diff --git a/doc/hooks/autopatchcil.section.md b/doc/hooks/autopatchcil.section.md
new file mode 100644
index 000000000000..f7ed8cb6835f
--- /dev/null
+++ b/doc/hooks/autopatchcil.section.md
@@ -0,0 +1,17 @@
+# autoPatchcilHook {#setup-hook-autopatchcilhook}
+
+This is a special setup hook which helps in packaging .NET assemblies/programs in that it automatically tries to find missing shared library dependencies of .NET assemblies based on the given `buildInputs` and `nativeBuildInputs`.
+
+As the hook needs information for the host where the package will be run on, there's a required environment variable called `autoPatchcilRuntimeId` which should be filled in with the RID (Runtime Identifier) of the machine where the output will be run on. If you're using `buildDotnetModule`, it will fall back to `dotnetRuntimeIds` (which is set to `lib.singleton (if runtimeId != null then runtimeId else systemToDotnetRid stdenvNoCC.hostPlatform.system)`) for you if not provided.
+
+In certain situations you may want to run the main command (`autoPatchcil`) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the `dontAutoPatchcil` environment variable to a non-empty value.
+
+By default, `autoPatchcil` will fail as soon as any .NET assembly requires a dependency which cannot be resolved via the given build inputs. In some situations you might prefer to just leave missing dependencies unpatched and continue to patch the rest. This can be achieved by setting the `autoPatchcilIgnoreMissingDeps` environment variable to a non-empty value. `autoPatchcilIgnoreMissingDeps` can be set to a list like `autoPatchcilIgnoreMissingDeps = [ "libcuda.so.1" "libcudart.so.1" ];` or to `[ "*" ]` to ignore all missing dependencies.
+
+The `autoPatchcil` command requires the `--rid` command line flag, informing the RID (Runtime Identifier) it should assume the assemblies will be executed on, and also recognizes a `--no-recurse` command line flag, which prevents it from recursing into subdirectories.
+
+::: {.note}
+Since, unlike most native binaries, .NET assemblies are compiled once to run on any platform, many assemblies may have PInvoke stubs for libraries that might not be available on the platform that the package will effectively run on. A few examples are assemblies that call native Windows APIs through PInvoke targeting `kernel32`, `gdi32`, `user32`, `shell32` or `ntdll`.
+
+`autoPatchcil` does its best to ignore dependencies from other platforms by checking the requested file extensions, however not all PInvoke stubs provide an extension so in those cases it will be necessary to list those in `autoPatchcilIgnoreMissingDeps` manually.
+:::
diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index e4b744056c5e..574b7eea8de3 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -7,6 +7,7 @@ The stdenv built-in hooks are documented in [](#ssec-setup-hooks).
 ```{=include=} sections
 autoconf.section.md
 automake.section.md
+autopatchcil.section.md
 autopatchelf.section.md
 aws-c-common.section.md
 bmake.section.md
diff --git a/doc/redirects.json b/doc/redirects.json
index 15cb82504393..4925709c92c6 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -2067,6 +2067,9 @@
   "setup-hook-automake": [
     "index.html#setup-hook-automake"
   ],
+  "setup-hook-autopatchcilhook": [
+    "index.html#setup-hook-autopatchcilhook"
+  ],
   "setup-hook-autopatchelfhook": [
     "index.html#setup-hook-autopatchelfhook"
   ],
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 2f117e12ae18..428adcd4d562 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -68,6 +68,8 @@
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
   The `name` argument will become mandatory in a future release.
 
+- [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`.
+
 - `grafana-agent` and `services.grafana-agent` have been removed in favor of
   Grafana Alloy (`grafana-alloy` and `services.alloy`), as they depend on an EOL compiler version
   and will become EOL during the 25.05 lifecycle.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b1c0fc28f5dd..21d614c6412f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5020,6 +5020,12 @@
     githubId = 6470493;
     name = "Craige McWhirter";
   };
+  craigf = {
+    email = "craig@craigfurman.dev";
+    github = "craigfurman";
+    githubId = 4772216;
+    name = "Craig Furman";
+  };
   cransom = {
     email = "cransom@hubns.net";
     github = "cransom";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 72f1fb1f9a44..bb23782e27d5 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -4,7 +4,7 @@ ansicolors,,,,,,Freed-Wu
 argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
-bit32,,,,5.3.0-1,5.1,lblasc
+bit32,,,,,5.1,lblasc
 busted,,,,,,
 busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 3978772d32d8..470c81ab9794 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -416,6 +416,8 @@
 
 - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.
 
+- `services.homepage-dashboard` now requires the `allowedHosts` option to be set in accordance with the [documentation](https://gethomepage.dev/installation/#homepage_allowed_hosts).
+
 - `services.netbird.tunnels` was renamed to [`services.netbird.clients`](#opt-services.netbird.clients),
   hardened (using dedicated less-privileged users) and significantly extended.
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 238f42652849..1f1317ddcdfe 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1055,6 +1055,8 @@
   ./services/networking/atticd.nix
   ./services/networking/autossh.nix
   ./services/networking/avahi-daemon.nix
+  ./services/networking/ax25/axlisten.nix
+  ./services/networking/ax25/axports.nix
   ./services/networking/babeld.nix
   ./services/networking/bee.nix
   ./services/networking/biboumi.nix
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
index 72861fdbbe87..1a541963187b 100644
--- a/nixos/modules/services/misc/homepage-dashboard.nix
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -4,7 +4,6 @@
   lib,
   ...
 }:
-
 let
   cfg = config.services.homepage-dashboard;
   # Define the settings format used for this program
@@ -29,6 +28,19 @@ in
         description = "Port for Homepage to bind to.";
       };
 
+      allowedHosts = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost:8082,127.0.0.1:8082";
+        example = "example.com";
+        description = ''
+          Hosts that homepage-dashboard will be running under.
+          You will want to change this in order to acess homepage from anything other than localhost.
+          see the upsream documentation:
+
+          <https://gethomepage.dev/installation/#homepage_allowed_hosts>
+        '';
+      };
+
       environmentFile = lib.mkOption {
         type = lib.types.str;
         description = ''
@@ -215,6 +227,7 @@ in
         NIXPKGS_HOMEPAGE_CACHE_DIR = "/var/cache/homepage-dashboard";
         PORT = toString cfg.listenPort;
         LOG_TARGETS = "stdout";
+        HOMEPAGE_ALLOWED_HOSTS = cfg.allowedHosts;
       };
 
       serviceConfig = {
diff --git a/nixos/modules/services/networking/ax25/axlisten.nix b/nixos/modules/services/networking/ax25/axlisten.nix
new file mode 100644
index 000000000000..ad887885c142
--- /dev/null
+++ b/nixos/modules/services/networking/ax25/axlisten.nix
@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    literalExpression
+    ;
+
+  cfg = config.services.ax25.axlisten;
+in
+{
+  options = {
+
+    services.ax25.axlisten = {
+
+      enable = mkEnableOption "AX.25 axlisten daemon";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.ax25-apps;
+        defaultText = literalExpression "pkgs.ax25-apps";
+        description = "The ax25-apps package to use.";
+      };
+
+      config = mkOption {
+        type = types.str;
+        default = "-art";
+        description = ''
+          Options that will be passed to the axlisten daemon.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.axlisten = {
+      description = "AX.25 traffic monitor";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "ax25-axports.target" ];
+      requires = [ "ax25-axports.target" ];
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${cfg.package}/bin/axlisten ${cfg.config}";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/ax25/axports.nix b/nixos/modules/services/networking/ax25/axports.nix
new file mode 100644
index 000000000000..257d7ee8c1c5
--- /dev/null
+++ b/nixos/modules/services/networking/ax25/axports.nix
@@ -0,0 +1,149 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.strings)
+    concatStringsSep
+    optionalString
+    ;
+
+  inherit (lib.attrsets)
+    filterAttrs
+    mapAttrsToList
+    mapAttrs'
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    ;
+
+  cfg = config.services.ax25.axports;
+
+  enabledAxports = filterAttrs (ax25Name: cfg: cfg.enable) cfg;
+
+  axportsOpts = {
+
+    options = {
+      enable = mkEnableOption "Enables the axport interface";
+
+      package = mkPackageOption pkgs "ax25-tools" { };
+
+      tty = mkOption {
+        type = types.str;
+        example = "/dev/ttyACM0";
+        description = ''
+          Location of hardware kiss tnc for this interface.
+        '';
+      };
+
+      callsign = mkOption {
+        type = types.str;
+        example = "WB6WLV-7";
+        description = ''
+          The callsign of the physical interface to bind to.
+        '';
+      };
+
+      description = mkOption {
+        type = types.str;
+        # This cannot be empty since some ax25 tools cant parse /etc/ax25/axports without it
+        default = "NixOS managed tnc";
+        description = ''
+          Free format description of this interface.
+        '';
+      };
+
+      baud = mkOption {
+        type = types.int;
+        example = 57600;
+        description = ''
+          The serial port speed of this interface.
+        '';
+      };
+
+      paclen = mkOption {
+        type = types.int;
+        default = 255;
+        description = ''
+          Default maximum packet size for this interface.
+        '';
+      };
+
+      window = mkOption {
+        type = types.int;
+        default = 7;
+        description = ''
+          Default window size for this interface.
+        '';
+      };
+
+      kissParams = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "-t 300 -l 10 -s 12 -r 80 -f n";
+        description = ''
+          Kissattach parameters for this interface.
+        '';
+      };
+    };
+  };
+in
+{
+
+  options = {
+
+    services.ax25.axports = mkOption {
+      type = types.attrsOf (types.submodule axportsOpts);
+      default = { };
+      description = "Specification of one or more AX.25 ports.";
+    };
+  };
+
+  config = mkIf (enabledAxports != { }) {
+
+    environment.etc."ax25/axports" = {
+      text = concatStringsSep "\n" (
+        mapAttrsToList (
+          portName: portCfg:
+          "${portName} ${portCfg.callsign} ${toString portCfg.baud} ${toString portCfg.paclen} ${toString portCfg.window} ${portCfg.description}"
+        ) enabledAxports
+      );
+      mode = "0644";
+    };
+
+    systemd.targets.ax25-axports = {
+      description = "AX.25 axports group target";
+    };
+
+    systemd.services = mapAttrs' (portName: portCfg: {
+      name = "ax25-kissattach-${portName}";
+      value = {
+        description = "AX.25 KISS attached interface for ${portName}";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "ax25-axports.target" ];
+        partOf = [ "ax25-axports.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${portCfg.package}/bin/kissattach ${portCfg.tty} ${portName}";
+        };
+        postStart = optionalString (portCfg.kissParams != null) ''
+          ${portCfg.package}/bin/kissparms -p ${portName} ${portCfg.kissParams}
+        '';
+      };
+    }) enabledAxports;
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8e83095a7ded..78bc07a59a37 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -213,6 +213,7 @@ in
   atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
+  ax25 = handleTest ./ax25.nix { };
   audiobookshelf = runTest ./audiobookshelf.nix;
   auth-mysql = runTest ./auth-mysql.nix;
   authelia = runTest ./authelia.nix;
@@ -791,7 +792,7 @@ in
   mediatomb = handleTest ./mediatomb.nix { };
   mediawiki = handleTest ./mediawiki.nix { };
   meilisearch = handleTest ./meilisearch.nix { };
-  memcached = handleTest ./memcached.nix { };
+  memcached = runTest ./memcached.nix;
   merecat = handleTest ./merecat.nix { };
   metabase = handleTest ./metabase.nix { };
   mihomo = handleTest ./mihomo.nix { };
@@ -885,7 +886,7 @@ in
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix { };
   nextcloud = handleTest ./nextcloud { };
-  nextflow = handleTestOn [ "x86_64-linux" ] ./nextflow.nix { };
+  nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = handleTest ./nexus.nix { };
   # TODO: Test nfsv3 + Kerberos
@@ -1233,7 +1234,7 @@ in
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
-  static-web-server = handleTest ./web-servers/static-web-server.nix { };
+  static-web-server = runTest ./web-servers/static-web-server.nix;
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
   stratis = handleTest ./stratis { };
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix { };
diff --git a/nixos/tests/ax25.nix b/nixos/tests/ax25.nix
new file mode 100644
index 000000000000..f1092d5de101
--- /dev/null
+++ b/nixos/tests/ax25.nix
@@ -0,0 +1,131 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+
+    baud = 57600;
+    tty = "/dev/ttyACM0";
+    port = "tnc0";
+    socatPort = 1234;
+
+    createAX25Node = nodeId: {
+
+      boot.kernelPackages = pkgs.linuxPackages_ham;
+      boot.kernelModules = [ "ax25" ];
+
+      networking.firewall.allowedTCPPorts = [ socatPort ];
+
+      environment.systemPackages = with pkgs; [
+        libax25
+        ax25-tools
+        ax25-apps
+        socat
+      ];
+
+      services.ax25.axports."${port}" = {
+        inherit baud tty;
+        enable = true;
+        callsign = "NOCALL-${toString nodeId}";
+        description = "mocked tnc";
+      };
+
+      services.ax25.axlisten = {
+        enable = true;
+      };
+
+      # All mocks radios will connect back to socat-broker on node 1 in order to get
+      # all messages that are "broadcasted over the ether"
+      systemd.services.ax25-mock-hardware = {
+        description = "mock AX.25 TNC and Radio";
+        wantedBy = [ "default.target" ];
+        before = [
+          "ax25-kissattach-${port}.service"
+          "axlisten.service"
+        ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${pkgs.socat}/bin/socat -d -d tcp:192.168.1.1:${toString socatPort} pty,link=${tty},b${toString baud},raw";
+        };
+      };
+    };
+  in
+  {
+    name = "ax25Simple";
+    nodes = {
+      node1 = lib.mkMerge [
+        (createAX25Node 1)
+        # mimicking radios on the same frequency
+        {
+          systemd.services.ax25-mock-ether = {
+            description = "mock radio ether";
+            wantedBy = [ "default.target" ];
+            requires = [ "network.target" ];
+            before = [ "ax25-mock-hardware.service" ];
+            # broken needs access to "ss" or "netstat"
+            path = [ pkgs.iproute2 ];
+            serviceConfig = {
+              Type = "exec";
+              ExecStart = "${pkgs.socat}/bin/socat-broker.sh tcp4-listen:${toString socatPort}";
+            };
+            postStart = "${pkgs.coreutils}/bin/sleep 2";
+          };
+        }
+      ];
+      node2 = createAX25Node 2;
+      node3 = createAX25Node 3;
+    };
+    testScript =
+      { ... }:
+      ''
+        def wait_for_machine(m):
+          m.succeed("lsmod | grep ax25")
+          m.wait_for_unit("ax25-axports.target")
+          m.wait_for_unit("axlisten.service")
+          m.fail("journalctl -o cat -u axlisten.service | grep -i \"no AX.25 port data configured\"")
+
+        # start the first node since the socat-broker needs to be running
+        node1.start()
+        node1.wait_for_unit("ax25-mock-ether.service")
+        wait_for_machine(node1)
+
+        node2.start()
+        node3.start()
+        wait_for_machine(node2)
+        wait_for_machine(node3)
+
+        # Node 1 -> Node 2
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-2 ctl I00\" | grep hello")
+
+        # Node 1 -> Node 3
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node2.sleep(5)
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 3
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node3.sleep(5)
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 2
