Merge staging-next into staging

doc/hooks/autopatchcil.section.md

···
+# autoPatchcilHook {#setup-hook-autopatchcilhook}
+
+This is a special setup hook which helps in packaging .NET assemblies/programs in that it automatically tries to find missing shared library dependencies of .NET assemblies based on the given `buildInputs` and `nativeBuildInputs`.
+
+As the hook needs information for the host where the package will be run on, there's a required environment variable called `autoPatchcilRuntimeId` which should be filled in with the RID (Runtime Identifier) of the machine where the output will be run on. If you're using `buildDotnetModule`, it will fall back to `dotnetRuntimeIds` (which is set to `lib.singleton (if runtimeId != null then runtimeId else systemToDotnetRid stdenvNoCC.hostPlatform.system)`) for you if not provided.
+
+In certain situations you may want to run the main command (`autoPatchcil`) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the `dontAutoPatchcil` environment variable to a non-empty value.
+
+By default, `autoPatchcil` will fail as soon as any .NET assembly requires a dependency which cannot be resolved via the given build inputs. In some situations you might prefer to just leave missing dependencies unpatched and continue to patch the rest. This can be achieved by setting the `autoPatchcilIgnoreMissingDeps` environment variable to a non-empty value. `autoPatchcilIgnoreMissingDeps` can be set to a list like `autoPatchcilIgnoreMissingDeps = [ "libcuda.so.1" "libcudart.so.1" ];` or to `[ "*" ]` to ignore all missing dependencies.
+
+The `autoPatchcil` command requires the `--rid` command line flag, informing the RID (Runtime Identifier) it should assume the assemblies will be executed on, and also recognizes a `--no-recurse` command line flag, which prevents it from recursing into subdirectories.
+
+::: {.note}
+Since, unlike most native binaries, .NET assemblies are compiled once to run on any platform, many assemblies may have PInvoke stubs for libraries that might not be available on the platform that the package will effectively run on. A few examples are assemblies that call native Windows APIs through PInvoke targeting `kernel32`, `gdi32`, `user32`, `shell32` or `ntdll`.
+
+`autoPatchcil` does its best to ignore dependencies from other platforms by checking the requested file extensions, however not all PInvoke stubs provide an extension so in those cases it will be necessary to list those in `autoPatchcilIgnoreMissingDeps` manually.
+:::

doc/hooks/index.md

···
 ```{=include=} sections
 autoconf.section.md
 automake.section.md
+autopatchcil.section.md
 autopatchelf.section.md
 aws-c-common.section.md
 bmake.section.md

doc/redirects.json

···
   "setup-hook-automake": [
     "index.html#setup-hook-automake"
   ],
+  "setup-hook-autopatchcilhook": [
+    "index.html#setup-hook-autopatchcilhook"
+  ],
   "setup-hook-autopatchelfhook": [
     "index.html#setup-hook-autopatchelfhook"
   ],

doc/release-notes/rl-2505.section.md

···
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
   The `name` argument will become mandatory in a future release.
 
+- [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`.
+
 - `grafana-agent` and `services.grafana-agent` have been removed in favor of
   Grafana Alloy (`grafana-alloy` and `services.alloy`), as they depend on an EOL compiler version
   and will become EOL during the 25.05 lifecycle.

maintainers/maintainer-list.nix

···
     githubId = 6470493;
     name = "Craige McWhirter";
   };
+  craigf = {
+    email = "[e-mail]";
+    github = "craigfurman";
+    githubId = 4772216;
+    name = "Craig Furman";
+  };
   cransom = {
     email = "[e-mail]";
     github = "cransom";

maintainers/scripts/luarocks-packages.csv

···
 argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
-bit32,,,,5.3.0-1,5.1,lblasc
+bit32,,,,,5.1,lblasc
 busted,,,,,,
 busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.
 
+- `services.homepage-dashboard` now requires the `allowedHosts` option to be set in accordance with the [documentation](https://gethomepage.dev/installation/#homepage_allowed_hosts).
+
 - `services.netbird.tunnels` was renamed to [`services.netbird.clients`](#opt-services.netbird.clients),
   hardened (using dedicated less-privileged users) and significantly extended.
 

nixos/modules/module-list.nix

···
   ./services/networking/atticd.nix
   ./services/networking/autossh.nix
   ./services/networking/avahi-daemon.nix
+  ./services/networking/ax25/axlisten.nix
+  ./services/networking/ax25/axports.nix
   ./services/networking/babeld.nix
   ./services/networking/bee.nix
   ./services/networking/biboumi.nix

nixos/modules/services/misc/homepage-dashboard.nix

···
   lib,
   ...
 }:
-
 let
   cfg = config.services.homepage-dashboard;
   # Define the settings format used for this program
···
         type = lib.types.int;
         default = 8082;
         description = "Port for Homepage to bind to.";
+      };
+
+      allowedHosts = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost:8082,127.0.0.1:8082";
+        example = "example.com";
+        description = ''
+          Hosts that homepage-dashboard will be running under.
+          You will want to change this in order to acess homepage from anything other than localhost.
+          see the upsream documentation:
+
+          <https://gethomepage.dev/installation/#homepage_allowed_hosts>
+        '';
       };
 
       environmentFile = lib.mkOption {
···
         NIXPKGS_HOMEPAGE_CACHE_DIR = "/var/cache/homepage-dashboard";
         PORT = toString cfg.listenPort;
         LOG_TARGETS = "stdout";
+        HOMEPAGE_ALLOWED_HOSTS = cfg.allowedHosts;
       };
 
       serviceConfig = {

nixos/modules/services/networking/ax25/axlisten.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    literalExpression
+    ;
+
+  cfg = config.services.ax25.axlisten;
+in
+{
+  options = {
+
+    services.ax25.axlisten = {
+
+      enable = mkEnableOption "AX.25 axlisten daemon";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.ax25-apps;
+        defaultText = literalExpression "pkgs.ax25-apps";
+        description = "The ax25-apps package to use.";
+      };
+
+      config = mkOption {
+        type = types.str;
+        default = "-art";
+        description = ''
+          Options that will be passed to the axlisten daemon.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.axlisten = {
+      description = "AX.25 traffic monitor";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "ax25-axports.target" ];
+      requires = [ "ax25-axports.target" ];
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${cfg.package}/bin/axlisten ${cfg.config}";
+      };
+    };
+  };
+}

nixos/modules/services/networking/ax25/axports.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    ;
+
+  inherit (lib.strings)
+    concatStringsSep
+    optionalString
+    ;
+
+  inherit (lib.attrsets)
+    filterAttrs
+    mapAttrsToList
+    mapAttrs'
+    ;
+
+  inherit (lib.modules)
+    mkIf
+    ;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    ;
+
+  cfg = config.services.ax25.axports;
+
+  enabledAxports = filterAttrs (ax25Name: cfg: cfg.enable) cfg;
+
+  axportsOpts = {
+
+    options = {
+      enable = mkEnableOption "Enables the axport interface";
+
+      package = mkPackageOption pkgs "ax25-tools" { };
+
+      tty = mkOption {
+        type = types.str;
+        example = "/dev/ttyACM0";
+        description = ''
+          Location of hardware kiss tnc for this interface.
+        '';
+      };
+
+      callsign = mkOption {
+        type = types.str;
+        example = "WB6WLV-7";
+        description = ''
+          The callsign of the physical interface to bind to.
+        '';
+      };
+
+      description = mkOption {
+        type = types.str;
+        # This cannot be empty since some ax25 tools cant parse /etc/ax25/axports without it
+        default = "NixOS managed tnc";
+        description = ''
+          Free format description of this interface.
+        '';
+      };
+
+      baud = mkOption {
+        type = types.int;
+        example = 57600;
+        description = ''
+          The serial port speed of this interface.
+        '';
+      };
+
+      paclen = mkOption {
+        type = types.int;
+        default = 255;
+        description = ''
+          Default maximum packet size for this interface.
+        '';
+      };
+
+      window = mkOption {
+        type = types.int;
+        default = 7;
+        description = ''
+          Default window size for this interface.
+        '';
+      };
+
+      kissParams = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "-t 300 -l 10 -s 12 -r 80 -f n";
+        description = ''
+          Kissattach parameters for this interface.
+        '';
+      };
+    };
+  };
+in
+{
+
+  options = {
+
+    services.ax25.axports = mkOption {
+      type = types.attrsOf (types.submodule axportsOpts);
+      default = { };
+      description = "Specification of one or more AX.25 ports.";
+    };
+  };
+
+  config = mkIf (enabledAxports != { }) {
+
+    environment.etc."ax25/axports" = {
+      text = concatStringsSep "\n" (
+        mapAttrsToList (
+          portName: portCfg:
+          "${portName} ${portCfg.callsign} ${toString portCfg.baud} ${toString portCfg.paclen} ${toString portCfg.window} ${portCfg.description}"
+        ) enabledAxports
+      );
+      mode = "0644";
+    };
+
+    systemd.targets.ax25-axports = {
+      description = "AX.25 axports group target";
+    };
+
+    systemd.services = mapAttrs' (portName: portCfg: {
+      name = "ax25-kissattach-${portName}";
+      value = {
+        description = "AX.25 KISS attached interface for ${portName}";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "ax25-axports.target" ];
+        partOf = [ "ax25-axports.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${portCfg.package}/bin/kissattach ${portCfg.tty} ${portName}";
+        };
+        postStart = optionalString (portCfg.kissParams != null) ''
+          ${portCfg.package}/bin/kissparms -p ${portName} ${portCfg.kissParams}
+        '';
+      };
+    }) enabledAxports;
+  };
+}

nixos/tests/all-tests.nix

···
   atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
+  ax25 = handleTest ./ax25.nix { };
   audiobookshelf = runTest ./audiobookshelf.nix;
   auth-mysql = runTest ./auth-mysql.nix;
   authelia = runTest ./authelia.nix;
···
   mediatomb = handleTest ./mediatomb.nix { };
   mediawiki = handleTest ./mediawiki.nix { };
   meilisearch = handleTest ./meilisearch.nix { };
-  memcached = handleTest ./memcached.nix { };
+  memcached = runTest ./memcached.nix;
   merecat = handleTest ./merecat.nix { };
   metabase = handleTest ./metabase.nix { };
   mihomo = handleTest ./mihomo.nix { };
···
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix { };
   nextcloud = handleTest ./nextcloud { };
-  nextflow = handleTestOn [ "x86_64-linux" ] ./nextflow.nix { };
+  nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = handleTest ./nexus.nix { };
   # TODO: Test nfsv3 + Kerberos
···
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
-  static-web-server = handleTest ./web-servers/static-web-server.nix { };
+  static-web-server = runTest ./web-servers/static-web-server.nix;
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
   stratis = handleTest ./stratis { };
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix { };

nixos/tests/ax25.nix

···
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+
+    baud = 57600;
+    tty = "/dev/ttyACM0";
+    port = "tnc0";
+    socatPort = 1234;
+
+    createAX25Node = nodeId: {
+
+      boot.kernelPackages = pkgs.linuxPackages_ham;
+      boot.kernelModules = [ "ax25" ];
+
+      networking.firewall.allowedTCPPorts = [ socatPort ];
+
+      environment.systemPackages = with pkgs; [
+        libax25
+        ax25-tools
+        ax25-apps
+        socat
+      ];
+
+      services.ax25.axports."${port}" = {
+        inherit baud tty;
+        enable = true;
+        callsign = "NOCALL-${toString nodeId}";
+        description = "mocked tnc";
+      };
+
+      services.ax25.axlisten = {
+        enable = true;
+      };
+
+      # All mocks radios will connect back to socat-broker on node 1 in order to get
+      # all messages that are "broadcasted over the ether"
+      systemd.services.ax25-mock-hardware = {
+        description = "mock AX.25 TNC and Radio";
+        wantedBy = [ "default.target" ];
+        before = [
+          "ax25-kissattach-${port}.service"
+          "axlisten.service"
+        ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "exec";
+          ExecStart = "${pkgs.socat}/bin/socat -d -d tcp:192.168.1.1:${toString socatPort} pty,link=${tty},b${toString baud},raw";
+        };
+      };
+    };
+  in
+  {
+    name = "ax25Simple";
+    nodes = {
+      node1 = lib.mkMerge [
+        (createAX25Node 1)
+        # mimicking radios on the same frequency
+        {
+          systemd.services.ax25-mock-ether = {
+            description = "mock radio ether";
+            wantedBy = [ "default.target" ];
+            requires = [ "network.target" ];
+            before = [ "ax25-mock-hardware.service" ];
+            # broken needs access to "ss" or "netstat"
+            path = [ pkgs.iproute2 ];
+            serviceConfig = {
+              Type = "exec";
+              ExecStart = "${pkgs.socat}/bin/socat-broker.sh tcp4-listen:${toString socatPort}";
+            };
+            postStart = "${pkgs.coreutils}/bin/sleep 2";
+          };
+        }
+      ];
+      node2 = createAX25Node 2;
+      node3 = createAX25Node 3;
+    };
+    testScript =
+      { ... }:
+      ''
+        def wait_for_machine(m):
+          m.succeed("lsmod | grep ax25")
+          m.wait_for_unit("ax25-axports.target")
+          m.wait_for_unit("axlisten.service")
+          m.fail("journalctl -o cat -u axlisten.service | grep -i \"no AX.25 port data configured\"")
+
+        # start the first node since the socat-broker needs to be running
+        node1.start()
+        node1.wait_for_unit("ax25-mock-ether.service")
+        wait_for_machine(node1)
+
+        node2.start()
+        node3.start()
+        wait_for_machine(node2)
+        wait_for_machine(node3)
+
+        # Node 1 -> Node 2
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-2 ctl I00\" | grep hello")
+
+        # Node 1 -> Node 3
+        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node2.sleep(5)
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 2 -> Node 3
+        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-3")
+        node3.sleep(1)
+        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-3 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 1
+        # must sleep due to previous ax25_call lingering
+        node3.sleep(5)
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-1")
+        node1.sleep(1)
+        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-1 ctl I00\" | grep hello")
+
+        # Node 3 -> Node 2
+        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-2")
+        node2.sleep(1)
+        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-2 ctl I00\" | grep hello")
+      '';
+  }
+)

nixos/tests/memcached.nix

···
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "memcached";
+{ pkgs, ... }:
+{
+  name = "memcached";
 
-    nodes.machine = {
-      imports = [ ../modules/profiles/minimal.nix ];
