From b3d48503cb8b8fc788d4f59af9262e57b3283f5f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 17 Dec 2024 15:56:46 +0000
Subject: [PATCH 01/35] bigloo: 4.4b -> 4.5b

---
 pkgs/by-name/bi/bigloo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bigloo/package.nix b/pkgs/by-name/bi/bigloo/package.nix
index 53f76870a4fc..054acfa7c8f1 100644
--- a/pkgs/by-name/bi/bigloo/package.nix
+++ b/pkgs/by-name/bi/bigloo/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bigloo";
-  version = "4.4b";
+  version = "4.5b";
 
   src = fetchurl {
     url = "ftp://ftp-sop.inria.fr/indes/fp/Bigloo/bigloo-${version}.tar.gz";
-    sha256 = "sha256-oxOSJwKWmwo7PYAwmeoFrKaYdYvmvQquWXyutolc488=";
+    sha256 = "sha256-hk1SXuan/zOf2ajJc8xGv5piOjgn2Ev7bgSikiNwfaU=";
   };
 
   nativeBuildInputs = [

From c978a5d55c888b1eab23376673f2d472b9bf2c7d Mon Sep 17 00:00:00 2001
From: Stephen D <webmaster@scd31.com>
Date: Sun, 29 Dec 2024 18:37:41 -0400
Subject: [PATCH 02/35] maintainers: add scd31

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e55b7c07349f..4701a6843ebc 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -20194,6 +20194,11 @@
     githubId = 3958212;
     name = "Tom Sorlie";
   };
+  scd31 = {
+    name = "scd31";
+    github = "scd31";
+    githubId = 57571338;
+  };
   schinmai-akamai = {
     email = "schinmai@akamai.com";
     github = "tchinmai7";

From c645ff1e650ef78d3ca7b732b069c296c268b021 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Jan 2025 06:50:16 +0000
Subject: [PATCH 03/35] debootstrap: 1.0.138 -> 1.0.140

---
 pkgs/by-name/de/debootstrap/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/debootstrap/package.nix b/pkgs/by-name/de/debootstrap/package.nix
index 08b65af738b2..09c5c65c6f19 100644
--- a/pkgs/by-name/de/debootstrap/package.nix
+++ b/pkgs/by-name/de/debootstrap/package.nix
@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "debootstrap";
-  version = "1.0.138";
+  version = "1.0.140";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "debootstrap";
     rev = "refs/tags/${version}";
-    hash = "sha256-2NUFt39isGThOqlg1LNOFxYJOPm93jDCvIztJoE5Vts=";
+    hash = "sha256-kusY42HwyMFuzwJimdVzuwx9XGjKssGAR7guB4E0TbQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 40576b59d4331e4fe0f52ed2cb039d0c55affed2 Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Fri, 3 Jan 2025 05:14:10 +0000
Subject: [PATCH 04/35] television: 0.8.5 -> 0.8.6

Diff: https://github.com/alexpasmantier/television/compare/0.8.5...0.8.6
Changelog: https://github.com/alexpasmantier/television/releases/tag/0.8.6
---
 pkgs/by-name/te/television/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 9f4e711cbd0f..60c4e08c658f 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
-    rev = "refs/tags/" + version;
-    hash = "sha256-LzO6LpKsox5U2IHYZXDDkUbPeZmAa/gBpG6nk78tIzQ=";
+    tag = version;
+    hash = "sha256-p6RuLuhtgVOa8+l0JU5byQ4SHG/TmURPlZUMNVqvfp8=";
   };
 
-  cargoHash = "sha256-I0muMgPfk72dnR4iufipjt+C7v6X/IMOdLCH12qHjA8=";
+  cargoHash = "sha256-0tXsoKSQ0c3po75oMd6LTG+HSkKr5UvI0lBg6FySwfs=";
 
   passthru = {
     tests.version = testers.testVersion {

From 66cd762fedf827ea26cd89ccbd75ac9eae62531e Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Fri, 3 Jan 2025 23:28:36 +0100
Subject: [PATCH 05/35] python312Packages.pyliblo: Fix build

---
 pkgs/development/python-modules/pyliblo/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/pyliblo/default.nix b/pkgs/development/python-modules/pyliblo/default.nix
index 7caead892995..d5756f745b27 100644
--- a/pkgs/development/python-modules/pyliblo/default.nix
+++ b/pkgs/development/python-modules/pyliblo/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
       url = "https://git.alpinelinux.org/aports/plain/community/py3-pyliblo/py3.11.patch?id=a7e1eca5533657ddd7e37c43e67e8126e3447258";
       hash = "sha256-4yCWNQaE/9FHGTVuvNEimBNuViWZ9aSJMcpTOP0fnM0=";
     })
+    # Fix compile error due to  incompatible pointer type 'lo_blob_dataptr'
+    (fetchurl {
+      url = "https://github.com/dsacre/pyliblo/commit/ebbb255d6a73384ec2560047eab236660d4589db.patch?full_index=1";
+      hash = "sha256-ZBAmBxSUT2xgoDVqSjq8TxW2jz3xR/pdCf2O3wMKvls=";
+    })
   ];
 
   build-system = [ cython_0 ];

From ab4228f5008f6dbc94c96f82512591f6c5b0dd62 Mon Sep 17 00:00:00 2001
From: NullCube <nullcub3@gmail.com>
Date: Sun, 5 Jan 2025 04:01:52 -0800
Subject: [PATCH 06/35] hyfetch: add nullcube to maintainers

---
 pkgs/by-name/hy/hyfetch/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/hy/hyfetch/package.nix b/pkgs/by-name/hy/hyfetch/package.nix
index b35d874fea04..2786d41bf30e 100644
--- a/pkgs/by-name/hy/hyfetch/package.nix
+++ b/pkgs/by-name/hy/hyfetch/package.nix
@@ -53,6 +53,7 @@ python3Packages.buildPythonApplication rec {
     maintainers = with lib.maintainers; [
       yisuidenghua
       isabelroses
+      nullcube
     ];
   };
 }

From 595fc886d6b905fffe12109d43efbe6ddf85178a Mon Sep 17 00:00:00 2001
From: NullCube <nullcub3@gmail.com>
Date: Sun, 5 Jan 2025 02:42:24 -0800
Subject: [PATCH 07/35] hyfetch: install man pages

---
 pkgs/by-name/hy/hyfetch/package.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkgs/by-name/hy/hyfetch/package.nix b/pkgs/by-name/hy/hyfetch/package.nix
index 2786d41bf30e..6e11e1c0d7ea 100644
--- a/pkgs/by-name/hy/hyfetch/package.nix
+++ b/pkgs/by-name/hy/hyfetch/package.nix
@@ -3,12 +3,18 @@
   fetchFromGitHub,
   python3Packages,
   pciutils,
+  installShellFiles,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "hyfetch";
   version = "1.99.0";
   pyproject = true;
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
@@ -24,6 +30,10 @@ python3Packages.buildPythonApplication rec {
     python3Packages.typing-extensions
   ];
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   # No test available
   doCheck = false;
 
@@ -31,6 +41,15 @@ python3Packages.buildPythonApplication rec {
     "hyfetch"
   ];
 
+  # NOTE: The HyFetch project maintains an updated version of neofetch renamed
+  # to "neowofetch" which is included in this package. However, the man page
+  # included is still named "neofetch", so to prevent conflicts and confusion
+  # we rename the file to "neowofetch" before installing it:
+  postInstall = ''
+    mv ./docs/neofetch.1 ./docs/neowofetch.1
+    installManPage ./docs/hyfetch.1 ./docs/neowofetch.1
+  '';
+
   postFixup = ''
     wrapProgram $out/bin/neowofetch \
       --prefix PATH : ${lib.makeBinPath [ pciutils ]}

From f598632917d43ced54a11df04f1de33532497bd4 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Thu, 2 Jan 2025 15:47:11 +0100
Subject: [PATCH 08/35] envoy: fix build

