From b4878419ee2ca05c740505bacd7eb3e2b4beab24 Mon Sep 17 00:00:00 2001
From: NotAShelf <raf@notashelf.dev>
Date: Wed, 11 Sep 2024 13:08:22 +0300
Subject: [PATCH 01/38] nixos/wakapi: add database options; gate db creation
 behind database.createLocally

Currently the NixOS module for Wakapi will create the database
automagically if the user has database dialect configured in the Wakapi
configuration file. By all means, this is undocumented behaviour and an
anti-feature.

This MR adds a database.createLocally option that allows the end-user to
create auto-creation behaviour, and lays out groundwork for automated
database setups for different database dialects supported by Wakapi.
---
 nixos/modules/services/web-apps/wakapi.nix | 80 ++++++++++++++++++++--
 1 file changed, 75 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
index 2dbfb6d9b3d5..b818c8083e87 100644
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -66,6 +66,60 @@ in
         The path to a file containing the password for the smtp mailer used by Wakapi.
       '';
     };
+
+    database = {
+      createLocally = mkEnableOption ''
+        automatic database configuration.
+
+        ::: {.note}
+        Only PostgreSQL is supported for the time being.
+        :::
+      '';
+
+      dialect = mkOption {
+        type = types.nullOr (
+          types.enum [
+            "postgres"
+            "sqlite3"
+            "mysql"
+            "cockroach"
+            "mssql"
+          ]
+        );
+        default = cfg.settings.db.dialect or null; # handle case where dialect is not set
+        defaultText = ''
+          Database dialect from settings if {option}`services.wakatime.settings.db.dialect`
+          is set, or `null` otherwise.
+        '';
+        description = ''
+          The database type to use for Wakapi.
+        '';
+      };
+
+      name = mkOption {
+        type = types.str;
+        default = cfg.settings.db.name or "wakapi";
+        defaultText = ''
+          Database name from settings if {option}`services.wakatime.settings.db.name`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the database to use for Wakapi.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = cfg.settings.db.user or "wakapi";
+        defaultText = ''
+          User from settings if {option}`services.wakatime.settings.db.user`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the user to use for Wakapi.
+        '';
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -73,10 +127,10 @@ in
       description = "Wakapi (self-hosted WakaTime-compatible backend)";
       wants = [
         "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
       after = [
         "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
       wantedBy = [ "multi-user.target" ];
 
       script = ''
@@ -134,6 +188,19 @@ in
         assertion = cfg.smtpPassword != null -> cfg.smtpPasswordFile != null;
         message = "Both `services.wakapi.smtpPassword` `services.wakapi.smtpPasswordFile` should not be set at the same time.";
       }
+      {
+        assertion = cfg.db.createLocally -> cfg.db.dialect != null;
+        message = "`services.wakapi.database.createLocally` is true, but a database dialect is not set!";
+      }
+    ];
+
+    warnings = [
+      (lib.optionalString (cfg.db.createLocall -> cfg.db.dialect != "postgres") ''
+        You have enabled automatic database configuration, but the database dialect is not set to "posgres".
+
+        The Wakapi module only supports for PostgreSQL. Please set `services.wakapi.database.createLocally`
+        to `false`, or switch to "postgres" as your database dialect.
+      '')
     ];
 
     users = {
@@ -145,10 +212,10 @@ in
       groups.wakapi = { };
     };
 
-    services.postgresql = mkIf (cfg.settings.db.dialect == "postgres") {
+    services.postgresql = mkIf (cfg.database.createLocally && cfg.database.dialect == "postgres") {
       enable = true;
 
-      ensureDatabases = singleton cfg.settings.db.name;
+      ensureDatabases = singleton cfg.database.name;
       ensureUsers = singleton {
         name = cfg.settings.db.user;
         ensureDBOwnership = true;
@@ -160,5 +227,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ isabelroses ];
+  meta.maintainers = with lib.maintainers; [
+    isabelroses
+    NotAShelf
+  ];
 }

From 19c568f3871fd91cbef1fd89f37de6dd2c772634 Mon Sep 17 00:00:00 2001
From: pcasaretto <pcasaretto@gmail.com>
Date: Sun, 28 Jul 2024 18:17:53 -0300
Subject: [PATCH 02/38] imhex: add support for darwin

Co-authored-by: Anderson Torres <torres.anderson.85@protonmail.com>
---
 pkgs/by-name/im/imhex/package.nix | 105 ++++++++++++++++++++++--------
 pkgs/top-level/all-packages.nix   |   4 --
 2 files changed, 78 insertions(+), 31 deletions(-)

diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index 55283031e79d..2e4ad286a1a0 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   cmake,
-  llvm,
+  darwin,
+  fetchpatch,
+  llvmPackages_17,
   fetchFromGitHub,
   mbedtls,
   gtk3,
@@ -21,13 +23,24 @@
   nlohmann_json,
   yara,
   rsync,
+  nix-update-script,
   autoPatchelfHook,
+  makeWrapper,
+  overrideSDK,
 }:
 
 let
   version = "1.35.4";
   patterns_version = "1.35.4";
 
+  llvmPackages = llvmPackages_17;
+
+  stdenv' =
+    let
+      baseStdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+    in
+    if stdenv.isDarwin then overrideSDK baseStdenv "11.0" else baseStdenv;
+
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
     owner = "WerWolv";
@@ -37,7 +50,7 @@ let
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv'.mkDerivation (finalAttrs: {
   pname = "imhex";
   inherit version;
 
@@ -46,20 +59,39 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
     owner = "WerWolv";
     repo = "ImHex";
-    rev = "refs/tags/v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
     hash = "sha256-6QpmFkSMQpGlEzo7BHZn20c+q8CTDUB4yO87wMU5JT4=";
   };
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    cmake
-    llvm
-    python3
-    perl
-    pkg-config
-    rsync
+  patches = [
+    # https://github.com/WerWolv/ImHex/pull/1910
+    # during https://github.com/NixOS/nixpkgs/pull/330303 it was discovered that ImHex
+    # would not build on Darwin x86-64
+    # this temporary patch can be removed when the above PR is merged
+    (fetchpatch {
+      url = "https://github.com/WerWolv/ImHex/commit/69624a2661ea44db9fb8b81c3278ef69016ebfcf.patch";
+      hash = "sha256-LcUCl8Rfz6cbhop2StksuViim2bH4ma3/8tGVKFdAgg=";
+    })
   ];
 
+  # Comment out fixup_bundle in PostprocessBundle.cmake as we are not building a standalone application
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/PostprocessBundle.cmake \
+      --replace-fail "fixup_bundle" "#fixup_bundle"
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      llvmPackages.llvm
+      python3
+      perl
+      pkg-config
+      rsync
+    ]
+    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ]
+    ++ lib.optionals stdenv.isDarwin [ makeWrapper ];
+
   buildInputs = [
     capstone
     curl
@@ -73,31 +105,50 @@ stdenv.mkDerivation rec {
     mbedtls
     nlohmann_json
     yara
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.UniformTypeIdentifiers ];
 
   # autoPatchelfHook only searches for *.so and *.so.*, and won't find *.hexpluglib
   # however, we will append to RUNPATH ourselves
-  autoPatchelfIgnoreMissingDeps = [ "*.hexpluglib" ];
-  appendRunpaths = [
+  autoPatchelfIgnoreMissingDeps = lib.optionals stdenv.isLinux [ "*.hexpluglib" ];
+  appendRunpaths = lib.optionals stdenv.isLinux [
     (lib.makeLibraryPath [ libGL ])
     "${placeholder "out"}/lib/imhex/plugins"
   ];
 
   cmakeFlags = [
-    "-DIMHEX_OFFLINE_BUILD=ON"
-    "-DUSE_SYSTEM_CAPSTONE=ON"
-    "-DUSE_SYSTEM_CURL=ON"
-    "-DUSE_SYSTEM_FMT=ON"
-    "-DUSE_SYSTEM_LLVM=ON"
-    "-DUSE_SYSTEM_NLOHMANN_JSON=ON"
-    "-DUSE_SYSTEM_YARA=ON"
+    (lib.cmakeBool "IMHEX_OFFLINE_BUILD" true)
+    (lib.cmakeBool "IMHEX_COMPRESS_DEBUG_INFO" false) # avoids error: cannot compress debug sections (zstd not enabled)
+    (lib.cmakeBool "IMHEX_GENERATE_PACKAGE" stdenv.isDarwin)
+    (lib.cmakeBool "USE_SYSTEM_CAPSTONE" true)
+    (lib.cmakeBool "USE_SYSTEM_CURL" true)
+    (lib.cmakeBool "USE_SYSTEM_FMT" true)
+    (lib.cmakeBool "USE_SYSTEM_LLVM" true)
+    (lib.cmakeBool "USE_SYSTEM_NLOHMANN_JSON" true)
+    (lib.cmakeBool "USE_SYSTEM_YARA" true)
   ];
 
   # rsync is used here so we can not copy the _schema.json files
-  postInstall = ''
-    mkdir -p $out/share/imhex
-    rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,patterns} $out/share/imhex
-  '';
+  postInstall =
+    if stdenv.isLinux then
+      ''
+        mkdir -p $out/share/imhex
+        rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,nodes,patterns} $out/share/imhex
+      ''
+    else if stdenv.isDarwin then
+      ''
+        mkdir -p $out/Applications
+        mv $out/imhex.app $out/Applications
+        rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,nodes,patterns} "$out/Applications/imhex.app/Contents/MacOS"
+        install_name_tool \
+          -change "$out/lib/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
+          "@executable_path/../Frameworks/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
+          "$out/Applications/imhex.app/Contents/MacOS/imhex"
+        makeWrapper "$out/Applications/imhex.app/Contents/MacOS/imhex" "$out/bin/imhex"
+      ''
+    else
+      throw "Unsupported system";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM";
@@ -107,6 +158,6 @@ stdenv.mkDerivation rec {
       kashw2
       cafkafk
     ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 72a2be0f2dff..0b1c8de612c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30582,10 +30582,6 @@ with pkgs;
 
   imgp = python3Packages.callPackage ../applications/graphics/imgp { };
 
