From b6e813b8cdd7bbf4f447ec4c259c85155a5cf06f Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 25 Jul 2024 18:53:17 +0300
Subject: [PATCH 01/34] treewide: Rename android `sdkVer` and `ndkVer`

`sdkVer` conflicts with the old `sdkVer`(now `darwinSdkVersion` but that still uses `sdkVer` if set) used by darwin

This shouldn't be an issue but due to `pkgs/development/interpreters/python/cpython/default.nix`
running `lib.filterAttrs (n: v: ! lib.isDerivation v && n != "passthruFun")` on it's inputs (2 of them are darwin only)
the `throw "Unsupported sdk...` in `pkgs/top-level/darwin-packages.nix` will be triggered.

After this change `pkgsCross.armv7a-android-prebuilt.python3.pythonOnBuildForHost` won't fail with
`error: Unsupported sdk: 33`

Issue was bisected to 3cb23cec239d4f73bb1b51f26ac7599384fdadd6

(cherry picked from commit 1144d46f9510b8c31d0195e8049caa0df3eb3fec)
---
 lib/systems/examples.nix                         | 10 ++++------
 .../androidndk-pkgs/androidndk-pkgs.nix          | 16 ++++++++--------
 pkgs/stdenv/cross/default.nix                    |  2 +-
 pkgs/top-level/all-packages.nix                  |  2 +-
 4 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 79ec4461e419..0fc37fa715a6 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -60,23 +60,21 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rustc.config = "armv7-linux-androideabi";
-    sdkVer = "28";
-    ndkVer = "24";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 
   aarch64-android-prebuilt = {
     config = "aarch64-unknown-linux-android";
     rustc.config = "aarch64-linux-android";
-    sdkVer = "28";
-    ndkVer = "24";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   };
 
   aarch64-android = {
     config = "aarch64-unknown-linux-android";
-    sdkVer = "30";
-    ndkVer = "24";
+    androidSdkVersion = "30";
+    androidNdkVersion = "24";
     libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index a8b172f4eb5d..561bae2a9b92 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -44,7 +44,7 @@ let
   buildInfo = ndkBuildInfoFun stdenv.buildPlatform;
   targetInfo = ndkTargetInfoFun stdenv.targetPlatform;
 
-  inherit (stdenv.targetPlatform) sdkVer;
+  androidSdkVersion = if (stdenv.targetPlatform ? androidSdkVersion && stdenv.targetPlatform.androidSdkVersion != null) then stdenv.targetPlatform.androidSdkVersion else (throw "`androidSdkVersion` is not set during the importing of nixpkgs");
   suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] stdenv.targetPlatform.config;
 
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
@@ -76,8 +76,8 @@ rec {
       cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
       find $out/toolchain -type d -exec chmod 777 {} \;
 
-      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
-        echo "NDK does not contain libraries for SDK version ${sdkVer}";
+      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion} ]; then
+        echo "NDK does not contain libraries for SDK version ${androidSdkVersion}";
         exit 1
       fi
 
@@ -85,8 +85,8 @@ rec {
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
       chmod +w $out/lib/*
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.so $out/lib/
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.o $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.o $out/lib/
 
       echo "INPUT(-lc++_static)" > $out/lib/libc++.a
 
@@ -129,7 +129,7 @@ rec {
     bintools = binutils;
     libc = targetAndroidndkPkgs.libraries;
     extraBuildCommands = ''
-      echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
+      echo "-D__ANDROID_API__=${stdenv.targetPlatform.androidSdkVersion}" >> $out/nix-support/cc-cflags
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
@@ -150,9 +150,9 @@ rec {
   # cross-compiling packages to wrap incorrectly wrap binaries we don't include
   # anyways.
   libraries = runCommand "bionic-prebuilt" {} ''
-    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
+    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}
     if [ ! -d $lpath ]; then
-      echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
+      echo "NDK does not contain libraries for SDK version ${androidSdkVersion} <$lpath>"
       exit 1
     fi
     mkdir -p $out/lib
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 1cbbfeb6d202..8aa83b8aa858 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -64,7 +64,7 @@ in lib.init bootStages ++ [
         cc = if crossSystem.useiOSPrebuilt or false
                then buildPackages.darwin.iosSdkPkgs.clang
              else if crossSystem.useAndroidPrebuilt or false
-               then buildPackages."androidndkPkgs_${crossSystem.ndkVer}".clang
+               then buildPackages."androidndkPkgs_${crossSystem.androidNdkVersion}".clang
              else if targetPlatform.isGhcjs
                # Need to use `throw` so tryEval for splicing works, ugh.  Using
                # `null` or skipping the attribute would cause an eval failure
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f54fce79166d..ded2b23ca8a4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20099,7 +20099,7 @@ with pkgs;
 
   # TODO(@Ericson2314): Build bionic libc from source
   bionic = if stdenv.hostPlatform.useAndroidPrebuilt
-    then pkgs."androidndkPkgs_${stdenv.hostPlatform.ndkVer}".libraries
+    then pkgs."androidndkPkgs_${stdenv.hostPlatform.androidNdkVer}".libraries
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
   boolstuff = callPackage ../development/libraries/boolstuff { };

From 799b4451fdd532610786f8b81b642767de3253c4 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 25 Jul 2024 20:09:42 +0300
Subject: [PATCH 02/34] lib.systems: throw if `sdkVer` or `ndkVer` are used for
 android.

Those attrs have been renamed and throwing is the best way to show it,
if we only warned then the user would only get an error like this `error: Unsupported sdk: 33`
from `pkgs/top-level/darwin-packages.nix`.

If someone wants to support multiple NixOS versions then they can simply
set both attrs. (`!args ? androidSdkVersion` is for that)

(cherry picked from commit 35e5943d69e0bfd7d3f265bf91f27b3c32b41d1b)
---
 lib/systems/default.nix  | 16 ++++++++++++++++
 lib/systems/examples.nix |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0981122388bb..9eacf831bac5 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -255,6 +255,22 @@ let
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"
         else if final.isiOS then "IPHONEOS_DEPLOYMENT_TARGET"
         else null;
+
+      # Remove before 25.05
+      androidSdkVersion =
+        if (args ? sdkVer && !args ? androidSdkVersion) then
+          throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidSdkVersion
+        else
+          null;
+      androidNdkVersion =
+        if (args ? ndkVer && !args ? androidNdkVersion) then
+          throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidNdkVersion
+        else
+          null;
     } // (
       let
         selectEmulator = pkgs:
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 0fc37fa715a6..ae76569ad859 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -60,6 +60,8 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rustc.config = "armv7-linux-androideabi";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 

From 2c8f6aa77d72bb8f1d666ffc574c5147627766b7 Mon Sep 17 00:00:00 2001
From: squalus <squalus@squalus.net>
Date: Sat, 24 Aug 2024 10:36:59 -0700
Subject: [PATCH 03/34] librewolf-unwrapped: add librewolf pref pane

- Adds the Librewolf preferences pane
- Adds an extra patching step from the upstream build script

https://codeberg.org/librewolf/source/src/commit/1b75cbb46/scripts/librewolf-patches.py#L132

Fixes #300107

(cherry picked from commit ddc59b790063200b95b4bb4abb66660263b895d1)
---
 .../networking/browsers/librewolf/librewolf.nix           | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index 04dec5ecff29..676a4646c715 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -6,7 +6,7 @@ rec {
 
   inherit (src) packageVersion firefox source;
 
-  extraPatches = [ ];
+  extraPatches = [ "${source}/patches/pref-pane/pref-pane-small.patch" ];
 
   extraConfigureFlags = [
     "--with-app-name=librewolf"
@@ -26,6 +26,12 @@ rec {
     cp ${source}/assets/search-config.json services/settings/dumps/main/search-config.json
     sed -i '/MOZ_SERVICES_HEALTHREPORT/ s/True/False/' browser/moz.configure
     sed -i '/MOZ_NORMANDY/ s/True/False/' browser/moz.configure
+
+    cp ${source}/patches/pref-pane/category-librewolf.svg browser/themes/shared/preferences
+    cp ${source}/patches/pref-pane/librewolf.css browser/themes/shared/preferences
+    cp ${source}/patches/pref-pane/librewolf.inc.xhtml browser/components/preferences
+    cp ${source}/patches/pref-pane/librewolf.js browser/components/preferences
+    cat ${source}/patches/pref-pane/preferences.ftl >> browser/locales/en-US/browser/preferences/preferences.ftl
   '';
 
   extraPrefsFiles = [ "${src.settings}/librewolf.cfg" ];