-      services.memcached.enable = true;
-    };
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    services.memcached.enable = true;
+  };
 
-    testScript =
-      let
-        testScript =
-          pkgs.writers.writePython3 "test_memcache"
-            {
-              libraries = with pkgs.python3Packages; [ memcached ];
-            }
-            ''
-              import memcache
-              c = memcache.Client(['localhost:11211'])
-              c.set('key', 'value')
-              assert 'value' == c.get('key')
-            '';
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("memcached.service")
-        machine.wait_for_open_port(11211)
-        machine.succeed("${testScript}")
-      '';
-  }
-)
+  testScript =
+    let
+      testScript =
+        pkgs.writers.writePython3 "test_memcache"
+          {
+            libraries = [ pkgs.python3Packages.python-memcached ];
+          }
+          ''
+            import memcache
+            c = memcache.Client(['localhost:11211'])
+            c.set('key', 'value')
+            assert 'value' == c.get('key')
+          '';
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("memcached.service")
+      machine.wait_for_open_port(11211)
+      machine.succeed("${testScript}")
+    '';
+}

nixos/tests/nextflow.nix

···
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    bash = pkgs.dockerTools.pullImage {
-      imageName = "quay.io/nextflow/bash";
-      imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
-      sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
-      finalImageName = "quay.io/nextflow/bash";
-    };
+{ pkgs, ... }:
+let
+  bash = pkgs.dockerTools.pullImage {
+    imageName = "quay.io/nextflow/bash";
+    imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
+    sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
+    finalImageName = "quay.io/nextflow/bash";
+  };
 
-    hello = pkgs.stdenv.mkDerivation {
-      name = "nextflow-hello";
-      src = pkgs.fetchFromGitHub {
-        owner = "nextflow-io";
-        repo = "hello";
-        rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
-        hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
-      };
-      installPhase = ''
-        cp -r $src $out
-      '';
+  hello = pkgs.stdenv.mkDerivation {
+    name = "nextflow-hello";
+    src = pkgs.fetchFromGitHub {
+      owner = "nextflow-io";
+      repo = "hello";
+      rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
+      hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
     };
-    run-nextflow-pipeline = pkgs.writeShellApplication {
-      name = "run-nextflow-pipeline";
-      runtimeInputs = [ pkgs.nextflow ];
-      text = ''
-        export NXF_OFFLINE=true
-        for b in false true; do
-          echo "docker.enabled = $b" > nextflow.config
-          cat nextflow.config
-          nextflow run -ansi-log false ${hello}
-        done
-      '';
-    };
-  in
-  {
-    name = "nextflow";
+    installPhase = ''
+      cp -r $src $out
+    '';
+  };
+  run-nextflow-pipeline = pkgs.writeShellApplication {
+    name = "run-nextflow-pipeline";
+    runtimeInputs = [ pkgs.nextflow ];
+    text = ''
+      export NXF_OFFLINE=true
+      for b in false true; do
+        echo "docker.enabled = $b" > nextflow.config
+        cat nextflow.config
+        nextflow run -ansi-log false ${hello}
+      done
+    '';
+  };
+in
+{
+  name = "nextflow";
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = [
-          run-nextflow-pipeline
-          pkgs.nextflow
-        ];
-        virtualisation = {
-          docker.enable = true;
-        };
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = [
+        run-nextflow-pipeline
+        pkgs.nextflow
+      ];
+      virtualisation = {
+        docker.enable = true;
       };
+    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("docker.service")
-        machine.succeed("docker load < ${bash}")
-        machine.succeed("run-nextflow-pipeline >&2")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("docker.service")
+      machine.succeed("docker load < ${bash}")
+      machine.succeed("run-nextflow-pipeline >&2")
+    '';
+}

nixos/tests/web-servers/static-web-server.nix

···
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "static-web-server";
-    meta = {
-      maintainers = with lib.maintainers; [ mac-chaffee ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "static-web-server";
+  meta = {
+    maintainers = with lib.maintainers; [ mac-chaffee ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.static-web-server = {
-          enable = true;
-          listen = "[::]:8080";
-          root = toString (
-            pkgs.writeTextDir "nixos-test.html" ''
-              <h1>Hello NixOS!</h1>
-            ''
-          );
-          configuration = {
-            general = {
-              directory-listing = true;
-            };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.static-web-server = {
+        enable = true;
+        listen = "[::]:8080";
+        root = toString (
+          pkgs.writeTextDir "nixos-test.html" ''
+            <h1>Hello NixOS!</h1>
+          ''
+        );
+        configuration = {
+          general = {
+            directory-listing = true;
           };
         };
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("static-web-server.socket")
-      machine.wait_for_open_port(8080)
-      # We don't use wait_until_succeeds() because we're testing socket
-      # activation which better work on the first request
-      response = machine.succeed("curl -fsS localhost:8080")
-      assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
-      response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
-      assert "Hello NixOS!" in response
-      machine.wait_for_unit("static-web-server.service")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("static-web-server.socket")
+    machine.wait_for_open_port(8080)
+    # We don't use wait_until_succeeds() because we're testing socket
+    # activation which better work on the first request
+    response = machine.succeed("curl -fsS localhost:8080")
+    assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
+    response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
+    assert "Hello NixOS!" in response
+    machine.wait_for_unit("static-web-server.service")
+  '';
+}

pkgs/applications/editors/vim/plugins/overrides.nix

···
   fzf-lua = neovimUtils.buildNeovimPlugin {
     luaAttr = luaPackages.fzf-lua;
     runtimeDeps = [ fzf ];
+    nvimSkipModules = [
+      "fzf-lua.shell_helper"
+      "fzf-lua.spawn"
+    ];
   };
 
   fzf-vim = super.fzf-vim.overrideAttrs {

pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix

···
 
     if ! nodeVersion=$($serverNode -v); then
       echo "Unable to fix Node binary, quitting"
-      fail_with_exitcode ''${o.InstallExitCode.ServerTransferFailed}
+      fail_with_exitcode ''${f.UnifiedStatusCode.ServerTransferFailed}
     fi
 
     ${lib.optionalString useLocalExtensions ''

pkgs/applications/graphics/gimp/2.0/default.nix

···
+{
+  stdenv,
+  lib,
+  fetchurl,
+  replaceVars,
+  autoreconfHook,
+  pkg-config,
+  intltool,
+  babl,
+  gegl,
+  gtk2,
+  glib,
+  gdk-pixbuf,
+  isocodes,
+  pango,
+  cairo,
+  freetype,
+  fontconfig,
+  lcms,
+  libpng,
+  libjpeg,
+  libjxl,
+  poppler,
+  poppler_data,
+  libtiff,
+  libmng,
+  librsvg,
+  libwmf,
+  zlib,
+  libzip,
+  ghostscript,
+  aalib,
+  shared-mime-info,
+  libexif,
+  gettext,
+  makeWrapper,
+  gtk-doc,
+  xorg,
+  glib-networking,
+  libmypaint,
+  gexiv2,
+  harfbuzz,
+  mypaint-brushes1,
+  libwebp,
+  libheif,
+  libxslt,
+  libgudev,
+  openexr,
+  desktopToDarwinBundle,
+  AppKit,
+  Cocoa,
+  gtk-mac-integration-gtk2,
+  withPython ? false,
+  python2,
+}:
+
+let
+  python = python2.withPackages (pp: [ pp.pygtk ]);
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gimp";
+  version = "2.10.38";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
+    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+  };
+
+  patches = [
+    # to remove compiler from the runtime closure, reference was retained via
+    # gimp --version --verbose output
+    (replaceVars ./remove-cc-reference.patch {
+      cc_version = stdenv.cc.cc.name;
+    })
+
+    # Use absolute paths instead of relying on PATH
+    # to make sure plug-ins are loaded by the correct interpreter.
+    ./hardcode-plugin-interpreters.patch
+
+    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
+    # These variables have been removed since libheif 1.18.0
+    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
+    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
+    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
+    ./force-enable-libheif.patch
+  ];
+
+  nativeBuildInputs =
+    [
+      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      pkg-config
+      intltool
+      gettext
+      makeWrapper
+      gtk-doc
+      libxslt
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      desktopToDarwinBundle
+    ];
+
+  buildInputs =
+    [
+      babl
+      gegl
+      gtk2
+      glib
+      gdk-pixbuf
+      pango
+      cairo
+      gexiv2
+      harfbuzz
+      isocodes
+      freetype
+      fontconfig
+      lcms
+      libpng
+      libjpeg
+      libjxl
+      poppler
+      poppler_data
+      libtiff
+      openexr
+      libmng
+      librsvg
+      libwmf
+      zlib
+      libzip
+      ghostscript
+      aalib
+      shared-mime-info
+      libwebp
+      libheif
+      libexif
+      xorg.libXpm
+      glib-networking
+      libmypaint
+      mypaint-brushes1
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      AppKit
+      Cocoa
+      gtk-mac-integration-gtk2
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libgudev
+    ]
+    ++ lib.optionals withPython [
+      python
+      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
+      python2.pkgs.pygtk
+    ];
+
+  # needed by gimp-2.0.pc
+  propagatedBuildInputs = [
+    gegl
+  ];
+
+  configureFlags =
+    [
+      "--without-webkit" # old version is required
+      "--disable-check-update"
+      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "--with-icc-directory=/run/current-system/sw/share/color/icc"
+      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
+      "--libdir=\${exec_prefix}/lib"
+    ]
+    ++ lib.optionals (!withPython) [
+      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [ ]
+      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
+    );
+
+    # Check if librsvg was built with --disable-pixbuf-loader.
+    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+  };
+
+  preConfigure = ''
+    # The check runs before glib-networking is registered
+    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+  '';
+
+  passthru = {
+    # The declarations for `gimp-with-plugins` wrapper,
+    # used for determining plug-in installation paths
+    majorVersion = "${lib.versions.major finalAttrs.version}.0";
+    targetLibDir = "lib/gimp/${finalAttrs.passthru.majorVersion}";
+    targetDataDir = "share/gimp/${finalAttrs.passthru.majorVersion}";
+    targetPluginDir = "${finalAttrs.passthru.targetLibDir}/plug-ins";
+    targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
+
+    # probably its a good idea to use the same gtk in plugins ?
+    gtk = gtk2;
+
+    python2Support = withPython;
+  };
+
+  meta = with lib; {
+    description = "GNU Image Manipulation Program";
+    homepage = "https://www.gimp.org/";
+    maintainers = with maintainers; [ ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    mainProgram = "gimp";
+  };
+})

pkgs/applications/graphics/gimp/2.0/hardcode-plugin-interpreters.patch

···
+--- a/plug-ins/pygimp/Makefile.am
++++ b/plug-ins/pygimp/Makefile.am
+@@ -157,7 +157,7 @@ install-interp-file:
+ 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
+ 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+ 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
+-	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
++	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
+ 
+ install-data-local: install-env-file install-interp-file
+ 

pkgs/applications/graphics/gimp/2.0/remove-cc-reference.patch

···
+diff --git a/app/gimp-version.c b/app/gimp-version.c
+index 3d1894a036..48bb670b64 100644
+--- a/app/gimp-version.c
++++ b/app/gimp-version.c
+@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+                                       GIMP_BUILD_ID,
+                                       gimp_version_get_revision (),
+                                       GIMP_BUILD_PLATFORM_FAMILY,
+-                                      CC_VERSION,
++                                      "@cc_version@",
+                                       lib_versions);
+       g_free (lib_versions);
+ 

pkgs/applications/graphics/gimp/default.nix

···
   lib,
   fetchurl,
   replaceVars,
-  autoreconfHook,
+  meson,
+  ninja,
   pkg-config,
-  intltool,
   babl,
+  cfitsio,
   gegl,
-  gtk2,
+  gtk3,
   glib,
   gdk-pixbuf,
+  graphviz,
   isocodes,
   pango,
   cairo,
+  libarchive,
+  luajit,
   freetype,
   fontconfig,
   lcms,
   libpng,
+  libiff,
+  libilbm,
   libjpeg,
   libjxl,
   poppler,
···
   ghostscript,
   aalib,
   shared-mime-info,
+  python3,
   libexif,
   gettext,
-  makeWrapper,
-  gtk-doc,
+  wrapGAppsHook3,
+  libxslt,
+  gobject-introspection,
+  vala,
+  gi-docgen,
+  perl,
+  appstream-glib,
+  desktop-file-utils,
   xorg,
   glib-networking,
+  json-glib,
   libmypaint,
+  llvmPackages,
   gexiv2,
   harfbuzz,
   mypaint-brushes1,
   libwebp,
   libheif,
-  libxslt,
+  gjs,
   libgudev,
   openexr,
+  xvfb-run,
+  dbus,
+  adwaita-icon-theme,
+  alsa-lib,
   desktopToDarwinBundle,
   AppKit,
   Cocoa,
-  gtk-mac-integration-gtk2,
-  withPython ? false,
-  python2,
 }:
 
 let
-  python = python2.withPackages (pp: [ pp.pygtk ]);
+  python = python3.withPackages (
+    pp: with pp; [
+      pygobject3
+    ]
+  );
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "2.10.38";
+  version = "3.0.2";
 
   outputs = [
     "out"
     "dev"
+    "devdoc"
   ];
 
   src = fetchurl {
-    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-UKhF7sEciDH+hmFweVD1uERuNfMO37ms+Y+FwRM/hW4=";
+    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
   };
 
   patches = [
···
 
     # Use absolute paths instead of relying on PATH
     # to make sure plug-ins are loaded by the correct interpreter.
-    ./hardcode-plugin-interpreters.patch
+    # TODO: This now only appears to be used on Windows.
+    (replaceVars ./hardcode-plugin-interpreters.patch {
+      python_interpreter = python.interpreter;
+      PYTHON_EXE = null;
+    })
 
-    # GIMP queries libheif.pc for builtin encoder/decoder support to determine if AVIF/HEIC files are supported
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/blob/a8b1173ca441283971ee48f4778e2ffd1cca7284/configure.ac?page=2#L1846-1852)
-    # These variables have been removed since libheif 1.18.0
-    # (see https://github.com/strukturag/libheif/commit/cf0d89c6e0809427427583290547a7757428cf5a)
-    # This has already been fixed for the upcoming GIMP 3, but the fix has not been backported to 2.x yet
-    # (see https://gitlab.gnome.org/GNOME/gimp/-/issues/9080)
-    ./force-enable-libheif.patch
+    # D-Bus configuration is not available in the build sandbox
+    # so we need to pick up the one from the package.
