-  version = "26.05";
+  version = "26.05.1";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = "bookstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hiq3cM5TpxlwyJwqEYQ1k+zUXsP23vsAb9OMXdXwCZA=";
+    hash = "sha256-g68wTZ5jRwXEKvAF9nLfKfWGf1FDD15msSkXzzJkVDQ=";
   };
 
-  vendorHash = "sha256-/L2QAc8ezz1cW7a847A7wGPk0DCHrFbnuj2J6KmFS/E=";
+  vendorHash = "sha256-YJwJp+OtrCDgGFsZAjdlSx0LoxQFbylqCNW90MF8Kzo=";
 
   passthru = {
     phpPackage = php83;
diff --git a/pkgs/by-name/bu/buildkite-agent/package.nix b/pkgs/by-name/bu/buildkite-agent/package.nix
index 28e441a5dba1..18d0887a5638 100644
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.127.1";
+  version = "3.127.2";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nG7pvoQfVQrrF+s8Ghc4OITXtW1D0dPAuU3Ef7yDr7E=";
+    hash = "sha256-dSG/F/KtV4nBpm2EeXjGI/2uM2/CgRkjYq5uq7+vZVw=";
   };
 
-  vendorHash = "sha256-Ow2nQAf0G4vsY167S0SbXhPnB6y1qRSf0+EFNPrC2CE=";
+  vendorHash = "sha256-N4m7Dak0EBkbJtOjatv0GQKsdxt0B/fZn08T9HpAXDA=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/by-name/co/comma/package.nix b/pkgs/by-name/co/comma/package.nix
index af71638565e1..ba5f9c4c26ed 100644
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@@ -36,26 +36,44 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"fzy"' '"${lib.getExe fzy}"'
   '';
 
-  postInstall = ''
-    ln -s $out/bin/comma $out/bin/,
+  postInstall =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      ln -s $out/bin/comma $out/bin/,
 
-    mkdir -p $out/share/comma
+      mkdir -p $out/share/comma
 
-    cp $src/etc/command-not-found.sh $out/share/comma
-    cp $src/etc/command-not-found.nu $out/share/comma
-    cp $src/etc/command-not-found.fish $out/share/comma
+      cp $src/etc/command-not-found.sh $out/share/comma
+      cp $src/etc/command-not-found.nu $out/share/comma
+      cp $src/etc/command-not-found.fish $out/share/comma
 
-    patchShebangs $out/share/comma/command-not-found.sh
-    substituteInPlace \
-      "$out/share/comma/command-not-found.sh" \
-      "$out/share/comma/command-not-found.nu" \
-      "$out/share/comma/command-not-found.fish" \
-      --replace-fail "comma --ask" "$out/bin/comma --ask"
-  ''
-  + lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
-    ${stdenv.hostPlatform.emulator buildPackages} "$out/bin/comma" --mangen > comma.1
-    installManPage comma.1
-  '';
+      patchShebangs $out/share/comma/command-not-found.sh
+      substituteInPlace \
+        "$out/share/comma/command-not-found.sh" \
+        "$out/share/comma/command-not-found.nu" \
+        "$out/share/comma/command-not-found.fish" \
+        --replace-fail "comma --ask" "$out/bin/comma --ask"
+    ''
+    + lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
+      ${emulator} "$out/bin/comma" --mangen > comma.1
+      installManPage comma.1
+
+      installShellCompletion --cmd comma \
+        --bash <(${emulator} $out/bin/comma --print-completions bash) \
+        --fish <(${emulator} $out/bin/comma --print-completions fish) \
+        --zsh <(${emulator} $out/bin/comma --print-completions zsh)
+
+      # TODO: Add , to other shells too
+      cat >>$out/share/zsh/site-functions/_comma <<'EOF'
+        if [ "$funcstack[1]" = "_comma" ]; then
+            _comma "$@"
+        else
+            compdef _comma ,
+        fi
+      EOF
+    '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/db/dblab/package.nix b/pkgs/by-name/db/dblab/package.nix
index 5891750e6734..3cecff1c8e90 100644
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dblab";
-  version = "0.40.1";
+  version = "0.40.2";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pDtiLKsAvV3k7sN5dnO0g03gxbs4WeCseadWKXh9DHM=";
+    hash = "sha256-nEUKRI1pukVDsUvPIubujcy/O1E0t3ESRT0aem5HL78=";
   };
 
   vendorHash = "sha256-T1y0ALF4s3T8ZaTqj2jUdnezVRmpegKnabahiQ3CgzA=";
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index c4e70b9ab233..118a37a0023c 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -5,7 +5,7 @@
   makeWrapper,
   makeDesktopItem,
   nodejs,
-  electron_41,
+  electron_42,
   element-web,
   callPackage,
   typescript,
@@ -15,7 +15,7 @@
   commandLineArgs ? "",
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   faketty,
   asar,
   copyDesktopItems,
@@ -24,19 +24,19 @@
 }:
 
 let
-  pnpm = pnpm_10;
-  electron = electron_41;
+  pnpm = pnpm_11;
+  electron = electron_42;
   seshat = callPackage ./seshat { };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-desktop";
-  version = "1.12.18";
+  version = "1.12.21";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
+    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
+    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix
index 389ffe8251ca..ee61fce02654 100644
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -6,14 +6,13 @@
   nodejs,
   jitsi-meet,
   fetchPnpmDeps,
-  pnpm_10,
+  pnpm_11,
   pnpmConfigHook,
   faketty,
 }:
 
 let
-  pnpm = pnpm_10;
-
+  pnpm = pnpm_11;
   noPhoningHome = {
     disable_guests = true; # disable automatic guest account registration at matrix.org
   };
@@ -26,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-web";
-  version = "1.12.18";
+  version = "1.12.21";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
+    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -40,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
+    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index fa60fce1b1a2..8a62a2677564 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fabric-ai";
-  version = "1.4.453";
+  version = "1.4.455";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+q68ee4oCSJ7zR2XFaJChHkJoalUUZwebWVV823eAmc=";
+    hash = "sha256-folZ+Y5l76SKo65RJAK7kZX6DJ/AL+iLkcV8NX+1DTA=";
   };
 
-  vendorHash = "sha256-XJ6JlvEY1L7/w+e8QJEXcB9VzueNEFg1GPn75+zQaYA=";
+  vendorHash = "sha256-DfI0SYMX1wfJ8V0tFYpjzCgqhR7H/0J1p5R3aNcrXTw=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fb/fbset/package.nix b/pkgs/by-name/fb/fbset/package.nix
index 34b43971a194..b774a3906eca 100644
--- a/pkgs/by-name/fb/fbset/package.nix
+++ b/pkgs/by-name/fb/fbset/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
     flex
   ];
 