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../0001-nixpkgs-use-system-Python.patch      |   6 +-
 .../en/envoy/0002-nixpkgs-use-system-Go.patch |   4 +-
 ...03-nixpkgs-use-system-C-C-toolchains.patch |   4 +-
 ...04-nixpkgs-patch-boringssl-for-gcc14.patch |  55 ++++++++
 ...05-deps-Bump-rules_rust-0.54.1-37056.patch | 128 ++++++++++++++++++
 pkgs/by-name/en/envoy/package.nix             |  54 +++++---
 6 files changed, 223 insertions(+), 28 deletions(-)
 create mode 100644 pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
 create mode 100644 pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch

diff --git a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
index 983408cab16c..e9cb4d5526e9 100644
--- a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
+++ b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
@@ -1,4 +1,4 @@
-From 47406ebaf0260e5b66a92baac3717936c8386b69 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:52:59 +0200
 Subject: [PATCH] nixpkgs: use system Python
@@ -10,7 +10,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  2 files changed, 5 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 9f2b336b1a..53a2c93c59 100644
+index 9f2b336b1a36ca0d2f04a40ac1809b30ff21df27..53a2c93c59492a12ef4a6ecfc0c8a679f0df73f7 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
 @@ -1,28 +1,25 @@
@@ -47,7 +47,7 @@ index 9f2b336b1a..53a2c93c59 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index b92dd461ba..cef32b3140 100644
+index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f131184fe4 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
 @@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
diff --git a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
index 0e42864dadba..b3f66ac22552 100644
--- a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
+++ b/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
@@ -1,4 +1,4 @@
-From 4be181e96199529a36e9a93c837af7173c827493 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:58:00 +0200
 Subject: [PATCH] nixpkgs: use system Go
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index c68eb4bf3e..addee4f6af 100644
+index c68eb4bf3ed2d39d46d38d7bd0eeab2c74a507fa..addee4f6af74ea78ae778b73384e01db83ac6694 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -20,7 +20,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
diff --git a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
index 8b1a0b016259..b8be06be0730 100644
--- a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
+++ b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
@@ -1,4 +1,4 @@
-From 3ecb08a7603a07310d1a38c0f47bc54bbe1f11c8 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:59:22 +0200
 Subject: [PATCH] nixpkgs: use system C/C++ toolchains
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index addee4f6af..dc1967e43b 100644
+index addee4f6af74ea78ae778b73384e01db83ac6694..dc1967e43b2b71358d2767a3d83b52819987290d 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -26,7 +26,11 @@ JQ_VERSION = "1.7"
diff --git a/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
new file mode 100644
index 000000000000..4c31f1e8a90c
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <katexochen0@gmail.com>
+Date: Thu, 2 Jan 2025 09:32:41 +0100
+Subject: [PATCH] nixpkgs: patch boringssl for gcc14
+
+Signed-off-by: Paul Meyer <katexochen0@gmail.com>
+---
+ bazel/boringssl-gcc14.patch | 25 +++++++++++++++++++++++++
+ bazel/repositories.bzl      |  1 +
+ 2 files changed, 26 insertions(+)
+ create mode 100644 bazel/boringssl-gcc14.patch
+
+diff --git a/bazel/boringssl-gcc14.patch b/bazel/boringssl-gcc14.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..8dcad4cc11f691eec93efa29075c1d356732e58b
+--- /dev/null
++++ b/bazel/boringssl-gcc14.patch
+@@ -0,0 +1,25 @@
++diff --git a/crypto/internal.h b/crypto/internal.h
++index a77102d..a45f97b 100644
++--- a/crypto/internal.h
+++++ b/crypto/internal.h
++@@ -1174,6 +1174,11 @@
++ 
++ // Arithmetic functions.
++ 
+++// The most efficient versions of these functions on GCC and Clang depend on C11
+++// |_Generic|. If we ever need to call these from C++, we'll need to add a
+++// variant that uses C++ overloads instead.
+++#if !defined(__cplusplus)
+++
++ // CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
++ // bit. |carry| must be zero or one.
++ #if OPENSSL_HAS_BUILTIN(__builtin_addc)
++@@ -1275,6 +1280,8 @@
++ #define CRYPTO_subc_w CRYPTO_subc_u32
++ #endif
++ 
+++#endif  // !__cplusplus
+++
++ 
++ // FIPS functions.
++ 
+diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
+index 5cb573770f0aeac7b42d803673c8c520b5e35131..e864ef24db4bf837ef50d90c8eca316eba939d74 100644
+--- a/bazel/repositories.bzl
++++ b/bazel/repositories.bzl
+@@ -264,6 +264,7 @@ def _boringssl():
+         patch_args = ["-p1"],
+         patches = [
+             "@envoy//bazel:boringssl_static.patch",
++            "@envoy//bazel:boringssl-gcc14.patch",
+         ],
+     )
+ 
diff --git a/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch b/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
new file mode 100644
index 000000000000..5537128a4582
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
@@ -0,0 +1,128 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "dependency-envoy[bot]"
+ <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Date: Fri, 8 Nov 2024 21:09:22 +0000
+Subject: [PATCH] deps: Bump `rules_rust` -> 0.54.1 (#37056)
+
+Fix #37054
+
+Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Signed-off-by: Ryan Northey <ryan@synca.io>
+---
+ bazel/repository_locations.bzl                | 10 ++++++---
+ .../dynamic_modules/sdk/rust/Cargo.Bazel.lock | 21 +++++++++++--------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
+index 85a125d44ece6c655f94aab3d986d96ab837897f..cfe7d145b59b691f6455b58b1baaae48276b7e9f 100644
+--- a/bazel/repository_locations.bzl
++++ b/bazel/repository_locations.bzl
+@@ -1465,12 +1465,16 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         license = "Emscripten SDK",
+         license_url = "https://github.com/emscripten-core/emsdk/blob/{version}/LICENSE",
+     ),
++    # After updating you may need to run:
++    #
++    #     CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
++    #
+     rules_rust = dict(
+         project_name = "Bazel rust rules",
+         project_desc = "Bazel rust rules (used by Wasm)",
+         project_url = "https://github.com/bazelbuild/rules_rust",
+-        version = "0.51.0",
+-        sha256 = "042acfb73469b2d1848fe148d81c3422c61ea47a9e1900f1c9ec36f51e8e7193",
++        version = "0.54.1",
++        sha256 = "af4f56caae50a99a68bfce39b141b509dd68548c8204b98ab7a1cafc94d5bb02",
+         # Note: rules_rust should point to the releases, not archive to avoid the hassle of bootstrapping in crate_universe.
+         # This is described in https://bazelbuild.github.io/rules_rust/crate_universe.html#setup, otherwise bootstrap
+         # is required which in turn requires a system CC toolchains, not the bazel controlled ones.
+@@ -1482,7 +1486,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         ],
+         implied_untracked_deps = ["rules_cc"],
+         extensions = ["envoy.wasm.runtime.wasmtime"],
+-        release_date = "2024-09-19",
++        release_date = "2024-11-07",
+         cpe = "N/A",
+         license = "Apache-2.0",
+         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",
+diff --git a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+index fa6012f406464428b37d548eecd6cec3fdaf901b..6af752304b65af39aa621fa201a8c0108931dad0 100644
+--- a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
++++ b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+@@ -1,5 +1,5 @@
+ {
+-  "checksum": "96b309ddded40cf6f46a62829d15a02d7253b4cc94af2ac1890e492f9c07e93f",
++  "checksum": "b550022ca979d6b55c6dbee950bbf18368e4b8da16973c4e88e292b4d6f28e81",
+   "crates": {
+     "aho-corasick 1.1.3": {
+       "name": "aho-corasick",
+@@ -2149,9 +2149,6 @@
+     "aarch64-apple-ios-sim": [
+       "aarch64-apple-ios-sim"
+     ],
+-    "aarch64-fuchsia": [
+-      "aarch64-fuchsia"
+-    ],
+     "aarch64-linux-android": [
+       "aarch64-linux-android"
+     ],
+@@ -2159,6 +2156,9 @@
+     "aarch64-pc-windows-msvc": [
+       "aarch64-pc-windows-msvc"
+     ],
++    "aarch64-unknown-fuchsia": [
++      "aarch64-unknown-fuchsia"
++    ],
+     "aarch64-unknown-linux-gnu": [
+       "aarch64-unknown-linux-gnu"
+     ],
+@@ -2197,8 +2197,8 @@
+       "aarch64-apple-darwin",
+       "aarch64-apple-ios",
+       "aarch64-apple-ios-sim",
+-      "aarch64-fuchsia",
+       "aarch64-linux-android",
++      "aarch64-unknown-fuchsia",
+       "aarch64-unknown-linux-gnu",
+       "aarch64-unknown-nixos-gnu",
+       "aarch64-unknown-nto-qnx710",
+@@ -2213,9 +2213,9 @@
+       "s390x-unknown-linux-gnu",
+       "x86_64-apple-darwin",
+       "x86_64-apple-ios",
+-      "x86_64-fuchsia",
+       "x86_64-linux-android",
+       "x86_64-unknown-freebsd",
++      "x86_64-unknown-fuchsia",
+       "x86_64-unknown-linux-gnu",
+       "x86_64-unknown-nixos-gnu"
+     ],
+@@ -2264,15 +2264,15 @@
+     "wasm32-wasi": [
+       "wasm32-wasi"
+     ],
++    "wasm32-wasip1": [
++      "wasm32-wasip1"
++    ],
+     "x86_64-apple-darwin": [
+       "x86_64-apple-darwin"
+     ],
+     "x86_64-apple-ios": [
+       "x86_64-apple-ios"
+     ],
+-    "x86_64-fuchsia": [
+-      "x86_64-fuchsia"
+-    ],
+     "x86_64-linux-android": [
+       "x86_64-linux-android"
+     ],
+@@ -2283,6 +2283,9 @@
+     "x86_64-unknown-freebsd": [
+       "x86_64-unknown-freebsd"
+     ],
++    "x86_64-unknown-fuchsia": [
++      "x86_64-unknown-fuchsia"
++    ],
+     "x86_64-unknown-linux-gnu": [
+       "x86_64-unknown-linux-gnu"
+     ],
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index c2e5025e298b..5cb9e454ab08 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -4,6 +4,7 @@
   bazel-gazelle,
   buildBazelPackage,
   fetchFromGitHub,
+  applyPatches,
   stdenv,
   cacert,
   cargo,
@@ -31,30 +32,52 @@ let
     # people should update both.
     version = "1.32.0";
     rev = "86dc7ef91ca15fb4957a74bd599397413fc26a24";
-    hash = "sha256-Wcbt62RfaNcTntmPjaAM0cP3LJangm4ht7Q0bzEpu5A=";
+    hash = "sha256-Sb87yQXtNbKrqPVujPbfOE+Y8ARmW+HyqMmLLa5tPmA=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-LkDNPFT7UUCsGPG1dMnwzdIw0lzc5+3JYDoblF5oZVk=";
+      x86_64-linux = "sha256-KQ0ZxLC/ZLLcypmb1UlVXvLWErLmxuednjKRFaBgKuQ=";
       aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
   bazel = bazel_6;
-  src = fetchFromGitHub {
-    owner = "envoyproxy";
-    repo = "envoy";
-    inherit (srcVer) hash rev;
 
