diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 54eefb8d9bfe..5c32a58933a6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12351,12 +12351,6 @@
     githubId = 33522919;
     name = "Marshall Arruda";
   };
-  martfont = {
-    name = "Martino Fontana";
-    email = "tinozzo123@tutanota.com";
-    github = "SuperSamus";
-    githubId = 40663462;
-  };
   martijnvermaat = {
     email = "martijn@vermaat.name";
     github = "martijnvermaat";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 43ee855a181d..daa40c97dd5d 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -33,6 +33,8 @@
 
 - `androidenv.androidPkgs_9_0` has been removed, and replaced with `androidenv.androidPkgs` for a more complete Android SDK including support for Android 9 and later.
 
+- `grafana` has been updated to version 11.1. This version doesn't support setting `http_addr` to a hostname anymore, an IP address is expected.
+
 - `wstunnel` has had a major version upgrade that entailed rewriting the program in Rust.
   The module was updated to accommodate for breaking changes.
   Breaking changes to the module API were minimised as much as possible,
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 32919950adc1..eae2658b7ffb 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -105,7 +105,7 @@ let
       };
       url = mkOption {
         type = types.str;
-        default = "localhost";
+        default = "";
         description = "Url of the datasource.";
       };
       editable = mkOption {
diff --git a/nixos/modules/services/web-apps/freshrss.nix b/nixos/modules/services/web-apps/freshrss.nix
index 021101fecaa4..7a22e1523192 100644
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@@ -5,6 +5,15 @@ let
   cfg = config.services.freshrss;
 
   poolName = "freshrss";
+
+  extension-env = pkgs.buildEnv {
+    name = "freshrss-extensions";
+    paths = cfg.extensions;
+  };
+  env-vars = {
+    DATA_PATH = cfg.dataDir;
+    THIRDPARTY_EXTENSIONS_PATH = "${extension-env}/share/freshrss/";
+  };
 in
 {
   meta.maintainers = with maintainers; [ etu stunkymonkey mattchrist ];
@@ -14,6 +23,31 @@ in
 
     package = mkPackageOption pkgs "freshrss" { };
 
+    extensions = mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      defaultText = literalExpression "[]";
+      example = literalExpression ''
+        with freshrss-extensions; [
+          youtube
+        ] ++ [
+          (freshrss-extensions.buildFreshRssExtension {
+            FreshRssExtUniqueId = "ReadingTime";
+            pname = "reading-time";
+            version = "1.5";
+            src = pkgs.fetchFromGitLab {
+              domain = "framagit.org";
+              owner = "Lapineige";
+              repo = "FreshRSS_Extension-ReadingTime";
+              rev = "fb6e9e944ef6c5299fa56ffddbe04c41e5a34ebf";
+             hash = "sha256-C5cRfaphx4Qz2xg2z+v5qRji8WVSIpvzMbethTdSqsk=";
+           };
+          })
+        ]
+      '';
+      description = "Additional extensions to be used.";
+    };
+
     defaultUser = mkOption {
       type = types.str;
       default = "admin";
@@ -214,9 +248,7 @@ in
             "pm.max_spare_servers" = 5;
             "catch_workers_output" = true;
           };
-          phpEnv = {
-            DATA_PATH = "${cfg.dataDir}";
-          };
+          phpEnv = env-vars;
         };
       };
 
@@ -259,9 +291,7 @@ in
             RemainAfterExit = true;
           };
           restartIfChanged = true;
-          environment = {
-            DATA_PATH = cfg.dataDir;
-          };
+          environment = env-vars;
 