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
   installFlags = [ "DESTDIR=$(out)" ];
 
   passthru = {
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 38619045104c..33f3d71541f9 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -13,13 +13,13 @@
 }:
 
 let
-  version = "2.63.5";
+  version = "2.63.14";
 
   src = fetchFromGitHub {
     owner = "filebrowser";
     repo = "filebrowser";
     tag = "v${version}";
-    hash = "sha256-/X/TztbZDC1hkRL97jkm6Ak8QmKFDMycekLl6NVPS0k=";
+    hash = "sha256-9CXHoQWr1RpTwFR8JRR72oQZxHrndTrnxYa6/0Z3Mk0=";
   };
 
   frontend = stdenvNoCC.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/go/golazo/package.nix b/pkgs/by-name/go/golazo/package.nix
index 4cc7b1fdc569..99506cefaecb 100644
--- a/pkgs/by-name/go/golazo/package.nix
+++ b/pkgs/by-name/go/golazo/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "golazo";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "0xjuanma";
     repo = "golazo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udZ3F6DQAzRZpPukkeGE4Ho0zl4pAt2CinIOQqmYe5Q=";
+    hash = "sha256-g9JPPP/pZ65Jgq2hXYzRynhZebF7s2ZTNU4Ca1Iu5uc=";
   };
 
   vendorHash = "sha256-M2gfqU5rOfuiVSZnH/Dr8OVmDhyU2jYkgW7RuIUTd+E=";
diff --git a/pkgs/by-name/ja/jaq/package.nix b/pkgs/by-name/ja/jaq/package.nix
index 9aca0ac88eef..d1f63072b49b 100644
--- a/pkgs/by-name/ja/jaq/package.nix
+++ b/pkgs/by-name/ja/jaq/package.nix
@@ -9,18 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jaq";
-  version = "3.0.0";
+  version = "3.1.0";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "01mf02";
     repo = "jaq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FhmnJm/MV4WfvhF7DWW6t2D876SIzzq7ODlY2Wmo9mM=";
+    hash = "sha256-cwHYsLp9uBb3/etH0bGYzNLOJJypeE4qED7jTBESHiE=";
   };
 
-  strictDeps = true;
-
-  cargoHash = "sha256-37yS5xUj04ZjXvVlji7XNTXbt3avQKmkqUMfovhUrtU=";
+  cargoHash = "sha256-9vLD5aYcnbdjQC+5FsTglLFYhbv/1lSqsfkD8oclwBs=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -71,7 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Jq clone focused on correctness, speed and simplicity";
     homepage = "https://github.com/01mf02/jaq";
-    changelog = "https://github.com/01mf02/jaq/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/01mf02/jaq/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     teams = [ lib.teams.ngi ];
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ka/karere/package.nix b/pkgs/by-name/ka/karere/package.nix
index 2ab08b90c989..b878da24fc4d 100644
--- a/pkgs/by-name/ka/karere/package.nix
+++ b/pkgs/by-name/ka/karere/package.nix
@@ -2,57 +2,72 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  rustPlatform,
+  cargo,
   meson,
   ninja,
   pkg-config,
-  cargo,
+  rustPlatform,
   rustc,
   wrapGAppsHook4,
   blueprint-compiler,
   desktop-file-utils,
-  appstream,
-  gtk4,
   libadwaita,
   webkitgtk_6_0,
   glib-networking,
+  gst_all_1,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "karere";
-  version = "2.5.5";
+  version = "3.1.1";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "tobagin";
     repo = "karere";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cR4+nZvz7ELy9/POX9yZiryVcCcpC63mFhZ6kvR33i8=";
+    hash = "sha256-VJGTpkMkYKvU/I/DoyBMD9deciLzmrs48If1wQutvnE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-h51B8iGiMWHbHogJSAKdm27QDBPzlrkCxlYOj9T4SuI=";
+    hash = "sha256-48ai2Jf/Uo+sXsT78v4usVEAn1zV/YVz4FZZs2ZZDa8=";
   };
 
   nativeBuildInputs = [
+    cargo
     meson
     ninja
     pkg-config
-    cargo
-    rustc
     rustPlatform.cargoSetupHook
+    rustc
     wrapGAppsHook4
     blueprint-compiler
     desktop-file-utils
-    appstream
   ];
 
   buildInputs = [
-    gtk4
     libadwaita
     webkitgtk_6_0
     glib-networking
-  ];
+  ]
+  ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-libav
+  ]);
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set FLATPAK_ID io.github.tobagin.karere
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Gtk4 Whatsapp client";
diff --git a/pkgs/by-name/ki/kicad/base.nix b/pkgs/by-name/ki/kicad/base.nix
index c43b90c1face..55976ff0e8c9 100644
--- a/pkgs/by-name/ki/kicad/base.nix
+++ b/pkgs/by-name/ki/kicad/base.nix
@@ -62,7 +62,6 @@
   debug,
   sanitizeAddress,
   sanitizeThreads,
-  templateDir ? null,
 }:
 
 assert lib.assertMsg (
@@ -208,14 +207,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontStrip = debug;
 
-  # KiCad looks for the stock library tables at
-  # KICAD_LIBRARY_DATA/template/{sym,fp}-lib-table, where KICAD_LIBRARY_DATA is
-  # compiled in as $out/share/kicad. Those files live in separate library packages.
-  postInstall = optionalString (templateDir != null) ''
-    rm -rf $out/share/kicad/template
-    ln -s ${templateDir} $out/share/kicad/template
-  '';
-
   meta = {
     description = "Just the built source without the libraries";
     longDescription = ''
diff --git a/pkgs/by-name/ki/kicad/package.nix b/pkgs/by-name/ki/kicad/package.nix
index 9fc7856da47f..e9fe9c2ea104 100644
--- a/pkgs/by-name/ki/kicad/package.nix
+++ b/pkgs/by-name/ki/kicad/package.nix
@@ -186,7 +186,6 @@ stdenv.mkDerivation rec {
     inherit wxGTK python wxPython;
     inherit withNgspice withScripting withI18n;
     inherit debug sanitizeAddress sanitizeThreads;
-    templateDir = template_dir;
   };
 
   inherit pname;
@@ -221,6 +220,36 @@ stdenv.mkDerivation rec {
       "${symbols}/share/kicad/template"
     ];
   };
+
+  # KiCad looks up its stock library tables relative to GetStockDataPath(),
+  # which our runtime_stock_data_path.patch lets us override via
+  # NIX_KICAD10_STOCK_DATA_PATH. We synthesise a directory that mirrors
+  # ${base}/share/kicad but replaces the upstream-installed (incomplete)
+  # template/ with the merged template_dir from the library packages.
+  # Doing this in the wrapper instead of in base.nix keeps the heavy
+  # kicad-base compile independent of the (cheap) library packages, so
+  # toggling overrides like compressStep doesn't force a base rebuild.
+  baseWithTemplate = runCommand "kicad-stock-data" { } ''
+    mkdir -p $out
+    for d in ${base}/share/kicad/*; do
+      name=$(basename "$d")
+      [ "$name" = template ] || ln -s "$d" "$out/$name"
+    done
+    ln -s ${template_dir} $out/template
+  '';
+
+  stockDataPath =
+    if addons == [ ] then
+      baseWithTemplate
+    else
+      symlinkJoin {
+        name = "kicad_stock_data_path";
+        paths = [
+          baseWithTemplate
+          "${addonsJoined}/share/kicad"
+        ];
+      };
+
   # We are emulating wrapGAppsHook3, along with other variables to the wrapper
   makeWrapperArgs =
     with passthru.libraries;
@@ -238,19 +267,8 @@ stdenv.mkDerivation rec {
       "--set-default KICAD10_FOOTPRINT_DIR ${footprints}/share/kicad/footprints"
       "--set-default KICAD10_SYMBOL_DIR ${symbols}/share/kicad/symbols"
       "--set-default KICAD10_TEMPLATE_DIR ${template_dir}"
+      "--set-default NIX_KICAD10_STOCK_DATA_PATH ${stockDataPath}"
     ]
-    ++ optionals (addons != [ ]) (
-      let
-        stockDataPath = symlinkJoin {
-          name = "kicad_stock_data_path";
-          paths = [
-            "${base}/share/kicad"
-            "${addonsJoined}/share/kicad"
-          ];
-        };
-      in
-      [ "--set-default NIX_KICAD10_STOCK_DATA_PATH ${stockDataPath}" ]
-    )
     ++ optionals with3d [
       "--set-default KICAD10_3DMODEL_DIR ${packages3d}/share/kicad/3dmodels"
     ]
diff --git a/pkgs/by-name/ki/kicad/runtime_stock_data_path.patch b/pkgs/by-name/ki/kicad/runtime_stock_data_path.patch
index 1b6eaead8c28..0ef3544d3fcf 100644
--- a/pkgs/by-name/ki/kicad/runtime_stock_data_path.patch
+++ b/pkgs/by-name/ki/kicad/runtime_stock_data_path.patch
@@ -1,5 +1,4 @@
 diff --git a/common/paths.cpp b/common/paths.cpp
-index a74cdd9..790cc58 100644
 --- a/common/paths.cpp
 +++ b/common/paths.cpp
 @@ -151,6 +151,10 @@ wxString PATHS::GetStockDataPath( bool aRespectRunFromBuildDir )
@@ -13,3 +12,14 @@ index a74cdd9..790cc58 100644
      if( aRespectRunFromBuildDir && wxGetEnv( wxT( "KICAD_RUN_FROM_BUILD_DIR" ), nullptr ) )
      {
          // Allow debugging from build dir by placing relevant files/folders in the build root
+@@ -198,6 +202,10 @@ wxString PATHS::GetStockEDALibraryPath()
+ {
+     wxString path;
+
++    if( wxGetEnv( wxT( "NIX_KICAD10_STOCK_DATA_PATH" ), &path ) ) {
++        return path;
++    }
++
+ #if defined( __WXMAC__ )
+     path = GetOSXKicadMachineDataDir();
+ #elif defined( __WXMSW__ )
diff --git a/pkgs/by-name/li/lis/package.nix b/pkgs/by-name/li/lis/package.nix
index bc02a046a6b7..3a664cc2398c 100644
--- a/pkgs/by-name/li/lis/package.nix
+++ b/pkgs/by-name/li/lis/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lis";
-  version = "2.1.10";
+  version = "2.1.11";
 