From bf04bfe620c2e99dab8d4c1755e96e077fe2368d Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Sun, 25 Aug 2024 00:38:32 -0400
Subject: [PATCH 04/34] bitwarden-desktop: 2024.6.4 -> 2024.8.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Diff: https://github.com/bitwarden/clients/compare/desktop-v2024.6.4...desktop-v2024.8.0

Changelog: https://github.com/bitwarden/clients/releases/tag/desktop-v2024.7.1
           https://github.com/bitwarden/clients/releases/tag/desktop-v2024.8.0

- The postPatch to fixup broken package{,-lock}.json in upstream seems
  to be no longer needed, so (happily) remove
- Python 3.12 removed distutils, so get it from setuptools
- Workaround broken node-argon2 dependency due to being updated (see
  inline comment)
- desktop_native/napi was split out of desktop_native, so adjust
  accordingly

Co-authored-by: Robert Schütz <mail@dotlambda.de>
(cherry picked from commit ac2fdbefa1176afda6cd46b5beec6ad7ca40e399)
---
 pkgs/by-name/bi/bitwarden-desktop/package.nix | 49 ++++++++++---------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index ce9bc31eb2bc..145f3dc10f3a 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -3,7 +3,7 @@
 , cargo
 , copyDesktopItems
 , dbus
-, electron_29
+, electron_31
 , fetchFromGitHub
 , glib
 , gnome
@@ -12,7 +12,6 @@
 , libsecret
 , makeDesktopItem
 , makeWrapper
-, moreutils
 , napi-rs-cli
 , nodejs_20
 , patchutils_0_4_2
@@ -26,41 +25,28 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_29;
+  electron = electron_31;
 in buildNpmPackage rec {
   pname = "bitwarden-desktop";
-  version = "2024.6.4";
+  version = "2024.8.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-oQ2VZoxePdYUC+xMKlRMpvPubSPULvt31XSh/OBw3Ec=";
+    hash = "sha256-szIa7fASDmeWKZPc6HtHKeXKerCAXrYZQWTVFMugAxk=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
   ];
 
-  # The nested package-lock.json from upstream is out-of-date, so copy the
-  # lock metadata from the root package-lock.json.
-  postPatch = ''
-    cat {,apps/desktop/src/}package-lock.json \
-      | ${lib.getExe jq} -s '
-        .[1].packages."".dependencies.argon2 = .[0].packages."".dependencies.argon2
-          | .[0].packages."" = .[1].packages.""
-          | .[1].packages = .[0].packages
-          | .[1]
-        ' \
-      | ${moreutils}/bin/sponge apps/desktop/src/package-lock.json
-  '';
-
   nodejs = nodejs_20;
 
   makeCacheWritable = true;
   npmFlags = [ "--engine-strict" "--legacy-peer-deps" ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-9d9pWrFYelAx/PPDHY3m92Frp8RSQuBqpiOjmWtm/1g=";
+  npmDepsHash = "sha256-5neEpU7ZhVO5OR181owsvAnFfl7lr0MymvqbRFCPs3M=";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
@@ -76,7 +62,7 @@ in buildNpmPackage rec {
       patches;
     patchFlags = [ "-p4" ];
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-ZmblY1APVa8moAR1waVBZPhrf5Wt1Gi6dvAxkhizckQ=";
+    hash = "sha256-ya/5z5XpsyuWayziLxuETu/dY8LzZspaAMqL2p8jYN8=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
@@ -87,10 +73,9 @@ in buildNpmPackage rec {
     copyDesktopItems
     jq
     makeWrapper
-    moreutils
     napi-rs-cli
     pkg-config
-    python3
+    (python3.withPackages (ps: with ps; [ setuptools ]))
     rustc
     rustPlatform.cargoCheckHook
     rustPlatform.cargoSetupHook
@@ -102,18 +87,36 @@ in buildNpmPackage rec {
     libsecret
   ];
 
+  # node-argon2 builds with LTO, but that causes missing symbols. So disable it
+  # and rebuild. Then we need to copy it into the build output for
+  # electron-builder, as `apps/desktop/src/package.json` specifies `argon2` as
+  # a dependency and electron-builder will otherwise install a fresh (and
+  # broken) argon2. See https://github.com/ranisalt/node-argon2/pull/415
+  preConfigure = ''
+    pushd node_modules/argon2
+    substituteInPlace binding.gyp --replace-fail '"-flto", ' ""
+    "$npm_config_node_gyp" rebuild
+    popd
+    mkdir -p apps/desktop/build/node_modules
+    cp -r ./{,apps/desktop/build/}node_modules/argon2
+  '';
+
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
+
+    pushd apps/desktop/desktop_native/napi
+    npm run build
+    popd
   '';
 
   postBuild = ''
     pushd apps/desktop
 
     # desktop_native/index.js loads a file of that name regarldess of the libc being used
-    mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
+    mv desktop_native/napi/desktop_napi.* desktop_native/napi/desktop_napi.linux-x64-musl.node
 
     npm exec electron-builder -- \
       --dir \

From 57321d2ed2f5bbe6bfc32f23a2d219db1eef84a5 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Sun, 5 May 2024 11:33:00 +0200
Subject: [PATCH 05/34] nodePackages: enable overriding src and name attrs

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 4549773edf119c40f3285fd46b662a5ceec2e456)
---
 pkgs/development/node-packages/node-env.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index bc1e36628ac8..5400fc63588e 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -109,7 +109,7 @@ let
     );
 
   # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+  composePackage = { name, packageName, src, dependencies ? [], ... }:
     builtins.addErrorContext "while evaluating node package '${packageName}'" ''
       installPackage "${packageName}" "${src}"
       ${includeDependencies { inherit dependencies; }}
@@ -194,7 +194,7 @@ let
   # dependencies in the package.json file to the versions that are actually
   # being used.
 
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }:
     ''
       if [ -d "${packageName}" ]
       then
@@ -496,7 +496,7 @@ let
     let
       extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
     in
-    stdenv.mkDerivation ({
+    stdenv.mkDerivation (finalAttrs: {
       name = "${name}${if version == null then "" else "-${version}"}";
       buildInputs = [ tarWrapper python nodejs ]
         ++ lib.optional (stdenv.isLinux) utillinux
@@ -508,8 +508,9 @@ let
       inherit dontStrip; # Stripping may fail a build for some package deployments
       inherit dontNpmInstall preRebuild unpackPhase buildPhase;
 
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+      # TODO: enable overriding dependencies too?
+      compositionScript = composePackage { inherit packageName dependencies; inherit (finalAttrs) name src; };
+      pinpointDependenciesScript = pinpointDependenciesOfPackage { inherit packageName dependencies production; };
 
       passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
 

From 8fe4a3a933fee677d79e5623b784df43194662d4 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 17 May 2024 11:09:12 +0200
Subject: [PATCH 06/34] pnpm: init at 9.1.1

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 53af969d621c29357788baf5642ed28ada3b5f00)
---
 pkgs/development/tools/pnpm/default.nix | 20 ++++++++++
 pkgs/development/tools/pnpm/generic.nix | 50 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  4 ++
 3 files changed, 74 insertions(+)
 create mode 100644 pkgs/development/tools/pnpm/default.nix
 create mode 100644 pkgs/development/tools/pnpm/generic.nix

