Merge remote-tracking branch 'origin/master' into staging-next

2024-11-21 22:43:01 +00:00 · 2024-10-27 16:10:56 -06:00 · 2024-10-27 16:10:56 -06:00 · 34b62f7c47
commit 34b62f7c47
parent cae0fd41a2 e52c5b6740
204 changed files with 5709 additions and 2819 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -192,3 +192,11 @@ ce21e97a1f20dee15da85c084f9d1148d84f853b

 # percona: apply nixfmt
 8d14fa2886fec877690c6d28cfcdba4503dbbcea
+
+# nixos/virtualisation: format image-related files
+# Original formatting commit that was reverted
+04fadac429ca7d6b92025188652376c230205730
+# Revert commit
+4cec81a9959ce612b653860dcca53101a36f328a
+# Final commit that does the formatting
+88b285c01d84de82c0b2b052fd28eaf6709c2d26
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -942,6 +942,11 @@ lib.mapAttrs mkLicense ({
    url = "https://license.coscl.org.cn/MulanPSL2";
  };

+  naist-2003 = {
+    spdxId = "NAIST-2003";
+    fullName = "Nara Institute of Science and Technology License (2003)";
+  };
+
  nasa13 = {
    spdxId = "NASA-1.3";
    fullName = "NASA Open Source Agreement 1.3";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -743,6 +743,11 @@
    githubId = 37664775;
    name = "Yuto Oguchi";
  };
+  airrnot = {
+    name = "airRnot";
+    github = "airRnot1106";
+    githubId = 62370527;
+  };
  airwoodix = {
    email = "airwoodix@posteo.me";
    github = "airwoodix";
@ -5871,7 +5876,10 @@
    github = "jollheef";
    githubId = 1749762;
    name = "Mikhail Klementev";
-    keys = [ { fingerprint = "5DD7 C6F6 0630 F08E DAE7  4711 1525 585D 1B43 C62A"; } ];
+    keys = [
+      { fingerprint = "5AC8 C9A1 68C7 9451 1A91  2295 C990 5BA7 2B5E 02BB"; }
+      { fingerprint = "5DD7 C6F6 0630 F08E DAE7  4711 1525 585D 1B43 C62A"; }
+    ];
  };
  dunxen = {
    email = "git@dunxen.dev";
@ -10507,6 +10515,13 @@
    githubId = 168684553;
    name = "João Marques";
  };
+  joinemm = {
+    email = "joonas@rautiola.co";
+    github = "joinemm";
+    githubId = 26210439;
+    name = "Joonas Rautiola";
+    keys = [ { fingerprint = "87EC DD30 6614 E510 5299  F0D4 090E B48A 4669 AA54"; } ];
+  };
  jojosch = {
    name = "Johannes Schleifenbaum";
    email = "johannes@js-webcoding.de";
@ -12396,6 +12411,13 @@
    githubId = 169170;
    name = "Mathias Schreck";
  };
+  loc = {
+    matrix = "@loc:locrealloc.de";
+    github = "LoCrealloc";
+    githubId = 64095253;
+    name = "LoC";
+    keys = [ { fingerprint = "DCCE F73B 209A 6024 CAE7  F926 5563 EB4A 8634 4F15"; } ];
+  };
  locallycompact = {
    email = "dan.firth@homotopic.tech";
    github = "locallycompact";
@ -14822,6 +14844,11 @@
    githubId = 96225281;
    name = "Mustafa Çalışkan";
  };
+  musjj = {
+    name = "musjj";
+    github = "musjj";
+    githubId = 72612857;
+  };
  mvisonneau = {
    name = "Maxime VISONNEAU";
    email = "maxime@visonneau.fr";
@ -23135,6 +23162,13 @@
    githubId = 1215623;
    keys = [ { fingerprint = "DA03 D6C6 3F58 E796 AD26  E99B 366A 2940 479A 06FC"; } ];
  };
+  wilhelmines = {
+    email = "mail@aesz.org";
+    matrix = "@wilhelmines:matrix.org";
+    name = "Ronja Schwarz";
+    github = "wilhelmines";
+    githubId = 71409721;
+  };
  willbush = {
    email = "git@willbush.dev";
    matrix = "@willbush:matrix.org";
@ -24248,12 +24282,6 @@
    githubId = 71881325;
    name = "Stefan Bordei";
  };
-  zzamboni = {
-    email = "diego@zzamboni.org";
-    github = "zzamboni";
-    githubId = 32876;
-    name = "Diego Zamboni";
-  };
  zzzsy = {
    email = "me@zzzsy.top";
    github = "zzzsyyy";
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@ -1,24 +1,47 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
-  inherit (lib) mkOption optionalString types versionAtLeast;
+  inherit (lib)
+    mkOption
+    optionalString
+    types
+    versionAtLeast
+    ;
  inherit (lib.options) literalExpression;
  cfg = config.amazonImage;
  amiBootMode = if config.ec2.efi then "uefi" else "legacy-bios";
-
-in {
-
-  imports = [ ../../../modules/virtualisation/amazon-image.nix ];
+in
+{
+  imports = [
+    ../../../modules/virtualisation/amazon-image.nix
+    ../../../modules/virtualisation/disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "amazonImage"
+        "sizeMB"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  # Amazon recommends setting this to the highest possible value for a good EBS
  # experience, which prior to 4.15 was 255.
  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
  config.boot.kernelParams =
-    let timeout =
-      if versionAtLeast config.boot.kernelPackages.kernel.version "4.15"
-      then "4294967295"
-      else  "255";
-    in [ "nvme_core.io_timeout=${timeout}" ];
+    let
+      timeout =
+        if versionAtLeast config.boot.kernelPackages.kernel.version "4.15" then "4294967295" else "255";
+    in
+    [ "nvme_core.io_timeout=${timeout}" ];

  options.amazonImage = {
    name = mkOption {
@ -34,30 +57,32 @@ in {
          }
        ]
      '';
-      default = [];
+      default = [ ];
      description = ''
        This option lists files to be copied to fixed locations in the
        generated image. Glob patterns work.
      '';
    };

-    sizeMB = mkOption {
-      type = with types; either (enum [ "auto" ]) int;
-      default = 3072;
-      example = 8192;
-      description = "The size in MB of the image";
-    };
-
    format = mkOption {
-      type = types.enum [ "raw" "qcow2" "vpc" ];
+      type = types.enum [
+        "raw"
+        "qcow2"
+        "vpc"
+      ];
      default = "vpc";
      description = "The image format to output";
    };
  };

-  config.system.build.amazonImage = let
-    configFile = pkgs.writeText "configuration.nix"
-      ''
+  # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
+  # to avoid breaking existing configs using that.
+  config.virtualisation.diskSize = lib.mkOverride 1490 (3 * 1024);
+  config.virtualisation.diskSizeAutoSupported = !config.ec2.zfs.enable;
+
+  config.system.build.amazonImage =
+    let
+      configFile = pkgs.writeText "configuration.nix" ''
        { modulesPath, ... }: {
          imports = [ "''${modulesPath}/virtualisation/amazon-image.nix" ];
          ${optionalString config.ec2.efi ''
@ -70,91 +95,102 @@ in {
        }
      '';

-    zfsBuilder = import ../../../lib/make-multi-disk-zfs-image.nix {
-      inherit lib config configFile pkgs;
-      inherit (cfg) contents format name;
+      zfsBuilder = import ../../../lib/make-multi-disk-zfs-image.nix {
+        inherit
+          lib
+          config
+          configFile
+          pkgs
+          ;
+        inherit (cfg) contents format name;

-      includeChannel = true;
+        includeChannel = true;

-      bootSize = 1000; # 1G is the minimum EBS volume
+        bootSize = 1000; # 1G is the minimum EBS volume

-      rootSize = cfg.sizeMB;
-      rootPoolProperties = {
-        ashift = 12;
-        autoexpand = "on";
+        rootSize = config.virtualisation.diskSize;
+        rootPoolProperties = {
+          ashift = 12;
+          autoexpand = "on";
+        };
+
+        datasets = config.ec2.zfs.datasets;
+
+        postVM = ''
+           extension=''${rootDiskImage##*.}
+           friendlyName=$out/${cfg.name}
+           rootDisk="$friendlyName.root.$extension"
+           bootDisk="$friendlyName.boot.$extension"
+           mv "$rootDiskImage" "$rootDisk"
+           mv "$bootDiskImage" "$bootDisk"
+
+           mkdir -p $out/nix-support
+           echo "file ${cfg.format} $bootDisk" >> $out/nix-support/hydra-build-products
+           echo "file ${cfg.format} $rootDisk" >> $out/nix-support/hydra-build-products
+
+          ${pkgs.jq}/bin/jq -n \
+            --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
+            --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
+            --arg root_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+            --arg boot_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$bootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+            --arg boot_mode "${amiBootMode}" \
+            --arg root "$rootDisk" \
+            --arg boot "$bootDisk" \
+           '{}
+             | .label = $system_label
+             | .boot_mode = $boot_mode
+             | .system = $system
+             | .disks.boot.logical_bytes = $boot_logical_bytes
+             | .disks.boot.file = $boot
+             | .disks.root.logical_bytes = $root_logical_bytes
+             | .disks.root.file = $root
+             ' > $out/nix-support/image-info.json
+        '';
      };

-      datasets = config.ec2.zfs.datasets;
+      extBuilder = import ../../../lib/make-disk-image.nix {
+        inherit
+          lib
+          config
+          configFile
+          pkgs
+          ;

-      postVM = ''
-        extension=''${rootDiskImage##*.}
-        friendlyName=$out/${cfg.name}
-        rootDisk="$friendlyName.root.$extension"
-        bootDisk="$friendlyName.boot.$extension"
-        mv "$rootDiskImage" "$rootDisk"
-        mv "$bootDiskImage" "$bootDisk"
+        inherit (cfg) contents format name;

-        mkdir -p $out/nix-support
-        echo "file ${cfg.format} $bootDisk" >> $out/nix-support/hydra-build-products
-        echo "file ${cfg.format} $rootDisk" >> $out/nix-support/hydra-build-products
+        fsType = "ext4";
+        partitionTableType = if config.ec2.efi then "efi" else "legacy+gpt";

-       ${pkgs.jq}/bin/jq -n \
-         --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
-         --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
-         --arg root_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
-         --arg boot_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$bootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
-         --arg boot_mode "${amiBootMode}" \
-         --arg root "$rootDisk" \
-         --arg boot "$bootDisk" \
-        '{}
-          | .label = $system_label
-          | .boot_mode = $boot_mode
-          | .system = $system
-          | .disks.boot.logical_bytes = $boot_logical_bytes
-          | .disks.boot.file = $boot
-          | .disks.root.logical_bytes = $root_logical_bytes
-          | .disks.root.file = $root
-          ' > $out/nix-support/image-info.json
-      '';
-    };
+        inherit (config.virtualisation) diskSize;

-    extBuilder = import ../../../lib/make-disk-image.nix {
-      inherit lib config configFile pkgs;
+        postVM = ''
+           extension=''${diskImage##*.}
+           friendlyName=$out/${cfg.name}.$extension
+           mv "$diskImage" "$friendlyName"
+           diskImage=$friendlyName

-      inherit (cfg) contents format name;
+           mkdir -p $out/nix-support
+           echo "file ${cfg.format} $diskImage" >> $out/nix-support/hydra-build-products

-      fsType = "ext4";
-      partitionTableType = if config.ec2.efi then "efi" else "legacy+gpt";
-
-      diskSize = cfg.sizeMB;
-
-      postVM = ''
-        extension=''${diskImage##*.}
-        friendlyName=$out/${cfg.name}.$extension
-        mv "$diskImage" "$friendlyName"
-        diskImage=$friendlyName
-
-        mkdir -p $out/nix-support
-        echo "file ${cfg.format} $diskImage" >> $out/nix-support/hydra-build-products
-
-       ${pkgs.jq}/bin/jq -n \
-         --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
-         --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
-         --arg logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
-         --arg boot_mode "${amiBootMode}" \
-         --arg file "$diskImage" \
-          '{}
-          | .label = $system_label
-          | .boot_mode = $boot_mode
-          | .system = $system
-          | .logical_bytes = $logical_bytes
-          | .file = $file
-          | .disks.root.logical_bytes = $logical_bytes
-          | .disks.root.file = $file
-          ' > $out/nix-support/image-info.json
-      '';
-    };
-  in if config.ec2.zfs.enable then zfsBuilder else extBuilder;
+          ${pkgs.jq}/bin/jq -n \
+            --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
+            --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
+            --arg logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+            --arg boot_mode "${amiBootMode}" \
+            --arg file "$diskImage" \
+             '{}
+             | .label = $system_label
+             | .boot_mode = $boot_mode
+             | .system = $system
+             | .logical_bytes = $logical_bytes
+             | .file = $file
+             | .disks.root.logical_bytes = $logical_bytes
+             | .disks.root.file = $file
+             ' > $out/nix-support/image-info.json
+        '';
+      };
+    in
+    if config.ec2.zfs.enable then zfsBuilder else extBuilder;

  meta.maintainers = with lib.maintainers; [ arianvp ];
 }
--- a/nixos/maintainers/scripts/openstack/openstack-image-zfs.nix
+++ b/nixos/maintainers/scripts/openstack/openstack-image-zfs.nix
@ -1,6 +1,11 @@
 # nix-build '<nixpkgs/nixos>' -A config.system.build.openstackImage --arg configuration "{ imports = [ ./nixos/maintainers/scripts/openstack/openstack-image.nix ]; }"

-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  inherit (lib) mkOption types;
  copyChannel = true;
@ -10,9 +15,20 @@ in
 {
  imports = [
    ../../../modules/virtualisation/openstack-config.nix
+    ../../../modules/virtualisation/disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "openstackImage"
+        "sizeMB"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
  ] ++ (lib.optional copyChannel ../../../modules/installer/cd-dvd/channel.nix);

-
  options.openstackImage = {
    name = mkOption {
      type = types.str;
@ -22,18 +38,15 @@ in

    ramMB = mkOption {
      type = types.int;
-      default = 1024;
+      default = (3 * 1024);
      description = "RAM allocation for build VM";
    };

-    sizeMB = mkOption {
-      type = types.int;
-      default = 8192;
-      description = "The size in MB of the image";
-    };
-
    format = mkOption {
-      type = types.enum [ "raw" "qcow2" ];
+      type = types.enum [
+        "raw"
+        "qcow2"
+      ];
      default = "qcow2";
      description = "The image format to output";
    };
@ -54,24 +67,28 @@ in
      };
    };

+    # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
+    # to avoid breaking existing configs using that.
+    virtualisation.diskSize = lib.mkOverride 1490 (8 * 1024);
+    virtualisation.diskSizeAutoSupported = false;
+
    system.build.openstackImage = import ../../../lib/make-single-disk-zfs-image.nix {
      inherit lib config;
      inherit (cfg) contents format name;
      pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package

-      configFile = pkgs.writeText "configuration.nix"
-        ''
-          { modulesPath, ... }: {
-            imports = [ "''${modulesPath}/virtualisation/openstack-config.nix" ];
-            openstack.zfs.enable = true;
-          }
-        '';
+      configFile = pkgs.writeText "configuration.nix" ''
+        { modulesPath, ... }: {
+          imports = [ "''${modulesPath}/virtualisation/openstack-config.nix" ];
+          openstack.zfs.enable = true;
+        }
+      '';

      includeChannel = copyChannel;

      bootSize = 1000;
      memSize = cfg.ramMB;
-      rootSize = cfg.sizeMB;
+      rootSize = config.virtualisation.diskSize;
      rootPoolProperties = {
        ashift = 12;
        autoexpand = "on";
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -165,6 +165,10 @@ in
  ###### interface

  options = {
+    security.enableWrappers = lib.mkEnableOption "SUID/SGID wrappers" // {
+      default = true;
+    };
+
    security.wrappers = lib.mkOption {
      type = lib.types.attrsOf wrapperType;
      default = {};
@ -227,7 +231,7 @@ in
  };

  ###### implementation
-  config = {
+  config = lib.mkIf config.security.enableWrappers {

    assertions = lib.mapAttrsToList
      (name: opts:
--- a/nixos/modules/services/misc/anki-sync-server.md
+++ b/nixos/modules/services/misc/anki-sync-server.md
@ -42,6 +42,15 @@ Here, `passwordFile` is the path to a file containing just the password in
 plaintext. Make sure to set permissions to make this file unreadable to any
 user besides root.