   src = fetchzip {
     url = "https://www.ssisc.org/lis/dl/lis-${finalAttrs.version}.zip";
-    hash = "sha256-rRtme4ItbvL8xGBSeoCD5f+INPPhmlON8cVt+q+puSc=";
+    hash = "sha256-RyNFHdezJyE8rJohxW3FmcqD+4N+7+ejD1z/DplQHe8=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ni/nih-plug/package.nix b/pkgs/by-name/ni/nih-plug/package.nix
new file mode 100644
index 000000000000..d01ac38879e8
--- /dev/null
+++ b/pkgs/by-name/ni/nih-plug/package.nix
@@ -0,0 +1,171 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  alsa-lib,
+  libjack2,
+  libGL,
+  libxkbcommon,
+  libx11,
+  libxcursor,
+  libxcb,
+  libxcb-wm,
+  python3,
+}:
+
+# NIH-plug is split into two things:
+#
+#   * a Rust audio-plugin framework (the `nih_plug*` library crates), and
+#   * a collection of end-user CLAP/VST3 plugins in `plugins/` built on top of
+#     it (Buffr Glitch, Crisp, Loudness War Winner,
+#     Puberty Simulator, Safety Limiter, Soft Vacuum, Spectral Compressor).
+#
+# Only the second is packageable in nixpkgs — the framework is consumed by
+# downstream plugin authors via Cargo, not installed system-wide. This
+# derivation builds every plugin listed in upstream's `bundler.toml` and
+# installs the resulting bundles to the standard Linux locations under
+# `$out/lib/{clap,vst3}` so they're discovered by hosts when the package is
+# in the user environment.
+
+rustPlatform.buildRustPackage rec {
+  pname = "nih-plug";
+  # Upstream does not tag releases. Use the `0-unstable-<date>` convention so
+  # the version compares lower than any future tagged release.
+  version = "0-unstable-2026-05-10";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "robbert-vdh";
+    repo = "nih-plug";
+    rev = "f36931f7af4646065488a9845d8f8c2f95252c23";
+    hash = "sha256-Jvd1RHs2VXzHN8Koj+JS1bcbGMSA30g2e3i8lhGjGlc=";
+  };
+
+  # `cargoLock.outputHashes` would have to be used here because the lockfile
+  # pins several crates by git rev. However, the lockfile contains four
+  # different revs of `baseview` all at version 0.1.0, and `importCargoLock`
+  # keys hashes by `<name>-<version>` — so it cannot represent more than one
+  # rev per name. The `fetchCargoVendor` path (default since 25.05) does not
+  # have this limitation: it produces one combined vendor directory hash.
+  cargoHash = "sha256-d89GZf9cwSlqdC/q3xMHh8ehDiOhuiZAI0/ygKQHuqc=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    python3
+  ];
+
+  buildInputs = [
+    alsa-lib # cpal (pulled in by the `standalone` feature) and midir
+    libjack2 # `jack` crate (also from the `standalone` feature)
+    libGL # baseview / nih_plug_egui & friends
+    libxkbcommon
+    libx11
+    libxcursor
+    libxcb
+    libxcb-wm
+  ];
+
+  # Only the production plugins are listed in upstream's `bundler.toml`. The
+  # `plugins/examples/*` crates exist for documentation and are deliberately
+  # excluded. Keep this list in sync with `bundler.toml`.
+  bundlePackages = [
+    "buffr_glitch"
+    "crisp"
+    "loudness_war_winner"
+    "puberty_simulator"
+    "safety_limiter"
+    "soft_vacuum"
+    "spectral_compressor"
+  ];
+
+  # `cargo xtask bundle` is a workspace alias for running the in-tree `xtask`
+  # binary, which itself invokes `cargo build --release -p <package>` for each
+  # named plugin and then assembles the resulting cdylibs into CLAP/VST3
+  # bundle layouts under `target/bundled/`. We invoke the alias directly so
+  # buildRustPackage's offline cargo environment is inherited by the nested
+  # build.
+  buildPhase = ''
+    runHook preBuild
+
+    cargoBuildArgs=( )
+    for p in ${lib.escapeShellArgs bundlePackages}; do
+      cargoBuildArgs+=( -p "$p" )
+    done
+
+    cargo run \
+      --frozen \
+      --offline \
+      --release \
+      --package xtask -- \
+      bundle "''${cargoBuildArgs[@]}" --release
+
+    runHook postBuild
+  '';
+
+  # The plugins themselves are audio-processing libraries; there is nothing
+  # meaningful to run as `cargo test` at the workspace level for the bundled
+  # outputs, and several workspace members would pull in heavy GUI toolkits
+  # for no benefit. Upstream's own CI does not run tests as part of the
+  # packaging job either.
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d "$out/lib/clap" "$out/lib/vst3"
+
+    # CLAP plugins are single `.clap` shared objects.
+    find target/bundled -maxdepth 1 -type f -name '*.clap' \
+      -exec install -Dm644 -t "$out/lib/clap" {} +
+
+    # VST3 plugins are directory bundles. On Linux the layout is
+    # `Foo.vst3/Contents/<arch>-linux/Foo.so`.
+    for vst3 in target/bundled/*.vst3; do
+      [ -e "$vst3" ] || continue
+      cp -r "$vst3" "$out/lib/vst3/"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Collection of CLAP and VST3 audio plugins built with the NIH-plug framework";
+    longDescription = ''
+      Builds the upstream NIH-plug plugin collection: Buffr Glitch (a MIDI-
+      triggered buffer-repeat effect), Crisp (high-frequency excitement
+      inspired by Polarity's Fake Distortion), Loudness War Winner
+      (digital saturation/clipper), Puberty Simulator (octave-down with
+      formant artefacts), Safety Limiter (hearing-protection  tool that cuts
+      to Morse-code SOS on clip), Soft Vacuum (oversampled port of Airwindows'
+      Hard Vacuum) and Spectral Compressor (FFT-based dynamics processor).
+
+      Outputs install to `$out/lib/clap` and `$out/lib/vst3`. Hosts that
+      honour `CLAP_PATH` / `VST3_PATH` will pick them up automatically when
+      the package is in the user's profile; otherwise symlink them into
+      `~/.clap` and `~/.vst3` (or `~/.local/share/{clap,vst3}`).
+
+      The NIH-plug framework itself is in upstream-declared maintenance mode;
+      a community fork at codeberg.org/BillyDM/nih-plug is the active
+      successor for new framework development. These plugin binaries continue
+      to be developed in the upstream repository.
+
+      Crossover and Diopser are part of the upstream repository but
+      unconditionally require nightly Rust (std::simd) and are not built here.
+    '';
+    homepage = "https://github.com/robbert-vdh/nih-plug";
+    changelog = "https://github.com/robbert-vdh/nih-plug/blob/${src.rev}/CHANGELOG.md";
+    # The framework crates are ISC. Every plugin in `plugins/` declares
+    # `GPL-3.0-or-later` in its `Cargo.toml`, and the produced bundles link
+    # `vst3-sys` which is also GPLv3+. The binaries shipped by this
+    # derivation are therefore GPLv3+.
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    # CI also targets macOS and Windows, but the bundle install layout and
+    # required system frameworks differ on Darwin (`CoreFoundation`, `AppKit`,
+    # bundles under `~/Library/Audio/Plug-Ins/...`) and have not been wired up
+    # here. Restrict to Linux until someone tests Darwin properly.
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/op/openrct2/package.nix b/pkgs/by-name/op/openrct2/package.nix
index 53d351df43f7..1c3e672e319e 100644
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openrct2";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5GPepF013XhymzlgfYjlB/XPE2/w18/kv3IDgJ4vPuY=";
+    hash = "sha256-sKfNE57ZpTsHJk0uKG0YUQYg63xnOiAEwkgRaG4zgmo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openstack-rs/package.nix b/pkgs/by-name/op/openstack-rs/package.nix
index 972f85e9a4e3..ac70940ea08b 100644
--- a/pkgs/by-name/op/openstack-rs/package.nix
+++ b/pkgs/by-name/op/openstack-rs/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openstack-rs";
-  version = "0.13.5";
+  version = "0.13.7";
 
