Merge staging-next into staging

2025-06-10 11:45:45 +03:00 · 2025-04-16 18:05:39 +00:00 · 2025-04-16 18:05:39 +00:00 · d8e0934a9d
commit d8e0934a9d
parent a0c5005f59 4963a3e8c2
89 changed files with 1976 additions and 517 deletions
--- a/doc/hooks/autopatchcil.section.md
+++ b/doc/hooks/autopatchcil.section.md
@ -0,0 +1,17 @@
+# autoPatchcilHook {#setup-hook-autopatchcilhook}
+
+This is a special setup hook which helps in packaging .NET assemblies/programs in that it automatically tries to find missing shared library dependencies of .NET assemblies based on the given `buildInputs` and `nativeBuildInputs`.
+
+As the hook needs information for the host where the package will be run on, there's a required environment variable called `autoPatchcilRuntimeId` which should be filled in with the RID (Runtime Identifier) of the machine where the output will be run on. If you're using `buildDotnetModule`, it will fall back to `dotnetRuntimeIds` (which is set to `lib.singleton (if runtimeId != null then runtimeId else systemToDotnetRid stdenvNoCC.hostPlatform.system)`) for you if not provided.
+
+In certain situations you may want to run the main command (`autoPatchcil`) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the `dontAutoPatchcil` environment variable to a non-empty value.
+
+By default, `autoPatchcil` will fail as soon as any .NET assembly requires a dependency which cannot be resolved via the given build inputs. In some situations you might prefer to just leave missing dependencies unpatched and continue to patch the rest. This can be achieved by setting the `autoPatchcilIgnoreMissingDeps` environment variable to a non-empty value. `autoPatchcilIgnoreMissingDeps` can be set to a list like `autoPatchcilIgnoreMissingDeps = [ "libcuda.so.1" "libcudart.so.1" ];` or to `[ "*" ]` to ignore all missing dependencies.
+
+The `autoPatchcil` command requires the `--rid` command line flag, informing the RID (Runtime Identifier) it should assume the assemblies will be executed on, and also recognizes a `--no-recurse` command line flag, which prevents it from recursing into subdirectories.
+
+::: {.note}
+Since, unlike most native binaries, .NET assemblies are compiled once to run on any platform, many assemblies may have PInvoke stubs for libraries that might not be available on the platform that the package will effectively run on. A few examples are assemblies that call native Windows APIs through PInvoke targeting `kernel32`, `gdi32`, `user32`, `shell32` or `ntdll`.
+
+`autoPatchcil` does its best to ignore dependencies from other platforms by checking the requested file extensions, however not all PInvoke stubs provide an extension so in those cases it will be necessary to list those in `autoPatchcilIgnoreMissingDeps` manually.
+:::
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@ -7,6 +7,7 @@ The stdenv built-in hooks are documented in [](#ssec-setup-hooks).
 ```{=include=} sections
 autoconf.section.md
 automake.section.md
+autopatchcil.section.md
 autopatchelf.section.md
 aws-c-common.section.md
 bmake.section.md
--- a/doc/redirects.json
+++ b/doc/redirects.json
@ -2067,6 +2067,9 @@
  "setup-hook-automake": [
    "index.html#setup-hook-automake"
  ],
+  "setup-hook-autopatchcilhook": [
+    "index.html#setup-hook-autopatchcilhook"
+  ],
  "setup-hook-autopatchelfhook": [
    "index.html#setup-hook-autopatchelfhook"
  ],
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -68,6 +68,8 @@
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
  The `name` argument will become mandatory in a future release.

+- [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`.
+
 - `grafana-agent` and `services.grafana-agent` have been removed in favor of
  Grafana Alloy (`grafana-alloy` and `services.alloy`), as they depend on an EOL compiler version
  and will become EOL during the 25.05 lifecycle.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5020,6 +5020,12 @@
    githubId = 6470493;
    name = "Craige McWhirter";
  };
+  craigf = {
+    email = "craig@craigfurman.dev";
+    github = "craigfurman";
+    githubId = 4772216;
+    name = "Craig Furman";
+  };
  cransom = {
    email = "cransom@hubns.net";
    github = "cransom";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -4,7 +4,7 @@ ansicolors,,,,,,Freed-Wu
 argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
-bit32,,,,5.3.0-1,5.1,lblasc
+bit32,,,,,5.1,lblasc
 busted,,,,,,
 busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -416,6 +416,8 @@

 - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.

+- `services.homepage-dashboard` now requires the `allowedHosts` option to be set in accordance with the [documentation](https://gethomepage.dev/installation/#homepage_allowed_hosts).
+
 - `services.netbird.tunnels` was renamed to [`services.netbird.clients`](#opt-services.netbird.clients),
  hardened (using dedicated less-privileged users) and significantly extended.

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1055,6 +1055,8 @@
  ./services/networking/atticd.nix
  ./services/networking/autossh.nix
  ./services/networking/avahi-daemon.nix
+  ./services/networking/ax25/axlisten.nix
+  ./services/networking/ax25/axports.nix
  ./services/networking/babeld.nix
  ./services/networking/bee.nix
  ./services/networking/biboumi.nix
--- a/nixos/modules/services/misc/homepage-dashboard.nix
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@ -4,7 +4,6 @@
  lib,
  ...
 }:
-
 let
  cfg = config.services.homepage-dashboard;
  # Define the settings format used for this program
@ -29,6 +28,19 @@ in
        description = "Port for Homepage to bind to.";
      };

+      allowedHosts = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost:8082,127.0.0.1:8082";
+        example = "example.com";
+        description = ''
+          Hosts that homepage-dashboard will be running under.
+          You will want to change this in order to acess homepage from anything other than localhost.
+          see the upsream documentation:
+
+          <https://gethomepage.dev/installation/#homepage_allowed_hosts>
+        '';
+      };
+
      environmentFile = lib.mkOption {
        type = lib.types.str;
        description = ''
@ -215,6 +227,7 @@ in
        NIXPKGS_HOMEPAGE_CACHE_DIR = "/var/cache/homepage-dashboard";
        PORT = toString cfg.listenPort;
        LOG_TARGETS = "stdout";
+        HOMEPAGE_ALLOWED_HOSTS = cfg.allowedHosts;
      };

      serviceConfig = {
--- a/nixos/modules/services/networking/ax25/axlisten.nix
+++ b/nixos/modules/services/networking/ax25/axlisten.nix
@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    literalExpression
+    ;
+
+  cfg = config.services.ax25.axlisten;
+in
+{
+  options = {
+
+    services.ax25.axlisten = {
+
+      enable = mkEnableOption "AX.25 axlisten daemon";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.ax25-apps;
+        defaultText = literalExpression "pkgs.ax25-apps";
+        description = "The ax25-apps package to use.";
+      };
+
+      config = mkOption {
+        type = types.str;
+        default = "-art";
+        description = ''
+          Options that will be passed to the axlisten daemon.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.axlisten = {
+      description = "AX.25 traffic monitor";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "ax25-axports.target" ];
+      requires = [ "ax25-axports.target" ];
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${cfg.package}/bin/axlisten ${cfg.config}";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/ax25/axports.nix
+++ b/nixos/modules/services/networking/ax25/axports.nix
@ -0,0 +1,149 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.strings)
+    concatStringsSep
+    optionalString
+    ;
+
+  inherit (lib.attrsets)
+    filterAttrs
+    mapAttrsToList
+    mapAttrs'
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    ;
+
+  cfg = config.services.ax25.axports;
+
+  enabledAxports = filterAttrs (ax25Name: cfg: cfg.enable) cfg;
+
+  axportsOpts = {
+
+    options = {
+      enable = mkEnableOption "Enables the axport interface";
+
+      package = mkPackageOption pkgs "ax25-tools" { };
+
+      tty = mkOption {
+        type = types.str;
+        example = "/dev/ttyACM0";
+        description = ''
+          Location of hardware kiss tnc for this interface.
+        '';
+      };
+
+      callsign = mkOption {
+        type = types.str;
+        example = "WB6WLV-7";
+        description = ''
+          The callsign of the physical interface to bind to.
+        '';
+      };
+
+      description = mkOption {
+        type = types.str;
+        # This cannot be empty since some ax25 tools cant parse /etc/ax25/axports without it
+        default = "NixOS managed tnc";
+        description = ''
+          Free format description of this interface.
+        '';
+      };
+
+      baud = mkOption {
+        type = types.int;
+        example = 57600;
+        description = ''
+          The serial port speed of this interface.
+        '';
+      };
+
+      paclen = mkOption {
+        type = types.int;
+        default = 255;
+        description = ''
+          Default maximum packet size for this interface.
+        '';
+      };
+
+      window = mkOption {
+        type = types.int;
+        default = 7;
+        description = ''
+          Default window size for this interface.
+        '';
+      };
+
+      kissParams = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "-t 300 -l 10 -s 12 -r 80 -f n";
+        description = ''
+          Kissattach parameters for this interface.
+        '';
+      };
+    };
+  };
+in
+{
+
+  options = {
+
+    services.ax25.axports = mkOption {
+      type = types.attrsOf (types.submodule axportsOpts);
+      default = { };
+      description = "Specification of one or more AX.25 ports.";
+    };
+  };
+
+  config = mkIf (enabledAxports != { }) {
+
+    environment.etc."ax25/axports" = {
+      text = concatStringsSep "\n" (
+        mapAttrsToList (
+          portName: portCfg:
+          "${portName} ${portCfg.callsign} ${toString portCfg.baud} ${toString portCfg.paclen} ${toString portCfg.window} ${portCfg.description}"
+        ) enabledAxports
+      );
+      mode = "0644";
+    };
+
+    systemd.targets.ax25-axports = {
+      description = "AX.25 axports group target";
+    };
+
+    systemd.services = mapAttrs' (portName: portCfg: {
+      name = "ax25-kissattach-${portName}";
+      value = {
+        description = "AX.25 KISS attached interface for ${portName}";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "ax25-axports.target" ];
+        partOf = [ "ax25-axports.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${portCfg.package}/bin/kissattach ${portCfg.tty} ${portName}";
+        };
+        postStart = optionalString (portCfg.kissParams != null) ''
+          ${portCfg.package}/bin/kissparms -p ${portName} ${portCfg.kissParams}
+        '';
+      };
+    }) enabledAxports;
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -213,6 +213,7 @@ in
  atop = import ./atop.nix { inherit pkgs runTest; };
  atticd = runTest ./atticd.nix;
  atuin = runTest ./atuin.nix;
+  ax25 = handleTest ./ax25.nix { };
  audiobookshelf = runTest ./audiobookshelf.nix;
  auth-mysql = runTest ./auth-mysql.nix;
  authelia = runTest ./authelia.nix;
@ -791,7 +792,7 @@ in
  mediatomb = handleTest ./mediatomb.nix { };
  mediawiki = handleTest ./mediawiki.nix { };
  meilisearch = handleTest ./meilisearch.nix { };
-  memcached = handleTest ./memcached.nix { };
+  memcached = runTest ./memcached.nix;
  merecat = handleTest ./merecat.nix { };
  metabase = handleTest ./metabase.nix { };
  mihomo = handleTest ./mihomo.nix { };
@ -885,7 +886,7 @@ in
  # TODO: put in networking.nix after the test becomes more complete
  networkingProxy = handleTest ./networking-proxy.nix { };
  nextcloud = handleTest ./nextcloud { };
-  nextflow = handleTestOn [ "x86_64-linux" ] ./nextflow.nix { };
+  nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
  nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
  nexus = handleTest ./nexus.nix { };
  # TODO: Test nfsv3 + Kerberos
@ -1233,7 +1234,7 @@ in
  stargazer = runTest ./web-servers/stargazer.nix;
  starship = runTest ./starship.nix;
  stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
-  static-web-server = handleTest ./web-servers/static-web-server.nix { };
+  static-web-server = runTest ./web-servers/static-web-server.nix;
  step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
  stratis = handleTest ./stratis { };
  strongswan-swanctl = handleTest ./strongswan-swanctl.nix { };
--- a/nixos/tests/ax25.nix
+++ b/nixos/tests/ax25.nix
@ -0,0 +1,131 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+
+    baud = 57600;
+    tty = "/dev/ttyACM0";
+    port = "tnc0";
+    socatPort = 1234;
+
+    createAX25Node = nodeId: {
+
+      boot.kernelPackages = pkgs.linuxPackages_ham;
+      boot.kernelModules = [ "ax25" ];
+
+      networking.firewall.allowedTCPPorts = [ socatPort ];
+
+      environment.systemPackages = with pkgs; [
+        libax25
+        ax25-tools
+        ax25-apps
+        socat
+      ];
+
+      services.ax25.axports."${port}" = {
+        inherit baud tty;
+        enable = true;
+        callsign = "NOCALL-${toString nodeId}";
+        description = "mocked tnc";
+      };
+
+      services.ax25.axlisten = {
+        enable = true;
+      };
+
+      # All mocks radios will connect back to socat-broker on node 1 in order to get
+      # all messages that are "broadcasted over the ether"
+      systemd.services.ax25-mock-hardware = {
+        description = "mock AX.25 TNC and Radio";
+        wantedBy = [ "default.target" ];
+        before = [
+          "ax25-kissattach-${port}.service"
+          "axlisten.service"
+        ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${pkgs.socat}/bin/socat -d -d tcp:192.168.1.1:${toString socatPort} pty,link=${tty},b${toString baud},raw";
+        };
+      };
+    };
+  in
+  {
+    name = "ax25Simple";
+    nodes = {
+      node1 = lib.mkMerge [
+        (createAX25Node 1)
+        # mimicking radios on the same frequency
+        {
+          systemd.services.ax25-mock-ether = {
+            description = "mock radio ether";
+            wantedBy = [ "default.target" ];
+            requires = [ "network.target" ];
+            before = [ "ax25-mock-hardware.service" ];
+            # broken needs access to "ss" or "netstat"
+            path = [ pkgs.iproute2 ];
+            serviceConfig = {
+              Type = "exec";
+              ExecStart = "${pkgs.socat}/bin/socat-broker.sh tcp4-listen:${toString socatPort}";
+            };
+            postStart = "${pkgs.coreutils}/bin/sleep 2";
+          };
+        }
+      ];
+      node2 = createAX25Node 2;
+      node3 = createAX25Node 3;
+    };
+    testScript =
+      { ... }:
+      ''
+        def wait_for_machine(m):
+          m.succeed("lsmod | grep ax25")
+          m.wait_for_unit("ax25-axports.target")
+          m.wait_for_unit("axlisten.service")
+          m.fail("journalctl -o cat -u axlisten.service | grep -i \"no AX.25 port data configured\"")
+
+        # start the first node since the socat-broker needs to be running
+        node1.start()
+        node1.wait_for_unit("ax25-mock-ether.service")
+        wait_for_machine(node1)
+
+        node2.start()
+        node3.start()
+        wait_for_machine(node2)
+        wait_for_machine(node3)
+
+        # Node 1 -> Node 2
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-2 ctl I00\" | grep hello")
+
+        # Node 1 -> Node 3
