Merge staging-next into staging

2025-06-25 18:46:32 +03:00 · 2024-12-20 12:06:14 +00:00 · 2024-12-20 12:06:14 +00:00 · f970ef5718
commit f970ef5718
parent fea626d298 668abaeafa
55 changed files with 1588 additions and 7090 deletions
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -181,6 +181,7 @@
        - pkgs/development/compilers/corretto/**/*
        - pkgs/development/compilers/graalvm/**/*
        - pkgs/development/compilers/openjdk/**/*
+        - pkgs/by-name/op/openjfx/**/*
        - pkgs/development/compilers/semeru-bin/**/*
        - pkgs/development/compilers/temurin-bin/**/*
        - pkgs/development/compilers/zulu/**/*
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -20519,6 +20519,12 @@
    githubId = 18403034;
    name = "Shaddy";
  };
+  shadowapex = {
+    email = "shadowapex@gmail.com";
+    github = "ShadowApex";
+    githubId = 376460;
+    name = "William Edwards";
+  };
  shadowrz = {
    email = "shadowrz+nixpkgs@disroot.org";
    matrix = "@shadowrz:nixos.dev";
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -31,6 +31,8 @@

 - [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products.

+- [Bonsai](https://git.sr.ht/~stacyharper/bonsai), a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the [SXMO](https://sxmo.org/) desktop environment. Available as [services.bonsaid](#opt-services.bonsaid.enable).
+
 - [scanservjs](https://github.com/sbs20/scanservjs/), a web UI for SANE scanners. Available at [services.scanservjs](#opt-services.scanservjs.enable).

 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
@ -39,6 +41,8 @@

 - [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).

+- [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
+
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).

 - [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable).
@ -61,6 +65,8 @@

 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).

+- [InputPlumber](https://github.com/ShadowBlip/InputPlumber/), an open source input router and remapper daemon for Linux. Available as [services.inputplumber](#opt-services.inputplumber.enable).
+
 - [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).

 - [KanBoard](https://github.com/kanboard/kanboard), a project management tool that focuses on the Kanban methodology. Available as [services.kanboard](#opt-services.kanboard.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -509,6 +509,7 @@
  ./services/desktops/ayatana-indicators.nix
  ./services/desktops/bamf.nix
  ./services/desktops/blueman.nix
+  ./services/desktops/bonsaid.nix
  ./services/desktops/cpupower-gui.nix
  ./services/desktops/deepin/deepin-anything.nix
  ./services/desktops/deepin/dde-api.nix
@ -604,6 +605,7 @@
  ./services/hardware/handheld-daemon.nix
  ./services/hardware/hddfancontrol.nix
  ./services/hardware/illum.nix
+  ./services/hardware/inputplumber.nix
  ./services/hardware/interception-tools.nix
  ./services/hardware/iptsd.nix
  ./services/hardware/irqbalance.nix
@ -1135,6 +1137,7 @@
  ./services/networking/miredo.nix
  ./services/networking/mjpg-streamer.nix
  ./services/networking/mmsd.nix
+  ./services/networking/modemmanager.nix
  ./services/networking/monero.nix
  ./services/networking/morty.nix
  ./services/networking/mosquitto.nix
--- a/nixos/modules/programs/autoenv.nix
+++ b/nixos/modules/programs/autoenv.nix
@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.autoenv;
+in
+{
+  options = {
+    programs.autoenv = {
+      enable = lib.mkEnableOption "autoenv";
+      package = lib.mkPackageOption pkgs "autoenv" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.autoenv ];
+
+    programs = {
+      zsh.interactiveShellInit = ''
+        source ${cfg.package}/share/autoenv/activate.sh
+      '';
+
+      bash.interactiveShellInit = ''
+        source ${cfg.package}/share/autoenv/activate.sh
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/desktops/bonsaid.nix
+++ b/nixos/modules/services/desktops/bonsaid.nix
@ -0,0 +1,168 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  json = pkgs.formats.json { };
+  transitionType = lib.types.submodule {
+    freeformType = json.type;
+    options.type = lib.mkOption {
+      type = lib.types.enum [
+        "delay"
+        "event"
+        "exec"
+      ];
+      description = ''
+        Type of transition. Determines how bonsaid interprets the other options in this transition.
+      '';
+    };
+    options.command = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = null;
+      description = ''
+        Command to run when this transition is taken.
+        This is executed inline by `bonsaid` and blocks handling of any other events until completion.
+        To perform the command asynchronously, specify it like `[ "setsid" "-f" "my-command" ]`.
+
+        Only effects transitions with `type = "exec"`.
+      '';
+    };
+    options.delay_duration = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
+      default = null;
+      description = ''
+        Nanoseconds to wait after the previous state change before performing this transition.
+        This can be placed at the same level as a `type = "event"` transition to achieve a
+        timeout mechanism.
+
+        Only effects transitions with `type = "delay"`.
+      '';
+    };
+    options.event_name = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = ''
+        Name of the event which should trigger this transition when received by `bonsaid`.
+        Events are sent to `bonsaid` by running `bonsaictl -e <event_name>`.
+
+        Only effects transitions with `type = "event"`.
+      '';
+    };
+    options.transitions = lib.mkOption {
+      type = lib.types.listOf transitionType;
+      default = [ ];
+      description = ''
+        List of transitions out of this state.
+        If left empty, then this state is considered a terminal state and entering it will
+        trigger an immediate transition back to the root state (after processing side effects).
+      '';
+      visible = "shallow";
+    };
+  };
+  cfg = config.services.bonsaid;
+in
+{
+  meta.maintainers = [ lib.maintainers.colinsane ];
+
+  options.services.bonsaid = {
+    enable = lib.mkEnableOption "bonsaid";
+    package = lib.mkPackageOption pkgs "bonsai" { };
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra flags to pass to `bonsaid`, such as `[ "-v" ]` to enable verbose logging.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.listOf transitionType;
+      description = ''
+        State transition definitions. See the upstream [README](https://git.sr.ht/~stacyharper/bonsai)
+        for extended documentation and a more complete example.
+      '';
+      example = [
+        {
+          type = "event";
+          event_name = "power_button_pressed";
+          transitions = [
+            {
+              # Hold power button for 600ms to trigger a command
+              type = "delay";
+              delay_duration = 600000000;
+              transitions = [
+                {
+                  type = "exec";
+                  command = [
+                    "swaymsg"
+                    "--"
+                    "output"
+                    "*"
+                    "power"
+                    "off"
+                  ];
+                  # `transitions = []` marks this as a terminal state,
+                  # so bonsai will return to the root state immediately after executing the above command.
+                  transitions = [ ];
+                }
+              ];
+            }
+            {
+              # If the power button is released before the 600ms elapses, return to the root state.
+              type = "event";
+              event_name = "power_button_released";
+              transitions = [ ];
+            }
+          ];
+        }
+      ];
+    };
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Path to a .json file specifying the state transitions.
+        You don't need to set this unless you prefer to provide the json file
+        yourself instead of using the `settings` option.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.bonsaid.configFile =
+      let
+        filterNulls =
+          v:
+          if lib.isAttrs v then
+            lib.mapAttrs (_: filterNulls) (lib.filterAttrs (_: a: a != null) v)
+          else if lib.isList v then
+            lib.map filterNulls (lib.filter (a: a != null) v)
+          else
+            v;
+      in
+      lib.mkDefault (json.generate "bonsai_tree.json" (filterNulls cfg.settings));
+
+    # bonsaid is controlled by bonsaictl, so place the latter in the environment by default.
+    # bonsaictl is typically invoked by scripts or a DE so this isn't strictly necesssary,
+    # but it's helpful while administering the service generally.
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.user.services.bonsaid = {
+      description = "Bonsai Finite State Machine daemon";
+      documentation = [ "https://git.sr.ht/~stacyharper/bonsai" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe' cfg.package "bonsaid")
+            "-t"
+            cfg.configFile
+          ]
+          ++ cfg.extraFlags
+        );
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/hardware/inputplumber.nix
+++ b/nixos/modules/services/hardware/inputplumber.nix
@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.inputplumber;
+in
+{
+  options.services.inputplumber = {
+    enable = lib.mkEnableOption "InputPlumber";
+    package = lib.mkPackageOption pkgs "inputplumber" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.inputplumber = {
+      description = "InputPlumber Service";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        XDG_DATA_DIRS = "/run/current-system/sw/share";
+      };
+      restartIfChanged = true;
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "on-failure";
+        RestartSec = "5";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ shadowapex ];
+}
--- a/nixos/modules/services/networking/modemmanager.nix
+++ b/nixos/modules/services/networking/modemmanager.nix
@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.networking.modemmanager;
+in
+{
+  meta = {
+    maintainers = lib.teams.freedesktop.members;
+  };
+
+  options = with lib; {
+    networking.modemmanager = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to use ModemManager to manage modem devices.
+          This is usually used by some higher layer manager such as NetworkManager
+          but can be used standalone especially if using a modem for non-IP
+          connectivity (e.g. GPS).
+        '';
+      };
+
+      package = mkPackageOption pkgs "modemmanager" { };
+
+      fccUnlockScripts = mkOption {
+        type = types.listOf (
+          types.submodule {
+            options = {
+              id = mkOption {
+                type = types.str;
+                description = "vid:pid of either the PCI or USB vendor and product ID";
+              };
+              path = mkOption {
+                type = types.path;
+                description = "Path to the unlock script";
+              };
+            };
+          }
+        );
+        default = [ ];
+        example = literalExpression ''[{ id = "03f0:4e1d"; path = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
+        description = ''
+          List of FCC unlock scripts to enable on the system, behaving as described in
+          https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc = builtins.listToAttrs (
+      map (
+        e:
+        lib.nameValuePair "ModemManager/fcc-unlock.d/${e.id}" {
+          source = e.path;
+        }
+      ) cfg.fccUnlockScripts
+    );
+
+    systemd.services.ModemManager = {
+      aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
+      path = lib.optionals (cfg.fccUnlockScripts != [ ]) [
+        pkgs.libqmi
+        pkgs.libmbim
+      ];
+    };
+
+    /*
+      [modem-manager]
+      Identity=unix-group:networkmanager
+      Action=org.freedesktop.ModemManager*
+      ResultAny=yes
+      ResultInactive=no
+      ResultActive=yes
+    */
+    security.polkit.enable = true;
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (
+          subject.isInGroup("networkmanager")
+          && action.id.indexOf("org.freedesktop.ModemManager") == 0
+          )
+            { return polkit.Result.YES; }
+      });
+    '';
+
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+    services.udev.packages = [ cfg.package ];
+  };
+}
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 with lib;