           script =
             let
@@ -293,9 +323,7 @@ in
         description = "FreshRSS feed updater";
         after = [ "freshrss-config.service" ];
         startAt = "*:0/5";
-        environment = {
-          DATA_PATH = cfg.dataDir;
-        };
+        environment = env-vars;
         serviceConfig = defaultServiceConfig // {
           ExecStart = "${cfg.package}/app/actualize_script.php";
         };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d16b747bfa95..3989ab5956fa 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -337,6 +337,7 @@ in {
   freenet = handleTest ./freenet.nix {};
   freeswitch = handleTest ./freeswitch.nix {};
   freetube = discoverTests (import ./freetube.nix);
+  freshrss-extensions = handleTest ./freshrss-extensions.nix {};
   freshrss-sqlite = handleTest ./freshrss-sqlite.nix {};
   freshrss-pgsql = handleTest ./freshrss-pgsql.nix {};
   freshrss-http-auth = handleTest ./freshrss-http-auth.nix {};
diff --git a/nixos/tests/freshrss-extensions.nix b/nixos/tests/freshrss-extensions.nix
new file mode 100644
index 000000000000..f3e893b3b5a8
--- /dev/null
+++ b/nixos/tests/freshrss-extensions.nix
@@ -0,0 +1,19 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "freshrss";
+
+  nodes.machine = { pkgs, ... }: {
+    services.freshrss = {
+      enable = true;
+      baseUrl = "http://localhost";
+      authType = "none";
+      extensions = [ pkgs.freshrss-extensions.youtube ];
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(80)
+    response = machine.succeed("curl -vvv -s http://127.0.0.1:80/i/?c=extension")
+    assert '<span class="ext_name disabled">YouTube Video Feed</span>' in response, "Extension not present in extensions page."
+  '';
+})
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index dd389bc8a3d1..fae6bd4dbbcf 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -10,7 +10,7 @@ let
         analytics.reporting_enabled = false;
 
         server = {
-          http_addr = "localhost";
+          http_addr = "::1";
           domain = "localhost";
         };
 
@@ -47,7 +47,7 @@ let
 
     postgresql = {
       services.grafana.settings.database = {
-        host = "127.0.0.1:5432";
+        host = "[::1]:5432";
         user = "grafana";
       };
       services.postgresql = {
@@ -91,9 +91,9 @@ in {
 
     with subtest("Declarative plugins installed"):
         declarativePlugins.wait_for_unit("grafana.service")
-        declarativePlugins.wait_for_open_port(3000)
+        declarativePlugins.wait_for_open_port(3000, addr="::1")
         declarativePlugins.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/plugins | grep grafana-clock-panel"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/plugins | grep grafana-clock-panel"
         )
         declarativePlugins.shutdown()
 
@@ -101,10 +101,10 @@ in {
         sqlite.wait_for_unit("grafana.service")
         sqlite.wait_for_open_port(3000)
         print(sqlite.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users -i"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/org/users -i"
         ))
         sqlite.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/org/users | grep admin\@localhost"
         )
         sqlite.shutdown()
 
@@ -112,10 +112,10 @@ in {
         socket.wait_for_unit("grafana.service")
         socket.wait_for_open_port(80)
         print(socket.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1/api/org/users -i"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]/api/org/users -i"
         ))
         socket.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1/api/org/users | grep admin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]/api/org/users | grep admin\@localhost"
         )
         socket.shutdown()
 
@@ -125,7 +125,7 @@ in {
         postgresql.wait_for_open_port(3000)
         postgresql.wait_for_open_port(5432)
         postgresql.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/org/users | grep admin\@localhost"
         )
         postgresql.shutdown()
 
@@ -135,7 +135,7 @@ in {
         mysql.wait_for_open_port(3000)
         mysql.wait_for_open_port(3306)
         mysql.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/org/users | grep admin\@localhost"
         )
         mysql.shutdown()
   '';
diff --git a/nixos/tests/grafana/provision/default.nix b/nixos/tests/grafana/provision/default.nix
index f9dd8b2961ac..775fae9b71ba 100644
--- a/nixos/tests/grafana/provision/default.nix
+++ b/nixos/tests/grafana/provision/default.nix
@@ -11,7 +11,7 @@ let
         analytics.reporting_enabled = false;
 
         server = {
-          http_addr = "localhost";
+          http_addr = "::1";
           domain = "localhost";
         };
 