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node2.sleep(5)
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 3
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node3.sleep(5)
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 2
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-2 ctl I00\" | grep hello")
+      '';
+  }
+)
--- a/nixos/tests/memcached.nix
+++ b/nixos/tests/memcached.nix
@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "memcached";
+{ pkgs, ... }:
+{
+  name = "memcached";

-    nodes.machine = {
-      imports = [ ../modules/profiles/minimal.nix ];
-      services.memcached.enable = true;
-    };
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    services.memcached.enable = true;
+  };

-    testScript =
-      let
-        testScript =
-          pkgs.writers.writePython3 "test_memcache"
-            {
-              libraries = with pkgs.python3Packages; [ memcached ];
-            }
-            ''
-              import memcache
-              c = memcache.Client(['localhost:11211'])
-              c.set('key', 'value')
-              assert 'value' == c.get('key')
-            '';
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("memcached.service")
-        machine.wait_for_open_port(11211)
-        machine.succeed("${testScript}")
-      '';
-  }
-)
+  testScript =
+    let
+      testScript =
+        pkgs.writers.writePython3 "test_memcache"
+          {
+            libraries = [ pkgs.python3Packages.python-memcached ];
+          }
+          ''
+            import memcache
+            c = memcache.Client(['localhost:11211'])
+            c.set('key', 'value')
+            assert 'value' == c.get('key')
+          '';
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("memcached.service")
+      machine.wait_for_open_port(11211)
+      machine.succeed("${testScript}")
+    '';
+}
--- a/nixos/tests/nextflow.nix
+++ b/nixos/tests/nextflow.nix
@ -1,60 +1,58 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    bash = pkgs.dockerTools.pullImage {
-      imageName = "quay.io/nextflow/bash";
-      imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
-      sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
-      finalImageName = "quay.io/nextflow/bash";
-    };
+{ pkgs, ... }:
+let
+  bash = pkgs.dockerTools.pullImage {
+    imageName = "quay.io/nextflow/bash";
+    imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
+    sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
+    finalImageName = "quay.io/nextflow/bash";
+  };

-    hello = pkgs.stdenv.mkDerivation {
-      name = "nextflow-hello";
-      src = pkgs.fetchFromGitHub {
-        owner = "nextflow-io";
-        repo = "hello";
-        rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
-        hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
+  hello = pkgs.stdenv.mkDerivation {
+    name = "nextflow-hello";
+    src = pkgs.fetchFromGitHub {
+      owner = "nextflow-io";
+      repo = "hello";
+      rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
+      hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
+    };
+    installPhase = ''
+      cp -r $src $out
+    '';
+  };
+  run-nextflow-pipeline = pkgs.writeShellApplication {
+    name = "run-nextflow-pipeline";
+    runtimeInputs = [ pkgs.nextflow ];
+    text = ''
+      export NXF_OFFLINE=true
+      for b in false true; do
+        echo "docker.enabled = $b" > nextflow.config
+        cat nextflow.config
+        nextflow run -ansi-log false ${hello}
+      done
+    '';
+  };
+in
+{
+  name = "nextflow";
+
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = [
+        run-nextflow-pipeline
+        pkgs.nextflow
+      ];
+      virtualisation = {
+        docker.enable = true;
      };
-      installPhase = ''
-        cp -r $src $out
-      '';
    };
-    run-nextflow-pipeline = pkgs.writeShellApplication {
-      name = "run-nextflow-pipeline";
-      runtimeInputs = [ pkgs.nextflow ];
-      text = ''
-        export NXF_OFFLINE=true
-        for b in false true; do
-          echo "docker.enabled = $b" > nextflow.config
-          cat nextflow.config
-          nextflow run -ansi-log false ${hello}
-        done
-      '';
-    };
-  in
-  {
-    name = "nextflow";

-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = [
-          run-nextflow-pipeline
-          pkgs.nextflow
-        ];
-        virtualisation = {
-          docker.enable = true;
-        };
-      };
-
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("docker.service")
-        machine.succeed("docker load < ${bash}")
-        machine.succeed("run-nextflow-pipeline >&2")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("docker.service")
+      machine.succeed("docker load < ${bash}")
+      machine.succeed("run-nextflow-pipeline >&2")
+    '';
+}
--- a/nixos/tests/web-servers/static-web-server.nix
+++ b/nixos/tests/web-servers/static-web-server.nix
@ -1,41 +1,39 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "static-web-server";
-    meta = {
-      maintainers = with lib.maintainers; [ mac-chaffee ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "static-web-server";
+  meta = {
+    maintainers = with lib.maintainers; [ mac-chaffee ];
+  };

-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.static-web-server = {
-          enable = true;
-          listen = "[::]:8080";
-          root = toString (
-            pkgs.writeTextDir "nixos-test.html" ''
-              <h1>Hello NixOS!</h1>
-            ''
-          );
-          configuration = {
-            general = {
-              directory-listing = true;
-            };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.static-web-server = {
+        enable = true;
+        listen = "[::]:8080";
+        root = toString (
+          pkgs.writeTextDir "nixos-test.html" ''
+            <h1>Hello NixOS!</h1>
+          ''
+        );
+        configuration = {
+          general = {
+            directory-listing = true;
          };
        };
      };
+    };

-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("static-web-server.socket")
-      machine.wait_for_open_port(8080)
-      # We don't use wait_until_succeeds() because we're testing socket
-      # activation which better work on the first request
-      response = machine.succeed("curl -fsS localhost:8080")
-      assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
-      response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
-      assert "Hello NixOS!" in response
-      machine.wait_for_unit("static-web-server.service")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("static-web-server.socket")
+    machine.wait_for_open_port(8080)
+    # We don't use wait_until_succeeds() because we're testing socket
+    # activation which better work on the first request
+    response = machine.succeed("curl -fsS localhost:8080")
+    assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
+    response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
+    assert "Hello NixOS!" in response
+    machine.wait_for_unit("static-web-server.service")
+  '';
+}
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1204,6 +1204,10 @@ in
  fzf-lua = neovimUtils.buildNeovimPlugin {
    luaAttr = luaPackages.fzf-lua;
    runtimeDeps = [ fzf ];
+    nvimSkipModules = [
+      "fzf-lua.shell_helper"
+      "fzf-lua.spawn"
+    ];
  };

  fzf-vim = super.fzf-vim.overrideAttrs {
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
@ -61,7 +61,7 @@ let

    if ! nodeVersion=$($serverNode -v); then
      echo "Unable to fix Node binary, quitting"
-      fail_with_exitcode ''${o.InstallExitCode.ServerTransferFailed}
+      fail_with_exitcode ''${f.UnifiedStatusCode.ServerTransferFailed}
    fi

    ${lib.optionalString useLocalExtensions ''
--- a/pkgs/applications/graphics/gimp/2.0/default.nix
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@ -0,0 +1,226 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  replaceVars,
+  autoreconfHook,
+  pkg-config,
+  intltool,
+  babl,
+  gegl,
+  gtk2,
+  glib,
+  gdk-pixbuf,
+  isocodes,
+  pango,
+  cairo,
+  freetype,
+  fontconfig,
+  lcms,
+  libpng,
+  libjpeg,
+  libjxl,
+  poppler,
+  poppler_data,
+  libtiff,
+  libmng,
+  librsvg,
+  libwmf,
+  zlib,
+  libzip,
+  ghostscript,
+  aalib,
+  shared-mime-info,
+  libexif,
+  gettext,
+  makeWrapper,
+  gtk-doc,
+  xorg,
+  glib-networking,
+  libmypaint,
+  gexiv2,
+  harfbuzz,
+  mypaint-brushes1,
+  libwebp,
+  libheif,
+  libxslt,
+  libgudev,
+  openexr,
+  desktopToDarwinBundle,
+  AppKit,
+  Cocoa,
+  gtk-mac-integration-gtk2,
+  withPython ? false,
+  python2,
+}:
+
+let
+  python = python2.withPackages (pp: [ pp.pygtk ]);
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gimp";
+  version = "2.10.38";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
+    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+  };
+
+  patches = [
+    # to remove compiler from the runtime closure, reference was retained via
+    # gimp --version --verbose output
+    (replaceVars ./remove-cc-reference.patch {
+      cc_version = stdenv.cc.cc.name;
+    })
+
+    # Use absolute paths instead of relying on PATH
+    # to make sure plug-ins are loaded by the correct interpreter.
+    ./hardcode-plugin-interpreters.patch
+
+    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
+    # These variables have been removed since libheif 1.18.0
+    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
+    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
+    ./force-enable-libheif.patch
+  ];
+
+  nativeBuildInputs =
+    [
+      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      pkg-config
+      intltool
+      gettext
+      makeWrapper
+      gtk-doc
+      libxslt
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      desktopToDarwinBundle
+    ];
+
+  buildInputs =
+    [
+      babl
+      gegl
+      gtk2
+      glib
+      gdk-pixbuf
+      pango
+      cairo
+      gexiv2
+      harfbuzz
+      isocodes
+      freetype
+      fontconfig
+      lcms
+      libpng
+      libjpeg
+      libjxl
+      poppler
+      poppler_data
+      libtiff
+      openexr
+      libmng
+      librsvg
+      libwmf
+      zlib
+      libzip
+      ghostscript
+      aalib
+      shared-mime-info
+      libwebp
+      libheif
+      libexif
+      xorg.libXpm
+      glib-networking
+      libmypaint
+      mypaint-brushes1
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      AppKit
+      Cocoa
+      gtk-mac-integration-gtk2
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libgudev
+    ]
+    ++ lib.optionals withPython [
+      python
+      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
+      python2.pkgs.pygtk
+    ];
+
+  # needed by gimp-2.0.pc
+  propagatedBuildInputs = [
+    gegl
+  ];
+
+  configureFlags =
+    [
+      "--without-webkit" # old version is required
+      "--disable-check-update"
+      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "--with-icc-directory=/run/current-system/sw/share/color/icc"
+      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
+      "--libdir=\${exec_prefix}/lib"
+    ]
+    ++ lib.optionals (!withPython) [
+      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [ ]
+      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
+    );
+
+    # Check if librsvg was built with --disable-pixbuf-loader.
+    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+  };
+
+  preConfigure = ''
+    # The check runs before glib-networking is registered
+    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+  '';
+
+  passthru = {
+    # The declarations for `gimp-with-plugins` wrapper,
+    # used for determining plug-in installation paths
+    majorVersion = "${lib.versions.major finalAttrs.version}.0";
+    targetLibDir = "lib/gimp/${finalAttrs.passthru.majorVersion}";
+    targetDataDir = "share/gimp/${finalAttrs.passthru.majorVersion}";
+    targetPluginDir = "${finalAttrs.passthru.targetLibDir}/plug-ins";
+    targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
+
+    # probably its a good idea to use the same gtk in plugins ?
+    gtk = gtk2;
+
+    python2Support = withPython;
+  };
+
+  meta = with lib; {
+    description = "GNU Image Manipulation Program";
+    homepage = "https://www.gimp.org/";
+    maintainers = with maintainers; [ ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    mainProgram = "gimp";
+  };
+})
--- a/pkgs/applications/graphics/gimp/2.0/force-enable-libheif.patch
+++ b/pkgs/applications/graphics/gimp/2.0/force-enable-libheif.patch
--- a/pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch
+++ b/pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch
@ -0,0 +1,11 @@
+--- a/plug-ins/pygimp/Makefile.am
+++ b/plug-ins/pygimp/Makefile.am
+@@ -157,7 +157,7 @@ install-interp-file:
+ 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
+ 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+ 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+-	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
+	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
+ 
+ install-data-local: install-env-file install-interp-file
+ 
--- a/pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch
+++ b/pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch
@ -0,0 +1,13 @@
+diff --git a/app/gimp-version.c b/app/gimp-version.c
+index 3d1894a036..48bb670b64 100644
+--- a/app/gimp-version.c
+++ b/app/gimp-version.c
+@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+                                       GIMP_BUILD_ID,
+                                       gimp_version_get_revision (),
+                                       GIMP_BUILD_PLATFORM_FAMILY,
+-                                      CC_VERSION,
+                                      "@cc_version@",
+                                       lib_versions);
+       g_free (lib_versions);
+ 
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@ -3,21 +3,27 @@
  lib,
  fetchurl,
  replaceVars,
-  autoreconfHook,
+  meson,
+  ninja,
  pkg-config,
-  intltool,
  babl,
+  cfitsio,
  gegl,
-  gtk2,
+  gtk3,
  glib,
  gdk-pixbuf,
+  graphviz,
  isocodes,
  pango,
  cairo,
+  libarchive,
+  luajit,
  freetype,
  fontconfig,
  lcms,
  libpng,
+  libiff,
+  libilbm,
  libjpeg,
  libjxl,
  poppler,
@ -31,44 +37,59 @@
  ghostscript,
  aalib,
  shared-mime-info,
+  python3,
  libexif,
  gettext,
-  makeWrapper,
-  gtk-doc,
+  wrapGAppsHook3,
+  libxslt,
+  gobject-introspection,
+  vala,
+  gi-docgen,
+  perl,
+  appstream-glib,
+  desktop-file-utils,
  xorg,
  glib-networking,
+  json-glib,
  libmypaint,
+  llvmPackages,
  gexiv2,
  harfbuzz,
  mypaint-brushes1,
  libwebp,
  libheif,
-  libxslt,
+  gjs,
  libgudev,
  openexr,
+  xvfb-run,
+  dbus,
+  adwaita-icon-theme,
+  alsa-lib,
  desktopToDarwinBundle,
  AppKit,
  Cocoa,
-  gtk-mac-integration-gtk2,
-  withPython ? false,
-  python2,
 }:

 let
-  python = python2.withPackages (pp: [ pp.pygtk ]);
+  python = python3.withPackages (
+    pp: with pp; [
+      pygobject3
+    ]
+  );
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gimp";
-  version = "2.10.38";
+  version = "3.0.2";

  outputs = [
    "out"
    "dev"
+    "devdoc"
  ];

  src = fetchurl {
-    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
  };

  patches = [
@ -80,26 +101,40 @@ stdenv.mkDerivation (finalAttrs: {

    # Use absolute paths instead of relying on PATH
    # to make sure plug-ins are loaded by the correct interpreter.
-    ./hardcode-plugin-interpreters.patch
+    # TODO: This now only appears to be used on Windows.