+By default, synced data are stored in */var/lib/anki-sync-server/*ankiuser**.
+You can change the directory by using `services.anki-sync-server.baseDirectory`
+
+```nix
+{
+  services.anki-sync-server.baseDirectory = "/home/anki/data";
+}
+```
+
 By default, the server listen address {option}`services.anki-sync-server.host`
 is set to localhost, listening on port
 {option}`services.anki-sync-server.port`, and does not open the firewall. This
--- a/nixos/modules/services/misc/anki-sync-server.nix
+++ b/nixos/modules/services/misc/anki-sync-server.nix
@ -59,6 +59,13 @@ in {
      description = "Port number anki-sync-server listens to.";
    };

+    baseDirectory = mkOption {
+      type = types.str;
+      default = "%S/%N";
+      description = "Base directory where user(s) synchronized data will be stored.";
+    };
+
+
    openFirewall = mkOption {
      default = false;
      type = types.bool;
@ -114,7 +121,7 @@ in {
      wantedBy = ["multi-user.target"];
      path = [cfg.package];
      environment = {
-        SYNC_BASE = "%S/%N";
+        SYNC_BASE = cfg.baseDirectory;
        SYNC_HOST = specEscape cfg.address;
        SYNC_PORT = toString cfg.port;
      };
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@ -54,6 +54,8 @@ in
            --no-update True
        '';
        Restart = "on-failure";
+        KillSignal = "SIGINT";
+        SuccessExitStatus = "0 156";
      };
    };

--- a/nixos/modules/services/networking/xl2tpd.nix
+++ b/nixos/modules/services/networking/xl2tpd.nix
@ -104,31 +104,18 @@ with lib;
      wantedBy = [ "multi-user.target" ];

      preStart = ''
-        mkdir -p -m 700 /etc/xl2tpd
+        install -m 700 -d /etc/xl2tpd/ppp

-        pushd /etc/xl2tpd > /dev/null
-
-        mkdir -p -m 700 ppp
-
-        [ -f ppp/chap-secrets ] || cat > ppp/chap-secrets << EOF
+        [ -f /etc/xl2tpd/ppp/chap-secrets ] || install -m 600 -o root -g root /dev/stdin /etc/xl2tpd/ppp/chap-secrets <<EOF
        # Secrets for authentication using CHAP
        # client	server	secret		IP addresses
        #username	xl2tpd	password	*
        EOF

-        chown root:root ppp/chap-secrets
-        chmod 600 ppp/chap-secrets
-
        # The documentation says this file should be present but doesn't explain why and things work even if not there:
-        [ -f l2tp-secrets ] || (echo -n "* * "; ${pkgs.apg}/bin/apg -n 1 -m 32 -x 32 -a 1 -M LCN) > l2tp-secrets
-        chown root:root l2tp-secrets
-        chmod 600 l2tp-secrets
+        [ -f /etc/xl2tpd/l2tp-secrets ] || install -m 600 -o root -g root <(echo -n "* * "; ${pkgs.apg}/bin/apg -n 1 -m 32 -x 32 -a 1 -M LCN) /etc/xl2tpd/l2tp-secrets

-        popd > /dev/null
-
-        mkdir -p /run/xl2tpd
-        chown root:root /run/xl2tpd
-        chmod 700       /run/xl2tpd
+        install -m 701 -o root -g root -d /run/xl2tpd
      '';

      serviceConfig = {
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@ -1,22 +1,33 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 with lib;
 let
  cfg = config.virtualisation.azureImage;
 in
 {
-  imports = [ ./azure-common.nix ];
+  imports = [
+    ./azure-common.nix
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "virtualisation"
+        "azureImage"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  options.virtualisation.azureImage = {
-    diskSize = mkOption {
-      type = with types; either (enum [ "auto" ]) int;
-      default = "auto";
-      example = 2048;
-      description = ''
-        Size of disk image. Unit is MB.
-      '';
-    };
-
    bootSize = mkOption {
      type = types.int;
      default = 256;
@ -35,7 +46,12 @@ in
    };

    vmGeneration = mkOption {
-      type = with types; enum [ "v1" "v2" ];
+      type =
+        with types;
+        enum [
+          "v1"
+          "v2"
+        ];
      default = "v1";
      description = ''
        VM Generation to use.
@ -57,7 +73,8 @@ in
      bootSize = "${toString cfg.bootSize}M";
      partitionTableType = if cfg.vmGeneration == "v2" then "efi" else "legacy";

-      inherit (cfg) diskSize contents;
+      inherit (cfg) contents;
+      inherit (config.virtualisation) diskSize;
      inherit config lib pkgs;
    };
  };
--- a/nixos/modules/virtualisation/digital-ocean-image.nix
+++ b/nixos/modules/virtualisation/digital-ocean-image.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 with lib;
 let
@ -6,18 +11,24 @@ let
 in
 {

-  imports = [ ./digital-ocean-config.nix ];
+  imports = [
+    ./digital-ocean-config.nix
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "virtualisation"
+        "digitalOceanImage"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  options = {
-    virtualisation.digitalOceanImage.diskSize = mkOption {
-      type = with types; either (enum [ "auto" ]) int;
-      default = "auto";
-      example = 4096;
-      description = ''
-        Size of disk image. Unit is MB.
-      '';
-    };
-
    virtualisation.digitalOceanImage.configFile = mkOption {
      type = with types; nullOr path;
      default = null;
@ -31,7 +42,10 @@ in
    };

    virtualisation.digitalOceanImage.compressionMethod = mkOption {
-      type = types.enum [ "gzip" "bzip2" ];
+      type = types.enum [
+        "gzip"
+        "bzip2"
+      ];
      default = "gzip";
      example = "bzip2";
      description = ''
@ -44,27 +58,35 @@ in

  #### implementation
  config = {
-
    system.build.digitalOceanImage = import ../../lib/make-disk-image.nix {
      name = "digital-ocean-image";
      format = "qcow2";
-      postVM = let
-        compress = {
-          "gzip" = "${pkgs.gzip}/bin/gzip";
-          "bzip2" = "${pkgs.bzip2}/bin/bzip2";
-        }.${cfg.compressionMethod};
-      in ''
-        ${compress} $diskImage
-      '';
-      configFile = if cfg.configFile == null
-        then config.virtualisation.digitalOcean.defaultConfigFile
-        else cfg.configFile;
-      inherit (cfg) diskSize;
+      postVM =
+        let
+          compress =
+            {
+              "gzip" = "${pkgs.gzip}/bin/gzip";
+              "bzip2" = "${pkgs.bzip2}/bin/bzip2";
+            }
+            .${cfg.compressionMethod};
+        in
+        ''
+          ${compress} $diskImage
+        '';
+      configFile =
+        if cfg.configFile == null then
+          config.virtualisation.digitalOcean.defaultConfigFile
+        else
+          cfg.configFile;
+      inherit (config.virtualisation) diskSize;
      inherit config lib pkgs;
    };

  };

-  meta.maintainers = with maintainers; [ arianvp eamsden ];
+  meta.maintainers = with maintainers; [
+    arianvp
+    eamsden
+  ];

 }
--- a/nixos/modules/virtualisation/disk-size-option.nix
+++ b/nixos/modules/virtualisation/disk-size-option.nix
@ -0,0 +1,38 @@
+{ lib, config, ... }:
+let
+  t = lib.types;
+in
+{
+  options = {
+    virtualisation.diskSizeAutoSupported = lib.mkOption {
+      type = t.bool;
+      default = true;
+      description = ''
+        Whether the current image builder or vm runner supports `virtualisation.diskSize = "auto".`
+      '';
+      internal = true;
+    };
+
+    virtualisation.diskSize = lib.mkOption {
+      type = t.either (t.enum [ "auto" ]) t.ints.positive;
+      default = if config.virtualisation.diskSizeAutoSupported then "auto" else 1024;
+      defaultText = "\"auto\" if diskSizeAutoSupported, else 1024";
+      description = ''
+        The disk size in megabytes of the virtual machine.
+      '';
+    };
+  };
+
+  config =
+    let
+      inherit (config.virtualisation) diskSize diskSizeAutoSupported;
+    in
+    {
+      assertions = [
+        {
+          assertion = diskSize != "auto" || diskSizeAutoSupported;
+          message = "Setting virtualisation.diskSize to `auto` is not supported by the current image build or vm runner; use an explicit size.";
+        }
+      ];
+    };
+}
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 with lib;
 let
@ -14,18 +19,24 @@ let
 in
 {

-  imports = [ ./google-compute-config.nix ];
+  imports = [
+    ./google-compute-config.nix
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "virtualisation"
+        "googleComputeImage"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  options = {
-    virtualisation.googleComputeImage.diskSize = mkOption {
-      type = with types; either (enum [ "auto" ]) int;
-      default = "auto";
-      example = 1536;
-      description = ''
-        Size of disk image. Unit is MB.
-      '';
-    };
-
    virtualisation.googleComputeImage.configFile = mkOption {
      type = with types; nullOr str;
      default = null;
@ -64,7 +75,13 @@ in
    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
      name = "google-compute-image";
      postVM = ''
-        PATH=$PATH:${with pkgs; lib.makeBinPath [ gnutar gzip ]}
+        PATH=$PATH:${
+          with pkgs;
+          lib.makeBinPath [
+            gnutar
+            gzip
+          ]
+        }
        pushd $out
        mv $diskImage disk.raw
        tar -Sc disk.raw | gzip -${toString cfg.compressionLevel} > \
@ -75,7 +92,7 @@ in
      format = "raw";
      configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
      partitionTableType = if cfg.efi then "efi" else "legacy";
-      inherit (cfg) diskSize;
+      inherit (config.virtualisation) diskSize;
      inherit config lib pkgs;
    };

--- a/nixos/modules/virtualisation/hyperv-image.nix
+++ b/nixos/modules/virtualisation/hyperv-image.nix
@ -1,21 +1,34 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:

 with lib;

 let
  cfg = config.hyperv;
+in
+{
+
+  imports = [
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "hyperv"
+        "baseImageSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

-in {
  options = {
    hyperv = {
-      baseImageSize = mkOption {
-        type = with types; either (enum [ "auto" ]) int;
-        default = "auto";
-        example = 2048;
-        description = ''
-          The size of the hyper-v base image in MiB.
-        '';
-      };
      vmDerivationName = mkOption {
        type = types.str;
        default = "nixos-hyperv-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
@ -34,6 +47,10 @@ in {
  };

  config = {
+    # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
+    # to avoid breaking existing configs using that.
+    virtualisation.diskSize = lib.mkOverride 1490 (4 * 1024);
+
    system.build.hypervImage = import ../../lib/make-disk-image.nix {
      name = cfg.vmDerivationName;
      postVM = ''
@ -41,7 +58,7 @@ in {
        rm $diskImage
      '';
      format = "raw";
-      diskSize = cfg.baseImageSize;
+      inherit (config.virtualisation) diskSize;
      partitionTableType = "efi";
      inherit config lib pkgs;
    };
--- a/nixos/modules/virtualisation/linode-image.nix
+++ b/nixos/modules/virtualisation/linode-image.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 with lib;
 let
@ -12,17 +17,24 @@ let
  '';
 in
 {
-  imports = [ ./linode-config.nix ];
+  imports = [
+    ./linode-config.nix
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "virtualisation"
+        "linodeImage"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  options = {
-    virtualisation.linodeImage.diskSize = mkOption {
-      type = with types; either (enum (singleton "auto")) ints.positive;
-      default = "auto";
-      example = 1536;
-      description = ''
-        Size of disk image in MB.
-      '';
-    };

    virtualisation.linodeImage.configFile = mkOption {
      type = with types; nullOr str;
@ -57,7 +69,7 @@ in
      format = "raw";
      partitionTableType = "none";
      configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
-      inherit (cfg) diskSize;
+      inherit (config.virtualisation) diskSize;
      inherit config lib pkgs;
    };
  };
--- a/nixos/modules/virtualisation/oci-image.nix
+++ b/nixos/modules/virtualisation/oci-image.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
  cfg = config.oci;
@ -7,9 +12,14 @@ in
  imports = [ ./oci-common.nix ];

  config = {
+    # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
+    # to avoid breaking existing configs using that.
+    virtualisation.diskSize = lib.mkOverride 1490 (8 * 1024);
+    virtualisation.diskSizeAutoSupported = false;
+
    system.build.OCIImage = import ../../lib/make-disk-image.nix {
      inherit config lib pkgs;
-      inherit (cfg) diskSize;
+      inherit (config.virtualisation) diskSize;
      name = "oci-image";
      configFile = ./oci-config-user.nix;
      format = "qcow2";
@ -25,7 +35,10 @@ in
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];

-      path  = [ pkgs.coreutils pkgs.curl ];
+      path = [
+        pkgs.coreutils
+        pkgs.curl
+      ];
      script = ''
        mkdir -m 0700 -p /root/.ssh
        if [ -f /root/.ssh/authorized_keys ]; then
--- a/nixos/modules/virtualisation/oci-options.nix
+++ b/nixos/modules/virtualisation/oci-options.nix
@ -1,5 +1,23 @@
-{ config, lib, pkgs, ... }:
 {
+  lib,
+  ...
+}:
+{
+  imports = [
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "oci"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];
+
  options = {
    oci = {
      efi = lib.mkOption {
@ -9,12 +27,6 @@
          Whether the OCI instance is using EFI.
        '';
      };
-      diskSize = lib.mkOption {
-        type = lib.types.int;
-        default = 8192;
-        description = "Size of the disk image created in MB.";
-        example = "diskSize = 12 * 1024; # 12GiB";
-      };
    };
  };
 }
--- a/nixos/modules/virtualisation/proxmox-image.nix
+++ b/nixos/modules/virtualisation/proxmox-image.nix
@ -1,8 +1,28 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:

 with lib;
-
 {
+  imports = [
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "proxmox"
+        "qemuConf"
+        "diskSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];
+
  options.proxmox = {
    qemuConf = {
      # essential configs
@ -54,7 +74,10 @@ with lib;
        '';
      };
      bios = mkOption {
-        type = types.enum [ "seabios" "ovmf" ];
+        type = types.enum [
+          "seabios"
+          "ovmf"
+        ];
        default = "seabios";
        description = ''
          Select BIOS implementation (seabios = Legacy BIOS, ovmf = UEFI).
@ -87,16 +110,6 @@ with lib;
          either "efi" or "hybrid".
        '';
      };
-      diskSize = mkOption {
-        type = types.str;
-        default = "auto";
-        example = "20480";
-        description = ''
-          The size of the disk, in megabytes.
-          if "auto" size is calculated based on the contents copied to it and
-          additionalSpace is taken into account.
-        '';
-      };
      net0 = mkOption {
        type = types.commas;
        default = "virtio=00:00:00:00:00:00,bridge=vmbr0,firewall=1";
@ -124,8 +137,13 @@ with lib;
      };
    };
    qemuExtraConf = mkOption {
-      type = with types; attrsOf (oneOf [ str int ]);
-      default = {};
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+        ]);
+      default = { };
      example = literalExpression ''
        {
          cpu = "host";
@ -137,7 +155,12 @@ with lib;
      '';
    };
    partitionTableType = mkOption {
-      type = types.enum [ "efi" "hybrid" "legacy" "legacy+gpt" ];
+      type = types.enum [
+        "efi"
+        "hybrid"
+        "legacy"
+        "legacy+gpt"
+      ];
      description = ''
        Partition table type to use. See make-disk-image.nix partitionTableType for details.
        Defaults to 'legacy' for 'proxmox.qemuConf.bios="seabios"' (default), other bios values defaults to 'efi'.
@ -185,142 +208,163 @@ with lib;
    };
  };