@ -15,14 +20,10 @@ let
      plugins = "keyfile";
      inherit (cfg) dhcp dns;
      # If resolvconf is disabled that means that resolv.conf is managed by some other module.
-      rc-manager =
-        if config.networking.resolvconf.enable then "resolvconf"
-        else "unmanaged";
+      rc-manager = if config.networking.resolvconf.enable then "resolvconf" else "unmanaged";
    };
    keyfile = {
-      unmanaged-devices =
-      if cfg.unmanaged == [ ] then null
-      else lib.concatStringsSep ";" cfg.unmanaged;
+      unmanaged-devices = if cfg.unmanaged == [ ] then null else lib.concatStringsSep ";" cfg.unmanaged;
    };
    logging = {
      audit = config.security.audit.enable;
@ -30,8 +31,8 @@ let
    };
    connection = cfg.connectionConfig;
    device = {
-        "wifi.scan-rand-mac-address" = cfg.wifi.scanRandMacAddress;
-        "wifi.backend" = cfg.wifi.backend;
+      "wifi.scan-rand-mac-address" = cfg.wifi.scanRandMacAddress;
+      "wifi.backend" = cfg.wifi.backend;
    };
  } cfg.settings;
  configFile = ini.generate "NetworkManager.conf" configAttrs;
@ -43,32 +44,29 @@ let
    ResultAny=yes
    ResultInactive=no
    ResultActive=yes
-
-    [modem-manager]
-    Identity=unix-group:networkmanager
-    Action=org.freedesktop.ModemManager*
-    ResultAny=yes
-    ResultInactive=no
-    ResultActive=yes
  */
  polkitConf = ''
    polkit.addRule(function(action, subject) {
      if (
        subject.isInGroup("networkmanager")
-        && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
-            || action.id.indexOf("org.freedesktop.ModemManager")  == 0
-        ))
+        && action.id.indexOf("org.freedesktop.NetworkManager.") == 0
+        )
          { return polkit.Result.YES; }
    });
  '';

-  ns = xs: pkgs.writeText "nameservers" (
-    concatStrings (map (s: "nameserver ${s}\n") xs)
-  );
+  ns = xs: pkgs.writeText "nameservers" (concatStrings (map (s: "nameserver ${s}\n") xs));

  overrideNameserversScript = pkgs.writeScript "02overridedns" ''
    #!/bin/sh
-    PATH=${with pkgs; makeBinPath [ gnused gnugrep coreutils ]}
+    PATH=${
+      with pkgs;
+      makeBinPath [
+        gnused
+        gnugrep
+        coreutils
+      ]
+    }
    tmp=$(mktemp)
    sed '/nameserver /d' /etc/resolv.conf > $tmp
    grep 'nameserver ' /etc/resolv.conf | \
@ -84,7 +82,15 @@ let
  };

  macAddressOptWifi = mkOption {
-    type = types.either types.str (types.enum [ "permanent" "preserve" "random" "stable" "stable-ssid" ]);
+    type = types.either types.str (
+      types.enum [
+        "permanent"
+        "preserve"
+        "random"
+        "stable"
+        "stable-ssid"
+      ]
+    );
    default = "preserve";
    example = "00:11:22:33:44:55";
    description = ''
@ -100,7 +106,14 @@ let
  };

  macAddressOptEth = mkOption {
-    type = types.either types.str (types.enum [ "permanent" "preserve" "random" "stable" ]);
+    type = types.either types.str (
+      types.enum [
+        "permanent"
+        "preserve"
+        "random"
+        "stable"
+      ]
+    );
    default = "preserve";
    example = "00:11:22:33:44:55";
    description = ''
@ -114,14 +127,14 @@ let
    '';
  };

-  packages = [
-    pkgs.modemmanager
-    pkgs.networkmanager
-  ]
-  ++ cfg.plugins
-  ++ lib.optionals (!delegateWireless && !enableIwd) [
-    pkgs.wpa_supplicant
-  ];
+  packages =
+    [
+      cfg.package
+    ]
+    ++ cfg.plugins
+    ++ lib.optionals (!delegateWireless && !enableIwd) [
+      pkgs.wpa_supplicant
+    ];

 in
 {
@ -148,12 +161,18 @@ in
        '';
      };

+      package = mkPackageOption pkgs "networkmanager" { };
+
      connectionConfig = mkOption {
-        type = with types; attrsOf (nullOr (oneOf [
-          bool
-          int
-          str
-        ]));
+        type =
+          with types;
+          attrsOf (
+            nullOr (oneOf [
+              bool
+              int
+              str
+            ])
+          );
        default = { };
        description = ''
          Configuration for the [connection] section of NetworkManager.conf.
@ -169,7 +188,7 @@ in

      settings = mkOption {
        type = ini.type;
-        default = {};
+        default = { };
        description = ''
          Configuration added to the generated NetworkManager.conf, note that you can overwrite settings with this.
          Refer to
@ -205,9 +224,7 @@ in
              check =
                p:
                lib.assertMsg
-                  (types.package.check p
-                    && p ? networkManagerPlugin
-                    && lib.isString p.networkManagerPlugin)
+                  (types.package.check p && p ? networkManagerPlugin && lib.isString p.networkManagerPlugin)
                  ''
                    Package ‘${p.name}’, is not a NetworkManager plug-in.
                    Those need to have a ‘networkManagerPlugin’ attribute.
@ -223,7 +240,10 @@ in
      };

      dhcp = mkOption {
-        type = types.enum [ "dhcpcd" "internal" ];
+        type = types.enum [
+          "dhcpcd"
+          "internal"
+        ];
        default = "internal";
        description = ''
          Which program (or internal library) should be used for DHCP.
@ -231,7 +251,14 @@ in
      };

      logLevel = mkOption {
-        type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];
+        type = types.enum [
+          "OFF"
+          "ERR"
+          "WARN"
+          "INFO"
+          "DEBUG"
+          "TRACE"
+        ];
        default = "WARN";
        description = ''
          Set the default logging verbosity level.
@ -262,7 +289,10 @@ in
        macAddress = macAddressOptWifi;

        backend = mkOption {
-          type = types.enum [ "wpa_supplicant" "iwd" ];
+          type = types.enum [
+            "wpa_supplicant"
+            "iwd"
+          ];
          default = "wpa_supplicant";
          description = ''
            Specify the Wi-Fi backend used for the device.
@ -289,7 +319,12 @@ in
      };

      dns = mkOption {
-        type = types.enum [ "default" "dnsmasq" "systemd-resolved" "none" ];
+        type = types.enum [
+          "default"
+          "dnsmasq"
+          "systemd-resolved"
+          "none"
+        ];
        default = "default";
        description = ''
          Set the DNS (`resolv.conf`) processing mode.
@ -304,27 +339,29 @@ in
      };

      dispatcherScripts = mkOption {
-        type = types.listOf (types.submodule {
-          options = {
-            source = mkOption {
-              type = types.path;
-              description = ''
-                Path to the hook script.
-              '';
-            };
+        type = types.listOf (
+          types.submodule {
+            options = {
+              source = mkOption {
+                type = types.path;
+                description = ''
+                  Path to the hook script.
+                '';
+              };

-            type = mkOption {
-              type = types.enum (attrNames dispatcherTypesSubdirMap);
-              default = "basic";
-              description = ''
-                Dispatcher hook type. Look up the hooks described at
-                [https://developer.gnome.org/NetworkManager/stable/NetworkManager.html](https://developer.gnome.org/NetworkManager/stable/NetworkManager.html)
-                and choose the type depending on the output folder.
-                You should then filter the event type (e.g., "up"/"down") from within your script.
-              '';
+              type = mkOption {
+                type = types.enum (attrNames dispatcherTypesSubdirMap);
+                default = "basic";
+                description = ''
+                  Dispatcher hook type. Look up the hooks described at
+                  [https://developer.gnome.org/NetworkManager/stable/NetworkManager.html](https://developer.gnome.org/NetworkManager/stable/NetworkManager.html)
+                  and choose the type depending on the output folder.
+                  You should then filter the event type (e.g., "up"/"down") from within your script.
+                '';
+              };
            };
-          };
-        });
+          }
+        );
        default = [ ];
        example = literalExpression ''
          [ {
@ -358,87 +395,69 @@ in
        '';
      };

-      fccUnlockScripts = mkOption {
-        type = types.listOf (types.submodule {
-          options = {
-            id = mkOption {
-              type = types.str;
-              description = "vid:pid of either the PCI or USB vendor and product ID";
-            };
-            path = mkOption {
-              type = types.path;
-              description = "Path to the unlock script";
-            };
-          };
-        });
-        default = [ ];
-        example = literalExpression ''[{ id = "03f0:4e1d"; path = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
-        description = ''
-          List of FCC unlock scripts to enable on the system, behaving as described in
-          https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
-        '';
-      };
      ensureProfiles = {
-        profiles = with lib.types; mkOption {
-          type = attrsOf (submodule {
-            freeformType = ini.type;
+        profiles =
+          with lib.types;
+          mkOption {
+            type = attrsOf (submodule {
+              freeformType = ini.type;