+    (replaceVars ./hardcode-plugin-interpreters.patch {
+      python_interpreter = python.interpreter;
+      PYTHON_EXE = null;
+    })

-    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
-    # These variables have been removed since libheif 1.18.0
-    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
-    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
-    ./force-enable-libheif.patch
+    # D-Bus configuration is not available in the build sandbox
+    # so we need to pick up the one from the package.
+    (replaceVars ./tests-dbus-conf.patch {
+      session_conf = "${dbus.out}/share/dbus-1/session.conf";
+    })
  ];

  nativeBuildInputs =
    [
-      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      meson
+      ninja
      pkg-config
-      intltool
      gettext
-      makeWrapper
-      gtk-doc
-      libxslt
+      wrapGAppsHook3
+      libxslt # for xsltproc
+      gobject-introspection
+      perl
+      vala
+
+      # for docs
+      gi-docgen
+
+      # for tests
+      desktop-file-utils
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      dbus
+      xvfb-run
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      desktopToDarwinBundle
@ -107,13 +142,16 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs =
    [
+      appstream-glib # for library
      babl
+      cfitsio
      gegl
-      gtk2
+      gtk3
      glib
      gdk-pixbuf
      pango
      cairo
+      libarchive
      gexiv2
      harfbuzz
      isocodes
@ -121,6 +159,8 @@ stdenv.mkDerivation (finalAttrs: {
      fontconfig
      lcms
      libpng
+      libiff
+      libilbm
      libjpeg
      libjxl
      poppler
@ -135,69 +175,137 @@ stdenv.mkDerivation (finalAttrs: {
      ghostscript
      aalib
      shared-mime-info
+      json-glib
      libwebp
      libheif
+      python
      libexif
      xorg.libXpm
+      xorg.libXmu
      glib-networking
      libmypaint
      mypaint-brushes1
+
+      # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
+      adwaita-icon-theme
+
+      # for Lua plug-ins
+      (luajit.withPackages (pp: [
+        pp.lgi
+      ]))
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+
+      # for JavaScript plug-ins
+      gjs
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.openmp
      AppKit
      Cocoa
-      gtk-mac-integration-gtk2
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      libgudev
-    ]
-    ++ lib.optionals withPython [
-      python
-      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
-      python2.pkgs.pygtk
    ];

-  # needed by gimp-2.0.pc
  propagatedBuildInputs = [
+    # needed by gimp-3.0.pc
    gegl
+    cairo
+    pango
+    gexiv2
  ];

-  configureFlags =
+  mesonFlags =
    [
-      "--without-webkit" # old version is required
-      "--disable-check-update"
-      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
-      "--with-icc-directory=/run/current-system/sw/share/color/icc"
-      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
-      "--libdir=\${exec_prefix}/lib"
+      "-Dbug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "-Dicc-directory=/run/current-system/sw/share/color/icc"
+      "-Dcheck-update=no"
+      (lib.mesonEnable "gudev" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "headless-tests" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "linux-input" stdenv.hostPlatform.isLinux)
+      # Not very important to do downstream, save a dependency.
+      "-Dappdata-test=disabled"
    ]
-    ++ lib.optionals (!withPython) [
-      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-Dalsa=disabled"
+      "-Djavascript=disabled"
    ];

-  enableParallelBuilding = true;
-
  doCheck = true;

  env = {
-    NIX_CFLAGS_COMPILE = toString (
-      [ ]
-      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
-    );
+    # The check runs before glib-networking is registered
+    GIO_EXTRA_MODULES = "${glib-networking}/lib/gio/modules";
+
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-DGDK_OSX_BIG_SUR=16";

    # Check if librsvg was built with --disable-pixbuf-loader.
    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
  };

-  preConfigure = ''
-    # The check runs before glib-networking is registered
-    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  postPatch = ''
+    patchShebangs \
+      app/tests/create_test_env.sh \
+      tools/gimp-mkenums
+
+    # GIMP is executed at build time so we need to fix this.
+    # TODO: Look into if we can fix the interp thing.
+    chmod +x plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+    patchShebangs \
+      plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+  '';
+
+  preBuild =
+    let
+      librarySuffix =
+        if stdenv.hostPlatform.extensions.library == ".so" then
+          "3.0.so.0"
+        else if stdenv.hostPlatform.extensions.library == ".dylib" then
+          "3.0.0.dylib"
+        else
+          throw "Unsupported library extension ‘${stdenv.hostPlatform.extensions.library}’";
+    in
+    ''
+      # Our gobject-introspection patches make the shared library paths absolute
+      # in the GIR files. When running GIMP in build or check phase, it will try
+      # to use plug-ins, which import GIMP introspection files which will try
+      # to load the GIMP libraries which will not be installed yet.
+      # So we need to replace the absolute path with a local one.
+      # We are using a symlink that will be overridden during installation.
+      mkdir -p "$out/lib"
+      ln -s "$PWD/libgimp/libgimp-${librarySuffix}" \
+        "$PWD/libgimpbase/libgimpbase-${librarySuffix}" \
+        "$PWD/libgimpcolor/libgimpcolor-${librarySuffix}" \
+        "$PWD/libgimpconfig/libgimpconfig-${librarySuffix}" \
+        "$PWD/libgimpmath/libgimpmath-${librarySuffix}" \
+        "$PWD/libgimpmodule/libgimpmodule-${librarySuffix}" \
+        "$out/lib/"
+    '';
+
+  preCheck = ''
+    # Avoid “Error retrieving accessibility bus address”
+    export NO_AT_BRIDGE=1
+    # Fix storing recent file list in tests
+    export HOME="$TMPDIR"
+    export XDG_DATA_DIRS="${glib.getSchemaDataDirPath gtk3}:${adwaita-icon-theme}/share:$XDG_DATA_DIRS"
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${
+      lib.makeBinPath [
+        # for dot for gegl:introspect (Debug » Show Image Graph, hidden by default on stable release)
+        graphviz
+        # for gimp-script-fu-interpreter-3.0 invoked by shebang of some plug-ins
+        "$out"
+      ]
+    }")
  '';

  postFixup = ''
-    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
  '';

  passthru = {
@ -210,9 +318,7 @@ stdenv.mkDerivation (finalAttrs: {
    targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";

    # probably its a good idea to use the same gtk in plugins ?
-    gtk = gtk2;
-
-    python2Support = withPython;
+    gtk = gtk3;
  };

  meta = with lib; {
@ -220,7 +326,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://www.gimp.org/";
    maintainers = with maintainers; [ jtojnar ];
    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    mainProgram = "gimp";
  };
 })
--- a/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch
+++ b/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch
@ -1,11 +1,8 @@
--- a/plug-ins/pygimp/Makefile.am
-+++ b/plug-ins/pygimp/Makefile.am
-@@ -157,7 +157,7 @@ install-interp-file:
- 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
- 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
- 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
-	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
-+	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
- 
- install-data-local: install-env-file install-interp-file
- 
+--- a/plug-ins/python/pygimp.interp.in
+++ b/plug-ins/python/pygimp.interp.in
+@@ -2,4 +2,4 @@ python=@PYTHON_EXE@
+ python3=@PYTHON_EXE@
+ /usr/bin/python=@PYTHON_EXE@
+ /usr/bin/python3=@PYTHON_EXE@
+-:Python:E::py::python3:
+:Python:E::py::@python_interpreter@:
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@ -2,7 +2,11 @@
 # If you just want a subset of plug-ins, you can specify them explicitly:
 # `gimp-with-plugins.override { plugins = with gimpPlugins; [ gap ]; }`.

-{ lib, pkgs }:
+{
+  lib,
+  pkgs,
+  gimp,
+}:

 let
  inherit (pkgs)
@ -16,6 +20,10 @@ let
    fetchFromGitHub
    fetchFromGitLab
    ;
+
+  # We cannot use gimp from the arguments directly, or it would be shadowed by the one
+  # from scope when initializing the scope with it, leading to infinite recursion.
+  gimpArg = gimp;
 in

 lib.makeScope pkgs.newScope (
@ -29,6 +37,7 @@ lib.makeScope pkgs.newScope (
      attrs:
      let
        name = attrs.name or "${attrs.pname}-${attrs.version}";
+        pkgConfigMajorVersion = lib.versions.major gimp.version;
      in
      stdenv.mkDerivation (
        {
@ -63,8 +72,10 @@ lib.makeScope pkgs.newScope (

          # Override installation paths.
          env = {
-            PKG_CONFIG_GIMP_2_0_GIMPLIBDIR = "${placeholder "out"}/${gimp.targetLibDir}";
-            PKG_CONFIG_GIMP_2_0_GIMPDATADIR = "${placeholder "out"}/${gimp.targetDataDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPLIBDIR" =
+              "${placeholder "out"}/${gimp.targetLibDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPDATADIR" =
+              "${placeholder "out"}/${gimp.targetDataDir}";
          } // attrs.env or { };
        }
      );
@ -86,7 +97,7 @@ lib.makeScope pkgs.newScope (
  in
  {
    # Allow overriding GIMP package in the scope.
-    inherit (pkgs) gimp;
+    gimp = gimpArg;

    bimp = pluginDerivation rec {
      /*
@ -130,6 +141,7 @@ lib.makeScope pkgs.newScope (
      installTargets = [ "install-admin" ];

      meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
        description = "Batch Image Manipulation Plugin for GIMP";
        homepage = "https://github.com/alessandrofrancesconi/gimp-plugin-bimp";
        license = licenses.gpl2Plus;
@ -153,6 +165,7 @@ lib.makeScope pkgs.newScope (
      '';

      meta = {
+        broken = gimp.majorVersion != "2.0";
        description = "Gimp plug-in for the farbfeld image format";
        homepage = "https://github.com/ids1024/gimp-farbfeld";
        license = lib.licenses.mit;
@ -192,6 +205,7 @@ lib.makeScope pkgs.newScope (
      '';

      meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
        description = "GIMP plug-in to do the fourier transform";
        homepage = "https://people.via.ecp.fr/~remi/soft/gimp/gimp_plugin_en.php3#fourier";
        license = with licenses; [ gpl3Plus ];
@ -222,7 +236,7 @@ lib.makeScope pkgs.newScope (
      };

      meta = {
-        broken = !gimp.python2Support;
+        broken = gimp.majorVersion != "2.0";
      };
    };

@ -240,6 +254,10 @@ lib.makeScope pkgs.newScope (
        ninja
        gettext
      ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
    };

    waveletSharpen = pluginDerivation {
@ -264,6 +282,10 @@ lib.makeScope pkgs.newScope (
      };

      installPhase = "installPlugin src/wavelet-sharpen"; # TODO translations are not copied .. How to do this on nix?
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
    };

    lqrPlugin = pluginDerivation rec {
@ -289,10 +311,15 @@ lib.makeScope pkgs.newScope (
          sha256 = "EdjZWM6U1bhUmsOnLA8iJ4SFKuAXHIfNPzxZqel+JrY=";
        })
      ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
    };

    gmic = pkgs.gmic-qt.override {
      variant = "gimp";
+      inherit (self) gimp;
    };

    gimplensfun = pluginDerivation {
@ -320,6 +347,7 @@ lib.makeScope pkgs.newScope (
    ";

      meta = {
+        broken = gimp.majorVersion != "2.0";
        description = "GIMP plugin to correct lens distortion using the lensfun library and database";

        homepage = "http://lensfun.sebastiankraft.net/";
--- a/pkgs/applications/graphics/gimp/remove-cc-reference.patch
+++ b/pkgs/applications/graphics/gimp/remove-cc-reference.patch
@ -1,8 +1,8 @@
 diff --git a/app/gimp-version.c b/app/gimp-version.c
-index 3d1894a036..48bb670b64 100644
+index 6e311c8252..e6fd9d1d78 100644
 --- a/app/gimp-version.c
 +++ b/app/gimp-version.c
-@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+@@ -90,7 +90,7 @@ gimp_version (gboolean be_verbose,
                                       GIMP_BUILD_ID,
                                       gimp_version_get_revision (),
                                       GIMP_BUILD_PLATFORM_FAMILY,
--- a/pkgs/applications/graphics/gimp/tests-dbus-conf.patch
+++ b/pkgs/applications/graphics/gimp/tests-dbus-conf.patch
@ -0,0 +1,11 @@
+--- a/build/meson/run_test_env.sh
+++ b/build/meson/run_test_env.sh
+@@ -33,7 +33,7 @@ if [ -n "${UI_TEST}" ]; then
+     OPT="--auto-servernum"
+   fi
+   xvfb-run $OPT --server-args="-screen 0 1280x1024x24" \
+-    dbus-run-session -- "$@"
+    dbus-run-session --config-file="@session_conf@" -- "$@"
+ 
+ else
+   # Run the executable directly,
--- a/pkgs/applications/graphics/gimp/wrapper.nix
+++ b/pkgs/applications/graphics/gimp/wrapper.nix
@ -13,8 +13,14 @@ let
    lib.attrValues gimpPlugins
  );
  selectedPlugins = lib.filter (pkg: pkg != gimp) (if plugins == null then allPlugins else plugins);
-  extraArgs = map (x: x.wrapArgs or "") selectedPlugins;
-  versionBranch = lib.versions.majorMinor gimp.version;
+  extraArgs =
+    map (x: x.wrapArgs or "") selectedPlugins
+    ++ lib.optionals (gimp.majorVersion == "2.0") [
+      ''--prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0"''
+    ];
+  exeVersion =
+    if gimp.majorVersion == "2.0" then lib.versions.majorMinor gimp.version else gimp.majorVersion;
+  majorVersion = lib.versions.major gimp.version;

 in
 symlinkJoin {
@ -25,16 +31,15 @@ symlinkJoin {
  nativeBuildInputs = [ makeWrapper ];

  postBuild = ''
-    for each in gimp-${versionBranch} gimp-console-${versionBranch}; do
+    for each in gimp-${exeVersion} gimp-console-${exeVersion}; do
      wrapProgram $out/bin/$each \
-        --set GIMP2_PLUGINDIR "$out/lib/gimp/2.0" \
-        --set GIMP2_DATADIR "$out/share/gimp/2.0" \
-        --prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0" \
+        --set GIMP${majorVersion}_PLUGINDIR "$out/${gimp.targetLibDir}" \
+        --set GIMP${majorVersion}_DATADIR "$out/${gimp.targetDataDir}" \
        ${toString extraArgs}
    done
    set +x
    for each in gimp gimp-console; do
-      ln -sf "$each-${versionBranch}" $out/bin/$each
+      ln -sf "$each-${exeVersion}" $out/bin/$each
    done
  '';

--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "135.0.7049.84",
+    "version": "135.0.7049.95",
    "chromedriver": {
-      "version": "135.0.7049.85",
-      "hash_darwin": "sha256-L4x/MSCbVt2UIQwbHREDV8br6DmdfuqTJ3//7opK2IU=",
-      "hash_darwin_aarch64": "sha256-vixXGqbc2UYpydg1RILhrtmr5DdbJ5I1sD8aNikejQU="
+      "version": "135.0.7049.96",
+      "hash_darwin": "sha256-MmL/hQGPk/kGBtbXSekE+lHktucPCv3HFr8VYTnff5w=",
+      "hash_darwin_aarch64": "sha256-TGiVrAYgeLGniGBZ2dHUBk6Hg996ouBSJHZm9hXExQ4="
    },
    "deps": {
      "depot_tools": {
@ -20,8 +20,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "6c019e56001911b3fd467e03bf68c435924d62f4",
-        "hash": "sha256-BFw1o2cIHBeBudeigH6YTOuLGsp/+pTOeE1lXBO3aio=",
+        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
+        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -566,8 +566,8 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
-        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
+        "rev": "2919d07ee57020e3e4b66cce45c61104d80304d2",
+        "hash": "sha256-zE6a0R8NZ3SE0bHwPan3dTh5kmq5JmYTbDQIvyNICeg="
      },
      "src/third_party/perfetto": {
        "url": "https://android.googlesource.com/platform/external/perfetto.git",
@ -616,8 +616,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e445bdea696eb6b6a46681dfc1a63edaa517edb",
-        "hash": "sha256-mSup6nKsEPjJ/HBV7PwjBI4PP7/RdwFm/dnavKeRqzI="
+        "rev": "5a44cdd70f04aa65fa063caa1a7e3028d75236f8",
+        "hash": "sha256-QX3b+S0IuxJKmlMudL6420+bXRhDkWYC7GNRKxKNm8A="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
--- a/pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh
+++ b/pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh
@ -0,0 +1,118 @@
+#!@shell@
+# shellcheck shell=bash
+
+declare -a autoPatchcilLibs
+declare -a extraAutoPatchcilLibs
+
+gatherLibraries() {
+    if [ -d "$1/lib" ]; then
+        autoPatchcilLibs+=("$1/lib")
+    fi
+}
+
+addEnvHooks "${targetOffset:?}" gatherLibraries
+
+# Can be used to manually add additional directories with shared object files
+# to be included for the next autoPatchcil invocation.