-  config = let
-    cfg = config.proxmox;
-    cfgLine = name: value: ''
-      ${name}: ${builtins.toString value}
-    '';
-    virtio0Storage = builtins.head (builtins.split ":" cfg.qemuConf.virtio0);
-    cfgFile = fileName: properties: pkgs.writeTextDir fileName ''
-      # generated by NixOS
-      ${lib.concatStrings (lib.mapAttrsToList cfgLine properties)}
-      #qmdump#map:virtio0:drive-virtio0:${virtio0Storage}:raw:
-    '';
-    inherit (cfg) partitionTableType;
-    supportEfi = partitionTableType == "efi" || partitionTableType == "hybrid";
-    supportBios = partitionTableType == "legacy" || partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
-    hasBootPartition = partitionTableType == "efi" || partitionTableType == "hybrid";
-    hasNoFsPartition = partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
-  in {
-    assertions = [
-      {
-        assertion = config.boot.loader.systemd-boot.enable -> config.proxmox.qemuConf.bios == "ovmf";
-        message = "systemd-boot requires 'ovmf' bios";
-      }
-      {
-        assertion = partitionTableType == "efi" -> config.proxmox.qemuConf.bios == "ovmf";
-        message = "'efi' disk partitioning requires 'ovmf' bios";
-      }
-      {
-        assertion = partitionTableType == "legacy" -> config.proxmox.qemuConf.bios == "seabios";
-        message = "'legacy' disk partitioning requires 'seabios' bios";
-      }
-      {
-        assertion = partitionTableType == "legacy+gpt" -> config.proxmox.qemuConf.bios == "seabios";
-        message = "'legacy+gpt' disk partitioning requires 'seabios' bios";
-      }
-    ];
-    system.build.VMA = import ../../lib/make-disk-image.nix {
-      name = "proxmox-${cfg.filenameSuffix}";
-      inherit (cfg) partitionTableType;
-      postVM = let
-        # Build qemu with PVE's patch that adds support for the VMA format
-        vma = (pkgs.qemu_kvm.override {
-          alsaSupport = false;
-          pulseSupport = false;
-          sdlSupport = false;
-          jackSupport = false;
-          gtkSupport = false;
-          vncSupport = false;
-          smartcardSupport = false;
-          spiceSupport = false;
-          ncursesSupport = false;
-          libiscsiSupport = false;
-          tpmSupport = false;
-          numaSupport = false;
-          seccompSupport = false;
-          guestAgentSupport = false;
-        }).overrideAttrs ( super: rec {
-          # Check https://github.com/proxmox/pve-qemu/tree/master for the version
-          # of qemu and patch to use
-          version = "9.0.0";
-          src = pkgs.fetchurl {
-            url = "https://download.qemu.org/qemu-${version}.tar.xz";
-            hash = "sha256-MnCKxmww2MiSYz6paMdxwcdtWX1w3erSGg0izPOG2mk=";
-          };
-          patches = [
-            # Proxmox' VMA tool is published as a particular patch upon QEMU
-            "${pkgs.fetchFromGitHub {
-              owner = "proxmox";
-              repo = "pve-qemu";
-              rev = "14afbdd55f04d250bd679ca1ad55d3f47cd9d4c8";
-              hash = "sha256-lSJQA5SHIHfxJvMLIID2drv2H43crTPMNIlIT37w9Nc=";
-            }}/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch"
-          ];
-
-          buildInputs = super.buildInputs ++ [ pkgs.libuuid ];
-          nativeBuildInputs = super.nativeBuildInputs ++ [ pkgs.perl ];
-
-        });
-      in
-      ''
-        ${vma}/bin/vma create "vzdump-qemu-${cfg.filenameSuffix}.vma" \
-          -c ${cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)}/qemu-server.conf drive-virtio0=$diskImage
-        rm $diskImage
-        ${pkgs.zstd}/bin/zstd "vzdump-qemu-${cfg.filenameSuffix}.vma"
-        mv "vzdump-qemu-${cfg.filenameSuffix}.vma.zst" $out/
-
-        mkdir -p $out/nix-support
-        echo "file vma $out/vzdump-qemu-${cfg.filenameSuffix}.vma.zst" > $out/nix-support/hydra-build-products
+  config =
+    let
+      cfg = config.proxmox;
+      cfgLine = name: value: ''
+        ${name}: ${builtins.toString value}
      '';
-      inherit (cfg.qemuConf) additionalSpace diskSize bootSize;
-      format = "raw";
-      inherit config lib pkgs;
-    };
+      virtio0Storage = builtins.head (builtins.split ":" cfg.qemuConf.virtio0);
+      cfgFile =
+        fileName: properties:
+        pkgs.writeTextDir fileName ''
+          # generated by NixOS
+          ${lib.concatStrings (lib.mapAttrsToList cfgLine properties)}
+          #qmdump#map:virtio0:drive-virtio0:${virtio0Storage}:raw:
+        '';
+      inherit (cfg) partitionTableType;
+      supportEfi = partitionTableType == "efi" || partitionTableType == "hybrid";
+      supportBios =
+        partitionTableType == "legacy"
+        || partitionTableType == "hybrid"
+        || partitionTableType == "legacy+gpt";
+      hasBootPartition = partitionTableType == "efi" || partitionTableType == "hybrid";
+      hasNoFsPartition = partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
+    in
+    {
+      assertions = [
+        {
+          assertion = config.boot.loader.systemd-boot.enable -> config.proxmox.qemuConf.bios == "ovmf";
+          message = "systemd-boot requires 'ovmf' bios";
+        }
+        {
+          assertion = partitionTableType == "efi" -> config.proxmox.qemuConf.bios == "ovmf";
+          message = "'efi' disk partitioning requires 'ovmf' bios";
+        }
+        {
+          assertion = partitionTableType == "legacy" -> config.proxmox.qemuConf.bios == "seabios";
+          message = "'legacy' disk partitioning requires 'seabios' bios";
+        }
+        {
+          assertion = partitionTableType == "legacy+gpt" -> config.proxmox.qemuConf.bios == "seabios";
+          message = "'legacy+gpt' disk partitioning requires 'seabios' bios";
+        }
+      ];
+      system.build.VMA = import ../../lib/make-disk-image.nix {
+        name = "proxmox-${cfg.filenameSuffix}";
+        inherit (cfg) partitionTableType;
+        postVM =
+          let
+            # Build qemu with PVE's patch that adds support for the VMA format
+            vma =
+              (pkgs.qemu_kvm.override {
+                alsaSupport = false;
+                pulseSupport = false;
+                sdlSupport = false;
+                jackSupport = false;
+                gtkSupport = false;
+                vncSupport = false;
+                smartcardSupport = false;
+                spiceSupport = false;
+                ncursesSupport = false;
+                libiscsiSupport = false;
+                tpmSupport = false;
+                numaSupport = false;
+                seccompSupport = false;
+                guestAgentSupport = false;
+              }).overrideAttrs
+                (super: rec {
+                  # Check https://github.com/proxmox/pve-qemu/tree/master for the version
+                  # of qemu and patch to use
+                  version = "9.0.0";
+                  src = pkgs.fetchurl {
+                    url = "https://download.qemu.org/qemu-${version}.tar.xz";
+                    hash = "sha256-MnCKxmww2MiSYz6paMdxwcdtWX1w3erSGg0izPOG2mk=";
+                  };
+                  patches = [
+                    # Proxmox' VMA tool is published as a particular patch upon QEMU
+                    "${
+                      pkgs.fetchFromGitHub {
+                        owner = "proxmox";
+                        repo = "pve-qemu";
+                        rev = "14afbdd55f04d250bd679ca1ad55d3f47cd9d4c8";
+                        hash = "sha256-lSJQA5SHIHfxJvMLIID2drv2H43crTPMNIlIT37w9Nc=";
+                      }
+                    }/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch"
+                  ];

-    boot = {
-      growPartition = true;
-      kernelParams = [ "console=ttyS0" ];
-      loader.grub = {
-        device = lib.mkDefault (if (hasNoFsPartition || supportBios) then
-          # Even if there is a separate no-fs partition ("/dev/disk/by-partlabel/no-fs" i.e. "/dev/vda2"),
-          # which will be used the bootloader, do not set it as loader.grub.device.
-          # GRUB installation fails, unless the whole disk is selected.
-          "/dev/vda"
-        else
-          "nodev");
-        efiSupport = lib.mkDefault supportEfi;
-        efiInstallAsRemovable = lib.mkDefault supportEfi;
+                  buildInputs = super.buildInputs ++ [ pkgs.libuuid ];
+                  nativeBuildInputs = super.nativeBuildInputs ++ [ pkgs.perl ];
+
+                });
+          in
+          ''
+            ${vma}/bin/vma create "vzdump-qemu-${cfg.filenameSuffix}.vma" \
+              -c ${
+                cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)
+              }/qemu-server.conf drive-virtio0=$diskImage
+            rm $diskImage
+            ${pkgs.zstd}/bin/zstd "vzdump-qemu-${cfg.filenameSuffix}.vma"
+            mv "vzdump-qemu-${cfg.filenameSuffix}.vma.zst" $out/
+
+            mkdir -p $out/nix-support
+            echo "file vma $out/vzdump-qemu-${cfg.filenameSuffix}.vma.zst" > $out/nix-support/hydra-build-products
+          '';
+        inherit (cfg.qemuConf) additionalSpace bootSize;
+        inherit (config.virtualisation) diskSize;
+        format = "raw";
+        inherit config lib pkgs;
      };

-      loader.timeout = 0;
-      initrd.availableKernelModules = [ "uas" "virtio_blk" "virtio_pci" ];
-    };
+      boot = {
+        growPartition = true;
+        kernelParams = [ "console=ttyS0" ];
+        loader.grub = {
+          device = lib.mkDefault (
+            if (hasNoFsPartition || supportBios) then
+              # Even if there is a separate no-fs partition ("/dev/disk/by-partlabel/no-fs" i.e. "/dev/vda2"),
+              # which will be used the bootloader, do not set it as loader.grub.device.
+              # GRUB installation fails, unless the whole disk is selected.
+              "/dev/vda"
+            else
+              "nodev"
+          );
+          efiSupport = lib.mkDefault supportEfi;
+          efiInstallAsRemovable = lib.mkDefault supportEfi;
+        };

-    fileSystems."/" = {
-      device = "/dev/disk/by-label/nixos";
-      autoResize = true;
-      fsType = "ext4";
-    };
-    fileSystems."/boot" = lib.mkIf hasBootPartition {
-      device = "/dev/disk/by-label/ESP";
-      fsType = "vfat";
-    };
-
-    networking = mkIf cfg.cloudInit.enable {
-      hostName = mkForce "";
-      useDHCP = false;
-    };
-
-    services = {
-      cloud-init = mkIf cfg.cloudInit.enable {
-        enable = true;
-        network.enable = true;
+        loader.timeout = 0;
+        initrd.availableKernelModules = [
+          "uas"
+          "virtio_blk"
+          "virtio_pci"
+        ];
      };
-      sshd.enable = mkDefault true;
-      qemuGuest.enable = true;
-    };

-    proxmox.qemuExtraConf.${cfg.cloudInit.device} = "${cfg.cloudInit.defaultStorage}:vm-9999-cloudinit,media=cdrom";
-  };
+      fileSystems."/" = {
+        device = "/dev/disk/by-label/nixos";
+        autoResize = true;
+        fsType = "ext4";
+      };
+      fileSystems."/boot" = lib.mkIf hasBootPartition {
+        device = "/dev/disk/by-label/ESP";
+        fsType = "vfat";
+      };
+
+      networking = mkIf cfg.cloudInit.enable {
+        hostName = mkForce "";
+        useDHCP = false;
+      };
+
+      services = {
+        cloud-init = mkIf cfg.cloudInit.enable {
+          enable = true;
+          network.enable = true;
+        };
+        sshd.enable = mkDefault true;
+        qemuGuest.enable = true;
+      };
+
+      proxmox.qemuExtraConf.${cfg.cloudInit.device} = "${cfg.cloudInit.defaultStorage}:vm-9999-cloudinit,media=cdrom";
+    };
 }
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
--- a/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/nixos/modules/virtualisation/virtualbox-image.nix
@ -1,22 +1,33 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let

  cfg = config.virtualbox;
-
-in {
+in
+{
+  imports = [
+    ./disk-size-option.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "virtualbox"
+        "baseImageSize"
+      ];
+      to = [
+        "virtualisation"
+        "diskSize"
+      ];
+    })
+  ];

  options = {
    virtualbox = {
-      baseImageSize = lib.mkOption {
-        type = with lib.types; either (enum [ "auto" ]) int;
-        default = "auto";
-        example = 50 * 1024;
-        description = ''
-          The size of the VirtualBox base image in MiB.
-        '';
-      };
      baseImageFreeSpace = lib.mkOption {
-        type = with lib.types; int;
+        type = lib.types.int;
        default = 30 * 1024;
        description = ''
          Free space in the VirtualBox base image in MiB.
@ -51,7 +62,14 @@ in {
        '';
      };
      params = lib.mkOption {
-        type = with lib.types; attrsOf (oneOf [ str int bool (listOf str) ]);
+        type =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            int
+            bool
+            (listOf str)
+          ]);
        example = {
          audio = "alsa";
          rtcuseutc = "on";
@ -64,11 +82,21 @@ in {
        '';
      };
      exportParams = lib.mkOption {
-        type = with lib.types; listOf (oneOf [ str int bool (listOf str) ]);
+        type =
+          with lib.types;
+          listOf (oneOf [
+            str
+            int
+            bool
+            (listOf str)
+          ]);
        example = [
-          "--vsys" "0" "--vendor" "ACME Inc."
+          "--vsys"
+          "0"
+          "--vendor"
+          "ACME Inc."
        ];
-        default = [];
+        default = [ ];
        description = ''
          Parameters passed to the Virtualbox export command.

@ -86,23 +114,25 @@ in {
          mountPoint = "/home/demo/storage";
          size = 100 * 1024;
        };
-        type = lib.types.nullOr (lib.types.submodule {
-          options = {
-            size = lib.mkOption {
-              type = lib.types.int;
-              description = "Size in MiB";
+        type = lib.types.nullOr (
+          lib.types.submodule {
+            options = {
+              size = lib.mkOption {
+                type = lib.types.int;
+                description = "Size in MiB";
+              };
+              label = lib.mkOption {
+                type = lib.types.str;
+                default = "vm-extra-storage";
+                description = "Label for the disk partition";
+              };
+              mountPoint = lib.mkOption {
+                type = lib.types.str;
+                description = "Path where to mount this disk.";
+              };
            };
-            label = lib.mkOption {
-              type = lib.types.str;
-              default = "vm-extra-storage";
-              description = "Label for the disk partition";
-            };
-            mountPoint = lib.mkOption {
-              type = lib.types.str;
-              description = "Path where to mount this disk.";
-            };
-          };
-        });
+          }
+        );
      };
      postExportCommands = lib.mkOption {
        type = lib.types.lines;
@ -122,7 +152,14 @@ in {
        '';
      };
      storageController = lib.mkOption {
-        type = with lib.types; attrsOf (oneOf [ str int bool (listOf str) ]);
+        type =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            int
+            bool
+            (listOf str)
+          ]);
        example = {
          name = "SCSI";
          add = "scsi";
@ -148,6 +185,9 @@ in {
  };

  config = {
+    # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
+    # to avoid breaking existing configs using that.
+    virtualisation.diskSize = lib.mkOverride 1490 (50 * 1024);

    virtualbox.params = lib.mkMerge [
      (lib.mapAttrs (name: lib.mkDefault) {
@ -172,80 +212,83 @@ in {

      inherit pkgs lib config;
      partitionTableType = "legacy";
-      diskSize = cfg.baseImageSize;
+      inherit (config.virtualisation) diskSize;
      additionalSpace = "${toString cfg.baseImageFreeSpace}M";

-      postVM =
-        ''
-          export HOME=$PWD
-          export PATH=${pkgs.virtualbox}/bin:$PATH
+      postVM = ''
+        export HOME=$PWD
+        export PATH=${pkgs.virtualbox}/bin:$PATH

-          echo "converting image to VirtualBox format..."
-          VBoxManage convertfromraw $diskImage disk.vdi
+        echo "converting image to VirtualBox format..."
+        VBoxManage convertfromraw $diskImage disk.vdi

-          ${lib.optionalString (cfg.extraDisk != null) ''
-            echo "creating extra disk: data-disk.raw"
-            dataDiskImage=data-disk.raw
-            truncate -s ${toString cfg.extraDisk.size}M $dataDiskImage
+        ${lib.optionalString (cfg.extraDisk != null) ''
+          echo "creating extra disk: data-disk.raw"
+          dataDiskImage=data-disk.raw
+          truncate -s ${toString cfg.extraDisk.size}M $dataDiskImage

-            parted --script $dataDiskImage -- \
-              mklabel msdos \
-              mkpart primary ext4 1MiB -1
-            eval $(partx $dataDiskImage -o START,SECTORS --nr 1 --pairs)
-            mkfs.ext4 -F -L ${cfg.extraDisk.label} $dataDiskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
-            echo "creating extra disk: data-disk.vdi"
-            VBoxManage convertfromraw $dataDiskImage data-disk.vdi
-          ''}
+          parted --script $dataDiskImage -- \
+            mklabel msdos \
+            mkpart primary ext4 1MiB -1
+          eval $(partx $dataDiskImage -o START,SECTORS --nr 1 --pairs)
+          mkfs.ext4 -F -L ${cfg.extraDisk.label} $dataDiskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
+          echo "creating extra disk: data-disk.vdi"
+          VBoxManage convertfromraw $dataDiskImage data-disk.vdi
+        ''}

-          echo "creating VirtualBox VM..."
-          vmName="${cfg.vmName}";
-          VBoxManage createvm --name "$vmName" --register \
-            --ostype ${if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "Linux26_64" else "Linux26"}
-          VBoxManage modifyvm "$vmName" \
-            --memory ${toString cfg.memorySize} \
-            ${lib.cli.toGNUCommandLineShell { } cfg.params}
-          VBoxManage storagectl "$vmName" ${lib.cli.toGNUCommandLineShell { } cfg.storageController}
-          VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 0 --device 0 --type hdd \
-            --medium disk.vdi
-          ${lib.optionalString (cfg.extraDisk != null) ''
-            VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 1 --device 0 --type hdd \
-            --medium data-disk.vdi
-          ''}
+        echo "creating VirtualBox VM..."
+        vmName="${cfg.vmName}";
+        VBoxManage createvm --name "$vmName" --register \
+          --ostype ${if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "Linux26_64" else "Linux26"}
+        VBoxManage modifyvm "$vmName" \
+          --memory ${toString cfg.memorySize} \
+          ${lib.cli.toGNUCommandLineShell { } cfg.params}
+        VBoxManage storagectl "$vmName" ${lib.cli.toGNUCommandLineShell { } cfg.storageController}
+        VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 0 --device 0 --type hdd \
+          --medium disk.vdi
+        ${lib.optionalString (cfg.extraDisk != null) ''
+          VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 1 --device 0 --type hdd \
+          --medium data-disk.vdi
+        ''}

-          echo "exporting VirtualBox VM..."
-          mkdir -p $out
-          fn="$out/${cfg.vmFileName}"
-          VBoxManage export "$vmName" --output "$fn" --options manifest ${lib.escapeShellArgs cfg.exportParams}
-          ${cfg.postExportCommands}
+        echo "exporting VirtualBox VM..."
+        mkdir -p $out
+        fn="$out/${cfg.vmFileName}"
+        VBoxManage export "$vmName" --output "$fn" --options manifest ${lib.escapeShellArgs cfg.exportParams}
+        ${cfg.postExportCommands}

-          rm -v $diskImage
+        rm -v $diskImage

-          mkdir -p $out/nix-support
-          echo "file ova $fn" >> $out/nix-support/hydra-build-products
-        '';
+        mkdir -p $out/nix-support
+        echo "file ova $fn" >> $out/nix-support/hydra-build-products
+      '';
    };

-    fileSystems = {
-      "/" = {
-        device = "/dev/disk/by-label/nixos";
-        autoResize = true;
-        fsType = "ext4";
-      };
-    } // (lib.optionalAttrs (cfg.extraDisk != null) {
-      ${cfg.extraDisk.mountPoint} = {
-        device = "/dev/disk/by-label/" + cfg.extraDisk.label;
-        autoResize = true;
-        fsType = "ext4";
-      };
-    });
+    fileSystems =
+      {
+        "/" = {
+          device = "/dev/disk/by-label/nixos";
+          autoResize = true;
+          fsType = "ext4";
+        };
+      }
+      // (lib.optionalAttrs (cfg.extraDisk != null) {
+        ${cfg.extraDisk.mountPoint} = {
+          device = "/dev/disk/by-label/" + cfg.extraDisk.label;
+          autoResize = true;
+          fsType = "ext4";
+        };
+      });

    boot.growPartition = true;
    boot.loader.grub.device = "/dev/sda";