-  imhex = callPackage ../by-name/im/imhex/package.nix {
-    llvm = llvm_17;
-  };
-
   inframap = callPackage ../applications/networking/cluster/inframap { };
 
   inkcut = libsForQt5.callPackage ../applications/misc/inkcut { };

From 99f0cc9344467a3f6ac7d9c5215b7a1f9f2c4939 Mon Sep 17 00:00:00 2001
From: "Boroczki, Lajos" <boroczki.lajos@gmail.com>
Date: Sat, 28 Sep 2024 17:19:40 +0200
Subject: [PATCH 03/38] xrdp: 0.9.25.1 -> 0.10.1, xorgxrdp: 0.9.20 -> 0.10.2

---
 .../networking/remote/xrdp/default.nix        |  8 +-
 .../remote/xrdp/dynamic_config.patch          | 80 +++++++++----------
 2 files changed, 42 insertions(+), 46 deletions(-)

diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index ff301d690941..f8b1ac4ee083 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -27,13 +27,13 @@
 let
   xorgxrdp = stdenv.mkDerivation rec {
     pname = "xorgxrdp";
-    version = "0.9.20";
+    version = "0.10.2";
 
     src = fetchFromGitHub {
       owner = "neutrinolabs";
       repo = "xorgxrdp";
       rev = "v${version}";
-      hash = "sha256-cAAWk/GqR5zJmh7EAzX3qJiYNl/RrDWdncdFeqsFIaU=";
+      hash = "sha256-xwkGY9dD747kyTvoXrYAIoiFBzQe5ngskUYQhDawnbU=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm ];
@@ -61,7 +61,7 @@ let
 
   xrdp = stdenv.mkDerivation rec {
     pname = "xrdp";
-    version = "0.9.25.1";
+    version = "0.10.1";
 
     src = applyPatches {
       inherit version;
@@ -72,7 +72,7 @@ let
         repo = "xrdp";
         rev = "v${version}";
         fetchSubmodules = true;
-        hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
+        hash = "sha256-lqifQJ/JX+0304arVctsEBEDFPhEPn2OWLyjAQW1who=";
       };
     };
 
diff --git a/pkgs/applications/networking/remote/xrdp/dynamic_config.patch b/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
index 5c97beeb6701..2cb50b19fc7f 100644
--- a/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
+++ b/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
@@ -135,8 +135,8 @@ index 8fa34aea..da94cf95 100644
 -    LOG(LOG_LEVEL_DEBUG, "keyboard_cfg_file %s", keyboard_cfg_file);
 +    LOG(LOG_LEVEL_DEBUG, "keyboard_cfg_file %s", client_info->xrdp_keyboard_ini_file);
  
--    fd = g_file_open(keyboard_cfg_file);
-+    fd = g_file_open(client_info->xrdp_keyboard_ini_file);
+-    fd = g_file_open_ro(keyboard_cfg_file);
++    fd = g_file_open_ro(client_info->xrdp_keyboard_ini_file);
  
      if (fd >= 0)
      {
@@ -179,19 +179,19 @@ index 8fa34aea..da94cf95 100644
                  list_delete(items);
                  list_delete(values);
                  return 1;
-diff --git a/sesman/config.c b/sesman/config.c
+diff --git a/sesman/libsesman/sesman_config.c b/sesman/libsesman/sesman_config.c
 index 61e9e403..0466f61a 100644
---- a/sesman/config.c
-+++ b/sesman/config.c
-@@ -34,6 +34,7 @@
- #include "sesman.h"
+--- a/sesman/libsesman/sesman_config.c
++++ b/sesman/libsesman/sesman_config.c
+@@ -37,6 +37,7 @@
  #include "log.h"
+ #include "os_calls.h"
  #include "string_calls.h"
 +#include <string.h>
- #include "chansrv/chansrv_common.h"
- 
- /***************************************************************************//**
-@@ -47,11 +48,10 @@
+ //#include "chansrv/chansrv_common.h"
+ #include "scp.h"
+
+@@ -171,7 +172,7 @@ config_output_policy_string(unsigned int value,
   *
   */
  static int
@@ -200,61 +200,57 @@ index 61e9e403..0466f61a 100644
                      struct list *param_v)
  {
      int i;
--    int length;
-     char *buf;
- 
-     list_clear(param_v);
-@@ -127,13 +127,12 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
-         g_free(cf->default_wm);
+@@ -249,14 +250,12 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
          cf->default_wm = g_strdup("startwm.sh");
      }
--    /* if default_wm doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
-+    /* if default_wm doesn't begin with '/', it's a relative path to base_dir */
+     /* if default_wm doesn't begin with '/', it's a relative path to
+-     * XRDP_CFG_PATH */
++     * base_dir */
      if (cf->default_wm[0] != '/')
      {
          /* sizeof operator returns string length including null terminator  */
--        length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->default_wm) + 1; /* '/' */
--        buf = (char *)g_malloc(length, 0);
+-        int length = (sizeof(XRDP_CFG_PATH) +
+-                      g_strlen(cf->default_wm) + 1); /* '/' */
+-        char *buf = (char *)g_malloc(length, 0);
 -        g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->default_wm);
-+        buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->default_wm) + 1, 0);
++        char *buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->default_wm) + 1, 0);
 +        g_sprintf(buf, "%s/%s", base_dir, cf->default_wm);
          g_free(cf->default_wm);
-         cf->default_wm = g_strdup(buf);
-         g_free(buf);
-@@ -151,10 +150,8 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
-     /* if reconnect_sh doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
+         cf->default_wm = buf;
+     }
+@@ -271,10 +270,8 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
      if (cf->reconnect_sh[0] != '/')
      {
--        /* sizeof operator returns string length including null terminator  */
--        length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->reconnect_sh) + 1; /* '/' */
--        buf = (char *)g_malloc(length, 0);
+         /* sizeof operator returns string length including null terminator  */
+-        int length = (sizeof(XRDP_CFG_PATH) +
+-                      g_strlen(cf->reconnect_sh) + 1); /* '/' */
+-        char *buf = (char *)g_malloc(length, 0);
 -        g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->reconnect_sh);
-+        buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->reconnect_sh) + 1, 0);
-+        g_sprintf(buf, "%s/%s", base_dir, cf->reconnect_sh);     
++        char *buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->reconnect_sh) + 1, 0);
++        g_sprintf(buf, "%s/%s", base_dir, cf->reconnect_sh);
          g_free(cf->reconnect_sh);
-         cf->reconnect_sh = g_strdup(buf);
-         g_free(buf);
-@@ -511,6 +508,7 @@ struct config_sesman *
+         cf->reconnect_sh = buf;
+     }
+@@ -580,6 +577,7 @@ struct config_sesman *
  config_read(const char *sesman_ini)
  {
      struct config_sesman *cfg;
 +    char cfg_dir[256];
      int all_ok = 0;
- 
+
      if ((cfg = g_new0(struct config_sesman, 1)) != NULL)
-@@ -532,8 +530,10 @@ config_read(const char *sesman_ini)
-                 param_v->auto_free = 1;
- 
+@@ -602,7 +600,10 @@ config_read(const char *sesman_ini)
+                 all_ok = 1;
+
                  /* read global config */
 -                config_read_globals(fd, cfg, param_n, param_v);
--
 +                g_strcpy(cfg_dir, sesman_ini);
 +                *(strrchr(cfg_dir, '/')) = 0;  // cfg_file validated to contain '/'
-+            
++
 +                config_read_globals(cfg_dir, fd, cfg, param_n, param_v);
-                 /* read Xvnc/X11rdp/Xorg parameter list */
+
+                 /* read Xvnc/Xorg parameter list */
                  config_read_vnc_params(fd, cfg, param_n, param_v);
-                 config_read_rdp_params(fd, cfg, param_n, param_v);
 diff --git a/xrdp/lang.c b/xrdp/lang.c
 index e4c18077..06f92997 100644
 --- a/xrdp/lang.c

From 06390e19bba888e85d44f50bf9faa0ef420c99b8 Mon Sep 17 00:00:00 2001
From: "Boroczki, Lajos" <boroczki.lajos@gmail.com>
Date: Sun, 29 Sep 2024 20:36:43 +0200
Subject: [PATCH 04/38] Add libdrm dependency

---
 pkgs/applications/networking/remote/xrdp/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index f8b1ac4ee083..74ba7ef7707d 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -12,6 +12,7 @@
 , systemd
 , pam
 , fuse
+, libdrm
 , libjpeg
 , libopus
 , nasm
@@ -38,7 +39,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm ];
 
-    buildInputs = [ xorg.xorgserver ];
+    buildInputs = [ xorg.xorgserver libdrm ];
 
     postPatch = ''
       # patch from Debian, allows to run xrdp daemon under unprivileged user
@@ -50,9 +51,10 @@ let
         --replace 'sysconfdir="/etc"' "sysconfdir=$out/etc"
     '';
 
-    preConfigure = "./bootstrap";
-
-    configureFlags = [ "XRDP_CFLAGS=-I${xrdp.src}/common"  ];
+    preConfigure = ''
+      ./bootstrap
+      export XRDP_CFLAGS="-I${xrdp.src}/common -I${libdrm.dev}/include -I${libdrm.dev}/include/libdrm"
+    '';
 
     enableParallelBuilding = true;
 