+    (replaceVars ./tests-dbus-conf.patch {
+      session_conf = "${dbus.out}/share/dbus-1/session.conf";
+    })
   ];
 
   nativeBuildInputs =
     [
-      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
+      meson
+      ninja
       pkg-config
-      intltool
       gettext
-      makeWrapper
-      gtk-doc
-      libxslt
+      wrapGAppsHook3
+      libxslt # for xsltproc
+      gobject-introspection
+      perl
+      vala
+
+      # for docs
+      gi-docgen
+
+      # for tests
+      desktop-file-utils
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      dbus
+      xvfb-run
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       desktopToDarwinBundle
···
 
   buildInputs =
     [
+      appstream-glib # for library
       babl
+      cfitsio
       gegl
-      gtk2
+      gtk3
       glib
       gdk-pixbuf
       pango
       cairo
+      libarchive
       gexiv2
       harfbuzz
       isocodes
···
       fontconfig
       lcms
       libpng
+      libiff
+      libilbm
       libjpeg
       libjxl
       poppler
···
       ghostscript
       aalib
       shared-mime-info
+      json-glib
       libwebp
       libheif
+      python
       libexif
       xorg.libXpm
+      xorg.libXmu
       glib-networking
       libmypaint
       mypaint-brushes1
+
+      # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
+      adwaita-icon-theme
+
+      # for Lua plug-ins
+      (luajit.withPackages (pp: [
+        pp.lgi
+      ]))
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+
+      # for JavaScript plug-ins
+      gjs
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.openmp
       AppKit
       Cocoa
-      gtk-mac-integration-gtk2
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libgudev
-    ]
-    ++ lib.optionals withPython [
-      python
-      # Duplicated here because python.withPackages does not expose the dev output with pkg-config files
-      python2.pkgs.pygtk
     ];
 
-  # needed by gimp-2.0.pc
   propagatedBuildInputs = [
+    # needed by gimp-3.0.pc
     gegl
+    cairo
+    pango
+    gexiv2
   ];
 
-  configureFlags =
+  mesonFlags =
     [
-      "--without-webkit" # old version is required
-      "--disable-check-update"
-      "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
-      "--with-icc-directory=/run/current-system/sw/share/color/icc"
-      # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
-      "--libdir=\${exec_prefix}/lib"
+      "-Dbug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
+      "-Dicc-directory=/run/current-system/sw/share/color/icc"
+      "-Dcheck-update=no"
+      (lib.mesonEnable "gudev" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "headless-tests" stdenv.hostPlatform.isLinux)
+      (lib.mesonEnable "linux-input" stdenv.hostPlatform.isLinux)
+      # Not very important to do downstream, save a dependency.
+      "-Dappdata-test=disabled"
     ]
-    ++ lib.optionals (!withPython) [
-      "--disable-python" # depends on Python2 which was EOLed on 2020-01-01
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-Dalsa=disabled"
+      "-Djavascript=disabled"
     ];
 
-  enableParallelBuilding = true;
-
   doCheck = true;
 
   env = {
-    NIX_CFLAGS_COMPILE = toString (
-      [ ]
-      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
-    );
+    # The check runs before glib-networking is registered
+    GIO_EXTRA_MODULES = "${glib-networking}/lib/gio/modules";
+
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-DGDK_OSX_BIG_SUR=16";
 
     # Check if librsvg was built with --disable-pixbuf-loader.
     PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
   };
 
-  preConfigure = ''
-    # The check runs before glib-networking is registered
-    export GIO_EXTRA_MODULES="${glib-networking}/lib/gio/modules:$GIO_EXTRA_MODULES"
+  postPatch = ''
+    patchShebangs \
+      app/tests/create_test_env.sh \
+      tools/gimp-mkenums
+
+    # GIMP is executed at build time so we need to fix this.
+    # TODO: Look into if we can fix the interp thing.
+    chmod +x plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+    patchShebangs \
+      plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+  '';
+
+  preBuild =
+    let
+      librarySuffix =
+        if stdenv.hostPlatform.extensions.library == ".so" then
+          "3.0.so.0"
+        else if stdenv.hostPlatform.extensions.library == ".dylib" then
+          "3.0.0.dylib"
+        else
+          throw "Unsupported library extension ‘${stdenv.hostPlatform.extensions.library}’";
+    in
+    ''
+      # Our gobject-introspection patches make the shared library paths absolute
+      # in the GIR files. When running GIMP in build or check phase, it will try
+      # to use plug-ins, which import GIMP introspection files which will try
+      # to load the GIMP libraries which will not be installed yet.
+      # So we need to replace the absolute path with a local one.
+      # We are using a symlink that will be overridden during installation.
+      mkdir -p "$out/lib"
+      ln -s "$PWD/libgimp/libgimp-${librarySuffix}" \
+        "$PWD/libgimpbase/libgimpbase-${librarySuffix}" \
+        "$PWD/libgimpcolor/libgimpcolor-${librarySuffix}" \
+        "$PWD/libgimpconfig/libgimpconfig-${librarySuffix}" \
+        "$PWD/libgimpmath/libgimpmath-${librarySuffix}" \
+        "$PWD/libgimpmodule/libgimpmodule-${librarySuffix}" \
+        "$out/lib/"
+    '';
+
+  preCheck = ''
+    # Avoid “Error retrieving accessibility bus address”
+    export NO_AT_BRIDGE=1
+    # Fix storing recent file list in tests
+    export HOME="$TMPDIR"
+    export XDG_DATA_DIRS="${glib.getSchemaDataDirPath gtk3}:${adwaita-icon-theme}/share:$XDG_DATA_DIRS"
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${
+      lib.makeBinPath [
+        # for dot for gegl:introspect (Debug » Show Image Graph, hidden by default on stable release)
+        graphviz
+        # for gimp-script-fu-interpreter-3.0 invoked by shebang of some plug-ins
+        "$out"
+      ]
+    }")
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
   '';
 
   passthru = {
···
     targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
 
     # probably its a good idea to use the same gtk in plugins ?
-    gtk = gtk2;
-
-    python2Support = withPython;
+    gtk = gtk3;
   };
 
   meta = with lib; {
···
     homepage = "https://www.gimp.org/";
     maintainers = with maintainers; [ jtojnar ];
     license = licenses.gpl3Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     mainProgram = "gimp";
   };
 })

pkgs/applications/graphics/gimp/hardcode-plugin-interpreters.patch

···
---- a/plug-ins/pygimp/Makefile.am
-+++ b/plug-ins/pygimp/Makefile.am
-@@ -157,7 +157,7 @@ install-interp-file:
- 	echo 'python=$(PYBIN_PATH)' > '$(DESTDIR)$(pyinterpfile)'
- 	echo 'python2=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
- 	echo '/usr/bin/python=$(PYBIN_PATH)' >> '$(DESTDIR)$(pyinterpfile)'
--	echo ":Python:E::py::`basename $(PYTHON)`:" >> '$(DESTDIR)$(pyinterpfile)'
-+	echo ":Python:E::py::$(PYTHON):" >> '$(DESTDIR)$(pyinterpfile)'
- 
- install-data-local: install-env-file install-interp-file
- 
+--- a/plug-ins/python/pygimp.interp.in
++++ b/plug-ins/python/pygimp.interp.in
+@@ -2,4 +2,4 @@ python=@PYTHON_EXE@
+ python3=@PYTHON_EXE@
+ /usr/bin/python=@PYTHON_EXE@
+ /usr/bin/python3=@PYTHON_EXE@
+-:Python:E::py::python3:
++:Python:E::py::@python_interpreter@:

pkgs/applications/graphics/gimp/plugins/default.nix

···
 # If you just want a subset of plug-ins, you can specify them explicitly:
 # `gimp-with-plugins.override { plugins = with gimpPlugins; [ gap ]; }`.
 
-{ lib, pkgs }:
+{
+  lib,
+  pkgs,
+  gimp,
+}:
 
 let
   inherit (pkgs)
···
     fetchFromGitHub
     fetchFromGitLab
     ;
+
+  # We cannot use gimp from the arguments directly, or it would be shadowed by the one
+  # from scope when initializing the scope with it, leading to infinite recursion.
+  gimpArg = gimp;
 in
 
 lib.makeScope pkgs.newScope (
···
       attrs:
       let
         name = attrs.name or "${attrs.pname}-${attrs.version}";
+        pkgConfigMajorVersion = lib.versions.major gimp.version;
       in
       stdenv.mkDerivation (
         {
···
 
           # Override installation paths.
           env = {
-            PKG_CONFIG_GIMP_2_0_GIMPLIBDIR = "${placeholder "out"}/${gimp.targetLibDir}";
-            PKG_CONFIG_GIMP_2_0_GIMPDATADIR = "${placeholder "out"}/${gimp.targetDataDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPLIBDIR" =
+              "${placeholder "out"}/${gimp.targetLibDir}";
+            "PKG_CONFIG_GIMP_${pkgConfigMajorVersion}_0_GIMPDATADIR" =
+              "${placeholder "out"}/${gimp.targetDataDir}";
           } // attrs.env or { };
         }
       );
···
   in
   {
     # Allow overriding GIMP package in the scope.
-    inherit (pkgs) gimp;
+    gimp = gimpArg;
 
     bimp = pluginDerivation rec {
       /*
···
       installTargets = [ "install-admin" ];
 
       meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
         description = "Batch Image Manipulation Plugin for GIMP";
         homepage = "https://github.com/alessandrofrancesconi/gimp-plugin-bimp";
         license = licenses.gpl2Plus;
···
       '';
 
       meta = {
+        broken = gimp.majorVersion != "2.0";
         description = "Gimp plug-in for the farbfeld image format";
         homepage = "https://github.com/ids1024/gimp-farbfeld";
         license = lib.licenses.mit;
···
       '';
 
       meta = with lib; {
+        broken = gimp.majorVersion != "2.0";
         description = "GIMP plug-in to do the fourier transform";
         homepage = "https://people.via.ecp.fr/~remi/soft/gimp/gimp_plugin_en.php3#fourier";
         license = with licenses; [ gpl3Plus ];
···
       };
 
       meta = {
-        broken = !gimp.python2Support;
+        broken = gimp.majorVersion != "2.0";
       };
     };
 
···
         ninja
         gettext
       ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     waveletSharpen = pluginDerivation {
···
       };
 
       installPhase = "installPlugin src/wavelet-sharpen"; # TODO translations are not copied .. How to do this on nix?
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     lqrPlugin = pluginDerivation rec {
···
           sha256 = "EdjZWM6U1bhUmsOnLA8iJ4SFKuAXHIfNPzxZqel+JrY=";
         })
       ];
+
+      meta = {
+        broken = gimp.majorVersion != "2.0";
+      };
     };
 
     gmic = pkgs.gmic-qt.override {
       variant = "gimp";
+      inherit (self) gimp;
     };
 
     gimplensfun = pluginDerivation {
···
     ";
 
       meta = {
+        broken = gimp.majorVersion != "2.0";
         description = "GIMP plugin to correct lens distortion using the lensfun library and database";
 
         homepage = "http://lensfun.sebastiankraft.net/";

pkgs/applications/graphics/gimp/remove-cc-reference.patch

···
 diff --git a/app/gimp-version.c b/app/gimp-version.c
-index 3d1894a036..48bb670b64 100644
+index 6e311c8252..e6fd9d1d78 100644
 --- a/app/gimp-version.c
 +++ b/app/gimp-version.c
-@@ -230,7 +230,7 @@ gimp_version (gboolean be_verbose,
+@@ -90,7 +90,7 @@ gimp_version (gboolean be_verbose,
                                        GIMP_BUILD_ID,
                                        gimp_version_get_revision (),
                                        GIMP_BUILD_PLATFORM_FAMILY,

pkgs/applications/graphics/gimp/tests-dbus-conf.patch

···
+--- a/build/meson/run_test_env.sh
++++ b/build/meson/run_test_env.sh
+@@ -33,7 +33,7 @@ if [ -n "${UI_TEST}" ]; then
+     OPT="--auto-servernum"
+   fi
+   xvfb-run $OPT --server-args="-screen 0 1280x1024x24" \
+-    dbus-run-session -- "$@"
++    dbus-run-session --config-file="@session_conf@" -- "$@"
+ 
+ else
+   # Run the executable directly,

pkgs/applications/graphics/gimp/wrapper.nix

···
     lib.attrValues gimpPlugins
   );
   selectedPlugins = lib.filter (pkg: pkg != gimp) (if plugins == null then allPlugins else plugins);
-  extraArgs = map (x: x.wrapArgs or "") selectedPlugins;
-  versionBranch = lib.versions.majorMinor gimp.version;
+  extraArgs =
+    map (x: x.wrapArgs or "") selectedPlugins
+    ++ lib.optionals (gimp.majorVersion == "2.0") [
+      ''--prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0"''
+    ];
+  exeVersion =
+    if gimp.majorVersion == "2.0" then lib.versions.majorMinor gimp.version else gimp.majorVersion;
+  majorVersion = lib.versions.major gimp.version;
 
 in
 symlinkJoin {
···
   nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
-    for each in gimp-${versionBranch} gimp-console-${versionBranch}; do
+    for each in gimp-${exeVersion} gimp-console-${exeVersion}; do
       wrapProgram $out/bin/$each \
-        --set GIMP2_PLUGINDIR "$out/lib/gimp/2.0" \
-        --set GIMP2_DATADIR "$out/share/gimp/2.0" \
-        --prefix GTK_PATH : "${gnome-themes-extra}/lib/gtk-2.0" \
+        --set GIMP${majorVersion}_PLUGINDIR "$out/${gimp.targetLibDir}" \
+        --set GIMP${majorVersion}_DATADIR "$out/${gimp.targetDataDir}" \
         ${toString extraArgs}
     done
     set +x
     for each in gimp gimp-console; do
-      ln -sf "$each-${versionBranch}" $out/bin/$each
+      ln -sf "$each-${exeVersion}" $out/bin/$each
     done
   '';
 

pkgs/applications/misc/keepassxc/default.nix

···
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  qttools,
-
-  apple-sdk_15,
-  asciidoctor,
-  botan3,
-  curl,
-  darwinMinVersionHook,
-  kio,
-  libXi,
-  libXtst,
-  libargon2,
-  libusb1,
-  minizip,
-  pcsclite,
-  pkg-config,
-  qrencode,
-  qtbase,
-  qtmacextras,
-  qtsvg,
-  qtx11extras,
-  readline,
-  wrapGAppsHook3,
-  wrapQtAppsHook,
-  zlib,
-
-  LocalAuthentication,
-
-  withKeePassBrowser ? true,
-  withKeePassBrowserPasskeys ? true,
-  withKeePassFDOSecrets ? true,
-  withKeePassKeeShare ? true,
-  withKeePassNetworking ? true,
-  withKeePassSSHAgent ? true,
-  withKeePassTouchID ? true,
-  withKeePassX11 ? true,
-  withKeePassYubiKey ? true,
-
-  nixosTests,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "keepassxc";
-  version = "2.7.10";
-
-  src = fetchFromGitHub {
-    owner = "keepassxreboot";
-    repo = "keepassxc";
-    rev = version;
-    hash = "sha256-FBoqCYNM/leN+w4aV0AJMx/G0bjHbI9KVWrnmq3NfaI=";
-  };
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
-    "-Wno-old-style-cast"
-    "-Wno-error"
-    "-D__BIG_ENDIAN__=${if stdenv.hostPlatform.isBigEndian then "1" else "0"}"
-  ]);
-
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-rpath ${libargon2}/lib";
-
-  patches = [ ./darwin.patch ];
-
-  cmakeFlags =
-    [
-      "-DKEEPASSXC_BUILD_TYPE=Release"
-      "-DWITH_GUI_TESTS=ON"
-      "-DWITH_XC_UPDATECHECK=OFF"
-    ]
-    ++ (lib.optional (!withKeePassX11) "-DWITH_XC_X11=OFF")
-    ++ (lib.optional (withKeePassFDOSecrets && stdenv.hostPlatform.isLinux) "-DWITH_XC_FDOSECRETS=ON")
-    ++ (lib.optional (withKeePassYubiKey && stdenv.hostPlatform.isLinux) "-DWITH_XC_YUBIKEY=ON")
-    ++ (lib.optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
-    ++ (lib.optional withKeePassBrowserPasskeys "-DWITH_XC_BROWSER_PASSKEYS=ON")
-    ++ (lib.optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
-    ++ (lib.optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
-    ++ (lib.optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
-
-  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-
-    export LC_ALL="en_US.UTF-8"
-    export QT_QPA_PLATFORM=offscreen
-    export QT_PLUGIN_PATH="${qtbase.bin}/${qtbase.qtPluginPrefix}"
-    # testcli, testgui and testkdbx4 are flaky - skip them all
-    # testautotype on darwin throws "QWidget: Cannot create a QWidget without QApplication"
-    make test ARGS+="-E 'testcli|testgui${lib.optionalString stdenv.hostPlatform.isDarwin "|testautotype|testkdbx4"}' --output-on-failure"
-
-    runHook postCheck
-  '';
-
-  nativeBuildInputs = [
-    asciidoctor
-    cmake
-    wrapQtAppsHook
-    qttools
-    pkg-config
-  ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) wrapGAppsHook3;
-
-  dontWrapGApps = true;
-  preFixup =
-    ''
-      qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      wrapQtApp "$out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC"
-    '';
-
-  postInstall = lib.concatLines [
-    (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p "$out/bin"
-      for program in keepassxc-cli keepassxc-proxy; do
-        ln -s "$out/Applications/KeePassXC.app/Contents/MacOS/$program" "$out/bin/$program"
-      done
-    '')
-
-    # See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/src/browser/NativeMessageInstaller.cpp#L317
-    (lib.optionalString withKeePassBrowser ''
-      mkdir -p "$out/lib/mozilla/native-messaging-hosts"
-      substituteAll "${./firefox-native-messaging-host.json}" "$out/lib/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"
-    '')
-  ];
-
-  buildInputs =
-    [
-      curl
-      botan3
-      kio
-      libXi
-      libXtst
-      libargon2
-      minizip
-      pcsclite
-      qrencode
-      qtbase
-      qtsvg
-      readline
-      zlib
-    ]
-    ++ lib.optional (stdenv.hostPlatform.isDarwin && withKeePassTouchID) LocalAuthentication
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      qtmacextras
-
-      apple-sdk_15
-      # ScreenCaptureKit, required by livekit, is only available on 12.3 and up:
-      # https://developer.apple.com/documentation/screencapturekit
-      (darwinMinVersionHook "12.3")
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libusb1
-    ++ lib.optional withKeePassX11 qtx11extras;
-
-  passthru.tests = nixosTests.keepassxc;
-
-  meta = with lib; {
-    description = "Offline password manager with many features";
-    longDescription = ''
-      A community fork of KeePassX, which is itself a port of KeePass Password Safe.