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-2 ctl I00\" | grep hello")
+      '';
+  }
+)
diff --git a/nixos/tests/memcached.nix b/nixos/tests/memcached.nix
index c3f8734e320c..de2d7ab421b6 100644
--- a/nixos/tests/memcached.nix
+++ b/nixos/tests/memcached.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "memcached";
+{ pkgs, ... }:
+{
+  name = "memcached";
 
-    nodes.machine = {
-      imports = [ ../modules/profiles/minimal.nix ];
-      services.memcached.enable = true;
-    };
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    services.memcached.enable = true;
+  };
 
-    testScript =
-      let
-        testScript =
-          pkgs.writers.writePython3 "test_memcache"
-            {
-              libraries = with pkgs.python3Packages; [ memcached ];
-            }
-            ''
-              import memcache
-              c = memcache.Client(['localhost:11211'])
-              c.set('key', 'value')
-              assert 'value' == c.get('key')
-            '';
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("memcached.service")
-        machine.wait_for_open_port(11211)
-        machine.succeed("${testScript}")
-      '';
-  }
-)
+  testScript =
+    let
+      testScript =
+        pkgs.writers.writePython3 "test_memcache"
+          {
+            libraries = [ pkgs.python3Packages.python-memcached ];
+          }
+          ''
+            import memcache
+            c = memcache.Client(['localhost:11211'])
+            c.set('key', 'value')
+            assert 'value' == c.get('key')
+          '';
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("memcached.service")
+      machine.wait_for_open_port(11211)
+      machine.succeed("${testScript}")
+    '';
+}
diff --git a/nixos/tests/nextflow.nix b/nixos/tests/nextflow.nix
index b4aad98483b9..62ce7d3ea571 100644
--- a/nixos/tests/nextflow.nix
+++ b/nixos/tests/nextflow.nix
@@ -1,60 +1,58 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    bash = pkgs.dockerTools.pullImage {
-      imageName = "quay.io/nextflow/bash";
-      imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
-      sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
-      finalImageName = "quay.io/nextflow/bash";
-    };
+{ pkgs, ... }:
+let
+  bash = pkgs.dockerTools.pullImage {
+    imageName = "quay.io/nextflow/bash";
+    imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
+    sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
+    finalImageName = "quay.io/nextflow/bash";
+  };
 
-    hello = pkgs.stdenv.mkDerivation {
-      name = "nextflow-hello";
-      src = pkgs.fetchFromGitHub {
-        owner = "nextflow-io";
-        repo = "hello";
-        rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
-        hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
+  hello = pkgs.stdenv.mkDerivation {
+    name = "nextflow-hello";
+    src = pkgs.fetchFromGitHub {
+      owner = "nextflow-io";
+      repo = "hello";
+      rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
+      hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
+    };
+    installPhase = ''
+      cp -r $src $out
+    '';
+  };
+  run-nextflow-pipeline = pkgs.writeShellApplication {
+    name = "run-nextflow-pipeline";
+    runtimeInputs = [ pkgs.nextflow ];
+    text = ''
+      export NXF_OFFLINE=true
+      for b in false true; do
+        echo "docker.enabled = $b" > nextflow.config
+        cat nextflow.config
+        nextflow run -ansi-log false ${hello}
+      done
+    '';
+  };
+in
+{
+  name = "nextflow";
+
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = [
+        run-nextflow-pipeline
+        pkgs.nextflow
+      ];
+      virtualisation = {
+        docker.enable = true;
       };
-      installPhase = ''
-        cp -r $src $out
-      '';
     };
-    run-nextflow-pipeline = pkgs.writeShellApplication {
-      name = "run-nextflow-pipeline";
-      runtimeInputs = [ pkgs.nextflow ];
-      text = ''
-        export NXF_OFFLINE=true
-        for b in false true; do
-          echo "docker.enabled = $b" > nextflow.config
-          cat nextflow.config
-          nextflow run -ansi-log false ${hello}
-        done
-      '';
-    };
-  in
-  {
-    name = "nextflow";
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = [
-          run-nextflow-pipeline
-          pkgs.nextflow
-        ];
-        virtualisation = {
-          docker.enable = true;
-        };
-      };
-
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("docker.service")
-        machine.succeed("docker load < ${bash}")
-        machine.succeed("run-nextflow-pipeline >&2")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("docker.service")
+      machine.succeed("docker load < ${bash}")
+      machine.succeed("run-nextflow-pipeline >&2")
+    '';
+}
diff --git a/nixos/tests/web-servers/static-web-server.nix b/nixos/tests/web-servers/static-web-server.nix
index 1c88e70a0957..0727b5cba021 100644
--- a/nixos/tests/web-servers/static-web-server.nix
+++ b/nixos/tests/web-servers/static-web-server.nix
@@ -1,41 +1,39 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "static-web-server";
-    meta = {
-      maintainers = with lib.maintainers; [ mac-chaffee ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "static-web-server";
+  meta = {
+    maintainers = with lib.maintainers; [ mac-chaffee ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.static-web-server = {
-          enable = true;
-          listen = "[::]:8080";
-          root = toString (
-            pkgs.writeTextDir "nixos-test.html" ''
-              <h1>Hello NixOS!</h1>
-            ''
-          );
-          configuration = {
-            general = {
-              directory-listing = true;
-            };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.static-web-server = {
+        enable = true;
+        listen = "[::]:8080";
+        root = toString (
+          pkgs.writeTextDir "nixos-test.html" ''
+            <h1>Hello NixOS!</h1>
+          ''
+        );
+        configuration = {
+          general = {
+            directory-listing = true;
           };
         };
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("static-web-server.socket")
-      machine.wait_for_open_port(8080)
-      # We don't use wait_until_succeeds() because we're testing socket
-      # activation which better work on the first request
-      response = machine.succeed("curl -fsS localhost:8080")
-      assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
-      response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
-      assert "Hello NixOS!" in response
-      machine.wait_for_unit("static-web-server.service")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("static-web-server.socket")
+    machine.wait_for_open_port(8080)
+    # We don't use wait_until_succeeds() because we're testing socket
+    # activation which better work on the first request
+    response = machine.succeed("curl -fsS localhost:8080")
+    assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
+    response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
+    assert "Hello NixOS!" in response
+    machine.wait_for_unit("static-web-server.service")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 1784aca034f1..22e88798d1a3 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1204,6 +1204,10 @@ in
   fzf-lua = neovimUtils.buildNeovimPlugin {
     luaAttr = luaPackages.fzf-lua;
     runtimeDeps = [ fzf ];
+    nvimSkipModules = [
+      "fzf-lua.shell_helper"
+      "fzf-lua.spawn"
+    ];
   };
 
   fzf-vim = super.fzf-vim.overrideAttrs {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
index 57e0e3e8b276..cf95ef73c57b 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
@@ -61,7 +61,7 @@ let
 
     if ! nodeVersion=$($serverNode -v); then
       echo "Unable to fix Node binary, quitting"
-      fail_with_exitcode ''${o.InstallExitCode.ServerTransferFailed}
+      fail_with_exitcode ''${f.UnifiedStatusCode.ServerTransferFailed}
     fi
 
     ${lib.optionalString useLocalExtensions ''
diff --git a/pkgs/applications/graphics/gimp/2.0/default.nix b/pkgs/applications/graphics/gimp/2.0/default.nix
new file mode 100644
index 000000000000..1d64cc10806f
--- /dev/null
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@@ -0,0 +1,226 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  replaceVars,
+  autoreconfHook,
+  pkg-config,
+  intltool,
+  babl,
+  gegl,
+  gtk2,
+  glib,
+  gdk-pixbuf,
+  isocodes,
+  pango,
+  cairo,
+  freetype,
+  fontconfig,
+  lcms,
+  libpng,
+  libjpeg,
+  libjxl,
+  poppler,
+  poppler_data,
+  libtiff,
+  libmng,
+  librsvg,
+  libwmf,
+  zlib,
+  libzip,
+  ghostscript,
+  aalib,
+  shared-mime-info,
+  libexif,
+  gettext,
+  makeWrapper,
+  gtk-doc,
+  xorg,
+  glib-networking,
+  libmypaint,
+  gexiv2,
+  harfbuzz,
+  mypaint-brushes1,
+  libwebp,
+  libheif,
+  libxslt,
+  libgudev,
+  openexr,
+  desktopToDarwinBundle,
+  AppKit,
+  Cocoa,
+  gtk-mac-integration-gtk2,
+  withPython ? false,
+  python2,
+}:
+
+let
+  python = python2.withPackages (pp: [ pp.pygtk ]);
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gimp";
+  version = "2.10.38";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
+    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+  };
+
+  patches = [
+    # to remove compiler from the runtime closure, reference was retained via
+    # gimp --version --verbose output
+    (replaceVars ./remove-cc-reference.patch {
+      cc_version = stdenv.cc.cc.name;
+    })
+
+    # Use absolute paths instead of relying on PATH
+    # to make sure plug-ins are loaded by the correct interpreter.
+    ./hardcode-plugin-interpreters.patch
+
+    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
+    # These variables have been removed since libheif 1.18.0
+    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
+    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
+    ./force-enable-libheif.patch
+  ];
+
+  nativeBuildInputs =
+    [
+      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      pkg-config
+      intltool
+      gettext
+      makeWrapper
+      gtk-doc
+      libxslt
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      desktopToDarwinBundle
+    ];
+
+  buildInputs =
+    [
+      babl
+      gegl
+      gtk2
+      glib
+      gdk-pixbuf
+      pango
+      cairo
+      gexiv2
+      harfbuzz
+      isocodes
+      freetype
+      fontconfig
+      lcms
+      libpng
+      libjpeg
+      libjxl
+      poppler
+      poppler_data
+      libtiff
+      openexr
+      libmng
+      librsvg
+      libwmf
+      zlib
+      libzip
+      ghostscript
+      aalib
+      shared-mime-info
+      libwebp
+      libheif
+      libexif
+      xorg.libXpm
+      glib-networking
+      libmypaint
+      mypaint-brushes1
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      AppKit
+      Cocoa
+      gtk-mac-integration-gtk2
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libgudev
+    ]
+    ++ lib.optionals withPython [
+      python
+      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
+      python2.pkgs.pygtk
+    ];
+
+  # needed by gimp-2.0.pc
+  propagatedBuildInputs = [
+    gegl
+  ];
+
+  configureFlags =
+    [
+      "--without-webkit" # old version is required
+      "--disable-check-update"
+      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "--with-icc-directory=/run/current-system/sw/share/color/icc"
+      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
+      "--libdir=\${exec_prefix}/lib"
+    ]
+    ++ lib.optionals (!withPython) [
+      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [ ]
+      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
+    );
+
+    # Check if librsvg was built with --disable-pixbuf-loader.
+    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+  };
+
+  preConfigure = ''
+    # The check runs before glib-networking is registered
+    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+  '';
+
+  passthru = {
+    # The declarations for `gimp-with-plugins` wrapper,
+    # used for determining plug-in installation paths
+    majorVersion = "${lib.versions.major finalAttrs.version}.0";
+    targetLibDir = "lib/gimp/${finalAttrs.passthru.majorVersion}";
+    targetDataDir = "share/gimp/${finalAttrs.passthru.majorVersion}";
+    targetPluginDir = "${finalAttrs.passthru.targetLibDir}/plug-ins";
+    targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
+
+    # probably its a good idea to use the same gtk in plugins ?
+    gtk = gtk2;
+
+    python2Support = withPython;
+  };
+
+  meta = with lib; {
+    description = "GNU Image Manipulation Program";
+    homepage = "https://www.gimp.org/";
+    maintainers = with maintainers; [ ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    mainProgram = "gimp";
+  };
+})
diff --git a/pkgs/applications/graphics/gimp/force-enable-libheif.patch b/pkgs/applications/graphics/gimp/2.0/force-enable-libheif.patch
similarity index 100%
rename from pkgs/applications/graphics/gimp/force-enable-libheif.patch
rename to pkgs/applications/graphics/gimp/2.0/force-enable-libheif.patch
diff --git a/pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch b/pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch
new file mode 100644
index 000000000000..1528404c31d2
--- /dev/null
+++ b/pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch
@@ -0,0 +1,11 @@
+--- a/plug-ins/pygimp/Makefile.am
++++ b/plug-ins/pygimp/Makefile.am
+@@ -157,7 +157,7 @@ install-interp-file:
+ 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
+ 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+ 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+-	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
++	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
+ 
+ install-data-local: install-env-file install-interp-file
+ 
diff --git a/pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch b/pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch
new file mode 100644
index 000000000000..20c350bdaea1
--- /dev/null
+++ b/pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch
@@ -0,0 +1,13 @@
+diff --git a/app/gimp-version.c b/app/gimp-version.c
+index 3d1894a036..48bb670b64 100644
+--- a/app/gimp-version.c
++++ b/app/gimp-version.c
+@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+                                       GIMP_BUILD_ID,
+                                       gimp_version_get_revision (),
+                                       GIMP_BUILD_PLATFORM_FAMILY,
+-                                      CC_VERSION,
++                                      "@cc_version@",
+                                       lib_versions);
+       g_free (lib_versions);
+ 
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index e5e552f299f9..0b2406c89f8b 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -3,21 +3,27 @@
   lib,
   fetchurl,
   replaceVars,
-  autoreconfHook,
+  meson,
+  ninja,
   pkg-config,
-  intltool,
   babl,
+  cfitsio,
   gegl,
-  gtk2,
+  gtk3,
   glib,
   gdk-pixbuf,
+  graphviz,
   isocodes,
   pango,
   cairo,
+  libarchive,
+  luajit,
   freetype,
   fontconfig,
   lcms,
   libpng,
+  libiff,
+  libilbm,
   libjpeg,
   libjxl,
   poppler,
@@ -31,44 +37,59 @@
   ghostscript,
   aalib,
   shared-mime-info,
+  python3,
   libexif,
   gettext,
-  makeWrapper,
-  gtk-doc,
+  wrapGAppsHook3,
+  libxslt,
+  gobject-introspection,
+  vala,
+  gi-docgen,
+  perl,
+  appstream-glib,
+  desktop-file-utils,
   xorg,
   glib-networking,
+  json-glib,
   libmypaint,
+  llvmPackages,
   gexiv2,
   harfbuzz,
   mypaint-brushes1,
   libwebp,
   libheif,
-  libxslt,
+  gjs,
   libgudev,
   openexr,
+  xvfb-run,
+  dbus,
+  adwaita-icon-theme,
+  alsa-lib,
   desktopToDarwinBundle,
   AppKit,
   Cocoa,
-  gtk-mac-integration-gtk2,
-  withPython ? false,
-  python2,
 }:
 
 let
-  python = python2.withPackages (pp: [ pp.pygtk ]);
+  python = python3.withPackages (
+    pp: with pp; [
+      pygobject3
+    ]
+  );
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "2.10.38";
+  version = "3.0.2";
 
   outputs = [
     "out"
     "dev"
+    "devdoc"
   ];
 
   src = fetchurl {
-    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
   };
 
   patches = [
@@ -80,26 +101,40 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Use absolute paths instead of relying on PATH
     # to make sure plug-ins are loaded by the correct interpreter.
-    ./hardcode-plugin-interpreters.patch
+    # TODO: This now only appears to be used on Windows.
