Merge staging-next into staging

2024-11-21 14:32:59 +00:00 · 2024-11-05 00:14:28 +00:00 · 2024-11-05 00:14:28 +00:00 · e953c01873
commit e953c01873
parent b15dd30144 2b84944850
87 changed files with 4930 additions and 3538 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -313,6 +313,7 @@ Container system, boot system and library changes are some examples of the pull

 To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:

+- the PR author should be @r-ryantm;
 - the commenter that issued the command should be among the package maintainers;
 - the package should reside in `pkgs/by-name`.

--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -226,10 +226,10 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel

 # PostgreSQL and related stuff
-/pkgs/servers/sql/postgresql @thoughtpolice
-/nixos/modules/services/databases/postgresql.md @thoughtpolice
-/nixos/modules/services/databases/postgresql.nix @thoughtpolice
-/nixos/tests/postgresql.nix @thoughtpolice
+/pkgs/servers/sql/postgresql @NixOS/postgres
+/nixos/modules/services/databases/postgresql.md @NixOS/postgres
+/nixos/modules/services/databases/postgresql.nix @NixOS/postgres
+/nixos/tests/postgresql.nix @NixOS/postgres

 # Hardened profile & related modules
 /nixos/modules/profiles/hardened.nix @joachifm
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -846,9 +846,14 @@ with lib.maintainers;
  };

  postgres = {
-    members = [ thoughtpolice ];
+    members = [
+      thoughtpolice
+      ma27
+      wolfgangwalther
+    ];
    scope = "Maintain the PostgreSQL package and plugins along with the NixOS module.";
    shortName = "PostgreSQL";
+    enableFeatureFreezePing = true;
  };

  python = {
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -575,6 +575,11 @@

 - `/share/vim-plugins` now only gets linked if `programs.vim.enable` is enabled

+- The `services.guix` module now manages trusted substitute servers
+  declaratively. Instead of `guix archive --authorize`, list keys with
+  `services.guix.substituters.authorizedKeys`. Default substitute servers can be
+  set via `services.guix.substituters.urls`.
+
 - The `tracy` package no longer works on X11, since it's moved to Wayland
  support, which is the intended default behavior by Tracy maintainers.
  X11 users have to switch to the new package `tracy-x11`.
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@ -6,17 +6,21 @@ let
  cfg = config.services.home-assistant;
  format = pkgs.formats.yaml {};

-  # Render config attribute sets to YAML
-  # Values that are null will be filtered from the output, so this is one way to have optional
-  # options shown in settings.
-  # We post-process the result to add support for YAML functions, like secrets or includes, see e.g.
+  # Post-process YAML output to add support for YAML functions, like
+  # secrets or includes, by naively unquoting strings with leading bangs
+  # and at least one space-separated parameter.
  # https://www.home-assistant.io/docs/configuration/secrets/
-  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ null ])) (lib.recursiveUpdate customLovelaceModulesResources (cfg.config or {}));
-  configFile = pkgs.runCommandLocal "configuration.yaml" { } ''
-    cp ${format.generate "configuration.yaml" filteredConfig} $out
+  renderYAMLFile = fn: yaml: pkgs.runCommandLocal fn { } ''
+    cp ${format.generate fn yaml} $out
    sed -i -e "s/'\!\([a-z_]\+\) \(.*\)'/\!\1 \2/;s/^\!\!/\!/;" $out
  '';
-  lovelaceConfigFile = format.generate "ui-lovelace.yaml" cfg.lovelaceConfig;
+
+  # Filter null values from the configuration, so that we can still advertise
+  # optional options in the config attribute.
+  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ null ])) (lib.recursiveUpdate customLovelaceModulesResources (cfg.config or {}));
+  configFile = renderYAMLFile "configuration.yaml" filteredConfig;
+
+  lovelaceConfigFile = renderYAMLFile "ui-lovelace.yaml" cfg.lovelaceConfig;

  # Components advertised by the home-assistant package
  availableComponents = cfg.package.availableComponents;
--- a/nixos/modules/services/misc/guix/default.nix
+++ b/nixos/modules/services/misc/guix/default.nix
@ -46,6 +46,17 @@ let
    GUIX_LOCPATH = "${cfg.stateDir}/guix/profiles/per-user/root/guix-profile/lib/locale";
    LC_ALL = "C.UTF-8";
  };
+
+  # Currently, this is just done the lazy way with the official Guix script. A
+  # more "formal" way would be creating our own Guix script to handle and
+  # generate the ACL file ourselves.
+  aclFile = pkgs.runCommandLocal "guix-acl" { } ''
+    export GUIX_CONFIGURATION_DIRECTORY=./
+    for official_server_keys in ${lib.concatStringsSep " " cfg.substituters.authorizedKeys}; do
+      ${lib.getExe' cfg.package "guix"} archive --authorize < "$official_server_keys"
+    done
+    install -Dm0600 ./acl "$out"
+  '';
 in
 {
  meta.maintainers = with lib.maintainers; [ foo-dogsquared ];
@ -118,6 +129,57 @@ in
      example = "/gnu/var";
    };

+    substituters = {
+      urls = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [
+          "https://ci.guix.gnu.org"
+          "https://bordeaux.guix.gnu.org"
+          "https://berlin.guix.gnu.org"
+        ];
+        example = lib.literalExpression ''
+          options.services.guix.substituters.urls.default ++ [
+            "https://guix.example.com"
+            "https://guix.example.org"
+          ]
+        '';
+        description = ''
+          A list of substitute servers' URLs for the Guix daemon to download
+          substitutes from.
+        '';
+      };
+
+      authorizedKeys = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [
+          "${cfg.package}/share/guix/ci.guix.gnu.org.pub"
+          "${cfg.package}/share/guix/bordeaux.guix.gnu.org.pub"
+          "${cfg.package}/share/guix/berlin.guix.gnu.org.pub"
+        ];
+        defaultText = ''
+          The packaged signing keys from {option}`services.guix.package`.
+        '';
+        example = lib.literalExpression ''
+          options.services.guix.substituters.authorizedKeys.default ++ [
+            (builtins.fetchurl {
+              url = "https://guix.example.com/signing-key.pub";
+            })
+
+            (builtins.fetchurl {
+              url = "https://guix.example.org/static/signing-key.pub";
+            })
+          ]
+        '';
+        description = ''
+          A list of signing keys for each substitute server to be authorized as
+          a source of substitutes. Without this, the listed substitute servers
+          from {option}`services.guix.substituters.urls` would be ignored [with
+          some
+          exceptions](https://guix.gnu.org/manual/en/html_node/Substitute-Authentication.html).
+        '';
+      };
+    };
+
    publish = {
      enable = mkEnableOption "substitute server for your Guix store directory";

@ -215,6 +277,8 @@ in
        script = ''
          ${lib.getExe' package "guix-daemon"} \
            --build-users-group=${cfg.group} \
+            ${lib.optionalString (cfg.substituters.urls != [ ])
+              "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"} \
            ${lib.escapeShellArgs cfg.extraArgs}
        '';
        serviceConfig = {
@ -254,11 +318,7 @@ in

      # Make transferring files from one store to another easier with the usual
      # case being of most substitutes from the official Guix CI instance.
-      system.activationScripts.guix-authorize-keys = ''
-        for official_server_keys in ${package}/share/guix/*.pub; do
-          ${lib.getExe' package "guix"} archive --authorize < $official_server_keys
-        done
-      '';
+      environment.etc."guix/acl".source = aclFile;

      # Link the usual Guix profiles to the home directory. This is useful in
      # ephemeral setups where only certain part of the filesystem is
@ -270,8 +330,8 @@ in
        in ''
          [ -d "${userProfile}" ] && ln -sfn "${userProfile}" "${location}"
        '';
-        linkProfileToPath = acc: profile: location: let
-          in acc + (linkProfile profile location);
+        linkProfileToPath = acc: profile: location:
+          acc + (linkProfile profile location);

        # This should contain export-only Guix user profiles. The rest of it is
        # handled manually in the activation script.
@ -387,7 +447,7 @@ in
          Type = "oneshot";

          PrivateDevices = true;
-          PrivateNetworks = true;
+          PrivateNetwork = true;
          ProtectControlGroups = true;
          ProtectHostname = true;
          ProtectKernelTunables = true;
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@ -331,7 +331,7 @@ in {
      APP_CONFIG_CACHE = "/run/snipe-it/cache/config.php";
      APP_ROUTES_CACHE = "/run/snipe-it/cache/routes-v7.php";
      APP_EVENTS_CACHE = "/run/snipe-it/cache/events.php";
-      SESSION_SECURE_COOKIE = tlsEnabled;
+      SECURE_COOKIES = tlsEnabled;
    };

    services.mysql = mkIf db.createLocally {
--- a/nixos/tests/guix/publish.nix
+++ b/nixos/tests/guix/publish.nix
@ -47,12 +47,12 @@ in {
      services.guix = {
        enable = true;

-        extraArgs = [
-          # Force to only get all substitutes from the local server. We don't
-          # have anything in the Guix store directory and we cannot get
-          # anything from the official substitute servers anyways.
-          "--substitute-urls='http://server.local:${toString publishPort}'"
+        # Force to only get all substitutes from the local server. We don't
+        # have anything in the Guix store directory and we cannot get
+        # anything from the official substitute servers anyways.
+        substituters.urls = [ "http://server.local:${toString publishPort}" ];

+        extraArgs = [
          # Enable autodiscovery of the substitute servers in the local
          # network. This machine shouldn't need to import the signing key from
          # the substitute server since it is automatically done anyways.
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -4531,8 +4531,8 @@ let
        mktplcRef = {
          name = "code-spell-checker";
          publisher = "streetsidesoftware";
-          version = "4.0.7";
-          hash = "sha256-y+xD8rOa/ljavAF7tdEpaOKEd4gUzfH15WBwMHyW7z4=";
+          version = "4.0.14";
+          hash = "sha256-b87sBCprMMfxsP8lyMM3yI82YvKZd5Jc+Z/x7uflnL0=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "24.10.3";
-  sha256 = "1xsimk3kjniy59sw56q52cmnpg1vb1l1zbaj6nrj44pl57vkp9cp";
-  vendorHash = "sha256-JVXhZjUdU1CrWzrh7INhAd3kRP/tcdsYzlre9SB9gOQ=";
+  version = "24.10.4";
+  sha256 = "0n1fcl2mi3q3g44bd5x7wgnx91769051dwaxmvc4yapkbsbwnr6g";
+  vendorHash = "sha256-AGFuNFwZjWnu+FcXGpTxDQysgSGmYbfEtERaGjCOnUA=";
 }
--- a/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@ -21,25 +21,26 @@
 , wrapGAppsHook4
 , sqlite
 , xdg-desktop-portal
+, libseccomp
 }:

 stdenv.mkDerivation rec {
  pname = "fractal";
-  version = "8";
+  version = "9";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "fractal";
    rev = "refs/tags/${version}";
-    hash = "sha256-a77+lPH2eqWTLFrYfcBXSvbyyYC52zSo+Rh/diqKYx4=";
+    hash = "sha256-3UI727LUYw7wUKbGRCtgpkF9NNw4XuZ3tl3KV3Ku9r4=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "matrix-sdk-0.7.1" = "sha256-ZlkxGXGrmZ8VQV7UY7A7BBfcqFCAB9Ep7l65irx4Dy8=";
-      "ruma-0.10.1" = "sha256-C/GJ0hDWJ9/grfjMuPSatJq2SrVkV0jxQlAAASkUWqg=";
+      "matrix-sdk-0.7.1" = "sha256-AmODDuNLpI6gXuu+oPl3MqcOnywqR8lqJ0bVOIiz02E=";
+      "ruma-0.10.1" = "sha256-6U2LKMYyY7SLOh2jJcVuDBsfcidNoia1XU+JsmhMHGY=";
    };
  };

@ -68,6 +69,7 @@ stdenv.mkDerivation rec {
    libshumate
    sqlite
    xdg-desktop-portal
+    libseccomp
  ] ++ (with gst_all_1; [
    gstreamer
    gst-plugins-base
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@ -1,22 +1,17 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, callPackage
-, libsForQt5
-, yasm
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  libsForQt5,
+  yasm,
+  withWebkit ? true,
 }:

 let
+  telegram-desktop = libsForQt5.callPackage ../telegram-desktop { inherit stdenv; };
  version = "1.4.9";
-in
-(libsForQt5.callPackage ../telegram-desktop/default.nix {
-  inherit stdenv;
-
-  tg_owt = (callPackage ../telegram-desktop/tg_owt.nix {
-    # tg_owt should use the same compiler
-    inherit stdenv;
-  }).overrideAttrs(oldAttrs: {
+  tg_owt = telegram-desktop.tg_owt.overrideAttrs (oldAttrs: {
    version = "0-unstable-2024-06-15";

    src = fetchFromGitHub {
@ -27,7 +22,7 @@ in
      fetchSubmodules = true;
    };

-    patches = (oldAttrs.patches or []) ++ [
+    patches = (oldAttrs.patches or [ ]) ++ [
      (fetchpatch {
        url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
        decode = "base64 -d";
@ -39,42 +34,45 @@ in

    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
  });
-
-  withWebKitGTK = false;
-}).overrideAttrs {
+in
+telegram-desktop.override {
  pname = "kotatogram-desktop";
-  version = "${version}-unstable-2024-09-27";
+  inherit withWebkit;
+  unwrapped = (telegram-desktop.unwrapped.override { inherit tg_owt; }).overrideAttrs {
+    pname = "kotatogram-desktop-unwrapped";
+    version = "${version}-unstable-2024-09-27";

-  src = fetchFromGitHub {
-    owner = "kotatogram";
-    repo = "kotatogram-desktop";
-    rev = "0581eb6219343b3cfcbb81124b372df1039b7568";
-    hash = "sha256-rvn8GZmHdMkVutLUe/LmUNIawlb9VgU3sYhPwZ2MWsI=";
-    fetchSubmodules = true;
-  };
+    src = fetchFromGitHub {
+      owner = "kotatogram";
+      repo = "kotatogram-desktop";
+      rev = "0581eb6219343b3cfcbb81124b372df1039b7568";
+      hash = "sha256-rvn8GZmHdMkVutLUe/LmUNIawlb9VgU3sYhPwZ2MWsI=";
+      fetchSubmodules = true;
+    };

-  patches = [
-    ./macos-qt5.patch
-    (fetchpatch {
-      url = "https://gitlab.com/mnauw/cppgir/-/commit/c8bb1c6017a6f7f2e47bd10543aea6b3ec69a966.patch";
-      stripLen = 1;
-      extraPrefix = "cmake/external/glib/cppgir/";
-      hash = "sha256-8B4h3BTG8dIlt3+uVgBI569E9eCebcor9uohtsrZpnI=";
-    })
-  ];
+    patches = [
+      ./macos-qt5.patch
+      (fetchpatch {
+        url = "https://gitlab.com/mnauw/cppgir/-/commit/c8bb1c6017a6f7f2e47bd10543aea6b3ec69a966.patch";
+        stripLen = 1;
+        extraPrefix = "cmake/external/glib/cppgir/";
+        hash = "sha256-8B4h3BTG8dIlt3+uVgBI569E9eCebcor9uohtsrZpnI=";
+      })
+    ];

-  meta = with lib; {
-    description = "Kotatogram – experimental Telegram Desktop fork";
-    longDescription = ''
-      Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.
+    meta = with lib; {
+      description = "Kotatogram – experimental Telegram Desktop fork";
+      longDescription = ''
+        Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.