-    postFetch = ''
-      chmod -R +w $out
-      rm $out/.bazelversion
-      echo ${srcVer.rev} > $out/SOURCE_VERSION
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "envoyproxy";
+      repo = "envoy";
+      inherit (srcVer) hash rev;
+    };
+    patches = [
+      # use system Python, not bazel-fetched binary Python
+      ./0001-nixpkgs-use-system-Python.patch
+
+      # use system Go, not bazel-fetched binary Go
+      ./0002-nixpkgs-use-system-Go.patch
+
+      # use system C/C++ tools
+      ./0003-nixpkgs-use-system-C-C-toolchains.patch
+
+      # patch boringssl to work with GCC 14
+      # vendored patch from https://boringssl.googlesource.com/boringssl/+/c70190368c7040c37c1d655f0690bcde2b109a0d
+      ./0004-nixpkgs-patch-boringssl-for-gcc14.patch
+
+      # update rust rules to work with rustc v1.83
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/019f589da2cc8da7673edd077478a100b4d99436
+      # drop with v1.33.x
+      ./0005-deps-Bump-rules_rust-0.54.1-37056.patch
+    ];
+    postPatch = ''
+      chmod -R +w .
+      rm ./.bazelversion
+      echo ${srcVer.rev} > ./SOURCE_VERSION
     '';
   };
 
@@ -80,17 +103,6 @@ buildBazelPackage rec {
     mv bazel/nix/rules_rust.patch bazel/rules_rust.patch
   '';
 
-  patches = [
-    # use system Python, not bazel-fetched binary Python
-    ./0001-nixpkgs-use-system-Python.patch
-
-    # use system Go, not bazel-fetched binary Go
-    ./0002-nixpkgs-use-system-Go.patch
-
-    # use system C/C++ tools
-    ./0003-nixpkgs-use-system-C-C-toolchains.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     python3

From c518e58752d508ca28bc660cba85bc720f1d2cdf Mon Sep 17 00:00:00 2001
From: Yechiel Worenklein <41305372+yechielw@users.noreply.github.com>
Date: Mon, 6 Jan 2025 13:17:58 +0200
Subject: [PATCH 09/35] maintainers: add yechielw

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index edb71c74ff8d..e10c365091b8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25019,6 +25019,12 @@
     githubId = 58453832;
     keys = [ { fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4"; } ];
   };
+  yechielw = {
+    name = "yechielw";
+    email = "yechielworen@gmail.com";
+    github = "yechielw";
+    githubId = 41305372;
+  };
   yelite = {
     name = "Lite Ye";
     email = "yelite958@gmail.com";

From fff647bfd5b61fb6e59afce7c85eba1acbb60711 Mon Sep 17 00:00:00 2001
From: Yechiel Worenklein <41305372+yechielw@users.noreply.github.com>
Date: Mon, 6 Jan 2025 13:23:10 +0200
Subject: [PATCH 10/35] smap: init at 0.1.12 Smap is a drop-in replacement for
 Nmap powered by shodan.io written in go

---
 pkgs/by-name/sm/smap/package.nix | 38 ++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 pkgs/by-name/sm/smap/package.nix

diff --git a/pkgs/by-name/sm/smap/package.nix b/pkgs/by-name/sm/smap/package.nix
new file mode 100644
index 000000000000..bad8a00ece3a
--- /dev/null
+++ b/pkgs/by-name/sm/smap/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+}:
+
+buildGoModule rec {
+  pname = "smap";
+  version = "0.1.12";
+
+  src = fetchFromGitHub {
+    owner = "s0md3v";
+    repo = "Smap";
+    tag = version;
+    hash = "sha256-GLw0zgjWnEwtwRV4vTHqGUS6TqcFhhZ1zeThKe6S0CY=";
+  };
+
+  vendorHash = "sha256-19plbD+ibjoqAA6gGhCvpO52z/VejJkRRh8ljBHN+qY=";
+
+  subPackages = [ "cmd/smap" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Drop-in replacement for Nmap powered by shodan.io";
+    homepage = "https://github.com/s0md3v/Smap";
+    changelog = "https://github.com/s0md3v/Smap/releases/tag/${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yechielw ];
+    mainProgram = "smap";
+  };
+}

From 55ec1eee1ec65b44a2176b5b42cea4df0f1cdaec Mon Sep 17 00:00:00 2001
From: Soham S Gumaste <sgumas2@uic.edu>
Date: Thu, 2 Jan 2025 16:10:57 -0600
Subject: [PATCH 11/35] libmsquic: init at 2.4.7

---
 pkgs/by-name/li/libmsquic/package.nix | 54 +++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 pkgs/by-name/li/libmsquic/package.nix

diff --git a/pkgs/by-name/li/libmsquic/package.nix b/pkgs/by-name/li/libmsquic/package.nix
new file mode 100644
index 000000000000..965df2d62ad0
--- /dev/null
+++ b/pkgs/by-name/li/libmsquic/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  lttng-tools,
+  libatomic_ops,
+  perl,
+  coreutils,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmsquic";
+  version = "2.4.7";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "msquic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WveyZ9rMevLTc5C4cgMFcnj0O6Hd+HcfU8ccD6VBgyU=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+
+  buildInputs = [
+    lttng-tools
+    libatomic_ops
+  ];
+
+  postUnpack = ''
+    for f in "$(find . -type f -name "*.pl")"; do
+      patchShebangs --build $f 2>&1 > /dev/null
+    done
+
+    for g in $(find . -type f -name "*" ); do
+      if test -f $g; then
+        sed -i "s|/usr/bin/env|${coreutils}/bin/env|g" $g
+      fi
+    done
+  '';
+
+  meta = {
+    description = "Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust";
+    homepage = "https://github.com/microsoft/msquic";
+    changelog = "https://github.com/microsoft/msquic/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ SohamG ];
+  };
+})