+    (replaceVars ./hardcode-plugin-interpreters.patch {
+      python_interpreter = python.interpreter;
+      PYTHON_EXE = null;
+    })
 
-    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
-    # These variables have been removed since libheif 1.18.0
-    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
-    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
-    ./force-enable-libheif.patch
+    # D-Bus configuration is not available in the build sandbox
+    # so we need to pick up the one from the package.
+    (replaceVars ./tests-dbus-conf.patch {
+      session_conf = "${dbus.out}/share/dbus-1/session.conf";
+    })
   ];
 
   nativeBuildInputs =
     [
-      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      meson
+      ninja
       pkg-config
-      intltool
       gettext
-      makeWrapper
-      gtk-doc
-      libxslt
+      wrapGAppsHook3
+      libxslt # for xsltproc
+      gobject-introspection
+      perl
+      vala
+
+      # for docs
+      gi-docgen
+
+      # for tests
+      desktop-file-utils
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      dbus
+      xvfb-run
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       desktopToDarwinBundle
@@ -107,13 +142,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
+      appstream-glib # for library
       babl
+      cfitsio
       gegl
-      gtk2
+      gtk3
       glib
       gdk-pixbuf
       pango
       cairo
+      libarchive
       gexiv2
       harfbuzz
       isocodes
@@ -121,6 +159,8 @@ stdenv.mkDerivation (finalAttrs: {
       fontconfig
       lcms
       libpng
+      libiff
+      libilbm
       libjpeg
       libjxl
       poppler
@@ -135,69 +175,137 @@ stdenv.mkDerivation (finalAttrs: {
       ghostscript
       aalib
       shared-mime-info
+      json-glib
       libwebp
       libheif
+      python
       libexif
       xorg.libXpm
+      xorg.libXmu
       glib-networking
       libmypaint
       mypaint-brushes1
+
+      # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
+      adwaita-icon-theme
+
+      # for Lua plug-ins
+      (luajit.withPackages (pp: [
+        pp.lgi
+      ]))
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+
+      # for JavaScript plug-ins
+      gjs
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.openmp
       AppKit
       Cocoa
-      gtk-mac-integration-gtk2
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libgudev
-    ]
-    ++ lib.optionals withPython [
-      python
-      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
-      python2.pkgs.pygtk
     ];
 
-  # needed by gimp-2.0.pc
   propagatedBuildInputs = [
+    # needed by gimp-3.0.pc
     gegl
+    cairo
+    pango
+    gexiv2
   ];
 
-  configureFlags =
+  mesonFlags =
     [
-      "--without-webkit" # old version is required
-      "--disable-check-update"
-      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
-      "--with-icc-directory=/run/current-system/sw/share/color/icc"
-      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
-      "--libdir=\${exec_prefix}/lib"
+      "-Dbug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "-Dicc-directory=/run/current-system/sw/share/color/icc"
+      "-Dcheck-update=no"
+      (lib.mesonEnable "gudev" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "headless-tests" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "linux-input" stdenv.hostPlatform.isLinux)
+      # Not very important to do downstream, save a dependency.
+      "-Dappdata-test=disabled"
     ]
-    ++ lib.optionals (!withPython) [
-      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-Dalsa=disabled"
+      "-Djavascript=disabled"
     ];
 
-  enableParallelBuilding = true;
-
   doCheck = true;
 
   env = {
-    NIX_CFLAGS_COMPILE = toString (
-      [ ]
-      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
-    );
+    # The check runs before glib-networking is registered
+    GIO_EXTRA_MODULES = "${glib-networking}/lib/gio/modules";
+
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-DGDK_OSX_BIG_SUR=16";
 
     # Check if librsvg was built with --disable-pixbuf-loader.
     PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
   };
 
-  preConfigure = ''
-    # The check runs before glib-networking is registered
-    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  postPatch = ''
+    patchShebangs \
+      app/tests/create_test_env.sh \
+      tools/gimp-mkenums
+
+    # GIMP is executed at build time so we need to fix this.
+    # TODO: Look into if we can fix the interp thing.
+    chmod +x plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+    patchShebangs \
+      plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+  '';
+
+  preBuild =
+    let
+      librarySuffix =
+        if stdenv.hostPlatform.extensions.library == ".so" then
+          "3.0.so.0"
+        else if stdenv.hostPlatform.extensions.library == ".dylib" then
+          "3.0.0.dylib"
+        else
+          throw "Unsupported library extension ‘${stdenv.hostPlatform.extensions.library}’";
+    in
+    ''
+      # Our gobject-introspection patches make the shared library paths absolute
+      # in the GIR files. When running GIMP in build or check phase, it will try
+      # to use plug-ins, which import GIMP introspection files which will try
+      # to load the GIMP libraries which will not be installed yet.
+      # So we need to replace the absolute path with a local one.
+      # We are using a symlink that will be overridden during installation.
+      mkdir -p "$out/lib"
+      ln -s "$PWD/libgimp/libgimp-${librarySuffix}" \
+        "$PWD/libgimpbase/libgimpbase-${librarySuffix}" \
+        "$PWD/libgimpcolor/libgimpcolor-${librarySuffix}" \
+        "$PWD/libgimpconfig/libgimpconfig-${librarySuffix}" \
+        "$PWD/libgimpmath/libgimpmath-${librarySuffix}" \
+        "$PWD/libgimpmodule/libgimpmodule-${librarySuffix}" \
+        "$out/lib/"
+    '';
+
+  preCheck = ''
+    # Avoid “Error retrieving accessibility bus address”
+    export NO_AT_BRIDGE=1
+    # Fix storing recent file list in tests
+    export HOME="$TMPDIR"
+    export XDG_DATA_DIRS="${glib.getSchemaDataDirPath gtk3}:${adwaita-icon-theme}/share:$XDG_DATA_DIRS"
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${
+      lib.makeBinPath [
+        # for dot for gegl:introspect (Debug » Show Image Graph, hidden by default on stable release)
+        graphviz
+        # for gimp-script-fu-interpreter-3.0 invoked by shebang of some plug-ins
+        "$out"
+      ]
+    }")
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
   '';
 
   passthru = {
@@ -210,9 +318,7 @@ stdenv.mkDerivation (finalAttrs: {
     targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
 
     # probably its a good idea to use the same gtk in plugins ?
-    gtk = gtk2;
-
-    python2Support = withPython;
+    gtk = gtk3;
   };
 
   meta = with lib; {
@@ -220,7 +326,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.gimp.org/";
     maintainers = with maintainers; [ jtojnar ];
     license = licenses.gpl3Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     mainProgram = "gimp";
   };
 })
diff --git a/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch b/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch
index 1528404c31d2..6a0ec0af6262 100644
--- a/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch
+++ b/pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch
@@ -1,11 +1,8 @@
---- a/plug-ins/pygimp/Makefile.am
-+++ b/plug-ins/pygimp/Makefile.am
-@@ -157,7 +157,7 @@ install-interp-file:
- 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
- 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
- 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
--	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
-+	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
- 
- install-data-local: install-env-file install-interp-file
- 
+--- a/plug-ins/python/pygimp.interp.in
++++ b/plug-ins/python/pygimp.interp.in
+@@ -2,4 +2,4 @@ python=@PYTHON_EXE@
+ python3=@PYTHON_EXE@
+ /usr/bin/python=@PYTHON_EXE@
+ /usr/bin/python3=@PYTHON_EXE@
+-:Python:E::py::python3:
++:Python:E::py::@python_interpreter@:
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index b237c5f1bcf1..9c86343599b1 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -2,7 +2,11 @@
 # If you just want a subset of plug-ins, you can specify them explicitly:
 # `gimp-with-plugins.override { plugins = with gimpPlugins; [ gap ]; }`.
 
-{ lib, pkgs }:
+{
+  lib,
+  pkgs,
+  gimp,
+}:
 
 let
   inherit (pkgs)
@@ -16,6 +20,10 @@ let
     fetchFromGitHub
     fetchFromGitLab
     ;
+
+  # We cannot use gimp from the arguments directly, or it would be shadowed by the one
+  # from scope when initializing the scope with it, leading to infinite recursion.
+  gimpArg = gimp;
 in
 
 lib.makeScope pkgs.newScope (
@@ -29,6 +37,7 @@ lib.makeScope pkgs.newScope (
       attrs:
       let
         name = attrs.name or "${attrs.pname}-${attrs.version}";
+        pkgConfigMajorVersion = lib.versions.major gimp.version;
       in
       stdenv.mkDerivation (
         {
@@ -63,8 +72,10 @@ lib.makeScope pkgs.newScope (
 
           # Override installation paths.
           env = {
-            PKG_CONFIG_GIMP_2_0_GIMPLIBDIR = "${placeholder "out"}/${gimp.targetLibDir}";
-            PKG_CONFIG_GIMP_2_0_GIMPDATADIR = "${placeholder "out"}/${gimp.targetDataDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPLIBDIR" =
+              "${placeholder "out"}/${gimp.targetLibDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPDATADIR" =
+              "${placeholder "out"}/${gimp.targetDataDir}";
           } // attrs.env or { };
         }
       );
@@ -86,7 +97,7 @@ lib.makeScope pkgs.newScope (
   in
   {
     # Allow overriding GIMP package in the scope.
-    inherit (pkgs) gimp;
+    gimp = gimpArg;
 
     bimp = pluginDerivation rec {
       /*
@@ -130,6 +141,7 @@ lib.makeScope pkgs.newScope (
       installTargets = [ "install-admin" ];
 
       meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
         description = "Batch Image Manipulation Plugin for GIMP";
         homepage = "https://github.com/alessandrofrancesconi/gimp-plugin-bimp";
         license = licenses.gpl2Plus;
@@ -153,6 +165,7 @@ lib.makeScope pkgs.newScope (
       '';
 
       meta = {
+        broken = gimp.majorVersion != "2.0";
         description = "Gimp plug-in for the farbfeld image format";
         homepage = "https://github.com/ids1024/gimp-farbfeld";
         license = lib.licenses.mit;
@@ -192,6 +205,7 @@ lib.makeScope pkgs.newScope (
       '';
 
       meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
         description = "GIMP plug-in to do the fourier transform";
         homepage = "https://people.via.ecp.fr/~remi/soft/gimp/gimp_plugin_en.php3#fourier";
         license = with licenses; [ gpl3Plus ];
@@ -222,7 +236,7 @@ lib.makeScope pkgs.newScope (
       };
 
       meta = {
-        broken = !gimp.python2Support;
+        broken = gimp.majorVersion != "2.0";
       };
     };
 
@@ -240,6 +254,10 @@ lib.makeScope pkgs.newScope (
         ninja
         gettext
       ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     waveletSharpen = pluginDerivation {
@@ -264,6 +282,10 @@ lib.makeScope pkgs.newScope (
       };
 
       installPhase = "installPlugin src/wavelet-sharpen"; # TODO translations are not copied .. How to do this on nix?
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     lqrPlugin = pluginDerivation rec {
@@ -289,10 +311,15 @@ lib.makeScope pkgs.newScope (
           sha256 = "EdjZWM6U1bhUmsOnLA8iJ4SFKuAXHIfNPzxZqel+JrY=";
         })
       ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     gmic = pkgs.gmic-qt.override {
       variant = "gimp";
+      inherit (self) gimp;
     };
 
     gimplensfun = pluginDerivation {
@@ -320,6 +347,7 @@ lib.makeScope pkgs.newScope (
     ";
 
       meta = {
+        broken = gimp.majorVersion != "2.0";
         description = "GIMP plugin to correct lens distortion using the lensfun library and database";
 
         homepage = "http://lensfun.sebastiankraft.net/";
diff --git a/pkgs/applications/graphics/gimp/remove-cc-reference.patch b/pkgs/applications/graphics/gimp/remove-cc-reference.patch
index 20c350bdaea1..8b62b801f02b 100644
--- a/pkgs/applications/graphics/gimp/remove-cc-reference.patch
+++ b/pkgs/applications/graphics/gimp/remove-cc-reference.patch
@@ -1,8 +1,8 @@
 diff --git a/app/gimp-version.c b/app/gimp-version.c
-index 3d1894a036..48bb670b64 100644
+index 6e311c8252..e6fd9d1d78 100644
 --- a/app/gimp-version.c
 +++ b/app/gimp-version.c
-@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+@@ -90,7 +90,7 @@ gimp_version (gboolean be_verbose,
                                        GIMP_BUILD_ID,
                                        gimp_version_get_revision (),
                                        GIMP_BUILD_PLATFORM_FAMILY,
diff --git a/pkgs/applications/graphics/gimp/tests-dbus-conf.patch b/pkgs/applications/graphics/gimp/tests-dbus-conf.patch
new file mode 100644
index 000000000000..da9152eeef01
--- /dev/null
+++ b/pkgs/applications/graphics/gimp/tests-dbus-conf.patch
@@ -0,0 +1,11 @@
+--- a/build/meson/run_test_env.sh
++++ b/build/meson/run_test_env.sh
+@@ -33,7 +33,7 @@ if [ -n "${UI_TEST}" ]; then
+     OPT="--auto-servernum"
+   fi
+   xvfb-run $OPT --server-args="-screen 0 1280x1024x24" \
+-    dbus-run-session -- "$@"
++    dbus-run-session --config-file="@session_conf@" -- "$@"
+ 
+ else
+   # Run the executable directly,
diff --git a/pkgs/applications/graphics/gimp/wrapper.nix b/pkgs/applications/graphics/gimp/wrapper.nix
index 82ff058ba7dc..efac48c2f7e2 100644
--- a/pkgs/applications/graphics/gimp/wrapper.nix
+++ b/pkgs/applications/graphics/gimp/wrapper.nix
@@ -13,8 +13,14 @@ let
     lib.attrValues gimpPlugins
   );
   selectedPlugins = lib.filter (pkg: pkg != gimp) (if plugins == null then allPlugins else plugins);
-  extraArgs = map (x: x.wrapArgs or "") selectedPlugins;
-  versionBranch = lib.versions.majorMinor gimp.version;
+  extraArgs =
+    map (x: x.wrapArgs or "") selectedPlugins
+    ++ lib.optionals (gimp.majorVersion == "2.0") [
+      ''--prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0"''
+    ];
+  exeVersion =
+    if gimp.majorVersion == "2.0" then lib.versions.majorMinor gimp.version else gimp.majorVersion;
+  majorVersion = lib.versions.major gimp.version;
 
 in
 symlinkJoin {
@@ -25,16 +31,15 @@ symlinkJoin {
   nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
-    for each in gimp-${versionBranch} gimp-console-${versionBranch}; do
+    for each in gimp-${exeVersion} gimp-console-${exeVersion}; do
       wrapProgram $out/bin/$each \
-        --set GIMP2_PLUGINDIR "$out/lib/gimp/2.0" \
-        --set GIMP2_DATADIR "$out/share/gimp/2.0" \
-        --prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0" \
+        --set GIMP${majorVersion}_PLUGINDIR "$out/${gimp.targetLibDir}" \
+        --set GIMP${majorVersion}_DATADIR "$out/${gimp.targetDataDir}" \
         ${toString extraArgs}
     done
     set +x
     for each in gimp gimp-console; do
-      ln -sf "$each-${versionBranch}" $out/bin/$each
+      ln -sf "$each-${exeVersion}" $out/bin/$each
     done
   '';
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index bc38c109d23a..d3a5de070330 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "135.0.7049.84",
+    "version": "135.0.7049.95",
     "chromedriver": {
-      "version": "135.0.7049.85",
-      "hash_darwin": "sha256-L4x/MSCbVt2UIQwbHREDV8br6DmdfuqTJ3//7opK2IU=",
-      "hash_darwin_aarch64": "sha256-vixXGqbc2UYpydg1RILhrtmr5DdbJ5I1sD8aNikejQU="
+      "version": "135.0.7049.96",
+      "hash_darwin": "sha256-MmL/hQGPk/kGBtbXSekE+lHktucPCv3HFr8VYTnff5w=",
+      "hash_darwin_aarch64": "sha256-TGiVrAYgeLGniGBZ2dHUBk6Hg996ouBSJHZm9hXExQ4="
     },
     "deps": {
       "depot_tools": {
@@ -20,8 +20,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "6c019e56001911b3fd467e03bf68c435924d62f4",
-        "hash": "sha256-BFw1o2cIHBeBudeigH6YTOuLGsp/+pTOeE1lXBO3aio=",
+        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
+        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -566,8 +566,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
-        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
+        "rev": "2919d07ee57020e3e4b66cce45c61104d80304d2",
+        "hash": "sha256-zE6a0R8NZ3SE0bHwPan3dTh5kmq5JmYTbDQIvyNICeg="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
@@ -616,8 +616,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e445bdea696eb6b6a46681dfc1a63edaa517edb",
-        "hash": "sha256-mSup6nKsEPjJ/HBV7PwjBI4PP7/RdwFm/dnavKeRqzI="
+        "rev": "5a44cdd70f04aa65fa063caa1a7e3028d75236f8",
+        "hash": "sha256-QX3b+S0IuxJKmlMudL6420+bXRhDkWYC7GNRKxKNm8A="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
diff --git a/pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh b/pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh
new file mode 100644
index 000000000000..898ad68cb969
--- /dev/null
+++ b/pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh
@@ -0,0 +1,118 @@
+#!@shell@
+# shellcheck shell=bash
+
+declare -a autoPatchcilLibs
+declare -a extraAutoPatchcilLibs
+
+gatherLibraries() {
+    if [ -d "$1/lib" ]; then
+        autoPatchcilLibs+=("$1/lib")
+    fi
+}
+
+addEnvHooks "${targetOffset:?}" gatherLibraries
+
+# Can be used to manually add additional directories with shared object files
+# to be included for the next autoPatchcil invocation.