-      It contains some useful (or purely cosmetic) features, but they could be unstable. A detailed list is available here: https://kotatogram.github.io/changes
-    '';
-    license = licenses.gpl3Only;
-    platforms = platforms.all;
-    homepage = "https://kotatogram.github.io";
-    changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k${version}";
-    maintainers = with maintainers; [ ilya-fedin ];
-    mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
+        It contains some useful (or purely cosmetic) features, but they could be unstable. A detailed list is available here: https://kotatogram.github.io/changes
+      '';
+      license = licenses.gpl3Only;
+      platforms = platforms.all;
+      homepage = "https://kotatogram.github.io";
+      changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k${version}";
+      maintainers = with maintainers; [ ilya-fedin ];
+      mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
+    };
  };
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix
@ -1,23 +0,0 @@
-{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_4_1, makeBinaryWrapper }:
-
-stdenv.mkDerivation {
-  pname = "${kotatogram-desktop.pname}-with-webkit";
-  version = kotatogram-desktop.version;
-  nativeBuildInputs = [ makeBinaryWrapper ];
-  dontUnpack = true;
-  installPhase = ''
-    mkdir -p $out
-    cp -r ${kotatogram-desktop}/share $out
-    substituteInPlace $out/share/dbus-1/services/* --replace-fail ${kotatogram-desktop} $out
-  '';
-  postFixup = ''
-    mkdir -p $out/bin
-    makeBinaryWrapper {${kotatogram-desktop},$out}/bin/${kotatogram-desktop.meta.mainProgram} \
-      --inherit-argv0 \
-      --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_4_1 ]}
-  '';
-  meta = kotatogram-desktop.meta // {
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -1,169 +1,73 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, callPackage
-, pkg-config
-, cmake
-, ninja
-, clang
-, python3
-, wrapQtAppsHook
-, tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; }
-, qtbase
-, qtimageformats
-, qtsvg
-, qtwayland
-, kcoreaddons
-, lz4
-, xxHash
-, ffmpeg
-, protobuf
-, openalSoft
-, minizip
-, libopus
-, alsa-lib
-, libpulseaudio
-, range-v3
-, tl-expected
-, hunspell
-, gobject-introspection
-, jemalloc
-, rnnoise
-, microsoft-gsl
-, boost
-, ada
-, withWebKitGTK ? true
-, wrapGAppsHook3
-, glib-networking
-, webkitgtk_4_1
-, libicns
-, apple-sdk_15
-, nix-update-script
+{
+  callPackage,
+  lib,
+  stdenv,
+  pname ? "telegram-desktop",
+  unwrapped ? callPackage ./unwrapped.nix { inherit stdenv; },
+  qtbase,
+  qtimageformats,
+  qtsvg,
+  qtwayland,
+  wrapGAppsHook3,
+  wrapQtAppsHook,
+  glib-networking,
+  webkitgtk_4_1,
+  withWebkit ? true,
 }:
-
-# Main reference:
-# - This package was originally based on the Arch package but all patches are now upstreamed:
-#   https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/telegram-desktop
-# Other references that could be useful:
-# - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
-# - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
-
 stdenv.mkDerivation (finalAttrs: {
-  pname = "telegram-desktop";
-  version = "5.6.3";
+  inherit pname;
+  inherit (unwrapped) version meta passthru;

-  src = fetchFromGitHub {
-    owner = "telegramdesktop";
-    repo = "tdesktop";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-frz425V5eRulNVxCf457TWQAzU/f9/szD/sx3/LYQ2Y=";
-  };
+  inherit unwrapped;

-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
-      --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
-  '' + lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
-    substituteInPlace Telegram/lib_webview/webview/platform/linux/webview_linux_webkitgtk_library.cpp \
-      --replace-fail '"libwebkit2gtk-4.1.so.0"' '"${webkitgtk_4_1}/lib/libwebkit2gtk-4.1.so.0"'
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
-      --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
-  '';
+  nativeBuildInputs =
+    [
+      wrapQtAppsHook
+    ]
+    ++ lib.optionals withWebkit [
+      wrapGAppsHook3
+    ];

-  # Avoid double-wrapping
+  buildInputs =
+    [
+      qtbase
+      qtimageformats
+      qtsvg
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      qtwayland
+    ]
+    ++ lib.optionals withWebkit [
+      glib-networking
+    ];
+
+  qtWrapperArgs = lib.optionals (stdenv.hostPlatform.isLinux && withWebkit) [
+    "--prefix"
+    "LD_LIBRARY_PATH"
+    ":"
+    (lib.makeLibraryPath [ webkitgtk_4_1 ])
+  ];
+
+  dontUnpack = true;
  dontWrapGApps = true;
-
-  # Wrapping the inside of the app bundles, avoiding double-wrapping
  dontWrapQtApps = stdenv.hostPlatform.isDarwin;

-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    ninja
-    python3
-    wrapQtAppsHook
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    # to build bundled libdispatch
-    clang
-    gobject-introspection
-  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    qtbase
-    qtimageformats
-    qtsvg
-    lz4
-    xxHash
-    ffmpeg
-    openalSoft
-    minizip
-    libopus
-    range-v3
-    tl-expected
-    rnnoise
-    tg_owt
-    microsoft-gsl
-    boost
-    ada
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    protobuf
-    qtwayland
-    kcoreaddons
-    alsa-lib
-    libpulseaudio
-    hunspell
-    jemalloc
-  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
-    glib-networking
-    webkitgtk_4_1
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_15
-    libicns
-  ];
-
-  cmakeFlags = [
-    # We're allowed to used the API ID of the Snap package:
-    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
-    (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
-  ];
-
-  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
-    ln -s $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
+  installPhase = ''
+    runHook preInstall
+    cp -r "$unwrapped" "$out"
+    runHook postInstall
  '';

-  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
+  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebkit) ''
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    wrapQtApp $out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}
-  '';
-
-  passthru = {
-    inherit tg_owt;
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Telegram Desktop messaging app";
-    longDescription = ''
-      Desktop client for the Telegram messenger, based on the Telegram API and
-      the MTProto secure protocol.
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      wrapQtApp "$out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}"
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace $out/share/dbus-1/services/* \
+        --replace-fail "$unwrapped" "$out"
    '';
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
-    homepage = "https://desktop.telegram.org/";
-    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ nickcao ];
-    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
-  };
 })
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
@ -9,7 +9,7 @@
  libjpeg,
  openssl,
  libopus,
-  ffmpeg,
+  ffmpeg_6,
  openh264,
  crc32c,
  libvpx,
@ -68,7 +68,7 @@ stdenv.mkDerivation {
      libjpeg
      openssl
      libopus
-      ffmpeg
+      ffmpeg_6
      openh264
      crc32c
      libvpx
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@ -0,0 +1,150 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  callPackage,
+  pkg-config,
+  cmake,
+  ninja,
+  clang,
+  python3,
+  tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; },
+  qtbase,
+  qtimageformats,
+  qtsvg,
+  qtwayland,
+  kcoreaddons,
+  lz4,
+  xxHash,
+  ffmpeg_6,
+  protobuf,
+  openalSoft,
+  minizip,
+  libopus,
+  alsa-lib,
+  libpulseaudio,
+  range-v3,
+  tl-expected,
+  hunspell,
+  gobject-introspection,
+  jemalloc,
+  rnnoise,
+  microsoft-gsl,
+  boost,
+  ada,
+  libicns,
+  apple-sdk_15,
+  nix-update-script,
+}:
+
+# Main reference:
+# - This package was originally based on the Arch package but all patches are now upstreamed:
+#   https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/telegram-desktop
+# Other references that could be useful:
+# - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
+# - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "telegram-desktop-unwrapped";
+  version = "5.7.1";
+
+  src = fetchFromGitHub {
+    owner = "telegramdesktop";
+    repo = "tdesktop";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-MPVm9WfAjF11sy0hyhDTI/mM2OsENSMavnVrOwXTGUk=";
+  };
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
+      --replace-fail '"libasound.so.2"' '"${lib.getLib alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
+      --replace-fail '"libasound.so.2"' '"${lib.getLib alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
+      --replace-fail '"libpulse.so.0"' '"${lib.getLib libpulseaudio}/lib/libpulse.so.0"'
+  '';
+
+  nativeBuildInputs =
+    [
+      pkg-config
+      cmake
+      ninja
+      python3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # to build bundled libdispatch
+      clang
+      gobject-introspection
+    ];
+
+  buildInputs =
+    [
+      qtbase
+      qtimageformats
+      qtsvg
+      lz4
+      xxHash
+      ffmpeg_6
+      openalSoft
+      minizip
+      libopus
+      range-v3
+      tl-expected
+      rnnoise
+      tg_owt
+      microsoft-gsl
+      boost
+      ada
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      protobuf
+      qtwayland
+      kcoreaddons
+      alsa-lib
+      libpulseaudio
+      hunspell
+      jemalloc
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_15
+      libicns
+    ];
+
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    # We're allowed to used the API ID of the Snap package:
+    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
+    (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
+  ];
+
+  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
+    ln -sr $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit tg_owt;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Telegram Desktop messaging app";
+    longDescription = ''
+      Desktop client for the Telegram messenger, based on the Telegram API and
+      the MTProto secure protocol.
+    '';
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+    homepage = "https://desktop.telegram.org/";
+    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ nickcao ];
+    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
+  };
+})
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@ -113,6 +113,10 @@ stdenv.mkDerivation (finalAttrs: {
      cmake/FindUtfCpp.cmake
    # Upstream uses different config file name.
    substituteInPlace CMakeLists.txt --replace 'find_package(UtfCpp)' 'find_package(utf8cpp)'
+
+    # Use gettext even on Darwin
+    substituteInPlace libtransmission/utils.h \
+      --replace-fail '#if defined(HAVE_GETTEXT) && !defined(__APPLE__)' '#if defined(HAVE_GETTEXT)'
  '';

  nativeBuildInputs = [
@ -145,8 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals enableQt6 (with qt6Packages; [ qttools qtbase qtsvg ])
  ++ optionals enableGTK3 [ gtkmm3 xorg.libpthreadstubs ]
  ++ optionals enableSystemd [ systemd ]
-  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ]
-  ++ optionals stdenv.hostPlatform.isDarwin [ libiconv Foundation ];
+  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ];

  postInstall = ''
    mkdir $apparmor
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -21,14 +21,7 @@
 , wayland
 , xdg-utils

-  # Darwin Frameworks
-, AppKit
-, CoreGraphics
-, CoreServices
-, CoreText
-, Foundation
-, libiconv
-, OpenGL
+, apple-sdk_11
 }:
 let
  rpathLibs = [
@ -72,13 +65,7 @@ rustPlatform.buildRustPackage rec {

  buildInputs = rpathLibs
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreGraphics
-    CoreServices
-    CoreText
-    Foundation
-    libiconv
-    OpenGL
+    apple-sdk_11
  ];

  outputs = [ "out" "terminfo" ];
--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-move-transition";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-move-transition";
    rev = version;
-    sha256 = "sha256-ZmxopTv6YuAZ/GykvMRcP2PQwQk08ObmqZ9kBcR0UH4=";
+    sha256 = "sha256-kCiRgfpcFdxoK6e8jtrtzkBD4w5B/ilO1YyBHCG13gg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/video/wf-recorder/default.nix
+++ b/pkgs/applications/video/wf-recorder/default.nix
@ -14,6 +14,7 @@
  libpulseaudio,
  pipewire,
  mesa, # for libgbm
+  fetchpatch,
 }:

 stdenv.mkDerivation rec {
@ -27,6 +28,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-7/fQOkfAw5v3irD5blJOdq88j0VBrPVQQufdt9wsACk=";
  };

+  patches = [
+    # compile fixes from upstream, remove when they stop applying
+    (fetchpatch {
+      url = "https://github.com/ammen99/wf-recorder/commit/560bb92d3ddaeb31d7af77d22d01b0050b45bebe.diff";
+      sha256 = "sha256-7jbX5k8dh4dWfolMkZXiERuM72zVrkarsamXnd+1YoI=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-buildx";
-  version = "0.17.1";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "buildx";
    rev = "v${version}";
-    hash = "sha256-+d0yaosNoOOuo/A7aC6pfy2xGJU718nBBNMMok2Ofv0=";
+    hash = "sha256-mw66AF+JwavuB8r2qzo50rguqZaUfzCVmyYI6yk7ig8=";
  };

  doCheck = false;
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@ -33,18 +33,15 @@
 # follows:
 # /lib32 will include 32bit libraries from multiPkgs
 # /lib64 will include 64bit libraries from multiPkgs and targetPkgs
-# /lib will link to /lib32
+# /lib will link to /lib64

 let
-  inherit (stdenv.hostPlatform) is64bit;
-
  name = if (args ? pname && args ? version)
    then "${args.pname}-${args.version}"
    else args.name;

  # "use of glibc_multi is only supported on x86_64-linux"
  isMultiBuild = multiArch && stdenv.system == "x86_64-linux";
-  isTargetBuild = !isMultiBuild;

  # list of packages (usually programs) which match the host's architecture
  # (which includes stuff from multiPkgs)
@ -60,7 +57,7 @@ let
  baseTargetPaths = with pkgs; [
    glibcLocales
    (if isMultiBuild then glibc_multi else glibc)
-    (toString gcc.cc.lib)
+    gcc.cc.lib
    bashInteractiveFHS
    coreutils
    less
@ -77,7 +74,7 @@ let
    xz
  ];
  baseMultiPaths = with pkgsi686Linux; [
-    (toString gcc.cc.lib)
+    gcc.cc.lib
  ];

  ldconfig = writeShellScriptBin "ldconfig" ''
@ -85,190 +82,139 @@ let
    exec ${if isMultiBuild then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
  '';

-  etcProfile = writeText "profile" ''
-    export PS1='${name}-fhsenv:\u@\h:\w\$ '
-    export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
-    export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
-    export TZDIR='/etc/zoneinfo'
+  etcProfile = pkgs.writeTextFile {
+    name = "${name}-fhsenv-profile";
+    destination = "/etc/profile";
+    text = ''
+      export PS1='${name}-fhsenv:\u@\h:\w\$ '
+      export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
+      export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
+      export TZDIR='/etc/zoneinfo'

-    # XDG_DATA_DIRS is used by pressure-vessel (steam proton) and vulkan loaders to find the corresponding icd
-    export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share
+      # XDG_DATA_DIRS is used by pressure-vessel (steam proton) and vulkan loaders to find the corresponding icd
+      export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share

-    # Following XDG spec [1], XDG_DATA_DIRS should default to "/usr/local/share:/usr/share".
-    # In nix, it is commonly set without containing these values, so we add them as fallback.
-    #
-    # [1] <https://specifications.freedesktop.org/basedir-spec/latest>
-    case ":$XDG_DATA_DIRS:" in
-      *:/usr/local/share:*) ;;
-      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/local/share" ;;
-    esac
-    case ":$XDG_DATA_DIRS:" in
-      *:/usr/share:*) ;;
-      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/share" ;;
-    esac
+      # Following XDG spec [1], XDG_DATA_DIRS should default to "/usr/local/share:/usr/share".
+      # In nix, it is commonly set without containing these values, so we add them as fallback.
+      #
+      # [1] <https://specifications.freedesktop.org/basedir-spec/latest>
+      case ":$XDG_DATA_DIRS:" in
+        *:/usr/local/share:*) ;;
+        *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/local/share" ;;
+      esac
+      case ":$XDG_DATA_DIRS:" in
+        *:/usr/share:*) ;;
+        *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/share" ;;
+      esac

-    # Force compilers and other tools to look in default search paths
-    unset NIX_ENFORCE_PURITY
-    export NIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
-    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
-    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
-    export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
-    export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
-    export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-    export ACLOCAL_PATH=/usr/share/aclocal
+      # Force compilers and other tools to look in default search paths
+      unset NIX_ENFORCE_PURITY
+      export NIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
+      export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
+      export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
+      export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
+      export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
+      export PKG_CONFIG_PATH=/usr/lib/pkgconfig
+      export ACLOCAL_PATH=/usr/share/aclocal

-    # GStreamer searches for plugins relative to its real binary's location
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bd97973ce0f2c5495bcda5cccd4f7ef7dcb7febc
-    export GST_PLUGIN_SYSTEM_PATH_1_0=/usr/lib/gstreamer-1.0:/usr/lib32/gstreamer-1.0
+      # GStreamer searches for plugins relative to its real binary's location
+      # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bd97973ce0f2c5495bcda5cccd4f7ef7dcb7febc
+      export GST_PLUGIN_SYSTEM_PATH_1_0=/usr/lib/gstreamer-1.0:/usr/lib32/gstreamer-1.0

-    ${profile}
+      ${profile}
+    '';
+  };
+
+  ensureGsettingsSchemasIsDirectory = runCommandLocal "fhsenv-ensure-gsettings-schemas-directory" {} ''
+    mkdir -p $out/share/glib-2.0/schemas
+    touch $out/share/glib-2.0/schemas/.keep
  '';