@@ -177,41 +177,41 @@ in {
     for description, machine in [nodeNix, nodeYaml, nodeYamlDir]:
         with subtest(f"Should start provision node: {description}"):
             machine.wait_for_unit("grafana.service")
-            machine.wait_for_open_port(3000)
+            machine.wait_for_open_port(3000, addr="::1")
 
         with subtest(f"Successful datasource provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/datasources/uid/test_datasource | grep Test\ Datasource"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/datasources/uid/test_datasource | grep Test\ Datasource"
             )
 
         with subtest(f"Successful dashboard provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/dashboards/uid/test_dashboard | grep Test\ Dashboard"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/dashboards/uid/test_dashboard | grep Test\ Dashboard"
             )
 
         with subtest(f"Successful rule provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/alert-rules/test_rule | grep Test\ Rule"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/v1/provisioning/alert-rules/test_rule | grep Test\ Rule"
             )
 
         with subtest(f"Successful contact point provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/contact-points | grep Test\ Contact\ Point"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/v1/provisioning/contact-points | grep Test\ Contact\ Point"
             )
 
         with subtest(f"Successful policy provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/policies | grep Test\ Contact\ Point"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/v1/provisioning/policies | grep Test\ Contact\ Point"
             )
 
         with subtest(f"Successful template provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/templates | grep Test\ Template"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/v1/provisioning/templates | grep Test\ Template"
             )
 
         with subtest("Successful mute timings provision with {description}"):
             machine.succeed(
-                "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/mute-timings | grep Test\ Mute\ Timing"
+                "curl -sSfN -u testadmin:snakeoilpwd http://[::1]:3000/api/v1/provisioning/mute-timings | grep Test\ Mute\ Timing"
             )
   '';
 })
diff --git a/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff b/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
deleted file mode 100644
index b8277f32afc9..000000000000
--- a/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/plugins/gpgme-vala/vapi/gpgme_public.vapi b/plugins/gpgme-vala/vapi/gpgme_public.vapi
-index bcf12569..b32efd03 100644
---- a/plugins/gpgme-vala/vapi/gpgme_public.vapi
-+++ b/plugins/gpgme-vala/vapi/gpgme_public.vapi
-@@ -22,9 +22,9 @@ public class Key {
-     public string issuer_name;
-     public string chain_id;
-     public Validity owner_trust;
--    [CCode(array_null_terminated = true)]
-+    [CCode(array_length = false, array_null_terminated = true)]
-     public SubKey[] subkeys;
--    [CCode(array_null_terminated = true)]
-+    [CCode(array_length = false, array_null_terminated = true)]
-     public UserID[] uids;
-     public KeylistMode keylist_mode;
-     // public string fpr; // requires gpgme >= 1.7.0
diff --git a/pkgs/applications/virtualization/docker/buildx.nix b/pkgs/applications/virtualization/docker/buildx.nix
index 609b0e97deb0..3b5f5669d7f7 100644
--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.14.1";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-IseiGF+tQWv7Z2jlCINuWH2Gzcdow2qazvYVFBGyQPU=";
+    hash = "sha256-JaUCj9HY0MhHLkPTRd72NaGlBdPCPc+y2XjhVQ/3+NA=";
   };
 
   doCheck = false;
diff --git a/pkgs/by-name/vv/vvvvvv/package.nix b/pkgs/by-name/vv/vvvvvv/package.nix
index a03f3617d2ff..73639236526f 100644
--- a/pkgs/by-name/vv/vvvvvv/package.nix
+++ b/pkgs/by-name/vv/vvvvvv/package.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://thelettervsixtim.es";
     license = licenses.unfree;
-    maintainers = with maintainers; [ martfont ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/compilers/openjdk/info.json b/pkgs/development/compilers/openjdk/info.json
index c8f88d7280e4..d4df70b8597f 100644
--- a/pkgs/development/compilers/openjdk/info.json
+++ b/pkgs/development/compilers/openjdk/info.json
@@ -1,8 +1,8 @@
 {
   "22": {
-    "version": "22-ga",
+    "version": "22.0.1-ga",
     "repo":    "jdk22u",
-    "hash":    "sha256-itjvIedPwJl/l3a2gIVpNMs1zkbrjioVqbCj1Z1nCJE="
+    "hash":    "sha256-wCHgharBnvRSB3dWW8C3e80AZtxyFgP0SS5X1d4LzMc="
   },
   "21": {
     "version": "21.0.3-ga",
diff --git a/pkgs/development/libraries/openxr-loader/default.nix b/pkgs/development/libraries/openxr-loader/default.nix
index f153d7f2f18b..710d985ee346 100644
--- a/pkgs/development/libraries/openxr-loader/default.nix
+++ b/pkgs/development/libraries/openxr-loader/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openxr-loader";
-  version = "1.1.37";
+  version = "1.1.38";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenXR-SDK-Source";
     rev = "release-${version}";
-    sha256 = "sha256-J9IfhTFFSY+rK0DqFdXtINo7nlGUcy2Lljq81T417qc=";
+    sha256 = "sha256-nM/c6fvjprQ5GQO4F13cOigi4xATgRTq+ebEwyv58gg=";
   };
 
