diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 8e95a9a21a97..7f4b38f06f2a 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index a7afd41589f5..19bfdd4f9f79 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Build codeowners validator
         run: nix-build base/ci -A codeownersValidator
 
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -96,7 +96,7 @@ jobs:
       # This is intentional, because we need to request the review of owners as declared in the base branch.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index abf9b7c33704..a9fecb67b645 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -241,7 +241,7 @@ jobs:
     steps:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 91ab0b25f146..12c6907f95e6 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/doc/redirects.json b/doc/redirects.json
index e29cb93697f9..ddf3626bbd34 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -86,6 +86,9 @@
     "index.html#building-a-titanium-app",
     "index.html#emulating-or-simulating-the-app"
   ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
   "sec-nixpkgs-release-25.05-lib": [
     "release-notes.html#sec-nixpkgs-release-25.05-lib"
   ],
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index ba25fef1bfde..ebc26f4b115e 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -20,6 +20,16 @@
 
 - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs.
 
+### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}
+
+- `nexusmods-app` has been upgraded from version 0.6.3 to 0.7.3.
+
+  - Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
+
+  - Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
+
+  - This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
+
 ## Nixpkgs Library {#sec-nixpkgs-release-25.05-lib}
 
 ### Breaking changes {#sec-nixpkgs-release-25.05-lib-breaking}
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index a103e8bd5cff..e8eb5a3058f7 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1922,6 +1922,9 @@
     "index.html#building-a-titanium-app",
     "index.html#emulating-or-simulating-the-app"
   ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
   "sec-nixpkgs-release-25.05-lib": [
     "release-notes.html#sec-nixpkgs-release-25.05-lib"
   ],
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 895d3fb2c9bf..fe8e77b1f1c3 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -95,6 +95,7 @@ let
 self = stdenv.mkDerivation {
   pname = "coq";
   inherit (fetched) version src;
+  exact-version = args.version;
 
   passthru = {
     inherit coq-version;
@@ -233,7 +234,8 @@ self = stdenv.mkDerivation {
 }; in
 if coqAtLeast "8.21" then self.overrideAttrs(o: {
   # coq-core is now a shim for rocq
-  propagatedBuildInputs = o.propagatedBuildInputs ++ [ rocq-core ];
+  propagatedBuildInputs = o.propagatedBuildInputs
+    ++ [ (rocq-core.override { version = o.exact-version; }) ];
   buildPhase = ''
     runHook preBuild
     dune build -p coq-core,coqide-server${lib.optionalString buildIde ",rocqide"} -j $NIX_BUILD_CORES
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index ee846eadd863..eaa5ae612c62 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -17,17 +17,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "6.2.0";
+  version = "6.2.2";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-2+/PJZPqKbxeWbIVx2647/xK5CqVUUvsdd67YFwjhms=";
+    hash = "sha256-vyJ5Fr38YvR8jjw/Tnih6c+GoctnVpgiaX7Bl+YNti0=";
   };
 
-  vendorHash = "sha256-wvvzD2lD1TPXEriNaI6nzNGR/Kg94zC58pAR42/DlMA=";
+  vendorHash = "sha256-KITZV8U4Hhdg9nXYd83p0joYOXulCsJ0sakiP2Q8gi0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ro/roslyn-ls/deps.json b/pkgs/by-name/ro/roslyn-ls/deps.json
index 891fda20b2a4..88becefb21b4 100644
--- a/pkgs/by-name/ro/roslyn-ls/deps.json
+++ b/pkgs/by-name/ro/roslyn-ls/deps.json
@@ -43,9 +43,9 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Razor.ExternalAccess.RoslynWorkspace",
-    "version": "9.0.0-preview.24555.12",
-    "hash": "sha256-SMOU22F2xZkFM6KRRETeRR79BuVccALMGH+zcgyqq4M=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.aspnetcore.razor.externalaccess.roslynworkspace/9.0.0-preview.24555.12/microsoft.aspnetcore.razor.externalaccess.roslynworkspace.9.0.0-preview.24555.12.nupkg"
+    "version": "9.0.0-preview.25064.4",
+    "hash": "sha256-w6gQZ702lMi2lI/9hIKbeaxW4K42YlDkDnGiD5+cgFo=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.aspnetcore.razor.externalaccess.roslynworkspace/9.0.0-preview.25064.4/microsoft.aspnetcore.razor.externalaccess.roslynworkspace.9.0.0-preview.25064.4.nupkg"
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
@@ -193,9 +193,9 @@
   },
   {
     "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "9.0.0-beta.24572.2",
-    "hash": "sha256-dTYFN1KH3grxcf/On6GLW5WdFliq91Y37DeWDCwiryM=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.24572.2/microsoft.dotnet.arcade.sdk.9.0.0-beta.24572.2.nupkg"
+    "version": "9.0.0-beta.25065.2",
+    "hash": "sha256-8LCKwRGoa0plL1IzZzPR8prayboN7gulS4EC6HWL+5E=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25065.2/microsoft.dotnet.arcade.sdk.9.0.0-beta.25065.2.nupkg"
   },
   {
     "pname": "Microsoft.DotNet.XliffTasks",
diff --git a/pkgs/by-name/ro/roslyn-ls/force-sdk_8_0.patch b/pkgs/by-name/ro/roslyn-ls/force-sdk_8_0.patch
index 21b12177e3d4..a5f75d015089 100644
--- a/pkgs/by-name/ro/roslyn-ls/force-sdk_8_0.patch
+++ b/pkgs/by-name/ro/roslyn-ls/force-sdk_8_0.patch
@@ -1,5 +1,5 @@
 diff --git a/eng/targets/TargetFrameworks.props b/eng/targets/TargetFrameworks.props
-index 2dddaff1560..bc8fd1938d5 100644
+index 58f90114f4d..8eb23c25067 100644
 --- a/eng/targets/TargetFrameworks.props
 +++ b/eng/targets/TargetFrameworks.props
 @@ -17,7 +17,7 @@
@@ -11,10 +11,10 @@ index 2dddaff1560..bc8fd1938d5 100644
      <NetRoslynNext>net9.0</NetRoslynNext>
    </PropertyGroup>
  