-  # Compose /etc for the fhs environment
-  etcPkg = runCommandLocal "${name}-fhs-etc" { } ''
-    mkdir -p $out/etc
-    pushd $out/etc
+  # Shamelessly stolen (and cleaned up) from original buildEnv.
+  # Should be semantically equivalent, except we also take
+  # a list of default extra outputs that will be installed
+  # for derivations that don't explicitly specify one.
+  # Note that this is not the same as `extraOutputsToInstall`,
+  # as that will apply even to derivations with an output
+  # explicitly specified, so this does change the behavior
+  # very slightly for that particular edge case.
+  pickOutputs = let
+    pickOutputsOne = outputs: drv:
+      let
+        isSpecifiedOutput = drv.outputSpecified or false;
+        outputsToInstall = drv.meta.outputsToInstall or null;
+        pickedOutputs = if isSpecifiedOutput || outputsToInstall == null
+          then [ drv ]
+          else map (out: drv.${out} or null) (outputsToInstall ++ outputs);
+        extraOutputs = map (out: drv.${out} or null) extraOutputsToInstall;
+        cleanOutputs = lib.filter (o: o != null) (pickedOutputs ++ extraOutputs);
+      in {
+        paths = cleanOutputs;
+        priority = drv.meta.priority or lib.meta.defaultPriority;
+      };
+  in paths: outputs: map (pickOutputsOne outputs) paths;

-    # environment variables
-    ln -s ${etcProfile} profile
+  paths = let
+    basePaths = [
+      etcProfile
+      # ldconfig wrapper must come first so it overrides the original ldconfig
+      ldconfig
+      # magic package that just creates a directory, to ensure that
+      # the entire directory can't be a symlink, as we will write
+      # compiled schemas to it
+      ensureGsettingsSchemasIsDirectory
+    ] ++ baseTargetPaths ++ targetPaths;
+  in pickOutputs basePaths ["out" "lib" "bin"];
+
+  paths32 = lib.optionals isMultiBuild (
+    let
+      basePaths = baseMultiPaths ++ multiPaths;
+    in pickOutputs basePaths ["out" "lib"]
+  );
+
+  allPaths = paths ++ paths32;
+
+  rootfs-builder = pkgs.rustPlatform.buildRustPackage {
+    name = "fhs-rootfs-bulder";
+    src = ./rootfs-builder;
+    cargoLock.lockFile = ./rootfs-builder/Cargo.lock;
+    doCheck = false;
+  };
+
+  rootfs = pkgs.runCommand "${name}-fhsenv-rootfs" {
+    __structuredAttrs = true;
+    exportReferencesGraph.graph = lib.concatMap (p: p.paths) allPaths;
+    inherit paths paths32 isMultiBuild includeClosures;
+    nativeBuildInputs = [ pkgs.jq ];
+  } ''
+    ${rootfs-builder}/bin/rootfs-builder
+
+    # create a bunch of symlinks for usrmerge
+    ln -s /usr/bin $out/bin
+    ln -s /usr/sbin $out/sbin
+    ln -s /usr/lib $out/lib
+    ln -s /usr/lib32 $out/lib32
+    ln -s /usr/lib64 $out/lib64
+    ln -s /usr/lib64 $out/usr/lib
+
+    # symlink 32-bit ld-linux so it's visible in /lib
+    if [ -e $out/usr/lib32/ld-linux.so.2 ]; then
+      ln -s /usr/lib32/ld-linux.so.2 $out/usr/lib64/ld-linux.so.2
+    fi

    # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
-    ln -s /proc/mounts mtab
-  '';
+    ln -s /proc/mounts $out/etc/mtab

-  # Composes a /usr-like directory structure
-  staticUsrProfileTarget = buildEnv {
-    name = "${name}-usr-target";
-    # ldconfig wrapper must come first so it overrides the original ldconfig
-    paths = [ etcPkg ldconfig ] ++ baseTargetPaths ++ targetPaths;
-    extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-    postBuild = ''
-      if [[ -d  $out/share/gsettings-schemas/ ]]; then
-          # Recreate the standard schemas directory if its a symlink to make it writable
-          if [[ -L $out/share/glib-2.0 ]]; then
-              target=$(readlink $out/share/glib-2.0)
-              rm $out/share/glib-2.0
-              mkdir $out/share/glib-2.0
-              ln -fsr $target/* $out/share/glib-2.0
-          fi
-
-          if [[ -L $out/share/glib-2.0/schemas ]]; then
-              target=$(readlink $out/share/glib-2.0/schemas)
-              rm $out/share/glib-2.0/schemas
-              mkdir $out/share/glib-2.0/schemas
-              ln -fsr $target/* $out/share/glib-2.0/schemas
-          fi
-
-          mkdir -p $out/share/glib-2.0/schemas
-
-          for d in $out/share/gsettings-schemas/*; do
-              # Force symlink, in case there are duplicates
-              ln -fsr $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
-              ln -fsr $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
-          done
-
-          # and compile them
-          ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
-      fi
-    '';
-    inherit includeClosures;
-  };
-
-  staticUsrProfileMulti = buildEnv {
-    name = "${name}-usr-multi";
-    paths = baseMultiPaths ++ multiPaths;
-    extraOutputsToInstall = [ "out" "lib" ] ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-    inherit includeClosures;
-  };
-
-  # setup library paths only for the targeted architecture
-  setupLibDirsTarget = ''
-    # link content of targetPaths
-    cp -rsHf ${staticUsrProfileTarget}/lib lib
-    ln -s lib lib${if is64bit then "64" else "32"}
-  '';
-
-  # setup /lib, /lib32 and /lib64
-  setupLibDirsMulti = ''
-    mkdir -m0755 lib32
-    mkdir -m0755 lib64
-    ln -s lib64 lib
-
-    # copy glibc stuff
-    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/
-    chmod u+w -R lib32/
-
-    # copy content of multiPaths (32bit libs)
-    if [ -d ${staticUsrProfileMulti}/lib ]; then
-      cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/
-      chmod u+w -R lib32/
+    if [[ -d $out/usr/share/gsettings-schemas/ ]]; then
+      for d in $out/usr/share/gsettings-schemas/*; do
+        # Force symlink, in case there are duplicates
+        ln -fsr $d/glib-2.0/schemas/*.xml $out/usr/share/glib-2.0/schemas
+        ln -fsr $d/glib-2.0/schemas/*.gschema.override $out/usr/share/glib-2.0/schemas
+      done
+      ${pkgs.glib.dev}/bin/glib-compile-schemas $out/usr/share/glib-2.0/schemas
    fi

-    # copy content of targetPaths (64bit libs)
-    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/
-    chmod u+w -R lib64/
-
-    # symlink 32-bit ld-linux.so
-    ln -Lsf ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
+    ${extraBuildCommands}
+    ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
  '';
-
-  setupLibDirs = if isTargetBuild
-                 then setupLibDirsTarget
-                 else setupLibDirsMulti;
-
-  # the target profile is the actual profile that will be used for the fhs
-  setupTargetProfile = ''
-    mkdir -m0755 usr
-    pushd usr
-
-    ${setupLibDirs}
-
-    '' + lib.optionalString isMultiBuild ''
-    if [ -d "${staticUsrProfileMulti}/share" ]; then
-      cp -rLf ${staticUsrProfileMulti}/share share
-    fi
-    '' + ''
-    if [ -d "${staticUsrProfileTarget}/share" ]; then
-      if [ -d share ]; then
-        chmod -R 755 share
-        cp -rLTf ${staticUsrProfileTarget}/share share
-      else
-        cp -rsHf ${staticUsrProfileTarget}/share share
-      fi
-    fi
-    for i in bin sbin include; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    cd ..
-
-    for i in etc opt; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    for i in usr/{bin,sbin,lib,lib32,lib64}; do
-      if [ -d "$i" ]; then
-        ln -s "$i"
-      fi
-    done
-
-    popd
-  '';
-
-in runCommandLocal "${name}-fhs" {
-  inherit nativeBuildInputs;
-  passthru = {
-    inherit args baseTargetPaths targetPaths baseMultiPaths ldconfig isMultiBuild;
-  };
-} ''
-  mkdir -p $out
-  pushd $out
-
-  ${setupTargetProfile}
-  ${extraBuildCommands}
-  ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
-''
+in rootfs
--- a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock
@ -0,0 +1,249 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "anyhow"
+version = "1.0.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c042108f3ed77fd83760a5fd79b53be043192bb3b9dba91d8c574c0ada7850c8"
+
+[[package]]
+name = "goblin"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53ab3f32d1d77146981dea5d6b1e8fe31eedcb7013e5e00d6ccd1259a4b4d923"
+dependencies = [
+ "log",
+ "plain",
+ "scroll",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rootfs-builder"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "goblin",
+ "serde",
+ "serde_json",
+ "walkdir",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scroll"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+dependencies = [
+ "scroll_derive",
+]
+
+[[package]]
+name = "scroll_derive"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.213"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.213"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.132"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
--- a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.toml
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.toml
@ -0,0 +1,11 @@
+[package]
+name = "rootfs-builder"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "*"
+serde = { version = "*", features = ["derive"] }
+serde_json = "*"
+walkdir = "*"
+goblin = "*"
--- a/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs
@ -0,0 +1,293 @@
+#![deny(clippy::pedantic)]
+
+use std::{
+    collections::{hash_map::Entry, HashMap},
+    env,
+    fs::{self, File},
+    io::{BufReader, Read},
+    os::unix::fs as ufs,
+    path::{Path, PathBuf},
+};
+
+use anyhow::{anyhow, Context};
+use goblin::{Hint, Object};
+use serde::Deserialize;
+use walkdir::WalkDir;
+
+#[derive(Debug, Deserialize)]
+struct RefGraphNode {
+    path: PathBuf,
+    references: Vec<PathBuf>,
+}
+
+#[derive(Debug, Deserialize)]
+struct InputDrv {
+    paths: Vec<PathBuf>,
+    priority: i64,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct StructuredAttrsRoot {
+    graph: Vec<RefGraphNode>,
+    paths: Vec<InputDrv>,
+    paths32: Vec<InputDrv>,
+    include_closures: bool,
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+struct PriorityKey {
+    implicit: bool,
+    group_priority: i64,
+    priority: i64,
+    root_index: usize,
+}
+
+fn build_reference_map(refs: Vec<RefGraphNode>) -> HashMap<PathBuf, Vec<PathBuf>> {
+    refs.into_iter()
+        .map(|mut gn| {
+            gn.references.retain_mut(|x| x != &gn.path);
+            (gn.path, gn.references)
+        })
+        .collect()
+}
+
+fn build_priority_keys(roots: &[InputDrv], group_priority: i64) -> HashMap<PathBuf, PriorityKey> {
+    let mut roots_map = HashMap::new();
+
+    for (idx, path) in roots.iter().enumerate() {
+        for subpath in &path.paths {
+            let priority = PriorityKey {
+                group_priority,
+                priority: path.priority,
+                root_index: idx,
+                implicit: false,
+            };
+
+            roots_map.entry(subpath.clone()).or_insert(priority);
+        }
+    }
+
+    roots_map
+}
+
+fn extend_to_closure(
+    roots: HashMap<PathBuf, PriorityKey>,
+    refs: &HashMap<PathBuf, Vec<PathBuf>>,
+) -> anyhow::Result<HashMap<PathBuf, PriorityKey>> {
+    let mut path_map = HashMap::new();
+
+    for (root, priority) in roots {
+        path_map.insert(root.clone(), priority);
+
+        let mut priority = priority;
+        priority.implicit = true;
+
+        let mut stack = vec![root.clone()];
+
+        while let Some(next) = stack.pop() {
+            match path_map.entry(next.clone()) {
+                Entry::Occupied(mut occupied_entry) => {
+                    let old_priority: &PriorityKey = occupied_entry.get();
+                    if old_priority > &priority {
+                        occupied_entry.insert(priority);
+                    }
+                }
+                Entry::Vacant(vacant_entry) => {
+                    vacant_entry.insert(priority);
+                }
+            }
+
+            stack.extend_from_slice(refs.get(&next).ok_or(anyhow!("encountered unknown path"))?);
+        }
+    }
+
+    Ok(path_map)
+}
+
+#[derive(Clone, Debug)]
+struct CandidatePath {
+    root: PathBuf,
+    relative: PathBuf,
+    priority: PriorityKey,
+}
+
+fn collect_candidate_paths(
+    paths: HashMap<PathBuf, PriorityKey>,
+    mapper: impl Fn(&Path, &Path) -> Option<PathBuf>,
+) -> anyhow::Result<HashMap<PathBuf, Vec<CandidatePath>>> {
+    let mut candidates: HashMap<_, Vec<_>> = HashMap::new();
+
+    for (path, priority) in paths {
+        for entry in WalkDir::new(&path).follow_links(true) {
+            let entry: PathBuf = match entry {
+                Ok(ent) => {
+                    // we don't care about directory structure
+                    if ent.file_type().is_dir() {
+                        continue;
+                    }
+
+                    ent.path().into()
+                }
+                Err(e) => {
+                    match e.io_error() {
+                        // could be a broken symlink, that's fine, we still want to handle those
+                        Some(_) => e
+                            .path()
+                            .ok_or_else(|| anyhow!("I/O error when walking {path:?}"))?
+                            .into(),
+                        None => {
+                            // symlink loop
+                            continue;
+                        }
+                    }
+                }
+            };
+
+            let relative = entry.strip_prefix(&path)?.to_owned();
+            if let Some(mapped) = mapper(&path, &relative) {
+                candidates.entry(mapped).or_default().push(CandidatePath {
+                    root: path.clone(),
+                    relative,
+                    priority,
+                });
+            }
+        }
+    }
+
+    Ok(candidates)
+}
+
+fn remap_native_path(root: &Path, p: &Path) -> Option<PathBuf> {
+    if p.starts_with("bin/") || p.starts_with("sbin/") {
+        return Some(PathBuf::from("usr/").join(p));
+    }
+
+    // glibc-multilib special case
+    if let Ok(no_lib32) = p.strip_prefix("lib/32/") {
+        return Some(PathBuf::from("usr/lib32/").join(no_lib32));
+    }
+
+    remap_multilib_path(root, p)
+}
+
+fn is_32_bit(path: &Path) -> bool {
+    // Be as pessimistic as possible, at least for now.
+    let Ok(mut f) = File::open(path) else {
+        return false;
+    };
+
+    let Ok(Hint::Elf(hint)) = goblin::peek(&mut f) else {
+        return false;
+    };
+
+    if let Some(is64) = hint.is_64 {
+        return !is64;
+    }
+
+    let mut buf = vec![];
+    let Ok(_) = f.read_to_end(&mut buf) else {
+        return false;
+    };
+
+    let Ok(Object::Elf(e)) = goblin::Object::parse(&buf) else {
+        return false;
+    };
+
+    !e.is_64
+}
+
+fn remap_multilib_path(root: &Path, p: &Path) -> Option<PathBuf> {
+    if let Ok(no_lib) = p.strip_prefix("lib/") {
+        let full = root.join(p);
+
+        let libdir = if is_32_bit(&full) { "lib32" } else { "lib64" };
+
+        return Some(PathBuf::from("usr/").join(libdir).join(no_lib));
+    }
+
+    if p.starts_with("etc/") || p.starts_with("opt/") {
+        return Some(p.into());
+    }
+
+    if p.starts_with("share/") || p.starts_with("include/") {
+        return Some(PathBuf::from("usr/").join(p));
+    }
+
+    None
+}
+
+fn build_plan(
+    paths: HashMap<PathBuf, PriorityKey>,
+    paths32: HashMap<PathBuf, PriorityKey>,
+) -> anyhow::Result<HashMap<PathBuf, PathBuf>> {
+    let candidates_native = collect_candidate_paths(paths, remap_native_path)?;
+    let candidates_32 = collect_candidate_paths(paths32, remap_multilib_path)?;
+
+    let mut all_candidates: HashMap<_, Vec<_>> = HashMap::new();
+
+    for map in [candidates_native, candidates_32] {
+        for (path, candidates) in map {
+            all_candidates
+                .entry(path)
+                .or_default()
+                .extend_from_slice(&candidates);
+        }
+    }
+
+    let mut final_plan: HashMap<PathBuf, PathBuf> = HashMap::new();
+    for (path, candidates) in all_candidates {
+        let best = candidates
+            .into_iter()
+            .min_by_key(|&CandidatePath { priority, .. }| priority)
+            .ok_or(anyhow!("candidate list empty"))?;
+        final_plan.insert(path, best.root.join(best.relative));
+    }
+
+    Ok(final_plan)
+}
+
+fn build_env(out: &Path, plan: HashMap<PathBuf, PathBuf>) -> anyhow::Result<()> {
+    fs::create_dir_all(out)?;
+
+    for (dest, src) in plan {
+        let full_dest = out.join(&dest);
+        let dest_dir = full_dest
+            .parent()
+            .ok_or(anyhow!("destination directory is root"))
+            .with_context(|| {
+                format!("When trying to determine destination directory for {full_dest:?}")
+            })?;
+        fs::create_dir_all(dest_dir)
+            .with_context(|| format!("When trying to create directory {dest_dir:?}"))?;
+        ufs::symlink(&src, &full_dest)
+            .with_context(|| format!("When symlinking {src:?} to {full_dest:?}"))?;
+    }
+
+    Ok(())
+}
+
+fn main() -> anyhow::Result<()> {
+    let filename = env::var("NIX_ATTRS_JSON_FILE")?;
+
+    let reader = File::open(filename)?;
+    let buf_reader = BufReader::new(reader);
+
+    let attrs: StructuredAttrsRoot = serde_json::from_reader(buf_reader)?;
+
+    let mut paths = build_priority_keys(&attrs.paths, 1);
+    let mut paths32 = build_priority_keys(&attrs.paths32, 2);
+
+    if attrs.include_closures {
+        let refs = build_reference_map(attrs.graph);
+
+        paths = extend_to_closure(paths, &refs)?;
+        paths32 = extend_to_closure(paths32, &refs)?;
+    };
+
+    let plan = build_plan(paths, paths32)?;
+
+    let out_dir = env::var("out")?;
+
+    build_env(&PathBuf::from(out_dir), plan)
+}
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@ -1,46 +1,48 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, telegram-desktop
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  telegram-desktop,
+  withWebkit ? true,
 }:

-telegram-desktop.overrideAttrs (old: rec {
+telegram-desktop.override {
  pname = "64gram";
-  version = "1.1.43";
+  inherit withWebkit;
+  unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
+    pname = "64gram-unwrapped";
+    version = "1.1.45";

-  src = fetchFromGitHub {
-    owner = "TDesktop-x64";
-    repo = "tdesktop";
-    rev = "v${version}";
+    src = fetchFromGitHub {
+      owner = "TDesktop-x64";
+      repo = "tdesktop";
+      rev = "v${version}";
+      hash = "sha256-bDe4tmJRWnussa5QrBh2oStvIF7R5/nbPfljb3us3nk=";
+      fetchSubmodules = true;
+    };

-    fetchSubmodules = true;
-    hash = "sha256-vRiAIGY3CU5+hsdn8xiNbgvSM3eGRVwnvsSmSoaDN/k=";
-  };
+    patches = (old.patches or [ ]) ++ [
+      (fetchpatch {
+        url = "https://github.com/TDesktop-x64/tdesktop/commit/c996ccc1561aed089c8b596f6ab3844335bbf1df.patch";
+        revert = true;
+        hash = "sha256-Hz7BXl5z4owe31l9Je3QOXT8FAyKcbsXsKjGfCmXhzE=";
+      })
+    ];

-  patches = (old.patches or []) ++ [
-    (fetchpatch {
-      url = "https://github.com/TDesktop-x64/tdesktop/commit/c996ccc1561aed089c8b596f6ab3844335bbf1df.patch";
-      revert = true;
-      hash = "sha256-Hz7BXl5z4owe31l9Je3QOXT8FAyKcbsXsKjGfCmXhzE=";
-    })
-  ];
+    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+      (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
+      (lib.cmakeBool "disable_autoupdate" true)
+    ];

-  cmakeFlags = (old.cmakeFlags or []) ++ [
-    (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
-    (lib.cmakeBool "disable_autoupdate" true)
-  ];
-
-  passthru.updateScript = nix-update-script {};
-
-  meta = with lib; {
-    description = "Unofficial Telegram Desktop providing Windows 64bit build and extra features";
-    license = licenses.gpl3Only;
-    platforms = platforms.all;
-    homepage = "https://github.com/TDesktop-x64/tdesktop";
-    changelog = "https://github.com/TDesktop-x64/tdesktop/releases/tag/v${version}";
-    maintainers = with maintainers; [ clot27 ];
-    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
-  };
-})
+    meta = {
+      description = "Unofficial Telegram Desktop providing Windows 64bit build and extra features";
+      license = lib.licenses.gpl3Only;
+      platforms = lib.platforms.all;
+      homepage = "https://github.com/TDesktop-x64/tdesktop";
+      changelog = "https://github.com/TDesktop-x64/tdesktop/releases/tag/v${version}";
+      maintainers = with lib.maintainers; [ clot27 ];
+      mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
+    };
+  });
+}
--- a/pkgs/by-name/ar/ark-pixel-font/package.nix
+++ b/pkgs/by-name/ar/ark-pixel-font/package.nix
@ -1,9 +1,21 @@
-{ lib
-, python312Packages
-, fetchFromGitHub
-, nix-update-script
+{
+  lib,
+  python312Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  fetchPypi,
 }:

+let
+  pixel-font-builder-compat = python312Packages.pixel-font-builder.overrideAttrs rec {
+    version = "0.0.26";
+    src = fetchPypi {
+      inherit version;
+      pname = "pixel_font_builder";
+      hash = "sha256-bgs2FbOA5tcUXe5+KuVztWGAv5yFxQNBaiZMeZ+ic+8=";
+    };
+  };
+in
 python312Packages.buildPythonPackage rec {
  pname = "ark-pixel-font";
  version = "2024.05.12";
@ -18,7 +30,7 @@ python312Packages.buildPythonPackage rec {
  format = "other";

  nativeBuildInputs = with python312Packages; [
-    pixel-font-builder
+    pixel-font-builder-compat
    unidata-blocks
    character-encoding-utils
    pypng
--- a/pkgs/by-name/br/brave/make-brave.nix
+++ b/pkgs/by-name/br/brave/make-brave.nix
@ -16,6 +16,7 @@
 , gsettings-desktop-schemas
 , gtk3
 , gtk4
+, qt6
 , libX11
 , libXScrnSaver
 , libXcomposite
@ -83,7 +84,7 @@ let
    libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
    libXext libXfixes libXi libXrandr libXrender libxshmfence
    libXtst libuuid mesa nspr nss pango pipewire udev wayland
-    xorg.libxcb zlib snappy libkrb5
+    xorg.libxcb zlib snappy libkrb5 qt6.qtbase
  ]
    ++ optional pulseSupport libpulseaudio
    ++ optional libvaSupport libva;
--- a/pkgs/by-name/by/byedpi/package.nix
+++ b/pkgs/by-name/by/byedpi/package.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "byedpi";
-  version = "0.14.1";
+  version = "0.15";

  src = fetchFromGitHub {
    owner = "hufrea";
    repo = "byedpi";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-JdL+3ETNxaEtOLUhgLSABL9C8w/EM4Ay37OXU5jLCFA=";
+    hash = "sha256-jsQFfIvWvpJRBewUSS5bhDGocfPTvtG6LiejUxdqk28=";
  };

  installPhase = ''
--- a/pkgs/by-name/cc/cctools/package.nix
+++ b/pkgs/by-name/cc/cctools/package.nix
@ -170,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
      apple-psl20
      gpl2 # GNU as
    ];
-    maintainers = with lib.maintainers; [ reckenrode ];
+    maintainers = lib.teams.darwin.members;
    platforms = lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/co/connectome-workbench/package.nix
+++ b/pkgs/by-name/co/connectome-workbench/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "connectome-workbench";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "Washington-University";
    repo = "workbench";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-d0J5bXp6mJlUQBmInxPXPkd5P5H+3F6fE9fc8pD1fUc=";
+    hash = "sha256-M5iverVDhBI/ijbgwfa6gHrthY4wrUi+/2A/443jBqg=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
  # ld: ../Brain/libBrain.a(BrainOpenGLVolumeObliqueSliceDrawing.cxx.o): undefined reference to symbol 'glGetFloatv'
  # ld: /nix/store/a5vcvrkh1c2ng5kr584g3zw3991vnhks-libGL-1.7.0/lib/libGL.so.1: error adding symbols: DSO missing from command line

+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+
  nativeBuildInputs = [
    cmake
    libsForQt5.wrapQtAppsHook
--- a/pkgs/by-name/de/detect-it-easy/0001-remove-hard-coded-paths-in-xoptions.patch
+++ b/pkgs/by-name/de/detect-it-easy/0001-remove-hard-coded-paths-in-xoptions.patch
@ -1,14 +1,14 @@
 diff --git a/XOptions/xoptions.cpp b/XOptions/xoptions.cpp
-index ca5723e..30574a5 100755
+index 8c887c3..36cdbc3 100755
 --- a/XOptions/xoptions.cpp
 +++ b/XOptions/xoptions.cpp
-@@ -1531,14 +1531,7 @@ bool XOptions::checkNative(const QString &sIniFileName)
+@@ -1754,14 +1754,7 @@ bool XOptions::checkNative(const QString &sIniFileName)
 #if defined(Q_OS_MAC)
     bResult = true;
 #elif defined(Q_OS_LINUX) || defined(Q_OS_FREEBSD)
 -    QString sApplicationDirPath = qApp->applicationDirPath();
 -
-    if ((sApplicationDirPath == "/bin") || (sApplicationDirPath == "/usr/bin") || (sApplicationDirPath == "/usr/local/bin") ||
+-    if ((sApplicationDirPath == "/bin") || (sApplicationDirPath == "/usr/bin") || (sApplicationDirPath == "/usr/local/bin") || (sApplicationDirPath == "/app/bin") ||
 -        (sApplicationDirPath.contains("/usr/local/bin$")) || isAppImage()) {
 -        bResult = true;
 -    } else {
@ -18,7 +18,7 @@ index ca5723e..30574a5 100755
 #elif defined(Q_OS_WIN)
     QString sApplicationDirPath = qApp->applicationDirPath();
 
-@@ -1565,22 +1558,7 @@ QString XOptions::getApplicationDataPath()
+@@ -1788,22 +1781,7 @@ QString XOptions::getApplicationDataPath()
 #ifdef Q_OS_MAC
     sResult = sApplicationDirPath + "/../Resources";
 #elif defined(Q_OS_LINUX)
--- a/pkgs/by-name/de/detect-it-easy/package.nix
+++ b/pkgs/by-name/de/detect-it-easy/package.nix
@ -13,14 +13,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "detect-it-easy";
-  version = "3.09";
+  version = "3.10";

  src = fetchFromGitHub {
    owner = "horsicq";
    repo = "DIE-engine";
    rev = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-A9YZBlGf3j+uSefPiDhrS1Qtu6vaLm4Yodt7BioGD2Q=";
+    hash = "sha256-yHgxYig5myY2nExweUk2muKbJTKN3SiwOLgQcMIY/BQ=";
  };

  patches = [ ./0001-remove-hard-coded-paths-in-xoptions.patch ];
@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {

  # clean up wrongly created dirs in `install.sh` and broken .desktop file
  postInstall = ''
-    rm -r $out/lib/{bin,share}
    grep -v "Version=#VERSION#" $src/LINUX/die.desktop > $out/share/applications/die.desktop
  '';

@ -61,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Program for determining types of files for Windows, Linux and MacOS.";
    mainProgram = "die";
    homepage = "https://github.com/horsicq/Detect-It-Easy";
+    changelog = "https://github.com/horsicq/Detect-It-Easy/blob/master/changelog.txt";
    maintainers = with lib.maintainers; [ ivyfanchiang ];
    platforms = [ "x86_64-linux" ];
    license = lib.licenses.mit;
--- a/pkgs/by-name/di/dissent/package.nix
+++ b/pkgs/by-name/di/dissent/package.nix
@ -1,4 +1,5 @@
 { buildGoModule
+, fetchFromGitLab
 , fetchFromGitHub
 , gobject-introspection
 , gst_all_1
@ -12,6 +13,19 @@
 , wrapGAppsHook4
 }:

+let
+  libspelling_2_1 = libspelling.overrideAttrs {
+    version = "0.2.1";
+
+    src = fetchFromGitLab {
+      domain = "gitlab.gnome.org";
+      owner = "GNOME";
+      repo = "libspelling";
+      rev = "refs/tags/0.2.1";
+      hash = "sha256-0OGcwPGWtYYf0XmvzXEaQgebBOW/6JWcDuF4MlQjCZQ=";
+    };
+  };
+in
 buildGoModule rec {
  pname = "dissent";
  version = "0.0.30";
@ -39,7 +53,9 @@ buildGoModule rec {
    libadwaita
    libcanberra-gtk3
    sound-theme-freedesktop
-    libspelling
+    # gotk4-spelling fails to build with libspelling >= 0.3.0
+    # https://github.com/diamondburned/gotk4-spelling/issues/1
+    libspelling_2_1
    gtksourceview5
  ];

--- a/pkgs/development/web/edge-runtime/Cargo.lock
+++ b/pkgs/development/web/edge-runtime/Cargo.lock
--- a/pkgs/by-name/ed/edge-runtime/librusty_v8.nix
+++ b/pkgs/by-name/ed/edge-runtime/librusty_v8.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+let
+  fetch_librusty_v8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      hash = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+in
+fetch_librusty_v8 {
+  version = "0.97.1";
+  shas = {
+    x86_64-linux = "sha256-wQBEi2Vs5ruhSkq0n3z8WWjls6V3th2cm+O6s4LDB8k=";
+    aarch64-linux = "sha256-U0PCUNcshm7AaBuUgwQQ1Qn9dr1iL2Okodl6BI/nZR8=";
+    x86_64-darwin = "sha256-cGXOstCOdqaOpU2LcOT5A0JfnkoDvUHhOcCJ9vsS7CM=";
+    aarch64-darwin = "sha256-9TmAON0KUVRQISTudyryIhf4VC/Dc4caq69iquDdrTU=";
+  };
+}
--- a/pkgs/development/web/edge-runtime/default.nix
+++ b/pkgs/development/web/edge-runtime/default.nix
@ -1,17 +1,18 @@
-{ stdenv
-, lib
-, callPackage
-, fetchFromGitHub
-, rustPlatform
-, nix-update-script
-, darwin
-, openssl
-, pkg-config
+{
+  stdenv,
+  lib,
+  callPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  darwin,
+  openssl,
+  pkg-config,
 }:

 let
  pname = "edge-runtime";
-  version = "1.53.4";
+  version = "1.60.1";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -20,21 +21,34 @@ rustPlatform.buildRustPackage {
    owner = "supabase";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-sDgGfQiAUuI+JaF0BRB5lwvjbWWIoTV/k/tbQsBBc4E=";
+    hash = "sha256-w0iSKHT6aIixKh1bHg1lOQNEw/emKK7R2iLzWjb2Pnk=";
    fetchSubmodules = true;
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ort-2.0.0-rc.0" = "sha256-j3g9ES2ZLmAAcPYgszBGDG16HiFJTnohwxSvXypFGTw=";
+      "deno_core-0.293.0" = "sha256-5WBORHokzWPdro9rmBijcsx/j81YFaEfMIK276bfI1o=";
+      "eszip-0.72.2" = "sha256-lzJeapA5NTWBnBaQY8i82OeYN2DIukJZKoRAXFG4qVA=";
+      "ort-2.0.0-rc.2" = "sha256-jOKeulnW/m+q1xf77jaNzLT+In/AFcSDDbz7xF23x5g=";
    };
  };

-  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];

-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Security CoreFoundation SystemConfiguration ]);
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Security
+        CoreFoundation
+        SystemConfiguration
+      ]
+    );

  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "3.5.1";
+  version = "4.0.1";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-LRMkwSrBU5/IPXMhRT05pE487nmSffXvmfbwBiqpyj8=";
+    hash = "sha256-hG8gCohf+U8T9A9Abqey9upErJklbCp8HuzHQKFcu3E=";
  };