From 257a4c5bb99741e112503f7853656c005798faa0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 06:59:36 +0000
Subject: [PATCH 12/35] emacsPackages.el-easydraw: 1.2.0-unstable-2024-12-18 ->
 1.2.0-unstable-2025-01-06

---
 .../elisp-packages/manual-packages/el-easydraw/package.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
index e29f2a1fb93e..f9a586b23b8d 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "edraw";
-  version = "1.2.0-unstable-2024-12-18";
+  version = "1.2.0-unstable-2025-01-06";
 
   src = fetchFromGitHub {
     owner = "misohena";
     repo = "el-easydraw";
-    rev = "1c46469d0ea3642958eaf7cea1016fcf05b4daec";
-    hash = "sha256-Z7LPC112FXHtDop1HXPnR6S+cSqfEW1HuYS8YD/qM+c=";
+    rev = "9a5b5e2b071be99350bfc8db6fbc2c9c667f3725";
+    hash = "sha256-lQYSUQFAv6rqvZySsFbe8B7ZqEaa2L+L3HXB231D4OQ=";
   };
 
   propagatedUserEnvPkgs = [ gzip ];

From 887a042c90274ab84726e7d1f7c862fb4b1874e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 08:58:41 +0000
Subject: [PATCH 13/35] lunar-client: 3.3.1 -> 3.3.2

---
 pkgs/by-name/lu/lunar-client/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 4aff832dda89..8f286b23454b 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-tRLT/jR6e9fwmQWAZ1OwjAOMiLy7us9WjiGpS8NBOzHO7jJ4TofSRvvSwpohr9YsnLiLnqANdlWtuabRpQhLLw==";
+    hash = "sha512-Gpm17h5U9Cw9r5EHE1wF5e0aza9yaGPUf+rhMVAhXjrVYBqiUsc/UG11TXWqarKlLpRmPDe+BvCF0qqTtTEZhw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 20436cd3892b3c82c6fdc02e86502d938df9ac88 Mon Sep 17 00:00:00 2001
From: Malte Poll <1780588+malt3@users.noreply.github.com>
Date: Mon, 6 Jan 2025 23:21:34 +0100
Subject: [PATCH 14/35] envoy: disable "-Werror" in protobuf

---
 pkgs/by-name/en/envoy/0006-gcc-warnings.patch | 127 ++++++++++++++++++
 .../envoy/0007-protobuf-remove-Werror.patch   |  19 +++
 pkgs/by-name/en/envoy/package.nix             |  18 ++-
 3 files changed, 162 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/en/envoy/0006-gcc-warnings.patch
 create mode 100644 pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch

diff --git a/pkgs/by-name/en/envoy/0006-gcc-warnings.patch b/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
new file mode 100644
index 000000000000..a0c7dd94a263
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
@@ -0,0 +1,127 @@
+From 448e4e14f4f188687580362a861ae4a0dbb5b1fb Mon Sep 17 00:00:00 2001
+From: "Krinkin, Mike" <krinkin.m.u@gmail.com>
+Date: Sat, 16 Nov 2024 00:40:40 +0000
+Subject: [PATCH] [contrib] Disable GCC warnings and broken features (#37131)
+
+Currently contrib does not build with GCC because of various false
+positive compiler warnings turned to errors and a GCC compiler bug.
+
+Let's first start with the bug, in GCC apparently
+using -gsplit-dwarf (debug fission) and -fdebug-types-section (used to
+optimize the size of debug inforamtion), when used together, can result
+in a linker failure.
+
+Refer to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885 for the GCC
+bug report of this issue. When it comes to Envoy, optimized builds with
+GCC are affected on at least GCC 11 (used by --config=docker-gcc) and
+GCC 12 (and I'm pretty sure the bug isn't fixed in any newer versions
+either, though I didn't check each version).
+
+Given that we cannot have both debug fission and a debug types section,
+we decided to abandon the debug types sections and keep the fission.
+
+That being said, apparently both of those options are unmaintained in
+GCC which poses a question of long term viability of using those or GCC.
+
+Other changes in this commit disable GCC compiler errors for various
+warnings that happen when building contrib. I checked those warnings and
+didn't find any true
+positive.
+
+And additionally, for warnings that exists in both Clang and GCC, Clang
+warnings don't trigger, so Clang also disagrees with GCC here.
+
+Additionally missing-requires warning is new and does not exist in GCC
+11, but exists in later versions of GCC, so to avoid breaking on this
+warning for future versions of GCC I disabled it, but also tell GCC to
+not complain if it sees a flag related to an unknwon diagnostic.
+
+This is the last change required to make GCC contrib builds work (you
+can find more context and discussions in
+https://github.com/envoyproxy/envoy/issues/31807)
+
+Risk Level: Low
+Testing: building with --config=gcc and --config=docker-gcc
+Docs Changes: N/A
+Release Notes: N/A
+Platform Specific Features: N/A
+Fixes #31807
+
+Signed-off-by: Mikhail Krinkin <krinkin.m.u@gmail.com>
+---
+ .bazelrc                 | 18 +++++++++++++++++-
+ bazel/envoy_internal.bzl | 16 +++++++++++++++-
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/.bazelrc b/.bazelrc
+index e0e4899cecf1..7df94c77944c 100644
+--- a/.bazelrc
++++ b/.bazelrc
+@@ -57,9 +57,9 @@ test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
+ # Allow tags to influence execution requirements
+ common --experimental_allow_tags_propagation
+ 
++build:linux --copt=-fdebug-types-section
+ # Enable position independent code (this is the default on macOS and Windows)
+ # (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
+-build:linux --copt=-fdebug-types-section
+ build:linux --copt=-fPIC
+ build:linux --copt=-Wno-deprecated-declarations
+ build:linux --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
+@@ -95,6 +95,21 @@ build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
+ build:gcc --test_env=HEAPCHECK=
+ build:gcc --action_env=BAZEL_COMPILER=gcc
+ build:gcc --action_env=CC=gcc --action_env=CXX=g++
++# This is to work around a bug in GCC that makes debug-types-section
++# option not play well with fission:
++# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885
++build:gcc --copt=-fno-debug-types-section
++# These trigger errors in multiple places both in Envoy dependecies
++# and in Envoy code itself when using GCC.
++# And in all cases the reports appear to be clear false positives.
++build:gcc --copt=-Wno-error=restrict
++build:gcc --copt=-Wno-error=uninitialized
++build:gcc --cxxopt=-Wno-missing-requires
++# We need this because -Wno-missing-requires options is rather new
++# in GCC, so flags -Wno-missing-requires exists in GCC 12, but does
++# not in GCC 11 and GCC 11 is what is used in docker-gcc
++# configuration currently
++build:gcc --cxxopt=-Wno-unknown-warning
+ 
+ # Clang-tidy
+ # TODO(phlax): enable this, its throwing some errors as well as finding more issues
+@@ -375,6 +390,7 @@ build:docker-clang-libc++ --config=docker-sandbox
+ build:docker-clang-libc++ --config=rbe-toolchain-clang-libc++
+ 
+ build:docker-gcc --config=docker-sandbox
++build:docker-gcc --config=gcc
+ build:docker-gcc --config=rbe-toolchain-gcc
+ 
+ build:docker-asan --config=docker-sandbox
+diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
+index 015659851c1b..27ecaa0bbf47 100644
+--- a/bazel/envoy_internal.bzl
++++ b/bazel/envoy_internal.bzl
+@@ -68,7 +68,21 @@ def envoy_copts(repository, test = False):
+                    "-Wc++2a-extensions",
+                    "-Wrange-loop-analysis",
+                ],
+-               repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
++               repository + "//bazel:gcc_build": [
++                   "-Wno-maybe-uninitialized",
++                   # GCC implementation of this warning is too noisy.
++                   #
++                   # It generates warnings even in cases where there is no ambiguity
++                   # between the overloaded version of a method and the hidden version
++                   # from the base class. E.g., when the two have different number of
++                   # arguments or incompatible types and therefore a wrong function
++                   # cannot be called by mistake without triggering a compiler error.
++                   #
++                   # As a safeguard, this warning is only disabled for GCC builds, so
++                   # if Clang catches a problem in the code we would get a warning
++                   # anyways.
++                   "-Wno-error=overloaded-virtual",
++               ],
+                # Allow 'nodiscard' function results values to be discarded for test code only
+                # TODO(envoyproxy/windows-dev): Replace /Zc:preprocessor with /experimental:preprocessor
+                # for msvc versions between 15.8 through 16.4.x. see
diff --git a/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch b/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
new file mode 100644
index 000000000000..196a499ec651
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
@@ -0,0 +1,19 @@
+diff -Naur a/bazel/protobuf.patch b/bazel/protobuf.patch
+--- a/bazel/protobuf.patch	2025-01-06 23:00:26.683972526 +0100
++++ b/bazel/protobuf.patch	2025-01-07 00:53:33.997482569 +0100
+@@ -149,3 +149,15 @@
+  #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
+  #define PROTOBUF_DEBUG true
+  #else
++diff -Naur a/build_defs/cpp_opts.bzl b/build_defs/cpp_opts.bzl
++--- a/build_defs/cpp_opts.bzl	2025-01-06 23:02:56.356552216 +0100
+++++ b/build_defs/cpp_opts.bzl	2025-01-07 00:23:30.534047300 +0100
++@@ -22,7 +22,7 @@
++         "-Woverloaded-virtual",
++         "-Wno-sign-compare",
++         "-Wno-nonnull",
++-        "-Werror",
+++        "-Wno-maybe-uninitialized",
++     ],
++ })
++ 
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 5cb9e454ab08..8ecf5f3865ce 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -38,8 +38,8 @@ let
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-KQ0ZxLC/ZLLcypmb1UlVXvLWErLmxuednjKRFaBgKuQ=";
-      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
+      x86_64-linux = "sha256-qny2l+gIoWCVRZIodd/Tzuj88f/+ajNXeZo/b9XEfVE=";
+      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV31N=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -73,6 +73,18 @@ buildBazelPackage rec {
       # cherry-pick of https://github.com/envoyproxy/envoy/commit/019f589da2cc8da7673edd077478a100b4d99436
       # drop with v1.33.x
       ./0005-deps-Bump-rules_rust-0.54.1-37056.patch
+
+      # patch gcc flags to work with GCC 14
+      # (silences erroneus -Werror=maybe-uninitialized and others)
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/448e4e14f4f188687580362a861ae4a0dbb5b1fb
+      # drop with v1.33.x
+      ./0006-gcc-warnings.patch
+
+      # Remove "-Werror" from protobuf build
+      # This is fixed in protobuf v28 and later:
+      # https://github.com/protocolbuffers/protobuf/commit/f5a1b178ad52c3e64da40caceaa4ca9e51045cb4
+      # drop with v1.33.x
+      ./0007-protobuf-remove-Werror.patch
     ];
     postPatch = ''
       chmod -R +w .
@@ -206,6 +218,8 @@ buildBazelPackage rec {
       "--noexperimental_strict_action_env"
       "--cxxopt=-Wno-error"
       "--linkopt=-Wl,-z,noexecstack"
+      "--config=gcc"
+      "--verbose_failures"
 