-            options = {
-              connection = {
-                id = lib.mkOption {
-                  type = str;
-                  description = "This is the name that will be displayed by NetworkManager and GUIs.";
+              options = {
+                connection = {
+                  id = lib.mkOption {
+                    type = str;
+                    description = "This is the name that will be displayed by NetworkManager and GUIs.";
+                  };
+                  type = lib.mkOption {
+                    type = str;
+                    description = "The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.";
+                    example = "vpn";
+                  };
                };
-                type = lib.mkOption {
-                  type = str;
-                  description = "The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.";
-                  example = "vpn";
+              };
+            });
+            apply = (lib.filterAttrsRecursive (n: v: v != { }));
+            default = { };
+            example = {
+              home-wifi = {
+                connection = {
+                  id = "home-wifi";
+                  type = "wifi";
+                  permissions = "";
+                };
+                wifi = {
+                  mac-address-blacklist = "";
+                  mode = "infrastructure";
+                  ssid = "Home Wi-Fi";
+                };
+                wifi-security = {
+                  auth-alg = "open";
+                  key-mgmt = "wpa-psk";
+                  psk = "$HOME_WIFI_PASSWORD";
+                };
+                ipv4 = {
+                  dns-search = "";
+                  method = "auto";
+                };
+                ipv6 = {
+                  addr-gen-mode = "stable-privacy";
+                  dns-search = "";
+                  method = "auto";
                };
              };
            };
-          });
-          apply = (lib.filterAttrsRecursive (n: v: v != { }));
-          default = { };
-          example = {
-            home-wifi = {
-              connection = {
-                id = "home-wifi";
-                type = "wifi";
-                permissions = "";
-              };
-              wifi = {
-                mac-address-blacklist = "";
-                mode = "infrastructure";
-                ssid = "Home Wi-Fi";
-              };
-              wifi-security = {
-                auth-alg = "open";
-                key-mgmt = "wpa-psk";
-                psk = "$HOME_WIFI_PASSWORD";
-              };
-              ipv4 = {
-                dns-search = "";
-                method = "auto";
-              };
-              ipv6 = {
-                addr-gen-mode = "stable-privacy";
-                dns-search = "";
-                method = "auto";
-              };
-            };
+            description = ''
+              Declaratively define NetworkManager profiles. You can find information about the generated file format [here](https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html) and [here](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking).
+              You current profiles which are most likely stored in `/etc/NetworkManager/system-connections` and there is [a tool](https://github.com/janik-haag/nm2nix) to convert them to the needed nix code.
+              If you add a new ad-hoc connection via a GUI or nmtui or anything similar it should just work together with the declarative ones.
+              And if you edit a declarative profile NetworkManager will move it to the persistent storage and treat it like a ad-hoc one,
+              but there will be two profiles as soon as the systemd unit from this option runs again which can be confusing since NetworkManager tools will start displaying two profiles with the same name and probably a bit different settings depending on what you edited.
+              A profile won't be deleted even if it's removed from the config until the system reboots because that's when NetworkManager clears it's temp directory.
+              If `networking.resolvconf.enable` is true, attributes affecting the name resolution (such as `ignore-auto-dns`) may not end up changing `/etc/resolv.conf` as expected when other name services (for example `networking.dhcpcd`) are enabled. Run `resolvconf -l` in the terminal to see what each service produces.
+            '';
          };
-          description = ''
-            Declaratively define NetworkManager profiles. You can find information about the generated file format [here](https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html) and [here](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking).
-            You current profiles which are most likely stored in `/etc/NetworkManager/system-connections` and there is [a tool](https://github.com/janik-haag/nm2nix) to convert them to the needed nix code.
-            If you add a new ad-hoc connection via a GUI or nmtui or anything similar it should just work together with the declarative ones.
-            And if you edit a declarative profile NetworkManager will move it to the persistent storage and treat it like a ad-hoc one,
-            but there will be two profiles as soon as the systemd unit from this option runs again which can be confusing since NetworkManager tools will start displaying two profiles with the same name and probably a bit different settings depending on what you edited.
-            A profile won't be deleted even if it's removed from the config until the system reboots because that's when NetworkManager clears it's temp directory.
-            If `networking.resolvconf.enable` is true, attributes affecting the name resolution (such as `ignore-auto-dns`) may not end up changing `/etc/resolv.conf` as expected when other name services (for example `networking.dhcpcd`) are enabled. Run `resolvconf -l` in the terminal to see what each service produces.
-          '';
-        };
        environmentFiles = mkOption {
-          default = [];
+          default = [ ];
          type = types.listOf types.path;
          example = [ "/run/secrets/network-manager.env" ];
          description = ''
@ -473,14 +492,13 @@ in
      +    settings.main.no-auto-default = "*";
         };
      ```
-    ''
-    )
+    '')
    (mkRemovedOptionModule [ "networking" "networkmanager" "enableFccUnlock" ] ''
      This option was removed, because using bundled FCC unlock scripts is risky,
      might conflict with vendor-provided unlock scripts, and should
      be a conscious decision on a per-device basis.
      Instead it's recommended to use the
-      `networking.networkmanager.fccUnlockScripts` option.
+      `networking.modemmanager.fccUnlockScripts` option.
    '')
    (mkRemovedOptionModule [ "networking" "networkmanager" "dynamicHosts" ] ''
      This option was removed because allowing (multiple) regular users to
@ -493,9 +511,12 @@ in
    (mkRemovedOptionModule [ "networking" "networkmanager" "firewallBackend" ] ''
      This option was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
    '')
+    (mkRenamedOptionModule
+      [ "networking" "networkmanager" "fccUnlockScripts" ]
+      [ "networking" "modemmanager" "fccUnlockScripts" ]
+    )
  ];

-
  ###### implementation

  config = mkIf cfg.enable {
@ -512,36 +533,38 @@ in

    hardware.wirelessRegulatoryDatabase = true;

-    environment.etc = {
-      "NetworkManager/NetworkManager.conf".source = configFile;
-
-      # The networkmanager-l2tp plugin expects /etc/ipsec.secrets to include /etc/ipsec.d/ipsec.nm-l2tp.secrets;
-      # see https://github.com/NixOS/nixpkgs/issues/64965
-      "ipsec.secrets".text = ''
-        include ipsec.d/ipsec.nm-l2tp.secrets
-      '';
-    }
-    // builtins.listToAttrs (map
-      (pkg: nameValuePair "NetworkManager/${pkg.networkManagerPlugin}" {
-        source = "${pkg}/lib/NetworkManager/${pkg.networkManagerPlugin}";
-      })
-      cfg.plugins)
-    // builtins.listToAttrs (map
-      (e: nameValuePair "ModemManager/fcc-unlock.d/${e.id}" {
-        source = e.path;
-      })
-      cfg.fccUnlockScripts)
-    // optionalAttrs (cfg.appendNameservers != [ ] || cfg.insertNameservers != [ ])
+    environment.etc =
      {
+        "NetworkManager/NetworkManager.conf".source = configFile;
+
+        # The networkmanager-l2tp plugin expects /etc/ipsec.secrets to include /etc/ipsec.d/ipsec.nm-l2tp.secrets;
+        # see https://github.com/NixOS/nixpkgs/issues/64965
+        "ipsec.secrets".text = ''
+          include ipsec.d/ipsec.nm-l2tp.secrets
+        '';
+      }
+      // builtins.listToAttrs (
+        map (
+          pkg:
+          nameValuePair "NetworkManager/${pkg.networkManagerPlugin}" {
+            source = "${pkg}/lib/NetworkManager/${pkg.networkManagerPlugin}";
+          }
+        ) cfg.plugins
+      )
+      // optionalAttrs (cfg.appendNameservers != [ ] || cfg.insertNameservers != [ ]) {
        "NetworkManager/dispatcher.d/02overridedns".source = overrideNameserversScript;
      }
-    // listToAttrs (lib.imap1
-      (i: s:
-        {
-          name = "NetworkManager/dispatcher.d/${dispatcherTypesSubdirMap.${s.type}}03userscript${lib.fixedWidthNumber 4 i}";
-          value = { mode = "0544"; inherit (s) source; };
-        })
-      cfg.dispatcherScripts);
+      // listToAttrs (
+        lib.imap1 (i: s: {
+          name = "NetworkManager/dispatcher.d/${
+            dispatcherTypesSubdirMap.${s.type}
+          }03userscript${lib.fixedWidthNumber 4 i}";
+          value = {
+            mode = "0544";
+            inherit (s) source;
+          };
+        }) cfg.dispatcherScripts
+      );

    environment.systemPackages = packages;

@ -590,17 +613,19 @@ in
      wantedBy = [ "network-online.target" ];
    };

-    systemd.services.ModemManager = {
-      aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
-      path = lib.optionals (cfg.fccUnlockScripts != []) [ pkgs.libqmi pkgs.libmbim ];
-    };
-
    systemd.services.NetworkManager-dispatcher = {
      wantedBy = [ "network.target" ];
-      restartTriggers = [ configFile overrideNameserversScript ];
+      restartTriggers = [
+        configFile
+        overrideNameserversScript
+      ];

      # useful binaries for user-specified hooks
-      path = [ pkgs.iproute2 pkgs.util-linux pkgs.coreutils ];
+      path = [
+        pkgs.iproute2
+        pkgs.util-linux
+        pkgs.coreutils
+      ];
      aliases = [ "dbus-org.freedesktop.nm-dispatcher.service" ];
    };