-    swapDevices = [{
-      device = "/var/swap";
-      size = 2048;
-    }];
+    swapDevices = [
+      {
+        device = "/var/swap";
+        size = 2048;
+      }
+    ];

    virtualisation.virtualbox.guest.enable = true;

--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -312,7 +312,7 @@ in rec {
        [ configuration
          versionModule
          ./maintainers/scripts/ec2/amazon-image.nix
-          ({ ... }: { amazonImage.sizeMB = "auto"; })
+          ({ ... }: { virtualisation.diskSize = "auto"; })
        ];
    }).config.system.build.amazonImage)

--- a/nixos/tests/mollysocket.nix
+++ b/nixos/tests/mollysocket.nix
@ -16,12 +16,10 @@ in {
  };

  testScript = ''
-    import json
-
    mollysocket.wait_for_unit("mollysocket.service")
    mollysocket.wait_for_open_port(${toString port})

    out = mollysocket.succeed("curl --fail http://127.0.0.1:${toString port}")
-    assert json.loads(out)["mollysocket"]["version"] == "${toString pkgs.mollysocket.version}"
+    assert "Version ${pkgs.mollysocket.version}" in out
  '';
 })
--- a/pkgs/applications/display-managers/greetd/gtkgreet.nix
+++ b/pkgs/applications/display-managers/greetd/gtkgreet.nix
@ -24,11 +24,13 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-GKBYql0hzqB6uY87SsAqHwf3qLAr7xznMnAjRtP4HS8=";
  };

+  depsBuildBuild = [ pkg-config ];
  nativeBuildInputs = [
    pkg-config
    meson
    ninja
    cmake
+    scdoc
    wrapGAppsHook3
  ];

@ -36,7 +38,6 @@ stdenv.mkDerivation rec {
    gtk3
    gtk-layer-shell
    json_c
-    scdoc
    librsvg
  ];

@ -44,6 +45,11 @@ stdenv.mkDerivation rec {
    "-Dlayershell=enabled"
  ];

+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace "dependency('scdoc'," "dependency('scdoc', native:true,"
+  '';
+
  # G_APPLICATION_FLAGS_NONE is deprecated in GLib 2.73.3+.
  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";

--- a/pkgs/applications/display-managers/greetd/tuigreet.nix
+++ b/pkgs/applications/display-managers/greetd/tuigreet.nix
@ -1,8 +1,11 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-}:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,

+  installShellFiles,
+  scdoc,
+}:
 rustPlatform.buildRustPackage rec {
  pname = "tuigreet";
  version = "0.9.1";
@ -16,6 +19,16 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-RkJjAmZ++4nc/lLh8g0LxGq2DjZGxQEjFOl8Yzx116A=";

+  nativeBuildInputs = [
+    installShellFiles
+    scdoc
+  ];
+
+  postInstall = ''
+    scdoc < contrib/man/tuigreet-1.scd > tuigreet.1
+    installManPage tuigreet.1
+  '';
+
  meta = {
    description = "Graphical console greeter for greetd";
    homepage = "https://github.com/apognu/tuigreet";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
@ -8,13 +8,13 @@

 melpaBuild {
  pname = "edraw";
-  version = "1.2.0-unstable-2024-07-24";
+  version = "1.2.0-unstable-2024-10-04";

  src = fetchFromGitHub {
    owner = "misohena";
    repo = "el-easydraw";
-    rev = "6f93e744d5f62de2176d3d0f0aa1f9e8d84ccefd";
-    hash = "sha256-dXu4hDC4qE7W+KkWb9HIqYwesOKisMiZSTAulDpjyfA=";
+    rev = "ad740d87e768052b0ef5b5e7f0822c7ac1b238fb";
+    hash = "sha256-xdyDikE8fUQ12Ra5j5lQUHVLKpTYtvfn1DosusQt61Q=";
  };

  propagatedUserEnvPkgs = [ gzip ];
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@ -3,32 +3,31 @@
  stdenv,
  vscode-utils,
  fetchurl,
-  ...
 }:

 let
-  version = "0.12.0";
+  version = "0.12.1";

  sources = {
    "x86_64-linux" = {
      arch = "linux-x64";
      url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-7zIe5yTSpAhkG4S+k2SAnp4ZOrbbSsdxExpRfMG5EAo=";
+      hash = "sha256-Tf26s4YDyjYUrVdKu9aYMMntirZyNRgnETMzO/EfFCA=";
    };
    "x86_64-darwin" = {
      arch = "darwin-x64";
      url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-0mBNcrfDUqdPfQyc38/Z8YppFP8u9tbxpOLWrQriviE=";
+      hash = "sha256-2u92qFaRIirCrvtuxeqVqt6zWEobS1f5SX26SGZF4xE=";
    };
    "aarch64-linux" = {
      arch = "linux-arm64";
      url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-YvKTs+kA4PghQkduq3aIx20bnGv1VnCtMqLmkLADfbE=";
+      hash = "sha256-+NUdF/KIWhLXOGtUgmNI9JF+L+f/4o064gznpLiORVM=";
    };
    "aarch64-darwin" = {
      arch = "darwin-arm64";
      url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-gV8VKwPBsgUCDd/A02ASNozuBl/tt5FW0xKOgVKVgAM=";
+      hash = "sha256-GVEOTgfSKc0YXZUF4WGl/56Jd4ucaeDm9nB+267BQoM=";
    };
  };
 in
--- a/pkgs/applications/emulators/retroarch/default.nix
+++ b/pkgs/applications/emulators/retroarch/default.nix
@ -36,6 +36,7 @@
 , udev
 , vulkan-loader
 , wayland
+, wayland-scanner
 , wrapQtAppsHook
 , zlib
 }:
@ -76,7 +77,7 @@ stdenv.mkDerivation rec {
  ] ++
  lib.optional enableNvidiaCgToolkit nvidia_cg_toolkit ++
  lib.optional withVulkan vulkan-loader ++
-  lib.optional withWayland wayland ++
+  lib.optionals withWayland [wayland wayland-scanner] ++
  lib.optionals stdenv.hostPlatform.isLinux [
    alsa-lib
    dbus
--- a/pkgs/applications/graphics/minidjvu/default.nix
+++ b/pkgs/applications/graphics/minidjvu/default.nix
@ -26,5 +26,8 @@ stdenv.mkDerivation rec {
    maintainers = [ ];
    platforms = lib.platforms.unix;
    mainProgram = "minidjvu";
+    knownVulnerabilities = [
+      "minidjvu is vulnerable to a number of out-of-bound read vulnerabilities, potentially causing denials of service (CVE-2017-12441, CVE-2017-12442, CVE-2017-12443, CVE-2017-12444, CVE-2017-12445)"
+    ];
  };
 }
--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@ -9,11 +9,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.26.0";
+  version = "5.28.0";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-jtTlqVsd+EGBkh05O+fRn6e6Q+Gw68uGruQqaTfsolM=";
+    hash = "sha256-0xOgnpHoFxBzDoDGI7bcBFRu47HDYASIu4ApQo288Bo=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

--- a/pkgs/applications/misc/chatblade/default.nix
+++ b/pkgs/applications/misc/chatblade/default.nix
@ -2,12 +2,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "chatblade";
-  version = "0.6.4";
+  version = "0.7.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-d8XavZBuWsuIUxraC2XaWM6tgo2JmsPZwzyl9Rj5wWM=";
+    hash = "sha256-v6X5aqArhp33bm8JELDCUoxE3nsvla4I3n0ZLLMMeJI=";
  };

  doCheck = false; # there are no tests
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,11 +1,11 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-YndBzhUNmn5tJdCqLmpUrs2WBXXpTxiKCNczWEz6DU4=";
+      hash_darwin = "sha256-SZfl93TcaD9j59zGflPFmHgIP5NaS8bgDi3l3SRRFiI=";
      hash_darwin_aarch64 =
-        "sha256-taG58kMgQUD40aGqnyx9O9e9m4qGsTWX57cjD3NeHm4=";
-      hash_linux = "sha256-raWGzhjqWdm5bRK+Z7Qga8QM9kQYSXxdL5N+wk1hlXI=";
-      version = "130.0.6723.58";
+        "sha256-wLX63aA8l+23ehdBHPcXtoZ2WEhrmYVKzqUDBbrhSRw=";
+      hash_linux = "sha256-kP6N7fM+7+S3JwT2JvqfWDRCfAQiNc/rQlHxjJ8DNuo=";
+      version = "130.0.6723.69";
    };
    deps = {
      gn = {
@ -15,8 +15,8 @@
        version = "2024-09-09";
      };
    };
-    hash = "sha256-w1xQr+B7ROeCqBRN+M9vmh45YTRqVfjDYSsN5saDuDo=";
-    version = "130.0.6723.58";
+    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
+    version = "130.0.6723.69";
  };
  ungoogled-chromium = {
    deps = {
@ -27,11 +27,11 @@
        version = "2024-09-09";
      };
      ungoogled-patches = {
-        hash = "sha256-M+aJ1hhFV88lBBPl9xBYpYRut7yHa/HJYXoclckaZVM=";
-        rev = "130.0.6723.58-1";
+        hash = "sha256-usNlX/ol8Zn3lQTvp311DuyYbSHF/HN0r7k8qeUIJmU=";
+        rev = "130.0.6723.69-1";
      };
    };
-    hash = "sha256-w1xQr+B7ROeCqBRN+M9vmh45YTRqVfjDYSsN5saDuDo=";
-    version = "130.0.6723.58";
+    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
+    version = "130.0.6723.69";
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -27,13 +27,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "aiven": {
-    "hash": "sha256-J/ZdlrYRo7Npr9zYZxvs0LWwqZN/r+IcgfOGMYaIqo4=",
+    "hash": "sha256-nWa9ohf3DOiMloJ5J8UcSZjJNHjRZw1sD6k5R8m6LWA=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.27.0",
+    "rev": "v4.28.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-vlL4RLe89MZ3z5xyC3r3kI4RqWXwbqWNQZlOxxpsGZo="
+    "vendorHash": "sha256-UM4EjL1qXOn2TMOupVxSyJVLarHIGTySXNJtWPrseSE="
  },
  "akamai": {
    "hash": "sha256-KnX+PAhT7TPp9SRkGwYPvxgk/ExaJPr7vKj9hTbJGhg=",
@ -525,11 +525,11 @@
    "vendorHash": "sha256-jAYaVNWMEGLDPgnyD2VJwVpDwn9lcvBNLnKPdlqdRZc="
  },
  "gridscale": {
-    "hash": "sha256-GVOjkena3zRaOxO3YRYf+gfM2/CRm8VajpuWGTU0F1Y=",
+    "hash": "sha256-J4ZLexpjYXxOTaqih0+Nucyf2soYXxGiB38xAeXUJKs=",
    "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
    "owner": "gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v1.26.0",
+    "rev": "v1.27.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -27,7 +27,7 @@

 stdenv.mkDerivation rec {
  pname = "nextcloud-client";
-  version = "3.14.1";
+  version = "3.14.2";

  outputs = [ "out" "dev" ];

@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    owner = "nextcloud-releases";
    repo = "desktop";
    rev = "refs/tags/v${version}";
-    hash = "sha256-bUqHegW38NQJn4TnEQt9wRJFqR6fbLpvQvmWF3akekc=";
+    hash = "sha256-vxCt/FNfQZ7rWME2zLGESgW/+FNoENZeCr8FFcGwoFQ=";
  };

  patches = [
--- a/pkgs/applications/networking/remote/freerdp/3.nix
+++ b/pkgs/applications/networking/remote/freerdp/3.nix
@ -68,24 +68,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "freerdp";
-  version = "3.8.0";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = finalAttrs.version;
-    hash = "sha256-zqqPfAXHjY4IV18mgbNxWDw7ZP/7SvoYn1u0FahpcNk=";
+    hash = "sha256-oThlqUpEmhcLpMMYExMA3GbtB2+lq6oc5TRZt0eKRLA=";
  };

-  patches = [
-    (fetchpatch {
-      name = "clang-fix-unwind-getlanguagespecificdata.patch";
-      url = "https://github.com/FreeRDP/FreeRDP/commit/6fb7bfd043d159d3819486fb601b598102cca823.patch";
-      hash = "sha256-U2Oz+IVvlIdg7kJ4rgAWhJVdzthY50YaCYKMMc2he7Y=";
-    })
-  ];
-
-
  postPatch = ''
    export HOME=$TMP

--- a/pkgs/applications/networking/sync/rsync/rrsync.nix
+++ b/pkgs/applications/networking/sync/rsync/rrsync.nix
@ -27,5 +27,6 @@ stdenv.mkDerivation {

  meta = rsync.meta // {
    description = "Helper to run rsync-only environments from ssh-logins";
+    mainProgram = "rrsync";
  };
 }
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "nvc";
-  version = "1.14.0";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "nickg";
    repo = "nvc";
    rev = "r${version}";
-    hash = "sha256-xaJt3zMAv+Op7cQAaKJOyI28oEssMw/7zvEnfReS4aw=";
+    hash = "sha256-EPnHm2bZCui8K/H1a6+pgec3Lrf+zAlFoKYBnLspdQQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "3.27-unstable-2024-10-02";
+  version = "3.27-unstable-2024-10-18";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "57a7c74623cdb6ee7f3b67873f6e9af976234e9d";
-    hash = "sha256-7xoSFLE4yPuWzoIS65UficBa086o1Yil0Z2ks8EARy0=";
+    rev = "a9d3be2c64a35e06691ba61fd1bf0d9b9cd5822d";
+    hash = "sha256-3t5AsUTNXnkXUfrGeGWcMwwC8kBhpSVx1ioVfKXloZA=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -4,6 +4,7 @@
 , fetchgit
 , fetchurl
 , makeWrapper
+, writeText
 , cmake
 , coreutils
 , git
@ -225,7 +226,11 @@ stdenv.mkDerivation rec {
  '';

  # error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
-  CXXFLAGS = lib.optional (stdenv.hostPlatform.system == "x86_64-darwin") "-faligned-allocation";
+  env.CXXFLAGS = lib.optionalString (stdenv.hostPlatform.system == "x86_64-darwin") "-faligned-allocation";
+
+  # workaround for
+  # https://github.com/root-project/root/issues/14778
+  env.NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "--version-script,${writeText "version.map" "ROOT { global: *; };"}";

  # To use the debug information on the fly (without installation)
  # add the outPath of root.debug into NIX_DEBUG_INFO_DIRS (in PATH-like format)
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.47";
+  version = "2.48";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    hash = "sha256-LFzUvDMNGxp5HzdjlaN0VS7HpIzN8GA5MQL61teKRvo=";
+    hash = "sha256-BrdB6SqQlLRvXbfIXHqaKD+F/SBzqGru6ISkUrEnUeQ=";
  };

  # Fix 'NameError: name 'ssl' is not defined'
--- a/pkgs/applications/version-management/git-town/default.nix
+++ b/pkgs/applications/version-management/git-town/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-town";
-  version = "16.3.0";
+  version = "16.4.1";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    rev = "v${version}";
-    hash = "sha256-q4bRUz6ZI6y0AYEDMUBMN1YJxmHkIDDkUiMd4rQbDHk=";
+    hash = "sha256-8Xr1R6txsJBGzBtvvKOCg2lcAHksl4hNPc9zySkTfdg=";
  };

  vendorHash = null;
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@ -53,7 +53,7 @@ stdenv.mkDerivation ({
  buildPhase = args.buildPhase or ''
    runHook preBuild

-    native-image -jar "$jar" $(export -p | sed -n 's/^declare -x \([^=]\+\)=.*$/ -E\1/p' | tr -d \\n) ''${nativeImageBuildArgs[@]}
+    native-image -jar "$jar" ''${nativeImageBuildArgs[@]}

    runHook postBuild
  '';
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@ -5,34 +5,31 @@
  artalk,
  fetchurl,
  installShellFiles,
+  versionCheckHook,
  stdenv,
  testers,
  nixosTests,
 }:
 buildGoModule rec {
  pname = "artalk";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner = "ArtalkJS";
    repo = "artalk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5tUUlkGeT4kY/81EQ29M6z+JnBT4YCa8gecbV9WMuDo=";
+    hash = "sha256-gzagE3muNpX/dwF45p11JAN9ElsGXNFQ3fCvF1QhvdU=";
  };
  web = fetchurl {
    url = "https://github.com/${src.owner}/${src.repo}/releases/download/v${version}/artalk_ui.tar.gz";
-    hash = "sha256-Cx3fDpnl52kwILzH9BBLfsWe5qEbIl/ecJd1wJEB/Hc=";
+    hash = "sha256-ckKC4lErKVdJuJ+pGysmMR96a9LkrCYnWB4j6VPP8OY=";
  };

-  CGO_ENABLED = 1;
-
-  vendorHash = "sha256-edqmv/Q99pgnScJqCmLwjHd7uKMNPGfCSujNTUQtpLc=";
+  vendorHash = "sha256-oAqYQzOUjly97H5L5PQ9I2SO2KqiUVxdJA+eoPrHD6Q=";

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/ArtalkJS/Artalk/internal/config.Version=${version}"
-    "-X github.com/ArtalkJS/Artalk/internal/config.CommitHash=${version}"
  ];

  preBuild = ''
@ -42,21 +39,22 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