From 4c786688739c7122cb7d957c91455e25006a782a Mon Sep 17 00:00:00 2001
From: "Boroczki, Lajos" <boroczki.lajos@gmail.com>
Date: Sun, 29 Sep 2024 20:40:41 +0200
Subject: [PATCH 05/38] xauth path changed

---
 pkgs/applications/networking/remote/xrdp/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index 74ba7ef7707d..d1882e3ddd13 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -96,7 +96,7 @@ let
     ];
 
     postPatch = ''
-      substituteInPlace sesman/xauth.c --replace "xauth -q" "${xorg.xauth}/bin/xauth -q"
+      substituteInPlace sesman/sesexec/xauth.c --replace "xauth -q" "${xorg.xauth}/bin/xauth -q"
 
       substituteInPlace configure.ac --replace /usr/include/ ""
     '';

From 2f5a9ad9b43021d1baf31d3f9d0a38d7297ffcbb Mon Sep 17 00:00:00 2001
From: "Boroczki, Lajos" <boroczki.lajos@gmail.com>
Date: Mon, 30 Sep 2024 08:17:21 +0200
Subject: [PATCH 06/38] Add SessionSockdirGroup=xrdp to sesman config

---
 pkgs/applications/networking/remote/xrdp/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index d1882e3ddd13..191a09c422cf 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -130,6 +130,7 @@ let
       cp $src/keygen/openssl.conf $out/share/xrdp/openssl.conf
 
       substituteInPlace $out/etc/xrdp/sesman.ini --replace /etc/xrdp/pulse $out/etc/xrdp/pulse
+      substituteInPlace $out/etc/xrdp/sesman.ini --replace '#SessionSockdirGroup=root' 'SessionSockdirGroup=xrdp'
 
       # remove all session types except Xorg (they are not supported by this setup)
       perl -i -ne 'print unless /\[(X11rdp|Xvnc|console|vnc-any|sesman-any|rdp-any|neutrinordp-any)\]/ .. /^$/' $out/etc/xrdp/xrdp.ini

From 4cbccd4923dce6b1725482049d8ac3b71c3c1d4d Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Fri, 11 Oct 2024 23:33:46 +0200
Subject: [PATCH 07/38] veryl: 0.13.0 -> 0.13.1

Diff: https://github.com/veryl-lang/veryl/compare/v0.13.0...v0.13.1

Changelog: https://github.com/veryl-lang/veryl/blob/v0.13.1/CHANGELOG.md
---
 pkgs/by-name/ve/veryl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index 0702a9d11438..90afbc757d6c 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veryl";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "veryl-lang";
     repo = "veryl";
     rev = "v${version}";
-    hash = "sha256-U4ikR2jRmHUwRycAL/t2XJtvHQniKu6skRKWn8XDIgM=";
+    hash = "sha256-YcYP7JO27Fv/LTrxbQ0vNqwBE6anGjeTFS31MAp2ip4=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-t2q3rbY84+0ayxt7a/TCD0exCm7KEs+8UbQjCtqZPoE=";
+  cargoHash = "sha256-HvT56jBmFTWUdzHjyPVaJ3wuMD01omCFEIEJ53JrKY4=";
 
   nativeBuildInputs = [
     pkg-config

From 35325ecea96a18eea55566f55107dd01910967dc Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Fri, 11 Oct 2024 23:50:57 +0200
Subject: [PATCH 08/38] veryl: add shell completions

---
 pkgs/by-name/ve/veryl/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index 90afbc757d6c..febb85b3c9b7 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -3,6 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
+  installShellFiles,
   dbus,
   stdenv,
   darwin,
@@ -24,6 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs =
@@ -37,6 +39,13 @@ rustPlatform.buildRustPackage rec {
       darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd veryl \
+      --bash <($out/bin/veryl metadata --completion bash) \
+      --fish <($out/bin/veryl metadata --completion fish) \
+      --zsh <($out/bin/veryl metadata --completion zsh)
+  '';
+
   checkFlags = [
     # takes over an hour
     "--skip=tests::progress"
@@ -53,7 +62,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=analyzer::test_68_std"
     "--skip=emitter::test_25_dependency"
     "--skip=emitter::test_68_std"
-
   ];
 
   meta = {

From 666d3bd33d4f978ba8ea1ca34ae6756606721f58 Mon Sep 17 00:00:00 2001
From: Tomo <tomodachi94@protonmail.com>
Date: Wed, 16 Oct 2024 18:01:49 +0000
Subject: [PATCH 09/38] {nodePackages,vimPlugins}.coc-metals: drop

Upstream deprecated it:
https://github.com/scalameta/coc-metals

Upstream recommends vimPlugins.nvim-metals instead.

Part of #229475
---
 .../manual/release-notes/rl-2411.section.md   |   3 +
 .../editors/vim/plugins/overrides.nix         |   1 -
 pkgs/development/node-packages/aliases.nix    |   1 +
 .../node-packages/node-packages.json          |   1 -
 .../node-packages/node-packages.nix           | 244 ------------------
 5 files changed, 4 insertions(+), 246 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 3815475f9f70..f15bd7ae6ff6 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -352,6 +352,9 @@
 
 - `services.pgbouncer` systemd service is configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the free-form type option named [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings) according to the NixOS RFC 0042.
 