-      The goal is to extend and improve KeePassX with new features and bugfixes,
-      to provide a feature-rich, fully cross-platform and modern open-source password manager.
-      Accessible via native cross-platform GUI, CLI, has browser integration
-      using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
-    '';
-    homepage = "https://keepassxc.org/";
-    license = licenses.gpl2Plus;
-    mainProgram = "keepassxc";
-    maintainers = with maintainers; [
-      blankparticle
-      sigmasquadron
-    ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}

pkgs/applications/networking/browsers/chromium/info.json

···
 {
   "chromium": {
-    "version": "135.0.7049.84",
+    "version": "135.0.7049.95",
     "chromedriver": {
-      "version": "135.0.7049.85",
-      "hash_darwin": "sha256-L4x/MSCbVt2UIQwbHREDV8br6DmdfuqTJ3//7opK2IU=",
-      "hash_darwin_aarch64": "sha256-vixXGqbc2UYpydg1RILhrtmr5DdbJ5I1sD8aNikejQU="
+      "version": "135.0.7049.96",
+      "hash_darwin": "sha256-MmL/hQGPk/kGBtbXSekE+lHktucPCv3HFr8VYTnff5w=",
+      "hash_darwin_aarch64": "sha256-TGiVrAYgeLGniGBZ2dHUBk6Hg996ouBSJHZm9hXExQ4="
     },
     "deps": {
       "depot_tools": {
···
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "6c019e56001911b3fd467e03bf68c435924d62f4",
-        "hash": "sha256-BFw1o2cIHBeBudeigH6YTOuLGsp/+pTOeE1lXBO3aio=",
+        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
+        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
···
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
-        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
+        "rev": "2919d07ee57020e3e4b66cce45c61104d80304d2",
+        "hash": "sha256-zE6a0R8NZ3SE0bHwPan3dTh5kmq5JmYTbDQIvyNICeg="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
···
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e445bdea696eb6b6a46681dfc1a63edaa517edb",
-        "hash": "sha256-mSup6nKsEPjJ/HBV7PwjBI4PP7/RdwFm/dnavKeRqzI="
+        "rev": "5a44cdd70f04aa65fa063caa1a7e3028d75236f8",
+        "hash": "sha256-QX3b+S0IuxJKmlMudL6420+bXRhDkWYC7GNRKxKNm8A="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",

pkgs/build-support/dotnet/auto-patchcil-hook/auto-patchcil.sh

···
+#!@shell@
+# shellcheck shell=bash
+
+declare -a autoPatchcilLibs
+declare -a extraAutoPatchcilLibs
+
+gatherLibraries() {
+    if [ -d "$1/lib" ]; then
+        autoPatchcilLibs+=("$1/lib")
+    fi
+}
+
+addEnvHooks "${targetOffset:?}" gatherLibraries
+
+# Can be used to manually add additional directories with shared object files
+# to be included for the next autoPatchcil invocation.
+addAutoPatchcilSearchPath() {
+    local -a findOpts=()
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --no-recurse)
+            shift
+            findOpts+=("-maxdepth" 1)
+            ;;
+        --*)
+            echo "addAutoPatchcilSearchPath: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchcilLibs+=("$dir")
+    done < <(
+        find "$@" "${findOpts[@]}" \! -type d \
+            \( -name '*.so' -o -name '*.so.*' \) -print0 |
+            sed -z 's#/[^/]*$##' |
+            uniq -z
+    )
+}
+
+autoPatchcil() {
+    local rid=
+    local norecurse=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+        --)
+            shift
+            break
+            ;;
+        --rid)
+            rid="$2"
+            shift 2
+            ;;
+        --no-recurse)
+            shift
+            norecurse=1
+            ;;
+        --*)
+            echo "autoPatchcil: ERROR: Invalid command line" \
+                "argument: $1" >&2
+            return 1
+            ;;
+        *) break ;;
+        esac
+    done
+
+    if [ -z "$rid" ]; then
+        echo "autoPatchcil: ERROR: No RID (Runtime ID) provided." >&2
+        return 1
+    fi
+
+    local ignoreMissingDepsArray=("--ignore-missing")
+    concatTo ignoreMissingDepsArray autoPatchcilIgnoreMissingDeps
+
+    if [ ${#ignoreMissingDepsArray[@]} -lt 2 ]; then
+        ignoreMissingDepsArray=()
+    fi
+
+    local autoPatchcilFlags=(
+        ${norecurse:+--no-recurse}
+        --rid "$rid"
+        "${ignoreMissingDepsArray[@]}"
+        --paths "$@"
+        --libs "${autoPatchcilLibs[@]}"
+    )
+
+    # shellcheck disable=SC2016
+    echoCmd 'patchcil auto flags' "${autoPatchcilFlags[@]}"
+    @patchcil@ auto "${autoPatchcilFlags[@]}"
+}
+
+autoPatchcilFixupOutput() {
+    if [[ -z "${dontAutoPatchcil-}" ]]; then
+        if [ -n "${dotnetRuntimeIds+x}" ]; then
+            if [[ -n $__structuredAttrs ]]; then
+                local dotnetRuntimeIdsArray=("${dotnetRuntimeIds[@]}")
+            else
+                # shellcheck disable=SC2206 # Intentionally expanding it to preserve old behavior
+                local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
+            fi
+        else
+            local dotnetRuntimeIdsArray=("")
+        fi
+
+        autoPatchcil --rid "${autoPatchcilRuntimeId:-${dotnetRuntimeIdsArray[0]}}" -- "${prefix:?}"
+    fi
+}
+
+fixupOutputHooks+=(autoPatchcilFixupOutput)

pkgs/build-support/dotnet/auto-patchcil-hook/default.nix

···
+{
+  lib,
+  bash,
+  patchcil,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "auto-patchcil-hook";
+  substitutions = {
+    shell = lib.getExe bash;
+    patchcil = lib.getExe patchcil;
+  };
+} ./auto-patchcil.sh

pkgs/by-name/au/autokbisw/nix/default.nix

···
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "sha256-FSIi4jDX7R35jDHkKzQFJLl4K0Hdx9UWgwxJbHVpsYU=";
+  };
+}

pkgs/by-name/au/autokbisw/nix/workspace-state.json

···
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e1465042f195f374b94f915ba8ca49de24300a0d",
+            "version": "1.0.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      }
+    ]
+  },
+  "version": 6
+}

pkgs/by-name/au/autokbisw/package.nix

···
+{
+  fetchFromGitHub,
+  lib,
+  swift,
+  swiftPackages,
+  swiftpm,
+  swiftpm2nix,
+}:
+let
+  # Nix dir generated by running `swiftpm2nix` in the upstream project
+  generated = swiftpm2nix.helpers ./nix;
+in
+swiftPackages.stdenv.mkDerivation rec {
+  pname = "autokbisw";
+  version = "2.0.1";
+  src = fetchFromGitHub {
+    owner = "ohueter";
+    repo = "autokbisw";
+    tag = version;
+    hash = "sha256-xNXXgDLWW8pdik3STmhpZATf9REd+8IGeoX/oxGg4vc=";
+  };
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+  configurePhase = generated.configure;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $(swiftpmBinPath)/autokbisw $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Automatic keyboard input language switching for macOS";
+    homepage = "https://github.com/ohueter/autokbisw";
+    changelog = "https://github.com/ohueter/autokbisw/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    mainProgram = "autokbisw";
+    maintainers = with lib.maintainers; [ craigf ];
+    platforms = lib.platforms.darwin;
+  };
+}

pkgs/by-name/ba/babl/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "babl";
-  version = "0.1.110";
+  version = "0.1.112";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v0e+dUDWJ1OJ9mQx7wMGTfU3YxXiQ9C6tEjGqnE/V0M=";
+    hash = "sha256-+2lmgkIXh8j+zIPoqrSBId7I7jjRGbZSkc/L4xUCink=";
   };
 
   patches = [

pkgs/by-name/cr/cryptomator/package.nix

···
 in
 maven.buildMavenPackage rec {
   pname = "cryptomator";
-  version = "1.15.2";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "cryptomator";
     repo = "cryptomator";
     tag = version;
-    hash = "sha256-uhsX4VIA8NNUjxa0dHyB5bhWMxjd2LJfcKJInxROQRY=";
+    hash = "sha256-3HGSeTUzfcXuNFxPuhkQBQ8CTEvgrNjpFtqOuluCeRs=";
   };
 
   mvnJdk = jdk;
   mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-KfQdYsPdmQRQqjx/kpDQR9tYjb54goA31w55x6VX6KM=";
+  mvnHash = "sha256-vC2ULlBm/170ElcQC898N4kmWfuWwb7hFpF1oMIukyQ=";
 
   preBuild = ''
     VERSION=${version}

pkgs/by-name/de/devenv/package.nix

···
     doInstallCheck = false;
   });
 
-  version = "1.5";
+  version = "1.5.1";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
···
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-bJlcIFcEhobOiaJsxub48fR8nIZDU4QK4FIycmDW2mk=";
+    hash = "sha256-ybqhaIuv8OU0f14Rr+1ilxE4iTCnguXi/60g4ys6JOI=";
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/en/envoy-bin/package.nix

···
   versionCheckHook,
 }:
 let
-  version = "1.33.2";
+  version = "1.34.0";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
···
 
   hash =
     {
-      aarch64-linux = "sha256-gew2iaghIu/wymgMSBdvTTUbb5iBp5zJ2QeKb7Swtqg=";
-      x86_64-linux = "sha256-vS/4fF78lf14gNcQkV9XPBqrTZxV2NqIbc2R30P610E=";
+      aarch64-linux = "sha256-VVEYQ25ZNmWftuhLOOZnxKaosQFeMHsQdkAzIq+zEM0=";
+      x86_64-linux = "sha256-FavpvY1hYNOnlFQE2NV3O8z9gyKGpD01oU/wute9iRA=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/ga/gallery-dl/package.nix

···
 
 let
   pname = "gallery-dl";
-  version = "1.29.3";
+  version = "1.29.4";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
···
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-LzMiJxMl6IWtUloWxBAMLvkhnTQpHkz/gjWl5gW2sZ0=";
+    hash = "sha256-dQK1AWmdlfb1cRcYzXWUsXmRgjQRc++zEHZvLUygMwg=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/ga/gamescope/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.3";
+  version = "3.16.4";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-4Pbyv+EAgwjabVJ4oW3jSmi0Rzpe+BxCN8mM5/beEco=";
+    hash = "sha256-2AxqvZA1eZaJFKMfRljCIcP0M2nMngw0FQiXsfBW7IA=";
   };
 
   patches = [

pkgs/by-name/gm/gmic-qt/package.nix

···
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_DYNAMIC_LINKING" true)
     (lib.cmakeBool "ENABLE_SYSTEM_GMIC" true)
-    (lib.cmakeFeature "GMIC_QT_HOST" (if variant == "standalone" then "none" else variant))
+    (lib.cmakeFeature "GMIC_QT_HOST" (
+      if variant == "standalone" then
+        "none"
+      else if variant == "gimp" && gimp.majorVersion == "3.0" then
+        "gimp3"
+      else
+        variant
+    ))
   ];
 
   postFixup = lib.optionalString (variant == "gimp") ''

pkgs/by-name/go/gofumpt/package.nix

···
 
 buildGoModule rec {
   pname = "gofumpt";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mJM0uKztX0OUQvynnxeKL9yft7X/Eh28ERg8SbZC5Ws=";
+    hash = "sha256-37wYYB0k8mhQq30y1oo77qW3bIqqN/K/NG1RgxK6dyI=";
   };
 
-  vendorHash = "sha256-kJysyxROvB0eMAHbvNF+VXatEicn4ln2Vqkzp7GDWAQ=";
+  vendorHash = "sha256-T6/xEXv8+io3XwQ2keacpYYIdTnYhTTUCojf62tTwbA=";
 
   env.CGO_ENABLED = "0";
 

pkgs/by-name/go/golangci-lint/package.nix

···
 
 buildGo124Module rec {
   pname = "golangci-lint";
-  version = "2.0.2";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-+IndC9znKgVGiFWW0aCNjhxPwX1kDFnfG2+SKEQ15Rc=";
+    hash = "sha256-CAO+oo3l3mlZIiC1Srhc0EfZffQOHvVkamPHzSKRSFw=";
   };
 
-  vendorHash = "sha256-B6mCvJtIfRbAv6fZ8Ge82nT9oEcL3WR4D+AAVs9R3zM=";
+  vendorHash = "sha256-2GQp/sgYRlDengx8uy3zzqi9hwHh4CQUHoj1zaxNNLE=";
 
   subPackages = [ "cmd/golangci-lint" ];
 

pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.x.patch

···
+diff --git a/src/main.c b/src/main.c
+index d16a7f7..2c596e9 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -125,7 +125,7 @@ static gint        grig_app_delete     (GtkWidget *, GdkEvent *, gpointer);
+ static void        grig_app_destroy    (GtkWidget *, gpointer);
+ static void        grig_show_help      (void);
+ static void        grig_show_version   (void);
+-static gint        grig_list_add       (const struct rig_caps *, void *);
++static gint        grig_list_add       (struct rig_caps *, void *);
+ static gint        grig_list_compare   (gconstpointer, gconstpointer);
+ static void        grig_sig_handler    (int sig);
+ 
+@@ -729,7 +729,7 @@ grig_list_rigs ()
+  * \sa grig_list_rigs, grig_list_compare
+  */
+ static gint
+-grig_list_add (const struct rig_caps *caps, void *array)
++grig_list_add (struct rig_caps *caps, void *array)
+ {
+ 	grig_rig_info_t *info;
+ 
+diff --git a/src/rig-selector.c b/src/rig-selector.c
+index 425d41a..e040c0e 100644
+--- a/src/rig-selector.c
++++ b/src/rig-selector.c
+@@ -46,7 +46,7 @@ static void add     (GtkWidget *, gpointer);
+ static void delete  (GtkWidget *, gpointer);
+ static void edit    (GtkWidget *, gpointer);
+ static void cancel  (GtkWidget *, gpointer);
+-static void connect (GtkWidget *, gpointer);
++static void connectrig (GtkWidget *, gpointer);
+ static void selection_changed (GtkTreeSelection *sel, gpointer data);
+ 
+ static void render_civ (GtkTreeViewColumn *col,
+@@ -191,7 +191,7 @@ rig_selector_execute ()
+     g_signal_connect (G_OBJECT (cancbut), "clicked",
+                       G_CALLBACK (cancel), window);
+     g_signal_connect (G_OBJECT (conbut), "clicked",
+-                      G_CALLBACK (connect), window);
++                      G_CALLBACK (connectrig), window);
+     g_signal_connect (G_OBJECT (delbut), "clicked",
+                       G_CALLBACK (delete), NULL);
+     g_signal_connect (G_OBJECT (newbut), "clicked",
+@@ -439,7 +439,7 @@ static void cancel (GtkWidget *button, gpointer window)
+  * simply destroys the rig selector window and whereby control is returned
+  * to the main() function.