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
new file mode 100644
index 000000000000..6fe9bc5cbe4f
--- /dev/null
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -0,0 +1,20 @@
+{ lib, callPackage }:
+let
+  inherit (lib) mapAttrs' nameValuePair;
+
+  variants = {
+    "8" = {
+      version = "8.15.8";
+      hash = "sha256-aR/hdu6pqKgN8g5JdvPftEoEhBzriFY4/iomF0+B5l4=";
+    };
+    "9" = {
+      version = "9.1.1";
+      hash = "sha256-lVHoA9y3oYOf31QWFTqEQGDHvOATIYzoI0EFMlBKwQs=";
+    };
+  };
+
+  callPnpm = variant: callPackage ./generic.nix {inherit (variant) version hash;};
+
+  mkPnpm = versionSuffix: variant: nameValuePair "pnpm_${versionSuffix}" (callPnpm variant);
+in
+mapAttrs' mkPnpm variants
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
new file mode 100644
index 000000000000..81fd5c2967dd
--- /dev/null
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  nodejs,
+  testers,
+  withNode ? true,
+
+  version,
+  hash,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pnpm";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://registry.npmjs.org/pnpm/-/pnpm-${finalAttrs.version}.tgz";
+    inherit hash;
+  };
+
+  buildInputs = lib.optionals withNode [ nodejs ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{bin,libexec}
+    cp -R . $out/libexec/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpm.cjs $out/bin/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpx.cjs $out/bin/pnpx
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests.version = lib.optionalAttrs withNode (
+      testers.testVersion { package = finalAttrs.finalPackage; }
+    );
+  };
+
+  meta = with lib; {
+    description = "Fast, disk space efficient package manager for JavaScript";
+    homepage = "https://pnpm.io/";
+    changelog = "https://github.com/pnpm/pnpm/releases/tag/v${finalAttrs.version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scrumplex ];
+    platforms = platforms.all;
+    mainProgram = "pnpm";
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4dc9c547e6c6..8e8293ee5cad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11891,6 +11891,10 @@ with pkgs;
 
   pngquant = callPackage ../tools/graphics/pngquant { };
 
+  inherit (callPackages ../development/tools/pnpm { })
+    pnpm_8 pnpm_9;
+  pnpm = pnpm_9;
+
   po4a = perlPackages.Po4a;
 
   poac = callPackage ../development/tools/poac {

From 3f4a4d0672c4f5f0787f53b086a15be0067de88b Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 22 Feb 2024 23:22:44 +0100
Subject: [PATCH 07/34] pnpm.fetchDeps: init

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 74f5ff78bfb0caae8dff6554b57dab7ca5ea9ca4)
---
 .../javascript.section.md                     | 63 ++++++++++++++
 .../tools/pnpm/fetch-deps/default.nix         | 83 +++++++++++++++++++
 .../tools/pnpm/fetch-deps/pnpm-config-hook.sh | 40 +++++++++
 pkgs/development/tools/pnpm/generic.nix       | 11 ++-
 4 files changed, 193 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/tools/pnpm/fetch-deps/default.nix
 create mode 100644 pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index f706f92c6691..5421ca0258b1 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -310,6 +310,69 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 - `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
 - `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
 
+### pnpm {#javascript-pnpm}
+
+Pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8` and `pnpm_9`, which support different sets of lock file versions.
+
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The functions `pnpm_8.fetchDeps` and `pnpm_9.fetchDeps` can create this pnpm store derivation. In conjunction, the setup hooks `pnpm_8.configHook` and `pnpm_9.configHook` will prepare the build environment to install the prefetched dependencies store. Here is an example for a package that contains a `package.json` and a `pnpm-lock.yaml` files using the above `pnpm_` attributes:
+
+```nix
+{
+  stdenv,
+  nodejs,
+  # This is pinned as { pnpm = pnpm_9; }
+  pnpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "foo";
+  version = "0-unstable-1980-01-01";
+
+  src = ...;
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "...";
+  };
+})
+```
+
+NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or `pnpm_9`), to increase future reproducibility. It might also be required to use an older version, if the package needs support for a certain lock file version.
+
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
+
+#### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
+
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`. Note, that projects using `pnpm-workspace.yaml` are currently not supported, and will probably not work using this approach.
+If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
+
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
+
+```
+.
+├── frontend
+│   ├── ...
+│   ├── package.json
+│   └── pnpm-lock.yaml
+└── ...
+```
+
+```nix
+  ...
+  pnpmDeps = pnpm.fetchDeps {
+    ...
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+  };
+
+  # by default the working directory is the extracted source
+  pnpmRoot = "frontend";
+```
+
 ### yarn2nix {#javascript-yarn2nix}
 
 #### Preparation {#javascript-yarn2nix-preparation}
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
new file mode 100644
index 000000000000..3a74f4cfe389
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -0,0 +1,83 @@
+{
+  stdenvNoCC,
+  fetchurl,
+  jq,
+  moreutils,
+  cacert,
+  makeSetupHook,
+  pnpm,
+}:
+{
+  fetchDeps =
+    {
+      src,
+      hash ? "",
+      pname,
+      ...
+    }@args:
+    let
+      args' = builtins.removeAttrs args [
+        "hash"
+        "pname"
+      ];
+      hash' =
+        if hash != "" then
+          { outputHash = hash; }
+        else
+          {
+            outputHash = "";
+            outputHashAlgo = "sha256";
+          };
+    in
+    stdenvNoCC.mkDerivation (
+      args'
+      // {
+        name = "${pname}-pnpm-deps";
+
+        nativeBuildInputs = [
+          jq
+          moreutils
+          pnpm
+          cacert
+        ];
+
+        installPhase = ''
+          runHook preInstall
+
+          export HOME=$(mktemp -d)
+          pnpm config set store-dir $out
+          # Some packages produce platform dependent outputs. We do not want to cache those in the global store
+          pnpm config set side-effects-cache false
+          # As we pin pnpm versions, we don't really care about updates
+          pnpm config set update-notifier false
+          # pnpm is going to warn us about using --force
+          # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
+          pnpm install --frozen-lockfile --ignore-script --force
+
+          runHook postInstall
+        '';
+
+        fixupPhase = ''
+          runHook preFixup
+
+          # Remove timestamp and sort the json files
+          rm -rf $out/v3/tmp
+          for f in $(find $out -name "*.json"); do
+            jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
+          done
+
+          runHook postFixup
+        '';
+
+        dontConfigure = true;
+        dontBuild = true;
+        outputHashMode = "recursive";
+      }
+      // hash'
+    );
+
+  configHook = makeSetupHook {
+    name = "pnpm-config-hook";
+    propagatedBuildInputs = [ pnpm ];
+  } ./pnpm-config-hook.sh;
+}
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
new file mode 100644
index 000000000000..fc0c47dbb70b
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -0,0 +1,40 @@
+# shellcheck shell=bash
+
+pnpmConfigHook() {
+    echo "Executing pnpmConfigHook"
+
+    if [ -n "${pnpmRoot-}" ]; then
+      pushd "$pnpmRoot"
+    fi
+
+    if [ -z "${pnpmDeps-}" ]; then
+      echo "Error: 'pnpmDeps' must be set when using pnpmConfigHook."
+      exit 1
+    fi
+
+    echo "Configuring pnpm store"
+
+    export HOME=$(mktemp -d)
+    export STORE_PATH=$(mktemp -d)
+
+    cp -Tr "$pnpmDeps" "$STORE_PATH"
+    chmod -R +w "$STORE_PATH"
+
+    pnpm config set store-dir "$STORE_PATH"
+
+    echo "Installing dependencies"
+
+    pnpm install --offline --frozen-lockfile --ignore-script
+
+    echo "Patching scripts"
+
+    patchShebangs node_modules/{*,.*}
+
+    if [ -n "${pnpmRoot-}" ]; then
+      popd
+    fi
+
+    echo "Finished pnpmConfigHook"
+}
+
+postConfigureHooks+=(pnpmConfigHook)
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index 81fd5c2967dd..c53dfd78f673 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenvNoCC,
+  callPackages,
   fetchurl,
   nodejs,
   testers,
@@ -8,9 +9,7 @@
 
   version,
   hash,
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
+}: stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pnpm";
   inherit version;
 