+addAutoPatchcilSearchPath() {
+    local -a findOpts=()
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --no-recurse)
+            shift
+            findOpts+=("-maxdepth" 1)
+            ;;
+        --*)
+            echo "addAutoPatchcilSearchPath: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchcilLibs+=("$dir")
+    done < <(
+        find "$@" "${findOpts[@]}" \! -type d \
+            \( -name '*.so' -o -name '*.so.*' \) -print0 |
+            sed -z 's#/[^/]*$##' |
+            uniq -z
+    )
+}
+
+autoPatchcil() {
+    local rid=
+    local norecurse=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --rid)
+            rid="$2"
+            shift 2
+            ;;
+        --no-recurse)
+            shift
+            norecurse=1
+            ;;
+        --*)
+            echo "autoPatchcil: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    if [ -z "$rid" ]; then
+        echo "autoPatchcil: ERROR: No RID (Runtime ID) provided." >&2
+        return 1
+    fi
+
+    local ignoreMissingDepsArray=("--ignore-missing")
+    concatTo ignoreMissingDepsArray autoPatchcilIgnoreMissingDeps
+
+    if [ ${#ignoreMissingDepsArray[@]} -lt 2 ]; then
+        ignoreMissingDepsArray=()
+    fi
+
+    local autoPatchcilFlags=(
+        ${norecurse:+--no-recurse}
+        --rid "$rid"
+        "${ignoreMissingDepsArray[@]}"
+        --paths "$@"
+        --libs "${autoPatchcilLibs[@]}"
+    )
+
+    # shellcheck disable=SC2016
+    echoCmd 'patchcil auto flags' "${autoPatchcilFlags[@]}"
+    @patchcil@ auto "${autoPatchcilFlags[@]}"
+}
+
+autoPatchcilFixupOutput() {
+    if [[ -z "${dontAutoPatchcil-}" ]]; then
+        if [ -n "${dotnetRuntimeIds+x}" ]; then
+            if [[ -n $__structuredAttrs ]]; then
+                local dotnetRuntimeIdsArray=("${dotnetRuntimeIds[@]}")
+            else
+                # shellcheck disable=SC2206 # Intentionally expanding it to preserve old behavior
+                local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
+            fi
+        else
+            local dotnetRuntimeIdsArray=("")
+        fi
+
+        autoPatchcil --rid "${autoPatchcilRuntimeId:-${dotnetRuntimeIdsArray[0]}}" -- "${prefix:?}"
+    fi
+}
+
+fixupOutputHooks+=(autoPatchcilFixupOutput)
--- a/pkgs/build-support/dotnet/auto-patchcil-hook/default.nix
+++ b/pkgs/build-support/dotnet/auto-patchcil-hook/default.nix
@ -0,0 +1,14 @@
+{
+  lib,
+  bash,
+  patchcil,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "auto-patchcil-hook";
+  substitutions = {
+    shell = lib.getExe bash;
+    patchcil = lib.getExe patchcil;
+  };
+} ./auto-patchcil.sh
--- a/pkgs/by-name/au/autokbisw/nix/default.nix
+++ b/pkgs/by-name/au/autokbisw/nix/default.nix
@ -0,0 +1,7 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "sha256-FSIi4jDX7R35jDHkKzQFJLl4K0Hdx9UWgwxJbHVpsYU=";
+  };
+}
--- a/pkgs/by-name/au/autokbisw/nix/workspace-state.json
+++ b/pkgs/by-name/au/autokbisw/nix/workspace-state.json
@ -0,0 +1,25 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e1465042f195f374b94f915ba8ca49de24300a0d",
+            "version": "1.0.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      }
+    ]
+  },
+  "version": 6
+}
--- a/pkgs/by-name/au/autokbisw/package.nix
+++ b/pkgs/by-name/au/autokbisw/package.nix
@ -0,0 +1,45 @@
+{
+  fetchFromGitHub,
+  lib,
+  swift,
+  swiftPackages,
+  swiftpm,
+  swiftpm2nix,
+}:
+let
+  # Nix dir generated by running `swiftpm2nix` in the upstream project
+  generated = swiftpm2nix.helpers ./nix;
+in
+swiftPackages.stdenv.mkDerivation rec {
+  pname = "autokbisw";
+  version = "2.0.1";
+  src = fetchFromGitHub {
+    owner = "ohueter";
+    repo = "autokbisw";
+    tag = version;
+    hash = "sha256-xNXXgDLWW8pdik3STmhpZATf9REd+8IGeoX/oxGg4vc=";
+  };
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+  configurePhase = generated.configure;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $(swiftpmBinPath)/autokbisw $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Automatic keyboard input language switching for macOS";
+    homepage = "https://github.com/ohueter/autokbisw";
+    changelog = "https://github.com/ohueter/autokbisw/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    mainProgram = "autokbisw";
+    maintainers = with lib.maintainers; [ craigf ];
+    platforms = lib.platforms.darwin;
+  };
+}
--- a/pkgs/by-name/ba/babl/package.nix
+++ b/pkgs/by-name/ba/babl/package.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "babl";
-  version = "0.1.110";
+  version = "0.1.112";

  outputs = [
    "out"
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v0e+dUDWJ1OJ9mQx7wMGTfU3YxXiQ9C6tEjGqnE/V0M=";
+    hash = "sha256-+2lmgkIXh8j+zIPoqrSBId7I7jjRGbZSkc/L4xUCink=";
  };

  patches = [
--- a/pkgs/by-name/cr/cryptomator/package.nix
+++ b/pkgs/by-name/cr/cryptomator/package.nix
@ -17,18 +17,18 @@ let
 in
 maven.buildMavenPackage rec {
  pname = "cryptomator";
-  version = "1.15.2";
+  version = "1.15.3";

  src = fetchFromGitHub {
    owner = "cryptomator";
    repo = "cryptomator";
    tag = version;
-    hash = "sha256-uhsX4VIA8NNUjxa0dHyB5bhWMxjd2LJfcKJInxROQRY=";
+    hash = "sha256-3HGSeTUzfcXuNFxPuhkQBQ8CTEvgrNjpFtqOuluCeRs=";
  };

  mvnJdk = jdk;
  mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-KfQdYsPdmQRQqjx/kpDQR9tYjb54goA31w55x6VX6KM=";
+  mvnHash = "sha256-vC2ULlBm/170ElcQC898N4kmWfuWwb7hFpF1oMIukyQ=";

  preBuild = ''
    VERSION=${version}
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@ -26,7 +26,7 @@ let
    doInstallCheck = false;
  });

-  version = "1.5";
+  version = "1.5.1";
 in
 rustPlatform.buildRustPackage {
  pname = "devenv";
@ -36,7 +36,7 @@ rustPlatform.buildRustPackage {
    owner = "cachix";
    repo = "devenv";
    rev = "v${version}";
-    hash = "sha256-bJlcIFcEhobOiaJsxub48fR8nIZDU4QK4FIycmDW2mk=";
+    hash = "sha256-ybqhaIuv8OU0f14Rr+1ilxE4iTCnguXi/60g4ys6JOI=";
  };

  useFetchCargoVendor = true;
--- a/pkgs/by-name/en/envoy-bin/package.nix
+++ b/pkgs/by-name/en/envoy-bin/package.nix
@ -8,7 +8,7 @@
  versionCheckHook,
 }:
 let
-  version = "1.33.2";
+  version = "1.34.0";
  inherit (stdenv.hostPlatform) system;
  throwSystem = throw "envoy-bin is not available for ${system}.";

@ -21,8 +21,8 @@ let

  hash =
    {
-      aarch64-linux = "sha256-gew2iaghIu/wymgMSBdvTTUbb5iBp5zJ2QeKb7Swtqg=";
-      x86_64-linux = "sha256-vS/4fF78lf14gNcQkV9XPBqrTZxV2NqIbc2R30P610E=";
+      aarch64-linux = "sha256-VVEYQ25ZNmWftuhLOOZnxKaosQFeMHsQdkAzIq+zEM0=";
+      x86_64-linux = "sha256-FavpvY1hYNOnlFQE2NV3O8z9gyKGpD01oU/wute9iRA=";
    }
    .${system} or throwSystem;
 in
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@ -8,7 +8,7 @@

 let
  pname = "gallery-dl";
-  version = "1.29.3";
+  version = "1.29.4";
 in
 python3Packages.buildPythonApplication {
  inherit pname version;
@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
    owner = "mikf";
    repo = "gallery-dl";
    tag = "v${version}";
-    hash = "sha256-LzMiJxMl6IWtUloWxBAMLvkhnTQpHkz/gjWl5gW2sZ0=";
+    hash = "sha256-dQK1AWmdlfb1cRcYzXWUsXmRgjQRc++zEHZvLUygMwg=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@ -48,14 +48,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gamescope";
-  version = "3.16.3";
+  version = "3.16.4";

  src = fetchFromGitHub {
    owner = "ValveSoftware";
    repo = "gamescope";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-4Pbyv+EAgwjabVJ4oW3jSmi0Rzpe+BxCN8mM5/beEco=";
+    hash = "sha256-2AxqvZA1eZaJFKMfRljCIcP0M2nMngw0FQiXsfBW7IA=";
  };

  patches = [
--- a/pkgs/by-name/gm/gmic-qt/package.nix
+++ b/pkgs/by-name/gm/gmic-qt/package.nix
@ -100,7 +100,14 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [
    (lib.cmakeBool "ENABLE_DYNAMIC_LINKING" true)
    (lib.cmakeBool "ENABLE_SYSTEM_GMIC" true)
-    (lib.cmakeFeature "GMIC_QT_HOST" (if variant == "standalone" then "none" else variant))
+    (lib.cmakeFeature "GMIC_QT_HOST" (
+      if variant == "standalone" then
+        "none"
+      else if variant == "gimp" && gimp.majorVersion == "3.0" then
+        "gimp3"
+      else
+        variant
+    ))
  ];

  postFixup = lib.optionalString (variant == "gimp") ''
--- a/pkgs/by-name/go/gofumpt/package.nix
+++ b/pkgs/by-name/go/gofumpt/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "gofumpt";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "mvdan";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-mJM0uKztX0OUQvynnxeKL9yft7X/Eh28ERg8SbZC5Ws=";
+    hash = "sha256-37wYYB0k8mhQq30y1oo77qW3bIqqN/K/NG1RgxK6dyI=";
  };

-  vendorHash = "sha256-kJysyxROvB0eMAHbvNF+VXatEicn4ln2Vqkzp7GDWAQ=";
+  vendorHash = "sha256-T6/xEXv8+io3XwQ2keacpYYIdTnYhTTUCojf62tTwbA=";

  env.CGO_ENABLED = "0";

--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@ -7,16 +7,16 @@

 buildGo124Module rec {
  pname = "golangci-lint";
-  version = "2.0.2";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    hash = "sha256-+IndC9znKgVGiFWW0aCNjhxPwX1kDFnfG2+SKEQ15Rc=";
+    hash = "sha256-CAO+oo3l3mlZIiC1Srhc0EfZffQOHvVkamPHzSKRSFw=";
  };

-  vendorHash = "sha256-B6mCvJtIfRbAv6fZ8Ge82nT9oEcL3WR4D+AAVs9R3zM=";
+  vendorHash = "sha256-2GQp/sgYRlDengx8uy3zzqi9hwHh4CQUHoj1zaxNNLE=";

  subPackages = [ "cmd/golangci-lint" ];

--- a/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch
+++ b/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch
@ -0,0 +1,56 @@
+diff --git a/src/main.c b/src/main.c
+index d16a7f7..2c596e9 100644
+--- a/src/main.c
+++ b/src/main.c
+@@ -125,7 +125,7 @@ static gint        grig_app_delete     (GtkWidget *, GdkEvent *, gpointer);
+ static void        grig_app_destroy    (GtkWidget *, gpointer);
+ static void        grig_show_help      (void);
+ static void        grig_show_version   (void);
+-static gint        grig_list_add       (const struct rig_caps *, void *);
+static gint        grig_list_add       (struct rig_caps *, void *);
+ static gint        grig_list_compare   (gconstpointer, gconstpointer);
+ static void        grig_sig_handler    (int sig);
+ 
+@@ -729,7 +729,7 @@ grig_list_rigs ()
+  * \sa grig_list_rigs, grig_list_compare
+  */
+ static gint
+-grig_list_add (const struct rig_caps *caps, void *array)
+grig_list_add (struct rig_caps *caps, void *array)
+ {
+ 	grig_rig_info_t *info;
+ 
+diff --git a/src/rig-selector.c b/src/rig-selector.c
+index 425d41a..e040c0e 100644
+--- a/src/rig-selector.c
+++ b/src/rig-selector.c
+@@ -46,7 +46,7 @@ static void add     (GtkWidget *, gpointer);
+ static void delete  (GtkWidget *, gpointer);
+ static void edit    (GtkWidget *, gpointer);
+ static void cancel  (GtkWidget *, gpointer);
+-static void connect (GtkWidget *, gpointer);
+static void connectrig (GtkWidget *, gpointer);
+ static void selection_changed (GtkTreeSelection *sel, gpointer data);
+ 
+ static void render_civ (GtkTreeViewColumn *col,
+@@ -191,7 +191,7 @@ rig_selector_execute ()
+     g_signal_connect (G_OBJECT (cancbut), "clicked",
+                       G_CALLBACK (cancel), window);
+     g_signal_connect (G_OBJECT (conbut), "clicked",
+-                      G_CALLBACK (connect), window);
+                      G_CALLBACK (connectrig), window);
+     g_signal_connect (G_OBJECT (delbut), "clicked",
+                       G_CALLBACK (delete), NULL);
+     g_signal_connect (G_OBJECT (newbut), "clicked",
+@@ -439,7 +439,7 @@ static void cancel (GtkWidget *button, gpointer window)
+  * simply destroys the rig selector window and whereby control is returned
+  * to the main() function.