+  */
+-static void connect (GtkWidget *button, gpointer window)
++static void connectrig (GtkWidget *button, gpointer window)
+ {
+     
+     
+-- 
+2.47.0
+

pkgs/by-name/gr/grig/package.nix

···
     sha256 = "sha256-OgIgHW9NMW/xSSti3naIR8AQWUtNSv5bYdOcObStBlM=";
   };
 
+  patches = [
+    # https://github.com/fillods/grig/issues/22
+    ./0001-Fix-grig-for-hamlib-4.6.x.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

pkgs/by-name/ke/keepassxc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libsForQt5,
+
+  apple-sdk_15,
+  asciidoctor,
+  botan3,
+  curl,
+  darwinMinVersionHook,
+  libXi,
+  libXtst,
+  libargon2,
+  libusb1,
+  minizip,
+  nix-update-script,
+  pcsclite,
+  pkg-config,
+  qrencode,
+  readline,
+  wrapGAppsHook3,
+  zlib,
+
+  withKeePassBrowser ? true,
+  withKeePassBrowserPasskeys ? true,
+  withKeePassFDOSecrets ? stdenv.hostPlatform.isLinux,
+  withKeePassKeeShare ? true,
+  withKeePassNetworking ? true,
+  withKeePassSSHAgent ? true,
+  withKeePassX11 ? true,
+  withKeePassYubiKey ? stdenv.hostPlatform.isLinux,
+
+  nixosTests,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "keepassxc";
+  version = "2.7.10";
+
+  src = fetchFromGitHub {
+    owner = "keepassxreboot";
+    repo = "keepassxc";
+    tag = finalAttrs.version;
+    hash = "sha256-FBoqCYNM/leN+w4aV0AJMx/G0bjHbI9KVWrnmq3NfaI=";
+  };
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
+    "-Wno-old-style-cast"
+    "-Wno-error"
+    "-D__BIG_ENDIAN__=${if stdenv.hostPlatform.isBigEndian then "1" else "0"}"
+  ]);
+
+  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-rpath ${libargon2}/lib";
+
+  patches = [ ./darwin.patch ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "KEEPASSXC_BUILD_TYPE" "Release")
+    (lib.cmakeBool "WITH_GUI_TESTS" true)
+    (lib.cmakeBool "WITH_XC_UPDATECHECK" false)
+    (lib.cmakeBool "WITH_XC_X11" withKeePassX11)
+    (lib.cmakeBool "WITH_XC_BROWSER" withKeePassBrowser)
+    (lib.cmakeBool "WITH_XC_BROWSER_PASSKEYS" withKeePassBrowserPasskeys)
+    (lib.cmakeBool "WITH_XC_KEESHARE" withKeePassKeeShare)
+    (lib.cmakeBool "WITH_XC_NETWORKING" withKeePassNetworking)
+    (lib.cmakeBool "WITH_XC_SSHAGENT" withKeePassSSHAgent)
+    (lib.cmakeBool "WITH_XC_FDOSECRETS" withKeePassFDOSecrets)
+    (lib.cmakeBool "WITH_XC_YUBIKEY" withKeePassYubiKey)
+  ];
+
+  doCheck = true;
+  checkPhase =
+    let
+      disabledTests = lib.concatStringsSep "|" (
+        [
+          # flaky
+          "testcli"
+          "testgui"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # QWidget: Cannot create a QWidget without QApplication
+          "testautotype"
+
+          # FAIL!  : TestDatabase::testExternallyModified() Compared values are not the same
+          #   Actual   (((spyFileChanged.count()))): 0
+          #   Expected (1)                         : 1
+          #   Loc: [/tmp/nix-build-keepassxc-2.7.10.drv-2/source/tests/TestDatabase.cpp(288)]
+          "testdatabase"
+        ]
+      );
+    in
+    ''
+      runHook preCheck
+
+      export LC_ALL="en_US.UTF-8"
+      export QT_QPA_PLATFORM=offscreen
+      export QT_PLUGIN_PATH="${libsForQt5.qtbase.bin}/${libsForQt5.qtbase.qtPluginPrefix}"
+
+      make test ARGS+="-E '${disabledTests}' --output-on-failure"
+
+      runHook postCheck
+    '';
+
+  nativeBuildInputs = [
+    asciidoctor
+    cmake
+    libsForQt5.wrapQtAppsHook
+    libsForQt5.qttools
+    pkg-config
+  ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) wrapGAppsHook3;
+
+  dontWrapGApps = true;
+  preFixup =
+    ''
+      qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      wrapQtApp "$out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC"
+    '';
+
+  postInstall = lib.concatLines [
+    (lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p "$out/bin"
+      for program in keepassxc-cli keepassxc-proxy; do
+        ln -s "$out/Applications/KeePassXC.app/Contents/MacOS/$program" "$out/bin/$program"
+      done
+    '')
+
+    # See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/src/browser/NativeMessageInstaller.cpp#L317
+    (lib.optionalString withKeePassBrowser ''
+      mkdir -p "$out/lib/mozilla/native-messaging-hosts"
+      substituteAll "${./firefox-native-messaging-host.json}" "$out/lib/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"
+    '')
+  ];
+
+  buildInputs =
+    [
+      botan3
+      curl
+      libXi
+      libXtst
+      libargon2
+      libsForQt5.kio
+      libsForQt5.qtbase
+      libsForQt5.qtsvg
+      minizip
+      pcsclite
+      qrencode
+      readline
+      zlib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libsForQt5.qtmacextras
+
+      apple-sdk_15
+      # ScreenCaptureKit, required by livekit, is only available on 12.3 and up:
+      # https://developer.apple.com/documentation/screencapturekit
+      (darwinMinVersionHook "12.3")
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libusb1
+    ]
+    ++ lib.optionals withKeePassX11 [
+      libsForQt5.qtx11extras
+    ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) keepassxc;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Offline password manager with many features";
+    longDescription = ''
+      A community fork of KeePassX, which is itself a port of KeePass Password Safe.
+      The goal is to extend and improve KeePassX with new features and bugfixes,
+      to provide a feature-rich, fully cross-platform and modern open-source password manager.
+      Accessible via native cross-platform GUI, CLI, has browser integration
+      using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
+    '';
+    homepage = "https://keepassxc.org/";
+    changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "keepassxc";
+    maintainers = with lib.maintainers; [
+      blankparticle
+      sigmasquadron
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})

pkgs/by-name/kn/knot-dns/package.nix

···
     "-DNDEBUG"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   doCheck = true;
   checkFlags = [ "V=1" ]; # verbose output in case some test fails
   doInstallCheck = true;

pkgs/by-name/li/libretro-shaders-slang/package.nix

···
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-03-13";
+  version = "0-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "25311dc03332d9ef2dff8d9d06c611d828028fac";
-    hash = "sha256-nmDjjQgxpZcddOHlBAE9CKdR95u+6lEYXcmIwH9RHXo=";
+    rev = "cacb61c9a3022c84057331063e31304933b61bdf";
+    hash = "sha256-dpqru8Qu1xZkHNKv6oF/T61/k6X2CWljUSVeJqxMvso=";
   };
 
   dontConfigure = true;

pkgs/by-name/lu/lutgen/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
     rev = "v${version}";
-    hash = "sha256-jmMVeDDVb/TuxulDYj+8y4Kl42EJTAWb3tAsanfWduE=";
+    hash = "sha256-VE4R0rdQbZ7cyCPRtWWARUAnlR/KWGFUoJSJ4lySwzY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-BEh8Wl0X1wv53w/Zu0PHwh8oGtCvIJe60aVqLbiH1Hs=";
+  cargoHash = "sha256-H913/EjCh14AcCIj/Em6neP5F6i88rSVbPMmnS3po/I=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/mi/misconfig-mapper/package.nix

···
 
 buildGoModule rec {
   pname = "misconfig-mapper";
-  version = "1.13.7";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${version}";
-    hash = "sha256-6WFtXIqnn2ayfXkGMIxGDlYpE3UbHRuAU8qHGk9SCU4=";
+    hash = "sha256-7ObDlO/jHUMJdEIFwsFrdSyrbs6I6koNJxQyH6FbhZc=";
   };
 
-  vendorHash = "sha256-fEmf+d9oBXz7KymNVmC+CM7OyPD9QV1uN4ReTNhei7A=";
+  vendorHash = "sha256-gxURT2S1m7J3bZ0VIYxFFsbxU3za2BgJ/6TONoPGzAw=";
 
   ldflags = [
     "-s"

pkgs/by-name/op/open-webui/package.nix

···
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-C7YuXxCrnJ+8L7JNh6TA8xi0G3y1FwFb9DQwhS+igME=";
+    npmDepsHash = "sha256-MIjQ5Lbtv6kFHUyuc12JTItUPxIHoo65iUlSjBxw9Z8=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.

pkgs/by-name/pa/patchcil/deps.json

···
+[
+  {
+    "pname": "AsmResolver",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-ZW61z6Qmztdy2NaiqxvNcP5RWBIiIO6CWNnqYq0MwoA="
+  },
+  {
+    "pname": "AsmResolver.DotNet",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-VoTiIr2/r2my6sg2AOEeiqz9vZhWtq5mGaW2Hx90Uo4="
+  },
+  {
+    "pname": "AsmResolver.PE",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-tTU/flTxRJaC4gkmI/gctqIriGIMntkgTs51TqzcQlg="
+  },
+  {
+    "pname": "AsmResolver.PE.File",
+    "version": "6.0.0-beta.1",
+    "hash": "sha256-hPuFrpcm2VMiYEirsL4kYmAhOzjwjNXUklIfYJEonLo="
+  },
+  {
+    "pname": "DotNet.Glob",
+    "version": "3.1.3",
+    "hash": "sha256-5uGSaGY1IqDjq4RCDLPJm0Lg9oyWmyR96OiNeGqSj84="
+  },
+  {
+    "pname": "System.CommandLine",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  }
+]

pkgs/by-name/pa/patchcil/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
+  stdenv,
+  nix-update-script,
+  aot ? dotnetCorePackages.sdk_9_0.hasILCompiler && !stdenv.hostPlatform.isDarwin,
+}:
+
+buildDotnetModule rec {
+  pname = "patchcil";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "GGG-KILLER";
+    repo = "patchcil";
+    tag = "v${version}";
+    hash = "sha256-jqVXKp5ShWkIMAgmcwu9/QHy+Ey9d1Piv62wsO0Xm44=";
+  };
+
+  nativeBuildInputs = lib.optional aot stdenv.cc;
+
+  projectFile = "src/PatchCil.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = if aot then null else dotnetCorePackages.runtime_9_0;
+
+  selfContainedBuild = aot;
+  dotnetFlags = lib.optionals (!aot) [
+    # Disable AOT
+    "-p:PublishAot=false"
+    "-p:InvariantGlobalization=false"
+    "-p:EventSourceSupport=true"
+    "-p:HttpActivityPropagationSupport=true"
+    "-p:MetadataUpdaterSupport=true"
+    "-p:MetricsSupport=true"
+    "-p:UseNativeHttpHandler=false"
+    "-p:XmlResolverIsNetworkingEnabledByDefault=true"
+    "-p:EnableGeneratedComInterfaceComImportInterop=true"
+    "-p:_ComObjectDescriptorSupport=true"
+    "-p:_DataSetXmlSerializationSupport=true"
+    "-p:_DefaultValueAttributeSupport=true"
+    "-p:_DesignerHostSupport=true"
+    "-p:_EnableConsumingManagedCodeFromNativeHosting=true"
+    "-p:_UseManagedNtlm=true"
+  ];
+
+  preFixup = lib.optionalString aot ''
+    # Remove debug symbols as they shouldn't have anything in them.