   src = fetchFromGitHub {
     owner = "gtema";
     repo = "openstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8Dg1ymrjra6q4WXOUh+qEgyIIh7Z5FinLNc9fFETyFQ=";
+    hash = "sha256-cpx35OT/x/2XJD4RzaWX/yKM4nwBgl6/gVrEtgyljEI=";
   };
 
-  cargoHash = "sha256-mEYfcv9GViTOB4WoV2tHpWrzcEEcGf0DI9hDhajDvpc=";
+  cargoHash = "sha256-LwN+7LkE/nFbiUlcSjQRxIg0BtO4XLuf/wPS1Vdvx+M=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pi/picoclaw/package.nix b/pkgs/by-name/pi/picoclaw/package.nix
index 18575c949f6f..4f5e81ba43ea 100644
--- a/pkgs/by-name/pi/picoclaw/package.nix
+++ b/pkgs/by-name/pi/picoclaw/package.nix
@@ -2,22 +2,25 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  olm,
   versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "picoclaw";
-  version = "0.2.1";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "sipeed";
     repo = "picoclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JvcvpaGPPBiABK28rQhe63chYm7MRdfU6uflZosNRKg=";
+    hash = "sha256-oMees7EKANS5dkMHIqAHfGcumrNMtTEEA+dmpl8/dLE=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-K9LssS1Hff19dv6oa8EaFOUZIRnOtAqC5jgnY5HuWTk=";
+  vendorHash = "sha256-LjTLLeK2M8W34z1M11wKuBAoDI6ciCG3f4FRWAre/sY=";
+
+  buildInputs = [ olm ];
 
   preBuild = ''
     go generate ./...
@@ -26,7 +29,7 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/sipeed/picoclaw/cmd/picoclaw/internal.version=${finalAttrs.version}"
+    "-X github.com/sipeed/picoclaw/pkg/config.Version=${finalAttrs.version}"
   ];
 
   doInstallCheck = true;
@@ -40,6 +43,8 @@ buildGoModule (finalAttrs: {
         "TestCodexCliProvider_MockCLI_Success"
         "TestCodexCliProvider_MockCLI_Error"
         "TestCodexCliProvider_MockCLI_WithModel"
+        "TestGatewayStopRefusesNonGatewayAttachedProcess"
+        "TestGatewayStatusIgnoresAndRemovesPidFileForNonGatewayProcess"
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index 5cceb499d9b5..034254572c8a 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -11,7 +11,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.66.3";
+  version = "2.67.0";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-EGYrEWB3YVVVNmc/KqtyLYbQPTcrv6+Piwqi347DB4c=";
+    hash = "sha256-LS8KW6dZe/CYdA1LvZlq1vL8YllnDZkD9WEEDOToY1M=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/qd/qdrant/package.nix b/pkgs/by-name/qd/qdrant/package.nix
index 8560277c44fa..963b8fa09411 100644
--- a/pkgs/by-name/qd/qdrant/package.nix
+++ b/pkgs/by-name/qd/qdrant/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "qdrant";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "qdrant";
     repo = "qdrant";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lqMyLnVD2iRu2AxlDHO7LzH2fFT01Gegn2JMhLAtDns=";
+    hash = "sha256-HLISCnfYM07jJ1jfER6i+zMlzYxWq+DJ2FVgpjkTytg=";
   };
 
-  cargoHash = "sha256-nYW1vZzDg2atNLqROFhzKLh0v6aZHoYKUeNNTb82tr4=";
+  cargoHash = "sha256-QG4HMADZmOu5ilFZBqogdrwBaBegoqNP9GvsDddUYbs=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/re/restic/package.nix b/pkgs/by-name/re/restic/package.nix
index 51c086ea76c1..76ec9ee316eb 100644
--- a/pkgs/by-name/re/restic/package.nix
+++ b/pkgs/by-name/re/restic/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "restic";
-  version = "0.18.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "restic";
     repo = "restic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lLinqZUOsZCPPybvVDB1f8o9Hl5qKYi0eHwJAaydsD8=";
+    hash = "sha256-9o67zhGDnWNuKGDun3OXtzZHKqw/vCzx5sLuQd/HzRY=";
   };
 
   patches = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     ./0001-Skip-testing-restore-with-permission-failure.patch
   ];
 
-  vendorHash = "sha256-4GVhG1sjFiuKyDUAgmSmFww5bDKIoCjejkkoSqkvU4E=";
+  vendorHash = "sha256-iJLnmxReBoHnt1xfewmmNs+fG3nqcNSpfJ1998wXKNU=";
 
   subPackages = [ "cmd/restic" ];
 