+- `nodePackages.coc-metals` was removed due to being deprecated upstream.
+  `vimPlugins.nvim-metals` is its official replacement.
+
 - `teleport` has been upgraded from major version 15 to major version 16.
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index c4ed286b997a..6496698420a8 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2726,7 +2726,6 @@ in
       "coc-lists"
       "coc-ltex"
       "coc-markdownlint"
-      "coc-metals"
       "coc-pairs"
       "coc-prettier"
       "coc-r-lsp"
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 4e315d23ef5b..09290902051c 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -74,6 +74,7 @@ mapAliases {
   inherit (pkgs) coc-diagnostic; # added 2024-06-29
   coc-imselect = throw "coc-imselect was removed because it was broken"; # added 2023-08-21
   inherit (pkgs) coc-pyright; # added 2024-07-14
+  coc-metals = throw "coc-metals was removed because it was deprecated upstream. vimPlugins.nvim-metals is its official replacement."; # Added 2024-10-16
   coc-python = throw "coc-python was removed because it was abandoned upstream on 2020-12-24. Upstream now recommends using coc-pyright or coc-jedi instead."; # added 2024-10-15
   coinmon = throw "coinmon was removed since it was abandoned upstream"; # added 2024-03-19
   coffee-script = pkgs.coffeescript; # added 2023-08-18
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 9c50df42a0d2..5d76987e3701 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -44,7 +44,6 @@
 , "coc-lists"
 , "coc-ltex"
 , "coc-markdownlint"
-, "coc-metals"
 , "coc-pairs"
 , "coc-prettier"
 , "coc-r-lsp"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index ef6e6f2e90e9..b4762215cfc8 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -60955,250 +60955,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  coc-metals = nodeEnv.buildNodePackage {
-    name = "coc-metals";
-    packageName = "coc-metals";
-    version = "1.0.14";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/coc-metals/-/coc-metals-1.0.14.tgz";
-      sha512 = "zFExh1wGAZl4LXSp76NAjWORO9Tyhfw8WtALnhDv741p4tjWjVSEl6GmXTQN0U0tXz8UZ8ln2rL2OaxOdgMCTA==";
-    };
-    dependencies = [
-      sources."@chemzqm/msgpack-lite-0.1.29"
-      sources."@chemzqm/neovim-5.9.5"
-      sources."@tootallnate/once-1.1.2"
-      sources."agent-base-6.0.2"
-      sources."arch-2.2.0"
-      sources."array-buffer-byte-length-1.0.1"
-      sources."arraybuffer.prototype.slice-1.0.3"
-      sources."async-2.6.4"
-      sources."available-typed-arrays-1.0.7"
-      sources."await-semaphore-0.1.3"
-      sources."balanced-match-1.0.2"
-      sources."big-integer-1.6.52"
-      sources."binary-0.3.0"
-      sources."bluebird-3.4.7"
-      sources."brace-expansion-1.1.11"
-      sources."bser-2.1.1"
-      sources."buffer-indexof-polyfill-1.0.2"
-      sources."buffers-0.1.1"
-      sources."bytes-3.1.2"
-      sources."call-bind-1.0.7"
-      sources."chainsaw-0.1.0"
-      sources."chownr-2.0.0"
-      sources."clipboardy-2.3.0"
-      sources."coc.nvim-0.0.79"
-      sources."concat-map-0.0.1"
-      sources."content-disposition-0.5.4"
-      sources."core-util-is-1.0.3"
-      (sources."cross-spawn-6.0.5" // {
-        dependencies = [
-          sources."semver-5.7.2"
-          sources."which-1.3.1"
-        ];
-      })
-      sources."data-view-buffer-1.0.1"
-      sources."data-view-byte-length-1.0.1"
-      sources."data-view-byte-offset-1.0.0"
-      sources."date-format-4.0.14"
-      sources."debounce-1.2.1"
-      sources."debug-4.3.7"
-      sources."deep-extend-0.6.0"
-      sources."define-data-property-1.1.4"
-      sources."define-properties-1.2.1"
-      sources."duplexer2-0.1.4"
-      sources."encoding-0.1.13"
-      sources."end-of-stream-1.4.4"
-      sources."es-abstract-1.23.3"
-      sources."es-define-property-1.0.0"
-      sources."es-errors-1.3.0"
-      sources."es-object-atoms-1.0.0"
-      sources."es-set-tostringtag-2.0.3"
-      sources."es-to-primitive-1.2.1"
-      sources."execa-1.0.0"
-      sources."fast-diff-1.3.0"
-      sources."fb-watchman-2.0.2"
-      sources."flatted-3.3.1"
-      sources."follow-redirects-1.15.9"
-      sources."for-each-0.3.3"
-      sources."fp-ts-2.16.9"
-      sources."fs-extra-8.1.0"
-      (sources."fs-minipass-2.1.0" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-        ];
-      })
-      sources."fs.realpath-1.0.0"
-      (sources."fstream-1.0.12" // {
-        dependencies = [
-          sources."mkdirp-0.5.6"
-          sources."rimraf-2.7.1"
-        ];
-      })
-      sources."function-bind-1.1.2"
-      sources."function.prototype.name-1.1.6"
-      sources."functions-have-names-1.2.3"
-      sources."get-intrinsic-1.2.4"
-      sources."get-stream-4.1.0"
-      sources."get-symbol-description-1.0.2"
-      sources."glob-7.2.3"
-      sources."globalthis-1.0.4"
-      sources."gopd-1.0.1"
-      sources."graceful-fs-4.2.11"
-      sources."has-bigints-1.0.2"
-      sources."has-property-descriptors-1.0.2"
-      sources."has-proto-1.0.3"
-      sources."has-symbols-1.0.3"
-      sources."has-tostringtag-1.0.2"
-      sources."hasown-2.0.2"
-      sources."http-proxy-agent-4.0.1"
-      sources."https-proxy-agent-5.0.1"
-      sources."iconv-lite-0.6.3"
-      sources."ieee754-1.2.1"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."ini-1.3.8"
-      sources."int64-buffer-0.1.10"
-      sources."internal-slot-1.0.7"
-      sources."is-array-buffer-3.0.4"
-      sources."is-bigint-1.0.4"
-      sources."is-boolean-object-1.1.2"
-      sources."is-callable-1.2.7"
-      sources."is-data-view-1.0.1"
-      sources."is-date-object-1.0.5"
-      sources."is-docker-2.2.1"
-      sources."is-negative-zero-2.0.3"
-      sources."is-number-object-1.0.7"
-      sources."is-regex-1.1.4"
-      sources."is-shared-array-buffer-1.0.3"
-      sources."is-stream-1.1.0"
-      sources."is-string-1.0.7"
-      sources."is-symbol-1.0.4"
-      sources."is-typed-array-1.1.13"
-      sources."is-weakref-1.0.2"
-      sources."is-wsl-2.2.0"
-      sources."isarray-2.0.5"
-      sources."isexe-2.0.0"
-      sources."isuri-2.0.3"
-      sources."jsonc-parser-2.3.1"
-      sources."jsonfile-4.0.0"
-      sources."listenercount-1.0.1"
-      (sources."locate-java-home-1.1.2" // {
-        dependencies = [
-          sources."semver-5.7.2"
-        ];
-      })
-      sources."lodash-4.17.21"
-      sources."log4js-6.9.1"
-      sources."metals-languageclient-0.4.2"
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."minipass-5.0.0"
-      (sources."minizlib-2.1.2" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-        ];
-      })
-      sources."mkdirp-1.0.4"
-      sources."ms-2.1.3"
-      (sources."mv-2.1.1" // {
-        dependencies = [
-          sources."glob-6.0.4"
-          sources."mkdirp-0.5.6"
-          sources."rimraf-2.4.5"
-        ];
-      })
-      sources."ncp-2.0.0"
-      sources."nice-try-1.0.5"
-      sources."node-fetch-2.7.0"
-      sources."node-int64-0.4.0"
-      sources."npm-run-path-2.0.2"
-      sources."object-inspect-1.13.2"
-      sources."object-keys-1.1.1"
-      sources."object.assign-4.1.5"
-      sources."once-1.4.0"
-      sources."p-finally-1.0.0"
-      sources."path-is-absolute-1.0.1"
-      sources."path-key-2.0.1"
-      sources."possible-typed-array-names-1.0.0"
-      sources."process-nextick-args-2.0.1"
-      sources."promise.prototype.finally-3.1.8"
-      sources."promisify-child-process-4.1.1"
-      sources."pump-3.0.2"
-      sources."rc-1.2.8"
-      (sources."readable-stream-2.3.8" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      sources."regexp.prototype.flags-1.5.2"
-      sources."rfc-3986-1.0.1"
-      sources."rfdc-1.4.1"
-      sources."rimraf-3.0.2"
-      sources."safe-array-concat-1.1.2"
-      sources."safe-buffer-5.2.1"
-      sources."safe-regex-test-1.0.3"
-      sources."safer-buffer-2.1.2"
-      sources."semver-7.6.3"
-      sources."set-function-length-1.2.2"
-      sources."set-function-name-2.0.2"
-      sources."setimmediate-1.0.5"
-      sources."shebang-command-1.2.0"
-      sources."shebang-regex-1.0.0"
-      sources."shell-quote-1.8.1"
-      sources."side-channel-1.0.6"
-      sources."signal-exit-3.0.7"
-      sources."streamroller-3.1.5"
-      sources."string.prototype.trim-1.2.9"
-      sources."string.prototype.trimend-1.0.8"
-      sources."string.prototype.trimstart-1.0.8"
-      (sources."string_decoder-1.1.1" // {
-        dependencies = [
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      sources."strip-eof-1.0.0"
-      sources."strip-json-comments-2.0.1"
-      sources."tar-6.2.1"
-      sources."tr46-0.0.3"
-      sources."traverse-0.3.9"
-      sources."tslib-2.7.0"
-      sources."typed-array-buffer-1.0.2"
-      sources."typed-array-byte-length-1.0.1"
-      sources."typed-array-byte-offset-1.0.2"
-      sources."typed-array-length-1.0.6"
-      sources."unbox-primitive-1.0.2"
-      sources."universalify-0.1.2"
-      sources."unzipper-0.10.14"
-      sources."util-deprecate-1.0.2"
-      sources."uuid-7.0.3"
-      sources."vscode-jsonrpc-5.0.1"
-      (sources."vscode-languageserver-protocol-3.15.3" // {
-        dependencies = [
-          sources."vscode-languageserver-types-3.15.1"
-        ];
-      })
-      sources."vscode-languageserver-textdocument-1.0.12"
-      sources."vscode-languageserver-types-3.17.5"
-      sources."vscode-uri-2.1.2"
-      sources."webidl-conversions-3.0.1"
-      sources."whatwg-url-5.0.0"
-      sources."which-2.0.2"
-      sources."which-boxed-primitive-1.0.2"
-      sources."which-typed-array-1.1.15"
-      sources."wrappy-1.0.2"
-      sources."yallist-4.0.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "coc.nvim extension for Metals, the Scala language server";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   coc-pairs = nodeEnv.buildNodePackage {
     name = "coc-pairs";
     packageName = "coc-pairs";

From 84768649a29a394bf5fd45c3f417ee4b9c66616f Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 17 Oct 2024 14:50:45 +0200
Subject: [PATCH 10/38] nextcloud30: 30.0.0 -> 30.0.1

ChangeLog: https://github.com/nextcloud/server/releases/tag/v30.0.1
---
 pkgs/servers/nextcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index a63ee485fec7..3468ae8b5a4b 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -71,8 +71,8 @@ in
   };
 
   nextcloud30 = generic {
-    version = "30.0.0";
-    hash = "sha256-GNeoCVe7U+lPsESS9rUhNDTdo+naEtn3iZl2h8hWTmA=";
+    version = "30.0.1";
+    hash = "sha256-eewv+tYjG9j8xKuqzBLlrFHmcNCJr/s3lINZLNoP3Ms=";
     packages = nextcloud30Packages;
   };
 

From e9ddacf236687203430818c49a3eff17e0be3517 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 17 Oct 2024 22:45:30 +0200
Subject: [PATCH 11/38] grafana: 11.2.2 -> 11.2.2+security-01, fix
 CVE-2024-9264

ChangeLog: https://github.com/grafana/grafana/releases/tag/v11.2.2%2Bsecurity-01
---
 pkgs/servers/monitoring/grafana/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 529200dd1f16..d2b4fc16d436 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -9,7 +9,7 @@
 # TODO: Go back to using buildGoModule when upgrading to grafana 11.3.
 buildGo122Module rec {
   pname = "grafana";
-  version = "11.2.2";
+  version = "11.2.2+security-01";
 
   subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];
 
@@ -17,7 +17,7 @@ buildGo122Module rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-rELvOqKVf/Dmh38fxvvFzNM9zRQF9J8OyidXJvuubzs=";
+    hash = "sha256-1ZDX0R3t6CAdIfrYfR373olGL5orSDs2iwriAszl7qk=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22

From b71ae2d9501c687ab40e784d209e813df2259f2d Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Fri, 18 Oct 2024 01:56:56 +0200
Subject: [PATCH 12/38] chromium,chromedriver: 129.0.6668.100 -> 130.0.6723.58

https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html

This update includes 17 security fixes.