   nativeBuildInputs = [ cmake python3 pkg-config ];
diff --git a/pkgs/development/libraries/rapidyaml/default.nix b/pkgs/development/libraries/rapidyaml/default.nix
index a51b675bd918..2af9968c842c 100644
--- a/pkgs/development/libraries/rapidyaml/default.nix
+++ b/pkgs/development/libraries/rapidyaml/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     description = "Library to parse and emit YAML, and do it fast";
     homepage = "https://github.com/biojppm/rapidyaml";
     license = licenses.mit;
-    maintainers = with maintainers; [ martfont ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index 4f3fbb94be09..a4b20a75d15b 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "testcontainers";
-  version = "4.7.0";
+  version = "4.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "testcontainers";
     repo = "testcontainers-python";
     rev = "refs/tags/testcontainers-v${version}";
-    hash = "sha256-DX2s3Z3QM8qzUr5nM+9erJG/XHkB96h8S4+KYDfcA8A=";
+    hash = "sha256-li9okYMPW6PM03cFQRfHKzr48eOguNXmmHnSCBgDqYo=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 927a011ded28..ad285956866a 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -3,26 +3,22 @@
 , yarn, nodejs, python3, cacert
 , jq, moreutils
 , nix-update-script, nixosTests, xcbuild
-, util-linux
+, faketty
 }:
 
 let
-  # We need dev dependencies to run webpack, but patch away
-  # `cypress` (and @grafana/e2e which has a direct dependency on cypress).
-  # This attempts to download random blobs from the Internet in
-  # postInstall. Also, it's just a testing framework, so not worth the hassle.
-  patchAwayGrafanaE2E = ''
-    find . -name package.json | while IFS=$'\n' read -r pkg_json; do
-      <"$pkg_json" jq '. + {
-        "devDependencies": .devDependencies | del(."@grafana/e2e") | del(.cypress)
-      }' | sponge "$pkg_json"
-    done
-    rm -r packages/grafana-e2e
+  # Grafana seems to just set it to the latest version available
+  # nowadays.
+  patchGoVersion = ''
+    substituteInPlace go.{mod,work} pkg/build/wire/go.mod \
+      --replace-fail "go 1.22.4" "go 1.22.3"
+    substituteInPlace Makefile \
+      --replace-fail "GO_VERSION = 1.22.4" "GO_VERSION = 1.22.3"
   '';
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "11.0.0";
+  version = "11.1.0";
 
   subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];
 