+    rm $out/lib/patchcil/patchcil.dbg
+  '';
+
+  executables = [ "patchcil" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "A small utility to modify the library paths from PInvoke in .NET assemblies.";
+    homepage = "https://github.com/GGG-KILLER/patchcil";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ggg ];
+    mainProgram = "patchcil";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+      "x86_64-windows"
+      "i686-windows"
+    ];
+  };
+}

pkgs/by-name/po/polarity/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-04-06";
+  version = "latest-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "3d661ea0485a83b0c1065595839cb2d9d594e4e8";
-    hash = "sha256-4NeDOGzCq211SVVtfISq/Z901Et1zYhMQ/t7eNEBW9Y=";
+    rev = "9ee17a9a167efdd660c4806e2d3cd5bc2b3177e1";
+    hash = "sha256-9MsPMQnqzePhxF9f9DgmZ9aq8TzLYi3jZA9HF2McVss=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-S0d64jFKiyGVIFH8HhT4mzBEVUPDIMevvClTeqy0/28=";
+  cargoHash = "sha256-23qr4bEAsN75ONnNmym9eWH38fRoMmP1EkmOaka73Ko=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/rk/rkbin/package.nix

···
   passthru = {
     BL31_RK3568 = "${rkbin}/bin/rk35/rk3568_bl31_v1.44.elf";
     BL31_RK3588 = "${rkbin}/bin/rk35/rk3588_bl31_v1.47.elf";
+    TPL_RK3566 = "${rkbin}/bin/rk35/rk3566_ddr_1056MHz_v1.23.bin";
     TPL_RK3568 = "${rkbin}/bin/rk35/rk3568_ddr_1056MHz_v1.23.bin";
     TPL_RK3588 = "${rkbin}/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.18.bin";
   };

pkgs/by-name/sc/screen-pipe/package.nix

···
   openssl,
   sqlite,
   stdenv,
-  darwin,
   alsa-lib,
   xorg,
+  apple-sdk_12,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "screen-pipe";
···
       openssl
       sqlite
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_12_3.frameworks;
-      [
-        CoreAudio
-        AudioUnit
-        CoreFoundation
-        CoreGraphics
-        CoreMedia
-        IOKit
-        Metal
-        MetalPerformanceShaders
-        Security
-        ScreenCaptureKit
-        SystemConfiguration
-      ]
-    )
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       xorg.libxcb

pkgs/by-name/sn/snx-rs/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "snx-rs";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${version}";
-    hash = "sha256-eWtoCU5JkpHGcOLzjzj9icDlnIW1y+fiEn5V/E5IQ4U=";
+    hash = "sha256-bLuIXd2pqqiyEP+lDTJYVDZkRZ0HcDkKFZd/qlpuf98=";
   };
 
   passthru.updateScript = nix-update-script { };
···
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Hjc2wKkNmlVjZb5wz9fq9hzUsxXJyeFYq+4C+weUlq0=";
+  cargoHash = "sha256-E5OJVf9CkLn5mFtk4Yacs2OIvAuIw0idSs7QuTNvfgU=";
 
   meta = {
     description = "Open source Linux client for Checkpoint VPN tunnels";

pkgs/by-name/sw/swagger-cli/package.nix

···
     npm run bump
   '';
 
+  postInstall = ''
+    find $out/lib/node_modules -xtype l -delete
+  '';
+
   meta = with lib; {
     description = "Swagger 2.0 and OpenAPI 3.0 command-line tool";
     homepage = "https://apitools.dev/swagger-cli/";

pkgs/by-name/sy/synapse-admin-etkecc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  nix-update-script,
+  writers,
+  baseUrl ? null,
+}:
+
+assert lib.asserts.assertMsg (
+  baseUrl == null
+) "The baseUrl parameter is deprecated, please use .withConfig instead";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "synapse-admin-etkecc";
+  version = "0.10.3-etke39";
+
+  src = fetchFromGitHub {
+    owner = "etkecc";
+    repo = "synapse-admin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1jE4QrHAnH27FrfpgM8rKd4I2AAJArtL0jgcWVc8TrU=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-60rS/OfPEQmmZ5j7mUjMPyK9prgNOX7MkYpu9djdjxQ=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnBuildHook
+  ];
+
+  env = {
+    NODE_ENV = "production";
+    SYNAPSE_ADMIN_VERSION = finalAttrs.version;
+  };
+
+  installPhase = ''
+    runHook preInstall
+    cp -r dist $out
+    runHook postInstall
+  '';
+
+  passthru = {
+    # https://github.com/etkecc/synapse-admin/blob/main/docs/config.md
+    withConfig =
+      config:
+      stdenv.mkDerivation {
+        inherit (finalAttrs) version meta;
+        pname = "synapse-admin-etkecc-with-config";
+        dontUnpack = true;
+        configFile = writers.writeJSON "synapse-admin-config" config;
+        installPhase = ''
+          runHook preInstall
+          cp -r ${finalAttrs.finalPackage} $out
+          chmod -R +w $out
+          cp $configFile $out/config.json
+          runHook postInstall
+        '';
+      };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Maintained fork of the admin console for (Matrix) Synapse homeservers, including additional features";
+    homepage = "https://github.com/etkecc/synapse-admin";
+    changelog = "https://github.com/etkecc/synapse-admin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+})

pkgs/by-name/wa/walker/package.nix

···
 
 buildGoModule rec {
   pname = "walker";
-  version = "0.12.19";
+  version = "0.12.21";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${version}";
-    hash = "sha256-XOOYalJ+6V/O/fhC5gEDk2m1yZ2e5DofRRIi8ETHgoQ=";
+    hash = "sha256-wONW5CaPkLiVR5roGFx2SOcvcVDr9E9eCtojGBy3ErE=";
   };
 
   vendorHash = "sha256-6PPNVnsH1eU4fLcZpxiBoHCzN/TUUxfTfmxDsBDPDKQ=";

pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch

···
+diff --git a/xslt/common/html.xsl b/xslt/common/html.xsl
+index 77aed075..82832fb4 100644
+--- a/xslt/common/html.xsl
++++ b/xslt/common/html.xsl
+@@ -266,6 +266,16 @@ certain tokens, and you can add your own with {html.sidebar.mode}. See
+ -->
+ <xsl:param name="html.sidebar.right" select="''"/>
+ 
++<!--@@==========================================================================
++html.csp.nonce
++An optional CSP nonce string to allow the execution of scripts and styles.
++@revision[version=42.2 date=2025-02-22 status=final]
++
++This parameter takes a string value that will be added to the 'nonce' attribute
++of all 'style' and 'script' tags in the generated HTML output. This paramter is used
++to whitelist script and style tags that are allowed to be executed.
++-->
++<xsl:param name="html.csp.nonce" select="false()"/>
+ 
+ <!--**==========================================================================
+ html.output
+@@ -1124,6 +1134,11 @@ dimensions. All parameters can be automatically computed if not provided.
+     </xsl:call-template>
+   </xsl:param>
+   <style type="text/css">
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if>
+     <xsl:call-template name="html.css.content">
+       <xsl:with-param name="node" select="$node"/>
+       <xsl:with-param name="direction" select="$direction"/>
+@@ -1533,6 +1548,11 @@ copy, override this template and provide the necessary files.
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+     <script type="text/javascript">
++      <xsl:if test="$html.csp.nonce">
++        <xsl:attribute name="nonce">
++          <xsl:value-of select="$html.csp.nonce" />
++        </xsl:attribute>
++      </xsl:if>
+       <xsl:attribute name="src">
+         <xsl:text>http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=MML_HTMLorMML</xsl:text>
+       </xsl:attribute>
+@@ -1558,6 +1578,11 @@ result of {html.js.content} to that file.
+ <xsl:template name="html.js.script">
+   <xsl:param name="node" select="."/>
+   <script type="text/javascript">
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if>
+     <xsl:call-template name="html.js.content">
+       <xsl:with-param name="node" select="$node"/>
+     </xsl:call-template>
+@@ -2035,8 +2060,19 @@ on all `code` elements with `"syntax"` in the class value.
+ <xsl:template name="html.js.syntax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$html.syntax.highlight">
+-  <script type="text/javascript" src="{$html.js.root}highlight.pack.js"></script>
+-  <script><![CDATA[
++    <script type="text/javascript" src="{$html.js.root}highlight.pack.js">
++      <xsl:if test="$html.csp.nonce">
++        <xsl:attribute name="nonce">
++          <xsl:value-of select="$html.csp.nonce" />
++        </xsl:attribute>
++      </xsl:if>
++    </script>
++    <script>
++    <xsl:if test="$html.csp.nonce">
++      <xsl:attribute name="nonce">
++        <xsl:value-of select="$html.csp.nonce" />
++      </xsl:attribute>
++    </xsl:if><![CDATA[
+ document.addEventListener('DOMContentLoaded', function() {
+   var matches = document.querySelectorAll('code.syntax')
+   for (var i = 0; i < matches.length; i++) {

pkgs/by-name/ye/yelp-xsl/package.nix

···
 
   doCheck = true;
 
+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "yelp-xsl";

pkgs/by-name/ye/yelp/cve-2025-3155.patch

···
+diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
+index 9e44b734..0a74da55 100644
+--- a/data/xslt/mal2html.xsl.in
++++ b/data/xslt/mal2html.xsl.in
+@@ -19,6 +19,11 @@
+ <xsl:param name="mal.link.prefix" select="'xref:'"/>
+ <xsl:param name="mal.link.extension" select="''"/>
+ 
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
++</xsl:template>
++
+ <xsl:template name="mal.link.target.custom">
+   <xsl:param name="node" select="."/>
+   <xsl:param name="action" select="$node/@action"/>
+diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
+index 676ce3eb..56bc1f5c 100644
+--- a/data/xslt/man2html.xsl.in
++++ b/data/xslt/man2html.xsl.in
+@@ -131,7 +131,7 @@
+   the correct styling and a single character which we measure the
+   width of and update each sheet as required.