+addAutoPatchcilSearchPath() {
+    local -a findOpts=()
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --no-recurse)
+            shift
+            findOpts+=("-maxdepth" 1)
+            ;;
+        --*)
+            echo "addAutoPatchcilSearchPath: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchcilLibs+=("$dir")
+    done < <(
+        find "$@" "${findOpts[@]}" \! -type d \
+            \( -name '*.so' -o -name '*.so.*' \) -print0 |
+            sed -z 's#/[^/]*$##' |
+            uniq -z
+    )
+}
+
+autoPatchcil() {
+    local rid=
+    local norecurse=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --rid)
+            rid="$2"
+            shift 2
+            ;;
+        --no-recurse)
+            shift
+            norecurse=1
+            ;;
+        --*)
+            echo "autoPatchcil: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    if [ -z "$rid" ]; then
+        echo "autoPatchcil: ERROR: No RID (Runtime ID) provided." >&2
+        return 1
+    fi
+
+    local ignoreMissingDepsArray=("--ignore-missing")
+    concatTo ignoreMissingDepsArray autoPatchcilIgnoreMissingDeps
+
+    if [ ${#ignoreMissingDepsArray[@]} -lt 2 ]; then
+        ignoreMissingDepsArray=()
+    fi
+
+    local autoPatchcilFlags=(
+        ${norecurse:+--no-recurse}
+        --rid "$rid"
+        "${ignoreMissingDepsArray[@]}"
+        --paths "$@"
+        --libs "${autoPatchcilLibs[@]}"
+    )
+
+    # shellcheck disable=SC2016
+    echoCmd 'patchcil auto flags' "${autoPatchcilFlags[@]}"
+    @patchcil@ auto "${autoPatchcilFlags[@]}"
+}
+
+autoPatchcilFixupOutput() {
+    if [[ -z "${dontAutoPatchcil-}" ]]; then
+        if [ -n "${dotnetRuntimeIds+x}" ]; then
+            if [[ -n $__structuredAttrs ]]; then
+                local dotnetRuntimeIdsArray=("${dotnetRuntimeIds[@]}")
+            else
+                # shellcheck disable=SC2206 # Intentionally expanding it to preserve old behavior
+                local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
+            fi
+        else
+            local dotnetRuntimeIdsArray=("")
+        fi
+
+        autoPatchcil --rid "${autoPatchcilRuntimeId:-${dotnetRuntimeIdsArray[0]}}" -- "${prefix:?}"
+    fi
+}
+
+fixupOutputHooks+=(autoPatchcilFixupOutput)
diff --git a/pkgs/build-support/dotnet/auto-patchcil-hook/default.nix b/pkgs/build-support/dotnet/auto-patchcil-hook/default.nix
new file mode 100644
index 000000000000..cbe9105e6115
--- /dev/null
+++ b/pkgs/build-support/dotnet/auto-patchcil-hook/default.nix
@@ -0,0 +1,14 @@
+{
+  lib,
+  bash,
+  patchcil,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "auto-patchcil-hook";
+  substitutions = {
+    shell = lib.getExe bash;
+    patchcil = lib.getExe patchcil;
+  };
+} ./auto-patchcil.sh
diff --git a/pkgs/by-name/au/autokbisw/nix/default.nix b/pkgs/by-name/au/autokbisw/nix/default.nix
new file mode 100644
index 000000000000..ef16085c27f5
--- /dev/null
+++ b/pkgs/by-name/au/autokbisw/nix/default.nix
@@ -0,0 +1,7 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "sha256-FSIi4jDX7R35jDHkKzQFJLl4K0Hdx9UWgwxJbHVpsYU=";
+  };
+}
diff --git a/pkgs/by-name/au/autokbisw/nix/workspace-state.json b/pkgs/by-name/au/autokbisw/nix/workspace-state.json
new file mode 100644
index 000000000000..67db53fa95f3
--- /dev/null
+++ b/pkgs/by-name/au/autokbisw/nix/workspace-state.json
@@ -0,0 +1,25 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e1465042f195f374b94f915ba8ca49de24300a0d",
+            "version": "1.0.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      }
+    ]
+  },
+  "version": 6
+}
diff --git a/pkgs/by-name/au/autokbisw/package.nix b/pkgs/by-name/au/autokbisw/package.nix
new file mode 100644
index 000000000000..76b601b2ae24
--- /dev/null
+++ b/pkgs/by-name/au/autokbisw/package.nix
@@ -0,0 +1,45 @@
+{
+  fetchFromGitHub,
+  lib,
+  swift,
+  swiftPackages,
+  swiftpm,
+  swiftpm2nix,
+}:
+let
+  # Nix dir generated by running `swiftpm2nix` in the upstream project
+  generated = swiftpm2nix.helpers ./nix;
+in
+swiftPackages.stdenv.mkDerivation rec {
+  pname = "autokbisw";
+  version = "2.0.1";
+  src = fetchFromGitHub {
+    owner = "ohueter";
+    repo = "autokbisw";
+    tag = version;
+    hash = "sha256-xNXXgDLWW8pdik3STmhpZATf9REd+8IGeoX/oxGg4vc=";
+  };
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+  configurePhase = generated.configure;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $(swiftpmBinPath)/autokbisw $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Automatic keyboard input language switching for macOS";
+    homepage = "https://github.com/ohueter/autokbisw";
+    changelog = "https://github.com/ohueter/autokbisw/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    mainProgram = "autokbisw";
+    maintainers = with lib.maintainers; [ craigf ];
+    platforms = lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/ba/babl/package.nix b/pkgs/by-name/ba/babl/package.nix
index bfccb384280f..e99f319fb7e5 100644
--- a/pkgs/by-name/ba/babl/package.nix
+++ b/pkgs/by-name/ba/babl/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "babl";
-  version = "0.1.110";
+  version = "0.1.112";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v0e+dUDWJ1OJ9mQx7wMGTfU3YxXiQ9C6tEjGqnE/V0M=";
+    hash = "sha256-+2lmgkIXh8j+zIPoqrSBId7I7jjRGbZSkc/L4xUCink=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cr/cryptomator/package.nix b/pkgs/by-name/cr/cryptomator/package.nix
index 800c57d798c6..dec64a4a3229 100644
--- a/pkgs/by-name/cr/cryptomator/package.nix
+++ b/pkgs/by-name/cr/cryptomator/package.nix
@@ -17,18 +17,18 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "cryptomator";
-  version = "1.15.2";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "cryptomator";
     repo = "cryptomator";
     tag = version;
-    hash = "sha256-uhsX4VIA8NNUjxa0dHyB5bhWMxjd2LJfcKJInxROQRY=";
+    hash = "sha256-3HGSeTUzfcXuNFxPuhkQBQ8CTEvgrNjpFtqOuluCeRs=";
   };
 
   mvnJdk = jdk;
   mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-KfQdYsPdmQRQqjx/kpDQR9tYjb54goA31w55x6VX6KM=";
+  mvnHash = "sha256-vC2ULlBm/170ElcQC898N4kmWfuWwb7hFpF1oMIukyQ=";
 
   preBuild = ''
     VERSION=${version}
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 38b949855124..068712cd7a11 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -26,7 +26,7 @@ let
     doInstallCheck = false;
   });
 
-  version = "1.5";
+  version = "1.5.1";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-bJlcIFcEhobOiaJsxub48fR8nIZDU4QK4FIycmDW2mk=";
+    hash = "sha256-ybqhaIuv8OU0f14Rr+1ilxE4iTCnguXi/60g4ys6JOI=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/en/envoy-bin/package.nix b/pkgs/by-name/en/envoy-bin/package.nix
index 9379db80d7ad..2fe4094532cf 100644
--- a/pkgs/by-name/en/envoy-bin/package.nix
+++ b/pkgs/by-name/en/envoy-bin/package.nix
@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.33.2";
+  version = "1.34.0";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-gew2iaghIu/wymgMSBdvTTUbb5iBp5zJ2QeKb7Swtqg=";
-      x86_64-linux = "sha256-vS/4fF78lf14gNcQkV9XPBqrTZxV2NqIbc2R30P610E=";
+      aarch64-linux = "sha256-VVEYQ25ZNmWftuhLOOZnxKaosQFeMHsQdkAzIq+zEM0=";
+      x86_64-linux = "sha256-FavpvY1hYNOnlFQE2NV3O8z9gyKGpD01oU/wute9iRA=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix
index cded6b78595c..af8206fd4f33 100644
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "gallery-dl";
-  version = "1.29.3";
+  version = "1.29.4";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-LzMiJxMl6IWtUloWxBAMLvkhnTQpHkz/gjWl5gW2sZ0=";
+    hash = "sha256-dQK1AWmdlfb1cRcYzXWUsXmRgjQRc++zEHZvLUygMwg=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 54b9f6261972..23b59aeb52b8 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -48,14 +48,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.3";
+  version = "3.16.4";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-4Pbyv+EAgwjabVJ4oW3jSmi0Rzpe+BxCN8mM5/beEco=";
+    hash = "sha256-2AxqvZA1eZaJFKMfRljCIcP0M2nMngw0FQiXsfBW7IA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gm/gmic-qt/package.nix b/pkgs/by-name/gm/gmic-qt/package.nix
index 4a07ba02bcef..629097841c03 100644
--- a/pkgs/by-name/gm/gmic-qt/package.nix
+++ b/pkgs/by-name/gm/gmic-qt/package.nix
@@ -100,7 +100,14 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_DYNAMIC_LINKING" true)
     (lib.cmakeBool "ENABLE_SYSTEM_GMIC" true)
-    (lib.cmakeFeature "GMIC_QT_HOST" (if variant == "standalone" then "none" else variant))
+    (lib.cmakeFeature "GMIC_QT_HOST" (
+      if variant == "standalone" then
+        "none"
+      else if variant == "gimp" && gimp.majorVersion == "3.0" then
+        "gimp3"
+      else
+        variant
+    ))
   ];
 
   postFixup = lib.optionalString (variant == "gimp") ''
diff --git a/pkgs/by-name/go/gofumpt/package.nix b/pkgs/by-name/go/gofumpt/package.nix
index 12435ba1918d..7d9248cf9d73 100644
--- a/pkgs/by-name/go/gofumpt/package.nix
+++ b/pkgs/by-name/go/gofumpt/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "gofumpt";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mJM0uKztX0OUQvynnxeKL9yft7X/Eh28ERg8SbZC5Ws=";
+    hash = "sha256-37wYYB0k8mhQq30y1oo77qW3bIqqN/K/NG1RgxK6dyI=";
   };
 
-  vendorHash = "sha256-kJysyxROvB0eMAHbvNF+VXatEicn4ln2Vqkzp7GDWAQ=";
+  vendorHash = "sha256-T6/xEXv8+io3XwQ2keacpYYIdTnYhTTUCojf62tTwbA=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index 4d1517f03fc9..039deb97ab33 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -7,16 +7,16 @@
 
 buildGo124Module rec {
   pname = "golangci-lint";
-  version = "2.0.2";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-+IndC9znKgVGiFWW0aCNjhxPwX1kDFnfG2+SKEQ15Rc=";
+    hash = "sha256-CAO+oo3l3mlZIiC1Srhc0EfZffQOHvVkamPHzSKRSFw=";
   };
 
-  vendorHash = "sha256-B6mCvJtIfRbAv6fZ8Ge82nT9oEcL3WR4D+AAVs9R3zM=";
+  vendorHash = "sha256-2GQp/sgYRlDengx8uy3zzqi9hwHh4CQUHoj1zaxNNLE=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch b/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch
new file mode 100644
index 000000000000..2ddbeb767705
--- /dev/null
+++ b/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch
@@ -0,0 +1,56 @@
+diff --git a/src/main.c b/src/main.c
+index d16a7f7..2c596e9 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -125,7 +125,7 @@ static gint        grig_app_delete     (GtkWidget *, GdkEvent *, gpointer);
+ static void        grig_app_destroy    (GtkWidget *, gpointer);
+ static void        grig_show_help      (void);
+ static void        grig_show_version   (void);
+-static gint        grig_list_add       (const struct rig_caps *, void *);
++static gint        grig_list_add       (struct rig_caps *, void *);
+ static gint        grig_list_compare   (gconstpointer, gconstpointer);
+ static void        grig_sig_handler    (int sig);
+ 
+@@ -729,7 +729,7 @@ grig_list_rigs ()
+  * \sa grig_list_rigs, grig_list_compare
+  */
+ static gint
+-grig_list_add (const struct rig_caps *caps, void *array)
++grig_list_add (struct rig_caps *caps, void *array)
+ {
+ 	grig_rig_info_t *info;
+ 
+diff --git a/src/rig-selector.c b/src/rig-selector.c
+index 425d41a..e040c0e 100644
+--- a/src/rig-selector.c
++++ b/src/rig-selector.c
+@@ -46,7 +46,7 @@ static void add     (GtkWidget *, gpointer);
+ static void delete  (GtkWidget *, gpointer);
+ static void edit    (GtkWidget *, gpointer);
+ static void cancel  (GtkWidget *, gpointer);
+-static void connect (GtkWidget *, gpointer);
++static void connectrig (GtkWidget *, gpointer);
+ static void selection_changed (GtkTreeSelection *sel, gpointer data);
+ 
+ static void render_civ (GtkTreeViewColumn *col,
+@@ -191,7 +191,7 @@ rig_selector_execute ()
+     g_signal_connect (G_OBJECT (cancbut), "clicked",
+                       G_CALLBACK (cancel), window);
+     g_signal_connect (G_OBJECT (conbut), "clicked",
+-                      G_CALLBACK (connect), window);
++                      G_CALLBACK (connectrig), window);
+     g_signal_connect (G_OBJECT (delbut), "clicked",
+                       G_CALLBACK (delete), NULL);
+     g_signal_connect (G_OBJECT (newbut), "clicked",
+@@ -439,7 +439,7 @@ static void cancel (GtkWidget *button, gpointer window)
+  * simply destroys the rig selector window and whereby control is returned
+  * to the main() function.