@ -609,17 +634,19 @@ in
      wantedBy = [ "multi-user.target" ];
      before = [ "network-online.target" ];
      after = [ "NetworkManager.service" ];
-      script = let
-        path = id: "/run/NetworkManager/system-connections/${id}.nmconnection";
-      in ''
-        mkdir -p /run/NetworkManager/system-connections
-      '' + lib.concatMapStringsSep "\n"
-        (profile: ''
+      script =
+        let
+          path = id: "/run/NetworkManager/system-connections/${id}.nmconnection";
+        in
+        ''
+          mkdir -p /run/NetworkManager/system-connections
+        ''
+        + lib.concatMapStringsSep "\n" (profile: ''
          ${pkgs.envsubst}/bin/envsubst -i ${ini.generate (lib.escapeShellArg profile.n) profile.v} > ${path (lib.escapeShellArg profile.n)}
        '') (lib.mapAttrsToList (n: v: { inherit n v; }) cfg.ensureProfiles.profiles)
-      + ''
-        ${pkgs.networkmanager}/bin/nmcli connection reload
-      '';
+        + ''
+          ${cfg.package}/bin/nmcli connection reload
+        '';
      serviceConfig = {
        EnvironmentFile = cfg.ensureProfiles.environmentFiles;
        UMask = "0177";
@ -654,13 +681,18 @@ in
      })

      {
+        modemmanager.enable = lib.mkDefault true;
+
        networkmanager.connectionConfig = {
          "ethernet.cloned-mac-address" = cfg.ethernet.macAddress;
          "wifi.cloned-mac-address" = cfg.wifi.macAddress;
          "wifi.powersave" =
-            if cfg.wifi.powersave == null then null
-            else if cfg.wifi.powersave then 3
-            else 2;
+            if cfg.wifi.powersave == null then
+              null
+            else if cfg.wifi.powersave then
+              3
+            else
+              2;
        };
      }
    ];
@ -670,7 +702,8 @@ in
    security.polkit.enable = true;
    security.polkit.extraConfig = polkitConf;

-    services.dbus.packages = packages
+    services.dbus.packages =
+      packages
      ++ optional cfg.enableStrongSwan pkgs.strongswanNM
      ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq;

--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -512,6 +512,17 @@ let
        '';
      };

+      updateDaemon = {
+        commandFlags = mkOption {
+          type = types.str;
+          default = "--quiet";
+          description = ''
+            Command-line flags passed to the update daemon.
+            The default --quiet flag mutes all logging, including errors.
+          '';
+        };
+      };
+
      extraConfig = mkOption {
        type = types.lines;
        default = "";
@ -622,7 +633,7 @@ let
        serviceConfig = {
          User = "${cfg.user}";
          Group = "tt_rss";
-          ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
+          ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon ${cfg.updateDaemon.commandFlags}";
          Restart = "on-failure";
          RestartSec = "60";
          SyslogIdentifier = "tt-rss";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1095,6 +1095,7 @@ in {
  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
  tsm-client-gui = handleTest ./tsm-client-gui.nix {};
  ttyd = handleTest ./web-servers/ttyd.nix {};
+  tt-rss = handleTest ./web-apps/tt-rss.nix {};
  txredisapi = handleTest ./txredisapi.nix {};
  tuptime = handleTest ./tuptime.nix {};
  turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {};
--- a/nixos/tests/web-apps/tt-rss.nix
+++ b/nixos/tests/web-apps/tt-rss.nix
@ -0,0 +1,22 @@
+import ../make-test-python.nix (
+  { ... }:
+  {
+    name = "tt-rss-nixos";
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.tt-rss = {
+          enable = true;
+          virtualHost = "localhost";
+          selfUrlPath = "http://localhost/";
+          singleUserMode = true;
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("tt-rss.service")
+      machine.succeed("curl -sSfL http://localhost/ | grep 'Tiny Tiny RSS'")
+    '';
+  }
+)
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -60,15 +60,7 @@ rustPlatform.buildRustPackage rec {
  };

  buildType = "production";
-
-  cargoBuildFlags = [
-    "-p"
-    "polkadot"
-    "-p"
-    "polkadot-omni-node"
-    "-p"
-    "polkadot-parachain-bin"
-  ];
+  buildAndTestSubdir = "polkadot";

  # NOTE: tests currently fail to compile due to an issue with cargo-auditable
  # and resolution of features flags, potentially related to this:
@ -100,8 +92,8 @@ rustPlatform.buildRustPackage rec {
  ROCKSDB_LIB_DIR = "${rocksdb}/lib";

  meta = with lib; {
-    description = "Polkadot Node Implementation";
-    homepage = "https://polkadot.network";
+    description = "Implementation of a https://polkadot.network node in Rust based on the Substrate framework";
+    homepage = "https://github.com/paritytech/polkadot-sdk";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [
      akru
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
@ -8,13 +8,13 @@

 melpaBuild {
  pname = "edraw";
-  version = "1.2.0-unstable-2024-10-04";
+  version = "1.2.0-unstable-2024-12-18";

  src = fetchFromGitHub {
    owner = "misohena";
    repo = "el-easydraw";
-    rev = "ad740d87e768052b0ef5b5e7f0822c7ac1b238fb";
-    hash = "sha256-xdyDikE8fUQ12Ra5j5lQUHVLKpTYtvfn1DosusQt61Q=";
+    rev = "1c46469d0ea3642958eaf7cea1016fcf05b4daec";
+    hash = "sha256-Z7LPC112FXHtDop1HXPnR6S+cSqfEW1HuYS8YD/qM+c=";
  };

  propagatedUserEnvPkgs = [ gzip ];
--- a/pkgs/by-name/ai/aiken/package.nix
+++ b/pkgs/by-name/ai/aiken/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "aiken";
-  version = "1.1.7";
+  version = "1.1.9";

  src = fetchFromGitHub {
    owner = "aiken-lang";
    repo = "aiken";
    rev = "v${version}";
-    hash = "sha256-dcJrLzdj4YK5CZ0jk+gqiqIj1ngq7443y8FVo6ajaz8=";
+    hash = "sha256-Zu7t6DmQ9A7prv9ybhDgVPVisM0Dnf5CAXIXJHHEBGs=";
  };

-  cargoHash = "sha256-KtlqV/I9zqTlMStKQX7o14NuSOLf+dDoi/QJqirxqHY=";
+  cargoHash = "sha256-AVLoGeq+Kld5iLndobcylyS1HAz0FryunTFiR8pR1f4=";

  buildInputs =
    [ openssl ]
--- a/pkgs/by-name/au/autoenv/package.nix
+++ b/pkgs/by-name/au/autoenv/package.nix
@ -0,0 +1,35 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "autoenv";
+  version = "0-unstable-2024-10-16";
+
+  src = fetchFromGitHub {
+    owner = "hyperupcall";
+    repo = "autoenv";
+    rev = "90241f182d6a7c96e9de8a25c1eccaf2a2d1b43a";
+    hash = "sha256-vZrsMPhuu+xPVAww04nKyoOl7k0upvpIaxeMrCikDio=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share
+    cp -R $src $out/share/autoenv
+    chmod +x $out/share/autoenv
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Per-directory shell environments sourced from .env file";
+    homepage = "https://github.com/hyperupcall/autoenv";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ clebs ];
+  };
+})
--- a/pkgs/by-name/ca/calibre-web/package.nix
+++ b/pkgs/by-name/ca/calibre-web/package.nix
@ -35,6 +35,7 @@ python.pkgs.buildPythonApplication rec {
    flask-limiter
    flask-login
    flask-principal
+    flask-simpleldap
    flask-wtf
    iso-639
    jsonschema
--- a/pkgs/by-name/ca/calls/package.nix
+++ b/pkgs/by-name/ca/calls/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitLab,
  meson,
+  mesonEmulatorHook,
  ninja,
  pkg-config,
  libadwaita,
@ -51,19 +52,23 @@ stdenv.mkDerivation (finalAttrs: {
    "devdoc"
  ];

-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-    desktop-file-utils
-    appstream-glib
-    vala
-    wrapGAppsHook4
-    gtk-doc
-    docbook-xsl-nons
-    docbook_xml_dtd_43
-    docutils
-  ];
+  nativeBuildInputs =
+    [
+      meson
+      ninja
+      pkg-config
+      desktop-file-utils
+      appstream-glib
+      vala
+      wrapGAppsHook4
+      gtk-doc
+      docbook-xsl-nons
+      docbook_xml_dtd_43
+      docutils
+    ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      mesonEmulatorHook
+    ];

  buildInputs = [
    modemmanager
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.82";
+  version = "0.9.87";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    hash = "sha256-dtZGTKC9C9akjcD56I2iafPnPEd5MKgoCjB0Rkc53o4=";
+    hash = "sha256-J+84FZfrbv6jp2T9cYgodLZ+TgIAht+uJSVi5ULDGBU=";
  };

-  cargoHash = "sha256-3V9o4DmGG4gkqrRfZkcKTJe2Ld2ON9Ne2XJMOVUeFaA=";
+  cargoHash = "sha256-eq+COE9UWDTHZK6dlNqGuoJMUKCNyP5UpAcpk0qAUJI=";

  cargoBuildFlags = [ "-p" "cargo-nextest" ];
  cargoTestFlags = [ "-p" "cargo-nextest" ];
--- a/pkgs/by-name/de/delta/package.nix
+++ b/pkgs/by-name/de/delta/package.nix
@ -6,8 +6,8 @@
  pkg-config,
  oniguruma,
  stdenv,
-  apple-sdk_11,
  git,
+  zlib,
 }:

 rustPlatform.buildRustPackage rec {
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
      oniguruma
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple-sdk_11
+      zlib
    ];

  nativeCheckInputs = [ git ];
--- a/pkgs/by-name/es/esp-generate/package.nix
+++ b/pkgs/by-name/es/esp-generate/package.nix
@ -0,0 +1,29 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "esp-generate";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "esp-rs";
+    repo = "esp-generate";
+    rev = "v${version}";
+    hash = "sha256-vfHORu0C3vK7a9jv1Wj+XjqM7mR8/t0N4x3hfARdxaw=";
+  };
+
+  cargoHash = "sha256-hYgEZvRXXhgzuNuSu4ytrlWDwlVYX6R46agu+BxrbEo=";
+
+  meta = {
+    description = "Template generation tool to create no_std applications targeting Espressif's chips";
+    homepage = "https://github.com/esp-rs/esp-generate";
+    license = with lib.licenses; [
+      mit # or
+      asl20
+    ];
+    maintainers = [ lib.maintainers.eymeric ];
+  };
+}
--- a/pkgs/by-name/fa/fastnlo-toolkit/package.nix
+++ b/pkgs/by-name/fa/fastnlo-toolkit/package.nix
@ -3,7 +3,6 @@
  stdenv,
  fetchurl,
  boost,
-  gfortran,
  lhapdf,
  ncurses,
  perl,
@ -35,23 +34,26 @@ stdenv.mkDerivation rec {
    ./yoda2_support.patch
  ];