CVEs:
CVE-2024-9954 CVE-2024-9955 CVE-2024-9956 CVE-2024-9957 CVE-2024-9958
CVE-2024-9959 CVE-2024-9960 CVE-2024-9961 CVE-2024-9962 CVE-2024-9963
CVE-2024-9964 CVE-2024-9965 CVE-2024-9966
---
 .../networking/browsers/chromium/common.nix   | 20 +++++++++++++++++--
 .../networking/browsers/chromium/default.nix  |  6 ++++++
 .../browsers/chromium/upstream-info.nix       | 18 ++++++++---------
 3 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 1ef2e9d15382..70ebecaa63de 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -70,9 +70,9 @@ let
   # source tree.
   extraAttrs = buildFun base;
 
-  githubPatch = { commit, hash, revert ? false }: fetchpatch {
+  githubPatch = { commit, hash, revert ? false, excludes ? [] }: fetchpatch {
     url = "https://github.com/chromium/chromium/commit/${commit}.patch";
-    inherit hash revert;
+    inherit hash revert excludes;
   };
 
   mkGnFlags =
@@ -314,6 +314,22 @@ let
     ] ++ lib.optionals (chromiumVersionAtLeast "129") [
       # Rebased variant of patch right above to build M129+ with our rust and our clang.
       ./patches/chromium-129-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "130") [
+      # Our rustc.llvmPackages is too old for std::hardware_destructive_interference_size
+      # and std::hardware_constructive_interference_size.
+      # So let's revert the change for now and hope that our rustc.llvmPackages and
+      # nixpkgs-stable catch up sooner than later.
+      # https://groups.google.com/a/chromium.org/g/cxx/c/cwktrFxxUY4
+      # https://chromium-review.googlesource.com/c/chromium/src/+/5767325
+      # Note: We exclude the changes made to the partition_allocator (PA), as the revert
+      # would otherwise not apply because upstream reverted those changes to PA already
+      # in https://chromium-review.googlesource.com/c/chromium/src/+/5841144
+      (githubPatch {
+        commit = "fc838e8cc887adbe95110045d146b9d5885bf2a9";
+        hash = "sha256-NNKzIp6NYdeZaqBLWDW/qNxiDB1VFRz7msjMXuMOrZ8=";
+        excludes = [ "base/allocator/partition_allocator/src/partition_alloc/*" ];
+        revert = true;
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 484cc0e4f194..767e244a6cd1 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -58,6 +58,12 @@ let
         # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
         # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
         hardeningDisable = [ "format" ];
+      } // lib.optionalAttrs (chromiumVersionAtLeast "130") {
+        # At the time of writing, gn is at v2024-05-13 and has a backported patch.
+        # This patch appears to be already present in v2024-09-09 (from M130), which
+        # results in the patch not applying and thus failing the build.
+        # As a work around until gn is updated again, we filter specifically that patch out.
+        patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
       });
       recompressTarball = callPackage ./recompress-tarball.nix { inherit chromiumVersionAtLeast; };
     });
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 1dae6fdb4a4b..1e13bee43289 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,22 +1,22 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-/0mBZCSNULvZSQ/irsQSgNPsuOSWiRRnJA/6ogHYeGk=";
+      hash_darwin = "sha256-YndBzhUNmn5tJdCqLmpUrs2WBXXpTxiKCNczWEz6DU4=";
       hash_darwin_aarch64 =
-        "sha256-JWcYFYaaXM2KN6oSu7wwxztYPbhql2XYZlvL2ymKgwI=";
-      hash_linux = "sha256-odFoTWjDa9ilyOrQ0T+0xxedRD7YOe/s7xdAyyku74w=";
-      version = "129.0.6668.91";
+        "sha256-taG58kMgQUD40aGqnyx9O9e9m4qGsTWX57cjD3NeHm4=";
+      hash_linux = "sha256-raWGzhjqWdm5bRK+Z7Qga8QM9kQYSXxdL5N+wk1hlXI=";
+      version = "130.0.6723.58";
     };
     deps = {
       gn = {
-        hash = "sha256-8o3rDdojqVHMQCxI2T3MdJOXKlW3XX7lqpy3zWhJiaA=";
-        rev = "d010e218ca7077928ad7c9e9cc02fe43b5a8a0ad";
+        hash = "sha256-iNXRq3Mr8+wmY1SR4sV7yd2fDiIZ94eReelwFI0UhGU=";
+        rev = "20806f79c6b4ba295274e3a589d85db41a02fdaa";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-08-19";
+        version = "2024-09-09";
       };
     };
-    hash = "sha256-LOZ9EPw7VgBNEV7Wxb8H5WfSYTTWOL8EDP91uCrZAsA=";
-    version = "129.0.6668.100";
+    hash = "sha256-w1xQr+B7ROeCqBRN+M9vmh45YTRqVfjDYSsN5saDuDo=";
+    version = "130.0.6723.58";
   };
   ungoogled-chromium = {
     deps = {

From bbc4efa5dec763979308a85b02cf2498447ea566 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Oct 2024 05:19:56 +0000
Subject: [PATCH 13/38] rospo: 0.12.1 -> 0.13.0

---
 pkgs/by-name/ro/rospo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ro/rospo/package.nix b/pkgs/by-name/ro/rospo/package.nix
index 088d0d04f61b..19300832cef1 100644
--- a/pkgs/by-name/ro/rospo/package.nix
+++ b/pkgs/by-name/ro/rospo/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "rospo";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "ferama";
     repo = "rospo";
     rev = "v${version}";
-    hash = "sha256-cUah73wr0fKK9Lw3228r5SITDn5rNlpgQW5rHtbo6jU=";
+    hash = "sha256-+1xrke8dfMkuZZ/imY+1KkeJnZCDtKJpxwAg5ksErnM=";
   };
 
-  vendorHash = "sha256-KbR8T7KwueQ9fc4AOX26GOTQFXuV9LgfSxgwCzQt4eE=";
+  vendorHash = "sha256-MTPFBrLFMQ2hEwtSDb7t3ls/Wagw7s9/w6bwWjZ62vE=";
 
   ldflags = [
     "-s"

From 5005449a6ed0451dbe6d976a254091445e984047 Mon Sep 17 00:00:00 2001
From: Alexey Orlenko <alex@aqrln.net>
Date: Fri, 18 Oct 2024 10:05:49 +0200
Subject: [PATCH 14/38] prisma-engines: 5.21.0 -> 5.21.1

---
 pkgs/development/tools/database/prisma-engines/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index c404bed3418d..a991bce5abc4 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -13,13 +13,13 @@
 # function correctly.
 rustPlatform.buildRustPackage rec {
   pname = "prisma-engines";
-  version = "5.21.0";
+  version = "5.21.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
     rev = version;
-    hash = "sha256-X5aBrnyZ/tMykJFifyY1LeR/nShBlxm9HazVE0L7RJk=";
+    hash = "sha256-zVGnAFvxBRh7YGXET8YjDI+qXay6StgG618mRfpc4kw=";
   };
 
   # Use system openssl.

From 1ddf2d83e38a1f17784e69fc0860dc3bc460d333 Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Fri, 18 Oct 2024 10:21:50 +0200
Subject: [PATCH 15/38] docs/release-notes: document deprecations in Go
 ecosystem

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
---
 nixos/doc/manual/release-notes/rl-2411.section.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 39bd3065d63d..a57633fae2d1 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -627,6 +627,12 @@
   `goModules`, `modRoot`, `vendorHash`, `deleteVendor`, and `proxyVendor` are now passed as derivation attributes.
   `goModules` and `vendorHash` are no longer placed under `passthru`.
 
+- `buildFlags`/`buildFlagsArray` on `buildGoModule` have been deprecated. 24.11 is the last release where `buildGoModule` accepts these flags (while throwing a warning).
+  Use the [`ldflags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-ldflags) and/or [`tags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-tags) attributes or
+  [the environment](https://nixos.org/manual/nixpkgs/unstable/#ssec-go-environment) instead.
+
+- `buildGoPackage` has been deprecated. 24.11 is the last release with `buildGoPackage` available.
+
 - `hareHook` has been added as the language framework for Hare. From now on, it,
   not the `hare` package, should be added to `nativeBuildInputs` when building
   Hare programs.

From f8a1a35c65586403594c5b8be3171371603591c9 Mon Sep 17 00:00:00 2001
From: Alexey Orlenko <alex@aqrln.net>
Date: Fri, 18 Oct 2024 11:54:06 +0200
Subject: [PATCH 16/38] prisma: 5.21.0 -> 5.21.1

---
 pkgs/by-name/pr/prisma/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index ce95eb246993..6b935d55642a 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prisma";
-  version = "5.21.0";
+  version = "5.21.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma";
     rev = finalAttrs.version;
-    hash = "sha256-i37Hiawmu/06Mv56FtYkvFGOtqW3x4Q2H1C0JW6/0pI=";
+    hash = "sha256-75TmTFl1EKLGE3kgghghary4Z2gjEjdguZ//ND3HAkc=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-o6m9Lxg+oqq15CtdA9RQRukdJWPPGtw/SwRyHDUf91A=";
+    hash = "sha256-fu2SJUn2xKm8lKNE8ncMRuNu6snj1J6cnHrJfzg+hJc=";
   };
 
   patchPhase = ''

From 4d56f18a82430e1bc51cb7f8dfa2ed61bdf0447a Mon Sep 17 00:00:00 2001
From: Lorenzo Manacorda <lorenzo@mailbox.org>
Date: Fri, 18 Oct 2024 13:17:35 +0200
Subject: [PATCH 17/38] maintainers/team-list: remove asymmetric from jitsi

---
 maintainers/team-list.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 7526987be2d2..1821660a506d 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -499,7 +499,6 @@ with lib.maintainers;
       ryantm
       lassulus
       yayayayaka
-      asymmetric
     ];
     scope = "Maintain Jitsi.";
     shortName = "Jitsi";

From 3581a1650f2a16c2e5e5febfcdb7a35b5513868e Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 18 Oct 2024 17:02:06 +0530
Subject: [PATCH 18/38] russ: 0.4.0 -> 0.5.0, move to by-name