@@ -32,7 +31,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru = {
+  passthru = let
+    fetchDepsAttrs = callPackages ./fetch-deps { pnpm = finalAttrs.finalPackage; };
+  in {
+    inherit (fetchDepsAttrs) fetchDeps configHook;
+
     tests.version = lib.optionalAttrs withNode (
       testers.testVersion { package = finalAttrs.finalPackage; }
     );

From b4f5b3fa1a7dacceb2efc92ed42eeaf2971a7773 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Sun, 2 Jun 2024 19:55:18 +0200
Subject: [PATCH 08/34] pnpm.fetchDeps: add serve script

This script allows users to reuse the cached dependencies outside of
derivations.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 728d48285e5c17ed9764bc7067b9cece3ae81f15)
---
 .../tools/pnpm/fetch-deps/default.nix         | 12 ++++++--
 .../tools/pnpm/fetch-deps/serve.nix           | 30 +++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/tools/pnpm/fetch-deps/serve.nix

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 3a74f4cfe389..83972abf8b08 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -1,6 +1,7 @@
 {
   stdenvNoCC,
   fetchurl,
+  callPackage,
   jq,
   moreutils,
   cacert,
@@ -29,7 +30,7 @@
             outputHashAlgo = "sha256";
           };
     in
-    stdenvNoCC.mkDerivation (
+    stdenvNoCC.mkDerivation (finalAttrs: (
       args'
       // {
         name = "${pname}-pnpm-deps";
@@ -69,12 +70,19 @@
           runHook postFixup
         '';
 
+        passthru = {
+          serve = callPackage ./serve.nix {
+            inherit pnpm;
+            pnpmDeps = finalAttrs.finalPackage;
+          };
+        };
+
         dontConfigure = true;
         dontBuild = true;
         outputHashMode = "recursive";
       }
       // hash'
-    );
+    ));
 
   configHook = makeSetupHook {
     name = "pnpm-config-hook";
diff --git a/pkgs/development/tools/pnpm/fetch-deps/serve.nix b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
new file mode 100644
index 000000000000..a44022d841dc
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
@@ -0,0 +1,30 @@
+{ writeShellApplication, pnpm, pnpmDeps }:
+writeShellApplication {
+  name = "serve-pnpm-store";
+
+  runtimeInputs = [
+    pnpm
+  ];
+
+  text = ''
+    storePath=$(mktemp -d)
+
+    clean() {
+      echo "Cleaning up temporary store at '$storePath'..."
+
+      rm -rf "$storePath"
+    }
+
+    echo "Copying pnpm store '${pnpmDeps}' to temporary store..."
+
+    cp -Tr "${pnpmDeps}" "$storePath"
+    chmod -R +w "$storePath"
+
+    echo "Run 'pnpm install --store-dir \"$storePath\"' to install packages from this store."
+
+    trap clean EXIT
+
+    pnpm server start \
+      --store-dir "$storePath"
+  '';
+}

From b05ae8faade5592fea2894f2a3395ac2217e107f Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 3 Jun 2024 16:02:45 +0300
Subject: [PATCH 09/34] pnpm_{8,9}: remove uneeded binary files from src

(cherry picked from commit 711884c56608d76285b681c5024818e5ddc76d05)
---
 pkgs/development/tools/pnpm/generic.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index c53dfd78f673..5560f4aee6eb 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -17,6 +17,11 @@
     url = "https://registry.npmjs.org/pnpm/-/pnpm-${finalAttrs.version}.tgz";
     inherit hash;
   };
+  # Remove binary files from src, we don't need them, and this way we make sure
+  # our distribution is free of binaryNativeCode
+  preConfigure = ''
+    rm -r dist/reflink.*node dist/vendor
+  '';
 
   buildInputs = lib.optionals withNode [ nodejs ];
 

From 026b770445fcb4b7de5d13b04d437830f441d8fe Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 3 Jun 2024 16:06:26 +0300
Subject: [PATCH 10/34] doc/javascript: pnpm: mention lack of
 monorepos/workspaces support

(cherry picked from commit c704c029566aaf525d949b54b8a8d85bb6aab29b)
---
 doc/languages-frameworks/javascript.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 5421ca0258b1..76db9d0007ce 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -348,6 +348,8 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
+NOTE: Nixpkgs pnpm tooling doesn't support building projects with a `pnpm-workspace.yaml`, or building monorepos. It maybe possible to use `pnpm.fetchDeps` for these projects, but it may be hard or impossible to produce a binary from such projects ([an example attempt](https://github.com/NixOS/nixpkgs/pull/290715#issuecomment-2144543728)).
+
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`. Note, that projects using `pnpm-workspace.yaml` are currently not supported, and will probably not work using this approach.
 If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
 

From 1f011f99a6d61de0d17c725808666f90df310445 Mon Sep 17 00:00:00 2001
From: Nathan Scully <nathan.r.scully@gmail.com>
Date: Tue, 11 Jun 2024 21:28:45 +1000
Subject: [PATCH 11/34] pnpm: 9.1.1 -> 9.3.0

(cherry picked from commit 6ff6c421c69b7fe3eb6d7dd86756781fe415e230)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 6fe9bc5cbe4f..d6a47cfebf4b 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -8,8 +8,8 @@ let
       hash = "sha256-aR/hdu6pqKgN8g5JdvPftEoEhBzriFY4/iomF0+B5l4=";
     };
     "9" = {
-      version = "9.1.1";
-      hash = "sha256-lVHoA9y3oYOf31QWFTqEQGDHvOATIYzoI0EFMlBKwQs=";
+      version = "9.3.0";
+      hash = "sha256-4fno0aFmB6Rt08FYtfen3HlFUB0cYiLUVNY9Az0dkY8=";
     };
   };
 

From 7a627e3337f9e286af274b69d3b7cc84ebc7d4bd Mon Sep 17 00:00:00 2001
From: Maxime Brunet <max@brnt.mx>
Date: Sat, 15 Jun 2024 12:23:28 -0700
Subject: [PATCH 12/34] pnpm: install shell completions

(cherry picked from commit b331e60725f6608ef66d1e858e0943ea33316833)
---
 pkgs/development/tools/pnpm/generic.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index 5560f4aee6eb..7050df448970 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -3,6 +3,7 @@
   stdenvNoCC,
   callPackages,
   fetchurl,
+  installShellFiles,
   nodejs,
   testers,
   withNode ? true,
@@ -25,6 +26,8 @@
 
   buildInputs = lib.optionals withNode [ nodejs ];
 
+  nativeBuildInputs = [ installShellFiles nodejs ];
+
   installPhase = ''
     runHook preInstall
 
@@ -36,6 +39,25 @@
     runHook postInstall
   '';
 
+  postInstall =
+    if lib.toInt (lib.versions.major version) < 9 then ''
+      export HOME="$PWD"
+      node $out/bin/pnpm install-completion bash
+      node $out/bin/pnpm install-completion fish
+      node $out/bin/pnpm install-completion zsh
+      sed -i '1 i#compdef pnpm' .config/tabtab/zsh/pnpm.zsh
+      installShellCompletion \
+        .config/tabtab/bash/pnpm.bash \
+        .config/tabtab/fish/pnpm.fish \
+        .config/tabtab/zsh/pnpm.zsh
+    '' else ''
+      node $out/bin/pnpm completion bash >pnpm.bash
+      node $out/bin/pnpm completion fish >pnpm.fish
+      node $out/bin/pnpm completion zsh >pnpm.zsh
+      sed -i '1 i#compdef pnpm' pnpm.zsh
+      installShellCompletion pnpm.{bash,fish,zsh}
+    '';
+
   passthru = let
     fetchDepsAttrs = callPackages ./fetch-deps { pnpm = finalAttrs.finalPackage; };
   in {

From eb5d55b2af160665e5f5fe5381a2e14bc8ec09ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 6 Jun 2024 14:41:22 +0200
Subject: [PATCH 13/34] pnpm.fetchDeps: misc cleanup