+  nativeBuildInputs = [
+    lhapdf # lhapdf-config
+    yoda # yoda-config
+  ] ++ lib.optional withPython python;
+
  buildInputs =
    [
      boost
-      gfortran
-      gfortran.cc.lib
      lhapdf
      yoda
    ]
    ++ lib.optional withPython python
    ++ lib.optional (withPython && python.isPy3k) ncurses;

+  propagatedNativeBuildInputs = lib.optional withPython [ swig ];
  propagatedBuildInputs =
    [
      zlib
    ]
    ++ lib.optional withPython [
-      swig
      python.pkgs.distutils
    ];

@ -68,6 +70,8 @@ stdenv.mkDerivation rec {
    "--with-yoda=${yoda}"
  ] ++ lib.optional withPython "--enable-pyext";

+  strictDeps = true;
+
  enableParallelBuilding = true;

  doCheck = true;
--- a/pkgs/by-name/fl/flamegraph/package.nix
+++ b/pkgs/by-name/fl/flamegraph/package.nix
@ -18,6 +18,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ perl ];

+  strictDeps = true;
+
  installPhase = ''
    runHook preInstall

@ -31,9 +33,15 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  nativeCheckInputs = [
+    perl
+  ];
+
  checkPhase = ''
-    patchShebangs ./test.sh
+    runHook preCheck
+    patchShebangs --build ./test.sh
    ./test.sh
+    runHook postCheck
  '';

  meta = with lib; {
--- a/pkgs/by-name/ge/geary/package.nix
+++ b/pkgs/by-name/ge/geary/package.nix
@ -56,12 +56,10 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    appstream-glib
    desktop-file-utils
    gettext
    gobject-introspection
    itstool
-    libxml2
    meson
    ninja
    pkg-config
@ -72,6 +70,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    adwaita-icon-theme
+    appstream-glib
    enchant2
    folks
    gcr
@ -91,6 +90,7 @@ stdenv.mkDerivation rec {
    libsecret
    libunwind
    libstemmer
+    libxml2
    libytnef
    sqlite
    webkitgtk_4_1
@ -109,6 +109,8 @@ stdenv.mkDerivation rec {
    "-Dcontractor=enabled" # install the contractor file (Pantheon specific)
  ];

+  strictDeps = true;
+
  # NOTE: Remove `build-auxyaml_to_json.py` when no longer needed, see:
  # https://gitlab.gnome.org/GNOME/geary/commit/f7f72143e0f00ca5e0e6a798691805c53976ae31#0cc1139e3347f573ae1feee5b73dbc8a8a21fcfa
  postPatch = ''
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@ -0,0 +1,136 @@
+{
+  lib,
+  perlPackages,
+  nix,
+  dmidecode,
+  pciutils,
+  usbutils,
+  iproute2,
+  nettools,
+  fetchFromGitHub,
+  makeWrapper,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+perlPackages.buildPerlPackage rec {
+  pname = "glpi-agent";
+  version = "1.11";
+
+  src = fetchFromGitHub {
+    owner = "glpi-project";
+    repo = "glpi-agent";
+    tag = version;
+    hash = "sha256-WdQ+/ZnMCRqLZK64oJNoR9dtMPq+CghsA8NUwt3EpjA=";
+  };
+
+  postPatch = ''
+    patchShebangs bin
+
+    substituteInPlace lib/GLPI/Agent/Tools/Linux.pm \
+      --replace-fail "/sbin/ip" $"{iproute2}/sbin/ip"
+    substituteInPlace lib/GLPI/Agent/Task/Inventory/Linux/Networks.pm \
+      --replace-fail "/sbin/ip" "${iproute2}/sbin/ip"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (
+    with perlPackages;
+    [
+      CGI
+      DataStructureUtil
+      FileCopyRecursive
+      HTTPProxy
+      HTTPServerSimple
+      HTTPServerSimpleAuthen
+      IOCapture
+      IOSocketSSL
+      IPCRun
+      JSON
+      LWPProtocolHttps
+      ModuleInstall
+      NetSNMP
+      TestCompile
+      TestDeep
+      TestException
+      TestMockModule
+      TestMockObject
+      TestNoWarnings
+      CpanelJSONXS
+      XMLLibXML
+      NetPing
+      ParallelForkManager
+      DigestSHA1
+      CryptDES
+      FileCopyRecursive
+      URIEscapeXS
+      DateTime
+      DataUUID
+      URI
+      HTTPDaemon
+      YAML
+      IOCompress
+    ]
+  );
+
+  propagatedBuildInputs = with perlPackages; [
+    FileWhich
+    LWP
+    NetIP
+    TextTemplate
+    UNIVERSALrequire
+    XMLTreePP
+    CompressRawZlib
+    HTTPDaemon
+    ProcDaemon
+    ProcPIDFile
+  ];
+
+  # Test fails due to "Argument list too long"
+  doCheck = false;
+
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r bin $out
+    cp -r lib $out
+    cp -r share $out
+
+    for cur in $out/bin/*; do
+      if [ -x "$cur" ]; then
+        sed -e "s|./lib|$out/lib|" -i "$cur"
+        wrapProgram "$cur" --prefix PATH : ${
+          lib.makeBinPath [
+            nix
+            dmidecode
+            pciutils
+            usbutils
+            nettools
+            iproute2
+          ]
+        }
+      fi
+    done
+  '';
+
+  outputs = [ "out" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GLPI unified Agent for UNIX, Linux, Windows and MacOSX";
+    homepage = "https://glpi-project.org/";
+    changelog = "https://github.com/glpi-project/glpi-agent/releases/tag/${src.tag}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "glpi-agent";
+  };
+}
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@ -9,15 +9,15 @@

 buildGoModule rec {
  pname = "goperf";
-  version = "0-unstable-2024-11-18";
+  version = "0-unstable-2024-12-04";

  src = fetchgit {
    url = "https://go.googlesource.com/perf";
-    rev = "34caac8501763e3ea700ee019bf2c29671a30c55";
-    hash = "sha256-b46zDtBlNpVMTwXTL9sYSpfEVJ87P2ZRQ7MVhOI0r/s=";
+    rev = "711ff2ab72314f5a878a356d9ff7ab8460de731f";
+    hash = "sha256-T0LHlO9ObVJ68pERkY+6eJCxY+Lj9eHvOxlCRevwbuE=";
  };

-  vendorHash = "sha256-5cGgUTruCdfDhvLxXzl5gg2BtAC8HU7ZBL7Niw++HZ0=";
+  vendorHash = "sha256-OrrciJqJLTMM+yF9SD/eRucwOrfcZuuyR+xE6+DlYpo=";

  passthru.updateScript = writeShellScript "update-goperf" ''
    export UPDATE_NIX_ATTR_PATH=goperf
--- a/pkgs/by-name/ho/hosts-bl/package.nix
+++ b/pkgs/by-name/ho/hosts-bl/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "hosts-bl";
+  version = "0-unstable-2024-11-17";
+
+  src = fetchFromGitHub {
+    owner = "ScriptTiger";
+    repo = "Hosts-BL";
+    rev = "b3ac0a50fce8e714e754a17e6a11f8709386782c";
+    sha256 = "sha256-w+4dEWwFMjBbeJPOqMrzLBBzPYh/V5SfV2BMrI0p3nw=";
+  };
+
+  postPatch = ''
+    go mod init github.com/ScriptTiger/Hosts-BL
+  '';
+
+  vendorHash = null;
+
+  meta = {
+    homepage = "https://github.com/ScriptTiger/Hosts-BL";
+    description = "Simple tool to handle hosts file black lists";
+    mainProgram = "Hosts-BL";
+    maintainers = [ lib.maintainers.puffnfresh ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/by-name/hy/hyprsunset/package.nix
+++ b/pkgs/by-name/hy/hyprsunset/package.nix
@ -23,6 +23,11 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-SVkcePzX9PAlWsPSGBaxiNFCouiQmGOezhMo0+zhDIQ=";
  };

+  postPatch = ''
+    # hyprwayland-scanner is not required at runtime
+    substituteInPlace CMakeLists.txt --replace-fail "hyprwayland-scanner>=0.4.0" ""
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -37,6 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
    wayland-scanner
  ];