-  postInstall =
-    ''
-      # work around case insensitive file systems
-      mv $out/bin/Artalk $out/bin/artalk.tmp
-      mv $out/bin/artalk.tmp $out/bin/artalk
-    ''
-    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd artalk \
-        --bash <($out/bin/artalk completion bash) \
-        --fish <($out/bin/artalk completion fish) \
-        --zsh <($out/bin/artalk completion zsh)
-    '';
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd artalk \
+      --bash <($out/bin/artalk completion bash) \
+      --fish <($out/bin/artalk completion fish) \
+      --zsh <($out/bin/artalk completion zsh)
+  '';
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = "-v";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];

  passthru.tests = {
-    version = testers.testVersion { package = artalk; };
    inherit (nixosTests) artalk;
  };

@ -65,6 +63,10 @@ buildGoModule rec {
    homepage = "https://github.com/ArtalkJS/Artalk";
    changelog = "https://github.com/ArtalkJS/Artalk/releases/tag/v${version}";
    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode
+    ];
    maintainers = with lib.maintainers; [ moraxyc ];
    mainProgram = "artalk";
  };
--- a/pkgs/by-name/ca/casadi/package.nix
+++ b/pkgs/by-name/ca/casadi/package.nix
@ -10,7 +10,6 @@
  cplex,
  fatrop,
  fetchFromGitHub,
-  fetchpatch,
  gurobi,
  highs,
  hpipm,
@ -37,40 +36,27 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "casadi";
-  version = "3.6.6";
+  version = "3.6.7";

  src = fetchFromGitHub {
    owner = "casadi";
    repo = "casadi";
    rev = finalAttrs.version;
-    hash = "sha256-T4aaBS918NbUEwWkSx0URi0W9uhCB8IFmzRcOR7T8Og=";
+    hash = "sha256-Mft0qhjdAbU82RgjYuKue5p7EqbTbt3ii5yXSsCFHrQ=";
  };

-  patches = [
-    (fetchpatch {
-      name = "add-FindSPRAL.cmake.patch";
-      url = "https://github.com/casadi/casadi/pull/3792/commits/28bc1b03e67ae06dea0c8557057020f5651be7ad.patch";
-      hash = "sha256-t0+RnXoFakmoX93MhN08RWAbCg6Nerh42LicBBgAkRQ=";
-    })
-  ];
-
  postPatch =
    ''
-      # fix case of fatropConfig.cmake & hpipmConfig.cmake
+      # fix case of hpipmConfig.cmake
      substituteInPlace CMakeLists.txt --replace-fail \
        "FATROP HPIPM" \
-        "fatrop hpipm"
+        "FATROP hpipm"

      # nix provide lib/clang headers in libclang, not in llvm.
      substituteInPlace casadi/interfaces/clang/CMakeLists.txt --replace-fail \
        '$'{CLANG_LLVM_LIB_DIR} \
        ${llvmPackages_17.libclang.lib}/lib

-      # fix fatrop includes
-      substituteInPlace casadi/interfaces/fatrop/fatrop_conic_interface.hpp --replace-fail \
-        "<ocp/" \
-        "<fatrop/ocp/"
-
      # fix mumps lib name. No idea where this comes from.
      substituteInPlace cmake/FindMUMPS.cmake --replace-fail \
        "mumps_seq" \
@ -173,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "WITH_CSPARSE" true)
    (lib.cmakeBool "WITH_BLASFEO" true)
    (lib.cmakeBool "WITH_HPIPM" true)
-    (lib.cmakeBool "WITH_FATROP" false) # invalid new-expression of abstract class type 'casadi::CasadiStructuredQP'
+    (lib.cmakeBool "WITH_FATROP" true)
    (lib.cmakeBool "WITH_BUILD_FATROP" false)
    (lib.cmakeBool "WITH_SUPERSCS" false) # packaging too chaotic
    (lib.cmakeBool "WITH_BUILD_OSQP" false)
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  versionCheckHook,
+}:
+let
+  os = if stdenv.hostPlatform.isDarwin then "macos" else "linux";
+  arch = if stdenv.hostPlatform.isAarch64 then "aarch64" else "x86_64";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clouddrive2";
+  version = "0.7.21";
+
+  src = fetchurl {
+    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
+    hash =
+      {
+        x86_64-linux = "sha256-U8th7cEAFDBg+CV6DEX0YnqaM2+NJNKmyA/IRtnWESo=";
+        aarch64-linux = "sha256-LaAVO4p0sSfsGmFPSzly1Hzo+t4oY6mgaTdnHrhu0vI=";
+        x86_64-darwin = "sha256-/cyLcX7A+WpuS6yciqAz3jvDIJvXEoyQyX+xe6+eRmE=";
+        aarch64-darwin = "sha256-Y5cKIHVzX0TjMNZGW3YvU8MNpuGsIjp4qNlB+b2BRJM=";
+      }
+      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/opt/clouddrive2
+    cp -r wwwroot "$out/opt/clouddrive2/wwwroot"
+    cp -r clouddrive "$out/opt/clouddrive2/clouddrive"
+    makeWrapper $out/opt/clouddrive2/clouddrive $out/bin/clouddrive
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckPhaseInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    homepage = "https://www.clouddrive2.com";
+    changelog = "https://github.com/cloud-fs/cloud-fs.github.io/releases/tag/v${finalAttrs.version}";
+    description = "Multi-cloud drives management tool supporting mounting cloud drives locally";
+    longDescription = ''
+      CloudDrive is a powerful multi-cloud drive management tool that provides a multi-cloud
+      drive solution that includes local mounting of cloud drives. It supports lots of cloud
+      drives in China.
+    '';
+    mainProgram = "clouddrive";
+    license = lib.licenses.unfree;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ ltrump ];
+  };
+})
--- a/pkgs/by-name/cl/clouddrive2/update.sh
+++ b/pkgs/by-name/cl/clouddrive2/update.sh
@ -0,0 +1,25 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl coreutils jq common-updater-scripts
+
+latestTag=$(curl -sSfL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} https://api.github.com/repos/cloud-fs/cloud-fs.github.io/releases/latest | jq -r ".tag_name")
+latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; clouddrive2.version" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+for i in \
+    "x86_64-linux linux-x86_64" \
+    "aarch64-linux linux-aarch64" \
+    "x86_64-darwin macos-x86_64" \
+    "aarch64-darwin macos-aarch64"; do
+    set -- $i
+    prefetch=$(nix-prefetch-url "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v$latestVersion/clouddrive-2-$2-$latestVersion.tgz")
+    hash=$(nix-hash --type sha256 --to-sri $prefetch)
+
+    update-source-version clouddrive2 $latestVersion $hash --system=$1 --ignore-same-version
+done
--- a/pkgs/by-name/cr/crystal-dock/package.nix
+++ b/pkgs/by-name/cr/crystal-dock/package.nix
@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "crystal-dock";
-  version = "2.5";
+  version = "2.7";

  src = fetchFromGitHub {
    owner = "dangvd";
    repo = "crystal-dock";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y7Wt0o57z8NaAcYoaigWtI7twx8UAUgSIEWz86LcNKM=";
+    hash = "sha256-VxdVB/DLVvmHGvZ2JI/mZCCWIdopYhObJuN4MKh+l4A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/dependency-track/package.nix
+++ b/pkgs/by-name/de/dependency-track/package.nix
@ -11,7 +11,7 @@
  nixosTests,
 }:
 let
-  version = "4.12.0";
+  version = "4.12.1";

  frontend = buildNpmPackage {
    pname = "dependency-track-frontend";
@ -21,10 +21,10 @@ let
      owner = "DependencyTrack";
      repo = "frontend";
      rev = version;
-      hash = "sha256-7omFxT3WBQp6xftgU6ttGgwIGbLXLetQz2ySvsgsQic=";
+      hash = "sha256-M7UtyhIuEi6ebkjO8OM0VVi8LQ+VqeVIzBgQwIzSAzg=";
    };

-    npmDepsHash = "sha256-LZg3n1+L6tvfC0gBKf8YZd/UMDz04v1V9qrJZrAr4W4=";
+    npmDepsHash = "sha256-ZU5D3ZXLaZ1m2YP6uZmpzahP2JQPL9tdOHOyN9fp/XA=";
    forceGitDeps = true;
    makeCacheWritable = true;

@ -41,7 +41,7 @@ maven.buildMavenPackage rec {
    owner = "DependencyTrack";
    repo = "dependency-track";
    rev = version;
-    hash = "sha256-FJ4VNDpmVBXU1/URb/Rnu0LXAbxKw6Zd7MPbN4bs9eY=";
+    hash = "sha256-Gx7tGkibSu+v4gGKC61EFwUsdruMh0t2gTnnNazjqco=";
  };

  patches = [
@ -56,7 +56,7 @@ maven.buildMavenPackage rec {
  '';

  mvnJdk = jre_headless;
-  mvnHash = "sha256-YrlGVJ0Hp9VHfMD0+hT/9q8tskft6RvszmU4tRAXSAY=";
+  mvnHash = "sha256-4QtWvsIFiS4d55y45tj3RLE4YYdXLrqpzqS7mOqRWYw=";
  manualMvnArtifacts = [ "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1" ];
  buildOffline = true;

--- a/pkgs/by-name/dr/dry/package.nix
+++ b/pkgs/by-name/dr/dry/package.nix
@ -0,0 +1,29 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "dry";
+  version = "0.11.2";
+
+  src = fetchFromGitHub {
+    owner = "moncho";
+    repo = "dry";
+    rev = "v${version}";
+    hash = "sha256-JGtPX6BrB3q2EQyF6x2A5Wsn5DudOSVt3IxBAjjwlC8=";
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-AduDbBpCoW7GmYrBPpL7wyLvwoez81qP/+mllgoHInY=";
+
+  meta = {
+    description = "Terminal application to manage Docker and Docker Swarm";
+    homepage = "https://moncho.github.io/dry/";
+    changelog = "https://github.com/moncho/dry/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dump_stack ];
+    mainProgram = "dry";
+  };
+}
--- a/pkgs/by-name/fa/fatrop/package.nix
+++ b/pkgs/by-name/fa/fatrop/package.nix
@ -11,26 +11,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fatrop";
-  version = "0.0.1";
+  version = "0.0.4";

  src = fetchFromGitHub {
    owner = "meco-group";
    repo = "fatrop";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-c4qYh8RutRsMIx3m0oxXy73fnLTBGVZ1QjFcLEJ413Y=";
+    hash = "sha256-XVOS9L2vQeFkPXZieX1ZJiVagR0f2BtiRmSDPB9LQeI=";
  };

-  postPatch = lib.optionalString pythonSupport ''
-    # avoid submodule
-    rmdir external/pybind11
-    ln -s ${python3Packages.pybind11.src} external/pybind11
-
-    # install python module
-    echo ""  >> fatropy/CMakeLists.txt
-    echo "install(DIRECTORY fatropy DESTINATION ${python3Packages.python.sitePackages})" >> fatropy/CMakeLists.txt
-    echo "install(TARGETS _fatropy DESTINATION ${python3Packages.python.sitePackages}/fatropy)" >> fatropy/CMakeLists.txt
-  '';
-
  nativeBuildInputs = [ cmake ];
  buildInputs =
    [ blasfeo ]
--- a/pkgs/by-name/fc/fcitx5-mozc-ut/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mozc-ut/package.nix
@ -0,0 +1,8 @@
+{
+  fcitx5-mozc,
+  mozc-ut,
+}:
+
+fcitx5-mozc.override {
+  mozc = mozc-ut;
+}
--- a/pkgs/by-name/fc/fcitx5-mozc/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mozc/package.nix
@ -0,0 +1,148 @@
+{
+  bazel_7,
+  buildBazelPackage,
+  fcitx5,
+  fetchFromGitHub,
+  gettext,
+  lib,
+  mozc,
+  nixosTests,
+  pkg-config,
+  python3,
+  stdenv,
+  unzip,
+}:
+
+buildBazelPackage {
+  pname = "fcitx5-mozc";
+  version = "2.30.5544.102";
+
+  src = fetchFromGitHub {
+    owner = "fcitx";
+    repo = "mozc";
+    fetchSubmodules = true;
+    rev = "57e67f2a25e4c0861e0e422da0c7d4c232d89fcc";
+    hash = "sha256-1EZjEbMl+LRipH5gEgFpaKP8uEKPfupHmiiTNJc/T1k=";
+  };
+
+  nativeBuildInputs = [
+    gettext
+    pkg-config
+    python3
+    unzip
+  ];
+
+  buildInputs = [
+    mozc
+    fcitx5
+  ];
+
+  postPatch = ''
+    sed -i -e 's|^\(LINUX_MOZC_SERVER_DIR = \).\+|\1"${mozc}/lib/mozc"|' src/config.bzl
+  '';
+
+  bazel = bazel_7;
+  removeRulesCC = false;
+  dontAddBazelOpts = true;
+
+  bazelFlags = [
+    "--config"
+    "oss_linux"
+    "--compilation_mode"
+    "opt"
+  ];
+
+  bazelTargets = [
+    "unix/fcitx5:fcitx5-mozc.so"
+    "unix/icons"
+  ];
+
+  fetchAttrs = {
+    preInstall = ''
+      rm -rf $bazelOut/external/fcitx5
+    '';
+
+    sha256 = "sha256-wz2lJckr7Pu4jtoejjFv8LdjVO2+ferrS473M4jc86I=";
+  };
+
+  preConfigure = ''
+    cd src
+  '';
+
+  buildAttrs = {
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm444 ../LICENSE $out/share/licenses/fcitx5-mozc/LICENSE
+      install -Dm444 data/installer/credits_en.html $out/share/licenses/fcitx5-mozc/Submodules
+
+      install -Dm555 bazel-bin/unix/fcitx5/fcitx5-mozc.so $out/lib/fcitx5/fcitx5-mozc.so
+      install -Dm444 unix/fcitx5/mozc-addon.conf $out/share/fcitx5/addon/mozc.conf
+      install -Dm444 unix/fcitx5/mozc.conf $out/share/fcitx5/inputmethod/mozc.conf
+
+      for pofile in unix/fcitx5/po/*.po; do
+        filename=$(basename $pofile)
+        lang=''${filename/.po/}
+        mofile=''${pofile/.po/.mo}
+        msgfmt $pofile -o $mofile
+        install -Dm444 $mofile $out/share/locale/$lang/LC_MESSAGES/fcitx5-mozc.mo
+      done
+
+      msgfmt --xml -d unix/fcitx5/po/ --template unix/fcitx5/org.fcitx.Fcitx5.Addon.Mozc.metainfo.xml.in -o unix/fcitx5/org.fcitx.Fcitx5.Addon.Mozc.metainfo.xml
+      install -Dm444 unix/fcitx5/org.fcitx.Fcitx5.Addon.Mozc.metainfo.xml $out/share/metainfo/org.fcitx.Fcitx5.Addon.Mozc.metainfo.xml
+
+      cd bazel-bin/unix
+
+      unzip -o icons.zip
+
+      # These are relative symlinks, they will always resolve to files within $out
+
+      install -Dm444 mozc.png $out/share/icons/hicolor/128x128/apps/org.fcitx.Fcitx5.fcitx_mozc.png
+      ln -s org.fcitx.Fcitx5.fcitx_mozc.png $out/share/icons/hicolor/128x128/apps/fcitx_mozc.png
+
+      for svg in \
+        alpha_full.svg \
+        alpha_half.svg \
+        direct.svg \
+        hiragana.svg \
+        katakana_full.svg \
+        katakana_half.svg \
+        outlined/dictionary.svg \
+        outlined/properties.svg \
+        outlined/tool.svg
+      do
+        name=$(basename -- $svg)
+        path=$out/share/icons/hicolor/scalable/apps
+        prefix=org.fcitx.Fcitx5.fcitx_mozc
+
+        install -Dm444 $svg $path/$prefix_$name
+        ln -s $prefix_$name $path/fcitx_mozc_$name
+      done
+
+      runHook postInstall
+    '';
+  };
+
+  passthru.tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    inherit (nixosTests) fcitx5;
+  };
+
+  meta = with lib; {
+    description = "Mozc - a Japanese Input Method Editor designed for multi-platform";
+    homepage = "https://github.com/fcitx/mozc";
+    license = with licenses; [
+      asl20 # abseil-cpp
+      bsd3 # mozc, breakpad, gtest, gyp, japanese-usage-dictionary, protobuf
+      mit # wil
+      naist-2003 # IPAdic
+      publicDomain # src/data/test/stress_test, Okinawa dictionary
+      unicode-30 # src/data/unicode, breakpad
+    ];
+    maintainers = with maintainers; [
+      berberman
+      govanify
+      musjj
+    ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@ -5,10 +5,10 @@

 let
  pname = "fflogs";
-  version = "8.14.0";
+  version = "8.14.21";
  src = fetchurl {
    url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-hHgPtr25X2vZY+MKQn9FgkMLrF5vgklMQHzx4ksGrDk=";
+    hash = "sha256-sBC2qvtSje2uXzSZAYXBFmycKxf0B6/JZhOvWNyMp20=";
  };
  extracted = appimageTools.extractType2 { inherit pname version src; };
 in
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "fzf";
-  version = "0.55.0";
+  version = "0.56.0";

  src = fetchFromGitHub {
    owner = "junegunn";
    repo = "fzf";
    rev = "v${version}";
-    hash = "sha256-4ikNCepLF7odkaEO+tzgrHb4528LetPEeMStJVZyjWg=";
+    hash = "sha256-HG2GQwic1wJ0OiCinBEZ1wfjqXuq37udEpBwLt7LIA0=";
  };