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 .../networking/feedreaders/russ/default.nix   | 37 -----------------
 pkgs/by-name/ru/russ/package.nix              | 41 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 -
 3 files changed, 41 insertions(+), 39 deletions(-)
 delete mode 100644 pkgs/applications/networking/feedreaders/russ/default.nix
 create mode 100644 pkgs/by-name/ru/russ/package.nix

diff --git a/pkgs/applications/networking/feedreaders/russ/default.nix b/pkgs/applications/networking/feedreaders/russ/default.nix
deleted file mode 100644
index 3fbaa2108d60..000000000000
--- a/pkgs/applications/networking/feedreaders/russ/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "russ";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "ckampfe";
-    repo = "russ";
-    rev = "1482bb1df13738fdd4ea1badf2146a9ed8e6656e";
-    hash = "sha256-MvTMo2q/cQ/LQNdUV8SmHgGlA42kLl0i9mdcoAFV/I4=";
-  };
-
-  cargoHash = "sha256-ObWrwXMGXkLqqM7VXhOXArshk2lVkbOTXhrQImDQp1s=";
-
-  # tests are network based :(
-  doCheck = false;
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-    CoreServices
-    AppKit
-  ]);
-
-  meta = with lib; {
-    description = "TUI RSS reader with vim-like controls and a local-first, offline-first focus";
-    mainProgram = "russ";
-    homepage = "https://github.com/ckampfe/russ";
-    license = with licenses; [ agpl3Only ];
-    maintainers = with maintainers; [ blusk ];
-    changelog = "https://github.com/ckampfe/russ/blob/master/CHANGELOG.md";
-  };
-}
diff --git a/pkgs/by-name/ru/russ/package.nix b/pkgs/by-name/ru/russ/package.nix
new file mode 100644
index 000000000000..98d460b6d43f
--- /dev/null
+++ b/pkgs/by-name/ru/russ/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "russ";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "ckampfe";
+    repo = "russ";
+    rev = "b21aa80ebc9dc2668463386f9eb270b1782d5842";
+    hash = "sha256-/76CvSBYim831OZzLhsj2Hm+0hoY/FLtKQqt19E5YOI=";
+  };
+
+  cargoHash = "sha256-d3lJQafvBuj9Sb2Tuep3Ypt1sP+vlWHk4kuP99gMly8=";
+
+  # tests are network based :(
+  doCheck = false;
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
+    with darwin.apple_sdk.frameworks;
+    [
+      CoreServices
+      AppKit
+    ]
+  );
+
+  meta = {
+    changelog = "https://github.com/ckampfe/russ/blob/master/CHANGELOG.md";
+    description = "TUI RSS reader with vim-like controls and a local-first, offline-first focus";
+    homepage = "https://github.com/ckampfe/russ";
+    license = with lib.licenses; [ agpl3Only ];
+    maintainers = with lib.maintainers; [ blusk ];
+    mainProgram = "russ";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 736cb135f8ec..aee293106d71 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13096,8 +13096,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  russ = callPackage ../applications/networking/feedreaders/russ { };
-
   tunnelto = callPackage ../tools/networking/tunnelto {
     inherit (darwin.apple_sdk.frameworks) Security;
   };

From 91347f7b41fa26d5089d647d1c405d14ffa3dd1e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Oct 2024 11:42:04 +0000
Subject: [PATCH 19/38] ledger-live-desktop: 2.84.1 -> 2.89.1

---
 pkgs/applications/blockchains/ledger-live-desktop/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index cfd9193f08be..c6697584e326 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.84.1";
+  version = "2.89.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-V/bOCddc7UhmN8zlHmKj+H4v+ZZ/qn8jRj0jH4EtwMI=";
+    hash = "sha256-PPoQnXDVf6Q6QPVE41guJL1vu7rW7mZdpRZjRME3Ue8=";
   };
 
   appimageContents = appimageTools.extractType2 {

From 3f69f471b951927edcf0d5e505efb22cf657277e Mon Sep 17 00:00:00 2001
From: wxt <3264117476@qq.com>
Date: Fri, 18 Oct 2024 19:30:35 +0800
Subject: [PATCH 20/38] renpy: fix build

---
 pkgs/by-name/re/renpy/5687.patch  | 91 +++++++++++++++++++++++++++++++
 pkgs/by-name/re/renpy/package.nix |  6 +-
 2 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/re/renpy/5687.patch

diff --git a/pkgs/by-name/re/renpy/5687.patch b/pkgs/by-name/re/renpy/5687.patch
new file mode 100644
index 000000000000..0ed4a883919f
--- /dev/null
+++ b/pkgs/by-name/re/renpy/5687.patch
@@ -0,0 +1,91 @@
+From b120f82f9809b98231188daacb94f22a9e69187a Mon Sep 17 00:00:00 2001
+From: Gregor Riepl <onitake@gmail.com>
+Date: Thu, 8 Aug 2024 23:56:16 +0200
+Subject: [PATCH] Replace deprecated APIs when compiling against newer FFmpeg
+
+---
+ module/ffmedia.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/module/ffmedia.c b/module/ffmedia.c
+index d4bb346ac35740711b8393e66d0bfc28c849ff0e..0f57e311f277359fad731e348531becbadbb06d4 100644
+--- a/module/ffmedia.c
++++ b/module/ffmedia.c
+@@ -71,7 +71,11 @@ static int rwops_read(void *opaque, uint8_t *buf, int buf_size) {
+ 
+ }
+ 
++#if (LIBAVFORMAT_VERSION_MAJOR < 61)
+ static int rwops_write(void *opaque, uint8_t *buf, int buf_size) {
++#else
++static int rwops_write(void *opaque, const uint8_t *buf, int buf_size) {
++#endif
+     printf("Writing to an SDL_rwops is a really bad idea.\n");
+     return -1;
+ }
+@@ -690,9 +694,14 @@ static void decode_audio(MediaState *ms) {
+ 			}
+ 
+             converted_frame->sample_rate = audio_sample_rate;
++#if (LIBAVUTIL_VERSION_MAJOR < 59)
+             converted_frame->channel_layout = AV_CH_LAYOUT_STEREO;
++#else
++            converted_frame->ch_layout = (AVChannelLayout) AV_CHANNEL_LAYOUT_STEREO;
++#endif
+             converted_frame->format = AV_SAMPLE_FMT_S16;
+ 
++#if (LIBAVUTIL_VERSION_MAJOR < 59)
+ 			if (!ms->audio_decode_frame->channel_layout) {
+ 				ms->audio_decode_frame->channel_layout = av_get_default_channel_layout(ms->audio_decode_frame->channels);
+ 
+@@ -711,6 +720,26 @@ static void decode_audio(MediaState *ms) {
+ 				    swr_set_matrix(ms->swr, stereo_matrix, 1);
+ 				}
+ 			}
++#else
++			if (ms->audio_decode_frame->ch_layout.order == AV_CHANNEL_ORDER_UNSPEC) {
++				av_channel_layout_default(&ms->audio_decode_frame->ch_layout, ms->audio_decode_frame->ch_layout.nb_channels);
++
++				if (audio_equal_mono && (ms->audio_decode_frame->ch_layout.nb_channels == 1)) {
++				    swr_alloc_set_opts2(
++                        &ms->swr,
++                        &converted_frame->ch_layout,
++                        converted_frame->format,
++                        converted_frame->sample_rate,
++                        &ms->audio_decode_frame->ch_layout,
++                        ms->audio_decode_frame->format,
++                        ms->audio_decode_frame->sample_rate,
++                        0,
++                        NULL);
++
++				    swr_set_matrix(ms->swr, stereo_matrix, 1);
++				}
++			}
++#endif
+ 
+ 			if(swr_convert_frame(ms->swr, converted_frame, ms->audio_decode_frame)) {
+ 				av_frame_free(&converted_frame);
+@@ -1159,7 +1188,11 @@ static int decode_thread(void *arg) {
+ 
+ 	// Compute the number of samples we need to play back.
+ 	if (ms->audio_duration < 0) {
++#if (LIBAVFORMAT_VERSION_MAJOR < 62)
+ 		if (av_fmt_ctx_get_duration_estimation_method(ctx) != AVFMT_DURATION_FROM_BITRATE) {
++#else
++		if (ctx->duration_estimation_method != AVFMT_DURATION_FROM_BITRATE) {
++#endif
+ 
+ 			long long duration = ((long long) ctx->duration) * audio_sample_rate;
+ 			ms->audio_duration = (unsigned int) (duration /  AV_TIME_BASE);
+@@ -1319,7 +1352,11 @@ static int decode_sync_start(void *arg) {
+ 
+ 	// Compute the number of samples we need to play back.
+ 	if (ms->audio_duration < 0) {
++#if (LIBAVFORMAT_VERSION_MAJOR < 62)
+ 		if (av_fmt_ctx_get_duration_estimation_method(ctx) != AVFMT_DURATION_FROM_BITRATE) {
++#else
++		if (ctx->duration_estimation_method != AVFMT_DURATION_FROM_BITRATE) {
++#endif
+ 
+ 			long long duration = ((long long) ctx->duration) * audio_sample_rate;
+ 			ms->audio_duration = (unsigned int) (duration /  AV_TIME_BASE);
diff --git a/pkgs/by-name/re/renpy/package.nix b/pkgs/by-name/re/renpy/package.nix
index 5cc7a0970556..9bba63ce1c43 100644
--- a/pkgs/by-name/re/renpy/package.nix
+++ b/pkgs/by-name/re/renpy/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   python311,
   pkg-config,
   SDL2,
@@ -86,7 +87,10 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  patches = [ ./shutup-erofs-errors.patch ];
+  patches = [
+    ./shutup-erofs-errors.patch
+    ./5687.patch
+  ];
 
   postPatch = ''
     cp tutorial/game/tutorial_director.rpy{m,}

From 284e618ce5b9f917ed435daa9bbc4e9407870484 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 18 Oct 2024 15:13:47 +0300
Subject: [PATCH 21/38] python312Packages.tempest: add missing pynacl
 checkInput to fix build