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index b544ae359863..f21c10be4aac 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2026-06-01";
+  version = "0-unstable-2026-06-02";
 
   outputs = [
     "out"
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "631641c39db42a2e67c9af7cf6a4e52d7250bb39";
-    hash = "sha256-Bjc2ksy4B3Vk6pgHE5nZ74FQ4ER/XpPt30OBerRkWOY=";
+    rev = "1d8b0556eefb11a77bc9c28249d16f7a3e0459e9";
+    hash = "sha256-+UcNgW9+1oQ4whv/5QI99M1IZSXgKedxAPH7RxZrgX0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index 1c707c969b25..08edd2d4d3bb 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -7,16 +7,16 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.5.2";
+  version = "6.5.4";
 
   sources = {
     "aarch64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-aarch64.AppImage";
-      hash = "sha256-VrPNKXgVO/9yvGqseOVkYKMFVqhtExL2PCJb6stn3ko=";
+      hash = "sha256-/tlCdCyy7FRlDMFWsx1S4JbIJqombk23LPum/tH6psU=";
     };
     "x86_64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-      hash = "sha256-caRL09PKJ33XHRReZ5qSpfgKH0wpJxGSHXfA83sz5UE=";
+      hash = "sha256-iQdy8nxakCv0XxpN04W50X3OWibcMn1ZnT+qYvkyfXg=";
     };
   };
 
diff --git a/pkgs/by-name/si/six-sines/package.nix b/pkgs/by-name/si/six-sines/package.nix
new file mode 100644
index 000000000000..14100abc6c98
--- /dev/null
+++ b/pkgs/by-name/si/six-sines/package.nix
@@ -0,0 +1,216 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  autoPatchelfHook,
+  # JUCE graphics / GL
+  freetype,
+  fontconfig,
+  libGL,
+  # JUCE / standalone audio + MIDI
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  # JUCE GUI: linked at build time (juce_gui_basics dlopens these at runtime,
+  # but the standalone host's X11 GUI path links them directly)
+  libx11,
+  libxext,
+  libxcursor,
+  libxinerama,
+  libxrandr,
+  libxrender,
+  libxscrnsaver,
+  # clap-wrapper's Linux standalone GUI host (auto-detected via pkg-config;
+  # if absent, the standalone still builds but can't show plugin windows)
+  gtkmm3,
+}:
+
+let
+  # The bundled clap-wrapper hard-codes CLAP_WRAPPER_DOWNLOAD_DEPENDENCIES=TRUE
+  # and CPM-fetches these from GitHub at configure time. We pre-fetch them so
+  # the build is hermetic, and feed the paths in via *_SDK_ROOT cmake flags;
+  # `base_sdks.cmake` short-circuits the CPM path when *_SDK_ROOT is set.
+  #
+  # Revisions are pinned to whatever the clap-wrapper submodule at the
+  # six-sines v1.1.0 tag requests in cmake/base_sdks.cmake. When bumping
+  # six-sines, re-check those tags here.
+  vst3sdk = fetchFromGitHub {
+    owner = "steinbergmedia";
+    repo = "vst3sdk";
+    rev = "v3.7.6_build_18";
+    fetchSubmodules = true;
+    hash = "sha256-MeMb09bM8D4FPHWvvRbmWbiyO9u8JVxyfgv4jmeogLI=";
+    # The `doc` submodule is ~130 MB of PDFs we never reference. The
+    # `vstgui4` submodule isn't touched by clap-wrapper's VST3 glue either,
+    # but it's small (~12 MB) and removing it would diverge further from
+    # upstream Steinberg, so leave it in.
+    postFetch = ''
+      rm -rf $out/doc
+    '';
+  };
+
+  rtaudio-src = fetchFromGitHub {
+    owner = "thestk";
+    repo = "rtaudio";
+    rev = "6.0.1";
+    hash = "sha256-Acsxbnl+V+Y4mKC1gD11n0m03E96HMK+oEY/YV7rlIY=";
+  };
+
+  rtmidi-src = fetchFromGitHub {
+    owner = "thestk";
+    repo = "rtmidi";
+    rev = "6.0.0";
+    hash = "sha256-QuUeFx8rPpe0+exB3chT6dUceDa/7ygVy+cQYykq7e0=";
+  };
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "six-sines";
+  version = "1.1.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "baconpaul";
+    repo = "six-sines";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-IQLGC86FqS3dptPzNpHEYKB59MWFDKsOPGM+FuzGcPo=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoPatchelfHook
+  ];
+
+  # nixpkgs' default `format` hardening injects `-Wformat -Wformat-security
+  # -Werror=format-security`. clap-wrapper's base_sdks.cmake adds
+  # `-Wno-format` privately to the VST3 SDK targets to silence a known
+  # confusion between `%lld` and `long long int`, which leaves
+  # `-Werror=format-security` dangling — and gcc treats "X ignored without
+  # Y" as a `-Werror=format-security` violation in its own right, breaking
+  # the base-sdk-vst3 compile. Disabling the whole hardening flag is the
+  # smallest change that lets the SDK's own pragma stand.
+  hardeningDisable = [ "format" ];
+
+  buildInputs = [
+    freetype
+    fontconfig
+    libGL
+    alsa-lib
+    libjack2
+    libpulseaudio
+    libx11
+    libxext
+    libxcursor
+    libxinerama
+    libxrandr
+    libxrender
+    libxscrnsaver
+    gtkmm3
+  ];
+
+  # JUCE loads several X11 libraries via dlopen() in juce_XSymbols_linux.h
+  # (libx11.so.6, libxext.so.6, libxcursor.so.1, libxinerama.so.1,
+  # libxrender.so.1, libxrandr.so.2, plus libxss.so.1 from
+  # juce_XWindowSystem_linux.cpp). Listing them in runtimeDependencies makes
+  # autoPatchelfHook bake them into the binaries' RPATH.
+  runtimeDependencies = [
+    libx11
+    libxext
+    libxcursor
+    libxinerama
+    libxrandr
+    libxrender
+    libxscrnsaver
+  ];
+
+  postPatch = ''
+    # sst-plugininfra's version_from_versionfile_or_git() looks for a
+    # BUILD_VERSION file before falling back to `git describe`. fetchFromGitHub
+    # strips .git, so we provide the file directly. The format is 5 lines:
+    # header (ignored), commit hash, tag, branch, display version.
+    cat > BUILD_VERSION <<EOF
+    Six Sines v${finalAttrs.version}
+    v${finalAttrs.version}
+    v${finalAttrs.version}
+    main
+    ${finalAttrs.version}
+    EOF
+  '';
+
+  cmakeFlags = [
+    # Don't try to copy build artefacts into ~/.clap and ~/.vst3 from
+    # within the build (CMake's POST_BUILD step in clap-wrapper's
+    # target_copy_after_build()).
+    (lib.cmakeBool "COPY_AFTER_BUILD" false)
+
+    # Hand clap-wrapper the SDK trees it would otherwise CPM-download.
+    # base_sdks.cmake short-circuits the CPM path whenever a *_SDK_ROOT is
+    # set, so we don't need to additionally flip CLAP_WRAPPER_DOWNLOAD_DEPENDENCIES.
+    (lib.cmakeFeature "VST3_SDK_ROOT" "${vst3sdk}")
+    (lib.cmakeFeature "RTAUDIO_SDK_ROOT" "${rtaudio-src}")
+    (lib.cmakeFeature "RTMIDI_SDK_ROOT" "${rtmidi-src}")
+
+    # CMake 4 hard-removed support for cmake_minimum_required(VERSION < 3.5).
+    # The bundled libsamplerate submodule still declares `VERSION 3.1..3.18`
+    # at the top of its CMakeLists.txt and refuses to configure otherwise.
+    # 3.5 is the value CMake itself suggests in the error.
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
+
+  # The CMakeLists exposes a `six-sines_all` custom target that aggregates
+  # the `_clap`, `_vst3`, and `_standalone` sub-targets (`_auv2` is
+  # APPLE-gated and absent on Linux). The default ALL target would build
+  # the same outputs in practice — the test subdir is already EXCLUDE_FROM_ALL
+  # — but going through `six-sines_all` matches what upstream documents and
+  # keeps the surface narrow if extra default targets ever land later.
+  buildPhase = ''
+    runHook preBuild
+    cmake --build . --config Release --parallel "$NIX_BUILD_CORES" --target six-sines_all
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/lib/clap $out/lib/vst3 $out/bin
+
+    # The clap-wrapper assets dir is flat on Linux — the CLAP/ and VST3/
+    # subdirectories only get created on Windows (the relevant branches in
+    # make_clapfirst.cmake and wrap_vst3.cmake are gated on WIN32). On
+    # Linux and macOS everything lands directly in ''${CMAKE_BINARY_DIR}/
+    # six-sines_assets/.
+    cp -r 'six-sines_assets/Six Sines.clap' "$out/lib/clap/"
+    cp -r 'six-sines_assets/Six Sines.vst3' "$out/lib/vst3/"
+
+    # Rename the standalone to a Unix-friendly $out/bin name.
+    install -m755 'six-sines_assets/Six Sines' "$out/bin/six-sines"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Small synthesizer exploring audio-rate inter-modulation of sine waves (FM/PM/AM)";
+    longDescription = ''
+      Six Sines is a six-operator phase-/amplitude-/ring-modulation synthesizer
+      by Paul Walker (baconpaul). It ships as a CLAP plug-in, a VST3 plug-in,
+      and a standalone application backed by RtAudio (ALSA / JACK / PulseAudio).
+    '';
+    homepage = "https://github.com/baconpaul/six-sines";
+    changelog = "https://github.com/baconpaul/six-sines/blob/v${finalAttrs.version}/doc/changelog.md";
+    # Author's own code is MIT (see LICENSE.md), but the binary statically
+    # links GPL3 JUCE, so the combined work is distributed under GPL3+
+    # (resources/LICENSE_GPL3).
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    mainProgram = "six-sines";
+    # cmake/compile-options.cmake hard-codes `-march=nehalem` for non-Apple
+    # builds, and clap-wrapper hard-codes the VST3 bundle architecture path
+    # to `x86_64-linux`. aarch64-linux would require patching both.
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/sl/slimevr-server/package.nix b/pkgs/by-name/sl/slimevr-server/package.nix
index 55e3846a4855..97f009fbca92 100644
--- a/pkgs/by-name/sl/slimevr-server/package.nix
+++ b/pkgs/by-name/sl/slimevr-server/package.nix
@@ -99,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
       loucass003
     ];
     platforms = with lib.platforms; darwin ++ linux;
+    broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "slimevr-server";
   };
 })
diff --git a/pkgs/by-name/sl/slimevr/package.nix b/pkgs/by-name/sl/slimevr/package.nix
index c6777363588b..8a19904fad5b 100644
--- a/pkgs/by-name/sl/slimevr/package.nix
+++ b/pkgs/by-name/sl/slimevr/package.nix
@@ -6,7 +6,7 @@
   replaceVars,
   nodejs,
   pnpmConfigHook,
-  pnpm_9,
+  pnpm_10,
   electron,
   makeWrapper,
   slimevr-server,
@@ -30,9 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     pname = "${finalAttrs.pname}-pnpm-deps";
     inherit (finalAttrs) version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-gGBwE6QxJsbVmQc1e390SSXAjs/T992ju8y9wz1H1QQ=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-Y8TSsoXqRxexar9uFKHiIuogAuLSTMqK9blFbMVTwOE=";
   };
 