       # Force use of system Java.
       "--extra_toolchains=@local_jdk//:all"

From 2be6e953057bc97b79a049d9a856b05ae2e923c1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 12:46:20 +0100
Subject: [PATCH 15/35] python312Packages.frelatage: refactor

---
 pkgs/development/python-modules/frelatage/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/frelatage/default.nix b/pkgs/development/python-modules/frelatage/default.nix
index 3f8d64f9e464..f3acdf33516b 100644
--- a/pkgs/development/python-modules/frelatage/default.nix
+++ b/pkgs/development/python-modules/frelatage/default.nix
@@ -23,9 +23,9 @@ buildPythonPackage rec {
     hash = "sha256-eHVqp6govBV9FvSQyaZuEEImHQRs/mbLaW86RCvtDbM=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     timeout-decorator
   ];

From 1f8cedfb8d9615076456d464358183cb81f2e5df Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 12:48:22 +0100
Subject: [PATCH 16/35] python313Packages.frelatage: relax numpy

---
 pkgs/development/python-modules/frelatage/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/frelatage/default.nix b/pkgs/development/python-modules/frelatage/default.nix
index f3acdf33516b..be04e82e7aa6 100644
--- a/pkgs/development/python-modules/frelatage/default.nix
+++ b/pkgs/development/python-modules/frelatage/default.nix
@@ -23,6 +23,8 @@ buildPythonPackage rec {
     hash = "sha256-eHVqp6govBV9FvSQyaZuEEImHQRs/mbLaW86RCvtDbM=";
   };
 
+  pythonRelaxDeps = [ "numpy" ];
+
   build-system = [ poetry-core ];
 
   dependencies = [

From fc6755e85ef5c2c81fed3e5911d6cb57d3c5e5db Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 14:15:09 +0100
Subject: [PATCH 17/35] python312Packages.glom: refactor

- disable failing tests
- remove postPatch section
---
 .../python-modules/glom/default.nix           | 44 +++++++++++--------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/python-modules/glom/default.nix b/pkgs/development/python-modules/glom/default.nix
index 04a8a1649f89..acd0da2f0b59 100644
--- a/pkgs/development/python-modules/glom/default.nix
+++ b/pkgs/development/python-modules/glom/default.nix
@@ -9,12 +9,14 @@
   pythonAtLeast,
   pythonOlder,
   pyyaml,
+  setuptools,
+  tomli,
 }:
 
 buildPythonPackage rec {
   pname = "glom";
   version = "24.11.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,42 +25,45 @@ buildPythonPackage rec {
     hash = "sha256-QyX5Z1mpEgRK97bGvQ26RK2MHrYDiqsFcylmHSAhuyc=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "face==20.1.1" "face"
-  '';
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     boltons
     attrs
     face
   ];
 
+  optional-dependencies = {
+    toml = lib.optionals (pythonOlder "3.11") [ tomli ];
+    yaml = [ pyyaml ];
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
-    pyyaml
-  ];
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck = ''
     # test_cli.py checks the output of running "glom"
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTests =
-    [
-      # Test is outdated (was made for PyYAML 3.x)
-      "test_main_yaml_target"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.11") [
-      "test_regular_error_stack"
-      "test_long_target_repr"
-    ];
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    "test_regular_error_stack"
+    "test_long_target_repr"
+    "test_glom_error_stack"
+    "test_glom_error_double_stack"
+    "test_branching_stack"
+    "test_midway_branch"
+    "test_partially_failing_branch"
+    "test_coalesce_stack"
+    "test_nesting_stack"
+    "test_3_11_byte_code_caret"
+  ];
 
   pythonImportsCheck = [ "glom" ];
 
   meta = with lib; {
-    description = "Restructuring data, the Python way";
-    mainProgram = "glom";
+    description = "Module for restructuring data";
     longDescription = ''
       glom helps pull together objects from other objects in a
       declarative, dynamic, and downright simple way.
@@ -67,5 +72,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/mahmoud/glom/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ twey ];
+    mainProgram = "glom";
   };
 }

From eafe458896d2b39f3b14587d46d22897c12f85c6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 14:31:00 +0100
Subject: [PATCH 18/35] python313Packages.face: switch to PEP517

---
 pkgs/development/python-modules/face/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/face/default.nix b/pkgs/development/python-modules/face/default.nix
index 731479b3bf4b..f3889cc5faa9 100644
--- a/pkgs/development/python-modules/face/default.nix
+++ b/pkgs/development/python-modules/face/default.nix
@@ -5,12 +5,13 @@
   boltons,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "face";
   version = "22.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,7 +20,9 @@ buildPythonPackage rec {
     hash = "sha256-1daS+QvI9Zh7Y25H42OEubvaSZqvCneqCwu+g0x2kj0=";
   };
 