Fixes #348971
---
 pkgs/development/python-modules/tempest/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index fcae826816fb..63ed58fca0b9 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -19,6 +19,7 @@
   paramiko,
   pbr,
   prettytable,
+  pynacl,
   python,
   pythonOlder,
   pyyaml,
@@ -74,6 +75,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     hacking
     oslotest
+    pynacl
     stestr
   ];
 

From 924cf63ceb24f60d90e6dfd52510676a8e7f0f42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Oct 2024 12:20:38 +0000
Subject: [PATCH 22/38] art: 1.23 -> 1.24.1

---
 pkgs/by-name/ar/art/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index 6181d49d4b06..854fcaecce46 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.23";
+  version = "1.24.1";
 
   src = fetchFromBitbucket {
     owner = "agriggio";
     repo = "art";
     rev = version;
-    hash = "sha256-OB/Rr4rHNJc40o6esNPDRbhN4EPGf2zhlzzM+mBpUUU=";
+    hash = "sha256-uvdqU509ri6CKCEGA8Ln5tMp0pe3r/bcJefbeZGjocE=";
   };
 
   nativeBuildInputs = [

From 9c2f72fc58215ef28acfe6bd55f4b5b296c1ca7c Mon Sep 17 00:00:00 2001
From: FliegendeWurst <2012gdwu+github@posteo.de>
Date: Fri, 18 Oct 2024 14:48:05 +0200
Subject: [PATCH 23/38] auto-cpufreq: copy icon to correct location

---
 pkgs/by-name/au/auto-cpufreq/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/au/auto-cpufreq/package.nix b/pkgs/by-name/au/auto-cpufreq/package.nix
index 244735554010..3a87f2ac0cbe 100644
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -82,7 +82,7 @@ python3Packages.buildPythonPackage rec {
     mkdir -p $out/share/applications
     mkdir $out/share/pixmaps
     cp scripts/auto-cpufreq-gtk.desktop $out/share/applications
-    cp images/icon.png $out/share/pixmaps/auto-cpufreq.python3Packages
+    cp images/icon.png $out/share/pixmaps/auto-cpufreq.png
 
     # polkit policy
     mkdir -p $out/share/polkit-1/actions

From 4c2fcb090b1f3e5b47eaa7bd33913b574a11e0a0 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 11 Oct 2024 07:15:48 +0200
Subject: [PATCH 24/38] =?UTF-8?q?ocamlPackages.uuidm:=200.9.8=20=E2=86=92?=
 =?UTF-8?q?=200.9.9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../development/ocaml-modules/uuidm/default.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/ocaml-modules/uuidm/default.nix b/pkgs/development/ocaml-modules/uuidm/default.nix
index 83b8cacc77a0..cf354c5e898d 100644
--- a/pkgs/development/ocaml-modules/uuidm/default.nix
+++ b/pkgs/development/ocaml-modules/uuidm/default.nix
@@ -1,20 +1,21 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner
+, version ? if lib.versionAtLeast ocaml.version "4.14" then "0.9.9" else "0.9.8"
+}:
 
 lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
   "uuidm is not available for OCaml ${ocaml.version}"
 
-stdenv.mkDerivation rec {
-  version = "0.9.8";
+stdenv.mkDerivation {
+  inherit version;
   pname = "uuidm";
   src = fetchurl {
     url = "https://erratique.ch/software/uuidm/releases/uuidm-${version}.tbz";
-    sha256 = "sha256-/GZbkJVDQu1UY8SliK282kUWAVMfOnpQadUlRT/tJrM=";
+    hash = {
+      "0.9.9" = "sha256-jOgNF05dpoU/XQEefSZhn3zSlQ1BA1b/U4Ib9j2mvFo=";
+      "0.9.8" = "sha256-/GZbkJVDQu1UY8SliK282kUWAVMfOnpQadUlRT/tJrM=";
+    }."${version}";
   };
 
-  postPatch = ''
-    substituteInPlace pkg/META --replace "bytes" ""
-  '';
-
   strictDeps = true;
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];

From b63ca881dd6ab8faa1588c5815100b6fefdb676b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christina=20S=C3=B8rensen?= <christina@cafkafk.com>
Date: Fri, 18 Oct 2024 16:08:09 +0200
Subject: [PATCH 25/38] eza: 0.20.2 -> 0.20.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changelog: https://github.com/eza-community/eza/releases/tag/v0.20.4
Signed-off-by: Christina Sørensen <christina@cafkafk.com>
---
 pkgs/by-name/ez/eza/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 0753bf9f8be4..d94f62a63469 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.2";
+  version = "0.20.4";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-lit0v9emrAYkHWpCP1Z35UdrKdMiDh2HWeQg4WfxJIo=";
+    hash = "sha256-0wkFVExa8HCe3UBDMWjq2UAtrW1zmUQHAcVgWgmPPWM=";
   };
 
-  cargoHash = "sha256-TwUbEeka20K9C8TvJH/Hiv8qp66TjAkcyMG7K2JuagQ=";
+  cargoHash = "sha256-GWrhW9+bX0pc78Seb6WHvWjCSe8XWKiHYUXRMFq+LbY=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]

From 1306e829f2020552924bee72ebbce8a32d327804 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Oct 2024 14:06:33 +0000
Subject: [PATCH 26/38] gpscorrelate: 2.1 -> 2.2

---
 pkgs/by-name/gp/gpscorrelate/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/gp/gpscorrelate/package.nix b/pkgs/by-name/gp/gpscorrelate/package.nix
index bb72042c21c5..d9801f5d704c 100644
--- a/pkgs/by-name/gp/gpscorrelate/package.nix
+++ b/pkgs/by-name/gp/gpscorrelate/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gpscorrelate";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "dfandrich";
     repo = "gpscorrelate";
     rev = version;
-    hash = "sha256-1t9XUY12hVaUNOg785dMJCiaMMCI2XCcif1DkKYXOoo=";
+    hash = "sha256-H1kqOzL79/Y1kHVEQ5y9JRWTDCBMbtEPo75drm8+7Qo=";
   };
 
   nativeBuildInputs = [
@@ -48,11 +48,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  preCheck = ''
-    # https://github.com/dfandrich/gpscorrelate/issues/29
-    rm tests/data/test005.*
-  '';
-
   installTargets = [ "install" "install-po" "install-desktop-file" ];
 
   meta = with lib; {

From 9f421e6497592f6850cb9317366460a716b46afc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 18 Oct 2024 17:00:10 +0200
Subject: [PATCH 27/38] python312Packages.breathe: disable failing tests

Exclude tests that broke with Sphinx 7.4.x. The upstream project is sadly
not very well maintained these days due to funding reasons.
---
 pkgs/development/python-modules/breathe/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/breathe/default.nix b/pkgs/development/python-modules/breathe/default.nix
index 4564364bfe5e..27fef0c6a5b9 100644
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@@ -46,6 +46,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # tests fail with sphinx 7.4.x
+    "tests/test_renderer.py"
+  ];
+
   pythonImportsCheck = [ "breathe" ];
 
   meta = {

From a9e2aef0338d565bc4ebd901c56e477a00af7cd4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Oct 2024 15:05:40 +0000
Subject: [PATCH 28/38] mapserver: 8.2.1 -> 8.2.2

---
 pkgs/by-name/ma/mapserver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 5d1739d07c07..7e8820ba582f 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mapserver";
-  version = "8.2.1";
+  version = "8.2.2";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "MapServer";
     rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-kZEDC89yoQP0ma5avp6r+Hz8JMpErGlBVQkhlHO6UFw=";
+    hash = "sha256-tub0Jd1IUkONQ5Mqz8urihbrcFLlOQybLhOvzkcwW54=";
   };
 
   nativeBuildInputs =

From cdfb779caa8c7458e014d21c8f7d3e8c37cbb9bc Mon Sep 17 00:00:00 2001
From: Jack Wilsdon <jack@wilsdon.me>
Date: Thu, 17 Oct 2024 22:55:57 +0100
Subject: [PATCH 29/38] python3Packages.flask-mail: disable broken tests

---
 pkgs/development/python-modules/flask-mail/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/flask-mail/default.nix b/pkgs/development/python-modules/flask-mail/default.nix
index 104d6f3da2b0..0f1e4e227e6b 100644
--- a/pkgs/development/python-modules/flask-mail/default.nix
+++ b/pkgs/development/python-modules/flask-mail/default.nix
@@ -31,6 +31,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # Broken by fix for CVE-2023-27043.
+    # Reported upstream in https://github.com/pallets-eco/flask-mail/issues/233
+    "test_unicode_sender_tuple"
+    "test_unicode_sender"
+  ];
+
   meta = {
     description = "Flask extension providing simple email sending capabilities";
     homepage = "https://github.com/pallets-eco/flask-mail";

From fc31cfea42541950a70e687703fa00a3b27e1a20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 18 Oct 2024 17:29:18 +0200
Subject: [PATCH 30/38] nixos/plasma6: fix shellcheck findings with
 enableStrictShellChecks enabled

---
 nixos/modules/services/desktop-managers/plasma6.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index af7b27f28e26..eca4862b16f1 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -12,7 +12,7 @@
 
   activationScript = ''
     # will be rebuilt automatically
-    rm -fv $HOME/.cache/ksycoca*
+    rm -fv "$HOME/.cache/ksycoca"*
   '';
 in {
   options = {