(cherry picked from commit 49d9ddaa0f823c8c768ef3f0cee810f4660f1b4d)
---
 pkgs/development/tools/pnpm/fetch-deps/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 83972abf8b08..41c322013877 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -1,6 +1,5 @@
 {
   stdenvNoCC,
-  fetchurl,
   callPackage,
   jq,
   moreutils,
@@ -11,7 +10,6 @@
 {
   fetchDeps =
     {
-      src,
       hash ? "",
       pname,
       ...
@@ -36,10 +34,10 @@
         name = "${pname}-pnpm-deps";
 
         nativeBuildInputs = [
+          cacert
           jq
           moreutils
           pnpm
-          cacert
         ];
 
         installPhase = ''

From 0c8b42a51a8b7e5cef361fc7aa948f0002da4682 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 6 Jun 2024 14:41:44 +0200
Subject: [PATCH 14/34] pnpm.fetchDeps: error if lockfile version has a
 mismatch

(cherry picked from commit 7a1cd1fcf17e10c910d805104fa93f9ffd728e34)
---
 pkgs/development/tools/pnpm/fetch-deps/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 41c322013877..eb8b847960c5 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenvNoCC,
   callPackage,
   jq,
@@ -6,6 +7,7 @@
   cacert,
   makeSetupHook,
   pnpm,
+  yq,
 }:
 {
   fetchDeps =
@@ -38,11 +40,18 @@
           jq
           moreutils
           pnpm
+          yq
         ];
 
         installPhase = ''
           runHook preInstall
 
+          lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
+          if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
+            echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
+            exit 1
+          fi
+
           export HOME=$(mktemp -d)
           pnpm config set store-dir $out
           # Some packages produce platform dependent outputs. We do not want to cache those in the global store

From 1e7d78a522ed72773d49ad26b4f64fb32b699ac5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 26 Jun 2024 22:28:32 +0200
Subject: [PATCH 15/34] pnpm_9: 9.3.0 -> 9.4.0

(cherry picked from commit 7affeddbed52850139beb6b21e6190ea756abef2)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index d6a47cfebf4b..6ef6fb3c5f72 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -8,8 +8,8 @@ let
       hash = "sha256-aR/hdu6pqKgN8g5JdvPftEoEhBzriFY4/iomF0+B5l4=";
     };
     "9" = {
-      version = "9.3.0";
-      hash = "sha256-4fno0aFmB6Rt08FYtfen3HlFUB0cYiLUVNY9Az0dkY8=";
+      version = "9.4.0";
+      hash = "sha256-tv0L/aVV5+WErX5WswxosB1aBPnuk5ifS5PKhHPEnHQ=";
     };
   };
 

From 72b6b2e8f5977bb147ba47c009f6729eaa50874a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Tue, 9 Jul 2024 15:11:00 +0200
Subject: [PATCH 16/34] pnpm_9: 9.4.0 -> 9.6.0

(cherry picked from commit a04915fe1780f869cc9d86db3f7e798d9ad91683)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 6ef6fb3c5f72..f3cc4c206bd5 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -8,8 +8,8 @@ let
       hash = "sha256-aR/hdu6pqKgN8g5JdvPftEoEhBzriFY4/iomF0+B5l4=";
     };
     "9" = {
-      version = "9.4.0";
-      hash = "sha256-tv0L/aVV5+WErX5WswxosB1aBPnuk5ifS5PKhHPEnHQ=";
+      version = "9.6.0";
+      hash = "sha256-2uD36CLFayCXm7WWXjtzuL2rtri47xIdpthXUIWZyjU=";
     };
   };
 

From 5e5f785fa9aaad68ecc1bfa316e1bfa49daa48b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 19 Jul 2024 12:18:40 +0200
Subject: [PATCH 17/34] pnpm_8: 8.15.8 -> 8.15.9

(cherry picked from commit 1d8ea76d5407dc316225b8aa254fa8c3cdbab0f6)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index f3cc4c206bd5..48f0bb804050 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -4,8 +4,8 @@ let
 
   variants = {
     "8" = {
-      version = "8.15.8";
-      hash = "sha256-aR/hdu6pqKgN8g5JdvPftEoEhBzriFY4/iomF0+B5l4=";
+      version = "8.15.9";
+      hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
       version = "9.6.0";

From 39d4d862a25544dd484120ac4849c9269aab7b1b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 5 Aug 2024 18:31:34 +0300
Subject: [PATCH 18/34] pnpm_{8,9}.fetchDeps: put all pnpm install arguments in
 separate lines

(cherry picked from commit 27424c4c882164e68ecdc66d6a80740b7738b61f)
---
 pkgs/development/tools/pnpm/fetch-deps/default.nix         | 5 ++++-
 pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh | 6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index eb8b847960c5..17252c6cc043 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -60,7 +60,10 @@
           pnpm config set update-notifier false
           # pnpm is going to warn us about using --force
           # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
-          pnpm install --frozen-lockfile --ignore-script --force
+          pnpm install \
+              --force \
+              --ignore-script \
+              --frozen-lockfile
 
           runHook postInstall
         '';
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index fc0c47dbb70b..ba7b1b4094e8 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -24,7 +24,11 @@ pnpmConfigHook() {
 
     echo "Installing dependencies"
 
-    pnpm install --offline --frozen-lockfile --ignore-script
+    pnpm install \
+        --offline \
+        --ignore-script \
+        --frozen-lockfile
+
 
     echo "Patching scripts"
 

From 10481a20563730c6d62838e1fdf66eb757185d06 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 5 Aug 2024 18:32:27 +0300
Subject: [PATCH 19/34] pnpm_{8,9}.fetchDeps: fix --ignore-scripts argument

Co-authored-by: Niklas Korz <niklas@niklaskorz.de>
(cherry picked from commit 7eaa7e82529cb727f67453feb26e8e460b8385aa)
---
 pkgs/development/tools/pnpm/fetch-deps/default.nix         | 2 +-
 pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 17252c6cc043..65dc7c9cf527 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -62,7 +62,7 @@
           # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
           pnpm install \
               --force \
-              --ignore-script \
+              --ignore-scripts \
               --frozen-lockfile
 
           runHook postInstall
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index ba7b1b4094e8..00172f840aef 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -26,7 +26,7 @@ pnpmConfigHook() {
 
     pnpm install \
         --offline \
-        --ignore-script \
+        --ignore-scripts \
         --frozen-lockfile
 
 

From 1376fa54c2a6e02c99cf4f6da874fd1495d63ba8 Mon Sep 17 00:00:00 2001
From: Pyrox <pyrox@pyrox.dev>
Date: Sat, 29 Jun 2024 19:04:05 -0400
Subject: [PATCH 20/34] pnpm.fetchDeps: Add workspaces support and support for
 custom pnpm configuration commands

Solves #316908

(cherry picked from commit 875c9f044f4d9183933d72003987812e18ce3bc8)
---
 .../javascript.section.md                     | 55 ++++++++++++++++++-
 .../tools/pnpm/fetch-deps/default.nix         |  6 ++
 .../tools/pnpm/fetch-deps/pnpm-config-hook.sh |  6 ++
 3 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 76db9d0007ce..2acbc4fb0867 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -346,11 +346,11 @@ NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or
 
 In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
 
+`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-NOTE: Nixpkgs pnpm tooling doesn't support building projects with a `pnpm-workspace.yaml`, or building monorepos. It maybe possible to use `pnpm.fetchDeps` for these projects, but it may be hard or impossible to produce a binary from such projects ([an example attempt](https://github.com/NixOS/nixpkgs/pull/290715#issuecomment-2144543728)).
-
-If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`. Note, that projects using `pnpm-workspace.yaml` are currently not supported, and will probably not work using this approach.
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`.
 If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
 
 Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
@@ -375,6 +375,55 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
   pnpmRoot = "frontend";
 ```
 
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
+
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspace = "<workspace project name>"` in your `pnpm.fetchDeps` call,
+which will make PNPM only install dependencies for that workspace package.
+
+For example:
+
+```nix
+...
+pnpmWorkspace = "@astrojs/language-server";
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) pnpmWorkspace;
+  ...
+}
+```
+
+The above would make `pnpm.fetchDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
+Note that you do not need to set `sourceRoot` to make this work.
+
+Usually in such cases, you'd want to use `pnpm --filter=$pnpmWorkspace build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
+
+```nix
+buildPhase = ''
+  runHook preBuild
+
+  pnpm --filter=@astrojs/language-server build
+
+  runHook postBuild
+'';
+```
+
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
+
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
+set `prePnpmInstall` to the right commands to run. For example:
+
+```nix
+prePnpmInstall = ''
+  pnpm config set dedupe-peer-dependants false
+'';
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) prePnpmInstall;
+  ...
+};
+```
+
+In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
+
+
 ### yarn2nix {#javascript-yarn2nix}
 
 #### Preparation {#javascript-yarn2nix-preparation}
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 65dc7c9cf527..e5032da10590 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -14,6 +14,8 @@
     {
       hash ? "",
       pname,
+      pnpmWorkspace ? "",
+      prePnpmInstall ? "",
       ...
     }@args:
     let
@@ -29,6 +31,7 @@
             outputHash = "";
             outputHashAlgo = "sha256";
           };
+      installFlags = lib.optionalString (pnpmWorkspace != "")  "--filter=${pnpmWorkspace}";
     in
     stdenvNoCC.mkDerivation (finalAttrs: (
       args'
@@ -58,11 +61,14 @@
           pnpm config set side-effects-cache false
           # As we pin pnpm versions, we don't really care about updates
           pnpm config set update-notifier false
+          # Run any additional pnpm configuration commands that users provide.
+          ${prePnpmInstall}
           # pnpm is going to warn us about using --force
           # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
           pnpm install \
               --force \
               --ignore-scripts \
+              ${installFlags} \
               --frozen-lockfile
 
           runHook postInstall
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index 00172f840aef..e82a62f9101c 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -24,9 +24,15 @@ pnpmConfigHook() {
 
     echo "Installing dependencies"
 
+    if [[ -n "$pnpmWorkspace" ]]; then
+        pnpmInstallFlags+=("--filter=$pnpmWorkspace")
+    fi
+    runHook prePnpmInstall
+
     pnpm install \
         --offline \
         --ignore-scripts \
+        "${pnpmInstallFlags[@]}" \
         --frozen-lockfile
 
 

From 83069d01a613b11996729524a64ae4b89ea24cfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 7 Aug 2024 11:59:38 +0200
Subject: [PATCH 21/34] pnpm_9: 9.6.0 -> 9.7.0

(cherry picked from commit 57c288bfe2b6a26189a25fa17916705566c020d2)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 48f0bb804050..232948d7a093 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -8,8 +8,8 @@ let
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
-      version = "9.6.0";
-      hash = "sha256-2uD36CLFayCXm7WWXjtzuL2rtri47xIdpthXUIWZyjU=";
+      version = "9.7.0";
+      hash = "sha256-s1AY+/qPWDZosmSeQHkipyE1XNgfYb7rSsHUJY5YVVk=";
     };
   };
 

From 7d99e53b65b4305632ba97670daa540f2019c3eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Sun, 25 Aug 2024 13:10:23 -0700
Subject: [PATCH 22/34] imagemagick: 7.1.1-36 -> 7.1.1-37

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.1-36...7.1.1-37

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit c946f33531b4becda7270ae017692bebfec0ec94)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 952a13726f7a..539f5e657cb1 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -51,13 +51,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-36";
+  version = "7.1.1-37";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-Y/tj8IAhsCFK7Yd0MXZ8X6AOLxICyVOIaSaQveMf17k=";
+    hash = "sha256-dlcyCJw/tytb6z5VaogblUlzBRYBtijUJbkX3vZdeEU=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

From d5d2de09313bed25683535645674b1d413c36981 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Sun, 25 Aug 2024 13:22:45 -0700
Subject: [PATCH 23/34] librewolf: 129.0.1-1 -> 129.0.2-1

(cherry picked from commit a783da1ef3c5e3c9b350ba1abb4a7d1c73aa125e)
---
 .../networking/browsers/librewolf/src.json             | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 33f1e7d3b1cf..c92c6fda87e5 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "129.0.1-1",
+  "packageVersion": "129.0.2-1",
   "source": {
-    "rev": "129.0.1-1",
-    "sha256": "0pvv3v23q31hdjvqi1f3cqfyjrb8dbrrbfwxj2wacak1g0mzbxf4"
+    "rev": "129.0.2-1",
+    "sha256": "1zghj91bqy2746x4x6cwn503dkw1fmfv0wgq02wv2cwlp8mmd7j7"
   },
   "firefox": {
-    "version": "129.0.1",
-    "sha512": "27c463e8277994c62bab85cf0e2f0cea16a9b272694b61fa56a6b3bd7c70d6481774288386094836a54df54c1b1144d61be67f4f5eac418c05479d452221c027"
+    "version": "129.0.2",
+    "sha512": "f6805a87e5cb4e437583916e3ec1b312dc73eec5fc06ce7a038b13bd7c6827b18cf383c30645d96623ce41675351f3023ec6b9f89d676f1c889994eae79f2c13"
   }
 }

From fb3ed6024c63cfb46de99baa23ecad230b5a74da Mon Sep 17 00:00:00 2001
From: zendo <linzway@qq.com>
Date: Sun, 25 Aug 2024 10:55:15 +0800
Subject: [PATCH 24/34] deploy-rs: move to by-name

(cherry picked from commit 6eff98293278b4502539bc5fad6c25caa8afa6fc)
---
 .../default.nix => by-name/de/deploy-rs/package.nix}       | 7 +++----
 pkgs/top-level/all-packages.nix                            | 4 ----
 2 files changed, 3 insertions(+), 8 deletions(-)
 rename pkgs/{tools/package-management/deploy-rs/default.nix => by-name/de/deploy-rs/package.nix} (87%)

diff --git a/pkgs/tools/package-management/deploy-rs/default.nix b/pkgs/by-name/de/deploy-rs/package.nix
similarity index 87%
rename from pkgs/tools/package-management/deploy-rs/default.nix
rename to pkgs/by-name/de/deploy-rs/package.nix
index ad656ca385e4..08d83e701d0d 100644
--- a/pkgs/tools/package-management/deploy-rs/default.nix
+++ b/pkgs/by-name/de/deploy-rs/package.nix
@@ -2,8 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , rustPlatform
-, CoreServices
-, SystemConfiguration
+, darwin
 }:
 
 rustPlatform.buildRustPackage {
@@ -20,8 +19,8 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-Vo/45cZM/sBAaoikhEwCvduhMQjurwSZwCjwrIQn7IA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
-    CoreServices
-    SystemConfiguration
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8e8293ee5cad..26589c16c882 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -39177,10 +39177,6 @@ with pkgs;
 
   dell-530cdn = callPackage ../misc/drivers/dell-530cdn { };
 
-  deploy-rs = callPackage ../tools/package-management/deploy-rs {
-    inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
-  };
-
   dockutil = callPackage ../os-specific/darwin/dockutil { };
 
   eiciel = callPackage ../tools/filesystems/eiciel { };

From 5fda26f950a00bb87e910aff03e6e4e1859d75a4 Mon Sep 17 00:00:00 2001
From: zendo <linzway@qq.com>
Date: Sun, 25 Aug 2024 11:25:36 +0800
Subject: [PATCH 25/34] deploy-rs: unstable-2024-02-16 -> 0-unstable-2024-06-12

(cherry picked from commit 93fc93def0f78f772cab176825579a448ed7a641)
---