-  vendorHash = "sha256-XLDtWYFHwBqbkzj4yRyr3uC1FnpS0bn1ia8i6m+CTBM=";
+  vendorHash = "sha256-yRXI9/LVj4f7qFdScqfpL5WCsK+lJXa6yQmdbUhfrKY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ka/kapacitor/0001-fix-build.patch
+++ b/pkgs/by-name/ka/kapacitor/0001-fix-build.patch
@ -0,0 +1,190 @@
+From 3a5c573079f427dcda47176137747806200551cb Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Fri, 27 Sep 2024 21:25:14 +0800
+Subject: [PATCH] fix build
+
+---
+ flux-core/src/semantic/flatbuffers/types.rs |  6 +++---
+ flux-core/src/semantic/nodes.rs             |  5 ++---
+ flux-core/src/semantic/sub.rs               | 24 ++++++++++-----------
+ flux-core/src/semantic/types.rs             |  5 +++--
+ go/libflux/buildinfo.gen.go                 |  9 ++++----
+ 5 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/flux-core/src/semantic/flatbuffers/types.rs b/flux-core/src/semantic/flatbuffers/types.rs
+index c3eecf0..e7e1c95 100644
+--- a/flux-core/src/semantic/flatbuffers/types.rs
+++ b/flux-core/src/semantic/flatbuffers/types.rs
+@@ -108,7 +108,7 @@ impl From<fb::PolyType<'_>> for Option<PolyType> {
+         for value in c.iter() {
+             let constraint: Option<(Tvar, Kind)> = value.into();
+             let (tv, kind) = constraint?;
+-            cons.entry(tv).or_insert_with(Vec::new).push(kind);
+            cons.entry(tv).or_default().push(kind);
+         }
+         Some(PolyType {
+             vars,
+@@ -345,9 +345,9 @@ where
+     builder.finished_data()
+ }
+ 
+-pub fn deserialize<'a, T: 'a, S>(buf: &'a [u8]) -> S
+pub fn deserialize<'a, T, S>(buf: &'a [u8]) -> S
+ where
+-    T: flatbuffers::Follow<'a> + flatbuffers::Verifiable,
+    T: flatbuffers::Follow<'a> + flatbuffers::Verifiable + 'a,
+     S: std::convert::From<T::Inner>,
+ {
+     flatbuffers::root::<T>(buf).unwrap().into()
+diff --git a/flux-core/src/semantic/nodes.rs b/flux-core/src/semantic/nodes.rs
+index 3213991..f64dbd4 100644
+--- a/flux-core/src/semantic/nodes.rs
+++ b/flux-core/src/semantic/nodes.rs
+@@ -822,9 +822,8 @@ impl VariableAssgn {
+         //
+         // Note these variables are fixed after generalization
+         // and so it is safe to update these nodes in place.
+-        self.vars = p.vars.clone();
+-        self.cons = p.cons.clone();
+-
+	self.vars.clone_from(&p.vars);
+        self.cons.clone_from(&p.cons);
+         // Update the type environment
+         infer.env.add(self.id.name.clone(), p);
+         Ok(())
+diff --git a/flux-core/src/semantic/sub.rs b/flux-core/src/semantic/sub.rs
+index 2ca73e0..1431565 100644
+--- a/flux-core/src/semantic/sub.rs
+++ b/flux-core/src/semantic/sub.rs
+@@ -481,7 +481,7 @@ where
+ }
+ 
+ #[allow(clippy::too_many_arguments, clippy::type_complexity)]
+-pub(crate) fn merge4<A: ?Sized, B: ?Sized, C: ?Sized, D: ?Sized>(
+pub(crate) fn merge4<A, B, C, D>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+@@ -492,10 +492,10 @@ pub(crate) fn merge4<A: ?Sized, B: ?Sized, C: ?Sized, D: ?Sized>(
+     d: Option<D::Owned>,
+ ) -> Option<(A::Owned, B::Owned, C::Owned, D::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
+-    C: ToOwned,
+-    D: ToOwned,
+    A: ToOwned + ?Sized,
+    B: ToOwned + ?Sized,
+    C: ToOwned + ?Sized,
+    D: ToOwned + ?Sized,
+ {
+     let a_b_c = merge3(a_original, a, b_original, b, c_original, c);
+     merge_fn(
+@@ -515,7 +515,7 @@ where
+     .map(|((a, b, c), d)| (a, b, c, d))
+ }
+ 
+-pub(crate) fn merge3<A: ?Sized, B: ?Sized, C: ?Sized>(
+pub(crate) fn merge3<A, B, C>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+@@ -524,9 +524,9 @@ pub(crate) fn merge3<A: ?Sized, B: ?Sized, C: ?Sized>(
+     c: Option<C::Owned>,
+ ) -> Option<(A::Owned, B::Owned, C::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
+-    C: ToOwned,
+    A: ToOwned + ?Sized,
+    B: ToOwned + ?Sized,
+    C: ToOwned + ?Sized,
+ {
+     let a_b = merge(a_original, a, b_original, b);
+     merge_fn(
+@@ -542,15 +542,15 @@ where
+ 
+ /// Merges two values using `f` if either or both them is `Some(..)`.
+ /// If both are `None`, `None` is returned.
+-pub(crate) fn merge<A: ?Sized, B: ?Sized>(
+pub(crate) fn merge<A, B>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+     b: Option<B::Owned>,
+ ) -> Option<(A::Owned, B::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
+    A: ToOwned + ?Sized,
+    B: ToOwned + ?Sized,
+ {
+     merge_fn(a_original, A::to_owned, a, b_original, B::to_owned, b)
+ }
+diff --git a/flux-core/src/semantic/types.rs b/flux-core/src/semantic/types.rs
+index 6a0e292..685475a 100644
+--- a/flux-core/src/semantic/types.rs
+++ b/flux-core/src/semantic/types.rs
+@@ -1327,7 +1327,7 @@ fn collect_record(record: &Record) -> (RefMonoTypeVecMap<'_, RecordLabel>, Optio
+ 
+     let mut fields = record.fields();
+     for field in &mut fields {
+-        a.entry(&field.k).or_insert_with(Vec::new).push(&field.v);
+        a.entry(&field.k).or_default().push(&field.v);
+     }
+     (a, fields.tail())
+ }
+@@ -1812,7 +1812,7 @@ impl PartialEq<&str> for Label {
+ 
+ impl PartialOrd for Label {
+     fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+-        self.0.name().partial_cmp(other.0.name())
+        Some(self.cmp(other))
+     }
+ }
+ 
+@@ -2198,6 +2198,7 @@ impl Function {
+ pub(crate) trait TypeLike {
+     type Error;
+     fn typ(&self) -> &MonoType;
+    #[allow(dead_code)]
+     fn into_type(self) -> MonoType;
+     fn error(&self, error: Error) -> Self::Error;
+ }
+diff --git a/go/libflux/buildinfo.gen.go b/go/libflux/buildinfo.gen.go
+index 2d13f4a..266f493 100644
+--- a/go/libflux/buildinfo.gen.go
+++ b/go/libflux/buildinfo.gen.go
+@@ -10,6 +10,7 @@ package libflux
+ // and forces the cgo library to rebuild and relink
+ // the sources. This is because non-C/C++ sources
+ // are not tracked by Go's build system.'
+//
+ //lint:ignore U1000 generated code
+ var sourceHashes = map[string]string{
+ 	"libflux/Cargo.lock":                                                                          "ec8537d38afbe08ecf451990b8c0a84ee4b30ee66d440d6525832c769764e44e",
+@@ -41,17 +42,17 @@ var sourceHashes = map[string]string{
+ 	"libflux/flux-core/src/semantic/env.rs":                                                       "8da036aa5f0e09f94fd2461687e97131068e56c762bef8cd98cfd91f36ef3e98",
+ 	"libflux/flux-core/src/semantic/flatbuffers/mod.rs":                                           "270671ffdcb1eb5308f9bbab0431c9464df264070a2deb05c526d182a6ec5585",
+ 	"libflux/flux-core/src/semantic/flatbuffers/semantic_generated.rs":                            "beaaa6b08d8b56dba81153a58e440bbdc430b4eca0201a3431e90b793f1adbce",
+-	"libflux/flux-core/src/semantic/flatbuffers/types.rs":                                         "029d51104eb4a0bbfc8d82a470e0f2915a27d7cb00c08a3f35e638b5a3105fc2",
+	"libflux/flux-core/src/semantic/flatbuffers/types.rs":                                         "c378f78c87464d9ecd4dc86b4808c0268e3968adf3def0170c77ce78bb0200c9",
+ 	"libflux/flux-core/src/semantic/formatter/mod.rs":                                             "8dd34520750a39ad242adfbb68c38a170d56bad82d5ccf80b165f0977ea68289",
+ 	"libflux/flux-core/src/semantic/fresh.rs":                                                     "97238fbc317e7c51836a6ba3441d641d9f4f8c7f637bde4bccbd0e09146129d0",
+ 	"libflux/flux-core/src/semantic/fs.rs":                                                        "f7f609bc8149769d99b737150e184a2d54029c0b768365dbcf08ff193b0e1f6f",
+ 	"libflux/flux-core/src/semantic/import.rs":                                                    "184e955211db1ceb1be782b4daf75584b86907b1428e50015497909cfc2dd89a",
+ 	"libflux/flux-core/src/semantic/infer.rs":                                                     "9d4293f2471a90cc89c1e45cdc72082e0da1a484981b803aea05856e6b4d722f",
+ 	"libflux/flux-core/src/semantic/mod.rs":                                                       "a70c32d73f0053e4a3eda7ad23626252cf6420b5db8b440a7351c2f62aa7a948",
+-	"libflux/flux-core/src/semantic/nodes.rs":                                                     "23ee2dec99b71f0fe81987528b3dfbd95e89d77a274ccc8a0baa146dea89ad51",
+-	"libflux/flux-core/src/semantic/sub.rs":                                                       "a989e50c113ca899fe02f8d49a4744a420580a3f803f656db25beb2d0c2a247b",
+	"libflux/flux-core/src/semantic/nodes.rs":                                                     "d5bff77bcb3de0e730b2a3f6d1245a12c718dfe3b8ecf937532330d2579ab53f",
+	"libflux/flux-core/src/semantic/sub.rs":                                                       "618713f4d14e9e2674204a9d293600692213327e77842cbe973c7b1715e23f24",
+ 	"libflux/flux-core/src/semantic/symbols.rs":                                                   "ddbceca632ca384c6bb461a660e02781c43295025f2dd10f1ea997131dd5eb30",
+-	"libflux/flux-core/src/semantic/types.rs":                                                     "ed414b695e925f18f74984ec88bba652ef8dd8c9e905cb9e8fa19b101a4601b4",
+	"libflux/flux-core/src/semantic/types.rs":                                                     "ae9cdcff357d217c0f744769a95b9f3bf55083f923df0c235f52de2b40be8f74",
+ 	"libflux/flux-core/src/semantic/vectorize.rs":                                                 "6ce2dc4e6ff572abc0146a220291322ea88557ce674ae16220a2d67420e9fa0d",
+ 	"libflux/flux-core/src/semantic/walk/_walk.rs":                                                "c3d04e72cfbe595d4919b84f4df4bc6c55297516cf8e12e6cb691f48be648291",
+ 	"libflux/flux-core/src/semantic/walk/mod.rs":                                                  "f71aac086dd1d7b730e24bac690a3e47a9bfe575cd6cba499af67db9b920c726",
+-- 
+2.46.0
+
--- a/pkgs/servers/monitoring/kapacitor/fix-linting-error-on-unneeded-clone.patch
+++ b/pkgs/servers/monitoring/kapacitor/fix-linting-error-on-unneeded-clone.patch
--- a/pkgs/servers/monitoring/kapacitor/default.nix
+++ b/pkgs/servers/monitoring/kapacitor/default.nix
@ -1,22 +1,23 @@
-{ stdenv
-, lib
-, rustPlatform
-, fetchFromGitHub
-, fetchpatch
-, libiconv
-, buildGoModule
-, pkg-config
+{
+  stdenv,
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  libiconv,
+  buildGoModule,
+  pkg-config,
 }:

 let
  libflux_version = "0.171.0";
  flux = rustPlatform.buildRustPackage rec {
    pname = "libflux";
-    version = "v${libflux_version}";
+    version = "${libflux_version}";
    src = fetchFromGitHub {
      owner = "influxdata";
      repo = "flux";
-      rev = "v${libflux_version}";
+      rev = "refs/tags/v${libflux_version}";
      hash = "sha256-v9MUR+PcxAus91FiHYrMN9MbNOTWewh7MT6/t/QWQcM=";
    };
    patches = [
@ -29,6 +30,8 @@ let
      # Can be removed as soon as kapacitor depends on a newer version of `libflux`, cf:
      # https://github.com/influxdata/kapacitor/blob/v1.7.0/go.mod#L26
      ./fix-linting-error-on-unneeded-clone.patch
+      # https://github.com/influxdata/flux/commit/68c831c40b396f0274f6a9f97d77707c39970b02
+      ./0001-fix-build.patch

      # https://github.com/influxdata/flux/pull/5273
      # fix compile error with Rust 1.64
@ -40,7 +43,7 @@ let
      })
    ];
    sourceRoot = "${src.name}/libflux";
-    cargoHash = "sha256-oAMoGGdR0QEjSzZ0/J5J9s/ekSlryCcRBSo5N2r70Ko=";
+    cargoHash = "sha256-yIYeJvLe+L72ZyuQ2AK6l4HGSF/tgCyGQsXEOWUXDn0=";
    nativeBuildInputs = [ rustPlatform.bindgenHook ];
    buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
    pkgcfg = ''
@ -51,28 +54,30 @@ let
      Libs: -L/out/lib -lflux -lpthread
    '';
    passAsFile = [ "pkgcfg" ];
-    postInstall = ''
-      mkdir -p $out/include $out/pkgconfig
-      cp -r $NIX_BUILD_TOP/source/libflux/include/influxdata $out/include
-      substitute $pkgcfgPath $out/pkgconfig/flux.pc \
-        --replace /out $out
-    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      install_name_tool -id $out/lib/libflux.dylib $out/lib/libflux.dylib
-    '';
+    postInstall =
+      ''
+        mkdir -p $out/include $out/pkgconfig
+        cp -r $NIX_BUILD_TOP/source/libflux/include/influxdata $out/include
+        substitute $pkgcfgPath $out/pkgconfig/flux.pc \
+          --replace-fail /out $out
+      ''
+      + lib.optionalString stdenv.hostPlatform.isDarwin ''
+        install_name_tool -id $out/lib/libflux.dylib $out/lib/libflux.dylib
+      '';
  };
 in
 buildGoModule rec {
  pname = "kapacitor";
-  version = "1.7.0";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = "influxdata";
    repo = "kapacitor";
-    rev = "v${version}";
-    hash = "sha256-vDluZZrct1x+OMVU8MNO56YBZq7JNlpW68alOrAGYSM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vxaLfJq0NFAJst0/AEhNJUl9dAaZY3blZAFthseMSX0=";
  };

-  vendorHash = "sha256-OX4QAthg15lwMyhOPyLTS++CMvGI5Um+FSd025PhW3E=";
+  vendorHash = "sha256-myToEgta8R5R4v2/nZqtQQvNdy1kWgwklbQeFxzIdgs=";

  nativeBuildInputs = [ pkg-config ];

@ -90,20 +95,34 @@ buildGoModule rec {
  # Remove failing server tests
  preCheck = ''
    rm server/server_test.go
+    rm pipeline/tick/*test.go
  '';

+  checkFlags =
+    let
+      skippedTests = [
+        "TestBatch_KapacitorLoopback"
+      ];
+    in
+    [
+      "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
+    ];
+
  # Tests start http servers which need to bind to local addresses,
  # but that fails in the Darwin sandbox by default unless this option is turned on
  # Error is: panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
  # See also https://github.com/NixOS/nix/pull/1646
  __darwinAllowLocalNetworking = true;

-  meta = with lib; {
+  meta = {
    description = "Open source framework for processing, monitoring, and alerting on time series data";
    homepage = "https://influxdata.com/time-series-platform/kapacitor/";
    downloadPage = "https://github.com/influxdata/kapacitor/releases";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    changelog = "https://github.com/influxdata/kapacitor/blob/master/CHANGELOG.md";
-    maintainers = with maintainers; [ offline totoroot ];
+    maintainers = with lib.maintainers; [
+      offline
+      totoroot
+    ];
  };
 }
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@ -226,7 +226,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://opensource.apple.com/releases/";
    license = lib.licenses.apple-psl20;
    mainProgram = "ld";
-    maintainers = with lib.maintainers; [ reckenrode ];
+    maintainers = lib.teams.darwin.members;
    platforms = lib.platforms.darwin; # Porting to other platforms is incomplete. Support only Darwin for now.
  };
 })
--- a/pkgs/by-name/ma/materialgram/package.nix
+++ b/pkgs/by-name/ma/materialgram/package.nix
@ -1,34 +1,40 @@
 {
-  telegram-desktop,
  lib,
+  telegram-desktop,
  fetchFromGitHub,
+  withWebkit ? true,
 }:
-telegram-desktop.overrideAttrs (
-  finalAttrs: previousAttrs: {
-    pname = "materialgram";
-    version = "5.6.1.1";