From 82c8a151e37d2a26586a62e926790ecabc0c0eb9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 18 Oct 2024 17:18:36 +0200
Subject: [PATCH 31/38] python312Packages.aioairzone: 0.9.4 -> 0.9.5

https://github.com/Noltari/aioairzone/releases/tag/0.9.5
---
 pkgs/development/python-modules/aioairzone/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index 306dd1aff433..21d831c9e24e 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.9.4";
+  version = "0.9.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone";
     rev = "refs/tags/${version}";
-    hash = "sha256-dcYp5lMN5twK1HQK/3PhBQ4nm/NKURC0x14ozkbzJ5A=";
+    hash = "sha256-LFMHueSz0ddZNYUL0uuC91dw1ppYcdE/EjKX0ikc+J0=";
   };
 
   build-system = [ setuptools ];

From e8a263c190b61ab17f06bd5092d2d8eb8de095fc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 18 Oct 2024 17:18:57 +0200
Subject: [PATCH 32/38] python312Packages.solarlog-cli: 0.3.1 -> 0.3.2

https://github.com/dontinelli/solarlog_cli/releases/tag/v0.3.2
---
 pkgs/development/python-modules/solarlog-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/solarlog-cli/default.nix b/pkgs/development/python-modules/solarlog-cli/default.nix
index ef88f6db9363..b82b69d8c2f0 100644
--- a/pkgs/development/python-modules/solarlog-cli/default.nix
+++ b/pkgs/development/python-modules/solarlog-cli/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "solarlog-cli";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dontinelli";
     repo = "solarlog_cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-67ZEval+cRvjFhQynFVYf5FFDw+zWrAfSC/2d6X+oh4=";
+    hash = "sha256-Oa2o4fuchW3ROtQFVhiWL6rhdUbzSFDegCkm8W7bCpE=";
   };
 
   build-system = [ hatchling ];

From bd63b5fef27fe82cd6cd4d8b120d7e0681d19389 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 18 Oct 2024 17:19:35 +0200
Subject: [PATCH 33/38] python312Packages.pyblu: 1.0.4 -> 1.0.4

https://github.com/LouisChrist/pyblu/releases/tag/v1.0.4
---
 pkgs/development/python-modules/pyblu/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyblu/default.nix b/pkgs/development/python-modules/pyblu/default.nix
index 867ca8ba31cb..c149661969ea 100644
--- a/pkgs/development/python-modules/pyblu/default.nix
+++ b/pkgs/development/python-modules/pyblu/default.nix
@@ -12,16 +12,18 @@
 
 buildPythonPackage rec {
   pname = "pyblu";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LouisChrist";
     repo = "pyblu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1H7TqFPVstB+nCYwWOT8E2HcmkLQx9pekBq2WIAf8DQ=";
+    hash = "sha256-BDuptBC72XG+q/5MlbPMjYDIhWKg4gfEo2pLOflwQaM=";
   };
 
+  pythonRelaxDeps = [ "aiohttp" ];
+
   build-system = [ poetry-core ];
 
   dependencies = [

From f5a4fca45c5c13578b5de59d9a02d366fa890c7c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 17 Oct 2024 01:38:12 +0200
Subject: [PATCH 34/38] python312Packages.home-assistant-bluetooth: 1.12.2 ->
 1.13.0

https://github.com/home-assistant-libs/home-assistant-bluetooth/blob/v1.13.0/CHANGELOG.md
---
 .../python-modules/home-assistant-bluetooth/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index fc288114c374..c289b781a598 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.12.2";
+  version = "1.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "home-assistant-bluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WAsgiOmYqmt/PCKp+vZA2To95YZAgnYCF8ysCn5N9nc=";
+    hash = "sha256-+2bw4im09TyjJ5/7ct42ZCFwU7yKWQnbSo7b+44VtpE=";
   };
 
   postPatch = ''

From 4f560da920d6a7d4042a12f68cf8fa13946e0b9a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 13 Oct 2024 02:10:16 +0200
Subject: [PATCH 35/38] python312Packages.pyipp: 0.16.0 -> 0.17.0

https://github.com/ctalkington/python-ipp/releases/tag/0.17.0
---
 pkgs/development/python-modules/pyipp/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyipp/default.nix b/pkgs/development/python-modules/pyipp/default.nix
index 284fb8368ffd..e3d051ab07d9 100644
--- a/pkgs/development/python-modules/pyipp/default.nix
+++ b/pkgs/development/python-modules/pyipp/default.nix
@@ -12,12 +12,13 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
+  syrupy,
   yarl,
 }:
 
 buildPythonPackage rec {
   pname = "pyipp";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +27,7 @@ buildPythonPackage rec {
     owner = "ctalkington";
     repo = "python-ipp";
     rev = "refs/tags/${version}";
-    hash = "sha256-ddI9K0lJDZbVgO+hptP4I+EH//5vOoFDYXWxGALF8Ik=";
+    hash = "sha256-B3x6WkTSTGlZWMAK2BTA2EVVz+IvB3QL+arZGBAkZsE=";
   };
 
   postPatch = ''
@@ -49,6 +50,7 @@ buildPythonPackage rec {
     aresponses
     pytest-asyncio
     pytestCheckHook
+    syrupy
   ];
 
   __darwinAllowLocalNetworking = true;

From 5f3bbf8a5dd2ef61db05d2793b04fd2e8b66646f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 18 Oct 2024 17:35:42 +0200
Subject: [PATCH 36/38] home-assistant: 2024.10.2 -> 2024.10.3

https://github.com/home-assistant/core/releases/tag/2024.10.3
---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 pkgs/servers/home-assistant/default.nix            | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 58dbbd5cc0a1..8fe00f2433a4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.10.2";
+  version = "2024.10.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 6fc00b593afc..94b9758dccb5 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -408,7 +408,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.10.2";
+  hassVersion = "2024.10.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -426,13 +426,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-YHK6SJJok1FGtFfD2C2QFCtWzNK1ZiOGZe/kbQFkMvU=";
+    hash = "sha256-kxxa7FI2wIpE3bEifNyjtEHj7rsuImQvxGd6I46ySqM=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-mVKokL6EcvLMvOEKIw1dlEQeXaxMLO8ExMOzw6r1eCs=";
+    hash = "sha256-DhDdCvov5/Yf2MnY2veV8W/lYk3LTDzxYpbAsbjxWcg=";
   };
 
   build-system = with python.pkgs; [

From 61ef66f8e7605fb8228cc6e9ceea0163d9b4a5b1 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 18 Oct 2024 20:17:26 +0400
Subject: [PATCH 37/38] mapserver: modernize

---
 pkgs/by-name/ma/mapserver/package.nix | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 7e8820ba582f..43996b4c92d5 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -70,23 +70,24 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional withPython python3;
 
   cmakeFlags = [
-    "-DWITH_KML=ON"
-    "-DWITH_SOS=ON"
-    "-DWITH_RSVG=ON"
-    "-DWITH_CURL=ON"
-    "-DWITH_CLIENT_WMS=ON"
-    "-DWITH_CLIENT_WFS=ON"
+    (lib.cmakeBool "WITH_KML" true)
+    (lib.cmakeBool "WITH_SOS" true)
+    (lib.cmakeBool "WITH_RSVG" true)
+    (lib.cmakeBool "WITH_CURL" true)
+    (lib.cmakeBool "WITH_CLIENT_WMS" true)
+    (lib.cmakeBool "WITH_CLIENT_WFS" true)
+    (lib.cmakeBool "WITH_PYTHON" withPython)
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optional withPython "-DWITH_PYTHON=ON";
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Platform for publishing spatial data and interactive mapping applications to the web";
     homepage = "https://mapserver.org/";
     changelog = "https://mapserver.org/development/changelog/";
-    license = licenses.mit;
-    maintainers = teams.geospatial.members;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = lib.teams.geospatial.members;
+    platforms = lib.platforms.unix;
   };
 }

From 065da7698d7c51c093d061714df289ee6e81641c Mon Sep 17 00:00:00 2001
From: Harry Askham <harryaskham@gmail.com>
Date: Fri, 18 Oct 2024 10:26:51 +0100
Subject: [PATCH 38/38] doc: Cross-link mention of symlinkJoin in
 'Multiple-output packages'

Per #36886, would have saved me some time today to have the trivial
builder more visible.
---
 doc/stdenv/multiple-output.chapter.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/stdenv/multiple-output.chapter.md b/doc/stdenv/multiple-output.chapter.md
index 5e86d2aa3d56..09fdba01c44a 100644
--- a/doc/stdenv/multiple-output.chapter.md
+++ b/doc/stdenv/multiple-output.chapter.md
@@ -21,7 +21,7 @@ In the Nix language the individual outputs can be reached explicitly as attribut
 
 When a multiple-output derivation gets into a build input of another derivation, the `dev` output is added if it exists, otherwise the first output is added. In addition to that, `propagatedBuildOutputs` of that package which by default contain `$outputBin` and `$outputLib` are also added. (See [](#multiple-output-file-type-groups).)
 
-In some cases it may be desirable to combine different outputs under a single store path. A function `symlinkJoin` can be used to do this. (Note that it may negate some closure size benefits of using a multiple-output package.)
+In some cases it may be desirable to combine different outputs under a single store path. The `symlinkJoin` builder can be used to do this. (See [](#trivial-builder-symlinkJoin)). Note that this may negate some closure size benefits of using a multiple-output package.
 
 ## Writing a split derivation {#sec-multiple-outputs-}