+  */
+-static void connect (GtkWidget *button, gpointer window)
++static void connectrig (GtkWidget *button, gpointer window)
+ {
+     
+     
+-- 
+2.47.0
+
diff --git a/pkgs/by-name/gr/grig/package.nix b/pkgs/by-name/gr/grig/package.nix
index 189eaeaa3639..d6dfabd09375 100644
--- a/pkgs/by-name/gr/grig/package.nix
+++ b/pkgs/by-name/gr/grig/package.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OgIgHW9NMW/xSSti3naIR8AQWUtNSv5bYdOcObStBlM=";
   };
 
+  patches = [
+    # https://github.com/fillods/grig/issues/22
+    ./0001-Fix-grig-for-hamlib-4.6.x.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/applications/misc/keepassxc/darwin.patch b/pkgs/by-name/ke/keepassxc/darwin.patch
similarity index 100%
rename from pkgs/applications/misc/keepassxc/darwin.patch
rename to pkgs/by-name/ke/keepassxc/darwin.patch
diff --git a/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json b/pkgs/by-name/ke/keepassxc/firefox-native-messaging-host.json
similarity index 100%
rename from pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json
rename to pkgs/by-name/ke/keepassxc/firefox-native-messaging-host.json
diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/by-name/ke/keepassxc/package.nix
similarity index 56%
rename from pkgs/applications/misc/keepassxc/default.nix
rename to pkgs/by-name/ke/keepassxc/package.nix
index 42d69a6f863c..170cc7bfe8e3 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/by-name/ke/keepassxc/package.nix
@@ -3,54 +3,46 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  qttools,
+  libsForQt5,
 
   apple-sdk_15,
   asciidoctor,
   botan3,
   curl,
   darwinMinVersionHook,
-  kio,
   libXi,
   libXtst,
   libargon2,
   libusb1,
   minizip,
+  nix-update-script,
   pcsclite,
   pkg-config,
   qrencode,
-  qtbase,
-  qtmacextras,
-  qtsvg,
-  qtx11extras,
   readline,
   wrapGAppsHook3,
-  wrapQtAppsHook,
   zlib,
 
-  LocalAuthentication,
-
   withKeePassBrowser ? true,
   withKeePassBrowserPasskeys ? true,
-  withKeePassFDOSecrets ? true,
+  withKeePassFDOSecrets ? stdenv.hostPlatform.isLinux,
   withKeePassKeeShare ? true,
   withKeePassNetworking ? true,
   withKeePassSSHAgent ? true,
-  withKeePassTouchID ? true,
   withKeePassX11 ? true,
-  withKeePassYubiKey ? true,
+  withKeePassYubiKey ? stdenv.hostPlatform.isLinux,
 
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "keepassxc";
   version = "2.7.10";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-FBoqCYNM/leN+w4aV0AJMx/G0bjHbI9KVWrnmq3NfaI=";
   };
 
@@ -64,40 +56,58 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin.patch ];
 
-  cmakeFlags =
-    [
-      "-DKEEPASSXC_BUILD_TYPE=Release"
-      "-DWITH_GUI_TESTS=ON"
-      "-DWITH_XC_UPDATECHECK=OFF"
-    ]
-    ++ (lib.optional (!withKeePassX11) "-DWITH_XC_X11=OFF")
-    ++ (lib.optional (withKeePassFDOSecrets && stdenv.hostPlatform.isLinux) "-DWITH_XC_FDOSECRETS=ON")
-    ++ (lib.optional (withKeePassYubiKey && stdenv.hostPlatform.isLinux) "-DWITH_XC_YUBIKEY=ON")
-    ++ (lib.optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
-    ++ (lib.optional withKeePassBrowserPasskeys "-DWITH_XC_BROWSER_PASSKEYS=ON")
-    ++ (lib.optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
-    ++ (lib.optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
-    ++ (lib.optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
+  cmakeFlags = [
+    (lib.cmakeFeature "KEEPASSXC_BUILD_TYPE" "Release")
+    (lib.cmakeBool "WITH_GUI_TESTS" true)
+    (lib.cmakeBool "WITH_XC_UPDATECHECK" false)
+    (lib.cmakeBool "WITH_XC_X11" withKeePassX11)
+    (lib.cmakeBool "WITH_XC_BROWSER" withKeePassBrowser)
+    (lib.cmakeBool "WITH_XC_BROWSER_PASSKEYS" withKeePassBrowserPasskeys)
+    (lib.cmakeBool "WITH_XC_KEESHARE" withKeePassKeeShare)
+    (lib.cmakeBool "WITH_XC_NETWORKING" withKeePassNetworking)
+    (lib.cmakeBool "WITH_XC_SSHAGENT" withKeePassSSHAgent)
+    (lib.cmakeBool "WITH_XC_FDOSECRETS" withKeePassFDOSecrets)
+    (lib.cmakeBool "WITH_XC_YUBIKEY" withKeePassYubiKey)
+  ];
 
   doCheck = true;
-  checkPhase = ''
-    runHook preCheck
+  checkPhase =
+    let
+      disabledTests = lib.concatStringsSep "|" (
+        [
+          # flaky
+          "testcli"
+          "testgui"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # QWidget: Cannot create a QWidget without QApplication
+          "testautotype"
 
-    export LC_ALL="en_US.UTF-8"
-    export QT_QPA_PLATFORM=offscreen
-    export QT_PLUGIN_PATH="${qtbase.bin}/${qtbase.qtPluginPrefix}"
-    # testcli, testgui and testkdbx4 are flaky - skip them all
-    # testautotype on darwin throws "QWidget: Cannot create a QWidget without QApplication"
-    make test ARGS+="-E 'testcli|testgui${lib.optionalString stdenv.hostPlatform.isDarwin "|testautotype|testkdbx4"}' --output-on-failure"
+          # FAIL!  : TestDatabase::testExternallyModified() Compared values are not the same
+          #   Actual   (((spyFileChanged.count()))): 0
+          #   Expected (1)                         : 1
+          #   Loc: [/tmp/nix-build-keepassxc-2.7.10.drv-2/source/tests/TestDatabase.cpp(288)]
+          "testdatabase"
+        ]
+      );
+    in
+    ''
+      runHook preCheck
 
-    runHook postCheck
-  '';
+      export LC_ALL="en_US.UTF-8"
+      export QT_QPA_PLATFORM=offscreen
+      export QT_PLUGIN_PATH="${libsForQt5.qtbase.bin}/${libsForQt5.qtbase.qtPluginPrefix}"
+
+      make test ARGS+="-E '${disabledTests}' --output-on-failure"
+
+      runHook postCheck
+    '';
 
   nativeBuildInputs = [
     asciidoctor
     cmake
-    wrapQtAppsHook
-    qttools
+    libsForQt5.wrapQtAppsHook
+    libsForQt5.qttools
     pkg-config
   ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) wrapGAppsHook3;
 
@@ -127,35 +137,43 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      curl
       botan3
-      kio
+      curl
       libXi
       libXtst
       libargon2
+      libsForQt5.kio
+      libsForQt5.qtbase
+      libsForQt5.qtsvg
       minizip
       pcsclite
       qrencode
-      qtbase
-      qtsvg
       readline
       zlib
     ]
-    ++ lib.optional (stdenv.hostPlatform.isDarwin && withKeePassTouchID) LocalAuthentication
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      qtmacextras
+      libsForQt5.qtmacextras
 
       apple-sdk_15
       # ScreenCaptureKit, required by livekit, is only available on 12.3 and up:
       # https://developer.apple.com/documentation/screencapturekit
       (darwinMinVersionHook "12.3")
     ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libusb1
-    ++ lib.optional withKeePassX11 qtx11extras;
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libusb1
+    ]
+    ++ lib.optionals withKeePassX11 [
+      libsForQt5.qtx11extras
+    ];
 
-  passthru.tests = nixosTests.keepassxc;
+  passthru = {
+    tests = {
+      inherit (nixosTests) keepassxc;
+    };
+    updateScript = nix-update-script { };
+  };
 
-  meta = with lib; {
+  meta = {
     description = "Offline password manager with many features";
     longDescription = ''
       A community fork of KeePassX, which is itself a port of KeePass Password Safe.
@@ -165,12 +183,13 @@ stdenv.mkDerivation rec {
       using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
     '';
     homepage = "https://keepassxc.org/";
-    license = licenses.gpl2Plus;
+    changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
     mainProgram = "keepassxc";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       blankparticle
       sigmasquadron
     ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index f2c58300c055..361bdb298424 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -101,6 +101,8 @@ stdenv.mkDerivation rec {
     "-DNDEBUG"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   doCheck = true;
   checkFlags = [ "V=1" ]; # verbose output in case some test fails
   doInstallCheck = true;
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index adbc3ca89e7b..7546283c2732 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-03-13";
+  version = "0-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "25311dc03332d9ef2dff8d9d06c611d828028fac";
-    hash = "sha256-nmDjjQgxpZcddOHlBAE9CKdR95u+6lEYXcmIwH9RHXo=";
+    rev = "cacb61c9a3022c84057331063e31304933b61bdf";
+    hash = "sha256-dpqru8Qu1xZkHNKv6oF/T61/k6X2CWljUSVeJqxMvso=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/lu/lutgen/package.nix b/pkgs/by-name/lu/lutgen/package.nix
index 4d096143fbfc..011a65ce898f 100644
--- a/pkgs/by-name/lu/lutgen/package.nix
+++ b/pkgs/by-name/lu/lutgen/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
     rev = "v${version}";
-    hash = "sha256-jmMVeDDVb/TuxulDYj+8y4Kl42EJTAWb3tAsanfWduE=";
+    hash = "sha256-VE4R0rdQbZ7cyCPRtWWARUAnlR/KWGFUoJSJ4lySwzY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-BEh8Wl0X1wv53w/Zu0PHwh8oGtCvIJe60aVqLbiH1Hs=";
+  cargoHash = "sha256-H913/EjCh14AcCIj/Em6neP5F6i88rSVbPMmnS3po/I=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index 1bc25833f15a..fbd13a1002d8 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "misconfig-mapper";
-  version = "1.13.7";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${version}";
-    hash = "sha256-6WFtXIqnn2ayfXkGMIxGDlYpE3UbHRuAU8qHGk9SCU4=";
+    hash = "sha256-7ObDlO/jHUMJdEIFwsFrdSyrbs6I6koNJxQyH6FbhZc=";
   };
 
-  vendorHash = "sha256-fEmf+d9oBXz7KymNVmC+CM7OyPD9QV1uN4ReTNhei7A=";
+  vendorHash = "sha256-gxURT2S1m7J3bZ0VIYxFFsbxU3za2BgJ/6TONoPGzAw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 741a5e5ad29d..2979f34cc6a4 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -30,7 +30,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-C7YuXxCrnJ+8L7JNh6TA8xi0G3y1FwFb9DQwhS+igME=";
+    npmDepsHash = "sha256-MIjQ5Lbtv6kFHUyuc12JTItUPxIHoo65iUlSjBxw9Z8=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
diff --git a/pkgs/by-name/pa/patchcil/deps.json b/pkgs/by-name/pa/patchcil/deps.json
new file mode 100644
index 000000000000..175fd1c3cb4d
--- /dev/null
+++ b/pkgs/by-name/pa/patchcil/deps.json
@@ -0,0 +1,32 @@
+[
+  {
+    "pname": "AsmResolver",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-ZW61z6Qmztdy2NaiqxvNcP5RWBIiIO6CWNnqYq0MwoA="
+  },
+  {
+    "pname": "AsmResolver.DotNet",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-VoTiIr2/r2my6sg2AOEeiqz9vZhWtq5mGaW2Hx90Uo4="
+  },
+  {
+    "pname": "AsmResolver.PE",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-tTU/flTxRJaC4gkmI/gctqIriGIMntkgTs51TqzcQlg="
+  },
+  {
+    "pname": "AsmResolver.PE.File",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-hPuFrpcm2VMiYEirsL4kYmAhOzjwjNXUklIfYJEonLo="
+  },
+  {
+    "pname": "DotNet.Glob",
+    "version": "3.1.3",
+    "hash": "sha256-5uGSaGY1IqDjq4RCDLPJm0Lg9oyWmyR96OiNeGqSj84="
+  },
+  {
+    "pname": "System.CommandLine",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  }
+]
diff --git a/pkgs/by-name/pa/patchcil/package.nix b/pkgs/by-name/pa/patchcil/package.nix
new file mode 100644
index 000000000000..d0bdfb97c7b2
--- /dev/null
+++ b/pkgs/by-name/pa/patchcil/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
+  stdenv,
+  nix-update-script,
+  aot ? dotnetCorePackages.sdk_9_0.hasILCompiler && !stdenv.hostPlatform.isDarwin,
+}:
+
+buildDotnetModule rec {
+  pname = "patchcil";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "GGG-KILLER";
+    repo = "patchcil";
+    tag = "v${version}";
+    hash = "sha256-jqVXKp5ShWkIMAgmcwu9/QHy+Ey9d1Piv62wsO0Xm44=";
+  };
+
+  nativeBuildInputs = lib.optional aot stdenv.cc;
+
+  projectFile = "src/PatchCil.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = if aot then null else dotnetCorePackages.runtime_9_0;
+
+  selfContainedBuild = aot;
+  dotnetFlags = lib.optionals (!aot) [
+    # Disable AOT
+    "-p:PublishAot=false"
+    "-p:InvariantGlobalization=false"
+    "-p:EventSourceSupport=true"
+    "-p:HttpActivityPropagationSupport=true"
+    "-p:MetadataUpdaterSupport=true"
+    "-p:MetricsSupport=true"
+    "-p:UseNativeHttpHandler=false"
+    "-p:XmlResolverIsNetworkingEnabledByDefault=true"
+    "-p:EnableGeneratedComInterfaceComImportInterop=true"
+    "-p:_ComObjectDescriptorSupport=true"
+    "-p:_DataSetXmlSerializationSupport=true"
+    "-p:_DefaultValueAttributeSupport=true"
+    "-p:_DesignerHostSupport=true"
+    "-p:_EnableConsumingManagedCodeFromNativeHosting=true"
+    "-p:_UseManagedNtlm=true"
+  ];
+
+  preFixup = lib.optionalString aot ''
+    # Remove debug symbols as they shouldn't have anything in them.