   patches = [
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     makeWrapper
     copyDesktopItems
     udevCheckHook
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index 656edd499d13..d496a193a4fc 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -6,7 +6,7 @@
   libredirect,
   buildGoModule,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   esbuild,
@@ -51,15 +51,15 @@ buildGoModule (finalAttrs: {
         src
         sourceRoot
         ;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-paCYfh7tjDuPm8JCpzhCNjL1ZsyQTNxofW8UNIKjqmE=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-i4ji/NjK6/hpqrma+DJ2x5kKq/YEN3Cy8mKQLy1M+dU=";
     };
 
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
     ];
 
     env.ESBUILD_BINARY_PATH = lib.getExe lockedEsbuild;
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 71ced608ab2f..62550cd2cd06 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -20,7 +20,7 @@ let
   television = rustPlatform.buildRustPackage (finalAttrs: {
     pname = "television";
 
-    version = "0.15.7";
+    version = "0.15.8";
 
     __structuredAttrs = true;
 
@@ -28,10 +28,10 @@ let
       owner = "alexpasmantier";
       repo = "television";
       tag = finalAttrs.version;
-      hash = "sha256-VfCD3qXgueXqJbImOQbnY5JtAFVmzazBQ5Tgh4YIw4s=";
+      hash = "sha256-Q+F+Q/DCIML1d5bupaoReVMmCldfp7rzmoVgaqg7bPw=";
     };
 
-    cargoHash = "sha256-tChehWQhCwmM3JPfJrtE3J5zQ1gPSqlQJn85DPqHKTI=";
+    cargoHash = "sha256-l4lFyU6psDt2+xFfVKsX13QwurZJ56xMhV1bm1Lw7MA=";
 
     nativeBuildInputs = [
       installShellFiles
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index 5448fd0aecf6..725b0332f154 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.14.21";
+  version = "0.14.25";
 
   __structuredAttrs = true;
 
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8u3hWzbFY/qwUKDvoESVJODNQdxyV/c36iz6M1sCQ5A=";
+    hash = "sha256-F+GDI+1n8PqhWIxHlKgdsZ8IhQo0CsyAV6g26f5ITVo=";
   };
 
-  cargoHash = "sha256-Wt885VcPCv7uNSuhHa9LuuWsfCOwz711N6E8YqXYsMI=";
+  cargoHash = "sha256-JpeXrk/6FP27rcG84CzeaCn9JEMopvtu/rg7/w1TgzI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/tr/transmission_4/package.nix b/pkgs/by-name/tr/transmission_4/package.nix
index 3c19ae576f1d..06e9cf106a77 100644
--- a/pkgs/by-name/tr/transmission_4/package.nix
+++ b/pkgs/by-name/tr/transmission_4/package.nix
@@ -255,6 +255,6 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       mit
     ];
-    platforms = lib.platforms.unix;
+    platforms = if enableMac then lib.platforms.darwin else lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index f6b386740b4a..5d0a7b3863c5 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "348.260529.2";
+  version = "350.260608.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-lBBI+Jhmm0+jmsV2Vq3UFU5ViyeuHVOluRoLrHIwyiM=";
+    hash = "sha256-y/wUe8kNlA4XmbJrjjAYSnNAMAB8OgVmCrum6bYAyV4=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/by-name/ty/typos/package.nix b/pkgs/by-name/ty/typos/package.nix
index 816ff0f32537..bea2153517a6 100644
--- a/pkgs/by-name/ty/typos/package.nix
+++ b/pkgs/by-name/ty/typos/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "typos";
-  version = "1.47.0";
+  version = "1.47.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "typos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ESKwH9w6TXmn4sqiaZua7cDi6BbwgKtP6dPgedGNhC8=";
+    hash = "sha256-S7end5AqeNm4M/ox2BVb6mTGaJmO6jhz1Rczs0otaWk=";
   };
 
-  cargoHash = "sha256-0iGunX9HbZXmpwJA5bOr60cBiATcDmnI0+OpNipo0oY=";
+  cargoHash = "sha256-w39zZ508kBnrkesqlgGv+6Y9FRGHEZlNz48MaOixfP8=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/un/undock/package.nix b/pkgs/by-name/un/undock/package.nix
index 16965a873d9b..155308e81ddd 100644
--- a/pkgs/by-name/un/undock/package.nix
+++ b/pkgs/by-name/un/undock/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "undock";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "crazy-max";
     repo = "undock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bddCRAphSn01kWHkE32/4I+EAMvcaEJ4VIbDG5ydE0Y=";
+    hash = "sha256-PA2v5k2EciNtcDhLNJCRstLWpuk1RfKOhc9oyYaNehc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/wh/whichllm/package.nix b/pkgs/by-name/wh/whichllm/package.nix
index 79fd5f198c5c..f2adf453b9cd 100644
--- a/pkgs/by-name/wh/whichllm/package.nix
+++ b/pkgs/by-name/wh/whichllm/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "whichllm";
-  version = "0.5.7";
+  version = "0.5.9";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Andyyyy64";
     repo = "whichllm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UvhCSC9tKpdgXFCMGn0HWM0kuHhXSauEr/ys/9PUIRs=";
+    hash = "sha256-TWDAg/AM0fg8oQj4To+Ht/DVIi9SieNMyYfQMsbKRtI=";
   };
 