 pkgs/by-name/de/deploy-rs/package.nix | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/de/deploy-rs/package.nix b/pkgs/by-name/de/deploy-rs/package.nix
index 08d83e701d0d..9830785e6a30 100644
--- a/pkgs/by-name/de/deploy-rs/package.nix
+++ b/pkgs/by-name/de/deploy-rs/package.nix
@@ -1,33 +1,34 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
 }:
 
 rustPlatform.buildRustPackage {
   pname = "deploy-rs";
-  version = "unstable-2024-02-16";
+  version = "0-unstable-2024-06-12";
 
   src = fetchFromGitHub {
     owner = "serokell";
     repo = "deploy-rs";
-    rev = "0a0187794ac7f7a1e62cda3dabf8dc041f868790";
-    hash = "sha256-dTGGw2y8wvfjr+J9CjQbfdulOq72hUG17HXVNxpH1yE=";
+    rev = "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a";
+    hash = "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=";
   };
 
-  cargoHash = "sha256-Vo/45cZM/sBAaoikhEwCvduhMQjurwSZwCjwrIQn7IA=";
+  cargoHash = "sha256-lsW810bktMzHZIbuN3pz9N+IUcjNtE5J2AuB/G6pGWI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
     darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Multi-profile Nix-flake deploy tool";
     homepage = "https://github.com/serokell/deploy-rs";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ teutat3s ];
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ teutat3s ];
     mainProgram = "deploy";
   };
 }

From 8e13b43d94e2d41c5dd463e1d05e4ce2ef341093 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 24 Aug 2024 18:20:00 +0200
Subject: [PATCH 26/34] perlPackages.DBI: 1.643 -> 1.644

(cherry picked from commit edb0167f969964196ef8d0e6a896aa2f085affbd)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 28e48975c4d3..4ff91b21e584 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7288,10 +7288,10 @@ with self; {
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.643";
+    version = "1.644";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TIMB/DBI-1.643.tar.gz";
-      hash = "sha256-iiuZPbVgosNzwXTul2pRAn3XgOx2auF2IMIDk9LoNvo=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.644.tar.gz";
+      hash = "sha256-Ipe5neCeZwhmQLWQaZ4OmC+0adpjqT/ijcFHgtt6U8g=";
     };
     postInstall = lib.optionalString (perl ? crossVersion) ''
       mkdir -p $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI

From 81a75e9d2ff3ff519efe69b931d6e8f1ddd0fa76 Mon Sep 17 00:00:00 2001
From: Yaya <github@uwu.is>
Date: Thu, 22 Aug 2024 11:14:19 +0200
Subject: [PATCH 27/34] gitlab: 17.2.2 -> 17.2.4

https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/
https://gitlab.com/gitlab-org/gitlab/-/blob/v17.2.4-ee/CHANGELOG.md

Fixes CVE-2024-3127
Fixes CVE-2024-6502
Fixes CVE-2024-7110
Fixes CVE-2024-8041

(cherry picked from commit 61d815a20bdb9fd827c379de088a345aa8adfc60)
---
 .../applications/version-management/gitlab/data.json | 12 ++++++------
 .../version-management/gitlab/gitaly/default.nix     |  4 ++--
 .../gitlab/gitlab-pages/default.nix                  |  4 ++--
 .../gitlab/gitlab-workhorse/default.nix              |  2 +-
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 60ef72756c34..9a431ad88530 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "17.2.2",
-  "repo_hash": "1gk29bwd6vzikjg28p30wgdq9a46l4qbnac5r0h2mwih1sm8hlbc",
+  "version": "17.2.4",
+  "repo_hash": "0hj1v7w68axzdy2lwwc320zpg2r2qv2f9rl23yisni6975p03ayi",
   "yarn_hash": "10y540bxwaz355p9r4q34199aibadrd5p4d9ck2y3n6735k0hm74",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.2.2-ee",
+  "rev": "v17.2.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.2.2",
-    "GITLAB_PAGES_VERSION": "17.2.2",
+    "GITALY_SERVER_VERSION": "17.2.4",
+    "GITLAB_PAGES_VERSION": "17.2.4",
     "GITLAB_SHELL_VERSION": "14.37.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
-    "GITLAB_WORKHORSE_VERSION": "17.2.2"
+    "GITLAB_WORKHORSE_VERSION": "17.2.4"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 8d62fee32bf1..485af5b6efd9 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "17.2.2";
+  version = "17.2.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-4K0unlvhAnTIiuyRUNm0dXG5sJsxIuo8HkUQvUK7ws4=";
+      hash = "sha256-Y+Yi5kH/0s+yMuD/90Tdxeshp9m0Mrx080jmWnq/zZ0=";
     };
 
     vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 5c934a5afc83..0fecac629883 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-AtLsy2hHxqr3XyTItLfMoTmrUsM707Kme7jE2jAAfyc=";
+    hash = "sha256-7sB2MjU1iwqrOK8dNb7a14NFtrJ/7yoT07tzYVyCSJ8=";
   };
 
   vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 77ba5813469d..a7d2c7d2c0fd 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {

From 53a72b6f7d2262085d9dc05b25a12964884c6a59 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 26 May 2024 15:44:43 +0200
Subject: [PATCH 28/34] adwaita-icon-theme-legacy: init at 46.2

This theme contains icons required by icon-naming-spec that were removed from Adwaita icon theme proper few releases back.
Try installing it in addition to `gnome.adwaita-icon-theme` if some apps are missing icons.
See https://gitlab.gnome.org/GNOME/adwaita-icon-theme/-/issues/288 for more info.

Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
(cherry picked from commit e85cdfc65af6147fed5c82e93d4681d5cc644020)
---
 .../ad/adwaita-icon-theme-legacy/package.nix  | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix

diff --git a/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix b/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix
new file mode 100644
index 000000000000..3ffe3c70f17c
--- /dev/null
+++ b/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  meson,
+  ninja,
+  gtk4,
+  gnome,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adwaita-icon-theme-legacy";
+  version = "46.2";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/adwaita-icon-theme-legacy/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-legacy-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VISA9YWJpUty0Ygzt1WxX/vVZ+MYcknXTi4fj5nyL7Q=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gtk4 # for gtk4-update-icon-cache
+  ];
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "adwaita-icon-theme-legacy";
+    };
+  };
+
+  meta = with lib; {
+    description = "Fullcolor icon theme providing fallback for legacy apps";
+    homepage = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme-legacy";
+    license = licenses.cc-by-sa-30;
+    maintainers = teams.gnome.members;
+    platforms = platforms.all;
+  };
+})

From 3f6b5336eb20bfbfad0943d8ca40bbcb86e78b10 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 Aug 2024 08:30:59 +0000
Subject: [PATCH 29/34] discord: 0.0.63 -> 0.0.64

(cherry picked from commit 10913b690b8f0fa87d27b56c7054df408746e964)
---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index abd57741d898..e53ee375c7b9 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,7 +2,7 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.63";
+      stable = "0.0.64";
       ptb = "0.0.98";
       canary = "0.0.465";
       development = "0.0.24";
@@ -17,7 +17,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-KtVX9EJPYmzDQd2beV/dDW8jjLDjacKZDrD72kLUwKo=";
+        hash = "sha256-tBopyhGRNDmtOWSwwiNnPJJm82sk3s76cUun7erHRbM=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";

From 9608b32d810189b92a8d9878505264bcfd3fdc5d Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 23 Aug 2024 23:34:10 +0300
Subject: [PATCH 30/34] Discord updates

discord: 0.0.64 -> 0.0.65

discord-ptb: 0.0.98 -> 0.0.101

discord-canary: 0.0.465 -> 0.0.475

pkgsCross.aarch64-darwin.discord: 0.0.313 -> 0.0.316

pkgsCross.aarch64-darwin.discord-ptb: 0.0.127 -> 0.0.130

pkgsCross.aarch64-darwin.discord-canary: 0.0.574 -> 0.0.583

pkgsCross.aarch64-darwin.discord-development: 0.0.45 -> 0.0.46

(cherry picked from commit 9490a5f310f4b4fc83c149b7bbbf9012ce03671e)
---