-  propagatedBuildInputs = [ boltons ];
+  build-system = [ setuptools ];
+
+  dependencies = [ boltons ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From e289667cfe6b273a9381911316767f39f3ae8691 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 13:38:51 +0000
Subject: [PATCH 19/35] cnquery: 11.35.0 -> 11.36.0

---
 pkgs/by-name/cn/cnquery/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index c4e672e62b7b..869ce53a5255 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.35.0";
+  version = "11.36.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-WBzl3DyjPr5vV9oobqZx1pprs4gkVN9BafOMIMqqb7E=";
+    hash = "sha256-LISy9xMAv9Wal+iRF9qoCLrQnq0r4HOqCir/w0uTrAA=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-rgjYpiTWp9KqC7gX05Fx5h2hKT1ah2GQorPzPhJpQH0=";
+  vendorHash = "sha256-JweIdmjnybaOyL5GOxCmP8TpyMYTG9qD5aFbabAJ4h8=";
 
   ldflags = [
     "-w"

From 68eab267d2e9f0291e06f1f34db8e11abacf49f7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 7 Jan 2025 13:10:57 +0100
Subject: [PATCH 20/35] ucspi-tcp: use debian's 0.88-11 patch set

Use Debian's most current patches to allow building ucspi-tcp again.
---
 pkgs/by-name/uc/ucspi-tcp/package.nix | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/uc/ucspi-tcp/package.nix b/pkgs/by-name/uc/ucspi-tcp/package.nix
index 40a5533d332f..971f85f8eff0 100644
--- a/pkgs/by-name/uc/ucspi-tcp/package.nix
+++ b/pkgs/by-name/uc/ucspi-tcp/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
+  quilt,
 }:
 
 stdenv.mkDerivation rec {
@@ -13,21 +15,22 @@ stdenv.mkDerivation rec {
     sha256 = "171yl9kfm8w7l17dfxild99mbf877a9k5zg8yysgb1j8nz51a1ja";
   };
 
-  # Plain upstream tarball doesn't build, get patches from Debian
   patches = [
-    (fetchurl {
-      url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-3.diff.gz";
-      sha256 = "0mzmhz8hjkrs0khmkzs5i0s1kgmgaqz07h493bd5jj5fm5njxln6";
-    })
     ./remove-setuid.patch
   ];
 
-  # Apply Debian patches
+  debian = fetchzip {
+    url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-11.debian.tar.xz";
+    sha256 = "0x8h46wkm62dvyj1acsffcl4s06k5zh6139qxib3zzhk716hv5xg";
+  };
+
+  nativeBuildInputs = [
+    quilt
+  ];
+
+  # Plain upstream tarball doesn't build, apply patches from Debian
   postPatch = ''
-    for fname in debian/diff/*.diff; do
-        echo "Applying patch $fname"
-        patch < "$fname"
-    done
+    QUILT_PATCHES=$debian/patches quilt push -a
   '';
 
   # The build system is weird; 'make install' doesn't install anything, instead
@@ -40,7 +43,7 @@ stdenv.mkDerivation rec {
   preBuild = ''
     echo "$out" > conf-home
 
-    echo "main() { return 0; }" > chkshsgr.c
+    echo "int main() { return 0; }" > chkshsgr.c
   '';
 
   installPhase = ''
@@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
     ./install
 
     # Install Debian man pages (upstream has none)
-    cp debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
+    cp $debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
   '';
 
   meta = with lib; {

From 2cecb7931519c09eb4051c93b7c1ef904f152839 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 7 Jan 2025 12:38:16 +0100
Subject: [PATCH 21/35] envoy: 1.32.0 -> 1.32.3

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/en/envoy/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 8ecf5f3865ce..823e2c180b41 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -30,16 +30,16 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.32.0";
-    rev = "86dc7ef91ca15fb4957a74bd599397413fc26a24";
-    hash = "sha256-Sb87yQXtNbKrqPVujPbfOE+Y8ARmW+HyqMmLLa5tPmA=";
+    version = "1.32.3";
+    rev = "58bd599ebd5918d4d005de60954fcd2cb00abd95";
+    hash = "sha256-5HpxcsAPoyVOJ3Aem+ZjSLa8Zu6s76iCMiWJbp8RjHc=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-qny2l+gIoWCVRZIodd/Tzuj88f/+ajNXeZo/b9XEfVE=";
-      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV31N=";
+      x86_64-linux = "sha256-YFXNatolLM9DdwkMnc9SWsa6Z6/aGzqLmo/zKE7OFy0=";
+      aarch64-linux = "sha256-AjG1OBjPjiSwWCmIJgHevSQHx8+rzRgmLsw3JwwD0hk=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 

From 3f4fd5664aeba5c58fc346c9634ae3dae826cea8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 7 Jan 2025 17:38:08 +0100
Subject: [PATCH 22/35] jitsi-meet-electron: fix build

---
 pkgs/by-name/ji/jitsi-meet-electron/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index 7229a0fb1515..956e97365bcc 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -91,6 +91,8 @@ buildNpmPackage rec {
         -c.electronVersion=${electron.version}
   '';
 
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   installPhase = ''
     runHook preInstall
 

From 4193ef177a52e30f87ab97273cb7160921d2f5ea Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Tue, 7 Jan 2025 20:17:01 +0200
Subject: [PATCH 23/35] discord: bump all versions (#371793)

---
 .../instant-messengers/discord/default.nix    | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2d0e4413d46a..17825ae97ff2 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,24 +9,24 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.78";
+        stable = "0.0.79";
         ptb = "0.0.124";
-        canary = "0.0.549";
-        development = "0.0.60";
+        canary = "0.0.556";
+        development = "0.0.61";
       }
     else
       {
-        stable = "0.0.330";
-        ptb = "0.0.153";
-        canary = "0.0.661";
-        development = "0.0.68";
+        stable = "0.0.331";
+        ptb = "0.0.154";
+        canary = "0.0.668";
+        development = "0.0.70";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-1G9NM0Z6dN2LtunHkkIzNNA+xFslxhnI8GVrjXlNZK8=";
+        hash = "sha256-gQVx+PueGDofUjKSvyorCu73myNujcKz9gugMKB9koY=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -34,29 +34,29 @@ let
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-hwgvPNoEGjfg6uLlC/k3iYfxfjbja5H2F2aSiEcGZ/o=";
+        hash = "sha256-5qn0YL0+1uE6kmQO3Fh2DD0gNjk6MT+yAdIoMK7Y8Tw=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-SL+lWMSXC1Y11Sk59sE7F8n04DED2365RKKeKFU8R6o=";
+        hash = "sha256-9ssgue3Y8StyKnc1dvr6b0Z3hjPYtJCNuVsruqFx8ug=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-wLDr2jtjPsV3rUsFCNKKHXTwGPdoR/whLmr4w8I7x+U=";
+        hash = "sha256-U37JyZwPmsk6ArD8Lz0xAiy/I78H+wHSig3+1BpD9iA=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-EvIEMyqOotnyqBC8w4XbF+RuP+g2Bjt4hD4aEeEzZGU=";
+        hash = "sha256-BVKhyLoz/EoaZ6LgCaJuZZ37u9ProXOPddrfg171Eu4=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-dCeLnfgvaKngO8r/VIDgQLkMKgV7BDOOKcXUdo91Eeo=";
+        hash = "sha256-1eCHufW68AuYuYWzfq6Tt+YylFgCLT88DrvrNZvQG8A=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-5sUkGN9ucyYArGkfbGBdJokoqpHKBrkwxH055LpMlrs=";
+        hash = "sha256-UdHwa/ALOOt/bNA6UmVJB8GNe+yHJ1xFoyF0nT1Zn3g=";
       };
     };
     aarch64-darwin = x86_64-darwin;

From 9d5dd054329f2cf56b88d242248c66d391a64ab3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 15:36:02 +0100
Subject: [PATCH 24/35] python312Packages.jellyfish: 1.0.4 -> 1.1.2