-  vendorHash = "sha256-b7hCXDJ/EJr1sEvmS2RYaxBMkdWOo2LWe76mamD3BSY=";
+  vendorHash = "sha256-dsQyoSJQT5PwhZ/anth5YjNXf6ZubrCza6kXWZJ3DgA=";

  CGO_ENABLED = 0;

--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@ -10,15 +10,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitlab-ci-ls";
-  version = "0.21.3";
+  version = "0.22.0";
  src = fetchFromGitHub {
    owner = "alesbrelih";
    repo = "gitlab-ci-ls";
    rev = "${version}";
-    hash = "sha256-3PqGnknP5ilwPCDsD8GwIEamZC24lEnuQhipTo8RDI0=";
+    hash = "sha256-RXM581tW78YzH+NQhkpsbHz6m+PAF7NQ5p3TFugPo+M=";
  };

-  cargoHash = "sha256-c31madEElZpHbzyKHqUDyPW/maVrkNKlldX24Y3iFGQ=";
+  cargoHash = "sha256-PuNpkDjoJr1GttETWHA9X+LYNIJSgBXdZId5q2JSo6g=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs =
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@ -1,11 +1,12 @@
-{ callPackage
-, lib
-, stdenv
-, fetchurl
-, nixos
-, testers
-, versionCheckHook
-, hello
+{
+  callPackage,
+  lib,
+  stdenv,
+  fetchurl,
+  nixos,
+  testers,
+  versionCheckHook,
+  hello,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -42,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.tests.run = callPackage ./test.nix { hello = finalAttrs.finalPackage; };

-  meta = with lib; {
+  meta = {
    description = "Program that produces a familiar, friendly greeting";
    longDescription = ''
      GNU Hello is a program that prints "Hello, world!" when you run it.
@ -50,9 +51,9 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://www.gnu.org/software/hello/manual/";
    changelog = "https://git.savannah.gnu.org/cgit/hello.git/plain/NEWS?h=v${finalAttrs.version}";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ stv0g ];
    mainProgram = "hello";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/jo/journalist/package.nix
+++ b/pkgs/by-name/jo/journalist/package.nix
@ -1,34 +1,21 @@
 {
  lib,
  buildGoModule,
-  fetchpatch,
  fetchFromGitHub,
 }:

 buildGoModule rec {
  pname = "journalist";
-  version = "1.0.0-unstable-2024-06-15";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "mrusme";
    repo = "journalist";
-    rev = "93781b1278e271995769f576b74fee794a19de14";
-    hash = "sha256-RRo9AEaHJPzN9+oW5kIBUNCPVdFkY2USOIZeUts8P/M=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3MnkndG2c4P3oprIRbzj26oAutEmAgsUx8mjlaDLrkI=";
  };

-  overrideModAttrs = _oldAttrs: {
-    patches = [
-      # fix go.sum by adding missing module
-      # see https://github.com/mrusme/journalist/pull/18
-      (fetchpatch {
-        name = "fix-go-sum.patch";
-        url = "https://github.com/mrusme/journalist/commit/546585222993586057a12ab4e9b38000c537f6cf.patch";
-        hash = "sha256-+QZhP/Har5UVi1pvqB6wWY0+xKqP0B8QukCcNlGkqxQ=";
-      })
-    ];
-  };
-
-  vendorHash = "sha256-fEHVc9kRbeeXICWhJshLp9JK/ICBR/RB5SVChJzSXpI=";
+  vendorHash = "sha256-2EJ96dhhU7FZxMkHOmQo79WCHu8U1AGgFf47FIuQdek=s";

  ldflags = [
    "-s"
@ -39,6 +26,7 @@ buildGoModule rec {
  meta = {
    description = "RSS aggregator";
    homepage = "https://github.com/mrusme/journalist";
+    changelog = "https://github.com/mrusme/journalist/releases/tag/v${version}";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ moraxyc ];
    mainProgram = "journalist";
--- a/pkgs/by-name/ka/kando/package.nix
+++ b/pkgs/by-name/ka/kando/package.nix
@ -0,0 +1,152 @@
+{
+  lib,
+  stdenv,
+  buildNpmPackage,
+  fetchFromGitHub,
+  overrideSDK,
+
+  electron,
+  nodejs,
+
+  cmake,
+  zip,
+  makeWrapper,
+  wayland-scanner,
+  copyDesktopItems,
+  makeDesktopItem,
+
+  libxkbcommon,
+  libX11,
+  libXtst,
+  libXi,
+  wayland,
+  darwin,
+}:
+
+let
+  buildNpmPackage' = buildNpmPackage.override {
+    stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+  };
+in
+buildNpmPackage' rec {
+  pname = "kando";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "kando-menu";
+    repo = "kando";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JcPTplqrMgDsT0HDTh7liChUWvLqe9gwS51ANM3Wsds=";
+  };
+
+  npmDepsHash = "sha256-13NuhGq5Pv5GSLeXASWxbXZYaUb9KzMgR7y5I7mv+MA=";
+
+  npmFlags = [ "--ignore-scripts" ];
+
+  makeCacheWritable = true;
+
+  nativeBuildInputs =
+    [
+      cmake
+      zip
+      makeWrapper
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      wayland-scanner
+      copyDesktopItems
+    ];
+
+  buildInputs =
+    lib.optionals stdenv.isLinux [
+      libxkbcommon
+      libX11
+      libXtst
+      libXi
+      wayland
+    ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.AppKit ];
+
+  dontUseCmakeConfigure = true;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    # use our own node headers since we skip downloading them
+    NIX_CFLAGS_COMPILE = "-I${nodejs}/include/node";
+    # disable code signing on Darwin
+    CSC_IDENTITY_AUTO_DISCOVERY = lib.optionalString stdenv.isDarwin "false";
+  };
+
+  postConfigure = ''
+    # electron files need to be writable on Darwin
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
+    zip -0Xqr ../electron.zip .
+    popd
+
+    rm -r electron-dist
+
+    # force @electron/packager to use our electron instead of downloading it, even if it is a different version
+    substituteInPlace node_modules/@electron/packager/dist/packager.js \
+        --replace-fail 'await this.getElectronZipPath(downloadOpts)' '"electron.zip"'
+
+    # don't fetch node headers
+    substituteInPlace node_modules/cmake-js/lib/dist.js \
+        --replace-fail '!this.downloaded' 'false'
+  '';
+
+  # we used --ignore-scripts to have time to patch the dependencies
+  # now we'll have to call npm rebuild manually
+  preBuild = ''
+    npm rebuild --verbose
+  '';
+
+  npmBuildScript = "package";
+
+  installPhase = ''
+    runHook preInstall
+
+    ${lib.optionalString stdenv.isLinux ''
+      mkdir -p $out/share/kando
+      cp -r out/*/{locales,resources{,.pak}} $out/share/kando
+
+      install -Dm644 assets/icons/icon.svg $out/share/icons/hicolor/scalable/apps/kando.svg
+
+      makeWrapper ${lib.getExe electron} $out/bin/kando \
+          --add-flags $out/share/kando/resources/app \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --inherit-argv0
+    ''}
+
+    ${lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/Applications
+      cp -r out/*/Kando.app $out/Applications
+      makeWrapper $out/Applications/Kando.app/Contents/MacOS/Kando $out/bin/kando
+    ''}
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "kando";
+      exec = "kando %U";
+      icon = "kando";
+      desktopName = "Kando";
+      genericName = "Pie Menu";
+      comment = "The Cross-Platform Pie Menu";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  meta = {
+    changelog = "https://github.com/kando-menu/kando/releases/tag/v${version}";
+    description = "Cross-Platform Pie Menu";
+    homepage = "https://github.com/kando-menu/kando";
+    license = lib.licenses.mit;
+    mainProgram = "kando";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = electron.meta.platforms;
+  };
+}
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "kdlfmt";
+  version = "0.0.3";
+
+  src = fetchFromGitHub {
+    owner = "hougesen";
+    repo = "kdlfmt";
+    rev = "v${version}";
+    hash = "sha256-qD1NYLHGmVRgV6pPXbvJ9NWDg/wVLWJY4hUsOLDlKh0=";
+  };
+
+  cargoHash = "sha256-7HSDz/JI5VuTdM/Hv+nq+ddpQg31Q1v7Ct5gz2PfdmE=";
+
+  meta = {
+    description = "Formatter for kdl documents";
+    homepage = "https://github.com/hougesen/kdlfmt.git";
+    changelog = "https://github.com/hougesen/kdlfmt/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ airrnot ];
+    mainProgram = "kdlfmt";
+  };
+}
--- a/pkgs/by-name/li/lib60870/package.nix
+++ b/pkgs/by-name/li/lib60870/package.nix
@ -32,11 +32,11 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

-  meta = with lib; {
+  meta = {
    description = "Implementation of the IEC 60870-5-101/104 protocol";
    homepage = "https://libiec61850.com/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ stv0g ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ stv0g ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/li/libconfig/package.nix
+++ b/pkgs/by-name/li/libconfig/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  # This also disables building tests.
+  # on static windows cross-compile they fail to build
+  doCheck ? with stdenv.hostPlatform; !(isWindows && isStatic),
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libconfig";
+  version = "1.7.3";
+
+  src = fetchurl {
+    url = "https://hyperrealm.github.io/${finalAttrs.pname}/dist/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-VFFm1srAN3RDgdHpzFpUBQlOe/rRakEWmbz/QLuzHuc=";
+  };
+
+  inherit doCheck;
+
+  configureFlags =
+    lib.optional (stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isStatic) "--disable-examples"
+    ++ lib.optional (!finalAttrs.doCheck) "--disable-tests";
+
+  cmakeFlags = lib.optionals (!finalAttrs.doCheck) [ "-DBUILD_TESTS:BOOL=OFF" ];
+
+  meta = {
+    homepage = "https://hyperrealm.github.io/libconfig/";
+    description = "C/C++ library for processing configuration files";
+    license = lib.licenses.lgpl3;
+    maintainers = with lib.maintainers; [ stv0g ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/li/libiec61850/package.nix
+++ b/pkgs/by-name/li/libiec61850/package.nix
@ -23,11 +23,11 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

-  meta = with lib; {
+  meta = {
    description = "Open-source library for the IEC 61850 protocols";
    homepage = "https://libiec61850.com/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ stv0g ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ stv0g ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/lo/lora/package.nix
+++ b/pkgs/by-name/lo/lora/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "lora";
+  version = "v3.005";
+
+  src = fetchFromGitHub {
+    owner = "cyrealtype";
+    repo = "lora";
+    rev = version;
+    hash = "sha256-EHa8DUPFRvdYBdCY41gfjKGtTHwGIXCwD9Qc+Npmt1s=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp -R $src/fonts/ttf/*.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Lora is a well-balanced contemporary serif with roots in calligraphy";
+    homepage = "https://github.com/cyrealtype/lora";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ofalvai ];
+  };
+}
--- a/pkgs/by-name/mo/mollysocket/package.nix
+++ b/pkgs/by-name/mo/mollysocket/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mollysocket";
-  version = "1.4.1";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "mollyim";
    repo = "mollysocket";
    rev = version;
-    hash = "sha256-vE5J4BKYmVqtowfxDDTOwFKws7phYRm9xKFPiDNuNn4=";
+    hash = "sha256-RRnMmdyr4FZHsdLjGvTRiSw+YC+OutWqsoEId7ZlSX0=";
  };

-  cargoHash = "sha256-s/EhX5o6XuUqcrqhXY274MyWhRukgetfIZKQ4XNlq6Y=";
+  cargoHash = "sha256-BXllzuw01ANrk+osUsAlMyLRAptvxGO+rl0ygsCfewU=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/mo/mozc-ut/package.nix
+++ b/pkgs/by-name/mo/mozc-ut/package.nix
@ -0,0 +1,23 @@
+{
+  mozc,
+  mozcdic-ut-alt-cannadic,
+  mozcdic-ut-edict2,
+  mozcdic-ut-jawiki,
+  mozcdic-ut-neologd,
+  mozcdic-ut-personal-names,
+  mozcdic-ut-place-names,
+  mozcdic-ut-skk-jisyo,
+  mozcdic-ut-sudachidict,
+}:
+mozc.override {
+  dictionaries = [
+    mozcdic-ut-alt-cannadic
+    mozcdic-ut-edict2
+    mozcdic-ut-jawiki
+    mozcdic-ut-neologd
+    mozcdic-ut-personal-names
+    mozcdic-ut-place-names
+    mozcdic-ut-skk-jisyo
+    mozcdic-ut-sudachidict
+  ];
+}
--- a/pkgs/by-name/mo/mozc/package.nix
+++ b/pkgs/by-name/mo/mozc/package.nix
@ -17,7 +17,7 @@ let
  ut-dictionary = merge-ut-dictionaries.override { inherit dictionaries; };
 in
 buildBazelPackage rec {
-  pname = "ibus-mozc";
+  pname = "mozc";
  version = "2.30.5544.102";

  src = fetchFromGitHub {
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "nhost-cli";
-  version = "1.24.0";
+  version = "1.24.5";

  src = fetchFromGitHub {
    owner = "nhost";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-8kul3tiwEJF6Pu1os29MteeYP+85X9hH12MojMpW9bY=";
+    hash = "sha256-/NkegGp+JoJWPIkO3YKp/aZ6Yp5tcjnRCONY0GHe+HI=";
  };

  vendorHash = null;
@ -27,9 +27,12 @@ buildGoModule rec {
    mv $out/bin/cli $out/bin/nhost
  '';

+  checkFlags = [ "-skip=^TestMakeJSONRequest$" ];
+
  meta = {
-    description = "A tool for setting up a local development environment for Nhost";
+    description = "Tool for setting up a local development environment for Nhost";
    homepage = "https://github.com/nhost/cli";
+    changelog = "https://github.com/nhost/cli/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ moraxyc ];
    mainProgram = "nhost";
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@ -16,13 +16,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "nwg-panel";
-  version = "0.9.40";
+  version = "0.9.48";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
    rev = "refs/tags/v${version}";
-    hash = "sha256-MymxhQxPS07qZlD+TsiMyMtOrmIuqi3LAhc0Huxwxjs=";
+    hash = "sha256-/PMUkD2kr8aqmohStntlTOc5XgfR+A3LaeYsk04GvOM=";
  };

  # No tests
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "openpgp-card-tools";
-  version = "0.11.6";
+  version = "0.11.7";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "openpgp-card";
    repo = "openpgp-card-tools";
    rev = "v${version}";
-    hash = "sha256-ZnIJLNg9soRzGEjoRNbUzDUtj71y54t+qTC4QDjiCmM=";
+    hash = "sha256-sR+jBCSuDH4YdJz3YuvA4EE36RHV3m/xU8hIEXXsqKo=";
  };

-  cargoHash = "sha256-t+fKCviu9UOz2GHkIBqtSp0vyqXPAR1TuWi4yOYR0Bc=";
+  cargoHash = "sha256-G5+lVK41hbzy/Ltc0EKoUfqF0M1OYu679jyVjYKJmn0=";

  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];

--- a/pkgs/by-name/pr/prometheus-pushgateway/package.nix
+++ b/pkgs/by-name/pr/prometheus-pushgateway/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pushgateway";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "prometheus";
    repo = "pushgateway";
    rev = "v${version}";
-    sha256 = "sha256-SpHxBxBl0APP/y7MnR/p/+VjNAvFOZVlgGMlMGTbodI=";
+    sha256 = "sha256-Avp5hWRdkM/vCz6B/b7uOrnYjFrN5UkE7siK0+ANO1Q=";
  };

-  vendorHash = "sha256-GydAY73Ui6z833x0DoWa6BpK35CYdYfyHw2+RwT3miw=";
+  vendorHash = "sha256-cyZ/LzKB3UlyqzID9f6I4niwJ/sPIm2htVOn3Ik2HAY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@ -45,6 +45,7 @@ python3.pkgs.buildPythonApplication rec {
    boto3
    botocore
    colorama
+    cryptography
    dash
    dash-bootstrap-components
    detect-secrets
@ -52,12 +53,13 @@ python3.pkgs.buildPythonApplication rec {
    google-auth-httplib2
    jsonschema
    kubernetes
+    microsoft-kiota-abstractions
    msgraph-sdk
-    msrestazure
    numpy
    pandas
    py-ocsf-models
    pydantic
+    python-dateutil
    pytz
    schema
    shodan
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@ -1,30 +1,31 @@
-{ alsa-lib
-, libuuid
-, cups
-, dpkg
-, fetchurl
-, glib
-, libssh2
-, gtk3
-, lib
-, libayatana-appindicator
-, libdrm
-, libgcrypt
-, libkrb5
-, libnotify
-, mesa # for libgbm
-, libpulseaudio
-, libGL
-, nss
-, xorg
-, systemd
-, stdenv
-, vips
-, at-spi2-core
-, autoPatchelfHook
-, makeShellWrapper
-, wrapGAppsHook3
-, commandLineArgs ? ""
+{
+  alsa-lib,
+  libuuid,
+  cups,
+  dpkg,
+  fetchurl,
+  glib,
+  libssh2,
+  gtk3,
+  lib,
+  libayatana-appindicator,
+  libdrm,
+  libgcrypt,
+  libkrb5,
+  libnotify,
+  mesa, # for libgbm
+  libpulseaudio,
+  libGL,
+  nss,
+  xorg,
+  systemd,
+  stdenv,
+  vips,
+  at-spi2-core,
+  autoPatchelfHook,
+  makeShellWrapper,
+  wrapGAppsHook3,
+  commandLineArgs ? "",
 }:

 let
@ -39,7 +40,8 @@ let
      hash = sources.arm64_hash;
    };
  };
-  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 in
 stdenv.mkDerivation {
  pname = "qq";
@ -87,7 +89,12 @@ stdenv.mkDerivation {
    makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
      --prefix LD_PRELOAD : "${lib.makeLibraryPath [ libssh2 ]}/libssh2.so.1" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL libuuid ]}" \
+      --prefix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libGL
+          libuuid
+        ]
+      }" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
      --add-flags ${lib.escapeShellArg commandLineArgs} \
      "''${gappsWrapperArgs[@]}"
@ -110,12 +117,18 @@ stdenv.mkDerivation {

  passthru.updateScript = ./update.sh;