+ -->
+-<script type="text/javascript" language="javascript">
++<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
+ <xsl:text>
+ $(document).ready (function () {
+   var div = document.getElementById("invisible-char");
+diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
+index 0c1ec9bb..421fc02d 100644
+--- a/data/xslt/yelp-common.xsl.in
++++ b/data/xslt/yelp-common.xsl.in
+@@ -15,6 +15,13 @@
+ <xsl:param name="html.syntax.highlight" select="true()"/>
+ <xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
+ 
++<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
++
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
++</xsl:template>
++
+ <xsl:template name="html.js.mathjax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
+index e74eb463..2ce1d05b 100644
+--- a/libyelp/yelp-transform.c
++++ b/libyelp/yelp-transform.c
+@@ -71,6 +71,8 @@ static void      xslt_yelp_cache            (xsltTransformContextPtr  ctxt,
+                                              xsltStylePreCompPtr      comp);
+ static void      xslt_yelp_aux              (xmlXPathParserContextPtr ctxt,
+                                              int                      nargs);
++static void      xslt_yelp_generate_nonce   (xmlXPathParserContextPtr ctxt,
++                                             int                      nargs);
+ 
+ enum {
+     PROP_0,
+@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
+                              BAD_CAST "input",
+                              BAD_CAST YELP_NAMESPACE,
+                              (xmlXPathFunction) xslt_yelp_aux);
++    xsltRegisterExtFunction (priv->context,
++                         BAD_CAST "generate_nonce",
++                         BAD_CAST YELP_NAMESPACE,
++                         (xmlXPathFunction) xslt_yelp_generate_nonce);
+ 
+     priv->output = xsltApplyStylesheetUser (priv->stylesheet,
+                                             priv->input,
+@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
+     xsltExtensionInstructionResultRegister (tctxt, ret);
+     valuePush (ctxt, ret);
+ }
++
++static void
++xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
++{
++    GRand* rand;
++    gchar* nonce_str;
++
++    rand = g_rand_new ();
++    nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
++    xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
++    g_free(nonce_str);
++    g_rand_free(rand);
++}
+diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
+index 32ae131e..d544c5df 100644
+--- a/libyelp/yelp-view.c
++++ b/libyelp/yelp-view.c
+@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
+ 
+     if (app_info)
+       {
+-        if (!strstr (g_app_info_get_executable (app_info), "yelp"))
++        if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
+           {
+             GList l;
+ 

pkgs/by-name/ye/yelp/package.nix

···
     gst_all_1.gst-plugins-good
   ];
 
+  patches = [
+    ./cve-2025-3155.patch
+  ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "yelp";

pkgs/by-name/ze/zed-editor/package.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.181.5";
+  version = "0.181.8";
 
   outputs =
     [ "out" ]
···
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wp8CoWEOSScQP2Q+lQJgstzTNNwiy0ONHOy6PjIlFBo=";
+    hash = "sha256-gkbiV0kfeM1Ito8jVOBVneNjaXCA4PFayXJLIUmjqn4=";
   };
 
   patches = [
···
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FATdeVwbSUA/zfWV9TdoS4/fT9KWsekKGjQ34HJW4rk=";
+  cargoHash = "sha256-PMLu2PeyRNu6VbHByL+clUoY/P8Rlrc+SvP5gDKrN/E=";
 
   nativeBuildInputs =
     [

pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix

···
   libgee,
   libhandy,
   libxml2,
-  libsoup_2_4,
   elementary-calendar,
 }:
 
···
     libgee
     libhandy
     libical
-    libsoup_2_4
     wingpanel
   ];
 

pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix

···
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gettext,
   pkg-config,
+  xfce4-dev-tools,
   glib,
   gtk3,
   json_c,
   libxml2,
-  libsoup_2_4,
+  libsoup_3,
   upower,
   libxfce4ui,
   libxfce4util,
   xfce4-panel,
   xfconf,
-  hicolor-icon-theme,
   gitUpdater,
 }:
 
···
     sha256 = "sha256-AC0f5jkG0vOgEvPLWMzv8d+8xGZ1njbHbTsD3QHA3Fc=";
   };
 
+  patches = [
+    # Port to libsoup-3.0
+    # https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/merge_requests/28
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/c0653a903c6f2cecdf41ac9eaeba4f4617656ffe.patch";
+      hash = "sha256-wAowm4ppBSKvYwOowZbbs5pnTh9EQ9XX05lA81wtsRM=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/279c975dc1f95bd1ce9152eee1d19122e7deb9a8.patch";
+      hash = "sha256-gVfyXkE0bjBfvcQU9fDp+Gm59bD3VbAam04Jak8i31k=";
+    })
+  ];
+
   nativeBuildInputs = [
     gettext
     pkg-config
+    xfce4-dev-tools
   ];
 
   buildInputs = [
···
     gtk3
     json_c
     libxml2
-    libsoup_2_4
+    libsoup_3
     upower
     libxfce4ui
     libxfce4util
     xfce4-panel
     xfconf
-    hicolor-icon-theme
   ];
+
+  configureFlags = [ "--enable-maintainer-mode" ];
 
   enableParallelBuilding = true;
 

pkgs/development/compilers/dotnet/default.nix

···
 
         patchNupkgs = callPackage ./patch-nupkgs.nix { };
         nugetPackageHook = callPackage ./nuget-package-hook.nix { };
+        autoPatchcilHook = callPackage ../../../build-support/dotnet/auto-patchcil-hook { };
 
         buildDotnetModule = callPackage ../../../build-support/dotnet/build-dotnet-module { };
         buildDotnetGlobalTool = callPackage ../../../build-support/dotnet/build-dotnet-global-tool { };

pkgs/development/libraries/gegl/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gegl";
-  version = "0.4.54";
+  version = "0.4.58";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NaNC8IxrQ3mt7iy1dI/E4wfP3PJBfAuxfWymVD8jix4=";
+    hash = "sha256-1WeLvV/lNZQbgvlluX/Mk4XOk29wyYK9VlpT1VGdG/8=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/jemalloc/default.nix

···
     automake
   ];
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export LDFLAGS="$LDFLAGS -Wl,-no_uuid -Wl,-install_name,@rpath/libjemalloc.2.dylib";
-  '';
+  preConfigure = "";
 
   # TODO: switch to autoreconfHook when updating beyond 5.3.0
   # https://github.com/jemalloc/jemalloc/issues/2346

pkgs/development/libraries/librdf/raptor.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libxml2,
-  curl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "raptor";
-  version = "1.4.21";
-
-  src = fetchurl {
-    url = "http://download.librdf.org/source/raptor-${version}.tar.gz";
-    sha256 = "db3172d6f3c432623ed87d7d609161973d2f7098e3d2233d0702fbcc22cfd8ca";
-  };
-
-  buildInputs = [
-    libxml2
-    curl
-  ];
-
-  preBuild = ''
-    sed -e '/curl\/types/d' -i src/*.c src/*.h
-  '';
-
-  meta = {
-    description = "RDF Parser Toolkit";
-    homepage = "https://librdf.org/raptor";
-    license = with lib.licenses; [
-      lgpl21
-      asl20
-    ];
-    maintainers = [ lib.maintainers.marcweber ];
-    platforms = lib.platforms.linux;
-    # error: passing argument 2 of 'xmlSetStructuredErrorFunc' from incompatible pointer type [-Wincompatible-pointer-types]
-    broken = true;
-  };
-}

pkgs/development/libraries/qt-6/modules/qtwayland.nix

···
   wayland-scanner,
   pkg-config,
   libdrm,
+  fetchpatch,
 }:
 
 qtModule {
   pname = "qtwayland";
+
+  # Backport fix for popups not rendering properly
+  # FIXME: remove in 6.9.1
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/e4556c59f0c8250da7c16759432b2ac0a5ac9d9f.patch";
+      hash = "sha256-wRNXBwecuULn5MD87HP20uSuxHiuQslKp20DIuCGheM=";
+    })
+  ];
+
   # wayland-scanner needs to be propagated as both build
   # (for the wayland-scanner binary) and host (for the
   # actual wayland.xml protocol definition)

pkgs/development/lua-modules/bit32.patch

···
-diff -Naur lua-compat-5.2/c-api/compat-5.2.h lua-compat-5.2-patched/c-api/compat-5.2.h
---- lua-compat-5.2/c-api/compat-5.2.h	2015-02-19 09:23:42.000000000 +1100
-+++ lua-compat-5.2-patched/c-api/compat-5.2.h	2019-06-17 17:58:13.585361793 +1000
-@@ -146,8 +146,10 @@
- #define lua_pushglobaltable(L) \
-   lua_pushvalue(L, LUA_GLOBALSINDEX)
- 
-+#if !defined(luaL_newlib)
- #define luaL_newlib(L, l) \
-   (lua_newtable((L)),luaL_setfuncs((L), (l), 0))
-+#endif
- 
- void luaL_checkversion (lua_State *L);
- 

pkgs/development/lua-modules/generated-packages.nix

···
   bit32 = callPackage (
     {
       buildLuarocksPackage,
-      fetchFromGitHub,
       fetchurl,
+      fetchzip,
+      luaAtLeast,
       luaOlder,
     }:
     buildLuarocksPackage {
       pname = "bit32";
-      version = "5.3.0-1";
+      version = "5.3.5.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/bit32-5.3.0-1.rockspec";
-          sha256 = "1d6xdihpksrj5a3yvsvnmf3vfk15hj6f8n1rrs65m7adh87hc0yd";
+          url = "mirror://luarocks/bit32-5.3.5.1-1.rockspec";
+          sha256 = "11mg0hmmil92hkwamm91ghih6ys9pqsakx0z9jgnqxymnl887j51";
         }).outPath;
-      src = fetchFromGitHub {
-        owner = "keplerproject";
-        repo = "lua-compat-5.2";
-        rev = "bitlib-5.3.0";
-        hash = "sha256-Ek7FMWskfHwHhEVfjTDZyL/cruHDiQo5Jmnwsvai+MY=";
+      src = fetchzip {
+        url = "https://github.com/keplerproject/lua-compat-5.3/archive/v0.10.zip";
+        sha256 = "1caxn228gx48g6kymp9w7kczgxcg0v0cd5ixsx8viybzkd60dcn4";
       };
 
-      disabled = luaOlder "5.1";
+      disabled = luaOlder "5.1" || luaAtLeast "5.5";
 
       meta = {
         homepage = "http://www.lua.org/manual/5.2/manual.html#6.7";
         description = "Lua 5.2 bit manipulation library";
         maintainers = with lib.maintainers; [ lblasc ];
-        license.fullName = "MIT/X11";
+        license.fullName = "MIT";
       };
     }
   ) { };
···
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.1823-1";
+      version = "0.0.1836-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.1823-1.rockspec";
-          sha256 = "0icbchqxr546j21xq2f6w122xkcmqgpg9pywlip8xjj8vsdfx6n6";
+          url = "mirror://luarocks/fzf-lua-0.0.1836-1.rockspec";
+          sha256 = "1q0wfck09d0449q8dyb95cyyr8z0r8292dp8vrqq3jcd7qkjcf1q";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/47b85a25c0c0b2c20b4e75199ed01bb71e7814f5.zip";
-        sha256 = "1znlhvb84x3lipa5n1cdk1kpid49h647hnnwy01xw447vk49p11p";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/ba5ba606f11967e08165aeeb9d7abe04d0835f58.zip";
+        sha256 = "1r66yrpzzzazasmb450xpr11f0sjg8ckrf91x4c66ypsanz2z2ws";
       };
 
       disabled = luaOlder "5.1";
···
       src = fetchFromGitHub {
         owner = "lewis6991";
         repo = "gitsigns.nvim";
-        rev = "c6fedfd0b1715ee624384b134becec0a7b0a3d28";
-        hash = "sha256-c+7Bf7SqVaNiYHczouYChDrurDdTxIDzr/TLMtLqZ50=";
+        rev = "fcfa7a989cd6fed10abf02d9880dc76d7a38167d";
+        hash = "sha256-cg8r0yuuSE8G5MTj0pET8MzJ+VQf+HsXDJx5FzriM78=";
       };
 
       disabled = lua.luaversion != "5.1";
···
     }
   ) { };
 
-  haskell-tools-nvim = callPackage (
+  grug-far-nvim = callPackage (
     {
       buildLuarocksPackage,
       fetchurl,
···
       luaOlder,
     }:
     buildLuarocksPackage {
-      pname = "haskell-tools.nvim";
-      version = "5.0.0-1";
+      pname = "grug-far.nvim";
+      version = "1.6.6-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/haskell-tools.nvim-5.0.0-1.rockspec";
-          sha256 = "0ps1aqz344b2kc0p5zs70i4n9s07fnc5b2kxdbyj1x8cn3ndv959";
+          url = "mirror://luarocks/grug-far.nvim-1.6.6-1.rockspec";
+          sha256 = "1axdj580nv078d4rh7q9rqd5rd46cvd3gfif0cbqys2kpv0xx53d";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v5.0.0.zip";
-        sha256 = "0xwxxwcn775yjqjs90mr1qs9hf5dyqxhkii38yfq1cv5w8bnlrff";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/d6c682af0033b4fbb3645a997e3b4a9189ed1ed6.zip";
+        sha256 = "0v1nfyiymb17p3fkk6ih1pxiib25f8vg74k79vp9r5wr56l9ja9c";
       };
 
       disabled = luaOlder "5.1";
 
       meta = {
-        homepage = "https://github.com/mrcjkb/haskell-tools.nvim";
-        description = " 🦥 Supercharge your Haskell experience in neovim!";
-        maintainers = with lib.maintainers; [ mrcjkb ];
-        license.fullName = "GPL-2.0";
+        homepage = "https://github.com/MagicDuck/grug-far.nvim";
+        description = "Find And Replace plugin for neovim";
+        maintainers = with lib.maintainers; [ teto ];
+        license.fullName = "MIT";
       };
     }
   ) { };
 
-  grug-far-nvim = callPackage (
+  haskell-tools-nvim = callPackage (
     {
       buildLuarocksPackage,
       fetchurl,
···
       luaOlder,
     }:
     buildLuarocksPackage {
-      pname = "grug-far.nvim";
-      version = "1.5.15-1";
+      pname = "haskell-tools.nvim";
+      version = "5.0.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.5.15-1.rockspec";
-          sha256 = "1jp6b6kqp389wli766rypam4hr6dqv6v5r8kv1dk21d7glz8hg6h";
+          url = "mirror://luarocks/haskell-tools.nvim-5.0.0-1.rockspec";
+          sha256 = "0ps1aqz344b2kc0p5zs70i4n9s07fnc5b2kxdbyj1x8cn3ndv959";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/5da116bc99a03e14be3b824e319f4e49c676af78.zip";
-        sha256 = "196l6vy9573fkwld3cl927706a6gfgmc71kn1kx3pmk8l6p8hcya";
+        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v5.0.0.zip";
+        sha256 = "0xwxxwcn775yjqjs90mr1qs9hf5dyqxhkii38yfq1cv5w8bnlrff";
       };
 
       disabled = luaOlder "5.1";
 
       meta = {
-        homepage = "https://github.com/MagicDuck/grug-far.nvim";
-        description = "Find And Replace plugin for neovim";
-        license.fullName = "MIT";
+        homepage = "https://github.com/mrcjkb/haskell-tools.nvim";
+        description = " 🦥 Supercharge your Haskell experience in neovim!";
+        maintainers = with lib.maintainers; [ mrcjkb ];
+        license.fullName = "GPL-2.0";
       };
     }
   ) { };
···
     }:
     buildLuarocksPackage {
       pname = "lua-resty-openssl";