+  */
+-static void connect (GtkWidget *button, gpointer window)
+static void connectrig (GtkWidget *button, gpointer window)
+ {
+     
+     
+-- 
+2.47.0
+
--- a/pkgs/by-name/gr/grig/package.nix
+++ b/pkgs/by-name/gr/grig/package.nix
@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-OgIgHW9NMW/xSSti3naIR8AQWUtNSv5bYdOcObStBlM=";
  };

+  patches = [
+    # https://github.com/fillods/grig/issues/22
+    ./0001-Fix-grig-for-hamlib-4.6.x.patch
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
--- a/pkgs/applications/misc/keepassxc/darwin.patch
+++ b/pkgs/applications/misc/keepassxc/darwin.patch
--- a/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json
+++ b/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@ -3,54 +3,46 @@
  stdenv,
  fetchFromGitHub,
  cmake,
-  qttools,
+  libsForQt5,

  apple-sdk_15,
  asciidoctor,
  botan3,
  curl,
  darwinMinVersionHook,
-  kio,
  libXi,
  libXtst,
  libargon2,
  libusb1,
  minizip,
+  nix-update-script,
  pcsclite,
  pkg-config,
  qrencode,
-  qtbase,
-  qtmacextras,
-  qtsvg,
-  qtx11extras,
  readline,
  wrapGAppsHook3,
-  wrapQtAppsHook,
  zlib,

-  LocalAuthentication,
-
  withKeePassBrowser ? true,
  withKeePassBrowserPasskeys ? true,
-  withKeePassFDOSecrets ? true,
+  withKeePassFDOSecrets ? stdenv.hostPlatform.isLinux,
  withKeePassKeeShare ? true,
  withKeePassNetworking ? true,
  withKeePassSSHAgent ? true,
-  withKeePassTouchID ? true,
  withKeePassX11 ? true,
-  withKeePassYubiKey ? true,
+  withKeePassYubiKey ? stdenv.hostPlatform.isLinux,

  nixosTests,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "keepassxc";
  version = "2.7.10";

  src = fetchFromGitHub {
    owner = "keepassxreboot";
    repo = "keepassxc";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-FBoqCYNM/leN+w4aV0AJMx/G0bjHbI9KVWrnmq3NfaI=";
  };

@ -64,40 +56,58 @@ stdenv.mkDerivation rec {

  patches = [ ./darwin.patch ];

-  cmakeFlags =
-    [
-      "-DKEEPASSXC_BUILD_TYPE=Release"
-      "-DWITH_GUI_TESTS=ON"
-      "-DWITH_XC_UPDATECHECK=OFF"
-    ]
-    ++ (lib.optional (!withKeePassX11) "-DWITH_XC_X11=OFF")
-    ++ (lib.optional (withKeePassFDOSecrets && stdenv.hostPlatform.isLinux) "-DWITH_XC_FDOSECRETS=ON")
-    ++ (lib.optional (withKeePassYubiKey && stdenv.hostPlatform.isLinux) "-DWITH_XC_YUBIKEY=ON")
-    ++ (lib.optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
-    ++ (lib.optional withKeePassBrowserPasskeys "-DWITH_XC_BROWSER_PASSKEYS=ON")
-    ++ (lib.optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
-    ++ (lib.optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
-    ++ (lib.optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
+  cmakeFlags = [
+    (lib.cmakeFeature "KEEPASSXC_BUILD_TYPE" "Release")
+    (lib.cmakeBool "WITH_GUI_TESTS" true)
+    (lib.cmakeBool "WITH_XC_UPDATECHECK" false)
+    (lib.cmakeBool "WITH_XC_X11" withKeePassX11)
+    (lib.cmakeBool "WITH_XC_BROWSER" withKeePassBrowser)
+    (lib.cmakeBool "WITH_XC_BROWSER_PASSKEYS" withKeePassBrowserPasskeys)
+    (lib.cmakeBool "WITH_XC_KEESHARE" withKeePassKeeShare)
+    (lib.cmakeBool "WITH_XC_NETWORKING" withKeePassNetworking)
+    (lib.cmakeBool "WITH_XC_SSHAGENT" withKeePassSSHAgent)
+    (lib.cmakeBool "WITH_XC_FDOSECRETS" withKeePassFDOSecrets)
+    (lib.cmakeBool "WITH_XC_YUBIKEY" withKeePassYubiKey)
+  ];

  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
+  checkPhase =
+    let
+      disabledTests = lib.concatStringsSep "|" (
+        [
+          # flaky
+          "testcli"
+          "testgui"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # QWidget: Cannot create a QWidget without QApplication
+          "testautotype"

-    export LC_ALL="en_US.UTF-8"
-    export QT_QPA_PLATFORM=offscreen
-    export QT_PLUGIN_PATH="${qtbase.bin}/${qtbase.qtPluginPrefix}"
-    # testcli, testgui and testkdbx4 are flaky - skip them all
-    # testautotype on darwin throws "QWidget: Cannot create a QWidget without QApplication"
-    make test ARGS+="-E 'testcli|testgui${lib.optionalString stdenv.hostPlatform.isDarwin "|testautotype|testkdbx4"}' --output-on-failure"
+          # FAIL!  : TestDatabase::testExternallyModified() Compared values are not the same
+          #   Actual   (((spyFileChanged.count()))): 0
+          #   Expected (1)                         : 1
+          #   Loc: [/tmp/nix-build-keepassxc-2.7.10.drv-2/source/tests/TestDatabase.cpp(288)]
+          "testdatabase"
+        ]
+      );
+    in
+    ''
+      runHook preCheck

-    runHook postCheck
-  '';
+      export LC_ALL="en_US.UTF-8"
+      export QT_QPA_PLATFORM=offscreen
+      export QT_PLUGIN_PATH="${libsForQt5.qtbase.bin}/${libsForQt5.qtbase.qtPluginPrefix}"
+
+      make test ARGS+="-E '${disabledTests}' --output-on-failure"
+
+      runHook postCheck
+    '';

  nativeBuildInputs = [
    asciidoctor
    cmake
-    wrapQtAppsHook
-    qttools
+    libsForQt5.wrapQtAppsHook
+    libsForQt5.qttools
    pkg-config
  ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) wrapGAppsHook3;

@ -127,35 +137,43 @@ stdenv.mkDerivation rec {

  buildInputs =
    [
-      curl
      botan3
-      kio
+      curl
      libXi
      libXtst
      libargon2
+      libsForQt5.kio
+      libsForQt5.qtbase
+      libsForQt5.qtsvg
      minizip
      pcsclite
      qrencode
-      qtbase
-      qtsvg
      readline
      zlib
    ]
-    ++ lib.optional (stdenv.hostPlatform.isDarwin && withKeePassTouchID) LocalAuthentication
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      qtmacextras
+      libsForQt5.qtmacextras

      apple-sdk_15
      # ScreenCaptureKit, required by livekit, is only available on 12.3 and up:
      # https://developer.apple.com/documentation/screencapturekit
      (darwinMinVersionHook "12.3")
    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libusb1
-    ++ lib.optional withKeePassX11 qtx11extras;
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libusb1
+    ]
+    ++ lib.optionals withKeePassX11 [
+      libsForQt5.qtx11extras
+    ];

-  passthru.tests = nixosTests.keepassxc;
+  passthru = {
+    tests = {
+      inherit (nixosTests) keepassxc;
+    };
+    updateScript = nix-update-script { };
+  };

-  meta = with lib; {
+  meta = {
    description = "Offline password manager with many features";
    longDescription = ''
      A community fork of KeePassX, which is itself a port of KeePass Password Safe.
@ -165,12 +183,13 @@ stdenv.mkDerivation rec {
      using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
    '';
    homepage = "https://keepassxc.org/";
-    license = licenses.gpl2Plus;
+    changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
    mainProgram = "keepassxc";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      blankparticle
      sigmasquadron
    ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
-}
+})
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@ -101,6 +101,8 @@ stdenv.mkDerivation rec {
    "-DNDEBUG"
  ];

+  __darwinAllowLocalNetworking = true;
+
  doCheck = true;
  checkFlags = [ "V=1" ]; # verbose output in case some test fails
  doInstallCheck = true;
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-03-13";
+  version = "0-unstable-2025-04-14";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "25311dc03332d9ef2dff8d9d06c611d828028fac";
-    hash = "sha256-nmDjjQgxpZcddOHlBAE9CKdR95u+6lEYXcmIwH9RHXo=";
+    rev = "cacb61c9a3022c84057331063e31304933b61bdf";
+    hash = "sha256-dpqru8Qu1xZkHNKv6oF/T61/k6X2CWljUSVeJqxMvso=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/lu/lutgen/package.nix
+++ b/pkgs/by-name/lu/lutgen/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "lutgen";
-  version = "0.11.2";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "ozwaldorf";
    repo = "lutgen-rs";
    rev = "v${version}";
-    hash = "sha256-jmMVeDDVb/TuxulDYj+8y4Kl42EJTAWb3tAsanfWduE=";
+    hash = "sha256-VE4R0rdQbZ7cyCPRtWWARUAnlR/KWGFUoJSJ4lySwzY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-BEh8Wl0X1wv53w/Zu0PHwh8oGtCvIJe60aVqLbiH1Hs=";
+  cargoHash = "sha256-H913/EjCh14AcCIj/Em6neP5F6i88rSVbPMmnS3po/I=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "misconfig-mapper";
-  version = "1.13.7";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    tag = "v${version}";
-    hash = "sha256-6WFtXIqnn2ayfXkGMIxGDlYpE3UbHRuAU8qHGk9SCU4=";
+    hash = "sha256-7ObDlO/jHUMJdEIFwsFrdSyrbs6I6koNJxQyH6FbhZc=";
  };

-  vendorHash = "sha256-fEmf+d9oBXz7KymNVmC+CM7OyPD9QV1uN4ReTNhei7A=";
+  vendorHash = "sha256-gxURT2S1m7J3bZ0VIYxFFsbxU3za2BgJ/6TONoPGzAw=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@ -30,7 +30,7 @@ let
      url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
    };

-    npmDepsHash = "sha256-C7YuXxCrnJ+8L7JNh6TA8xi0G3y1FwFb9DQwhS+igME=";
+    npmDepsHash = "sha256-MIjQ5Lbtv6kFHUyuc12JTItUPxIHoo65iUlSjBxw9Z8=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
--- a/pkgs/by-name/pa/patchcil/deps.json
+++ b/pkgs/by-name/pa/patchcil/deps.json
@ -0,0 +1,32 @@
+[
+  {
+    "pname": "AsmResolver",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-ZW61z6Qmztdy2NaiqxvNcP5RWBIiIO6CWNnqYq0MwoA="
+  },
+  {
+    "pname": "AsmResolver.DotNet",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-VoTiIr2/r2my6sg2AOEeiqz9vZhWtq5mGaW2Hx90Uo4="
+  },
+  {
+    "pname": "AsmResolver.PE",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-tTU/flTxRJaC4gkmI/gctqIriGIMntkgTs51TqzcQlg="
+  },
+  {
+    "pname": "AsmResolver.PE.File",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-hPuFrpcm2VMiYEirsL4kYmAhOzjwjNXUklIfYJEonLo="
+  },
+  {
+    "pname": "DotNet.Glob",
+    "version": "3.1.3",
+    "hash": "sha256-5uGSaGY1IqDjq4RCDLPJm0Lg9oyWmyR96OiNeGqSj84="
+  },
+  {
+    "pname": "System.CommandLine",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  }
+]
--- a/pkgs/by-name/pa/patchcil/package.nix
+++ b/pkgs/by-name/pa/patchcil/package.nix
@ -0,0 +1,76 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
+  stdenv,
+  nix-update-script,
+  aot ? dotnetCorePackages.sdk_9_0.hasILCompiler && !stdenv.hostPlatform.isDarwin,
+}:
+
+buildDotnetModule rec {
+  pname = "patchcil";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "GGG-KILLER";
+    repo = "patchcil";
+    tag = "v${version}";
+    hash = "sha256-jqVXKp5ShWkIMAgmcwu9/QHy+Ey9d1Piv62wsO0Xm44=";
+  };
+
+  nativeBuildInputs = lib.optional aot stdenv.cc;
+
+  projectFile = "src/PatchCil.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = if aot then null else dotnetCorePackages.runtime_9_0;
+
+  selfContainedBuild = aot;
+  dotnetFlags = lib.optionals (!aot) [
+    # Disable AOT
+    "-p:PublishAot=false"
+    "-p:InvariantGlobalization=false"
+    "-p:EventSourceSupport=true"
+    "-p:HttpActivityPropagationSupport=true"
+    "-p:MetadataUpdaterSupport=true"
+    "-p:MetricsSupport=true"
+    "-p:UseNativeHttpHandler=false"
+    "-p:XmlResolverIsNetworkingEnabledByDefault=true"
+    "-p:EnableGeneratedComInterfaceComImportInterop=true"
+    "-p:_ComObjectDescriptorSupport=true"
+    "-p:_DataSetXmlSerializationSupport=true"
+    "-p:_DefaultValueAttributeSupport=true"
+    "-p:_DesignerHostSupport=true"
+    "-p:_EnableConsumingManagedCodeFromNativeHosting=true"
+    "-p:_UseManagedNtlm=true"
+  ];
+
+  preFixup = lib.optionalString aot ''
+    # Remove debug symbols as they shouldn't have anything in them.