   build-system = with python3Packages; [ hatchling ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 6dbace9edac2..c1d29b481de2 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1137,15 +1137,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.70-1";
+      version = "1.6.71-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.70-1.rockspec";
-          sha256 = "06cb19vg9rj48idc22ncjabb1phhrbiklr42mazf5y91dd9w8b19";
+          url = "mirror://luarocks/grug-far.nvim-1.6.71-1.rockspec";
+          sha256 = "1gvwjg617qimb8i737hvdr423py7ry8c0lsna9chpxaks3j0cf4n";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/5506c2f59dc9ab2ed6c233585412b24d31d51521.zip";
-        sha256 = "1n62s1z0r78snlravyh0k4kp5i7gsyi5p78fpgilgqaqs6s8my48";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/c995bbacf8229dc096ec1c3d60f8531059c86c1b.zip";
+        sha256 = "15wv6hvkiqi0rdg59y7dgaz7g6nz3141fdmkdggrc1h8aadky9zr";
       };
 
       disabled = luaOlder "5.1";
@@ -1168,15 +1168,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "haskell-tools.nvim";
-      version = "9.0.2-1";
+      version = "10.0.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/haskell-tools.nvim-9.0.2-1.rockspec";
-          sha256 = "1k4p153lvl7y5a301q45072ldxkic18d6ymfz814qc5vxbk6xalg";
+          url = "mirror://luarocks/haskell-tools.nvim-10.0.0-1.rockspec";
+          sha256 = "1jh1g10nhjx8vj1xpsacq09bs78cygxmf0yipgdkh9ry5cfmf8pm";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v9.0.2.zip";
-        sha256 = "1vl9z9snw8wzgnib7244z9gld61f2y4kp66540ia2yi8gp214n7l";
+        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v10.0.0.zip";
+        sha256 = "0r2h42d7fsf08cl7lkp3wm0qj22r4vd68l33q7lr9jzsw8bls2pk";
       };
 
       disabled = luaOlder "5.1";
@@ -2463,17 +2463,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lua-resty-openssl";
-      version = "1.7.1-1";
+      version = "1.8.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-openssl-1.7.1-1.rockspec";
-          sha256 = "1gvgz0p9j90grqjx501r1h6d3z866j550b3jlfjrcr1qb1xy5b6l";
+          url = "mirror://luarocks/lua-resty-openssl-1.8.0-1.rockspec";
+          sha256 = "1x6hbk8xcwaaa11wcs48fjpj1bipz2a3h8lswnzl3l25llv1gsib";
         }).outPath;
       src = fetchFromGitHub {
         owner = "fffonion";
         repo = "lua-resty-openssl";
-        tag = "1.7.1";
-        hash = "sha256-Zj4neqIptfg8Qckj6BOoHpnVlxCNmJuIgg1kcuqt6pw=";
+        tag = "1.8.0";
+        hash = "sha256-oafU+pwTxbPHrci0pEWdZNHu0eqEluEDF5M6ojx7Xeg=";
       };
 
       meta = {
@@ -2946,17 +2946,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luadbi";
-      version = "0.7.4-1";
+      version = "0.7.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luadbi-0.7.4-1.rockspec";
-          sha256 = "12nqbl2zmwyz7k0x1y5h235di3jb0xwf27p1rh8lcgg4cqx6izr7";
+          url = "mirror://luarocks/luadbi-0.7.5-1.rockspec";
+          sha256 = "1xd4jkqd74zqcpql4kyqlv2n1q4k4bvj2l59nz0fmqbmmlmfk0fw";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mwild1";
         repo = "luadbi";
-        tag = "v0.7.4";
-        hash = "sha256-N4I8zVTodS01QUIncwAts/vxh2aFY2nYCnVmpN+2HwM=";
+        tag = "v0.7.5";
+        hash = "sha256-KShn2FLRYf7oc0+jce2JIUePx+eRFeCq+K9EFXz5tU8=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.5";
@@ -2990,17 +2990,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luadbi-mysql";
-      version = "0.7.4-1";
+      version = "0.7.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luadbi-mysql-0.7.4-1.rockspec";
-          sha256 = "0ngpml0mw272pp03kabl1q3jj4fd5hmdlgvw9a2hgl0051358i6c";
+          url = "mirror://luarocks/luadbi-mysql-0.7.5-1.rockspec";
+          sha256 = "1bb89d56aplz7m58g6cmscd2xgpxm38f2m72yabq5n0vg1bm2ypn";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mwild1";
         repo = "luadbi";
-        tag = "v0.7.4";
-        hash = "sha256-N4I8zVTodS01QUIncwAts/vxh2aFY2nYCnVmpN+2HwM=";
+        tag = "v0.7.5";
+        hash = "sha256-KShn2FLRYf7oc0+jce2JIUePx+eRFeCq+K9EFXz5tU8=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.5";
@@ -3035,17 +3035,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luadbi-postgresql";
-      version = "0.7.4-1";
+      version = "0.7.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luadbi-postgresql-0.7.4-1.rockspec";
-          sha256 = "0wybfngdz8hw4sgmz8rmym1frz6fwrvpx1l5gh0j68m7q4l25crg";
+          url = "mirror://luarocks/luadbi-postgresql-0.7.5-1.rockspec";
+          sha256 = "077nlwxh0dxrp0d0ysjcv3cwz77yn7phvzfn06wdd4vg591cnzg1";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mwild1";
         repo = "luadbi";
-        tag = "v0.7.4";
-        hash = "sha256-N4I8zVTodS01QUIncwAts/vxh2aFY2nYCnVmpN+2HwM=";
+        tag = "v0.7.5";
+        hash = "sha256-KShn2FLRYf7oc0+jce2JIUePx+eRFeCq+K9EFXz5tU8=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.5";
@@ -3080,17 +3080,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luadbi-sqlite3";
-      version = "0.7.4-1";
+      version = "0.7.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luadbi-sqlite3-0.7.4-1.rockspec";
-          sha256 = "05kjihy5a8hyhn286gi2q1qyyiy8ajnyqp90wv41zjvhxjhg8ymx";
+          url = "mirror://luarocks/luadbi-sqlite3-0.7.5-1.rockspec";
+          sha256 = "0gvc6p8cpkr500dc5kq6k38q3wc09z0aw3w3ialdvjv9jcq7dqlr";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mwild1";
         repo = "luadbi";
-        tag = "v0.7.4";
-        hash = "sha256-N4I8zVTodS01QUIncwAts/vxh2aFY2nYCnVmpN+2HwM=";
+        tag = "v0.7.5";
+        hash = "sha256-KShn2FLRYf7oc0+jce2JIUePx+eRFeCq+K9EFXz5tU8=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.5";
@@ -5619,21 +5619,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "9.0.4-2";
+      version = "9.0.5-2";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-9.0.4-2.rockspec";
-          sha256 = "1l5jnk665cig8hgcfby4g2w8ffi5lsndx6nvc1pjjjhqz3m69c3w";
+          url = "mirror://luarocks/rustaceanvim-9.0.5-2.rockspec";
+          sha256 = "1wqs1nri1q4j91l7myn57667sxznisa1sgwhx4cakgancnl5m8s1";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.4.zip";
-        sha256 = "1m9ryz4ivrvjmz6zmffj01xc13kral6zvkwqaivhi6gx4553ya09";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.5.zip";
+        sha256 = "14396a3m4px4zcnpmfwkj3csxsmrbgx0v7yx6w8zni94zaixdacx";
       };
 
       disabled = lua.luaversion != "5.1";
 
       meta = {
-        homepage = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.4.zip";
+        homepage = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.5.zip";
         maintainers = with lib.maintainers; [ mrcjkb ];
         license = lib.licenses.gpl2Only;
         description = "🦀 Supercharge your Rust experience in Neovim! A heavily modified fork of rust-tools.nvim";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index b5616ef99519..2dfdf5fd83d0 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -591,8 +591,8 @@ in
 
     luarocksConfig = lib.recursiveUpdate old.luarocksConfig {
       variables = {
-        MYSQL_INCDIR = "${lib.getDev libmysqlclient}/include/";
-        MYSQL_LIBDIR = "${lib.getLib libmysqlclient}/lib//mysql/";
+        MYSQL_INCDIR = "${lib.getDev libmysqlclient}/include/mysql";
+        MYSQL_LIBDIR = "${lib.getLib libmysqlclient}/lib/mysql";
       };
     };
     buildInputs = old.buildInputs ++ [
@@ -1004,9 +1004,11 @@ in
       rm tests/plenary/colors/colors_spec.lua # colors depend on neovim version usually
       rm tests/plenary/capture/capture_spec.lua # because clipboard not available
 