-      version = "1.5.2-1";
+      version = "1.6.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-openssl-1.5.2-1.rockspec";
-          sha256 = "1nrriyf9fvn0achn2drvb915kx7cq4ldlyg24g118i8ib1fr9lgd";
+          url = "mirror://luarocks/lua-resty-openssl-1.6.0-1.rockspec";
+          sha256 = "108a53210khinpwk88pcz6s8n2f6hhaib3jfrgi9kjp0r4s14c4q";
         }).outPath;
       src = fetchFromGitHub {
         owner = "fffonion";
         repo = "lua-resty-openssl";
-        rev = "1.5.2";
-        hash = "sha256-vkcqUaHCIBBmcVP4csqjn6oPSBvUF8MBzveIc6jJKWY=";
+        rev = "1.6.0";
+        hash = "sha256-TqBRTFV1255Ct2mm2T8bLJNdSWZTEB6wOOHGRZczcVk=";
       };
 
       meta = {
···
     }:
     buildLuarocksPackage {
       pname = "lua-resty-session";
-      version = "4.0.5-1";
+      version = "4.1.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-session-4.0.5-1.rockspec";
-          sha256 = "0h0kqwna46mrraq310qjb7yigxwv13n4czk24xnqr21czxsskzkg";
+          url = "mirror://luarocks/lua-resty-session-4.1.0-1.rockspec";
+          sha256 = "0cmx2rwiwiprg1112chxrfvp7gs2jg0grdnkb5n7yhd5rnp0bhhw";
         }).outPath;
       src = fetchFromGitHub {
         owner = "bungle";
         repo = "lua-resty-session";
-        rev = "v4.0.5";
-        hash = "sha256-n0m6/4JnUPoidM7oWKd+ZyNbb/X/h8w21ptCrFaA8SI=";
+        rev = "v4.1.0";
+        hash = "sha256-MXB7Z/0drMOcTwJBHNwZx4iqem1XfG6uwozW+RxL588=";
       };
 
       disabled = luaOlder "5.1";
···
       knownRockspec =
         (fetchurl {
           url = "mirror://luarocks/lualine.nvim-scm-1.rockspec";
-          sha256 = "044bnw2phsxjsxkraaq9phj932f2f7vsbvfa91p7qfp2yjshixjf";
+          sha256 = "1cf500jgdd3f9d36ad9h3vf20vyz4za0lqsdrx9l3si39n71k92v";
         }).outPath;
       src = fetchFromGitHub {
         owner = "nvim-lualine";
         repo = "lualine.nvim";
-        rev = "0ea56f91b7f51a37b749c050a5e5dfdd56b302b3";
-        hash = "sha256-VSWWvhnaeNoeM7U1SwerL8vqu81eg8YJtLnJDdEjvzY=";
+        rev = "86fe39534b7da729a1ac56c0466e76f2c663dc42";
+        hash = "sha256-XeAFXg6GWzMJV/HzfdCXtv/effAHVU7mioFKTf1kDc8=";
       };
 
       disabled = luaOlder "5.1";
···
       version = "0.6.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luasystem-0.6.0-1.rockspec";
-          sha256 = "0pbjxfa56wy2bzs3q0bsxv27m8l2f3p2frvkprah2n708pxzi84s";
+          url = "mirror://luarocks/luasystem-0.6.2-1.rockspec";
+          sha256 = "0s6vd8a35x156ccp9b95rzqgklmgvz3a2bcfp4g09vlyh2kqy1am";
         }).outPath;
       src = fetchFromGitHub {
         owner = "lunarmodules";
         repo = "luasystem";
-        rev = "v0.6.0";
-        hash = "sha256-xhMdtI8tVBIQ4hsGe3l9z/ywJTvJhtGoE9hVnzvrTGc=";
+        rev = "v0.6.2";
+        hash = "sha256-EcKs8W8UAbyA5WCt75tGO2osNgFbL8SNUl78vKSy82o=";
       };
 
       disabled = luaOlder "5.1";
···
       src = fetchFromGitHub {
         owner = "hrsh7th";
         repo = "nvim-cmp";
-        rev = "059e89495b3ec09395262f16b1ad441a38081d04";
-        hash = "sha256-YC2ehgS759GzRUySPqmb1NQFxJ9HnP731oVYptWU3Xk=";
+        rev = "b5311ab3ed9c846b585c0c15b7559be131ec4be9";
+        hash = "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.4";
···
       src = fetchFromGitHub {
         owner = "nvim-lua";
         repo = "plenary.nvim";
-        rev = "3707cdb1e43f5cea73afb6037e6494e7ce847a66";
-        hash = "sha256-18zX3kZ42ynRefFP0mOcy6ESEpejTukjNi4jCRXx48A=";
+        rev = "857c5ac632080dba10aae49dba902ce3abf91b35";
+        hash = "sha256-8FV5RjF7QbDmQOQynpK7uRKONKbPRYbOPugf9ZxNvUs=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.4";
···
     }:
     buildLuarocksPackage {
       pname = "rest.nvim";
-      version = "3.9.1-1";
+      version = "3.12.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rest.nvim-3.9.1-1.rockspec";
-          sha256 = "02arw1hr702jfadnc72yr3kkhfcm7hfg1ipis7nlhvsj25i2yl54";
+          url = "mirror://luarocks/rest.nvim-3.12.0-1.rockspec";
+          sha256 = "1i16gr471v9v6jdwrqizagznpjdr58ijx0cs9yjnd8b6b9cwmxi9";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.9.1.zip";
-        sha256 = "15lkdr77q7zxqbh3xkx3ilj38hp5jfinrqw92q3dpmxc8d8wk9iw";
+        url = "https://github.com/rest-nvim/rest.nvim/archive/v3.12.0.zip";
+        sha256 = "1494r144idrq09da8ra4q0yk7giqh4hxs05397ja7hpxyz0yabdr";
       };
 
       disabled = luaOlder "5.1";
···
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "6.0.1-1";
+      version = "6.0.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.0.1-1.rockspec";
-          sha256 = "02qxbrk32fay17nlxs4sf4dpkvsfnj5lkm8wsb2q0a8jaa2v7dxv";
+          url = "mirror://luarocks/rustaceanvim-6.0.2-1.rockspec";
+          sha256 = "1z2s2f91mnc9fxr5ykffajpj2c92rjgnwipfvi2lhhl2p5hpgf9f";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.1.zip";
-        sha256 = "032barkibbsjjwzq87jbn2sqni3f5bmfvxn2bcq589viwdrziwgf";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.0.2.zip";
+        sha256 = "09wrfmzbk81xax5p4wzczsvv1x28nv54mayi12fvzv6c3bmcsbvj";
       };
 
       disabled = luaOlder "5.1";
···
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "415af52339215926d705cccc08145f3782c4d132";
-        hash = "sha256-5y8srYKaAqFplMtDjsc8GdDF8yui5vCNMiOeFLrC/sM=";
+        rev = "a4ed82509cecc56df1c7138920a1aeaf246c0ac5";
+        hash = "sha256-GF1zOHZItVZm3bx2wqI4hPj7EXQJ2F9KS4MtaEt2gm0=";
       };
 
       disabled = lua.luaversion != "5.1";

pkgs/development/lua-modules/overrides.nix

···
   cargo,
   cmake,
 
-  # plenary utilities
+  ast-grep,
   which,
   findutils,
   coreutils,
···
   ##########################################3
   #### manual fixes for generated packages
   ##########################################3
-  bit32 = prev.bit32.overrideAttrs (oa: {
-    # Small patch in order to no longer redefine a Lua 5.2 function that Luajit
-    # 2.1 also provides, see https://github.com/LuaJIT/LuaJIT/issues/325 for
-    # more
-    patches = [
-      ./bit32.patch
-    ];
-    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
-  });
-
   busted = prev.busted.overrideAttrs (oa: {
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       installShellFiles
···
       runHook preCheck
       # feel free to disable/adjust the tests
       rm tests/base/test_apply.lua tests/base/test_vimscript_interpreter.lua
+
+      # Dependencies needed in special location
+      mkdir -p deps/{ripgrep,astgrep}
+      mkdir {temp_test_dir,temp_history_dir}
+      ln -s ${lib.getExe ripgrep} deps/ripgrep/rg
+      ln -s ${lib.getExe ast-grep} deps/astgrep/ast-grep
+      ln -s ${vimPlugins.mini-nvim} deps/mini.nvim
+
+      # Update dependency check to respect packaged version
+      substituteInPlace lua/grug-far/test/dependencies.lua \
+        --replace-fail "local RG_VERSION = '14.1.0'" "local RG_VERSION = '${lib.getVersion ripgrep}'" \
+        --replace-fail "local SG_VERSION = '0.35.0'" "local SG_VERSION = '${lib.getVersion ast-grep}'"
+
       make test dir=base
       runHook postCheck
     '';

pkgs/development/python-modules/craft-platforms/default.nix

···
 
 buildPythonPackage rec {
   pname = "craft-platforms";
-  version = "0.7.1";
+  version = "0.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
     owner = "canonical";
     repo = "craft-platforms";
     tag = version;
-    hash = "sha256-+7uaN+ePu+88goPCj9KM3dKhTwV2erP0/Fg05LqOWPg=";
+    hash = "sha256-U57hmQ3UPuwoue8kAxAXiH8ecViryFqIxmpnaAdQnZo=";
   };
 
   postPatch = ''

pkgs/development/python-modules/islpy/default.nix

···
 
 buildPythonPackage rec {
   pname = "islpy";
-  version = "2025.1.3";
+  version = "2025.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "inducer";
     repo = "islpy";
     tag = "v${version}";
-    hash = "sha256-3HUfr0W5X8HaViUD0kpKbdxTTRS/TW6PvAGl8vr03XU=";
+    hash = "sha256-hzqxVLNKm63XliX5rDB54f6n1nJPVJJSAMmNTInbOEE=";
   };
 
   build-system = [

pkgs/development/python-modules/nomadnet/default.nix

···
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "markqvist";
     repo = "NomadNet";
     tag = version;
-    hash = "sha256-TKn35rrWsHo/5bGriMcPx+lPvhWzmVXU3EG4KU/ebwI=";
+    hash = "sha256-HBNZvU4ZCLgEn8ul1iflaY18novZMnn8GIojriX/ej0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/reolink-aio/default.nix

···
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.13.1";
+  version = "0.13.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
···
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = version;
-    hash = "sha256-yEv04y8mkXRmxGmK0UXBRcFdmyAg2xEXYYB0X+0zkao=";
+    hash = "sha256-khO8mu2aWBU9TiorKkMd1e54r5C7ovv6eWyJ61dzOJw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/rns/default.nix

···
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.9.3";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = version;
-    hash = "sha256-50L+5WVsYaidz71rkGZny2KlCR3ZfPEQJEPI38MOBWA=";
+    hash = "sha256-Z6Af/PNQkbo+0xn0kEh2I8T03D/gQpuRNHBhLX3mkms=";
   };
 
   patches = [

pkgs/development/tools/pnpm/default.nix

···
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
     };
     "10" = {
-      version = "10.8.0";
-      hash = "sha256-Kb8sXOrqeZHugu7BX+cWLg+tgW0MSms1oWwB05J0v2k=";
+      version = "10.8.1";
+      hash = "sha256-2LLrvGXPAsNJ7Ka0XJZAuRDxa2revbe5JunbRA5Hysc=";
     };
   };
 

pkgs/games/minecraft-servers/versions.json

···
 {
   "1.21": {
-    "sha1": "4707d00eb834b446575d89a61a11b5d548d8c001",
-    "url": "https://piston-data.mojang.com/v1/objects/4707d00eb834b446575d89a61a11b5d548d8c001/server.jar",
-    "version": "1.21.4",
+    "sha1": "e6ec2f64e6080b9b5d9b471b291c33cc7f509733",
+    "url": "https://piston-data.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar",
+    "version": "1.21.5",
     "javaVersion": 21
   },
   "1.20": {

pkgs/misc/arm-trusted-firmware/default.nix

···
     platformCanUseHDCPBlob = true;
   };
 
+  armTrustedFirmwareRK3568 = buildArmTrustedFirmware rec {
+    extraMakeFlags = [ "bl31" ];
+    platform = "rk3568";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
+  };
+
   armTrustedFirmwareRK3588 = buildArmTrustedFirmware rec {
     extraMakeFlags = [ "bl31" ];
     platform = "rk3588";

pkgs/misc/uboot/default.nix

···
   armTrustedFirmwareAllwinnerH616,
   armTrustedFirmwareRK3328,
   armTrustedFirmwareRK3399,
+  armTrustedFirmwareRK3568,
   armTrustedFirmwareRK3588,
   armTrustedFirmwareS905,
   buildPackages,
···
       "x86_64-linux"
     ];
     filesToInstall = [ "u-boot.rom" ];
+  };
+
+  ubootQuartz64B = buildUBoot {
+    defconfig = "quartz64-b-rk3566_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    filesToInstall = [
+      "idbloader.img"
+      "idbloader-spi.img"
+      "u-boot.itb"
+      "u-boot-rockchip.bin"
+      "u-boot-rockchip-spi.bin"
+    ];
   };
 
   ubootRaspberryPi = buildUBoot {

pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix

···
 
 buildNpmPackage rec {
   pname = "sankey-chart";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "MindFreeze";
     repo = "ha-sankey-chart";
     rev = "v${version}";
-    hash = "sha256-Yjh9HrL7zcMFSlXLRW071zG4Wiyv9q2siIw5Ego4e80=";
+    hash = "sha256-krWK2P7tjK5loFYXZ5+b8UN4TEKPObW2QK+3l7+zvj0=";
   };
 
-  npmDepsHash = "sha256-rrzBw+zkvSf6+ABSGfC8rvtQ+pxYyZOPDW7TBpA0ysQ=";
+  npmDepsHash = "sha256-OBgmmPcwpMxXrytP2tHzCFe1imz1S6LHBWJkruw3jgI=";
 
   installPhase = ''
     runHook preInstall

pkgs/top-level/aliases.nix

···
   libquotient = libsForQt5.libquotient; # Added 2023-11-11
   librarian-puppet-go = throw "'librarian-puppet-go' has been removed, as it's upstream is unmaintained"; # Added 2024-06-10
   librdf = throw "'librdf' has been renamed to/replaced by 'lrdf'"; # Converted to throw 2024-10-17
+  librdf_raptor = throw "librdf_raptor has been remove due to failing to build and being unmaintained"; # Added 2025-04-14
   LibreArp = librearp; # Added 2024-06-12
   LibreArp-lv2 = librearp-lv2; # Added 2024-06-12
   libreddit = throw "'libreddit' has been removed because it is unmaintained upstream. Consider using 'redlib', a maintained fork"; # Added 2024-07-17

pkgs/top-level/all-packages.nix

···
     buildDotnetGlobalTool
     mkNugetSource
     mkNugetDeps
+    autoPatchcilHook
     ;
 
   dotnetenv = callPackage ../build-support/dotnet/dotnetenv {
···
     haskellLib = haskell.lib.compose;
   };
 
-  librdf_raptor = callPackage ../development/libraries/librdf/raptor.nix { };
-
   librdf_raptor2 = callPackage ../development/libraries/librdf/raptor2.nix { };
 
   librdf_rasqal = callPackage ../development/libraries/librdf/rasqal.nix { };
···
     armTrustedFirmwareQemu
     armTrustedFirmwareRK3328
     armTrustedFirmwareRK3399
+    armTrustedFirmwareRK3568
     armTrustedFirmwareRK3588
     armTrustedFirmwareS905
     ;
···
     ubootQemuArm
     ubootQemuRiscv64Smode
     ubootQemuX86
+    ubootQuartz64B
     ubootRaspberryPi
     ubootRaspberryPi2
     ubootRaspberryPi3_32bit
···
     avahi = avahi.override { withLibdnssdCompat = true; };
   };
 
-  keepassxc = libsForQt5.callPackage ../applications/misc/keepassxc {
-    inherit (darwin.apple_sdk_11_0.frameworks) LocalAuthentication;
-  };
-
   evolution-data-server-gtk4 = evolution-data-server.override {
     withGtk3 = false;
     withGtk4 = true;
···
 
   inherit (xorg) xlsfonts;
 
-  gimp = callPackage ../applications/graphics/gimp {
+  gimp3 = callPackage ../applications/graphics/gimp {
+    lcms = lcms2;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
+  };
+
+  gimp3-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
+    gimpPlugins = gimp3Plugins;
+    plugins = null; # All packaged plugins enabled, if not explicit plugin list supplied
+  };
+
+  gimp3Plugins = recurseIntoAttrs (
+    callPackage ../applications/graphics/gimp/plugins {
+      gimp = gimp3;
+    }
+  );
+
+  gimp = callPackage ../applications/graphics/gimp/2.0 {
     autoreconfHook = buildPackages.autoreconfHook269;
     lcms = lcms2;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;