+    rm $out/lib/patchcil/patchcil.dbg
+  '';
+
+  executables = [ "patchcil" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "A small utility to modify the library paths from PInvoke in .NET assemblies.";
+    homepage = "https://github.com/GGG-KILLER/patchcil";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ggg ];
+    mainProgram = "patchcil";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+      "x86_64-windows"
+      "i686-windows"
+    ];
+  };
+}
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "polarity";
-  version = "latest-unstable-2025-04-06";
+  version = "latest-unstable-2025-04-14";

  src = fetchFromGitHub {
    owner = "polarity-lang";
    repo = "polarity";
-    rev = "3d661ea0485a83b0c1065595839cb2d9d594e4e8";
-    hash = "sha256-4NeDOGzCq211SVVtfISq/Z901Et1zYhMQ/t7eNEBW9Y=";
+    rev = "9ee17a9a167efdd660c4806e2d3cd5bc2b3177e1";
+    hash = "sha256-9MsPMQnqzePhxF9f9DgmZ9aq8TzLYi3jZA9HF2McVss=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-S0d64jFKiyGVIFH8HhT4mzBEVUPDIMevvClTeqy0/28=";
+  cargoHash = "sha256-23qr4bEAsN75ONnNmym9eWH38fRoMmP1EkmOaka73Ko=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

--- a/pkgs/by-name/rk/rkbin/package.nix
+++ b/pkgs/by-name/rk/rkbin/package.nix
@ -25,6 +25,7 @@ stdenv.mkDerivation {
  passthru = {
    BL31_RK3568 = "${rkbin}/bin/rk35/rk3568_bl31_v1.44.elf";
    BL31_RK3588 = "${rkbin}/bin/rk35/rk3588_bl31_v1.47.elf";
+    TPL_RK3566 = "${rkbin}/bin/rk35/rk3566_ddr_1056MHz_v1.23.bin";
    TPL_RK3568 = "${rkbin}/bin/rk35/rk3568_ddr_1056MHz_v1.23.bin";
    TPL_RK3588 = "${rkbin}/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.18.bin";
  };
--- a/pkgs/by-name/sc/screen-pipe/package.nix
+++ b/pkgs/by-name/sc/screen-pipe/package.nix
@ -9,9 +9,9 @@
  openssl,
  sqlite,
  stdenv,
-  darwin,
  alsa-lib,
  xorg,
+  apple-sdk_12,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "screen-pipe";
@ -49,22 +49,9 @@ rustPlatform.buildRustPackage rec {
      openssl
      sqlite
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_12_3.frameworks;
-      [
-        CoreAudio
-        AudioUnit
-        CoreFoundation
-        CoreGraphics
-        CoreMedia
-        IOKit
-        Metal
-        MetalPerformanceShaders
-        Security
-        ScreenCaptureKit
-        SystemConfiguration
-      ]
-    )
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      alsa-lib
      xorg.libxcb
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@ -18,13 +18,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "snx-rs";
-  version = "3.1.1";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "ancwrd1";
    repo = "snx-rs";
    tag = "v${version}";
-    hash = "sha256-eWtoCU5JkpHGcOLzjzj9icDlnIW1y+fiEn5V/E5IQ4U=";
+    hash = "sha256-bLuIXd2pqqiyEP+lDTJYVDZkRZ0HcDkKFZd/qlpuf98=";
  };

  passthru.updateScript = nix-update-script { };
@ -57,7 +57,7 @@ rustPlatform.buildRustPackage rec {
  ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Hjc2wKkNmlVjZb5wz9fq9hzUsxXJyeFYq+4C+weUlq0=";
+  cargoHash = "sha256-E5OJVf9CkLn5mFtk4Yacs2OIvAuIw0idSs7QuTNvfgU=";

  meta = {
    description = "Open source Linux client for Checkpoint VPN tunnels";
--- a/pkgs/by-name/sw/swagger-cli/package.nix
+++ b/pkgs/by-name/sw/swagger-cli/package.nix
@ -21,6 +21,10 @@ buildNpmPackage rec {
    npm run bump
  '';

+  postInstall = ''
+    find $out/lib/node_modules -xtype l -delete
+  '';
+
  meta = with lib; {
    description = "Swagger 2.0 and OpenAPI 3.0 command-line tool";
    homepage = "https://apitools.dev/swagger-cli/";
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  nix-update-script,
+  writers,
+  baseUrl ? null,
+}:
+
+assert lib.asserts.assertMsg (
+  baseUrl == null
+) "The baseUrl parameter is deprecated, please use .withConfig instead";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "synapse-admin-etkecc";
+  version = "0.10.3-etke39";
+
+  src = fetchFromGitHub {
+    owner = "etkecc";
+    repo = "synapse-admin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1jE4QrHAnH27FrfpgM8rKd4I2AAJArtL0jgcWVc8TrU=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-60rS/OfPEQmmZ5j7mUjMPyK9prgNOX7MkYpu9djdjxQ=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnBuildHook
+  ];
+
+  env = {
+    NODE_ENV = "production";
+    SYNAPSE_ADMIN_VERSION = finalAttrs.version;
+  };
+
+  installPhase = ''
+    runHook preInstall
+    cp -r dist $out
+    runHook postInstall
+  '';
+
+  passthru = {
+    # https://github.com/etkecc/synapse-admin/blob/main/docs/config.md
+    withConfig =
+      config:
+      stdenv.mkDerivation {
+        inherit (finalAttrs) version meta;
+        pname = "synapse-admin-etkecc-with-config";
+        dontUnpack = true;
+        configFile = writers.writeJSON "synapse-admin-config" config;
+        installPhase = ''
+          runHook preInstall
+          cp -r ${finalAttrs.finalPackage} $out
+          chmod -R +w $out
+          cp $configFile $out/config.json
+          runHook postInstall
+        '';
+      };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Maintained fork of the admin console for (Matrix) Synapse homeservers, including additional features";
+    homepage = "https://github.com/etkecc/synapse-admin";
+    changelog = "https://github.com/etkecc/synapse-admin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+})
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@ -13,13 +13,13 @@

 buildGoModule rec {
  pname = "walker";
-  version = "0.12.19";
+  version = "0.12.21";

  src = fetchFromGitHub {
    owner = "abenz1267";
    repo = "walker";
    rev = "v${version}";
-    hash = "sha256-XOOYalJ+6V/O/fhC5gEDk2m1yZ2e5DofRRIi8ETHgoQ=";
+    hash = "sha256-wONW5CaPkLiVR5roGFx2SOcvcVDr9E9eCtojGBy3ErE=";
  };

  vendorHash = "sha256-6PPNVnsH1eU4fLcZpxiBoHCzN/TUUxfTfmxDsBDPDKQ=";
--- a/pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch
+++ b/pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch
@ -0,0 +1,79 @@
+diff --git a/xslt/common/html.xsl b/xslt/common/html.xsl
+index 77aed075..82832fb4 100644
+--- a/xslt/common/html.xsl
+++ b/xslt/common/html.xsl
+@@ -266,6 +266,16 @@ certain tokens, and you can add your own with {html.sidebar.mode}. See
+ -->
+ <xsl:param name="html.sidebar.right" select="''"/>
+ 
+<!--@@==========================================================================
+html.csp.nonce
+An optional CSP nonce string to allow the execution of scripts and styles.
+@revision[version=42.2 date=2025-02-22 status=final]
+
+This parameter takes a string value that will be added to the 'nonce' attribute
+of all 'style' and 'script' tags in the generated HTML output. This paramter is used
+to whitelist script and style tags that are allowed to be executed.
+-->
+<xsl:param name="html.csp.nonce" select="false()"/>
+ 
+ <!--**==========================================================================
+ html.output
+@@ -1124,6 +1134,11 @@ dimensions. All parameters can be automatically computed if not provided.
+     </xsl:call-template>
+   </xsl:param>
+   <style type="text/css">
+    <xsl:if test="$html.csp.nonce">
+      <xsl:attribute name="nonce">
+        <xsl:value-of select="$html.csp.nonce" />
+      </xsl:attribute>
+    </xsl:if>
+     <xsl:call-template name="html.css.content">
+       <xsl:with-param name="node" select="$node"/>
+       <xsl:with-param name="direction" select="$direction"/>
+@@ -1533,6 +1548,11 @@ copy, override this template and provide the necessary files.
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+     <script type="text/javascript">
+      <xsl:if test="$html.csp.nonce">
+        <xsl:attribute name="nonce">
+          <xsl:value-of select="$html.csp.nonce" />
+        </xsl:attribute>
+      </xsl:if>
+       <xsl:attribute name="src">
+         <xsl:text>http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=MML_HTMLorMML</xsl:text>
+       </xsl:attribute>
+@@ -1558,6 +1578,11 @@ result of {html.js.content} to that file.
+ <xsl:template name="html.js.script">
+   <xsl:param name="node" select="."/>
+   <script type="text/javascript">
+    <xsl:if test="$html.csp.nonce">
+      <xsl:attribute name="nonce">
+        <xsl:value-of select="$html.csp.nonce" />
+      </xsl:attribute>
+    </xsl:if>
+     <xsl:call-template name="html.js.content">
+       <xsl:with-param name="node" select="$node"/>
+     </xsl:call-template>
+@@ -2035,8 +2060,19 @@ on all `code` elements with `"syntax"` in the class value.
+ <xsl:template name="html.js.syntax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$html.syntax.highlight">
+-  <script type="text/javascript" src="{$html.js.root}highlight.pack.js"></script>
+-  <script><![CDATA[
+    <script type="text/javascript" src="{$html.js.root}highlight.pack.js">
+      <xsl:if test="$html.csp.nonce">
+        <xsl:attribute name="nonce">
+          <xsl:value-of select="$html.csp.nonce" />
+        </xsl:attribute>
+      </xsl:if>
+    </script>
+    <script>
+    <xsl:if test="$html.csp.nonce">
+      <xsl:attribute name="nonce">
+        <xsl:value-of select="$html.csp.nonce" />
+      </xsl:attribute>
+    </xsl:if><![CDATA[
+ document.addEventListener('DOMContentLoaded', function() {
+   var matches = document.querySelectorAll('code.syntax')
+   for (var i = 0; i < matches.length; i++) {
--- a/pkgs/by-name/ye/yelp-xsl/package.nix
+++ b/pkgs/by-name/ye/yelp-xsl/package.nix
@ -29,6 +29,10 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = "yelp-xsl";
--- a/pkgs/by-name/ye/yelp/cve-2025-3155.patch
+++ b/pkgs/by-name/ye/yelp/cve-2025-3155.patch
@ -0,0 +1,101 @@
+diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
+index 9e44b734..0a74da55 100644
+--- a/data/xslt/mal2html.xsl.in
+++ b/data/xslt/mal2html.xsl.in
+@@ -19,6 +19,11 @@
+ <xsl:param name="mal.link.prefix" select="'xref:'"/>
+ <xsl:param name="mal.link.extension" select="''"/>
+ 
+<xsl:template name="html.head.top.custom">
+  <xsl:param name="node" select="."/>
+  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
+</xsl:template>
+
+ <xsl:template name="mal.link.target.custom">
+   <xsl:param name="node" select="."/>
+   <xsl:param name="action" select="$node/@action"/>
+diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
+index 676ce3eb..56bc1f5c 100644
+--- a/data/xslt/man2html.xsl.in
+++ b/data/xslt/man2html.xsl.in
+@@ -131,7 +131,7 @@
+   the correct styling and a single character which we measure the
+   width of and update each sheet as required.