@@ -30,11 +26,13 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-cC1dpgb8IiyPIqlVvn8Qi1l7j6lLtQF+BOOO+DQCp4E=";
+    hash = "sha256-iTTT10YN8jBT4/ukGXNK1QHcyzXnAqg2LiFtNiwnENw=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
-  env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
+  env = {
+    CYPRESS_INSTALL_BINARY = 0;
+  } // lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
     # Fix error: no member named 'aligned_alloc' in the global namespace.
     # Occurs while building @esfx/equatable@npm:1.0.2 on x86_64-darwin
     NIX_CFLAGS_COMPILE = "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
@@ -49,7 +47,7 @@ buildGoModule rec {
     # @esfx/equatable@npm:1.0.2 fails to build on darwin as it requires `xcbuild`
     ] ++ lib.optionals stdenv.isDarwin [ xcbuild.xcbuild ];
     postPatch = ''
-      ${patchAwayGrafanaE2E}
+      ${patchGoVersion}
     '';
     buildPhase = ''
       runHook preBuild
@@ -66,23 +64,24 @@ buildGoModule rec {
     dontFixup = true;
     outputHashMode = "recursive";
     outputHash = rec {
-      x86_64-linux = "sha256-+Udq8oQSIAHku55VKnrfgHHevzBels0QiOZwnwuts8k=";
+      x86_64-linux = "sha256-2VnhZBWLdYQhqKCxM63fCAwQXN4Zrh2wCdPBLCCUuvg=";
       aarch64-linux = x86_64-linux;
-      aarch64-darwin = "sha256-m3jtZNz0J2nZwFHXVp3ApgDfnGBOJvFeUpqOPQqv200=";
+      aarch64-darwin = "sha256-MZE3/PHynL6SHOxJgOG41pi2X8XeutruAOyUFY9Lmsc=";
       x86_64-darwin = aarch64-darwin;
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
   disallowedRequisites = [ offlineCache ];
 
-  vendorHash = "sha256-kcdW6RQghyAOZUDmIo9G6YBC+YaLHdafvj+fCd+dcDE=";
+  vendorHash = "sha256-Ny/SoelFVPvBBn50QpHcLTuVY3ynKbCegM1uQkJzB9Y=";
 
   proxyVendor = true;
 
-  nativeBuildInputs = [ wire yarn jq moreutils removeReferencesTo python3 ] ++ lib.optionals stdenv.isDarwin [ xcbuild.xcbuild ];
+  nativeBuildInputs = [ wire yarn jq moreutils removeReferencesTo python3 faketty ]
+    ++ lib.optionals stdenv.isDarwin [ xcbuild.xcbuild ];
 
   postPatch = ''
-    ${patchAwayGrafanaE2E}
+    ${patchGoVersion}
   '';
 
   postConfigure = ''
@@ -115,7 +114,7 @@ buildGoModule rec {
     # After having built all the Go code, run the JS builders now.
 
     # Workaround for https://github.com/nrwl/nx/issues/22445
-    ${util-linux}/bin/script -c 'yarn run build' /dev/null
+    faketty yarn run build
     yarn run plugins:build-bundled
   '';
 
@@ -156,8 +155,5 @@ buildGoModule rec {
     maintainers = with maintainers; [ offline fpletz willibutz globin ma27 Frostman ];
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
     mainProgram = "grafana-server";
-    # requires util-linux to work around https://github.com/nrwl/nx/issues/22445
-    # `script` doesn't seem to be part of util-linux on Darwin though.
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index f43aa15887cf..78c73719b481 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , nixosTests
 , php
+, writeText
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -16,26 +17,33 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-AAOON1RdbG6JSnCc123jmIlIXHOE1PE49BV4hcASO/s=";
   };
 
-  passthru.tests = {
-    inherit (nixosTests) freshrss-sqlite freshrss-pgsql freshrss-http-auth freshrss-none-auth;
-  };
+  postPatch = ''
+    patchShebangs cli/*.php app/actualize_script.php
+  '';
+
+  # the thirdparty_extension_path can only be set by config, but should be read by an env-var.
+  overrideConfig = writeText "constants.local.php" ''
+    <?php
+      define('THIRDPARTY_EXTENSIONS_PATH', getenv('THIRDPARTY_EXTENSIONS_PATH') . '/extensions');
+  '';
 
   buildInputs = [ php ];
 