-  meta = with lib; {
+  meta = {
    homepage = "https://im.qq.com/linuxqq/";
    description = "Messaging app";
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ fee1-dead bot-wxt1221 ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [
+      fee1-dead
+      bot-wxt1221
+    ];
  };
 }
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-09-28
+# Last updated: 2024-10-25
 {
-  version = "3.2.12-2024.9.27";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240927_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240927_arm64_01.deb";
-  arm64_hash = "sha256-VfM+p2cTNkDZc7sTftfTuRSMKVWwE6TerW25pA1MIR0=";
-  amd64_hash = "sha256-xBGSSxXDu+qUwj203i3iAkfI97iLtGOuGMGfEU6kCyQ=";
+  version = "3.2.13-2024.10.23";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241023_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241023_arm64_01.deb";
+  arm64_hash = "sha256-n2ezKgLfmugUZYvGzDvaLKy+Tf8ooUC6Oc6xCDp5rYA=";
+  amd64_hash = "sha256-H5ACKFVV4AQ3de9UV4i9ejL1WjuuPJhTLTVqK5EcssM=";
 }
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@ -7,7 +7,7 @@
  stdenv,
 }:
 let
-  version = "0.2.7";
+  version = "0.2.9";
 in
 rustPlatform.buildRustPackage {
  inherit version;
@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
    owner = "achristmascarl";
    repo = "rainfrog";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ey9ioPDeuNYw2+UBUgtE0C1wES3wecFDWd9CMeKBq4Q=";
+    hash = "sha256-PiJRVf+rpYFWRmys7Ca2lLfe5F9/ksIzkpKs6CQWu+A=";
  };

-  cargoHash = "sha256-mc7Lgaf1seefVu+LafctJm4y8xjX3c1ApadeQMi3STE=";
+  cargoHash = "sha256-L0gXxV/3+5oRV/Ipm4sRqr9dh9AEChWhtILO3PaNxYY=";

  buildInputs = lib.optionals stdenv.isDarwin (
    with darwin.apple_sdk.frameworks;
--- a/pkgs/by-name/re/remctl/package.nix
+++ b/pkgs/by-name/re/remctl/package.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  libevent,
+  krb5,
+  openssl,
+  perl,
+  pkg-config,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "remctl";
+  version = "3.18";
+
+  src = fetchFromGitHub {
+    owner = "rra";
+    repo = "remctl";
+    rev = "release/${finalAttrs.version}";
+    hash = "sha256-4KzNhFswNTwcXrDBAfRyr502zwRQ3FACV8gDfBm7M0A=";
+  };
+
+  # Fix references to /usr/bin/perl in tests and
+  # disable acl/localgroup test that does not work in sandbox.
+  postPatch = ''
+    patchShebangs tests
+    sed -i '\,server/acl/localgroup,d' tests/TESTS
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+  ];
+
+  buildInputs = [
+    krb5
+    libevent
+    openssl
+  ];
+
+  # Invokes pod2man to create man pages required by Makefile.
+  preConfigure = ''
+    ./bootstrap
+  '';
+
+  makeFlags = [
+    "LD=$(CC)"
+    "REMCTL_PERL_FLAGS='--prefix=$(out)'"
+    "REMCTL_PYTHON_INSTALL='--prefix=$(out)'"
+  ];
+
+  checkTarget = "check-local";
+
+  meta = with lib; {
+    description = "Remote execution tool";
+    homepage = "https://www.eyrie.org/~eagle/software/remctl";
+    mainProgram = "remctl";
+    license = licenses.mit;
+    maintainers = teams.deshaw.members;
+  };
+})
--- a/pkgs/by-name/se/send/package.nix
+++ b/pkgs/by-name/se/send/package.nix
@ -0,0 +1,58 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  nodejs,
+  nixosTests,
+}:
+
+buildNpmPackage rec {
+  pname = "send";
+  version = "3.4.23";
+
+  src = fetchFromGitHub {
+    owner = "timvisee";
+    repo = "send";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bqQEXLwUvTKX+m2yNHRnrl+eeaGmcovXpXugxd+j14A=";
+  };
+
+  npmDepsHash = "sha256-r1iaurKuhpP0sevB5pFdtv9j1ikM1fKL7Jgakh4FzTI=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  env = {
+    PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "true";
+  };
+
+  makeCacheWritable = true;
+
+  npmPackFlags = [ "--ignore-scripts" ];
+
+  NODE_OPTIONS = "--openssl-legacy-provider";
+
+  postInstall = ''
+    cp -r dist $out/lib/node_modules/send/
+    ln -s $out/lib/node_modules/send/dist/version.json $out/lib/node_modules/send/version.json
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/send \
+      --add-flags $out/lib/node_modules/send/server/bin/prod.js \
+      --set "NODE_ENV" "production"
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) send;
+  };
+
+  meta = {
+    description = "File Sharing Experiment";
+    changelog = "https://github.com/timvisee/send/releases/tag/v${version}";
+    homepage = "https://github.com/timvisee/send";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "send";
+  };
+}
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "simdutf";
-  version = "5.5.0";
+  version = "5.6.0";

  src = fetchFromGitHub {
    owner = "simdutf";
    repo = "simdutf";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-LEXx/b0DJZ9xxQX9+4YHjQCLFp2aXCE78Z6iPlXJjAw=";
+    hash = "sha256-DJCr+QoCmN0wJiXH+mv4g/zJYFfgJDGw0l6pzPriBVs=";
  };

  # Fix build on darwin
--- a/pkgs/by-name/so/softether/package.nix
+++ b/pkgs/by-name/so/softether/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  openssl,
  readline,
  ncurses,
@ -9,14 +9,15 @@
  dataDir ? "/var/lib/softether",
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "softether";
-  version = "4.38";
-  build = "9760";
+  version = "4.41-9782-beta";

-  src = fetchurl {
-    url = "https://github.com/SoftEtherVPN/SoftEtherVPN_Stable/releases/download/v${version}-${build}-rtm/softether-src-v${version}-${build}-rtm.tar.gz";
-    sha256 = "0d8zahi9lkv72jh8yj66pwrsi4451vk113d3khzrzgbic6s2i0g6";
+  src = fetchFromGitHub {
+    owner = "SoftEtherVPN";
+    repo = "SoftEtherVPN_Stable";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-yvN5hlfAtE+gWm0s/TY/Lp53By5SDHyQIvvDutRnDNQ=";
  };

  buildInputs = [
@ -40,11 +41,14 @@ stdenv.mkDerivation rec {
      Makefile
  '';

-  meta = with lib; {
+  meta = {
    description = "Open-Source Free Cross-platform Multi-protocol VPN Program";
    homepage = "https://www.softether.org/";
-    license = licenses.asl20;
-    maintainers = [ maintainers.rick68 ];
-    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.rick68 ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
  };
-}
+})
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sopwith";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "fragglet";
    repo = "sdl-sopwith";
    rev = "refs/tags/sdl-sopwith-${version}";
-    hash = "sha256-e7/Cv/v5NhYG5eb9B5oVxh/Dbmm2v4Y4KUKI4JI5SFw=";
+    hash = "sha256-sjg61QgcQDSQ/qrR+4PEZIf8OOnGBZvUSLCKGpS1bwg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ss/sshified/package.nix
+++ b/pkgs/by-name/ss/sshified/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "sshified";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "hoffie";
+    repo = "sshified";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-oCeuQ4Do+Lyqsf8hBH9qvLxWbWQlqol481VrbnAW2ic=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+  ];
+
+  subPackages = [ "." ];
+
+  meta = {
+    description = "Proxy HTTP requests through SSH";
+    homepage = "https://github.com/hoffie/sshified";
+    changelog = "https://github.com/hoffie/sshified/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ joinemm ];
+    mainProgram = "sshified";
+  };
+}
--- a/pkgs/by-name/st/streamcontroller/package.nix
+++ b/pkgs/by-name/st/streamcontroller/package.nix
@ -16,15 +16,13 @@
 stdenv.mkDerivation rec {
  pname = "streamcontroller";

-  # Note that the latest tagged version (1.5.0-beta.6) includes a python dependency
-  # that doesn't exist anymore, so we package an unstable version instead.
-  version = "1.5.0-beta.6-unstable-2024-08-13";
+  version = "1.5.0-beta.7";

  src = fetchFromGitHub {
    repo = "StreamController";
    owner = "StreamController";
-    rev = "dbb6460a69137af192db09d504224ae9f1127cbd";
-    hash = "sha256-+YYzHLRU5MNjF3iaKIDj9k4PVg+vnEZhbc3ZmNI7xyw=";
+    rev = version;
+    hash = "sha256-UBcsA9pAo7fONhk4vYXQU4EgSVKm1D7/7nvL9BaNIgo=";
  };

  # The installation method documented upstream
--- a/pkgs/by-name/tu/tuifimanager/package.nix
+++ b/pkgs/by-name/tu/tuifimanager/package.nix
@ -19,14 +19,14 @@ lib.throwIf (enableDragAndDrop && !hasDndSupport)

 python3.pkgs.buildPythonApplication rec {
  pname = "tuifimanager";
-  version = "4.1.7";
+  version = "5.0.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "GiorgosXou";
    repo = "TUIFIManager";
    rev = "v.${version}";
-    hash = "sha256-kljodLSSjvGcjhD7IhAVAAGd6LoiM6IYwMXuSsIJ198=";
+    hash = "sha256-2yYD1YFGoN0uj3HzcYxEs3zbwfUIDLLzvfTcZILx5h4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ve/vep/package.nix
+++ b/pkgs/by-name/ve/vep/package.nix
@ -0,0 +1,134 @@
+# Instructions:http://www.ensembl.org/info/docs/api/api_installation.html,
+# Do not use https://github.com/Ensembl/ensembl-vep/archive/release/${version}.zip
+# We cannot use INSTALL.pl but it’s not that bad:install the dependencies and copies the .pm files should be ok
+{
+  lib,
+  htslib,
+  perlPackages,
+  stdenv,
+  fetchFromGitHub,
+  perl,
+  makeWrapper,
+}:
+
+let
+  version = "110";
+  customInstallPhase = ''
+    mkdir -p $out/${perl.libPrefix}/${perl.version}/
+    tests=$(find modules/ -mindepth 1 -maxdepth 1 -type d | grep -v t)
+    cp -r $tests $out/${perl.libPrefix}/${perl.version}/
+  '';
+
+  ensemblGit =
+    name: sha256:
+    # Copy modules directly
+    stdenv.mkDerivation {
+      inherit name version;
+      src = fetchFromGitHub {
+        inherit sha256 version;
+        owner = "Ensembl";
+        repo = name;
+        rev = "release/${version}";
+      };
+      installPhase = ''
+        runHook preInstall
+
+        ${customInstallPhase}
+
+        runHook postInstall'';
+    };
+
+  vepPlugins = fetchFromGitHub {
+    owner = "Ensembl";
+    repo = "VEP_plugins";
+    rev = "8f271c4848338dc7d504881ff71fdf2892c3d096";
+    sha256 = "sha256-LbaXwLFDP3m1QhRHwO9uh36BEFHE2NzL4xdxTb7/S5Q=";
+  };
+
+  # Install ensembl-xs, faster run using re-implementation in C of some of the Perl subroutines
+  ensembl-xs = perlPackages.buildPerlPackage rec {
+    pname = "ensembl-xs";
+    version = "2.3.2";
+    src = fetchFromGitHub {
+      inherit version;
+      owner = "Ensembl";
+      repo = "ensembl-xs";
+      rev = version;
+      sha256 = "1qqnski532f4bz32wxbqd9w1sz40rjh81ipp9p02k3rlaf1gp1fa";
+    };
+    # PREFIX is important
+    configurePhase = ''
+      perl Makefile.PL PREFIX=$out INSTALLDIRS=site
+    '';
+    # Test do not work -- wrong include path
+    doCheck = false;
+  };
+
+  # it contains compiled versions of certain key subroutines used in VEP
+  ensembl = ensemblGit "ensembl" "sha256-ZhI4VNxIY+53RX2uYRNlFeo/ydAmlwGx00WDXaxv6h4=";
+  ensembl-io = ensemblGit "ensembl-io" "sha256-r3RvN5U2kcyghoKM0XuiBRe54t1U4FaZ0QEeYIFiG0w=";
+  ensembl-variation = ensemblGit "ensembl-variation" "sha256-UjrLHF9EqI+Mp+SZR4sLNZUCGiA/UYhoFWtpwiKF8tM=";
+  ensembl-funcgen = ensemblGit "ensembl-funcgen" "sha256-a9hxLBoXJsF5JWuRdpyOac1u033M8ivEjEQecuncghs=";
+in
+perlPackages.buildPerlModule rec {
+  inherit version;
+  pname = "vep";
+  buildInputs =
+    (with perlPackages; [
+      ArchiveZip
+      BioBigFile
+      BioDBHTS
+      BioExtAlign
+      BioPerl
+      DBI
+      DBDmysql
+      LWP
+      JSON
+    ])
+    ++ [
+      ensembl-xs
+      ensembl
+      ensembl-funcgen
+      ensembl-io
+      ensembl-variation
+    ];
+  propagatedBuildInputs = [ htslib ];
+  src = fetchFromGitHub {
+    owner = "Ensembl";
+    repo = "ensembl-${pname}";
+    rev = "release/${version}";
+    sha256 = "sha256-6lRdWV2ispl+mpBhkZez/d9PxOw1fkNUWeG8mUIqBJc=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  dontBuild = true;
+  doCheck = false;
+
+  outputs = [ "out" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -D -m755 filter_vep vep $out/bin/
+
+    wrapProgram $out/bin/vep \
+      --prefix PERL5LIB : $out/${perl.libPrefix}/${perl.version}/ \
+      --add-flags "--dir_plugins ${vepPlugins}"
+
+    wrapProgram $out/bin/filter_vep \
+      --prefix PERL5LIB : $out/${perl.libPrefix}/${perl.version}/
+    ${customInstallPhase}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://www.ensembl.org/info/docs/tools/vep/index.html";
+    description = "Annotate genetics variants based on genes, transcripts, and protein sequence, as well as regulatory regions";
+    license = lib.licenses.asl20;
+    mainProgram = "vep";
+    maintainers = with lib.maintainers; [ apraga ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "versatiles";
+  version = "0.12.10"; # When updating: Replace with current version
+
+  src = fetchFromGitHub {
+    owner = "versatiles-org";
+    repo = "versatiles-rs";
+    rev = "refs/tags/v${version}"; # When updating: Replace with long commit hash of new version
+    hash = "sha256-LKUpxsAy39dX8hESlUEVs4rkOpYsd7kbATfnU1QYd9Q="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed.
+  };
+
+  cargoHash = "sha256-dkFnoQY1+VNNrjS+o5Y0cvhWKoHt38KJKyNhCQ0dGaY="; # When updating: Same as above
+
+  # Testing only necessary for the `bins` and `lib` features
+  cargoTestFlags = [
+    "--bins"
+    "--lib"
+  ];
+
+  # Skip tests that require network access
+  checkFlags = [
+    "--skip tools::convert::tests::test_remote1"
+    "--skip tools::convert::tests::test_remote2"
+    "--skip tools::probe::tests::test_remote"
+    "--skip tools::serve::tests::test_remote"
+    "--skip utils::io::data_reader_http"
+    "--skip utils::io::data_reader_http::tests::read_range_git"
+    "--skip utils::io::data_reader_http::tests::read_range_googleapis"
+  ];
+
+  meta = {
+    description = "Toolbox for converting, checking and serving map tiles in various formats";
+    longDescription = ''
+      VersaTiles is a Rust-based project designed for processing and serving tile data efficiently.
+      It supports multiple tile formats and offers various functionalities for handling tile data.
+    '';
+    homepage = "https://versatiles.org/";
+    downloadPage = "https://github.com/versatiles-org/versatiles-rs";
+    changelog = "https://github.com/versatiles-org/versatiles-rs/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ wilhelmines ];
+    mainProgram = "versatiles";
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
+  };
+}
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "VictoriaMetrics";
-  version = "1.102.1";
+  version = "1.105.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    rev = "v${version}";
-    hash = "sha256-FFQiHPcvB3ht6NlaUWPAuEUswXYUzeRilAw4NQ9+8/o=";
+    hash = "sha256-cMc2CVjVTQLsY/GJht35DCapEtROPJO3j6FCCDXJPMk=";
  };