+ -->
+-<script type="text/javascript" language="javascript">
+<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
+ <xsl:text>
+ $(document).ready (function () {
+   var div = document.getElementById("invisible-char");
+diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
+index 0c1ec9bb..421fc02d 100644
+--- a/data/xslt/yelp-common.xsl.in
+++ b/data/xslt/yelp-common.xsl.in
+@@ -15,6 +15,13 @@
+ <xsl:param name="html.syntax.highlight" select="true()"/>
+ <xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
+ 
+<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
+
+<xsl:template name="html.head.top.custom">
+  <xsl:param name="node" select="."/>
+  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
+</xsl:template>
+
+ <xsl:template name="html.js.mathjax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
+index e74eb463..2ce1d05b 100644
+--- a/libyelp/yelp-transform.c
+++ b/libyelp/yelp-transform.c
+@@ -71,6 +71,8 @@ static void      xslt_yelp_cache            (xsltTransformContextPtr  ctxt,
+                                              xsltStylePreCompPtr      comp);
+ static void      xslt_yelp_aux              (xmlXPathParserContextPtr ctxt,
+                                              int                      nargs);
+static void      xslt_yelp_generate_nonce   (xmlXPathParserContextPtr ctxt,
+                                             int                      nargs);
+ 
+ enum {
+     PROP_0,
+@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
+                              BAD_CAST "input",
+                              BAD_CAST YELP_NAMESPACE,
+                              (xmlXPathFunction) xslt_yelp_aux);
+    xsltRegisterExtFunction (priv->context,
+                         BAD_CAST "generate_nonce",
+                         BAD_CAST YELP_NAMESPACE,
+                         (xmlXPathFunction) xslt_yelp_generate_nonce);
+ 
+     priv->output = xsltApplyStylesheetUser (priv->stylesheet,
+                                             priv->input,
+@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
+     xsltExtensionInstructionResultRegister (tctxt, ret);
+     valuePush (ctxt, ret);
+ }
+
+static void
+xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
+{
+    GRand* rand;
+    gchar* nonce_str;
+
+    rand = g_rand_new ();
+    nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
+    xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
+    g_free(nonce_str);
+    g_rand_free(rand);
+}
+diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
+index 32ae131e..d544c5df 100644
+--- a/libyelp/yelp-view.c
+++ b/libyelp/yelp-view.c
+@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
+ 
+     if (app_info)
+       {
+-        if (!strstr (g_app_info_get_executable (app_info), "yelp"))
+        if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
+           {
+             GList l;
+ 
--- a/pkgs/by-name/ye/yelp/package.nix
+++ b/pkgs/by-name/ye/yelp/package.nix
@ -49,6 +49,10 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-good
  ];

+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = "yelp";
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "0.181.5";
+  version = "0.181.8";

  outputs =
    [ "out" ]
@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wp8CoWEOSScQP2Q+lQJgstzTNNwiy0ONHOy6PjIlFBo=";
+    hash = "sha256-gkbiV0kfeM1Ito8jVOBVneNjaXCA4PFayXJLIUmjqn4=";
  };

  patches = [
@ -128,7 +128,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-FATdeVwbSUA/zfWV9TdoS4/fT9KWsekKGjQ34HJW4rk=";
+  cargoHash = "sha256-PMLu2PeyRNu6VbHByL+clUoY/P8Rlrc+SvP5gDKrN/E=";

  nativeBuildInputs =
    [
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
@ -16,7 +16,6 @@
  libgee,
  libhandy,
  libxml2,
-  libsoup_2_4,
  elementary-calendar,
 }:

@ -52,7 +51,6 @@ stdenv.mkDerivation rec {
    libgee
    libhandy
    libical
-    libsoup_2_4
    wingpanel
  ];

--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
@ -2,19 +2,20 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  gettext,
  pkg-config,
+  xfce4-dev-tools,
  glib,
  gtk3,
  json_c,
  libxml2,
-  libsoup_2_4,
+  libsoup_3,
  upower,
  libxfce4ui,
  libxfce4util,
  xfce4-panel,
  xfconf,
-  hicolor-icon-theme,
  gitUpdater,
 }:

@ -31,9 +32,23 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-AC0f5jkG0vOgEvPLWMzv8d+8xGZ1njbHbTsD3QHA3Fc=";
  };

+  patches = [
+    # Port to libsoup-3.0
+    # https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/merge_requests/28
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/c0653a903c6f2cecdf41ac9eaeba4f4617656ffe.patch";
+      hash = "sha256-wAowm4ppBSKvYwOowZbbs5pnTh9EQ9XX05lA81wtsRM=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/279c975dc1f95bd1ce9152eee1d19122e7deb9a8.patch";
+      hash = "sha256-gVfyXkE0bjBfvcQU9fDp+Gm59bD3VbAam04Jak8i31k=";
+    })
+  ];
+
  nativeBuildInputs = [
    gettext
    pkg-config
+    xfce4-dev-tools
  ];

  buildInputs = [
@ -41,15 +56,16 @@ stdenv.mkDerivation rec {
    gtk3
    json_c
    libxml2
-    libsoup_2_4
+    libsoup_3
    upower
    libxfce4ui
    libxfce4util
    xfce4-panel
    xfconf
-    hicolor-icon-theme
  ];

+  configureFlags = [ "--enable-maintainer-mode" ];
+
  enableParallelBuilding = true;

  passthru.updateScript = gitUpdater {
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@ -78,6 +78,7 @@ let

        patchNupkgs = callPackage ./patch-nupkgs.nix { };
        nugetPackageHook = callPackage ./nuget-package-hook.nix { };
+        autoPatchcilHook = callPackage ../../../build-support/dotnet/auto-patchcil-hook { };

        buildDotnetModule = callPackage ../../../build-support/dotnet/build-dotnet-module { };
        buildDotnetGlobalTool = callPackage ../../../build-support/dotnet/build-dotnet-global-tool { };
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@ -38,7 +38,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gegl";
-  version = "0.4.54";
+  version = "0.4.58";

  outputs = [
    "out"
@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NaNC8IxrQ3mt7iy1dI/E4wfP3PJBfAuxfWymVD8jix4=";
+    hash = "sha256-1WeLvV/lNZQbgvlluX/Mk4XOk29wyYK9VlpT1VGdG/8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@ -50,9 +50,7 @@ stdenv.mkDerivation rec {
    automake
  ];

-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export LDFLAGS="$LDFLAGS -Wl,-no_uuid -Wl,-install_name,@rpath/libjemalloc.2.dylib";
-  '';
+  preConfigure = "";

  # TODO: switch to autoreconfHook when updating beyond 5.3.0
  # https://github.com/jemalloc/jemalloc/issues/2346
--- a/pkgs/development/libraries/librdf/raptor.nix
+++ b/pkgs/development/libraries/librdf/raptor.nix
@ -1,39 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libxml2,
-  curl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "raptor";
-  version = "1.4.21";
-
-  src = fetchurl {
-    url = "http://download.librdf.org/source/raptor-${version}.tar.gz";
-    sha256 = "db3172d6f3c432623ed87d7d609161973d2f7098e3d2233d0702fbcc22cfd8ca";
-  };
-
-  buildInputs = [
-    libxml2
-    curl
-  ];
-
-  preBuild = ''
-    sed -e '/curl\/types/d' -i src/*.c src/*.h
-  '';
-
-  meta = {
-    description = "RDF Parser Toolkit";
-    homepage = "https://librdf.org/raptor";
-    license = with lib.licenses; [
-      lgpl21
-      asl20
-    ];
-    maintainers = [ lib.maintainers.marcweber ];
-    platforms = lib.platforms.linux;
-    # error: passing argument 2 of 'xmlSetStructuredErrorFunc' from incompatible pointer type [-Wincompatible-pointer-types]
-    broken = true;
-  };
-}
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@ -7,10 +7,21 @@
  wayland-scanner,
  pkg-config,
  libdrm,
+  fetchpatch,
 }:

 qtModule {
  pname = "qtwayland";
+
+  # Backport fix for popups not rendering properly
+  # FIXME: remove in 6.9.1
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/e4556c59f0c8250da7c16759432b2ac0a5ac9d9f.patch";
+      hash = "sha256-wRNXBwecuULn5MD87HP20uSuxHiuQslKp20DIuCGheM=";
+    })
+  ];
+
  # wayland-scanner needs to be propagated as both build
  # (for the wayland-scanner binary) and host (for the
  # actual wayland.xml protocol definition)
--- a/pkgs/development/lua-modules/bit32.patch
+++ b/pkgs/development/lua-modules/bit32.patch
@ -1,14 +0,0 @@
-diff -Naur lua-compat-5.2/c-api/compat-5.2.h lua-compat-5.2-patched/c-api/compat-5.2.h
--- lua-compat-5.2/c-api/compat-5.2.h	2015-02-19 09:23:42.000000000 +1100
-+++ lua-compat-5.2-patched/c-api/compat-5.2.h	2019-06-17 17:58:13.585361793 +1000
-@@ -146,8 +146,10 @@
- #define lua_pushglobaltable(L) \
-   lua_pushvalue(L, LUA_GLOBALSINDEX)
- 
-+#if !defined(luaL_newlib)
- #define luaL_newlib(L, l) \
-   (lua_newtable((L)),luaL_setfuncs((L), (l), 0))
-+#endif
- 
- void luaL_checkversion (lua_State *L);
- 
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -169,32 +169,31 @@ final: prev: {
  bit32 = callPackage (
    {
      buildLuarocksPackage,
-      fetchFromGitHub,
      fetchurl,
+      fetchzip,
+      luaAtLeast,
      luaOlder,
    }:
    buildLuarocksPackage {
      pname = "bit32";
-      version = "5.3.0-1";
+      version = "5.3.5.1-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/bit32-5.3.0-1.rockspec";
-          sha256 = "1d6xdihpksrj5a3yvsvnmf3vfk15hj6f8n1rrs65m7adh87hc0yd";
+          url = "mirror://luarocks/bit32-5.3.5.1-1.rockspec";
+          sha256 = "11mg0hmmil92hkwamm91ghih6ys9pqsakx0z9jgnqxymnl887j51";
        }).outPath;
-      src = fetchFromGitHub {
-        owner = "keplerproject";
-        repo = "lua-compat-5.2";
-        rev = "bitlib-5.3.0";
-        hash = "sha256-Ek7FMWskfHwHhEVfjTDZyL/cruHDiQo5Jmnwsvai+MY=";
+      src = fetchzip {
+        url = "https://github.com/keplerproject/lua-compat-5.3/archive/v0.10.zip";
+        sha256 = "1caxn228gx48g6kymp9w7kczgxcg0v0cd5ixsx8viybzkd60dcn4";
      };

-      disabled = luaOlder "5.1";
+      disabled = luaOlder "5.1" || luaAtLeast "5.5";

      meta = {
        homepage = "http://www.lua.org/manual/5.2/manual.html#6.7";
        description = "Lua 5.2 bit manipulation library";
        maintainers = with lib.maintainers; [ lblasc ];
-        license.fullName = "MIT/X11";
+        license.fullName = "MIT";
      };
    }
  ) { };
@ -815,15 +814,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "fzf-lua";
-      version = "0.0.1823-1";
+      version = "0.0.1836-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.1823-1.rockspec";
-          sha256 = "0icbchqxr546j21xq2f6w122xkcmqgpg9pywlip8xjj8vsdfx6n6";
+          url = "mirror://luarocks/fzf-lua-0.0.1836-1.rockspec";
+          sha256 = "1q0wfck09d0449q8dyb95cyyr8z0r8292dp8vrqq3jcd7qkjcf1q";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/47b85a25c0c0b2c20b4e75199ed01bb71e7814f5.zip";
-        sha256 = "1znlhvb84x3lipa5n1cdk1kpid49h647hnnwy01xw447vk49p11p";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/ba5ba606f11967e08165aeeb9d7abe04d0835f58.zip";
+        sha256 = "1r66yrpzzzazasmb450xpr11f0sjg8ckrf91x4c66ypsanz2z2ws";
      };

      disabled = luaOlder "5.1";
@ -881,8 +880,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "lewis6991";
        repo = "gitsigns.nvim";
-        rev = "c6fedfd0b1715ee624384b134becec0a7b0a3d28";
-        hash = "sha256-c+7Bf7SqVaNiYHczouYChDrurDdTxIDzr/TLMtLqZ50=";
+        rev = "fcfa7a989cd6fed10abf02d9880dc76d7a38167d";
+        hash = "sha256-cg8r0yuuSE8G5MTj0pET8MzJ+VQf+HsXDJx5FzriM78=";
      };

      disabled = lua.luaversion != "5.1";
@ -895,6 +894,37 @@ final: prev: {
    }
  ) { };

+  grug-far-nvim = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchurl,
+      fetchzip,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "grug-far.nvim";
+      version = "1.6.6-1";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/grug-far.nvim-1.6.6-1.rockspec";
+          sha256 = "1axdj580nv078d4rh7q9rqd5rd46cvd3gfif0cbqys2kpv0xx53d";
+        }).outPath;
+      src = fetchzip {
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/d6c682af0033b4fbb3645a997e3b4a9189ed1ed6.zip";
+        sha256 = "0v1nfyiymb17p3fkk6ih1pxiib25f8vg74k79vp9r5wr56l9ja9c";
+      };
+
+      disabled = luaOlder "5.1";
+
+      meta = {
+        homepage = "https://github.com/MagicDuck/grug-far.nvim";
+        description = "Find And Replace plugin for neovim";
+        maintainers = with lib.maintainers; [ teto ];
+        license.fullName = "MIT";
+      };
+    }
+  ) { };
+
  haskell-tools-nvim = callPackage (
    {
      buildLuarocksPackage,
@ -926,36 +956,6 @@ final: prev: {
    }
  ) { };

-  grug-far-nvim = callPackage (
-    {
-      buildLuarocksPackage,
-      fetchurl,
-      fetchzip,
-      luaOlder,
-    }:
-    buildLuarocksPackage {
-      pname = "grug-far.nvim";
-      version = "1.5.15-1";
-      knownRockspec =
-        (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.5.15-1.rockspec";
-          sha256 = "1jp6b6kqp389wli766rypam4hr6dqv6v5r8kv1dk21d7glz8hg6h";
-        }).outPath;
-      src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/5da116bc99a03e14be3b824e319f4e49c676af78.zip";
-        sha256 = "196l6vy9573fkwld3cl927706a6gfgmc71kn1kx3pmk8l6p8hcya";
-      };
-
-      disabled = luaOlder "5.1";
-
-      meta = {
-        homepage = "https://github.com/MagicDuck/grug-far.nvim";
-        description = "Find And Replace plugin for neovim";
-        license.fullName = "MIT";
-      };
-    }
-  ) { };
-
  http = callPackage (
    {
      basexx,
@ -1979,17 +1979,17 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "lua-resty-openssl";
-      version = "1.5.2-1";
+      version = "1.6.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/lua-resty-openssl-1.5.2-1.rockspec";
-          sha256 = "1nrriyf9fvn0achn2drvb915kx7cq4ldlyg24g118i8ib1fr9lgd";
+          url = "mirror://luarocks/lua-resty-openssl-1.6.0-1.rockspec";
+          sha256 = "108a53210khinpwk88pcz6s8n2f6hhaib3jfrgi9kjp0r4s14c4q";
        }).outPath;
      src = fetchFromGitHub {
        owner = "fffonion";
        repo = "lua-resty-openssl";
-        rev = "1.5.2";
-        hash = "sha256-vkcqUaHCIBBmcVP4csqjn6oPSBvUF8MBzveIc6jJKWY=";