   # There's nothing to build.
   dontBuild = true;
 
-  postPatch = ''
-    patchShebangs cli/*.php app/actualize_script.php
-  '';
-
   installPhase = ''
     runHook preInstall
     mkdir -p $out
     cp -vr * $out/
+    cp $overrideConfig $out/constants.local.php
     runHook postInstall
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) freshrss-sqlite freshrss-pgsql freshrss-http-auth freshrss-none-auth freshrss-extensions;
+  };
+
   meta = with lib; {
     description = "FreshRSS is a free, self-hostable RSS aggregator";
     homepage = "https://www.freshrss.org/";
diff --git a/pkgs/servers/web-apps/freshrss/extensions/default.nix b/pkgs/servers/web-apps/freshrss/extensions/default.nix
new file mode 100644
index 000000000000..c8d779f7933d
--- /dev/null
+++ b/pkgs/servers/web-apps/freshrss/extensions/default.nix
@@ -0,0 +1,138 @@
+{ config
+, lib
+, fetchFromGitHub
+, fetchFromGitLab
+, callPackage
+}:
+
+let
+  buildFreshRssExtension = (callPackage ./freshrss-utils.nix { }).buildFreshRssExtension;
+
+  official_extensions_version = "unstable-2024-04-27";
+  official_extensions_src = fetchFromGitHub {
+    owner = "FreshRSS";
+    repo = "Extensions";
+    rev = "71de129744ba37fd4cf363b78445f5345bc6d0b7";
+    hash = "sha256-A+hOjbGNfhwTOAMeo08MUdqfWxxetzLz865oQQDsQlg=";
+  };
+
+  baseExtensions =
+    _self:
+    lib.mapAttrs (_n: lib.recurseIntoAttrs) {
+      auto-ttl = buildFreshRssExtension rec {
+        FreshRssExtUniqueId = "AutoTTL";
+        pname = "auto-ttl";
+        version = "0.5.0";
+        src = fetchFromGitHub {
+          owner = "mgnsk";
+          repo = "FreshRSS-AutoTTL";
+          rev = "v${version}";
+          hash = "sha256-OiTiLZ2BjQD1W/BD8EkUt7WB2wOjL6GMGJ+APT4YpwE=";
+        };
+        meta = {
+          description = "FreshRSS extension for automatic feed refresh TTL based on the average frequency of entries.";
+          homepage = "https://github.com/mgnsk/FreshRSS-AutoTTL";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
+      demo = buildFreshRssExtension {
+        FreshRssExtUniqueId = "Demo";
+        pname = "demo";
+        version = "unstable-2023-12-22";
+        src = fetchFromGitHub {
+          owner = "FreshRSS";
+          repo = "xExtension-Demo";
+          rev = "8d60f71a2f0411f5fbbb1f88a57791cee0848f35";
+          hash = "sha256-5fe8TjefSiGMaeZkurxSJjX8qEEa1ArhJxDztp7ZNZc=";
+        };
+        meta = {
+          description = "FreshRSS Extension for the demo version.";
+          homepage = "https://github.com/FreshRSS/xExtension-Demo";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
+      reading-time = buildFreshRssExtension rec {
+        FreshRssExtUniqueId = "ReadingTime";
+        pname = "reading-time";
+        version = "1.5";
+        src = fetchFromGitLab {
+          domain = "framagit.org";
+          owner = "Lapineige";
+          repo = "FreshRSS_Extension-ReadingTime";
+          rev = "fb6e9e944ef6c5299fa56ffddbe04c41e5a34ebf";
+          hash = "sha256-C5cRfaphx4Qz2xg2z+v5qRji8WVSIpvzMbethTdSqsk=";
+        };
+        meta = {
+          description = "FreshRSS extension adding a reading time estimation next to each article.";
+          homepage = "https://framagit.org/Lapineige/FreshRSS_Extension-ReadingTime";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
+      reddit-image = buildFreshRssExtension rec {
+        FreshRssExtUniqueId = "RedditImage";
+        pname = "reddit-image";
+        version = "1.2.0";
+        src = fetchFromGitHub {
+          owner = "aledeg";
+          repo = "xExtension-RedditImage";
+          rev = "v${version}";
+          hash = "sha256-H/uxt441ygLL0RoUdtTn9Q6Q/Ois8RHlhF8eLpTza4Q=";
+        };
+        meta = {
+          description = "FreshRSS extension to process Reddit feeds.";
+          homepage = "https://github.com/aledeg/xExtension-RedditImage";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
+      title-wrap = buildFreshRssExtension {