+  strictDeps = true;
+
  passthru = {
    updateScript = nix-update-script { };
  };
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  udev,
+  libiio,
+  libevdev,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "inputplumber";
+  version = "0.39.2";
+
+  src = fetchFromGitHub {
+    owner = "ShadowBlip";
+    repo = "InputPlumber";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Glq7iJ1AHy99AGXYg5P3wAd3kAMJnt5P2vZzyn7qBY4=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-pcbW/Od5f+hFCrVpH2yioq+qCmlZ1m3TbUc6rBkYCEs=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    udev
+    libevdev
+    libiio
+  ];
+
+  postInstall = ''
+    cp -r rootfs/usr/* $out/
+  '';
+
+  meta = {
+    description = "Open source input router and remapper daemon for Linux";
+    homepage = "https://github.com/ShadowBlip/InputPlumber";
+    license = lib.licenses.gpl3Plus;
+    changelog = "https://github.com/ShadowBlip/InputPlumber/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ shadowapex ];
+    mainProgram = "inputplumber";
+  };
+}
--- a/pkgs/by-name/la/labelle/package.nix
+++ b/pkgs/by-name/la/labelle/package.nix
@ -8,18 +8,19 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.2.3";
+  version = "1.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nGWffQAXlnKiWBUnSo/IKGdWsLdwLr9N4jAURcVGfj8=";
+    hash = "sha256-+aRq+zwnoHy+kXerFCw1b46OHmWDDpyOiBRu4IvYAQg=";
  };

  postPatch = ''
-    sed -i 's/hatch-vcs >=0.3.0,<0.4/hatch-vcs >=0.3.0/' pyproject.toml
+    substituteInPlace pyproject.toml --replace-fail "hatch-vcs >=0.3.0,<0.4" "hatch-vcs >=0.3.0"
+    substituteInPlace pyproject.toml --replace-fail "Pillow>=8.1.2,<11" "Pillow>=8.1.2"
  '';

  buildInputs = [ qt6.qtwayland ];
@ -27,6 +28,7 @@ python3Packages.buildPythonApplication rec {
  nativeBuildInputs = [
    qt6.wrapQtAppsHook
    python3Packages.hatchling
+    python3Packages.hatch-fancy-pypi-readme
    python3Packages.hatch-vcs
    copyDesktopItems
  ];
--- a/pkgs/by-name/mq/mqttx-cli/package.nix
+++ b/pkgs/by-name/mq/mqttx-cli/package.nix
@ -0,0 +1,74 @@
+{
+  fetchFromGitHub,
+  fetchYarnDeps,
+  fetchpatch,
+  lib,
+  mqttx-cli,
+  nodejs,
+  stdenv,
+  testers,
+  yarnConfigHook,
+  yarnInstallHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mqttx-cli";
+  version = "1.11.0";
+
+  src = fetchFromGitHub {
+    owner = "emqx";
+    repo = "MQTTX";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-IPIiSav6MPJmzetBgVw9fLGPjJ+JKS3oWMEfCJmEY84=";
+  };
+
+  patches = [
+    # moves @faker-js/faker from devDependencies to dependencies
+    # because the final package depends on it
+    # https://github.com/emqx/MQTTX/pull/1801
+    (fetchpatch {
+      url = "https://github.com/emqx/MQTTX/commit/3d89c3a08477e9e2b5d83f2a222ceaa8c08e50ce.patch";
+      hash = "sha256-Rd6YpGHsvAYD7/XCJq6dgvGeKfOiLh7IUQFr/AQz0mY=";
+    })
+  ];
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/cli/yarn.lock";
+    hash = "sha256-vwPwSE6adxM1gkdsJBq3LH2eXze9yXADvnM90LsKjjo=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnInstallHook
+  ];
+
+  preConfigure = ''
+    cd cli
+  '';
+
+  # Using custom build script instead of `yarnBuildHook`
+  # because it needs `--ignore-engines` before `build`.
+  buildPhase = ''
+    runHook preBuild
+    yarn --offline --ignore-engines build
+    runHook postBuild
+  '';
+
+  postInstall = ''
+    # rename binary so it does not conflict with the desktop app
+    mv $out/bin/mqttx $out/bin/mqttx-cli
+  '';
+
+  passthru.tests.version = testers.testVersion { package = mqttx-cli; };
+
+  meta = {
+    description = "MQTTX Command Line Tools";
+    homepage = "https://mqttx.app/";
+    changelog = "https://mqttx.app/changelogs/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    mainProgram = "mqttx-cli";
+  };
+})
--- a/pkgs/by-name/na/nanovna-qt/fix-build.patch
+++ b/pkgs/by-name/na/nanovna-qt/fix-build.patch
@ -0,0 +1,36 @@
+diff --git a/libxavna/xavna_mock_ui/xavna_mock_ui.H b/libxavna/xavna_mock_ui/xavna_mock_ui.H
+index 333f9ed..819a019 100644
+--- a/libxavna/xavna_mock_ui/xavna_mock_ui.H
+++ b/libxavna/xavna_mock_ui/xavna_mock_ui.H
+@@ -2,6 +2,7 @@
+ #define XAVNA_MOCK_UI_H
+ 
+ #include <functional>
+#include <string>
+ using namespace std;
+ typedef function<void(string dut_name, double cableLen1, double cableLen2)> xavna_ui_changed_cb;
+ 
+diff --git a/vna_qt/firmwareupdater.H b/vna_qt/firmwareupdater.H
+index 7654211..8b61dfb 100644
+--- a/vna_qt/firmwareupdater.H
+++ b/vna_qt/firmwareupdater.H
+@@ -3,6 +3,7 @@
+ #include <string>
+ #include <functional>
+ #include <pthread.h>
+#include <cstdint>
+ using namespace std;
+ 
+ class FirmwareUpdater
+diff --git a/vna_qt/polarview.C b/vna_qt/polarview.C
+index 8bde6e3..5800463 100644
+--- a/vna_qt/polarview.C
+++ b/vna_qt/polarview.C
+@@ -3,6 +3,7 @@
+ #include <cmath>
+ #include <QPaintEvent>
+ #include <QPainter>
+#include <QPainterPath>
+ PolarView::PolarView(QWidget *parent) : QWidget(parent)
+ {
+ 
--- a/pkgs/by-name/na/nanovna-qt/package.nix
+++ b/pkgs/by-name/na/nanovna-qt/package.nix
@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  libtool,
+  fftw,
+  eigen,
+  qt5,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nanovna-qt";
+  # 20200507 dropped support for NanoVNA V2.2
+  version = "20200403";
+
+  src = fetchFromGitHub {
+    owner = "nanovna-v2";
+    repo = "NanoVNA-QT";
+    rev = version;
+    hash = "sha256-0nRpjLglCog9e4bSkaNSwjrwmLwut3Ykr3AaYZCaMEs=";
+  };
+
+  patches = [ ./fix-build.patch ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    fftw
+    eigen
+    qt5.qtbase
+    qt5.qtcharts
+  ];
+
+  autoreconfFlags = [ "--install" ];
+
+  postBuild = ''
+    pushd libxavna/xavna_mock_ui/
+    qmake
+    make
+    popd
+    pushd vna_qt/
+    qmake
+    make
+    popd
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 vna_qt/vna_qt -t $out/bin/
+    install -Dm555 libxavna/.libs/libxavna.so.0.0.0 -t $out/lib/
+    ln -s libxavna.so.0.0.0 $out/lib/libxavna.so.0
+    ln -s libxavna.so.0.0.0 $out/lib/libxavna.so
+    install -Dm555 libxavna/xavna_mock_ui/libxavna_mock_ui.so.1.0.0 -t $out/lib/
+    ln -s libxavna_mock_ui.so.1.0.0 $out/lib/libxavna_mock_ui.so.1.0
+    ln -s libxavna_mock_ui.so.1.0.0 $out/lib/libxavna_mock_ui.so.1
+    ln -s libxavna_mock_ui.so.1.0.0 $out/lib/libxavna_mock_ui.so
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    qtWrapperArgs+=(--prefix LD_LIBRARY_PATH : "$out/lib")
+  '';
+
+  meta = {
+    description = "PC GUI software for NanoVNA V2 series";
+    homepage = "https://nanorfe.com/nanovna-v2.html";
+    mainProgram = "vna_qt";
+    license = lib.licenses.gpl2Only;
+    changelog = "https://github.com/nanovna-v2/NanoVNA-QT/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ chuangzhu ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
@ -276,7 +276,10 @@ def reexec(
            build_attr = BuildAttr.from_arg(args.attr, args.file)
            drv = nix.build(attr, build_attr, **build_flags, no_out_link=True)
    except CalledProcessError:
-        logger.warning("could not build a newer version of nixos-rebuild")
+        logger.warning(
+            "could not build a newer version of nixos-rebuild, "
+            + "using current version"
+        )

    if drv:
        new = drv / f"bin/{EXECUTABLE}"
@ -284,14 +287,27 @@ def reexec(
        if new != current:
            logging.debug(
                "detected newer version of script, re-exec'ing, current=%s, new=%s",
-                argv[0],
+                current,
                new,
            )
            # Manually call clean-up functions since os.execve() will replace
            # the process immediately
            cleanup_ssh()
            tmpdir.TMPDIR.cleanup()
-            os.execve(new, argv, os.environ | {"_NIXOS_REBUILD_REEXEC": "1"})
+            try:
+                os.execve(new, argv, os.environ | {"_NIXOS_REBUILD_REEXEC": "1"})
+            except Exception:
+                # Possible errors that we can have here:
+                # - Missing the binary
+                # - Exec format error (e.g.: another OS/CPU arch)
+                logger.warning(
+                    "could not re-exec in a newer version of nixos-rebuild, "
+                    + "using current version"
+                )
+                logger.debug("re-exec exception", exc_info=True)
+                # We already run clean-up, let's re-exec in the current version
+                # to avoid issues
+                os.execve(current, argv, os.environ | {"_NIXOS_REBUILD_REEXEC": "1"})


 def execute(argv: list[str]) -> None:
--- a/pkgs/by-name/ob/oboete/Cargo.lock
+++ b/pkgs/by-name/ob/oboete/Cargo.lock
--- a/pkgs/by-name/ob/oboete/package.nix
+++ b/pkgs/by-name/ob/oboete/package.nix
@ -13,32 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "oboete";
-  version = "0.1.6";
+  version = "0.1.7";