 .../instant-messengers/discord/default.nix    | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index e53ee375c7b9..c4f352ac67a1 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,30 +2,30 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.64";
-      ptb = "0.0.98";
-      canary = "0.0.465";
+      stable = "0.0.65";
+      ptb = "0.0.101";
+      canary = "0.0.475";
       development = "0.0.24";
     } else {
-      stable = "0.0.313";
-      ptb = "0.0.127";
-      canary = "0.0.574";
-      development = "0.0.45";
+      stable = "0.0.316";
+      ptb = "0.0.130";
+      canary = "0.0.583";
+      development = "0.0.46";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-tBopyhGRNDmtOWSwwiNnPJJm82sk3s76cUun7erHRbM=";
+        hash = "sha256-kzYLZcjuG7k8RSjc5ooDlMKaAlMHvm0yCl5Krnhqq8A=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-aJx5ruZRCnBTf/Qon1uFfxMX2a25Xg2AzbnN/UtDe8w=";
+        hash = "sha256-JesxPoYybVLVwTrDwG2kO6Pikq7qvn7CO8j+24dwjBc=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-h4ULLPRhtGy6FZHKfj3AF0hjPhidVvJEbHOVgCh+6JQ=";
+        hash = "sha256-suVIDCZhI6DwUVizBmTm104Clr6pH/olAIbOMNzFNss=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -35,19 +35,19 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-eQLPtwSX24+DOxvQcS2tFOMI6HNYedycl/U5GnzR6w0=";
+        hash = "sha256-ZJ2ybvKGGCm8CZhwGxmLXZWNUD1eAyg17zD/sBwViB4=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Z2b4I8WzBaubb5oGEGpqC6VlVvObyQwKOH+mxCPMuMw=";
+        hash = "sha256-mLfeMx5dQNpoLUyoOSCj8XtNxWjsBpVWdFv1obtHJak=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-ZKjZf716RPOcXkZEFzvb4ojafafccVpjlLoEZv/GGec=";
+        hash = "sha256-eIjkXOW07sR26iBttT0mGDxNnpLFKlVJtzSAtFcicBg=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-KvomKLcDnHyRSGwKDxwb5AZbJqMwKpvP4BC0Sn7IVsk=";
+        hash = "sha256-nMihtf/xLIxwqAVrF1BSRewdS2WThx0LZ5HZUI+OzM0=";
       };
     };
     aarch64-darwin = x86_64-darwin;

From 7c7a8c1aeeefba20dbba70c4e5bb2a35c8f922b0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jun 2024 05:29:43 +0000
Subject: [PATCH 31/34] forgejo-runner: 3.4.1 -> 3.5.0

(cherry picked from commit 8cad9950e3a8bebc8ca22ac9b4402717f1572630)
---
 pkgs/by-name/fo/forgejo-runner/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 983a19455c4f..0aca4f54dc39 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
+    hash = "sha256-omp62KJVPSl3DqZxB1WJFd5secYIAc/6n6Ke5xzICQo=";
   };
 
   vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";

From ed6ca3c6a89fc385ca4eebbcd397bd9015945b18 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Sat, 24 Aug 2024 16:07:11 +0200
Subject: [PATCH 32/34] forgejo-runner: 3.5.0 -> 3.5.1

https://code.forgejo.org/forgejo/runner/releases/tag/v3.5.1

https://code.forgejo.org/forgejo/runner/src/tag/v3.5.1/RELEASE-NOTES.md

diff: https://code.forgejo.org/forgejo/runner/compare/v3.5.0...v3.5.1
(cherry picked from commit ecf6bf1ebf9112f9fcdce151dc5cb4e7cefef85f)
---
 pkgs/by-name/fo/forgejo-runner/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 0aca4f54dc39..7fc2c4c4f06c 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-omp62KJVPSl3DqZxB1WJFd5secYIAc/6n6Ke5xzICQo=";
+    hash = "sha256-LRMkwSrBU5/IPXMhRT05pE487nmSffXvmfbwBiqpyj8=";
   };
 
-  vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";
+  vendorHash = "sha256-XLDtWYFHwBqbkzj4yRyr3uC1FnpS0bn1ia8i6m+CTBM=";
 
   ldflags = [
     "-s"

From 49cc3841743a92d9af27e65d6a2fb094c7864581 Mon Sep 17 00:00:00 2001
From: Zoom <ZoomRmc@users.noreply.github.com>
Date: Sun, 25 Aug 2024 15:58:27 +0400
Subject: [PATCH 33/34] Kernel: update testing to 6.11-rc5

Update `linuxPackages_testing` from 6.11-rc4 to 6.11-rc5

(cherry picked from commit 48e00dda260902c86a948e7003fd655f22bf59f3)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index ca7ec693fc00..949ad2eef5ad 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.11-rc4",
-        "hash": "sha256:1cjvsmnnzm2gc8m56jbn07r8zfz6b96701njhy2bbd4a800zx1hi"
+        "version": "6.11-rc5",
+        "hash": "sha256:06qq6y7cryq0xy4b68ky2hr44cw2nqhbna0dbzfbmr9d5sh9c0gn"
     },
     "6.1": {
         "version": "6.1.106",

From 3e9a1b6cafe678190a8509586027a3316b6812df Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Mon, 26 Aug 2024 20:09:42 -0300
Subject: [PATCH 34/34] maintainers: remove superherointj

---
 maintainers/maintainer-list.nix                           | 7 -------
 pkgs/applications/editors/vscode/extensions/default.nix   | 2 +-
 pkgs/applications/networking/cluster/cilium/default.nix   | 2 +-
 pkgs/applications/networking/cluster/k3s/builder.nix      | 1 -
 pkgs/applications/networking/cluster/vcluster/default.nix | 2 +-
 pkgs/development/tools/godot/4/default.nix                | 2 +-
 pkgs/servers/etcd/3.5/default.nix                         | 2 +-
 7 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7e3f45435799..ee728a947dbd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19051,13 +19051,6 @@
     githubId = 2666479;
     name = "Y Nguyen";
   };
-  superherointj = {
-    email = "sergiomarcelo@yandex.com";
-    github = "superherointj";
-    githubId = 5861043;
-    matrix = "@superherointj:matrix.org";
-    name = "Sérgio Marcelo";
-  };
   SuperSandro2000 = {
     email = "sandro.jaeckel@gmail.com";
     matrix = "@sandro:supersandro.de";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c9276ac28e65..ce22447d7937 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3919,7 +3919,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops";
           homepage = "https://github.com/signageos/vscode-sops";
           license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.superherointj ];
+          maintainers = [ ];
         };
       };
 
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 5353078e1d15..0e7aec795bba 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
     license = lib.licenses.asl20;
     homepage = "https://www.cilium.io/";
-    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly superherointj ];
+    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly ];
     mainProgram = "cilium";
   };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 247ab0f339da..e3f8020cbaa0 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -95,7 +95,6 @@ let
     maintainers = with maintainers; [
       euank
       mic92
-      superherointj
       wrmilling
       yajo
     ];
diff --git a/pkgs/applications/networking/cluster/vcluster/default.nix b/pkgs/applications/networking/cluster/vcluster/default.nix
index f475ba4fbd0c..873854e21d1d 100644
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@@ -52,6 +52,6 @@ buildGoModule rec {
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
     mainProgram = "vcluster";
-    maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
+    maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly ];
   };
 }
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 111cf9e0a187..bb197071162a 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     description = "Free and Open Source 2D and 3D game engine";
     license = lib.licenses.mit;
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
-    maintainers = with lib.maintainers; [ shiryel superherointj ];
+    maintainers = with lib.maintainers; [ shiryel ];
     mainProgram = "godot4";
   };
 }
diff --git a/pkgs/servers/etcd/3.5/default.nix b/pkgs/servers/etcd/3.5/default.nix
index a837ae4713ca..7ea9dc628894 100644
--- a/pkgs/servers/etcd/3.5/default.nix
+++ b/pkgs/servers/etcd/3.5/default.nix
@@ -20,7 +20,7 @@ let
     description = "Distributed reliable key-value store for the most critical data of a distributed system";
     license = licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with maintainers; [ offline superherointj ];
+    maintainers = with maintainers; [ offline ];
     platforms = platforms.darwin ++ platforms.linux;
   };