+    rm $out/lib/patchcil/patchcil.dbg
+  '';
+
+  executables = [ "patchcil" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "A small utility to modify the library paths from PInvoke in .NET assemblies.";
+    homepage = "https://github.com/GGG-KILLER/patchcil";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ggg ];
+    mainProgram = "patchcil";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+      "x86_64-windows"
+      "i686-windows"
+    ];
+  };
+}
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index d424b8f126ac..c61c6579140b 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-04-06";
+  version = "latest-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "3d661ea0485a83b0c1065595839cb2d9d594e4e8";
-    hash = "sha256-4NeDOGzCq211SVVtfISq/Z901Et1zYhMQ/t7eNEBW9Y=";
+    rev = "9ee17a9a167efdd660c4806e2d3cd5bc2b3177e1";
+    hash = "sha256-9MsPMQnqzePhxF9f9DgmZ9aq8TzLYi3jZA9HF2McVss=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-S0d64jFKiyGVIFH8HhT4mzBEVUPDIMevvClTeqy0/28=";
+  cargoHash = "sha256-23qr4bEAsN75ONnNmym9eWH38fRoMmP1EkmOaka73Ko=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/rk/rkbin/package.nix b/pkgs/by-name/rk/rkbin/package.nix
index f13113238467..b4481753bee0 100644
--- a/pkgs/by-name/rk/rkbin/package.nix
+++ b/pkgs/by-name/rk/rkbin/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
   passthru = {
     BL31_RK3568 = "${rkbin}/bin/rk35/rk3568_bl31_v1.44.elf";
     BL31_RK3588 = "${rkbin}/bin/rk35/rk3588_bl31_v1.47.elf";
+    TPL_RK3566 = "${rkbin}/bin/rk35/rk3566_ddr_1056MHz_v1.23.bin";
     TPL_RK3568 = "${rkbin}/bin/rk35/rk3568_ddr_1056MHz_v1.23.bin";
     TPL_RK3588 = "${rkbin}/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.18.bin";
   };
diff --git a/pkgs/by-name/sc/screen-pipe/package.nix b/pkgs/by-name/sc/screen-pipe/package.nix
index 141eca8d82c7..36118fc16fdd 100644
--- a/pkgs/by-name/sc/screen-pipe/package.nix
+++ b/pkgs/by-name/sc/screen-pipe/package.nix
@@ -9,9 +9,9 @@
   openssl,
   sqlite,
   stdenv,
-  darwin,
   alsa-lib,
   xorg,
+  apple-sdk_12,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "screen-pipe";
@@ -49,22 +49,9 @@ rustPlatform.buildRustPackage rec {
       openssl
       sqlite
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_12_3.frameworks;
-      [
-        CoreAudio
-        AudioUnit
-        CoreFoundation
-        CoreGraphics
-        CoreMedia
-        IOKit
-        Metal
-        MetalPerformanceShaders
-        Security
-        ScreenCaptureKit
-        SystemConfiguration
-      ]
-    )
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       xorg.libxcb
diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index 69328f7b3d05..be931652bd21 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -18,13 +18,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "snx-rs";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${version}";
-    hash = "sha256-eWtoCU5JkpHGcOLzjzj9icDlnIW1y+fiEn5V/E5IQ4U=";
+    hash = "sha256-bLuIXd2pqqiyEP+lDTJYVDZkRZ0HcDkKFZd/qlpuf98=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Hjc2wKkNmlVjZb5wz9fq9hzUsxXJyeFYq+4C+weUlq0=";
+  cargoHash = "sha256-E5OJVf9CkLn5mFtk4Yacs2OIvAuIw0idSs7QuTNvfgU=";
 
   meta = {
     description = "Open source Linux client for Checkpoint VPN tunnels";
diff --git a/pkgs/by-name/sw/swagger-cli/package.nix b/pkgs/by-name/sw/swagger-cli/package.nix
index f78dd09b46a4..5b72e1e8d5d4 100644
--- a/pkgs/by-name/sw/swagger-cli/package.nix
+++ b/pkgs/by-name/sw/swagger-cli/package.nix
@@ -21,6 +21,10 @@ buildNpmPackage rec {
     npm run bump
   '';
 
+  postInstall = ''
+    find $out/lib/node_modules -xtype l -delete
+  '';
+
   meta = with lib; {
     description = "Swagger 2.0 and OpenAPI 3.0 command-line tool";
     homepage = "https://apitools.dev/swagger-cli/";
diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
new file mode 100644
index 000000000000..8f445e0000f0
--- /dev/null
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  nix-update-script,
+  writers,
+  baseUrl ? null,
+}:
+
+assert lib.asserts.assertMsg (
+  baseUrl == null
+) "The baseUrl parameter is deprecated, please use .withConfig instead";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "synapse-admin-etkecc";
+  version = "0.10.3-etke39";
+
+  src = fetchFromGitHub {
+    owner = "etkecc";
+    repo = "synapse-admin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1jE4QrHAnH27FrfpgM8rKd4I2AAJArtL0jgcWVc8TrU=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-60rS/OfPEQmmZ5j7mUjMPyK9prgNOX7MkYpu9djdjxQ=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnBuildHook
+  ];
+
+  env = {
+    NODE_ENV = "production";
+    SYNAPSE_ADMIN_VERSION = finalAttrs.version;
+  };
+
+  installPhase = ''
+    runHook preInstall
+    cp -r dist $out
+    runHook postInstall
+  '';
+
+  passthru = {
+    # https://github.com/etkecc/synapse-admin/blob/main/docs/config.md
+    withConfig =
+      config:
+      stdenv.mkDerivation {
+        inherit (finalAttrs) version meta;
+        pname = "synapse-admin-etkecc-with-config";
+        dontUnpack = true;
+        configFile = writers.writeJSON "synapse-admin-config" config;
+        installPhase = ''
+          runHook preInstall
+          cp -r ${finalAttrs.finalPackage} $out
+          chmod -R +w $out
+          cp $configFile $out/config.json
+          runHook postInstall
+        '';
+      };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Maintained fork of the admin console for (Matrix) Synapse homeservers, including additional features";
+    homepage = "https://github.com/etkecc/synapse-admin";
+    changelog = "https://github.com/etkecc/synapse-admin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+})
diff --git a/pkgs/by-name/wa/walker/package.nix b/pkgs/by-name/wa/walker/package.nix
index c8f596c4e730..d16a6e6e5459 100644
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule rec {
   pname = "walker";
-  version = "0.12.19";
+  version = "0.12.21";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${version}";
-    hash = "sha256-XOOYalJ+6V/O/fhC5gEDk2m1yZ2e5DofRRIi8ETHgoQ=";
+    hash = "sha256-wONW5CaPkLiVR5roGFx2SOcvcVDr9E9eCtojGBy3ErE=";
   };
 
   vendorHash = "sha256-6PPNVnsH1eU4fLcZpxiBoHCzN/TUUxfTfmxDsBDPDKQ=";
diff --git a/pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch b/pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch
new file mode 100644
index 000000000000..36886d7c4a2a
--- /dev/null
+++ b/pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch
@@ -0,0 +1,79 @@
+diff --git a/xslt/common/html.xsl b/xslt/common/html.xsl
+index 77aed075..82832fb4 100644
+--- a/xslt/common/html.xsl
++++ b/xslt/common/html.xsl
+@@ -266,6 +266,16 @@ certain tokens, and you can add your own with {html.sidebar.mode}. See
+ -->
+ <xsl:param name="html.sidebar.right" select="''"/>
+ 
++<!--@@==========================================================================
++html.csp.nonce
++An optional CSP nonce string to allow the execution of scripts and styles.
++@revision[version=42.2 date=2025-02-22 status=final]
++
++This parameter takes a string value that will be added to the 'nonce' attribute
++of all 'style' and 'script' tags in the generated HTML output. This paramter is used
++to whitelist script and style tags that are allowed to be executed.
++-->
++<xsl:param name="html.csp.nonce" select="false()"/>
+ 
+ <!--**==========================================================================
+ html.output
+@@ -1124,6 +1134,11 @@ dimensions. All parameters can be automatically computed if not provided.
+     </xsl:call-template>
+   </xsl:param>
+   <style type="text/css">
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if>
+     <xsl:call-template name="html.css.content">
+       <xsl:with-param name="node" select="$node"/>
+       <xsl:with-param name="direction" select="$direction"/>
+@@ -1533,6 +1548,11 @@ copy, override this template and provide the necessary files.
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+     <script type="text/javascript">
++      <xsl:if test="$html.csp.nonce">
++        <xsl:attribute name="nonce">
++          <xsl:value-of select="$html.csp.nonce" />
++        </xsl:attribute>
++      </xsl:if>
+       <xsl:attribute name="src">
+         <xsl:text>http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=MML_HTMLorMML</xsl:text>
+       </xsl:attribute>
+@@ -1558,6 +1578,11 @@ result of {html.js.content} to that file.
+ <xsl:template name="html.js.script">
+   <xsl:param name="node" select="."/>
+   <script type="text/javascript">
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if>
+     <xsl:call-template name="html.js.content">
+       <xsl:with-param name="node" select="$node"/>
+     </xsl:call-template>
+@@ -2035,8 +2060,19 @@ on all `code` elements with `"syntax"` in the class value.
+ <xsl:template name="html.js.syntax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$html.syntax.highlight">
+-  <script type="text/javascript" src="{$html.js.root}highlight.pack.js"></script>
+-  <script><![CDATA[
++    <script type="text/javascript" src="{$html.js.root}highlight.pack.js">
++      <xsl:if test="$html.csp.nonce">
++        <xsl:attribute name="nonce">
++          <xsl:value-of select="$html.csp.nonce" />
++        </xsl:attribute>
++      </xsl:if>
++    </script>
++    <script>
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if><![CDATA[
+ document.addEventListener('DOMContentLoaded', function() {
+   var matches = document.querySelectorAll('code.syntax')
+   for (var i = 0; i < matches.length; i++) {
diff --git a/pkgs/by-name/ye/yelp-xsl/package.nix b/pkgs/by-name/ye/yelp-xsl/package.nix
index 613e12f0a561..9f776b03e013 100644
--- a/pkgs/by-name/ye/yelp-xsl/package.nix
+++ b/pkgs/by-name/ye/yelp-xsl/package.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "yelp-xsl";
diff --git a/pkgs/by-name/ye/yelp/cve-2025-3155.patch b/pkgs/by-name/ye/yelp/cve-2025-3155.patch
new file mode 100644
index 000000000000..3cdcfaeef332
--- /dev/null
+++ b/pkgs/by-name/ye/yelp/cve-2025-3155.patch
@@ -0,0 +1,101 @@
+diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
+index 9e44b734..0a74da55 100644
+--- a/data/xslt/mal2html.xsl.in
++++ b/data/xslt/mal2html.xsl.in
+@@ -19,6 +19,11 @@
+ <xsl:param name="mal.link.prefix" select="'xref:'"/>
+ <xsl:param name="mal.link.extension" select="''"/>
+ 
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
++</xsl:template>
++
+ <xsl:template name="mal.link.target.custom">
+   <xsl:param name="node" select="."/>
+   <xsl:param name="action" select="$node/@action"/>
+diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
+index 676ce3eb..56bc1f5c 100644
+--- a/data/xslt/man2html.xsl.in
++++ b/data/xslt/man2html.xsl.in
+@@ -131,7 +131,7 @@
+   the correct styling and a single character which we measure the
+   width of and update each sheet as required.