-diff --git a/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj b/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
+diff --git a/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj b/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
 index 8101f56b8be..1733955dc3d 100644
---- a/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
-+++ b/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
+--- a/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
++++ b/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
 @@ -28,6 +28,12 @@
      -->
      <_MsbuildVersion>17.3.4</_MsbuildVersion>
@@ -43,3 +43,4 @@ index 8101f56b8be..1733955dc3d 100644
    </ItemGroup>
    <ItemGroup>
      <PackageReference Include="Microsoft.Build.Locator" PrivateAssets="All" />
+
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 689b7002afe0..c690ac2f465e 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -32,18 +32,18 @@ in
 buildDotnetModule rec {
   inherit pname dotnet-sdk dotnet-runtime;
 
-  vsVersion = "2.62.18";
+  vsVersion = "2.64.7";
   src = fetchFromGitHub {
     owner = "dotnet";
     repo = "roslyn";
     rev = "VSCode-CSharp-${vsVersion}";
-    hash = "sha256-oy1xYM6Kd/8uAQQdvsxLNkycs9OOs7SEe+dzYc4RMeM=";
+    hash = "sha256-HWcVb2vpZxZWSxvWYRc91iUNaNGYDGEgKzHtD3yoyXs=";
   };
 
   # versioned independently from vscode-csharp
   # "roslyn" in here:
   # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "4.14.0-1.25060.2";
+  version = "4.14.0-1.25074.7";
   projectFile = "src/LanguageServer/${project}/${project}.csproj";
   useDotnetFromEnv = true;
   nugetDeps = ./deps.json;
diff --git a/pkgs/desktops/xfce/core/xfce4-settings/default.nix b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
index 53b026f8be4d..5e3713dc7393 100644
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@@ -7,6 +7,8 @@
 , gtk-layer-shell
 , glib
 , libnotify
+, libX11
+, libXext
 , libxfce4ui
 , libxfce4util
 , libxklavier
@@ -24,9 +26,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-settings";
-  version = "4.20.0";
+  version = "4.20.1";
 
-  sha256 = "sha256-0fMuAucyxLr2VzQqAB0CL+HgkHNJctiVNZmUmTNzaPc=";
+  sha256 = "sha256-9BFO1cN0etDHJzkGHl5GKL2qzJTlpaP/qfvfz6KWaMI=";
 
   nativeBuildInputs = [
     wayland-scanner
@@ -39,6 +41,8 @@ mkXfceDerivation {
     gtk3
     gtk-layer-shell
     libnotify
+    libX11
+    libXext
     libxfce4ui
     libxfce4util
     libxklavier
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 15b6ca2544e9..b88ba3a60819 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -10,17 +10,20 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.9";
+  version = "1.6.10";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-thpfXCL4kMKZ6TWqz88IcGdpkNiuv/DWzf8HW/F8708=";
+    sha256 = "sha256-A8+sL0lN2Zwlw177CtTTM/JI4y8l9CBPvI8nMb+68OQ=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
 
   dontBuild = true;
 
+  # FIXME: this should be removed after upstream releases the update forcing the use of public_html.
+  dontCheckForBrokenSymlinks = true;
+
   installPhase = ''
     mkdir $out
     cp -r * $out/