  vendorHash = null;
--- a/pkgs/by-name/wa/warp-plus/package.nix
+++ b/pkgs/by-name/wa/warp-plus/package.nix
@ -0,0 +1,52 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+
+  nix-update-script,
+  testers,
+  warp-plus,
+}:
+
+buildGoModule rec {
+  pname = "warp-plus";
+  version = "1.2.4";
+
+  src = fetchFromGitHub {
+    owner = "bepass-org";
+    repo = "warp-plus";
+    rev = "v${version}";
+    hash = "sha256-fFyYch14JqXSmnplPJ8c3epOxromZmEJAdcuSgkKbcM=";
+  };
+
+  vendorHash = "sha256-/rBZqrX9xZT8yOZwynkOOQyPl0govNmvsEqWVxsuvB4=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  checkFlags =
+    let
+      # Skip tests that require network access
+      skippedTests = [
+        "TestConcurrencySafety"
+        "TestTwoDevicePing"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = warp-plus; };
+  };
+
+  meta = {
+    description = "Warp + Psiphon, an anti censorship utility for Iran";
+    homepage = "https://github.com/bepass-org/warp-plus";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ paveloom ];
+    mainProgram = "warp-plus";
+  };
+}
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@ -1,14 +1,14 @@
 {
  "darwin": {
-    "hash": "sha256-6cPn6ukGPpEdzCcENGUT5h+UPSo8rrEZEjeLEHJTG/4=",
-    "version": "0.2024.10.15.08.02.stable_03"
+    "hash": "sha256-KaHjVEdmzOw3BnFd77vTb+067IEOPIWiJmVOHQcjN6E=",
+    "version": "0.2024.10.23.14.49.stable_00"
  },
  "linux_x86_64": {
-    "hash": "sha256-ftTBelAaGWxrOlpDGtEeNT9GjtS4XZdvzUsWxEnrGzs=",
-    "version": "0.2024.10.15.08.02.stable_03"
+    "hash": "sha256-gRuA+drCQdOPJrSKky2WKxon84dxVVcfK+0GipzMBZU=",
+    "version": "0.2024.10.23.14.49.stable_00"
  },
  "linux_aarch64": {
-    "hash": "sha256-y7oSCc+bsRj7BSF8MiYpNJ73M5xBBTIRhotHdRPsfqk=",
-    "version": "0.2024.10.15.08.02.stable_03"
+    "hash": "sha256-LTpcGsQscEbxAosW68yfSb9lDyecDLdci3JzPimTYrQ=",
+    "version": "0.2024.10.23.14.49.stable_00"
  }
 }
--- a/pkgs/by-name/wi/wired/package.nix
+++ b/pkgs/by-name/wi/wired/package.nix
@ -0,0 +1,53 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  dbus,
+  pango,
+  cairo,
+  xorg,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wired";
+  version = "0.10.6";
+
+  src = fetchFromGitHub {
+    owner = "Toqozz";
+    repo = "wired-notify";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AWIV/+vVwDZECZ4lFMSFyuyUKJc/gb72PiBJv6lbhnc=";
+  };
+
+  cargoHash = "sha256-gIDMD1jT6Wj5FCgbPURF0aayFBOq2mrZE1GZWQ3iYAA=";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    dbus
+    pango
+    cairo
+    xorg.libXScrnSaver
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libX11
+    xorg.libXi
+  ];
+
+  postInstall = ''
+    mkdir -p $out/usr/lib/systemd/system
+    substitute ./wired.service $out/usr/lib/systemd/system/wired.service --replace /usr/bin/wired $out/bin/wired
+    install -Dm444 -t $out/etc/wired wired.ron wired_multilayout.ron
+  '';
+
+  meta = {
+    description = "Lightweight notification daemon written in Rust";
+    homepage = "https://github.com/Toqozz/wired-notify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fccapria ];
+    badPlatforms = lib.platforms.darwin;
+    mainProgram = "wired";
+  };
+}
--- a/pkgs/by-name/ya/yabai/package.nix
+++ b/pkgs/by-name/ya/yabai/package.nix
@ -27,7 +27,7 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "yabai";
-  version = "7.1.3";
+  version = "7.1.4";

  src =
    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@ -96,13 +96,13 @@ stdenv'.mkDerivation (finalAttrs: {
      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
      "aarch64-darwin" = fetchzip {
        url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-wp5B24DYX1RYHS/3+4WRRCzVE6FyCzatJDpzJWrEIpQ=";
+        hash = "sha256-DAHZwEhPIBIfR2V+jTKje1msB8OMKzwGYgYnDql8zb0=";
      };
      "x86_64-darwin" = fetchFromGitHub {
        owner = "koekeishiya";
        repo = "yabai";
        rev = "v${finalAttrs.version}";
-        hash = "sha256-hCwI6ziUR4yuJOv4MQXh3ufbausaDrG8XfjR+jIOeC4=";
+        hash = "sha256-i/UqmBNTLBYY4ORI1Y7FWr+LZK0f/qMdWLPPuTb9+2w=";
      };
    };

--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@ -0,0 +1,49 @@
+{
+  python3Packages,
+  fetchPypi,
+  ffmpeg,
+  lib,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "ytdl-sub";
+  version = "2024.10.26";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "ytdl_sub";
+    hash = "sha256-qfEPHhCB/Avl+nUIk2+ZVseg8ATP/LQmLvX/H9rhp7M=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    wheel
+  ];
+
+  dependencies = with python3Packages; [
+    yt-dlp
+    colorama
+    mergedeep
+    mediafile
+    pyyaml
+  ];
+
+  makeWrapperArgs = [
+    "--set YTDL_SUB_FFMPEG_PATH ${lib.getExe' ffmpeg "ffmpeg"}"
+    "--set YTDL_SUB_FFPROBE_PATH ${lib.getExe' ffmpeg "ffprobe"}"
+  ];
+
+  meta = {
+    homepage = "https://github.com/jmbannon/ytdl-sub";
+    description = "Lightweight tool to automate downloading and metadata generation with yt-dlp";
+    longDescription = ''
+      ytdl-sub is a command-line tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. No additional plugins or external scrapers are needed.
+    '';
+    changelog = "https://github.com/jmbannon/ytdl-sub/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      loc
+    ];
+    mainProgram = "ytdl-sub";
+  };
+}
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@ -3,7 +3,7 @@
  asar,
  commandLineArgs ? "",
  copyDesktopItems,
-  electron_30,
+  electron_33,
  fetchurl,
  makeDesktopItem,
  makeWrapper,
@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "ytmdesktop";
-  version = "2.0.5";
+  version = "2.0.6";

  desktopItems = [
    (makeDesktopItem {
@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/ytmdesktop/ytmdesktop/releases/download/v${finalAttrs.version}/youtube-music-desktop-app_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-0j8HVmkFyTk/Jpq9dfQXFxd2jnLwzfEiqCgRHuc5g9o=";
+    hash = "sha256-uLTnVA9ooGlbtmUGoYtrT9IlOhTAJpEXMr1GSs3ae/8=";
  };

  unpackPhase = ''
@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
  fixupPhase = ''
    runHook preFixup

-    makeWrapper ${lib.getExe electron_30} $out/bin/ytmdesktop \
+    makeWrapper ${lib.getExe electron_33} $out/bin/ytmdesktop \
      --add-flags $out/lib/resources/app.asar \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
      --add-flags ${lib.escapeShellArg commandLineArgs}
@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.gpl3Only;
    mainProgram = finalAttrs.pname;
    maintainers = [ lib.maintainers.cjshearer ];
-    inherit (electron_30.meta) platforms;
+    inherit (electron_33.meta) platforms;
    # While the files we extract from the .deb are cross-platform (javascript), the installation
    # process for darwin is different, and I don't have a test device. PRs are welcome if you can
    # add the correct installation steps. I would suggest looking at the following:
--- a/pkgs/by-name/ze/zenity/package.nix
+++ b/pkgs/by-name/ze/zenity/package.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zenity";
-  version = "4.0.2";
+  version = "4.0.3";

  src = fetchurl {
    url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor finalAttrs.version}/zenity-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wW3K5G4p4iwvoLlegOBslrKuyThAFhNpyVyF7Z8JMVM=";
+    hash = "sha256-tCnZe4e9nOf7cqwLeN9TRyXYrTmBfdympMou5TgbCN4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/zi/zip2hashcat/package.nix
+++ b/pkgs/by-name/zi/zip2hashcat/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ...
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zip2hashcat";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "hashstation";
+    repo = "zip2hashcat";
+    # Upstream 1.0 tag has no content
+    rev = "462bd94ea30d69a0810ca9bb3d056aa0f5393d57";
+    hash = "sha256-+hbDTGSDUxA7M8gBI/TViJ2ZvheNxlonYC/aFLvgPW8=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    $CC zip2hashcat.c -o zip2hashcat
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv zip2hashcat $out/bin/zip2hashcat
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Processes input ZIP files into a format suitable for use with hashcat";
+    homepage = "https://github.com/hashstation/zip2hashcat";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/hashstation/zip2hashcat/releases/tag/${version}";
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    mainProgram = "zip2hashcat";
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/zp/zpaqfranz/package.nix
+++ b/pkgs/by-name/zp/zpaqfranz/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zpaqfranz";
-  version = "60.6";
+  version = "60.7";

  src = fetchFromGitHub {
    owner = "fcorbelli";
    repo = "zpaqfranz";
    rev = finalAttrs.version;
-    hash = "sha256-/lUczs4YrbLH7agZDyThPwtMLiSi07XMqwk0GgR/jFw=";
+    hash = "sha256-tlMbCHlrGPvRSqdfItdCkxLPm1LtVWcGTQMUoZTCsIg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@ -120,27 +120,44 @@ let
      xorg.libXtst
    ];

-    postInstall = ''
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -sf $out/include/linux/*_md.h $out/include/
+    postInstall =
+      let
+        cLibsAsFlags = (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs);
+        preservedNixVariables = [
+          "-ELOCALE_ARCHIVE"
+          "-ENIX_BINTOOLS"
+          "-ENIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}"
+          "-ENIX_BUILD_CORES"
+          "-ENIX_BUILD_TOP"
+          "-ENIX_CC"
+          "-ENIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}"
+          "-ENIX_CFLAGS_COMPILE"
+          "-ENIX_HARDENING_ENABLE"
+          "-ENIX_LDFLAGS"
+        ];
+        preservedNixVariablesAsFlags = (map (f: "--add-flags '${f}'") preservedNixVariables);
+      in
+      ''
+        # jni.h expects jni_md.h to be in the header search path.
+        ln -sf $out/include/linux/*_md.h $out/include/

-      mkdir -p $out/share
-      # move files in $out like LICENSE.txt
-      find $out/ -maxdepth 1 -type f -exec mv {} $out/share \;
-      # symbolic link to $out/lib/svm/LICENSE_NATIVEIMAGE.txt
-      rm -f $out/LICENSE_NATIVEIMAGE.txt
+        mkdir -p $out/share
+        # move files in $out like LICENSE.txt
+        find $out/ -maxdepth 1 -type f -exec mv {} $out/share \;
+        # symbolic link to $out/lib/svm/LICENSE_NATIVEIMAGE.txt
+        rm -f $out/LICENSE_NATIVEIMAGE.txt

-      # copy-paste openjdk's preFixup
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat > $out/nix-support/setup-hook << EOF
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
+        # copy-paste openjdk's preFixup
+        # Set JAVA_HOME automatically.
+        mkdir -p $out/nix-support
+        cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+        EOF

-      wrapProgram $out/bin/native-image \
-        --prefix PATH : ${binPath} \
-        ${toString (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
-    '';
+        wrapProgram $out/bin/native-image \
+          --prefix PATH : ${binPath} \
+          ${toString (cLibsAsFlags ++ preservedNixVariablesAsFlags)}
+      '';

    preFixup = lib.optionalString (stdenv.hostPlatform.isLinux) ''
      for bin in $(find "$out/bin" -executable -type f); do
@ -171,10 +188,8 @@ let
      echo "Testing GraalVM"
      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'

-      extraNativeImageArgs="$(export -p | sed -n 's/^declare -x \([^=]\+\)=.*$/ -E\1/p' | tr -d \\n)"
-
      echo "Ahead-Of-Time compilation"
-      $out/bin/native-image -H:+UnlockExperimentalVMOptions -H:-CheckToolchain -H:+ReportExceptionStackTraces -march=compatibility $extraNativeImageArgs HelloWorld
+      $out/bin/native-image -H:+UnlockExperimentalVMOptions -H:-CheckToolchain -H:+ReportExceptionStackTraces -march=compatibility HelloWorld
      ./helloworld | fgrep 'Hello World'

      ${# -H:+StaticExecutableWithDynamicLibC is only available in Linux
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@ -9,11 +9,11 @@
 let
  babashka-unwrapped = buildGraalvmNativeImage rec {
    pname = "babashka-unwrapped";
-    version = "1.4.192";
+    version = "1.12.194";

    src = fetchurl {
      url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-uVRk1/lfOXMSp3qOdeMoAFpwJaEBxF1MYtFOv364H7Y=";
+      sha256 = "sha256-Dx3AANMpmCPH8Zaz8/9FRNRRhcEPnZHXQje47udwwRQ=";
    };

    graalvmDrv = graalvmCEPackages.graalvm-ce;
@ -37,6 +37,7 @@ let
      $out/bin/bb '(vec (dedupe *input*))' <<< '[1 1 1 1 2]' | fgrep '[1 2]'
      $out/bin/bb '(prn "bépo àê")' | fgrep 'bépo àê'
      $out/bin/bb '(:out (babashka.process/sh "echo" "ä"))' | fgrep 'ä'
+      $out/bin/bb '(into-array [:f])'
    '';

    postInstall = ''
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@ -21,10 +21,13 @@ let
      })
      # Backport of PHP_LIBXML_IGNORE_DEPRECATIONS_START and PHP_LIBXML_IGNORE_DEPRECATIONS_END
      # Required for libxml2 2.13 compatibility patch.
-      ./php81-fix-libxml2-2.13-compatibility.patch
+      (fetchpatch {
+        url = "https://github.com/php/php-src/commit/e2d97314ab342d434e778cd00a2f34e4bdb07664.patch";
+        hash = "sha256-w0hyYUgbRGpvIBfWeDTSEUGpiJdyrtNjKy+Fn1vyAO0=";
+      })
      # Fix build with libxml2 2.13+. Has to be applied after libxml2 2.12 patch.
      (fetchpatch {
-        url = "https://github.com/php/php-src/commit/9b4f6b09d58a4e54ee60443bf9a8b166852c03e0.patch";
+        url = "https://github.com/php/php-src/commit/4fe821311cafb18ca8bdf20b9d796c48a13ba552.patch";
        hash = "sha256-YC3I0BQi3o3+VmRu/UqpqPpaSC+ekPqzbORTHftbPvY=";
      })
    ];
--- a/pkgs/development/interpreters/php/php81-fix-libxml2-2.13-compatibility.patch
+++ b/pkgs/development/interpreters/php/php81-fix-libxml2-2.13-compatibility.patch
@ -1,28 +0,0 @@
-diff --git a/ext/libxml/php_libxml.h b/ext/libxml/php_libxml.h
-index a1011f0b17..7a7622c482 100644
--- a/ext/libxml/php_libxml.h
-+++ b/ext/libxml/php_libxml.h
-@@ -119,6 +119,23 @@ PHP_LIBXML_API void php_libxml_shutdown(void);
- ZEND_TSRMLS_CACHE_EXTERN()
- #endif
- 
-+#if defined(__clang__)
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_START \
-+	_Pragma("clang diagnostic push") \
-+	_Pragma("clang diagnostic ignored \"-Wdeprecated-declarations\"")
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_END \
-+	_Pragma("clang diagnostic pop")
-+#elif defined(__GNUC__)
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_START \
-+	_Pragma("GCC diagnostic push") \
-+	_Pragma("GCC diagnostic ignored \"-Wdeprecated-declarations\"")
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_END \
-+	_Pragma("GCC diagnostic pop")
-+#else
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_START
-+# define PHP_LIBXML_IGNORE_DEPRECATIONS_END
-+#endif
-+
- /* Other extension may override the global state options, these global options
-  * are copied initially to ctxt->options. Set the options to a known good value.
-  * See libxml2 globals.c and parserInternals.c.
--- a/pkgs/development/libraries/libconfig/default.nix
+++ b/pkgs/development/libraries/libconfig/default.nix
@ -1,32 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, # this also disables building tests.
-  # on static windows cross-compile they fail to build
-  doCheck ? with stdenv.hostPlatform; !(isWindows && isStatic)
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libconfig";
-  version = "1.7.3";
-
-  src = fetchurl {
-    url = "https://hyperrealm.github.io/${pname}/dist/${pname}-${version}.tar.gz";
-    sha256 = "sha256-VFFm1srAN3RDgdHpzFpUBQlOe/rRakEWmbz/QLuzHuc=";
-  };
-
-  inherit doCheck;
-
-  configureFlags = lib.optional (stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isStatic) "--disable-examples"
-    ++ lib.optional (!doCheck) "--disable-tests";
-
-  cmakeFlags = lib.optionals (!doCheck) [ "-DBUILD_TESTS:BOOL=OFF" ];
-
-  meta = with lib; {
-    homepage = "http://www.hyperrealm.com/libconfig";
-    description = "Simple library for processing structured configuration files";
-    license = licenses.lgpl3;
-    maintainers = [ ];
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/development/libraries/libieee1284/default.nix
+++ b/pkgs/development/libraries/libieee1284/default.nix
@ -32,6 +32,11 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--without-python"
+  ] ++ lib.optionals (stdenv.hostPlatform.isMusl && !stdenv.hostPlatform.isx86) [
+    # musl always provides <sys/io.h>, even though the functionality
+    # is x86-specific.
+    # https://www.openwall.com/lists/musl/2024/10/25/2
+    "ac_cv_header_sys_io_h=no"
  ];

  prePatch = ''
--- a/Show More
+++ b/Show More