+ -->
+-<script type="text/javascript" language="javascript">
++<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
+ <xsl:text>
+ $(document).ready (function () {
+   var div = document.getElementById("invisible-char");
+diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
+index 0c1ec9bb..421fc02d 100644
+--- a/data/xslt/yelp-common.xsl.in
++++ b/data/xslt/yelp-common.xsl.in
+@@ -15,6 +15,13 @@
+ <xsl:param name="html.syntax.highlight" select="true()"/>
+ <xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
+ 
++<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
++
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
++</xsl:template>
++
+ <xsl:template name="html.js.mathjax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
+index e74eb463..2ce1d05b 100644
+--- a/libyelp/yelp-transform.c
++++ b/libyelp/yelp-transform.c
+@@ -71,6 +71,8 @@ static void      xslt_yelp_cache            (xsltTransformContextPtr  ctxt,
+                                              xsltStylePreCompPtr      comp);
+ static void      xslt_yelp_aux              (xmlXPathParserContextPtr ctxt,
+                                              int                      nargs);
++static void      xslt_yelp_generate_nonce   (xmlXPathParserContextPtr ctxt,
++                                             int                      nargs);
+ 
+ enum {
+     PROP_0,
+@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
+                              BAD_CAST "input",
+                              BAD_CAST YELP_NAMESPACE,
+                              (xmlXPathFunction) xslt_yelp_aux);
++    xsltRegisterExtFunction (priv->context,
++                         BAD_CAST "generate_nonce",
++                         BAD_CAST YELP_NAMESPACE,
++                         (xmlXPathFunction) xslt_yelp_generate_nonce);
+ 
+     priv->output = xsltApplyStylesheetUser (priv->stylesheet,
+                                             priv->input,
+@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
+     xsltExtensionInstructionResultRegister (tctxt, ret);
+     valuePush (ctxt, ret);
+ }
++
++static void
++xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
++{
++    GRand* rand;
++    gchar* nonce_str;
++
++    rand = g_rand_new ();
++    nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
++    xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
++    g_free(nonce_str);
++    g_rand_free(rand);
++}
+diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
+index 32ae131e..d544c5df 100644
+--- a/libyelp/yelp-view.c
++++ b/libyelp/yelp-view.c
+@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
+ 
+     if (app_info)
+       {
+-        if (!strstr (g_app_info_get_executable (app_info), "yelp"))
++        if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
+           {
+             GList l;
+ 
diff --git a/pkgs/by-name/ye/yelp/package.nix b/pkgs/by-name/ye/yelp/package.nix
index 652cc277ae9a..270df670e2a2 100644
--- a/pkgs/by-name/ye/yelp/package.nix
+++ b/pkgs/by-name/ye/yelp/package.nix
@@ -49,6 +49,10 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-good
   ];
 
+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "yelp";
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index b3f75176f55f..673c818ab843 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.181.5";
+  version = "0.181.8";
 
   outputs =
     [ "out" ]
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wp8CoWEOSScQP2Q+lQJgstzTNNwiy0ONHOy6PjIlFBo=";
+    hash = "sha256-gkbiV0kfeM1Ito8jVOBVneNjaXCA4PFayXJLIUmjqn4=";
   };
 
   patches = [
@@ -128,7 +128,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FATdeVwbSUA/zfWV9TdoS4/fT9KWsekKGjQ34HJW4rk=";
+  cargoHash = "sha256-PMLu2PeyRNu6VbHByL+clUoY/P8Rlrc+SvP5gDKrN/E=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
index dc8d244b1c6a..afbf08cf401a 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
@@ -16,7 +16,6 @@
   libgee,
   libhandy,
   libxml2,
-  libsoup_2_4,
   elementary-calendar,
 }:
 
@@ -52,7 +51,6 @@ stdenv.mkDerivation rec {
     libgee
     libhandy
     libical
-    libsoup_2_4
     wingpanel
   ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
index 420fd62b68d6..3ae26029e889 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
@@ -2,19 +2,20 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gettext,
   pkg-config,
+  xfce4-dev-tools,
   glib,
   gtk3,
   json_c,
   libxml2,
-  libsoup_2_4,
+  libsoup_3,
   upower,
   libxfce4ui,
   libxfce4util,
   xfce4-panel,
   xfconf,
-  hicolor-icon-theme,
   gitUpdater,
 }:
 
@@ -31,9 +32,23 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AC0f5jkG0vOgEvPLWMzv8d+8xGZ1njbHbTsD3QHA3Fc=";
   };
 
+  patches = [
+    # Port to libsoup-3.0
+    # https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/merge_requests/28
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/c0653a903c6f2cecdf41ac9eaeba4f4617656ffe.patch";
+      hash = "sha256-wAowm4ppBSKvYwOowZbbs5pnTh9EQ9XX05lA81wtsRM=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/279c975dc1f95bd1ce9152eee1d19122e7deb9a8.patch";
+      hash = "sha256-gVfyXkE0bjBfvcQU9fDp+Gm59bD3VbAam04Jak8i31k=";
+    })
+  ];
+
   nativeBuildInputs = [
     gettext
     pkg-config
+    xfce4-dev-tools
   ];
 
   buildInputs = [
@@ -41,15 +56,16 @@ stdenv.mkDerivation rec {
     gtk3
     json_c
     libxml2
-    libsoup_2_4
+    libsoup_3
     upower
     libxfce4ui
     libxfce4util
     xfce4-panel
     xfconf
-    hicolor-icon-theme
   ];
 
+  configureFlags = [ "--enable-maintainer-mode" ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/development/compilers/dotnet/default.nix b/pkgs/development/compilers/dotnet/default.nix
index 923c31a7fcec..b40a3e9be4f2 100644
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@@ -78,6 +78,7 @@ let
 
         patchNupkgs = callPackage ./patch-nupkgs.nix { };
         nugetPackageHook = callPackage ./nuget-package-hook.nix { };
+        autoPatchcilHook = callPackage ../../../build-support/dotnet/auto-patchcil-hook { };
 
         buildDotnetModule = callPackage ../../../build-support/dotnet/build-dotnet-module { };
         buildDotnetGlobalTool = callPackage ../../../build-support/dotnet/build-dotnet-global-tool { };
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index ab80a9424c23..9c429091908c 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -38,7 +38,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gegl";
-  version = "0.4.54";
+  version = "0.4.58";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NaNC8IxrQ3mt7iy1dI/E4wfP3PJBfAuxfWymVD8jix4=";
+    hash = "sha256-1WeLvV/lNZQbgvlluX/Mk4XOk29wyYK9VlpT1VGdG/8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/jemalloc/default.nix b/pkgs/development/libraries/jemalloc/default.nix
index 0eea127c8c39..05a82ccffb13 100644
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@@ -50,9 +50,7 @@ stdenv.mkDerivation rec {
     automake
   ];
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export LDFLAGS="$LDFLAGS -Wl,-no_uuid -Wl,-install_name,@rpath/libjemalloc.2.dylib";
-  '';
+  preConfigure = "";
 
   # TODO: switch to autoreconfHook when updating beyond 5.3.0
   # https://github.com/jemalloc/jemalloc/issues/2346
diff --git a/pkgs/development/libraries/librdf/raptor.nix b/pkgs/development/libraries/librdf/raptor.nix
deleted file mode 100644
index 627d7a43869d..000000000000
--- a/pkgs/development/libraries/librdf/raptor.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libxml2,
-  curl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "raptor";
-  version = "1.4.21";
-
-  src = fetchurl {
-    url = "http://download.librdf.org/source/raptor-${version}.tar.gz";
-    sha256 = "db3172d6f3c432623ed87d7d609161973d2f7098e3d2233d0702fbcc22cfd8ca";
-  };
-
-  buildInputs = [
-    libxml2
-    curl
-  ];
-
-  preBuild = ''
-    sed -e '/curl\/types/d' -i src/*.c src/*.h
-  '';
-
-  meta = {
-    description = "RDF Parser Toolkit";
-    homepage = "https://librdf.org/raptor";
-    license = with lib.licenses; [
-      lgpl21
-      asl20
-    ];
-    maintainers = [ lib.maintainers.marcweber ];
-    platforms = lib.platforms.linux;
-    # error: passing argument 2 of 'xmlSetStructuredErrorFunc' from incompatible pointer type [-Wincompatible-pointer-types]
-    broken = true;
-  };
-}
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 2dc646b19e28..791612abe8ab 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -7,10 +7,21 @@
   wayland-scanner,
   pkg-config,
   libdrm,
+  fetchpatch,
 }:
 
 qtModule {
   pname = "qtwayland";
+
+  # Backport fix for popups not rendering properly
+  # FIXME: remove in 6.9.1
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/e4556c59f0c8250da7c16759432b2ac0a5ac9d9f.patch";
+      hash = "sha256-wRNXBwecuULn5MD87HP20uSuxHiuQslKp20DIuCGheM=";
+    })
+  ];
+
   # wayland-scanner needs to be propagated as both build
   # (for the wayland-scanner binary) and host (for the
   # actual wayland.xml protocol definition)
diff --git a/pkgs/development/lua-modules/bit32.patch b/pkgs/development/lua-modules/bit32.patch
deleted file mode 100644
index 544c4d423981..000000000000
--- a/pkgs/development/lua-modules/bit32.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -Naur lua-compat-5.2/c-api/compat-5.2.h lua-compat-5.2-patched/c-api/compat-5.2.h
---- lua-compat-5.2/c-api/compat-5.2.h	2015-02-19 09:23:42.000000000 +1100
-+++ lua-compat-5.2-patched/c-api/compat-5.2.h	2019-06-17 17:58:13.585361793 +1000
-@@ -146,8 +146,10 @@
- #define lua_pushglobaltable(L) \
-   lua_pushvalue(L, LUA_GLOBALSINDEX)
- 
-+#if !defined(luaL_newlib)
- #define luaL_newlib(L, l) \
-   (lua_newtable((L)),luaL_setfuncs((L), (l), 0))
-+#endif
- 
- void luaL_checkversion (lua_State *L);
- 
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 744f8e3084f8..44c8d6d993ee 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -169,32 +169,31 @@ final: prev: {
   bit32 = callPackage (
     {
       buildLuarocksPackage,
-      fetchFromGitHub,
       fetchurl,
+      fetchzip,
+      luaAtLeast,
       luaOlder,
     }:
     buildLuarocksPackage {
       pname = "bit32";
-      version = "5.3.0-1";
+      version = "5.3.5.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/bit32-5.3.0-1.rockspec";
-          sha256 = "1d6xdihpksrj5a3yvsvnmf3vfk15hj6f8n1rrs65m7adh87hc0yd";
+          url = "mirror://luarocks/bit32-5.3.5.1-1.rockspec";
+          sha256 = "11mg0hmmil92hkwamm91ghih6ys9pqsakx0z9jgnqxymnl887j51";
         }).outPath;
-      src = fetchFromGitHub {
-        owner = "keplerproject";
-        repo = "lua-compat-5.2";
-        rev = "bitlib-5.3.0";
-        hash = "sha256-Ek7FMWskfHwHhEVfjTDZyL/cruHDiQo5Jmnwsvai+MY=";
+      src = fetchzip {
+        url = "https://github.com/keplerproject/lua-compat-5.3/archive/v0.10.zip";
+        sha256 = "1caxn228gx48g6kymp9w7kczgxcg0v0cd5ixsx8viybzkd60dcn4";
       };
 
-      disabled = luaOlder "5.1";
+      disabled = luaOlder "5.1" || luaAtLeast "5.5";
 
       meta = {
         homepage = "http://www.lua.org/manual/5.2/manual.html#6.7";
         description = "Lua 5.2 bit manipulation library";
         maintainers = with lib.maintainers; [ lblasc ];
-        license.fullName = "MIT/X11";
+        license.fullName = "MIT";
       };
     }
   ) { };
@@ -815,15 +814,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.1823-1";
+      version = "0.0.1836-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.1823-1.rockspec";
-          sha256 = "0icbchqxr546j21xq2f6w122xkcmqgpg9pywlip8xjj8vsdfx6n6";
+          url = "mirror://luarocks/fzf-lua-0.0.1836-1.rockspec";
+          sha256 = "1q0wfck09d0449q8dyb95cyyr8z0r8292dp8vrqq3jcd7qkjcf1q";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/47b85a25c0c0b2c20b4e75199ed01bb71e7814f5.zip";
-        sha256 = "1znlhvb84x3lipa5n1cdk1kpid49h647hnnwy01xw447vk49p11p";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/ba5ba606f11967e08165aeeb9d7abe04d0835f58.zip";
+        sha256 = "1r66yrpzzzazasmb450xpr11f0sjg8ckrf91x4c66ypsanz2z2ws";
       };
 
       disabled = luaOlder "5.1";
@@ -881,8 +880,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "lewis6991";
         repo = "gitsigns.nvim";
-        rev = "c6fedfd0b1715ee624384b134becec0a7b0a3d28";
-        hash = "sha256-c+7Bf7SqVaNiYHczouYChDrurDdTxIDzr/TLMtLqZ50=";
+        rev = "fcfa7a989cd6fed10abf02d9880dc76d7a38167d";
+        hash = "sha256-cg8r0yuuSE8G5MTj0pET8MzJ+VQf+HsXDJx5FzriM78=";
       };
 
       disabled = lua.luaversion != "5.1";
@@ -895,6 +894,37 @@ final: prev: {
     }
   ) { };
 
+  grug-far-nvim = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchurl,
+      fetchzip,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "grug-far.nvim";
+      version = "1.6.6-1";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/grug-far.nvim-1.6.6-1.rockspec";
+          sha256 = "1axdj580nv078d4rh7q9rqd5rd46cvd3gfif0cbqys2kpv0xx53d";
+        }).outPath;
+      src = fetchzip {
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/d6c682af0033b4fbb3645a997e3b4a9189ed1ed6.zip";
+        sha256 = "0v1nfyiymb17p3fkk6ih1pxiib25f8vg74k79vp9r5wr56l9ja9c";
+      };
+
+      disabled = luaOlder "5.1";
+
+      meta = {
+        homepage = "https://github.com/MagicDuck/grug-far.nvim";
+        description = "Find And Replace plugin for neovim";
+        maintainers = with lib.maintainers; [ teto ];
+        license.fullName = "MIT";
+      };
+    }
+  ) { };
+
   haskell-tools-nvim = callPackage (
     {
       buildLuarocksPackage,
@@ -926,36 +956,6 @@ final: prev: {
     }
   ) { };
 
-  grug-far-nvim = callPackage (
-    {
-      buildLuarocksPackage,
-      fetchurl,
-      fetchzip,
-      luaOlder,
-    }:
-    buildLuarocksPackage {
-      pname = "grug-far.nvim";
-      version = "1.5.15-1";
-      knownRockspec =
-        (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.5.15-1.rockspec";
-          sha256 = "1jp6b6kqp389wli766rypam4hr6dqv6v5r8kv1dk21d7glz8hg6h";
-        }).outPath;
-      src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/5da116bc99a03e14be3b824e319f4e49c676af78.zip";
-        sha256 = "196l6vy9573fkwld3cl927706a6gfgmc71kn1kx3pmk8l6p8hcya";
-      };
-
-      disabled = luaOlder "5.1";
-
-      meta = {
-        homepage = "https://github.com/MagicDuck/grug-far.nvim";
-        description = "Find And Replace plugin for neovim";
-        license.fullName = "MIT";
-      };
-    }
-  ) { };
-
   http = callPackage (
     {
       basexx,
@@ -1979,17 +1979,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lua-resty-openssl";
-      version = "1.5.2-1";
+      version = "1.6.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-openssl-1.5.2-1.rockspec";
-          sha256 = "1nrriyf9fvn0achn2drvb915kx7cq4ldlyg24g118i8ib1fr9lgd";
+          url = "mirror://luarocks/lua-resty-openssl-1.6.0-1.rockspec";
+          sha256 = "108a53210khinpwk88pcz6s8n2f6hhaib3jfrgi9kjp0r4s14c4q";
         }).outPath;
       src = fetchFromGitHub {
         owner = "fffonion";
         repo = "lua-resty-openssl";