  src = fetchFromGitHub {
    owner = "mariinkys";
    repo = "oboete";
-    rev = "refs/tags/${version}";
-    hash = "sha256-tiYZ8xMIxMvRdQCf9+LI2B1lXbJz7MFyyeAOkJR+8Vk=";
+    tag = version;
+    hash = "sha256-W5dd8UNjG2w0N1EngDPK7Q83C2TF9UfW0GGvPaW6nls=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
-      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-config-0.1.0" = "sha256-joMHmFbgMAuaXtSvJutahE/8y+4AL7dd8bb9bs6Usc0=";
-      "cosmic-settings-daemon-0.1.0" = "sha256-mklNPKVMO6iFrxki2DwiL5K78KiWpGxksisYldaASIE=";
-      "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
-      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
-      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
-      "smithay-clipboard-0.8.0" = "sha256-4InFXm0ahrqFrtNLeqIuE3yeOpxKZJZx+Bc0yQDtv34=";
-      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
-      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
-      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
-    };
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-UZUqPITtpHeNrsi6Nao+dfK3ACVJmZIc47aqSbwTemw=";

  nativeBuildInputs = [
    pkg-config
@ -67,9 +52,9 @@ rustPlatform.buildRustPackage rec {
  };

  meta = {
-    description = "A simple flashcards application for the COSMIC™ desktop written in Rust";
+    description = "Simple flashcards application for the COSMIC™ desktop written in Rust";
    homepage = "https://github.com/mariinkys/oboete";
-    changelog = "https://github.com/mariinkys/oboete/releases/tag/${version}";
+    changelog = "https://github.com/mariinkys/oboete/releases/tag/${src.tag}";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ GaetanLepage ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/oc/ocis/package.nix
+++ b/pkgs/by-name/oc/ocis/package.nix
@ -0,0 +1,88 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  buildGoModule,
+  callPackage,
+  gnumake,
+  pnpm,
+  nodejs,
+  ocis,
+}:
+let
+  idp-assets = stdenvNoCC.mkDerivation {
+    pname = "idp-assets";
+    version = "0-unstable-2020-10-14";
+    src = fetchFromGitHub {
+      owner = "owncloud";
+      repo = "assets";
+      rev = "e8b6aeadbcee1865b9df682e9bd78083842d2b5c";
+      hash = "sha256-PzGff2Zx8xmvPYQa4lS4yz2h+y/lerKvUZkYI7XvAUw=";
+    };
+    installPhase = ''
+      mkdir -p $out/share
+      cp logo.svg favicon.ico $out/share/
+    '';
+    dontConfigure = true;
+    dontBuild = true;
+    dontFixup = true;
+  };
+in
+buildGoModule rec {
+  pname = "ocis";
+  version = "5.0.9";
+
+  vendorHash = null;
+
+  src = fetchFromGitHub {
+    owner = "owncloud";
+    repo = "ocis";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TsMrQx+P1F2t66e0tGG0VvRi4W7+pCpDHd0aNsacOsI=";
+  };
+
+  nativeBuildInputs = [
+    gnumake
+    nodejs
+    pnpm.configHook
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit pname version src;
+    sourceRoot = "${src.name}/services/idp";
+    hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
+  };
+  pnpmRoot = "services/idp";
+
+  buildPhase = ''
+    runHook preBuild
+    cp -r ${ocis.web}/share/* services/web/assets/
+    pnpm -C services/idp build
+
+    mkdir -p services/idp/assets/identifier/static
+    cp -r ${idp-assets}/share/* services/idp/assets/identifier/static/
+
+    make -C ocis VERSION=${version} DATE=${version} build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin/
+    cp ocis/bin/ocis $out/bin/
+    runHook postInstall
+  '';
+
+  passthru = {
+    web = callPackage ./web.nix { };
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    homepage = "https://github.com/owncloud/web";
+    description = "Next generation frontend for ownCloud Infinite Scale";
+    license = lib.licenses.asl20;
+    mainProgram = "ocis";
+    maintainers = with lib.maintainers; [ xinyangli ];
+  };
+}
--- a/pkgs/by-name/oc/ocis/update.sh
+++ b/pkgs/by-name/oc/ocis/update.sh
@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnugrep nix-update coreutils
+set -ex
+
+TAGS=$(curl -s https://api.github.com/repos/owncloud/ocis/releases | jq -r ".[].tag_name")
+
+for tag in $TAGS; do
+    main_version_old=$(echo "v$UPDATE_NIX_OLD_VERSION" | cut -d'.' -f1)
+    main_version_new=$(echo "$tag" | cut -d'.' -f1)
+
+    # Compare the main versions
+    if [[ "$main_version_old" == "$main_version_new" ]]; then
+        UPDATE_NIX_NEW_VERSION=$tag
+        break
+    else
+        continue
+    fi
+done
+
+OCIS_WEB_VERSION=$(curl -s https://raw.githubusercontent.com/owncloud/ocis/$UPDATE_NIX_NEW_VERSION/services/web/Makefile | grep -oP '(?<=WEB_ASSETS_VERSION = )v[0-9]+\.[0-9]+\.[0-9]+')
+nix-update -vr 'v(.*)' --version=$OCIS_WEB_VERSION ocis.web
+nix-update -vr 'v(.*)' --version=$UPDATE_NIX_NEW_VERSION ocis
--- a/pkgs/by-name/oc/ocis/web.nix
+++ b/pkgs/by-name/oc/ocis/web.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  nodejs,
+  pnpm,
+  fetchFromGitHub,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "ocis-web";
+  version = "8.0.5";
+
+  src = fetchFromGitHub {
+    owner = "owncloud";
+    repo = "web";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hupdtK/V74+X7/eXoDmUjFvSKuhnoOtNQz7o6TLJXG4=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    pnpm build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share
+    cp -r dist/* $out/share/
+    runHook postInstall
+  '';
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit pname version src;
+    hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
+  };
+
+  meta = {
+    homepage = "https://github.com/owncloud/ocis";
+    description = "ownCloud Infinite Scale Stack";
+    maintainers = with lib.maintainers; [ xinyangli ];
+    license = lib.licenses.agpl3Only;
+  };
+}
--- a/pkgs/by-name/op/openfortivpn-webview-qt/package.nix
+++ b/pkgs/by-name/op/openfortivpn-webview-qt/package.nix
@ -0,0 +1,39 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  qt6Packages,
+}:
+stdenv.mkDerivation rec {
+  pname = "openfortivpn-webview-qt";
+  version = "1.1.2";
+
+  src = fetchFromGitHub {
+    owner = "gm-vm";
+    repo = "openfortivpn-webview";
+    rev = "v${version}-electron";
+    hash = "sha256-BNotbb2pL7McBm0SQwcgEvjgS2GId4HVaxWUz/ODs6w=";
+  };
+  sourceRoot = "source/openfortivpn-webview-qt";
+
+  nativeBuildInputs = [
+    qt6Packages.wrapQtAppsHook
+    qt6Packages.qmake
+  ];
+  buildInputs = [ qt6Packages.qtwebengine ];
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp openfortivpn-webview $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Perform the SAML single sign-on and easily retrieve the SVPNCOOKIE needed by openfortivpn";
+    homepage = "https://github.com/gm-vm/openfortivpn-webview/tree/main";
+    license = licenses.mit;
+    maintainers = [ lib.maintainers.jonboh ];
+    platforms = platforms.linux;
+    mainProgram = "openfortivpn-webview";
+  };
+}
--- a/pkgs/by-name/op/openjfx/package.nix
+++ b/pkgs/by-name/op/openjfx/package.nix
@ -115,6 +115,8 @@ stdenv.mkDerivation {

  __darwinAllowLocalNetworking = true;

+  # GCC 14 makes these errors by default
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=int-conversion";
  env.config = writeText "gradle.properties" ''
    CONF = Release
    JDK_HOME = ${jdk-bootstrap.home}
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@ -7,11 +7,11 @@
 renode.overrideAttrs (
  finalAttrs: _: {
    pname = "renode-unstable";
-    version = "1.15.3+20241112git6e850cb52";
+    version = "1.15.3+20241217git398e80b6e";

    src = fetchurl {
      url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-      hash = "sha256-GkmzPc0pPRglkuGzPU+rLUcwlhw8v4VgQnxnkzT/+cI=";
+      hash = "sha256-DJau7daj06GHWr3uGAbb6/oKb4QIefRqH6QoYjy5JNU=";
    };

    passthru.updateScript =
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@ -12,14 +12,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2024-12-02";
-  cargoHash = "sha256-qlBR6Ua0h+1jk1VTjDRkSsmYjbsjeONGIEXGMxHlyfM=";
+  version = "2024-12-16";
+  cargoHash = "sha256-RUFhNJTLP1xOr+qpRVYZipk9rZ/c9kqJE9wuqmwFFPE=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    hash = "sha256-Aob7Gf46F4BMLS0FDzf8mV39fUbNHURaY+GbYNsoOY4=";
+    hash = "sha256-7DBZsPlP/9ZpYk+k6dLFG6SEH848HuGaY7ri/gdye4M=";
  };

  cargoBuildFlags = [
--- a/pkgs/development/libraries/physics/lhapdf/default.nix
+++ b/pkgs/development/libraries/physics/lhapdf/default.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  bash,
  python,
  makeWrapper,
 }:
@ -22,7 +23,10 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs =
-    [ makeWrapper ]
+    [
+      bash
+      makeWrapper
+    ]
    ++ lib.optionals (python != null && lib.versionAtLeast python.version "3.10") [
      python.pkgs.cython
    ];
@ -34,6 +38,8 @@ stdenv.mkDerivation rec {
    rm wrappers/python/lhapdf.cpp
  '';

+  strictDeps = true;
+
  enableParallelBuilding = true;

  passthru = {
@ -41,6 +47,7 @@ stdenv.mkDerivation rec {
  };

  postInstall = ''
+    patchShebangs --build $out/bin/lhapdf-config
    wrapProgram $out/bin/lhapdf --prefix PYTHONPATH : "$(toPythonPath "$out")"
  '';