---
 .../python-modules/jellyfish/Cargo.lock       | 337 ++++++++++++++++++
 .../python-modules/jellyfish/default.nix      |  61 ++--
 2 files changed, 371 insertions(+), 27 deletions(-)
 create mode 100644 pkgs/development/python-modules/jellyfish/Cargo.lock

diff --git a/pkgs/development/python-modules/jellyfish/Cargo.lock b/pkgs/development/python-modules/jellyfish/Cargo.lock
new file mode 100644
index 000000000000..b8e248240923
--- /dev/null
+++ b/pkgs/development/python-modules/jellyfish/Cargo.lock
@@ -0,0 +1,337 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "csv"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+
+[[package]]
+name = "itoa"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+
+[[package]]
+name = "jellyfish"
+version = "1.1.2"
+dependencies = [
+ "ahash",
+ "csv",
+ "num-traits",
+ "pyo3",
+ "smallvec",
+ "unicode-normalization",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.169"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "portable-atomic"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "serde"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "syn"
+version = "2.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tinyvec"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unindent"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/pkgs/development/python-modules/jellyfish/default.nix b/pkgs/development/python-modules/jellyfish/default.nix
index 8517c239de44..ca47c0ca312b 100644
--- a/pkgs/development/python-modules/jellyfish/default.nix
+++ b/pkgs/development/python-modules/jellyfish/default.nix
@@ -1,49 +1,56 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
-  fetchPypi,
-  isPy3k,
-  pytest,
-  unicodecsv,
+  cargo,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  rustc,
   rustPlatform,
-  libiconv,
+  unicodecsv,
 }:
 
 buildPythonPackage rec {
   pname = "jellyfish";
-  version = "1.0.4";
+  version = "1.1.2";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.11";
 
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cqq7O+3VE83SBxIkL9URc7WZcsCxRregucbzLxZWKT8=";
+  src = fetchFromGitHub {
+    owner = "jamesturk";
+    repo = "jellyfish";
+    rev = version;
+    hash = "sha256-xInjoTXYgZuHyvyKm+N4PAwHozE5BOkxoYhRzZnPs3Q=";
   };
 
-  nativeBuildInputs = with rustPlatform; [
-    maturinBuildHook
-    cargoSetupHook
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}-rust-dependencies";
-    hash = "sha256-HtzgxTO6tbN/tohaiTm9B9jrFYGTt1Szo9qRzpcy8BA=";
-  };
-
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
     unicodecsv
   ];
 
+  pythonImportsCheck = [ "jellyfish" ];
+
   meta = {
-    homepage = "https://github.com/sunlightlabs/jellyfish";
-    description = "Approximate and phonetic matching of strings";
+    description = "A python library for doing approximate and phonetic matching of strings";
+    homepage = "https://github.com/jamesturk/jellyfish";
+    changelog = "https://github.com/jamesturk/jellyfish/releases/tag/v${version}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ koral ];
   };
 }

From 7c94ade5df7052bdef805bc30b9d86d420347b05 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 7 Jan 2025 15:37:52 +0100
Subject: [PATCH 25/35] python313Packages.whispers: adjust inputs

---
 pkgs/development/python-modules/whispers/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/whispers/default.nix b/pkgs/development/python-modules/whispers/default.nix
index fba9a13a4551..da58f753f27c 100644
--- a/pkgs/development/python-modules/whispers/default.nix
+++ b/pkgs/development/python-modules/whispers/default.nix
@@ -16,6 +16,7 @@
   wrapt,
   semgrep,
   setuptools,
+  six,
 }:
 
 buildPythonPackage rec {
@@ -38,9 +39,12 @@ buildPythonPackage rec {
   '';
 
   pythonRelaxDeps = [
+    "jellyfish"
     "lxml"
     "pyyaml"
     "semgrep"
+    "six"
+    "wrapt"
   ];
 
   build-system = [ setuptools ];
@@ -54,8 +58,9 @@ buildPythonPackage rec {
     luhn
     lxml
     pyyaml
-    wrapt
     semgrep
+    six
+    wrapt
   ];
 
   nativeCheckInputs = [

From efdf4a86702f6032ed2db2e01db13eeb1372b40a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 18:22:29 +0000
Subject: [PATCH 26/35] nwg-panel: 0.9.58 -> 0.9.59

---
 pkgs/by-name/nw/nwg-panel/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index 699ca788c733..5e64db8b9542 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,13 +23,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.58";
+  version = "0.9.59";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-zYxZk3j8ODrK52aLSI+qA9tmJbH/eFfKYXMyd0V1LzM=";
+    hash = "sha256-ey0Fb9ilm7I2QWG1gQpnHTlMPoQswNlkrZ/WhUaLbDk=";
   };
 
   # No tests

From bf3495ea8a6c6614b27274e0d67d512ef8fc07e7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 3 Jan 2025 22:17:15 +0000
Subject: [PATCH 27/35] curseofwar-sdl: set mainProgram

---
 pkgs/games/curseofwar/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/games/curseofwar/default.nix b/pkgs/games/curseofwar/default.nix
index 0a74065cec93..2bf91002024e 100644
--- a/pkgs/games/curseofwar/default.nix
+++ b/pkgs/games/curseofwar/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast-paced action strategy game";
     homepage = "https://a-nikolaev.github.io/curseofwar/";
     license = licenses.gpl3;
+    mainProgram = if SDL != null then "curseofwar-sdl" else "curseofwar";
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
   };

From 9cae18285d96eb8861d679682936926a2e7d3cf2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 19:22:32 +0000
Subject: [PATCH 28/35] home-assistant-custom-components.xiaomi_miot: 1.0.7 ->
 1.0.8

---
 .../home-assistant/custom-components/xiaomi_miot/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
index 3c5243386135..58a5fae706d7 100644
--- a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-V7GPxyRPeyHXJErW/q9o7a+kbhrE46nDjYiSKvEMKnw=";
+    hash = "sha256-DTIXhs5gPN96C/fWz3s7ZTOybp7Mx+/NbNGXIOGyMmk=";
   };
 
   dependencies = [

From 9ba6ea13c329333a2a145823a5fded6195dbf2cb Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Tue, 7 Jan 2025 20:59:16 +0100
Subject: [PATCH 29/35] minio-warp: 1.0.7 -> 1.0.8

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/mi/minio-warp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/minio-warp/package.nix b/pkgs/by-name/mi/minio-warp/package.nix
index 1f7df3303d83..7d810a5d4544 100644
--- a/pkgs/by-name/mi/minio-warp/package.nix
+++ b/pkgs/by-name/mi/minio-warp/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "minio-warp";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "warp";
     rev = "v${version}";
-    hash = "sha256-TqgF8WkWz+OZGSwrjIMFg4WaSdunOrcjuYDhWuPZTU8=";
+    hash = "sha256-kME4yafNZtHDF/EAIG8qR4PH6HlokIfdBAJH+ibl5ro=";
   };
 
-  vendorHash = "sha256-i0npOEo+rplC+hU4yxGRpY8gX+VGjR7HwKbiv5mQ28M=";
+  vendorHash = "sha256-073ssCOh0CiiJaatwzhNrwpe2QO21iC6GSkwVtsmYjs=";
 
   # See .goreleaser.yml
   ldflags = [

From ba0ca0bc33b25935e718b253fd676d33b1e1f309 Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Tue, 7 Jan 2025 20:59:34 +0100
Subject: [PATCH 30/35] minio-warp: add nix-update-script

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/mi/minio-warp/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/mi/minio-warp/package.nix b/pkgs/by-name/mi/minio-warp/package.nix
index 7d810a5d4544..6b5ad34ee504 100644
--- a/pkgs/by-name/mi/minio-warp/package.nix
+++ b/pkgs/by-name/mi/minio-warp/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   buildGoModule,
   versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule rec {
@@ -37,6 +38,8 @@ buildGoModule rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = [ "--version" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "S3 benchmarking tool";
     homepage = "https://github.com/minio/warp";

From 8766f12b3f0cae24ba5ad2067be02a8e4f88ea0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jan 2025 21:35:25 +0000
Subject: [PATCH 31/35] python312Packages.meilisearch: 0.33.0 -> 0.33.1