-    src = fetchFromGitHub {
-      owner = "kukuruzka165";
-      repo = "materialgram";
-      rev = "refs/tags/v${finalAttrs.version}";
-      fetchSubmodules = true;
-      hash = "sha256-e2ZLUooPMs0qB97BDyCiOUeD7cc+MuF5of65mEeJr04=";
-    };
+telegram-desktop.override {
+  pname = "materialgram";
+  inherit withWebkit;
+  unwrapped = telegram-desktop.unwrapped.overrideAttrs (
+    finalAttrs: previousAttrs: {
+      pname = "materialgram-unwrapped";
+      version = "5.7.0.1";

-    meta = previousAttrs.meta // {
-      description = "Telegram Desktop fork with material icons and some improvements";
-      longDescription = ''
-        Telegram Desktop fork with Material Design and other improvements,
-        which is based on the Telegram API and the MTProto secure protocol.
-      '';
-      homepage = "https://kukuruzka165.github.io/materialgram/";
-      changelog = "https://github.com/kukuruzka165/materialgram/releases/tag/v${finalAttrs.version}";
-      maintainers = with lib.maintainers; [
-        oluceps
-        aleksana
-      ];
-      mainProgram = "materialgram";
-    };
-  }
-)
+      src = fetchFromGitHub {
+        owner = "kukuruzka165";
+        repo = "materialgram";
+        rev = "refs/tags/v${finalAttrs.version}";
+        hash = "sha256-YdLUwXMATla64KSYnXLXwLl0KktNoB/IuHIIY44R1VY=";
+        fetchSubmodules = true;
+      };
+
+      meta = previousAttrs.meta // {
+        description = "Telegram Desktop fork with material icons and some improvements";
+        longDescription = ''
+          Telegram Desktop fork with Material Design and other improvements,
+          which is based on the Telegram API and the MTProto secure protocol.
+        '';
+        homepage = "https://kukuruzka165.github.io/materialgram/";
+        changelog = "https://github.com/kukuruzka165/materialgram/releases/tag/v${finalAttrs.version}";
+        maintainers = with lib.maintainers; [
+          oluceps
+          aleksana
+        ];
+        mainProgram = "materialgram";
+      };
+    }
+  );
+}
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "oterm";
-  version = "0.4.2";
+  version = "0.6.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ggozad";
    repo = "oterm";
    rev = "refs/tags/${version}";
-    hash = "sha256-0wiUqpjCHGHOuJJaDzpmMGtCBgUI5Sk29DrOgbLj018=";
+    hash = "sha256-kIuWDu7CpLLRyGPcCQYNaAiZ5F/WEatDmf2XbvLedsI=";
  };

  pythonRelaxDeps = [
@ -26,8 +26,7 @@ python3Packages.buildPythonApplication rec {
    "typer"
  ];

-  build-system = with python3Packages; [ poetry-core ];
-
+  build-system = with python3Packages; [ hatchling ];

  dependencies = with python3Packages; [
    aiohttp
--- a/pkgs/by-name/re/redmine/Gemfile
+++ b/pkgs/by-name/re/redmine/Gemfile
@ -2,7 +2,7 @@ source 'https://rubygems.org'

 ruby '>= 2.7.0', '< 3.3.0'

-gem 'rails', '6.1.7.8'
+gem 'rails', '6.1.7.10'
 gem 'rouge', '~> 4.2.0'
 gem 'request_store', '~> 1.5.0'
 gem 'mini_mime', '~> 1.1.0'
--- a/pkgs/by-name/re/redmine/Gemfile.lock
+++ b/pkgs/by-name/re/redmine/Gemfile.lock
@ -1,28 +1,28 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actioncable (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionmailbox (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      mail (>= 2.7.1)
-    actionmailer (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      actionview (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionmailer (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (6.1.7.8)
-      actionview (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionpack (6.1.7.10)
+      actionview (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
@ -30,34 +30,34 @@ GEM
    actionpack-xml_parser (2.0.1)
      actionpack (>= 5.0)
      railties (>= 5.0)
-    actiontext (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actiontext (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      nokogiri (>= 1.8.5)
-    actionview (6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionview (6.1.7.10)
+      activesupport (= 6.1.7.10)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.7.8)
-      activesupport (= 6.1.7.8)
+    activejob (6.1.7.10)
+      activesupport (= 6.1.7.10)
      globalid (>= 0.3.6)
-    activemodel (6.1.7.8)
-      activesupport (= 6.1.7.8)
-    activerecord (6.1.7.8)
-      activemodel (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
-    activestorage (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    activemodel (6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activerecord (6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activestorage (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      marcel (~> 1.0)
      mini_mime (>= 1.1.0)
-    activesupport (6.1.7.8)
+    activesupport (6.1.7.10)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
@ -84,7 +84,7 @@ GEM
    css_parser (1.19.1)
      addressable
    csv (3.2.9)
-    date (3.3.4)
+    date (3.4.0)
    deckar01-task_list (2.3.2)
      html-pipeline
    docile (1.4.1)
@ -98,7 +98,7 @@ GEM
    htmlentities (4.3.4)
    i18n (1.14.6)
      concurrent-ruby (~> 1.0)
-    json (2.7.4)
+    json (2.7.5)
    language_server-protocol (3.17.0.3)
    listen (3.9.0)
      rb-fsevent (~> 0.10, >= 0.10.3)
@ -137,7 +137,7 @@ GEM
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    parallel (1.26.3)
-    parser (3.3.5.0)
+    parser (3.3.5.1)
      ast (~> 2.4.1)
      racc
    pg (1.5.9)
@ -148,20 +148,20 @@ GEM
    rack (2.2.10)
    rack-test (2.1.0)
      rack (>= 1.3)
-    rails (6.1.7.8)
-      actioncable (= 6.1.7.8)
-      actionmailbox (= 6.1.7.8)
-      actionmailer (= 6.1.7.8)
-      actionpack (= 6.1.7.8)
-      actiontext (= 6.1.7.8)
-      actionview (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activemodel (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    rails (6.1.7.10)
+      actioncable (= 6.1.7.10)
+      actionmailbox (= 6.1.7.10)
+      actionmailer (= 6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actiontext (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      bundler (>= 1.15.0)
-      railties (= 6.1.7.8)
+      railties (= 6.1.7.10)
      sprockets-rails (>= 2.0.0)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
@ -170,9 +170,9 @@ GEM
    rails-html-sanitizer (1.6.0)
      loofah (~> 2.21)
      nokogiri (~> 1.14)
-    railties (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    railties (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
      method_source
      rake (>= 12.2)
      thor (~> 1.0)
@ -213,7 +213,7 @@ GEM
      rubocop-ast (>= 1.28.1, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.32.3)
+    rubocop-ast (1.33.1)
      parser (>= 3.3.1.0)
    rubocop-performance (1.19.1)
      rubocop (>= 1.7.0, < 2.0)
@ -229,7 +229,7 @@ GEM
    sanitize (6.1.3)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    selenium-webdriver (4.25.0)
+    selenium-webdriver (4.26.0)
      base64 (~> 0.2)
      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
@ -255,7 +255,7 @@ GEM
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    unicode-display_width (2.6.0)
-    webrick (1.8.2)
+    webrick (1.9.0)
    websocket (1.2.11)
    websocket-driver (0.7.6)
      websocket-extensions (>= 0.1.0)
@ -295,7 +295,7 @@ DEPENDENCIES
  nokogiri (~> 1.15.2)
  pg (~> 1.5.3)
  puma
-  rails (= 6.1.7.8)
+  rails (= 6.1.7.10)
  rails-dom-testing
  rbpdf (~> 1.21.3)
  redcarpet (~> 3.6.0)
--- a/pkgs/by-name/re/redmine/gemset.nix
+++ b/pkgs/by-name/re/redmine/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1gxw5sxfj6i9q68yv0aq8jn0rzfypqbsidvj8pin8i7kpd636f9d";
+      sha256 = "0a2rn3ygh50d7p29zvd0yfcd0q7kf4c2n2kf1kjgxf3qlyi5036h";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  actionmailbox = {
    dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@ -16,10 +16,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "02ffqgzvlx4gjmxs474q5xfvl4c5ykdgj0y9whkrm0si6xpzajn0";
+      sha256 = "19f6kc470ahwmnrpc302wdkw8c6yw15q442g6cq4wccmkdarflz9";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  actionmailer = {
    dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@ -27,10 +27,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0icpi06ibsi9xmcy2p0c33wh8p7rl2j26r6rmbhknp9jw3rlga9s";
+      sha256 = "1nyzqnl6wz7qxynbwwra7vlajm6hi5swfk52zrp6x1c62zj4blrd";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -38,10 +38,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1plks83m7pbvxg8dp7aw8706kv5rxsxgpmcxdzwz57gsqkirvc7w";
+      sha256 = "0vnmynck11qwzzza8knx63a8djsrz0f2cibdnk463nr19ghjdmbx";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  actionpack-xml_parser = {
    dependencies = ["actionpack" "railties"];
@ -60,10 +60,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ki290ng0xkbjhr5sgrd98p4ysvbjdgxv4aqrafabcs0axgfibkx";
+      sha256 = "1r2bdsbm6zl85fy9kaqspq34cfh4da69hxag5ahbncq5cicdvpn0";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -71,10 +71,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16diw7arrvrxlk04c6h46qzyyikl1jf18z5sgixvcqzz8sfqp7g0";
+      sha256 = "1hmw0ymn4f0x4yxb1wrbycjan0z72x1wgq9g9ljfmv3fd66a7dr3";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -82,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06r93sgvbyqlv6sjy97qqlpa671lni4cvb5gd208m6215xk7ds71";
+      sha256 = "1k0nmq5djwmhk61px5749x9i9m5cginz6z4kzz6ncifhmrc0q47i";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -93,10 +93,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13562p4p9wra5k07jxi9g1v0l0plkkavr0z5jr1iznf7yizms8nq";
+      sha256 = "132bbnhkax3fqxx26yswrr60fgizn506bkf7gr1m1x4p0lfrnban";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  activerecord = {
    dependencies = ["activemodel" "activesupport"];
@ -104,10 +104,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0x0nym941dhgh5q5p293y2jk2b4baxmcgs6xkc5vrsqf164jmq9p";
+      sha256 = "06mkkxbcqsyahmqc775niyc8bfbxvashy7davjx3fm1s8kpij5yv";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  activestorage = {
    dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel" "mini_mime"];
@ -115,10 +115,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0i6vr1vng0pdb1dy8g1yvsfi90ji4bw02d06i6jyfvy9jb66amh7";
+      sha256 = "1p6l6nk7krnvn7gz15v40w3m71d9avf5sw1n38xl2r95s3zy4fjv";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -126,10 +126,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09krayvf764y868qm0sy0ssmcjx5a7iksnbi7zx284jjggc574ry";
+      sha256 = "0w6l6fzi4nin364hfr5qbjrr70mgf3phk9cvjmjzgyvvg9w1z3iz";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -249,10 +249,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "149jknsq999gnhy865n33fkk22s0r447k76x9pmcnnwldfv2q7wp";
+      sha256 = "04d7l3xdmkybrd20gayf8s38pgfld0hf8m726lz9np32xnnsszrf";
      type = "gem";
    };
-    version = "3.3.4";
+    version = "3.4.0";
  };
  deckar01-task_list = {
    dependencies = ["html-pipeline"];
@ -353,10 +353,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1klf2mnfilzjqwcjdi5qb1zl3ghrifz1amcnvwjvsfnx9a5jb9ly";
+      sha256 = "0pkcvzvarzs5y87srla1m6rgng8mm7y4gnshlpawddsci3rlhd7b";
      type = "gem";
    };
-    version = "2.7.4";
+    version = "2.7.5";
  };
  language_server-protocol = {
    groups = ["default" "test"];
@ -609,10 +609,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cqs31cyg2zp8yx2zzm3zkih0j93q870wasbviy2w343nxqvn3pk";
+      sha256 = "0rbc2ggfw9cwscv1f9dl39a85vl5gysy7sprfagxlanxp01l8k5p";
      type = "gem";
    };
-    version = "3.3.5.0";
+    version = "3.3.5.1";
  };
  pg = {
    groups = ["default"];
@ -690,10 +690,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cj4sr7fw01ycfkqmpz6zr90zyfxl8yw9s6m0df47a71m56hjb21";
+      sha256 = "1lc8j6b4nvsxa5m86nxw4ydv3h21xw1m5rk0n43i9zlixjrr55l0";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  rails-dom-testing = {
    dependencies = ["activesupport" "minitest" "nokogiri"];
@ -723,10 +723,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04k6y7balxm5d1sq53rb613lm1bwxmmzavmxg1h9z6dnds2djylb";
+      sha256 = "02szdqfif0s34k2lwfj9pm06m2h6dkhc5ni021s2q5val4c7lvny";
      type = "gem";
    };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
  };
  rainbow = {
    groups = ["default" "test"];
@ -911,10 +911,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "03zywfpm4540q6hw8srhi8pzp0gg51w65ir8jkaw58vk3j31w820";
+      sha256 = "0dvmlnmz173xwvcijgmkibga4viwz8xnm36j6lnxp6nik5pphm47";
      type = "gem";
    };
-    version = "1.32.3";
+    version = "1.33.1";
  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
@ -985,10 +985,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1md0sixm8dq8a7riv50x4q1z273q47b5jvcbv5hxympxn3ran4by";
+      sha256 = "1406irn0zgxasqha9l64w7h2kjxivys7hagdlnk40n8fwpzjc15v";
      type = "gem";
    };
-    version = "4.25.0";
+    version = "4.26.0";
  };
  simplecov = {
    dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
@ -1108,10 +1108,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
+      sha256 = "0r79mir4phdmcx0l4yqfwfzdy8vgvrl4ym07585rd2b401bhrrcy";
      type = "gem";
    };
-    version = "1.8.2";
+    version = "1.9.0";
  };
  websocket = {
    groups = ["default" "test"];
--- a/pkgs/by-name/re/redmine/package.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby_3_2, makeWrapper, nixosTests }:

 let
-  version = "5.1.3";
+  version = "5.1.4";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

@ -16,7 +16,7 @@ in

    src = fetchurl {
      url = "https://www.redmine.org/releases/redmine-${version}.tar.gz";
-      hash = "sha256-iiIyD9nJQOZZjzrV+3o5MxlchgaO7plLpvzcIsXOy1k=";
+      hash = "sha256-9XONahB/IxuPSwrlQQ4MRXQtdeDvMMSzGifArJ2v1Rw=";
    };

    nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/Cargo.lock
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/Cargo.lock
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.3";

  src = fetchFromGitHub {
    owner = "pop-os";
-    repo = pname;
+    repo = "xdg-desktop-portal-cosmic";
    rev = "epoch-${version}";
-    hash = "sha256-MbcktIXkiH3uxQLduXF76ZGn2aoTd/D6xKeUM4M/btM=";
+    hash = "sha256-IlMcgzhli61QWjdovj5BpOxOebV3RytBeHPhxzWNXqg=";
  };