+        FreshRssExtUniqueId = "TitleWrap";
+        pname = "title-wrap";
+        version = official_extensions_version;
+        src = official_extensions_src;
+        sourceRoot = "source/xExtension-TitleWrap";
+        meta = {
+          description = "FreshRSS extension instead of truncating the title is wrapped.";
+          homepage = "https://github.com/FreshRSS/Extensions/tree/master/xExtension-TitleWrap";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
+      youtube = buildFreshRssExtension {
+        FreshRssExtUniqueId = "YouTube";
+        pname = "youtube";
+        version = official_extensions_version;
+        src = official_extensions_src;
+        sourceRoot = "source/xExtension-YouTube";
+        meta = {
+          description = "FreshRSS extension allows you to directly watch YouTube/PeerTube videos from within subscribed channel feeds.";
+          homepage = "https://github.com/FreshRSS/Extensions/tree/master/xExtension-YouTube";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+    };
+
+  # add possibility to define aliases
+  aliases = super: {
+    # example:  RedditImage = super.reddit-image;
+  };
+
+  # overlays will be applied left to right, overrides should come after aliases.
+  overlays = lib.optionals config.allowAliases [
+    (_self: super: lib.recursiveUpdate super (aliases super))
+  ];
+
+  toFix = lib.foldl' (lib.flip lib.extends) baseExtensions overlays;
+in
+(lib.fix toFix) // {
+  inherit buildFreshRssExtension;
+}
diff --git a/pkgs/servers/web-apps/freshrss/extensions/freshrss-utils.nix b/pkgs/servers/web-apps/freshrss/extensions/freshrss-utils.nix
new file mode 100644
index 000000000000..bd0fc8f6de54
--- /dev/null
+++ b/pkgs/servers/web-apps/freshrss/extensions/freshrss-utils.nix
@@ -0,0 +1,45 @@
+{ stdenv, unzip }:
+let
+  buildFreshRssExtension =
+    args@{ pname
+    , version
+    , src
+    , FreshRssExtUniqueId
+    , configurePhase ? ''
+        runHook preConfigure
+        runHook postConfigure
+      ''
+    , buildPhase ? ''
+        runHook preBuild
+        runHook postBuild
+      ''
+    , dontPatchELF ? true
+    , dontStrip ? true
+    , passthru ? { }
+    , sourceRoot ? "source"
+    , ...
+    }:
+    stdenv.mkDerivation ((removeAttrs args [ "FreshRssExtUniqueId" ]) // {
+      pname = "freshrss-extension-${pname}";
+
+      inherit version src configurePhase buildPhase dontPatchELF dontStrip sourceRoot;
+
+      installPrefix = "share/freshrss/extensions/xExtension-${FreshRssExtUniqueId}";
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p "$out/$installPrefix"
+        find . -mindepth 1 -maxdepth 1 | xargs -d'\n' mv -t "$out/$installPrefix/"
+
+        runHook postInstall
+      '';
+
+      passthru = passthru // {
+        inherit FreshRssExtUniqueId;
+      };
+    });
+in
+{
+  inherit buildFreshRssExtension;
+}
diff --git a/pkgs/tools/graphics/vkbasalt-cli/default.nix b/pkgs/tools/graphics/vkbasalt-cli/default.nix
index efe704ace293..4d99b4efb413 100644
--- a/pkgs/tools/graphics/vkbasalt-cli/default.nix
+++ b/pkgs/tools/graphics/vkbasalt-cli/default.nix
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
     description = "Command-line utility for vkBasalt";
     homepage = "https://gitlab.com/TheEvilSkeleton/vkbasalt-cli";
     license = with licenses; [ lgpl3Only gpl3Only ];
-    maintainers = with maintainers; [ martfont ];
+    maintainers = with maintainers; [ ];
     mainProgram = "vkbasalt";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 74460a9b6572..e87db2f730a8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25505,6 +25505,7 @@ with pkgs;
   freeradius = callPackage ../servers/freeradius { };
 
   freshrss = callPackage ../servers/web-apps/freshrss { };
+  freshrss-extensions = recurseIntoAttrs (callPackage ../servers/web-apps/freshrss/extensions { });
 
   freeswitch = callPackage ../servers/sip/freeswitch {
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;