--- a/pkgs/development/libraries/physics/yoda/default.nix
+++ b/pkgs/development/libraries/physics/yoda/default.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitLab,
  autoreconfHook,
+  bash,
  python,
  root,
  makeWrapper,
@ -23,6 +24,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = with python.pkgs; [
    autoreconfHook
+    bash
    cython
    makeWrapper
  ];
@ -43,6 +45,8 @@ stdenv.mkDerivation rec {
    zlib
  ];

+  strictDeps = true;
+
  enableParallelBuilding = true;

  postPatch = ''
@ -54,6 +58,7 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
+    patchShebangs --build $out/bin/yoda-config
    for prog in "$out"/bin/*; do
      wrapProgram "$prog" --set PYTHONPATH $PYTHONPATH:$(toPythonPath "$out")
    done
--- a/pkgs/development/python-modules/nifty8/default.nix
+++ b/pkgs/development/python-modules/nifty8/default.nix
@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitLab,
+
+  cudaSupport ? config.cudaSupport,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  astropy,
+  ducc0,
+  h5py,
+  jax,
+  jaxlib,
+  matplotlib,
+  mpi,
+  mpi4py,
+  numpy,
+  scipy,
+
+  # test
+  pytestCheckHook,
+  mpiCheckPhaseHook,
+  openssh,
+}:
+
+buildPythonPackage rec {
+  pname = "nifty8";
+  version = "8.5.2";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.mpcdf.mpg.de";
+    owner = "ift";
+    repo = "nifty";
+    rev = "v${version}";
+    hash = "sha256-EWsJX+iqKOhQXEWlQfYUiPYqyfOfrwLtbI+DVn7vCQI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    astropy
+    ducc0
+    h5py
+    jax
+    (jaxlib.override { inherit cudaSupport; })
+    matplotlib
+    mpi4py
+    mpi
+    numpy
+    scipy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    mpiCheckPhaseHook
+    openssh
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    python3 -m pytest test
+
+    if [ "${stdenv.buildPlatform.system}" != "aarch64-linux" ] && \
+       [ "${stdenv.buildPlatform.system}" != "x86_64-darwin" ]; then
+    ${mpi}/bin/mpiexec -n 2 --bind-to none python3 -m pytest test/test_mpi
+    fi
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "nifty8" ];
+
+  meta = {
+    homepage = "https://gitlab.mpcdf.mpg.de/ift/nifty";
+    description = "Bayesian Imaging library for high-dimensional posteriors";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ parras ];
+  };
+}
--- a/pkgs/development/python-modules/pixel-font-knife/default.nix
+++ b/pkgs/development/python-modules/pixel-font-knife/default.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  pytestCheckHook,
+  nix-update-script,
+  hatchling,
+  pypng,
+  unidata-blocks,
+  pyyaml,
+}:
+
+buildPythonPackage rec {
+  pname = "pixel-font-knife";
+  version = "0.0.7";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchPypi {
+    pname = "pixel_font_knife";
+    inherit version;
+    hash = "sha256-NALIf8DbIPKmazF669LHsKuP0tndR0pbphrhlXt6wyA=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    pypng
+    unidata-blocks
+    pyyaml
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pixel_font_knife" ];
+
+  meta = {
+    homepage = "https://github.com/TakWolf/pixel-font-knife";
+    description = "Set of pixel font utilities";
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      TakWolf
+      h7x4
+    ];
+  };
+}
--- a/pkgs/os-specific/linux/device-tree/apply_overlays.py
+++ b/pkgs/os-specific/linux/device-tree/apply_overlays.py
@ -4,7 +4,7 @@ from functools import cached_property
 import json
 from pathlib import Path

-from libfdt import Fdt, FdtException, FDT_ERR_NOSPACE, fdt_overlay_apply
+from libfdt import Fdt, FdtException, FDT_ERR_NOSPACE, FDT_ERR_NOTFOUND, fdt_overlay_apply


@dataclass
@ -25,7 +25,14 @@ class Overlay:

 def get_compatible(fdt):
    root_offset = fdt.path_offset("/")
-    return set(fdt.getprop(root_offset, "compatible").as_stringlist())
+
+    try:
+        return set(fdt.getprop(root_offset, "compatible").as_stringlist())
+    except FdtException as e:
+        if e.err == -FDT_ERR_NOTFOUND:
+            return set()
+        else:
+            raise e


 def apply_overlay(dt: Fdt, dto: Fdt) -> Fdt:
@ -77,14 +84,15 @@ def main():
        with source_dt.open("rb") as fd:
            dt = Fdt(fd.read())

-        dt_compatible = get_compatible(dt)
-
        for overlay in overlays_data:
            if overlay.filter and overlay.filter not in str(rel_path):
                print(f"  Skipping overlay {overlay.name}: filter does not match")
                continue

-            if not overlay.compatible.intersection(dt_compatible):
+            dt_compatible = get_compatible(dt)
+            if len(dt_compatible) == 0:
+                print(f"  Device tree {rel_path} has no compatible string set. Assuming it's compatible with overlay")
+            elif not overlay.compatible.intersection(dt_compatible):
                print(f"  Skipping overlay {overlay.name}: {overlay.compatible} is incompatible with {dt_compatible}")
                continue

--- a/pkgs/os-specific/linux/iio-utils/default.nix
+++ b/pkgs/os-specific/linux/iio-utils/default.nix
@ -0,0 +1,19 @@
+{ lib, stdenv, kernel }:
+
+stdenv.mkDerivation {
+  pname = "iio-utils";
+  inherit (kernel) src version;
+
+  makeFlags = [ "bindir=${placeholder "out"}/bin" ];
+
+  postPatch = ''
+    cd tools/iio
+  '';
+
+  meta = with lib; {
+    description = "Userspace tool for interacting with Linux IIO";
+    homepage = "https://www.kernel.org/";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/dns/nsd/default.nix
+++ b/pkgs/servers/dns/nsd/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "nsd";
-  version = "4.10.2";
+  version = "4.11.0";

  src = fetchurl {
    url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yR7vLnPkMPooa9SPB1qNAj+25gVg4iGJyzWDxdoAtps=";
+    sha256 = "sha256-k5VtkNRf+p+E+MovcYpCEF5CNtCUzgMiEYSfGhLNwVg=";
  };

  prePatch = ''
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@ -11,14 +11,14 @@

 stdenv.mkDerivation rec {
  pname = "snac2";
-  version = "2.65";
+  version = "2.66";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "grunfink";
    repo = pname;
    rev = version;
-    hash = "sha256-jzkimE4JPrlsHP0jPawhloXMDNaWG1Sgfp5NiZxm1xo=";
+    hash = "sha256-JArXXuWS60tXShYD4bKwHRPlbLRALZTnwn3iYBhhD2s=";
  };

  buildInputs = [
--- a/pkgs/servers/tt-rss/default.nix
+++ b/pkgs/servers/tt-rss/default.nix
@ -1,13 +1,19 @@
-{ lib, stdenv, fetchgit }:
+{
+  lib,
+  stdenv,
+  fetchgit,
+  nixosTests,
+  unstableGitUpdater,
+}:

 stdenv.mkDerivation rec {
  pname = "tt-rss";
-  version = "unstable-2023-04-13";
+  version = "0-unstable-2024-11-04";

  src = fetchgit {
    url = "https://git.tt-rss.org/fox/tt-rss.git";
-    rev = "0578bf802571781a0a7e3debbbec66437a7d28b4";
-    hash = "sha256-j6R1QoH8SzUtyI3rGE6rHriboAfApAo/Guw8WbJ7LqU=";
+    rev = "42ebdb027ec249fb8e693c41d7ee80ecdc68d6ec";
+    hash = "sha256-QN7CwUufQSFlFde0NebO/kOYtEZCyL0ut+CNEpJMIMA=";
  };

  installPhase = ''
@ -18,16 +24,25 @@ stdenv.mkDerivation rec {

    # see the code of Config::get_version(). you can check that the version in
    # the footer of the preferences pages is not UNKNOWN
-    echo "23.04" > $out/version_static.txt
+    echo "${version}" > $out/version_static.txt

    runHook postInstall
  '';

+  passthru = {
+    inherit (nixosTests) tt-rss;
+    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+  };
+
  meta = with lib; {
    description = "Web-based news feed (RSS/Atom) aggregator";
    license = licenses.gpl2Plus;
    homepage = "https://tt-rss.org";
-    maintainers = with maintainers; [ globin zohl ];
+    maintainers = with maintainers; [
+      gileri
+      globin
+      zohl
+    ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchurl
-, makeWrapper
+, makeShellWrapper
 , updateAutotoolsGnuConfigScriptsHook
 , runtimeShellPackage
 }:
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook makeWrapper ];
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook makeShellWrapper ];
  buildInputs = [ runtimeShellPackage ];

  makeFlags = [
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -375,6 +375,8 @@ in {

    e1000e = if lib.versionOlder kernel.version "4.10" then  callPackage ../os-specific/linux/e1000e {} else null;

+    iio-utils = if lib.versionAtLeast kernel.version "4.1" then callPackage ../os-specific/linux/iio-utils { } else null;
+
    intel-speed-select = if lib.versionAtLeast kernel.version "5.3" then callPackage ../os-specific/linux/intel-speed-select { } else null;

    ipu6-drivers = callPackage ../os-specific/linux/ipu6-drivers {};
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -9194,6 +9194,8 @@ self: super: with self; {

  nidaqmx = callPackage ../development/python-modules/nidaqmx { };

+  nifty8 = callPackage ../development/python-modules/nifty8 { };
+
  nikola = callPackage ../development/python-modules/nikola { };

  niko-home-control = callPackage ../development/python-modules/niko-home-control { };
@ -10391,6 +10393,8 @@ self: super: with self; {

  pixel-font-builder = callPackage ../development/python-modules/pixel-font-builder { };

+  pixel-font-knife = callPackage ../development/python-modules/pixel-font-knife { };
+
  pixel-ring = callPackage ../development/python-modules/pixel-ring { };

  pjsua2 = (toPythonModule (pkgs.pjsip.override {