-  env.VERGEN_GIT_COMMIT_DATE = "2024-09-24";
+  env.VERGEN_GIT_COMMIT_DATE = "2024-10-10";
  env.VERGEN_GIT_SHA = src.rev;

  cargoLock = {
@ -30,11 +30,11 @@ rustPlatform.buildRustPackage rec {
      "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
      "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-bg-config-0.1.0" = "sha256-lAFAZBo5FnXgJV3MrZhaYmBxqtH1E7+Huj53ho/hPik=";
+      "cosmic-bg-config-0.1.0" = "sha256-bmcMZIURozlptsR4si62NTmexqaCX1Yj5bYj49GDehQ=";
      "cosmic-client-toolkit-0.1.0" = "sha256-1XtyEvednEMN4MApxTQid4eed19dEN5ZBDt/XRjuda0=";
-      "cosmic-config-0.1.0" = "sha256-gXrMEoAN+7nYAEcs4w6wROhQTjMCxkGn+muJutktLyk=";
-      "cosmic-files-0.1.0" = "sha256-rBR6IPpMgOltyaRPPZ5V8tYH/xtQphgrPWci/kvlgEg=";
-      "cosmic-settings-daemon-0.1.0" = "sha256-6cEgFfkBxEpIo8LsvKDR2khMdhEz/dp2oYJXXBiC9zg=";
+      "cosmic-config-0.1.0" = "sha256-XXT92zsdwkzx9dajSYlK6p/XPp6ajq9xJT504T1L4qU=";
+      "cosmic-files-0.1.0" = "sha256-eP6uLHxXpx+nNkEcROlqi0t3qRtU8vYITyt4JXtd7vw=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-mklNPKVMO6iFrxki2DwiL5K78KiWpGxksisYldaASIE=";
      "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
      "fs_extra-1.3.0" = "sha256-ftg5oanoqhipPnbUsqnA4aZcyHqn9XsINJdrStIPLoE=";
--- a/pkgs/by-name/ya/yabai/package.nix
+++ b/pkgs/by-name/ya/yabai/package.nix
@ -1,55 +1,33 @@
 {
  lib,
  stdenv,
-  overrideSDK,
  fetchFromGitHub,
  fetchzip,
-  installShellFiles,
-  testers,
-  writeShellScript,
+  apple-sdk_15,
  common-updater-scripts,
  curl,
-  darwin,
+  installShellFiles,
  jq,
-  xcodebuild,
+  versionCheckHook,
+  writeShellScript,
  xxd,
-  yabai,
 }:
-let
-  inherit (darwin.apple_sdk_11_0.frameworks)
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
-    ;
-
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "yabai";
-  version = "7.1.4";
+  version = "7.1.5";

  src =
    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

-  env = {
-    # silence service.h error
-    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-  };
-
  nativeBuildInputs =
    [ installShellFiles ]
    ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-      xcodebuild
      xxd
    ];

  buildInputs = lib.optionals stdenv.hostPlatform.isx86_64 [
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
+    apple-sdk_15
  ];

  dontConfigure = true;
@ -74,35 +52,27 @@ stdenv'.mkDerivation (finalAttrs: {
        # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
        # Since multilib doesn't work on darwin i dont know of a better way of handling this.
        substituteInPlace makefile \
-        --replace "-arch arm64e" "" \
-        --replace "-arch arm64" "" \
-        --replace "clang" "${stdenv.cc.targetPrefix}clang"
-
-        # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks aren't packaged.
-        # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compile time.
-        # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
-        substituteInPlace src/workspace.m \
-        --replace 'return screen.safeAreaInsets.top;' 'return 0;'
+        --replace-fail "-arch arm64e" "" \
+        --replace-fail "-arch arm64" ""
      '';

-  passthru = {
-    tests.version = testers.testVersion {
-      package = yabai;
-      version = "yabai-v${finalAttrs.version}";
-    };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;

+  passthru = {
    sources = {
      # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
      "aarch64-darwin" = fetchzip {
        url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-DAHZwEhPIBIfR2V+jTKje1msB8OMKzwGYgYnDql8zb0=";
+        hash = "sha256-o+9Z3Kxo1ff1TZPmmE6ptdOSsruQzxZm59bdYvhRo3c=";
      };
      "x86_64-darwin" = fetchFromGitHub {
        owner = "koekeishiya";
        repo = "yabai";
        rev = "v${finalAttrs.version}";
-        hash = "sha256-i/UqmBNTLBYY4ORI1Y7FWr+LZK0f/qMdWLPPuTb9+2w=";
+        hash = "sha256-6HBWJvjVWagtHrfjWaYSRcnQOuwTBVeVxo3wc+jSlyE=";
      };
    };

--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@ -22,7 +22,7 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-gsconnect";
-  version = "57";
+  version = "58";

  outputs = [ "out" "installedTests" ];

@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    owner = "GSConnect";
    repo = "gnome-shell-extension-gsconnect";
    rev = "v${version}";
-    hash = "sha256-0o5CEkdFPL7bZkHIA/zFWB8sY1OYROl4P3rl24+lze0=";
+    hash = "sha256-bpy4G+f3NJ2iVsycPluV+98at0G2wlp7t5cPEMGM90s=";
  };

  patches = [
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -307,8 +307,8 @@ in {
  };

  ruby_3_2 = generic {
-    version = rubyVersion "3" "2" "4" "";
-    hash = "sha256-xys8XDBILcoYsPhoyQdfP0fYFo6vYm1OaCzltZyFhpI=";
+    version = rubyVersion "3" "2" "5" "";
+    hash = "sha256-7wYQtJj2D7XP13tRrbPBD0yo7ZoXy4fGHlvqMUrDShY=";
    cargoHash = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
  };

--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@ -3,7 +3,7 @@
 stdenv.mkDerivation rec
 {
  pname = "openvdb";
-  version = "11.0.0";
+  version = "12.0.0";

  outputs = [ "out" "dev" ];

@ -11,7 +11,7 @@ stdenv.mkDerivation rec
    owner = "AcademySoftwareFoundation";
    repo = "openvdb";
    rev = "v${version}";
-    sha256 = "sha256-wDDjX0nKZ4/DIbEX33PoxR43dJDj2NF3fm+Egug62GQ=";
+    sha256 = "sha256-S2uvzDCrTxAmvUMJr5PChcYTqhIHvRZbOfQLtUvzypI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@ -12,6 +12,7 @@
  requests,
  setuptools-scm,
  setuptools,
+  stdenv,
  whoosh,
 }:

@ -41,6 +42,9 @@ buildPythonPackage rec {
    elasticsearch = [ elasticsearch ];
  };

+  # tests fail and get stuck on darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
  nativeCheckInputs = [
    geopy
    pysolr
--- a/pkgs/development/python-modules/easy-thumbnails/default.nix
+++ b/pkgs/development/python-modules/easy-thumbnails/default.nix
@ -2,42 +2,63 @@
  lib,
  buildPythonPackage,
  django,
-  fetchPypi,
+  fetchFromGitHub,
  pillow,
  pythonOlder,
  reportlab,
  svglib,
+  pytestCheckHook,
+  pytest-django,
+  setuptools,
+  testfixtures,
 }:

 buildPythonPackage rec {
  pname = "easy-thumbnails";
-  version = "2.10";
-  format = "setuptools";
+  version = "2.10.0";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0AlGL815Ht8kluXtRtBEcS4aBrfUYA5M8oEgAumQTvU=";
+  src = fetchFromGitHub {
+    owner = "SmileyChris";
+    repo = "easy-thumbnails";
+    rev = "refs/tags/${version}";
+    hash = "sha256-8JTHYQIBbu/4fknK2ZEQeDSgaxKGDfflxumcFMpaGQk=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    django
    pillow
-    svglib
    reportlab
+    svglib
  ];

-  # Tests require a Django instance which is setup
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  checkInputs = [ testfixtures ];
+
+  disabledTests = [
+    # AssertionError: 'ERROR' != 'INFO'
+    "test_postprocessor"
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="easy_thumbnails.tests.settings"
+  '';

  pythonImportsCheck = [ "easy_thumbnails" ];

-  meta = with lib; {
+  meta = {
    description = "Easy thumbnails for Django";
    homepage = "https://github.com/SmileyChris/easy-thumbnails";
    changelog = "https://github.com/SmileyChris/easy-thumbnails/blob/${version}/CHANGES.rst";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
  };
 }
--- a/pkgs/development/python-modules/httpie/default.nix
+++ b/pkgs/development/python-modules/httpie/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "httpie";
-  version = "3.2.3";
+  version = "3.2.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "httpie";
    repo = "httpie";
    rev = "refs/tags/${version}";
-    hash = "sha256-ogUqhMVY1fm+hKCMFYqfYsqHX+Gj6y8CMOUsxA3q29g=";
+    hash = "sha256-uZKkUUrPPnLHPHL8YrZgfsyCsSOR0oZ2eFytiV0PIUY=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/mando/default.nix
+++ b/pkgs/development/python-modules/mando/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "mando";
-  version = "0.7.1";
+  version = "0.8.2";

  pyproject = true;

@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "rubik";
    repo = "mando";
    rev = "v${version}";
-    hash = "sha256-Ylrrfo57jqGuWEqCa5RyTT9AagBpUvAfviHkyJPFv08=";
+    hash = "sha256-FuQZ53ojrQO++0TN0C3hk0LXH+mcfRqtGq8VvfYDufg=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1257";
+  version = "3.0.1259";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-HjOU8gn1T6TXnAd0fM8dgc3tz8hUgyHzsQjgISYD1qE=";
+    hash = "sha256-4jjUgUnZrCMDiGbV2keZGIRhqI9BD7BZqfYNWMnZX4E=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@ -6,6 +6,7 @@
  click,
  click-option-group,
  fetchPypi,
+  hatch-vcs,
  hatchling,
  hypothesis,
  jinja2,
@ -15,7 +16,6 @@
  tomli,
  typing-extensions,
 }:
-
 buildPythonPackage rec {
  pname = "typed-settings";
  version = "24.5.0";
@ -53,6 +53,8 @@ buildPythonPackage rec {
    pydantic = [ pydantic ];
  };

+  nativeBuildInputs = [ hatch-vcs ];
+
  nativeCheckInputs = [
    hypothesis
    pytestCheckHook
--- a/pkgs/development/python-modules/uamqp/clang-fix-incompatible-function-pointer-conversion.patch
+++ b/pkgs/development/python-modules/uamqp/clang-fix-incompatible-function-pointer-conversion.patch
@ -1,13 +0,0 @@
-diff --git a/src/message_receiver.pyx b/src/message_receiver.pyx
-index b99647c..479cc9c 100644
--- a/src/message_receiver.pyx
-+++ b/src/message_receiver.pyx
-@@ -120,7 +120,7 @@ cdef class cMessageReceiver(StructBase):
- 
- #### Callbacks (context is a MessageReceiver instance)
- 
-cdef void on_message_receiver_state_changed(void* context, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG new_state, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG previous_state):
-+cdef void on_message_receiver_state_changed(const void* context, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG new_state, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG previous_state):
-     if context != NULL:
-         context_pyobj = <PyObject*>context
-         if context_pyobj.ob_refcnt == 0: # context is being garbage collected, skip the callback
--- a/pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch
+++ b/pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch
@ -1,37 +0,0 @@
-From 52ab2095649b5951e6af77f68954209473296983 Mon Sep 17 00:00:00 2001
-From: Sandro <sandro.jaeckel@gmail.com>
-Date: Sat, 16 Jan 2021 15:54:05 +0100
-Subject: [PATCH] Fix finding apple libraries
-
---
- CMakeLists.txt | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
- 
-
-(rejected by upstream in https://github.com/Azure/azure-c-shared-utility/pull/499,
-seems problem it's solving is nixpkgs-specific)
-
-diff --git a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-index 7bbfa6f3f..3567b18bc 100644
--- a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-+++ b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-@@ -120,8 +120,9 @@ endif()
- 
- if(${use_applessl})
-     # MACOSX only has native tls and open ssl, so use the native apple tls
-    find_library(cf_foundation Foundation)
-+    find_library(cf_foundation CoreFoundation)
-     find_library(cf_network CFNetwork)
-+    find_library(cf_security Security)
- endif()
- 
- if(${no_logging})
-@@ -581,7 +582,7 @@ endif()
- 
- 
- if(${use_applessl})
-    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network})
-+    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network} ${cf_security})
- endif()
- 
- if(WIN32)
--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@ -3,8 +3,9 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  fetchpatch,
-  cython_0,
+  fetchpatch2,
+  setuptools,
+  cython,
  certifi,
  CFNetwork,
  cmake,
@ -17,41 +18,23 @@

 buildPythonPackage rec {
  pname = "uamqp";
-  version = "1.6.9";
-  format = "setuptools";
+  version = "1.6.11";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-uamqp-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sDRIM41zey1F6/x1ZioJJBAQCVyf1NKzhS82Ew08pgM=";
+    hash = "sha256-HTIOHheCrvyI7DwA/UcUXk/fbesd29lvUvJ9TAeG3CE=";
  };

-  patches =
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      ./darwin-azure-c-shared-utility-corefoundation.patch
-    ]
-    ++ [
-      (fetchpatch {
-        name = "CVE-2024-25110.patch";
-        url = "https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695.patch";
-        stripLen = 1;
-        extraPrefix = "src/vendor/azure-uamqp-c/";
-        hash = "sha256-igzZqTLUUyuNcpCUbYHI4RXmWxg+7EC/yyD4DBurR2M=";
-      })
-      (fetchpatch {
-        name = "CVE-2024-27099.patch";
-        url = "https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987.patch";
-        stripLen = 1;
-        extraPrefix = "src/vendor/azure-uamqp-c/";
-        # other files are just tests which aren't run from the python
-        # builder anyway
-        includes = [ "src/vendor/azure-uamqp-c/src/link.c" ];
-        hash = "sha256-EqDfG1xAz5CG8MssSSrz8Yrje5qwF8ri1Kdw+UUu5ms=";
-      })
-      # Fix incompatible function pointer conversion error with clang 16.
-      ./clang-fix-incompatible-function-pointer-conversion.patch
-    ];
+  patches = [
+    (fetchpatch2 {
+      name = "fix-clang16-compatibility.patch";
+      url = "https://github.com/Azure/azure-uamqp-python/commit/bd6d9ef5a8bca3873e1e66218fd09ca787b8064e.patch";
+      hash = "sha256-xtnIVjB71EPJp/QjLQWctcSDds5s6n4ut+gnvp3VMlM=";
+    })
+  ];

  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isx86_64) ''
    # force darwin aarch64 to use openssl instead of applessl, removing
@ -69,9 +52,13 @@ buildPythonPackage rec {
      src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
  '';

+  build-system = [
+    cython
+    setuptools
+  ];
+
  nativeBuildInputs = [
    cmake
-    cython_0
  ];

  buildInputs =
@ -82,7 +69,7 @@ buildPythonPackage rec {
      Security
    ];

-  propagatedBuildInputs = [ certifi ];
+  dependencies = [ certifi ];

  dontUseCmakeConfigure = true;

--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "xmlschema";
-  version = "3.4.2";
+  version = "3.4.3";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "sissaschool";
    repo = "xmlschema";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0x8nk8F+kg5SSDQI4dOnv67ilyN4z2MZ5phPC3PW4WQ=";
+    hash = "sha256-7RA9lQwuty8aZghwTKNbU+oL+BATH2FVIRQBe9fIpHI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:

 stdenvNoCC.mkDerivation rec {
-  version = "10.18.2";
+  version = "10.20.0";
  pname = "checkstyle";

  src = fetchurl {
    url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-VRbCJ+XYJLBrD90tMkJmevOu07t7K8LvcZ96NSjflb4=";
+    sha256 = "sha256-WvC5UyLxW1WHlVRs0Ll2kGwXM/9Z98qdYtjKaG2w5is=";
  };

  nativeBuildInputs = [ makeBinaryWrapper ];
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@ -10,14 +10,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "conan";
-  version = "2.5.0";
+  version = "2.9.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "conan-io";
    repo = "conan";
    rev = "refs/tags/${version}";
-    hash = "sha256-4GCLmPEoCX1Cw+H6Bo1KA4+9GX35HgONAmMF/WNX6ag=";
+    hash = "sha256-1KKXOvoSAemzafWvBoYFtxqgSObHcXe3GVPgG25VNm0=";
  };

  nativeBuildInputs = with python3.pkgs; [
@ -88,9 +88,8 @@ python3.pkgs.buildPythonApplication rec {

  disabledTestPaths = [
    # Requires cmake, meson, autotools, apt-get, etc.
-    "test/functional/command/new_test.py"
+    "test/functional/command/runner_test.py"
    "test/functional/command/test_install_deploy.py"
-    "test/functional/graph/test_transitive_build_scripts.py"
    "test/functional/layout/test_editable_cmake.py"
    "test/functional/layout/test_editable_cmake_components.py"
    "test/functional/layout/test_in_subfolder.py"
@ -102,7 +101,6 @@ python3.pkgs.buildPythonApplication rec {
    "test/functional/tools/system/package_manager_test.py"
    "test/functional/tools_versions_test.py"
    "test/functional/util/test_cmd_args_to_string.py"
-    "test/integration/command/runner_test.py"
    "test/integration/command/user_test.py"
    "test/integration/command_v2/list_test.py"
    "test/performance/test_large_graph.py"
--- a/pkgs/development/tools/build-managers/gn/default.nix
+++ b/pkgs/development/tools/build-managers/gn/default.nix
@ -1,4 +1,4 @@
-{ callPackage, ... } @ args:
+{ callPackage, ... }@args:

 callPackage ./generic.nix args {
  # Note: Please use the recommended version for Chromium stabe, i.e. from
--- a/pkgs/development/tools/build-managers/gn/generic.nix
+++ b/pkgs/development/tools/build-managers/gn/generic.nix
@ -1,9 +1,22 @@
-{ stdenv, lib, fetchgit, fetchpatch, cctools, darwin, writeText
-, ninja, python3
-, ...
+{
+  stdenv,
+  lib,
+  fetchgit,
+  fetchpatch,
+  cctools,
+  darwin,
+  writeText,
+  ninja,
+  python3,
+  ...
 }:

-{ rev, revNum, version, sha256 }:
+{
+  rev,
+  revNum,
+  version,
+  sha256,
+}:

 let
  revShort = builtins.substring 0 7 rev;
@ -17,7 +30,8 @@ let
    #endif  // OUT_LAST_COMMIT_POSITION_H_
  '';

-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
  pname = "gn-unstable";
  inherit version;

@ -36,16 +50,23 @@ in stdenv.mkDerivation {
    })
  ];

-  nativeBuildInputs = [ ninja python3 ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (with darwin; with apple_sdk.frameworks; [
-    libobjc
-    cctools
+  nativeBuildInputs = [
+    ninja
+    python3
+  ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
+    with darwin;
+    with apple_sdk.frameworks;
+    [
+      libobjc
+      cctools

-    # frameworks
-    ApplicationServices
-    Foundation
-    AppKit
-  ]);
+      # frameworks
+      ApplicationServices
+      Foundation
+      AppKit
+    ]
+  );

  env.NIX_CFLAGS_COMPILE = "-Wno-error";

@ -67,6 +88,10 @@ in stdenv.mkDerivation {
    homepage = "https://gn.googlesource.com/gn";
    license = licenses.bsd3;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ stesie matthewbauer primeos ];
+    maintainers = with maintainers; [
+      stesie
+      matthewbauer
+      primeos
+    ];
  };
 }
--- a/pkgs/development/tools/build-managers/gn/rev1924.nix
+++ b/pkgs/development/tools/build-managers/gn/rev1924.nix
@ -1,8 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix args {
-  rev = "24e2f7df92641de0351a96096fb2c490b2436bb8";
-  revNum = "1924"; # git describe HEAD --match initial-commit | cut -d- -f3
-  version = "2021-08-08";
-  sha256 = "1lwkyhfhw0zd7daqz466n7x5cddf0danr799h4jg3s0yvd4galjl";
-}
--- a/pkgs/development/web/edge-runtime/librusty_v8.nix
+++ b/pkgs/development/web/edge-runtime/librusty_v8.nix
@ -1,22 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-let
-  fetch_librusty_v8 = args: fetchurl {
-    name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
-    sha256 = args.shas.${stdenv.hostPlatform.system};
-    meta = {
-      inherit (args) version;
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    };
-  };
-in
-fetch_librusty_v8 {
-  version = "0.83.2";
-  shas = {
-    x86_64-linux = "sha256-RJNdy5jRZK3dTgrHsWuZZAHUyy1EogyNNuBekZ3Arrk=";
-    aarch64-linux = "sha256-mpOmuqtd7ob6xvrgH4P/6GLa/hXTS/ok0WOYo7+7ZhI=";
-    x86_64-darwin = "sha256-2o8CvJ3r5+4PLNGTySqPPDTqbU0piX4D1UtZMscMdHU=";
-    aarch64-darwin = "sha256-WHeITWSHjZxfQJndxcjsp4yIERKrKXSHFZ0UBc43p8o=";
-  };
-}
--- a/pkgs/kde/misc/oxygen-icons/default.nix
+++ b/pkgs/kde/misc/oxygen-icons/default.nix
@ -5,11 +5,11 @@
 }:
 mkKdeDerivation rec {
  pname = "oxygen-icons";
-  version = "6.0.0";
+  version = "6.1.0";

  src = fetchurl {
    url = "mirror://kde/stable/oxygen-icons/oxygen-icons-${version}.tar.xz";
-    hash = "sha256-KOwYKHXcwV2SePRc7RECaqOSR28fRUhxueLINwCOV3Q=";
+    hash = "sha256-FsqXEHnFBnxFB8q/G2GdyH3Wsyb9XC3Z9dQ4EPIXTWg=";
  };

  dontStrip = true;
--- a/pkgs/kde/misc/pulseaudio-qt/default.nix
+++ b/pkgs/kde/misc/pulseaudio-qt/default.nix
@ -7,11 +7,11 @@
 }:
 mkKdeDerivation rec {
  pname = "pulseaudio-qt";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchurl {
    url = "mirror://kde/stable/pulseaudio-qt/pulseaudio-qt-${version}.tar.xz";
-    hash = "sha256-G+y62ss2qdakMaDJPNtCj49n83zy0jdoZ1mDMYwK3oQ=";
+    hash = "sha256-8hvzDy/z5nDSBG+WYGncI/XmU/9Wus24kgwTdCZMvB4=";
  };

  extraNativeBuildInputs = [ pkg-config ];
--- a/pkgs/misc/logging/pacemaker/default.nix
+++ b/pkgs/misc/logging/pacemaker/default.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "pacemaker";
-  version = "2.1.8";
+  version = "2.1.9";

  src = fetchFromGitHub {
    owner = "ClusterLabs";
    repo = pname;
    rev = "Pacemaker-${version}";
-    sha256 = "sha256-J57+NSs4cL3BlEjSaXAoUTEhbMMxhWy8sUZ/K3x2nRM=";
+    sha256 = "sha256-L/LQS5XLps0pqTfMAh1ZiR00SVltrNxMl6DXQhXBw1Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch
@ -0,0 +1,81 @@
+From 197b10de54b53a089ad549f2e00787b4fa719210 Mon Sep 17 00:00:00 2001
+From: Artemis Tosini <me@artem.ist>
+Date: Sat, 2 Nov 2024 07:50:13 +0000
+Subject: [PATCH] HACK: bsd.lib.mk: Treat empty SHLIB_NAME as nonexistant
+
+Unsetting SHLIB_NAME in nix package definitions is a pain
+but we can easily set it to be empty. This is useful when
+building static libraries without unneeded static libraries.
+---
+ share/mk/bsd.lib.mk | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
+index 5f328d5378ca..89d16dc6fa41 100644
+--- a/share/mk/bsd.lib.mk
+++ b/share/mk/bsd.lib.mk
+@@ -242,7 +242,7 @@ PO_FLAG=-pg
+ _LIBDIR:=${LIBDIR}
+ _SHLIBDIR:=${SHLIBDIR}
+ 
+-.if defined(SHLIB_NAME)
+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if ${MK_DEBUG_FILES} != "no"
+ SHLIB_NAME_FULL=${SHLIB_NAME}.full
+ # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
+@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
+ .endif
+ .endif
+ 
+-.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
+.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
+ OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
+ BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
+ LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
+@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
+ CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
+ .endif
+ 
+-.if defined(SHLIB_NAME) || \
+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ SOBJS+=		${OBJS:.o=.pico}
+ DEPENDOBJS+=	${SOBJS}
+ CLEANFILES+=	${SOBJS}
+ .endif
+ 
+-.if defined(SHLIB_NAME)
+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ _LIBS+=		${SHLIB_NAME}
+ 
+ SOLINKOPTS+=	-shared -Wl,-x
+@@ -435,7 +435,7 @@ all: all-man
+ CLEANFILES+=	${_LIBS}
+ 
+ _EXTRADEPEND:
+-.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
+.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if defined(DPADD) && !empty(DPADD)
+ 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
+ .endif
+@@ -501,7 +501,7 @@ _libinstall:
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif
+-.if defined(SHLIB_NAME)
+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ 	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
+ 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
+@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
+ .endfor
+ .endif
+-.if defined(SHLIB_NAME) || \
+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ .for _S in ${SRCS:N*.[hly]}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
+-- 
+2.46.1
+
--- a/pkgs/os-specific/bsd/freebsd/pkgs/init.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/init.nix
@ -1,7 +1,9 @@
-{ mkDerivation }:
+{ mkDerivation, stdenv }:
 mkDerivation {
  path = "sbin/init";
  extraPaths = [ "sbin/mount" ];
  NO_FSCHG = "yes";
  MK_TESTS = "no";
+
+  meta.broken = !stdenv.hostPlatform.isStatic;
 }
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
@ -116,6 +116,13 @@ mkDerivation {
        --replace '/usr/share/i18n' '${builtins.placeholder "out"}/share/i18n'
  '';

+  # NIX_CFLAGS_LINK is empty at this point except when building static,
+  # in which case the stdenv adapter adds the `-static` flag.
+  # Building with `-static` set causes linker errors.
+  postConfigure = ''
+    export NIX_CFLAGS_LINK=
+  '';
+
  nativeBuildInputs = [
    bsdSetupHook
    freebsdSetupHook
@ -194,7 +201,7 @@ mkDerivation {
      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags
      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags install

-      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # not sure
+      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # otherwise these dynamic libraries try to link with libc.a
      mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
@ -266,6 +273,13 @@ mkDerivation {
      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags install
      rm -f $out/libexec/ld-elf.so.1
      mv $out/bin/ld-elf.so.1 $out/libexec
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+      mkdir $out/lib/keep_static
+      mv $out/lib/*_nonshared.a $out/lib/libgcc*.a $out/lib/libcompiler_rt.a $out/lib/keep_static
+      rm $out/lib/*.a
+      mv $out/lib/keep_static/* $out/lib
+      rmdir $out/lib/keep_static
    '';

  # libc should not be allowed to refer to anything other than itself
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
@ -1,4 +1,8 @@
-{ mkDerivation }:
+{
+  mkDerivation,
+  stdenv,
+  lib,
+}:
 # this package is quite different from stock libcxxrt.
 # as of FreeBSD 14.0, it is vendored from APPROXIMATELY libcxxrt
 # 5d8a15823a103bbc27f1bfdcf2b5aa008fab57dd, though the vendoring mechanism is
@ -8,11 +12,14 @@ mkDerivation {
  pname = "libcxxrt";
  path = "lib/libcxxrt";
  extraPaths = [ "contrib/libcxxrt" ];
-  outputs = [
-    "out"
-    "dev"
-    "debug"
-  ];
+  outputs =
+    [
+      "out"
+      "dev"
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
+      "debug"
+    ];
  noLibcxx = true;
  libName = "cxxrt";
 }
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@ -58,9 +58,12 @@ lib.makeOverridable (

      HOST_SH = stdenv'.shell;

-      makeFlags = [
-        "STRIP=-s" # flag to install, not command
-      ] ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no";
+      makeFlags =
+        [
+          "STRIP=-s" # flag to install, not command
+        ]
+        ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no"
+        ++ lib.optional stdenv.hostPlatform.isStatic "SHLIB_NAME=";

      # amd64 not x86_64 for this on unlike NetBSD
      MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@ -321,7 +321,7 @@ let
      description = "Powerful, open source object-relational database system";
      license     = licenses.postgresql;
      changelog   = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
-      maintainers = with maintainers; [ thoughtpolice danbst globin ivan ma27 wolfgangwalther ];
+      maintainers = with maintainers; [ globin ivan ] ++ teams.postgres.members;
      pkgConfigModules = [ "libecpg" "libecpg_compat" "libpgtypes" "libpq" ];
      platforms   = platforms.unix;

--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -171,6 +171,9 @@ self: super:
  libAppleWM = super.libAppleWM.overrideAttrs (attrs: {
    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
    buildInputs =  attrs.buildInputs ++ [ xorg.utilmacros ];
+    meta = attrs.meta // {
+      platforms = lib.platforms.darwin;
+    };
  });

  libXau = super.libXau.overrideAttrs (attrs: {
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
    "bash_cv_getcwd_malloc=yes"
    # This check cannot be performed when cross compiling. The "yes"
    # default is fine for static linking on Linux (weak symbols?) but
-    # not with OpenBSD, when it does clash with the regular `getenv`.
-    "bash_cv_getenv_redef=${if !(with stdenv.hostPlatform; isStatic && isOpenBSD) then "yes" else "no"}"
+    # not with BSDs, when it does clash with the regular `getenv`.
+    "bash_cv_getenv_redef=${if !(with stdenv.hostPlatform; isStatic && (isOpenBSD || isFreeBSD)) then "yes" else "no"}"
  ] ++ lib.optionals stdenv.hostPlatform.isCygwin [
    "--without-libintl-prefix"
    "--without-libiconv-prefix"
--- a/pkgs/tools/text/xurls/default.nix
+++ b/pkgs/tools/text/xurls/default.nix
@ -1,19 +1,26 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+}:

-buildGoModule rec {
+buildGoModule {
  pname = "xurls";
-  version = "2.5.0";
+  version = "2.5.0-unstable-2024-11-03";

  src = fetchFromGitHub {
    owner = "mvdan";
    repo = "xurls";
-    rev = "v${version}";
-    sha256 = "sha256-9hPXZ/t15+LG9fji1gyeWhUrYOr6eGyKYg3a1SmHJpQ=";
+    rev = "7c973a26c7bd6ecd8d86bb435d93ff98df2710fa";
+    sha256 = "sha256-jZmlM9rs+N0ks7msmb3eJ96aTYp0qUo/1bgLAgHnvSo=";
  };

-  vendorHash = "sha256-eVK7qU+NWsarBsEpg6aGow/urmhIpU3Z9RwoTvSymXo=";
+  vendorHash = "sha256-W6Z1E6a+qBdOuyHoiT6YA+CAJHBJ0FTYH8AntiKvVBY=";

-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];

  meta = with lib; {
    description = "Extract urls from text";
--- a/pkgs/tools/typesetting/hayagriva/default.nix
+++ b/pkgs/tools/typesetting/hayagriva/default.nix
@ -5,14 +5,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "hayagriva";
-  version = "0.6.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-ic1ohp0zmiFgfNSfI6XRL/3CJ2p+afW4IAEz2l4CL8Q=";
+    hash = "sha256-B0q5jwJVDpxywTuSspsfDameDfEkok5oTz/Oty9LkOI=";
  };

-  cargoHash = "sha256-G3rBvFzlp3Dg/k6BILNH6xNX+i9mEv9muZOiGkcad38=";
+  cargoHash = "sha256-N+3W4x5p5qas47uwVT0NrJNe9udE+0rQLx/ypo1pbR4=";

  buildFeatures = [ "cli" ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -473,6 +473,7 @@ mapAliases {
  gnuradio3_9 = throw "gnuradio3_9 has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
  gnuradio3_9Minimal = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
  gnuradio3_9Packages = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
+  gn1924 = throw "gn1924 has been removed because it was broken and no longer used by envoy."; # Added 2024-11-03
  gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17
  gradle_6 = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30
  gradle_6-unwrapped = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -597,8 +597,6 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
  };

-  edge-runtime = callPackage ../development/web/edge-runtime { };
-
  efficient-compression-tool = callPackage ../tools/compression/efficient-compression-tool { };

  eludris = callPackage ../tools/misc/eludris {
@ -2791,9 +2789,7 @@ with pkgs;

  ### APPLICATIONS/TERMINAL-EMULATORS

-  alacritty = callPackage ../applications/terminal-emulators/alacritty {
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
-  };
+  alacritty = callPackage ../applications/terminal-emulators/alacritty { };

  blackbox-terminal = callPackage ../applications/terminal-emulators/blackbox-terminal { };

@ -5261,8 +5257,6 @@ with pkgs;

  jwx = callPackage ../tools/security/jwx { } ;

-  kapacitor = callPackage ../servers/monitoring/kapacitor { };
-
  karma = callPackage ../servers/monitoring/karma { };

  kaldi = callPackage ../tools/audio/kaldi {
@ -17893,7 +17887,6 @@ with pkgs;
  nimbo = with python3Packages; callPackage ../applications/misc/nimbo { };

  gn = callPackage ../development/tools/build-managers/gn { };
-  gn1924 = callPackage ../development/tools/build-managers/gn/rev1924.nix { };

  nixbang = callPackage ../development/tools/misc/nixbang {
    pythonPackages = python3Packages;
@ -30201,8 +30194,6 @@ with pkgs;

  kotatogram-desktop = callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop { };

-  kotatogram-desktop-with-webkit = callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix { };
-
  kpt = callPackage ../applications/networking/cluster/kpt { };

  krabby = callPackage ../applications/misc/krabby { };