-        rev = "1.5.2";
-        hash = "sha256-vkcqUaHCIBBmcVP4csqjn6oPSBvUF8MBzveIc6jJKWY=";
+        rev = "1.6.0";
+        hash = "sha256-TqBRTFV1255Ct2mm2T8bLJNdSWZTEB6wOOHGRZczcVk=";
       };
 
       meta = {
@@ -2011,17 +2011,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lua-resty-session";
-      version = "4.0.5-1";
+      version = "4.1.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-session-4.0.5-1.rockspec";
-          sha256 = "0h0kqwna46mrraq310qjb7yigxwv13n4czk24xnqr21czxsskzkg";
+          url = "mirror://luarocks/lua-resty-session-4.1.0-1.rockspec";
+          sha256 = "0cmx2rwiwiprg1112chxrfvp7gs2jg0grdnkb5n7yhd5rnp0bhhw";
         }).outPath;
       src = fetchFromGitHub {
         owner = "bungle";
         repo = "lua-resty-session";
-        rev = "v4.0.5";
-        hash = "sha256-n0m6/4JnUPoidM7oWKd+ZyNbb/X/h8w21ptCrFaA8SI=";
+        rev = "v4.1.0";
+        hash = "sha256-MXB7Z/0drMOcTwJBHNwZx4iqem1XfG6uwozW+RxL588=";
       };
 
       disabled = luaOlder "5.1";
@@ -2730,13 +2730,13 @@ final: prev: {
       knownRockspec =
         (fetchurl {
           url = "mirror://luarocks/lualine.nvim-scm-1.rockspec";
-          sha256 = "044bnw2phsxjsxkraaq9phj932f2f7vsbvfa91p7qfp2yjshixjf";
+          sha256 = "1cf500jgdd3f9d36ad9h3vf20vyz4za0lqsdrx9l3si39n71k92v";
         }).outPath;
       src = fetchFromGitHub {
         owner = "nvim-lualine";
         repo = "lualine.nvim";
-        rev = "0ea56f91b7f51a37b749c050a5e5dfdd56b302b3";
-        hash = "sha256-VSWWvhnaeNoeM7U1SwerL8vqu81eg8YJtLnJDdEjvzY=";
+        rev = "86fe39534b7da729a1ac56c0466e76f2c663dc42";
+        hash = "sha256-XeAFXg6GWzMJV/HzfdCXtv/effAHVU7mioFKTf1kDc8=";
       };
 
       disabled = luaOlder "5.1";
@@ -3216,14 +3216,14 @@ final: prev: {
       version = "0.6.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luasystem-0.6.0-1.rockspec";
-          sha256 = "0pbjxfa56wy2bzs3q0bsxv27m8l2f3p2frvkprah2n708pxzi84s";
+          url = "mirror://luarocks/luasystem-0.6.2-1.rockspec";
+          sha256 = "0s6vd8a35x156ccp9b95rzqgklmgvz3a2bcfp4g09vlyh2kqy1am";
         }).outPath;
       src = fetchFromGitHub {
         owner = "lunarmodules";
         repo = "luasystem";
-        rev = "v0.6.0";
-        hash = "sha256-xhMdtI8tVBIQ4hsGe3l9z/ywJTvJhtGoE9hVnzvrTGc=";
+        rev = "v0.6.2";
+        hash = "sha256-EcKs8W8UAbyA5WCt75tGO2osNgFbL8SNUl78vKSy82o=";
       };
 
       disabled = luaOlder "5.1";
@@ -4080,8 +4080,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "hrsh7th";
         repo = "nvim-cmp";
-        rev = "059e89495b3ec09395262f16b1ad441a38081d04";
-        hash = "sha256-YC2ehgS759GzRUySPqmb1NQFxJ9HnP731oVYptWU3Xk=";
+        rev = "b5311ab3ed9c846b585c0c15b7559be131ec4be9";
+        hash = "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -4336,8 +4336,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-lua";
         repo = "plenary.nvim";
-        rev = "3707cdb1e43f5cea73afb6037e6494e7ce847a66";
-        hash = "sha256-18zX3kZ42ynRefFP0mOcy6ESEpejTukjNi4jCRXx48A=";
+        rev = "857c5ac632080dba10aae49dba902ce3abf91b35";
+        hash = "sha256-8FV5RjF7QbDmQOQynpK7uRKONKbPRYbOPugf9ZxNvUs=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -4426,15 +4426,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rest.nvim";
-      version = "3.9.1-1";
+      version = "3.12.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rest.nvim-3.9.1-1.rockspec";
-          sha256 = "02arw1hr702jfadnc72yr3kkhfcm7hfg1ipis7nlhvsj25i2yl54";
+          url = "mirror://luarocks/rest.nvim-3.12.0-1.rockspec";
+          sha256 = "1i16gr471v9v6jdwrqizagznpjdr58ijx0cs9yjnd8b6b9cwmxi9";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.9.1.zip";
-        sha256 = "15lkdr77q7zxqbh3xkx3ilj38hp5jfinrqw92q3dpmxc8d8wk9iw";
+        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.12.0.zip";
+        sha256 = "1494r144idrq09da8ra4q0yk7giqh4hxs05397ja7hpxyz0yabdr";
       };
 
       disabled = luaOlder "5.1";
@@ -4649,15 +4649,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "6.0.1-1";
+      version = "6.0.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.0.1-1.rockspec";
-          sha256 = "02qxbrk32fay17nlxs4sf4dpkvsfnj5lkm8wsb2q0a8jaa2v7dxv";
+          url = "mirror://luarocks/rustaceanvim-6.0.2-1.rockspec";
+          sha256 = "1z2s2f91mnc9fxr5ykffajpj2c92rjgnwipfvi2lhhl2p5hpgf9f";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.1.zip";
-        sha256 = "032barkibbsjjwzq87jbn2sqni3f5bmfvxn2bcq589viwdrziwgf";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.2.zip";
+        sha256 = "09wrfmzbk81xax5p4wzczsvv1x28nv54mayi12fvzv6c3bmcsbvj";
       };
 
       disabled = luaOlder "5.1";
@@ -4962,8 +4962,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "415af52339215926d705cccc08145f3782c4d132";
-        hash = "sha256-5y8srYKaAqFplMtDjsc8GdDF8yui5vCNMiOeFLrC/sM=";
+        rev = "a4ed82509cecc56df1c7138920a1aeaf246c0ac5";
+        hash = "sha256-GF1zOHZItVZm3bx2wqI4hPj7EXQJ2F9KS4MtaEt2gm0=";
       };
 
       disabled = lua.luaversion != "5.1";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 54c87b8ea563..54aef8fb8313 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -4,7 +4,7 @@
   cargo,
   cmake,
 
-  # plenary utilities
+  ast-grep,
   which,
   findutils,
   coreutils,
@@ -86,16 +86,6 @@ in
   ##########################################3
   #### manual fixes for generated packages
   ##########################################3
-  bit32 = prev.bit32.overrideAttrs (oa: {
-    # Small patch in order to no longer redefine a Lua 5.2 function that Luajit
-    # 2.1 also provides, see https://github.com/LuaJIT/LuaJIT/issues/325 for
-    # more
-    patches = [
-      ./bit32.patch
-    ];
-    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
-  });
-
   busted = prev.busted.overrideAttrs (oa: {
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       installShellFiles
@@ -227,6 +217,19 @@ in
       runHook preCheck
       # feel free to disable/adjust the tests
       rm tests/base/test_apply.lua tests/base/test_vimscript_interpreter.lua
+
+      # Dependencies needed in special location
+      mkdir -p deps/{ripgrep,astgrep}
+      mkdir {temp_test_dir,temp_history_dir}
+      ln -s ${lib.getExe ripgrep} deps/ripgrep/rg
+      ln -s ${lib.getExe ast-grep} deps/astgrep/ast-grep
+      ln -s ${vimPlugins.mini-nvim} deps/mini.nvim
+
+      # Update dependency check to respect packaged version
+      substituteInPlace lua/grug-far/test/dependencies.lua \
+        --replace-fail "local RG_VERSION = '14.1.0'" "local RG_VERSION = '${lib.getVersion ripgrep}'" \
+        --replace-fail "local SG_VERSION = '0.35.0'" "local SG_VERSION = '${lib.getVersion ast-grep}'"
+
       make test dir=base
       runHook postCheck
     '';
diff --git a/pkgs/development/python-modules/craft-platforms/default.nix b/pkgs/development/python-modules/craft-platforms/default.nix
index 375fac3aaef2..f22f119f3311 100644
--- a/pkgs/development/python-modules/craft-platforms/default.nix
+++ b/pkgs/development/python-modules/craft-platforms/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "craft-platforms";
-  version = "0.7.1";
+  version = "0.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-platforms";
     tag = version;
-    hash = "sha256-+7uaN+ePu+88goPCj9KM3dKhTwV2erP0/Fg05LqOWPg=";
+    hash = "sha256-U57hmQ3UPuwoue8kAxAXiH8ecViryFqIxmpnaAdQnZo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/islpy/default.nix b/pkgs/development/python-modules/islpy/default.nix
index 8738fc22e1f5..c7f6c53cb1bc 100644
--- a/pkgs/development/python-modules/islpy/default.nix
+++ b/pkgs/development/python-modules/islpy/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "islpy";
-  version = "2025.1.3";
+  version = "2025.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "inducer";
     repo = "islpy";
     tag = "v${version}";
-    hash = "sha256-3HUfr0W5X8HaViUD0kpKbdxTTRS/TW6PvAGl8vr03XU=";
+    hash = "sha256-hzqxVLNKm63XliX5rDB54f6n1nJPVJJSAMmNTInbOEE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 3041b8b0a9e9..8c6bda4b7f17 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     tag = version;
-    hash = "sha256-TKn35rrWsHo/5bGriMcPx+lPvhWzmVXU3EG4KU/ebwI=";
+    hash = "sha256-HBNZvU4ZCLgEn8ul1iflaY18novZMnn8GIojriX/ej0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 61f7404a4ced..798ba7ea9ab4 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.13.1";
+  version = "0.13.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = version;
-    hash = "sha256-yEv04y8mkXRmxGmK0UXBRcFdmyAg2xEXYYB0X+0zkao=";
+    hash = "sha256-khO8mu2aWBU9TiorKkMd1e54r5C7ovv6eWyJ61dzOJw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 1bc7c63a7837..02403b23e85e 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.9.3";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = version;
-    hash = "sha256-50L+5WVsYaidz71rkGZny2KlCR3ZfPEQJEPI38MOBWA=";
+    hash = "sha256-Z6Af/PNQkbo+0xn0kEh2I8T03D/gQpuRNHBhLX3mkms=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index b7dc82ca8cf1..cc1e1ce06109 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -16,8 +16,8 @@ let
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
     };
     "10" = {
-      version = "10.8.0";
-      hash = "sha256-Kb8sXOrqeZHugu7BX+cWLg+tgW0MSms1oWwB05J0v2k=";
+      version = "10.8.1";
+      hash = "sha256-2LLrvGXPAsNJ7Ka0XJZAuRDxa2revbe5JunbRA5Hysc=";
     };
   };
 
diff --git a/pkgs/games/minecraft-servers/versions.json b/pkgs/games/minecraft-servers/versions.json
index 0f5a3398401e..86239afe8579 100644
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@@ -1,8 +1,8 @@
 {
   "1.21": {
-    "sha1": "4707d00eb834b446575d89a61a11b5d548d8c001",
-    "url": "https://piston-data.mojang.com/v1/objects/4707d00eb834b446575d89a61a11b5d548d8c001/server.jar",
-    "version": "1.21.4",
+    "sha1": "e6ec2f64e6080b9b5d9b471b291c33cc7f509733",
+    "url": "https://piston-data.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar",
+    "version": "1.21.5",
     "javaVersion": 21
   },
   "1.20": {
diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index a959d2c2130a..743e429c0051 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -179,6 +179,13 @@ in
     platformCanUseHDCPBlob = true;
   };
 
+  armTrustedFirmwareRK3568 = buildArmTrustedFirmware rec {
+    extraMakeFlags = [ "bl31" ];
+    platform = "rk3568";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
+  };
+
   armTrustedFirmwareRK3588 = buildArmTrustedFirmware rec {
     extraMakeFlags = [ "bl31" ];
     platform = "rk3588";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 7d250b0d7bcb..02fd32cee2c9 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -24,6 +24,7 @@
   armTrustedFirmwareAllwinnerH616,
   armTrustedFirmwareRK3328,
   armTrustedFirmwareRK3399,
+  armTrustedFirmwareRK3568,
   armTrustedFirmwareRK3588,
   armTrustedFirmwareS905,
   buildPackages,
@@ -606,6 +607,20 @@ in
     filesToInstall = [ "u-boot.rom" ];
   };
 
+  ubootQuartz64B = buildUBoot {
+    defconfig = "quartz64-b-rk3566_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    filesToInstall = [
+      "idbloader.img"
+      "idbloader-spi.img"
+      "u-boot.itb"
+      "u-boot-rockchip.bin"
+      "u-boot-rockchip-spi.bin"
+    ];
+  };
+
   ubootRaspberryPi = buildUBoot {
     defconfig = "rpi_defconfig";
     extraMeta.platforms = [ "armv6l-linux" ];
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
index 308d5bba3170..137673e9be47 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "sankey-chart";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "MindFreeze";
     repo = "ha-sankey-chart";
     rev = "v${version}";
-    hash = "sha256-Yjh9HrL7zcMFSlXLRW071zG4Wiyv9q2siIw5Ego4e80=";
+    hash = "sha256-krWK2P7tjK5loFYXZ5+b8UN4TEKPObW2QK+3l7+zvj0=";
   };
 
-  npmDepsHash = "sha256-rrzBw+zkvSf6+ABSGfC8rvtQ+pxYyZOPDW7TBpA0ysQ=";
+  npmDepsHash = "sha256-OBgmmPcwpMxXrytP2tHzCFe1imz1S6LHBWJkruw3jgI=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5cd67e0b58e4..5c89b8ac7b66 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -946,6 +946,7 @@ mapAliases {
   libquotient = libsForQt5.libquotient; # Added 2023-11-11
   librarian-puppet-go = throw "'librarian-puppet-go' has been removed, as it's upstream is unmaintained"; # Added 2024-06-10
   librdf = throw "'librdf' has been renamed to/replaced by 'lrdf'"; # Converted to throw 2024-10-17
+  librdf_raptor = throw "librdf_raptor has been remove due to failing to build and being unmaintained"; # Added 2025-04-14
   LibreArp = librearp; # Added 2024-06-12
   LibreArp-lv2 = librearp-lv2; # Added 2024-06-12
   libreddit = throw "'libreddit' has been removed because it is unmaintained upstream. Consider using 'redlib', a maintained fork"; # Added 2024-07-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fdd3e8b1effc..74de04a60503 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -491,6 +491,7 @@ with pkgs;
     buildDotnetGlobalTool
     mkNugetSource
     mkNugetDeps
+    autoPatchcilHook
     ;
 
   dotnetenv = callPackage ../build-support/dotnet/dotnetenv {
@@ -11063,8 +11064,6 @@ with pkgs;
     haskellLib = haskell.lib.compose;
   };
 
-  librdf_raptor = callPackage ../development/libraries/librdf/raptor.nix { };
-
   librdf_raptor2 = callPackage ../development/libraries/librdf/raptor2.nix { };
 
   librdf_rasqal = callPackage ../development/libraries/librdf/rasqal.nix { };
@@ -12737,6 +12736,7 @@ with pkgs;
     armTrustedFirmwareQemu
     armTrustedFirmwareRK3328
     armTrustedFirmwareRK3399
+    armTrustedFirmwareRK3568
     armTrustedFirmwareRK3588
     armTrustedFirmwareS905
     ;
@@ -13311,6 +13311,7 @@ with pkgs;
     ubootQemuArm
     ubootQemuRiscv64Smode
     ubootQemuX86
+    ubootQuartz64B
     ubootRaspberryPi
     ubootRaspberryPi2
     ubootRaspberryPi3_32bit
@@ -14194,10 +14195,6 @@ with pkgs;
     avahi = avahi.override { withLibdnssdCompat = true; };
   };
 
-  keepassxc = libsForQt5.callPackage ../applications/misc/keepassxc {
-    inherit (darwin.apple_sdk_11_0.frameworks) LocalAuthentication;
-  };
-
   evolution-data-server-gtk4 = evolution-data-server.override {
     withGtk3 = false;
     withGtk4 = true;
@@ -14515,7 +14512,23 @@ with pkgs;
 
   inherit (xorg) xlsfonts;
 
-  gimp = callPackage ../applications/graphics/gimp {
+  gimp3 = callPackage ../applications/graphics/gimp {
+    lcms = lcms2;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
+  };
+
+  gimp3-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
+    gimpPlugins = gimp3Plugins;
+    plugins = null; # All packaged plugins enabled, if not explicit plugin list supplied
+  };
+
+  gimp3Plugins = recurseIntoAttrs (
+    callPackage ../applications/graphics/gimp/plugins {
+      gimp = gimp3;
+    }
+  );
+
+  gimp = callPackage ../applications/graphics/gimp/2.0 {
     autoreconfHook = buildPackages.autoreconfHook269;
     lcms = lcms2;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;