+      # UI tests depend on the neovim version
+      rm -r tests/plenary/ui/*
+
       # not sure why yet
-      rm tests/plenary/ui/mappings/date_spec.lua \
-        tests/plenary/capture/templates_spec.lua
+      rm tests/plenary/capture/templates_spec.lua
 
       # bypass upstream launcher that interacts with network
       nvim --headless -i NONE \
diff --git a/pkgs/development/ocaml-modules/lun/default.nix b/pkgs/development/ocaml-modules/lun/default.nix
index 7e6c615f1663..4d78e72c9c0b 100644
--- a/pkgs/development/ocaml-modules/lun/default.nix
+++ b/pkgs/development/ocaml-modules/lun/default.nix
@@ -6,13 +6,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "lun";
-  version = "0.0.2";
+  version = "0.0.3";
 
   minimalOCamlVersion = "4.12.0";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/lun/releases/download/v${finalAttrs.version}/lun-${finalAttrs.version}.tbz";
-    hash = "sha256-1oqjTXY+/jJT1uQOV6iiK9qV9DAmERYsL2BtentmB8I=";
+    hash = "sha256-d/LIzil/ecCQffPyk2e7Iy6zOD9sfOhk2jsSLENUp0U=";
   };
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/timedesc/default.nix b/pkgs/development/ocaml-modules/timedesc/default.nix
index 5d46988949d0..c0ff0b6897c2 100644
--- a/pkgs/development/ocaml-modules/timedesc/default.nix
+++ b/pkgs/development/ocaml-modules/timedesc/default.nix
@@ -9,13 +9,13 @@
   timedesc-tzlocal,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "timedesc";
-  version = "3.1.0";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://github.com/daypack-dev/timere/releases/download/timedesc-${version}/timedesc-${version}.tar.gz";
-    hash = "sha256-nEachJymJC8TP/Ha2rOFU3n09rxVlIZYmgQnYiNCiHE=";
+    url = "https://github.com/daypack-dev/timere/releases/download/timedesc-${finalAttrs.version}/timedesc-${finalAttrs.version}.tar.gz";
+    hash = "sha256-hXdijGY0qu+pLR2XtK/KL9gXvCstbZedo1379lqA1r0=";
   };
 
   sourceRoot = ".";
@@ -34,4 +34,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/timedesc/tzlocal.nix b/pkgs/development/ocaml-modules/timedesc/tzlocal.nix
index 5d4cabd3b493..1f50c00413f2 100644
--- a/pkgs/development/ocaml-modules/timedesc/tzlocal.nix
+++ b/pkgs/development/ocaml-modules/timedesc/tzlocal.nix
@@ -8,8 +8,6 @@ buildDunePackage {
 
   inherit (timedesc) version src sourceRoot;
 
-  minimalOCamlVersion = "4.08";
-
   meta = timedesc.meta // {
     description = "Virtual library for Timedesc local time zone detection backends";
   };
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 3a2fee59fc6c..3d2fd1706ab7 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.50.0";
+  version = "2.52.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OIkELIVPXjSqp9L7GqWwodLUrXpHa6GYKSeHF0fbhIk=";
+    hash = "sha256-Acqwa1zmDV4+xedGtabtB/utU4D5WkgbLyYCrmZiwFo=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/influxdb3-python/default.nix b/pkgs/development/python-modules/influxdb3-python/default.nix
index 5c18b4107cc1..d6d6312d5a43 100644
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@@ -14,17 +14,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "influxdb3-python";
-  version = "0.18.0";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "InfluxCommunity";
     repo = "influxdb3-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6IR1Jd/4cKk+79lh8NrfLfDtFQgEDEe9KCDIuOyUVsE=";
+    hash = "sha256-gCIaOE0k/h1Lb4wIuw+eOEjwdDJVc8tGd3Ql6JE+gmE=";
   };
 
   postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=82.0.1" "setuptools"
     # Upstream falls back to a default version if not in a GitHub Actions
     substituteInPlace setup.py \
       --replace-fail "version=get_version()," "version = '${finalAttrs.version}',"
diff --git a/pkgs/development/python-modules/litestar/default.nix b/pkgs/development/python-modules/litestar/default.nix
index e0d0c0f0224b..53e189ef577b 100644
--- a/pkgs/development/python-modules/litestar/default.nix
+++ b/pkgs/development/python-modules/litestar/default.nix
@@ -60,14 +60,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "litestar";
-  version = "2.21.1";
+  version = "2.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "litestar-org";
     repo = "litestar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dH51GecYwVTnOO+F1FJnFR2VO3IvLbpKWbxK7jssak8=";
+    hash = "sha256-EKCQQElL4pq5Li52RUP68UKJQ+NyuCdEh7zz15ugP2s=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 629c2cba2e0d..898c53fca80e 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -73,11 +73,18 @@ buildPythonPackage rec {
     # https://github.com/MagicStack/uvloop/issues/709
     "tests/test_process.py::TestAsyncio_AIO_Process::test_cancel_post_init"
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Segmentation fault
     "tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
     # Broken: https://github.com/NixOS/nixpkgs/issues/160904
     "tests/test_context.py::Test_UV_Context::test_create_ssl_server_manual_connection_lost"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # SSL record layer failures & ConnectionResetError
+    "tests/test_tcp.py::Test_AIO_TCPSSL"
+    "tests/test_tcp.py::Test_UV_TCPSSL"
+    "tests/test_unix.py::Test_AIO_UnixSSL"
+    "tests/test_unix.py::Test_UV_UnixSSL"
   ];
 
   preCheck = ''
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6102340485fc..aca3b795ba1e 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.11";
+    version = "7.0.12";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "03h6f1pa96xdszpxcnd846n5jgwqmc49gf9wbyq1gy8rlzpc59yr";
+      sha256 = "02fkkmmc28rw0kg02807jvv6k745zqfb9wg65dfd8sl298krp0fp";
     };
 
     # This is based on the following source:
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index a292540c5a2b..1939ed7bf96b 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildHomeAssistantComponent,
   fetchFromGitHub,
-  h2,
+  httpx,
   home-assistant,
   pytest-cov-stub,
   pytest-homeassistant-custom-component,
@@ -34,11 +34,7 @@ buildHomeAssistantComponent rec {
       --replace-fail '"--timeout=60",' ""
   '';
 
-  dependencies = [
-    # Uncodumented, but otherwise the home-assistant helpers/httpx_client.py fails like:
-    # ImportError: Using http2=True, but the 'h2' package is not installed. Make sure to install httpx using `pip install httpx[http2]`.
-    h2
-  ];
+  dependencies = httpx.optional-dependencies.http2;
 
   nativeCheckInputs = [
     home-assistant