+        rev = "1.6.0";
+        hash = "sha256-TqBRTFV1255Ct2mm2T8bLJNdSWZTEB6wOOHGRZczcVk=";
      };

      meta = {
@ -2011,17 +2011,17 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "lua-resty-session";
-      version = "4.0.5-1";
+      version = "4.1.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/lua-resty-session-4.0.5-1.rockspec";
-          sha256 = "0h0kqwna46mrraq310qjb7yigxwv13n4czk24xnqr21czxsskzkg";
+          url = "mirror://luarocks/lua-resty-session-4.1.0-1.rockspec";
+          sha256 = "0cmx2rwiwiprg1112chxrfvp7gs2jg0grdnkb5n7yhd5rnp0bhhw";
        }).outPath;
      src = fetchFromGitHub {
        owner = "bungle";
        repo = "lua-resty-session";
-        rev = "v4.0.5";
-        hash = "sha256-n0m6/4JnUPoidM7oWKd+ZyNbb/X/h8w21ptCrFaA8SI=";
+        rev = "v4.1.0";
+        hash = "sha256-MXB7Z/0drMOcTwJBHNwZx4iqem1XfG6uwozW+RxL588=";
      };

      disabled = luaOlder "5.1";
@ -2730,13 +2730,13 @@ final: prev: {
      knownRockspec =
        (fetchurl {
          url = "mirror://luarocks/lualine.nvim-scm-1.rockspec";
-          sha256 = "044bnw2phsxjsxkraaq9phj932f2f7vsbvfa91p7qfp2yjshixjf";
+          sha256 = "1cf500jgdd3f9d36ad9h3vf20vyz4za0lqsdrx9l3si39n71k92v";
        }).outPath;
      src = fetchFromGitHub {
        owner = "nvim-lualine";
        repo = "lualine.nvim";
-        rev = "0ea56f91b7f51a37b749c050a5e5dfdd56b302b3";
-        hash = "sha256-VSWWvhnaeNoeM7U1SwerL8vqu81eg8YJtLnJDdEjvzY=";
+        rev = "86fe39534b7da729a1ac56c0466e76f2c663dc42";
+        hash = "sha256-XeAFXg6GWzMJV/HzfdCXtv/effAHVU7mioFKTf1kDc8=";
      };

      disabled = luaOlder "5.1";
@ -3216,14 +3216,14 @@ final: prev: {
      version = "0.6.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/luasystem-0.6.0-1.rockspec";
-          sha256 = "0pbjxfa56wy2bzs3q0bsxv27m8l2f3p2frvkprah2n708pxzi84s";
+          url = "mirror://luarocks/luasystem-0.6.2-1.rockspec";
+          sha256 = "0s6vd8a35x156ccp9b95rzqgklmgvz3a2bcfp4g09vlyh2kqy1am";
        }).outPath;
      src = fetchFromGitHub {
        owner = "lunarmodules";
        repo = "luasystem";
-        rev = "v0.6.0";
-        hash = "sha256-xhMdtI8tVBIQ4hsGe3l9z/ywJTvJhtGoE9hVnzvrTGc=";
+        rev = "v0.6.2";
+        hash = "sha256-EcKs8W8UAbyA5WCt75tGO2osNgFbL8SNUl78vKSy82o=";
      };

      disabled = luaOlder "5.1";
@ -4080,8 +4080,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "hrsh7th";
        repo = "nvim-cmp";
-        rev = "059e89495b3ec09395262f16b1ad441a38081d04";
-        hash = "sha256-YC2ehgS759GzRUySPqmb1NQFxJ9HnP731oVYptWU3Xk=";
+        rev = "b5311ab3ed9c846b585c0c15b7559be131ec4be9";
+        hash = "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=";
      };

      disabled = luaOlder "5.1" || luaAtLeast "5.4";
@ -4336,8 +4336,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "nvim-lua";
        repo = "plenary.nvim";
-        rev = "3707cdb1e43f5cea73afb6037e6494e7ce847a66";
-        hash = "sha256-18zX3kZ42ynRefFP0mOcy6ESEpejTukjNi4jCRXx48A=";
+        rev = "857c5ac632080dba10aae49dba902ce3abf91b35";
+        hash = "sha256-8FV5RjF7QbDmQOQynpK7uRKONKbPRYbOPugf9ZxNvUs=";
      };

      disabled = luaOlder "5.1" || luaAtLeast "5.4";
@ -4426,15 +4426,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "rest.nvim";
-      version = "3.9.1-1";
+      version = "3.12.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/rest.nvim-3.9.1-1.rockspec";
-          sha256 = "02arw1hr702jfadnc72yr3kkhfcm7hfg1ipis7nlhvsj25i2yl54";
+          url = "mirror://luarocks/rest.nvim-3.12.0-1.rockspec";
+          sha256 = "1i16gr471v9v6jdwrqizagznpjdr58ijx0cs9yjnd8b6b9cwmxi9";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.9.1.zip";
-        sha256 = "15lkdr77q7zxqbh3xkx3ilj38hp5jfinrqw92q3dpmxc8d8wk9iw";
+        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.12.0.zip";
+        sha256 = "1494r144idrq09da8ra4q0yk7giqh4hxs05397ja7hpxyz0yabdr";
      };

      disabled = luaOlder "5.1";
@ -4649,15 +4649,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "rustaceanvim";
-      version = "6.0.1-1";
+      version = "6.0.2-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.0.1-1.rockspec";
-          sha256 = "02qxbrk32fay17nlxs4sf4dpkvsfnj5lkm8wsb2q0a8jaa2v7dxv";
+          url = "mirror://luarocks/rustaceanvim-6.0.2-1.rockspec";
+          sha256 = "1z2s2f91mnc9fxr5ykffajpj2c92rjgnwipfvi2lhhl2p5hpgf9f";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.1.zip";
-        sha256 = "032barkibbsjjwzq87jbn2sqni3f5bmfvxn2bcq589viwdrziwgf";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.2.zip";
+        sha256 = "09wrfmzbk81xax5p4wzczsvv1x28nv54mayi12fvzv6c3bmcsbvj";
      };

      disabled = luaOlder "5.1";
@ -4962,8 +4962,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "nvim-telescope";
        repo = "telescope.nvim";
-        rev = "415af52339215926d705cccc08145f3782c4d132";
-        hash = "sha256-5y8srYKaAqFplMtDjsc8GdDF8yui5vCNMiOeFLrC/sM=";
+        rev = "a4ed82509cecc56df1c7138920a1aeaf246c0ac5";
+        hash = "sha256-GF1zOHZItVZm3bx2wqI4hPj7EXQJ2F9KS4MtaEt2gm0=";
      };

      disabled = lua.luaversion != "5.1";
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -4,7 +4,7 @@
  cargo,
  cmake,

-  # plenary utilities
+  ast-grep,
  which,
  findutils,
  coreutils,
@ -86,16 +86,6 @@ in
  ##########################################3
  #### manual fixes for generated packages
  ##########################################3
-  bit32 = prev.bit32.overrideAttrs (oa: {
-    # Small patch in order to no longer redefine a Lua 5.2 function that Luajit
-    # 2.1 also provides, see https://github.com/LuaJIT/LuaJIT/issues/325 for
-    # more
-    patches = [
-      ./bit32.patch
-    ];
-    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
-  });
-
  busted = prev.busted.overrideAttrs (oa: {
    nativeBuildInputs = oa.nativeBuildInputs ++ [
      installShellFiles
@ -227,6 +217,19 @@ in
      runHook preCheck
      # feel free to disable/adjust the tests
      rm tests/base/test_apply.lua tests/base/test_vimscript_interpreter.lua
+
+      # Dependencies needed in special location
+      mkdir -p deps/{ripgrep,astgrep}
+      mkdir {temp_test_dir,temp_history_dir}
+      ln -s ${lib.getExe ripgrep} deps/ripgrep/rg
+      ln -s ${lib.getExe ast-grep} deps/astgrep/ast-grep
+      ln -s ${vimPlugins.mini-nvim} deps/mini.nvim
+
+      # Update dependency check to respect packaged version
+      substituteInPlace lua/grug-far/test/dependencies.lua \
+        --replace-fail "local RG_VERSION = '14.1.0'" "local RG_VERSION = '${lib.getVersion ripgrep}'" \
+        --replace-fail "local SG_VERSION = '0.35.0'" "local SG_VERSION = '${lib.getVersion ast-grep}'"
+
      make test dir=base
      runHook postCheck
    '';
--- a/pkgs/development/python-modules/craft-platforms/default.nix
+++ b/pkgs/development/python-modules/craft-platforms/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "craft-platforms";
-  version = "0.7.1";
+  version = "0.8.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "canonical";
    repo = "craft-platforms";
    tag = version;
-    hash = "sha256-+7uaN+ePu+88goPCj9KM3dKhTwV2erP0/Fg05LqOWPg=";
+    hash = "sha256-U57hmQ3UPuwoue8kAxAXiH8ecViryFqIxmpnaAdQnZo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/islpy/default.nix
+++ b/pkgs/development/python-modules/islpy/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "islpy";
-  version = "2025.1.3";
+  version = "2025.1.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "inducer";
    repo = "islpy";
    tag = "v${version}";
-    hash = "sha256-3HUfr0W5X8HaViUD0kpKbdxTTRS/TW6PvAGl8vr03XU=";
+    hash = "sha256-hzqxVLNKm63XliX5rDB54f6n1nJPVJJSAMmNTInbOEE=";
  };

  build-system = [
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "nomadnet";
-  version = "0.6.1";
+  version = "0.6.2";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "markqvist";
    repo = "NomadNet";
    tag = version;
-    hash = "sha256-TKn35rrWsHo/5bGriMcPx+lPvhWzmVXU3EG4KU/ebwI=";
+    hash = "sha256-HBNZvU4ZCLgEn8ul1iflaY18novZMnn8GIojriX/ej0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.13.1";
+  version = "0.13.2";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    tag = version;
-    hash = "sha256-yEv04y8mkXRmxGmK0UXBRcFdmyAg2xEXYYB0X+0zkao=";
+    hash = "sha256-khO8mu2aWBU9TiorKkMd1e54r5C7ovv6eWyJ61dzOJw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "rns";
-  version = "0.9.3";
+  version = "0.9.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "markqvist";
    repo = "Reticulum";
    tag = version;
-    hash = "sha256-50L+5WVsYaidz71rkGZny2KlCR3ZfPEQJEPI38MOBWA=";
+    hash = "sha256-Z6Af/PNQkbo+0xn0kEh2I8T03D/gQpuRNHBhLX3mkms=";
  };

  patches = [
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@ -16,8 +16,8 @@ let
      hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
    };
    "10" = {
-      version = "10.8.0";
-      hash = "sha256-Kb8sXOrqeZHugu7BX+cWLg+tgW0MSms1oWwB05J0v2k=";
+      version = "10.8.1";
+      hash = "sha256-2LLrvGXPAsNJ7Ka0XJZAuRDxa2revbe5JunbRA5Hysc=";
    };
  };

--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@ -1,8 +1,8 @@
 {
  "1.21": {
-    "sha1": "4707d00eb834b446575d89a61a11b5d548d8c001",
-    "url": "https://piston-data.mojang.com/v1/objects/4707d00eb834b446575d89a61a11b5d548d8c001/server.jar",
-    "version": "1.21.4",
+    "sha1": "e6ec2f64e6080b9b5d9b471b291c33cc7f509733",
+    "url": "https://piston-data.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar",
+    "version": "1.21.5",
    "javaVersion": 21
  },
  "1.20": {
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@ -179,6 +179,13 @@ in
    platformCanUseHDCPBlob = true;
  };

+  armTrustedFirmwareRK3568 = buildArmTrustedFirmware rec {
+    extraMakeFlags = [ "bl31" ];
+    platform = "rk3568";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
+  };
+
  armTrustedFirmwareRK3588 = buildArmTrustedFirmware rec {
    extraMakeFlags = [ "bl31" ];
    platform = "rk3588";
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@ -24,6 +24,7 @@
  armTrustedFirmwareAllwinnerH616,
  armTrustedFirmwareRK3328,
  armTrustedFirmwareRK3399,
+  armTrustedFirmwareRK3568,
  armTrustedFirmwareRK3588,
  armTrustedFirmwareS905,
  buildPackages,
@ -606,6 +607,20 @@ in
    filesToInstall = [ "u-boot.rom" ];
  };

+  ubootQuartz64B = buildUBoot {
+    defconfig = "quartz64-b-rk3566_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    filesToInstall = [
+      "idbloader.img"
+      "idbloader-spi.img"
+      "u-boot.itb"
+      "u-boot-rockchip.bin"
+      "u-boot-rockchip-spi.bin"
+    ];
+  };
+
  ubootRaspberryPi = buildUBoot {
    defconfig = "rpi_defconfig";
    extraMeta.platforms = [ "armv6l-linux" ];
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "sankey-chart";
-  version = "3.6.0";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "MindFreeze";
    repo = "ha-sankey-chart";
    rev = "v${version}";
-    hash = "sha256-Yjh9HrL7zcMFSlXLRW071zG4Wiyv9q2siIw5Ego4e80=";
+    hash = "sha256-krWK2P7tjK5loFYXZ5+b8UN4TEKPObW2QK+3l7+zvj0=";
  };

-  npmDepsHash = "sha256-rrzBw+zkvSf6+ABSGfC8rvtQ+pxYyZOPDW7TBpA0ysQ=";
+  npmDepsHash = "sha256-OBgmmPcwpMxXrytP2tHzCFe1imz1S6LHBWJkruw3jgI=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -946,6 +946,7 @@ mapAliases {
  libquotient = libsForQt5.libquotient; # Added 2023-11-11
  librarian-puppet-go = throw "'librarian-puppet-go' has been removed, as it's upstream is unmaintained"; # Added 2024-06-10
  librdf = throw "'librdf' has been renamed to/replaced by 'lrdf'"; # Converted to throw 2024-10-17
+  librdf_raptor = throw "librdf_raptor has been remove due to failing to build and being unmaintained"; # Added 2025-04-14
  LibreArp = librearp; # Added 2024-06-12
  LibreArp-lv2 = librearp-lv2; # Added 2024-06-12
  libreddit = throw "'libreddit' has been removed because it is unmaintained upstream. Consider using 'redlib', a maintained fork"; # Added 2024-07-17
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -491,6 +491,7 @@ with pkgs;
    buildDotnetGlobalTool
    mkNugetSource
    mkNugetDeps
+    autoPatchcilHook
    ;

  dotnetenv = callPackage ../build-support/dotnet/dotnetenv {
@ -11042,8 +11043,6 @@ with pkgs;
    haskellLib = haskell.lib.compose;
  };

-  librdf_raptor = callPackage ../development/libraries/librdf/raptor.nix { };
-
  librdf_raptor2 = callPackage ../development/libraries/librdf/raptor2.nix { };

  librdf_rasqal = callPackage ../development/libraries/librdf/rasqal.nix { };
@ -12713,6 +12712,7 @@ with pkgs;
    armTrustedFirmwareQemu
    armTrustedFirmwareRK3328
    armTrustedFirmwareRK3399
+    armTrustedFirmwareRK3568
    armTrustedFirmwareRK3588
    armTrustedFirmwareS905
    ;
@ -13283,6 +13283,7 @@ with pkgs;
    ubootQemuArm
    ubootQemuRiscv64Smode
    ubootQemuX86
+    ubootQuartz64B
    ubootRaspberryPi
    ubootRaspberryPi2
    ubootRaspberryPi3_32bit
@ -14166,10 +14167,6 @@ with pkgs;
    avahi = avahi.override { withLibdnssdCompat = true; };
  };

-  keepassxc = libsForQt5.callPackage ../applications/misc/keepassxc {
-    inherit (darwin.apple_sdk_11_0.frameworks) LocalAuthentication;
-  };
-
  evolution-data-server-gtk4 = evolution-data-server.override {
    withGtk3 = false;
    withGtk4 = true;
@ -14487,7 +14484,23 @@ with pkgs;

  inherit (xorg) xlsfonts;

-  gimp = callPackage ../applications/graphics/gimp {
+  gimp3 = callPackage ../applications/graphics/gimp {
+    lcms = lcms2;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
+  };
+
+  gimp3-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
+    gimpPlugins = gimp3Plugins;
+    plugins = null; # All packaged plugins enabled, if not explicit plugin list supplied
+  };
+
+  gimp3Plugins = recurseIntoAttrs (
+    callPackage ../applications/graphics/gimp/plugins {
+      gimp = gimp3;
+    }
+  );
+
+  gimp = callPackage ../applications/graphics/gimp/2.0 {
    autoreconfHook = buildPackages.autoreconfHook269;
    lcms = lcms2;
    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;