---
 pkgs/development/python-modules/meilisearch/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index acd07a2e2795..f4cd85fd778c 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.33.0";
+  version = "0.33.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     tag = "v${version}";
-    hash = "sha256-Eo1KBpSek1FnSp21vpsJEwISvUYEqOaodwrbarVcu7c=";
+    hash = "sha256-8x6Q0nGFz1pJ1jPfbepE7YL6z/HPkeyRYvwS9jJblRI=";
   };
 
   build-system = [ setuptools ];

From b3a9b074bd7d08a69b44bbb7dbcdad84c703bd20 Mon Sep 17 00:00:00 2001
From: Stephen D <webmaster@scd31.com>
Date: Tue, 24 Dec 2024 13:19:39 -0400
Subject: [PATCH 32/35] wsjtz: init at 2.7.0-rc7-1.43

---
 pkgs/by-name/ws/wsjtz/package.nix | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 pkgs/by-name/ws/wsjtz/package.nix

diff --git a/pkgs/by-name/ws/wsjtz/package.nix b/pkgs/by-name/ws/wsjtz/package.nix
new file mode 100644
index 000000000000..a58b8fda01a5
--- /dev/null
+++ b/pkgs/by-name/ws/wsjtz/package.nix
@@ -0,0 +1,31 @@
+{
+  wsjtx,
+  fetchzip,
+  lib,
+}:
+
+wsjtx.overrideAttrs (old: rec {
+  pname = "wsjtz";
+  version = "2.7.0-rc7-1.43";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/wsjt-z/Source/wsjtz-${version}.zip";
+    hash = "sha256-m+P83S5P9v3NPtifc+XjZm/mAOs+NT9fTWXisxuWtZo=";
+  };
+
+  postFixup = ''
+    mv $out/bin/wsjtx $out/bin/wsjtz
+    mv $out/bin/wsjtx_app_version $out/bin/wsjtz_app_version
+  '';
+
+  meta = {
+    description = "WSJT-X fork, primarily focused on automation and enhanced functionality";
+    homepage = "https://sourceforge.net/projects/wsjt-z/";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      scd31
+    ];
+    mainProgram = "wsjtz";
+  };
+})

From 165e372a15c629efd15e4db3b85ca02324b16413 Mon Sep 17 00:00:00 2001
From: Dict Xiong <me@beardic.cn>
Date: Sun, 5 Jan 2025 15:22:33 +0800
Subject: [PATCH 33/35] nixos/doh-server: init

---
 nixos/doc/manual/redirects.json               |   6 +
 .../manual/release-notes/rl-2505.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 .../modules/services/networking/doh-server.md |  69 +++++++
 .../services/networking/doh-server.nix        | 175 ++++++++++++++++++
 5 files changed, 253 insertions(+)
 create mode 100644 nixos/modules/services/networking/doh-server.md
 create mode 100644 nixos/modules/services/networking/doh-server.nix

diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index b404fa35052f..a7ebb49b62b8 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -875,6 +875,12 @@
   "module-services-networking-dnsmasq-references": [
     "index.html#module-services-networking-dnsmasq-references"
   ],
+  "module-service-doh-server": [
+    "index.html#module-service-doh-server"
+  ],
+  "module-service-doh-server-quick-start": [
+    "index.html#module-service-doh-server-quick-start"
+  ],
   "module-services-samba": [
     "index.html#module-services-samba"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 280b3ddb9488..772f7daa8d79 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -53,6 +53,8 @@
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
+- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
+
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index be529602d675..b5b6fd8c0e2f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1055,6 +1055,7 @@
   ./services/networking/dnsmasq.nix
   ./services/networking/dnsproxy.nix
   ./services/networking/doh-proxy-rust.nix
+  ./services/networking/doh-server.nix
   ./services/networking/ejabberd.nix
   ./services/networking/envoy.nix
   ./services/networking/epmd.nix
diff --git a/nixos/modules/services/networking/doh-server.md b/nixos/modules/services/networking/doh-server.md
new file mode 100644
index 000000000000..2ac1630aa29d
--- /dev/null
+++ b/nixos/modules/services/networking/doh-server.md
@@ -0,0 +1,69 @@
+# DNS-over-HTTPS Server {#module-service-doh-server}
+
+[DNS-over-HTTPS](https://github.com/m13253/dns-over-https) is a high performance DNS over HTTPS client & server. This module enables its server part (`doh-server`).
+
+## Quick Start {#module-service-doh-server-quick-start}
+
+Setup with Nginx + ACME (recommended):
+
+```nix
+{
+  services.doh-server = {
+    enable = true;
+    settings = {
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."doh.example.com" = {
+      enableACME = true;
+      forceSSL = true;
+      http2 = true;
+      locations."/".return = 404;
+      locations."/dns-query" = {
+        proxyPass = "http://127.0.0.1:8053/dns-query";
+        recommendedProxySettings = true;
+      };
+    };
+    # and other virtual hosts ...
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "you@example.com";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
+```
+
+`doh-server` can also work as a standalone HTTPS web server (with SSL cert and key specified), but this is not recommended as `doh-server` does not do OCSP Stabbing.
+
+Setup a standalone instance with ACME:
+
+```nix
+let
+  domain = "doh.example.com";
+in
+{
+  security.acme.certs.${domain} = {
+    dnsProvider = "cloudflare";
+    credentialFiles."CF_DNS_API_TOKEN_FILE" = "/run/secrets/cf-api-token";
+  };
+
+  services.doh-server = {
+    enable = true;
+    settings = {
+      listen = [ ":443" ];
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+    useACMEHost = domain;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 443 ];
+}
+```
+
+See a full configuration in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf.
diff --git a/nixos/modules/services/networking/doh-server.nix b/nixos/modules/services/networking/doh-server.nix
new file mode 100644
index 000000000000..baa3e1844946
--- /dev/null
+++ b/nixos/modules/services/networking/doh-server.nix
@@ -0,0 +1,175 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.doh-server;
+  toml = pkgs.formats.toml { };
+in
+{
+  options.services.doh-server = {
+    enable = lib.mkEnableOption "DNS-over-HTTPS server";
+
+    package = lib.mkPackageOption pkgs "dns-over-https" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = toml.type;
+        options = {
+
+          listen = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "127.0.0.1:8053"
+              "[::1]:8053"
+            ];
+            example = [ ":443" ];
+            description = "HTTP listen address and port";
+          };
+
+          path = lib.mkOption {
+            type = lib.types.str;
+            default = "/dns-query";
+            example = "/dns-query";
+            description = "HTTP path for resolve application";
+          };
+
+          upstream = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "udp:1.1.1.1:53"
+              "udp:1.0.0.1:53"
+              "udp:8.8.8.8:53"
+              "udp:8.8.4.4:53"
+            ];
+            example = [ "udp:127.0.0.1:53" ];
+            description = ''
+              Upstream DNS resolver.
+              If multiple servers are specified, a random one will be chosen each time.
+              You can use "udp", "tcp" or "tcp-tls" for the type prefix.
+              For "udp", UDP will first be used, and switch to TCP when the server asks to or the response is too large.
+              For "tcp", only TCP will be used.
+              For "tcp-tls", DNS-over-TLS (RFC 7858) will be used to secure the upstream connection.
+            '';
+          };
+
+          timeout = lib.mkOption {
+            type = lib.types.int;
+            default = 10;
+            example = 15;
+            description = "Upstream timeout";
+          };
+
+          tries = lib.mkOption {
+            type = lib.types.int;
+            default = 3;
+            example = 5;
+            description = "Number of tries if upstream DNS fails";
+          };
+
+          verbose = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = "Enable logging";
+          };
+
+          log_guessed_client_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
+              Note: http uri/useragent log cannot be controlled by this config
+            '';
+          };
+
+          ecs_allow_non_global_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              By default, non global IP addresses are never forwarded to upstream servers.
+              This is to prevent two things from happening:
+                1. the upstream server knowing your private LAN addresses;
+                2. the upstream server unable to provide geographically near results,
+                  or even fail to provide any result.
+              However, if you are deploying a split tunnel corporation network environment, or for any other reason you want to inhibit this behavior and allow local (eg RFC1918) address to be forwarded, change the following option to "true".
+            '';
+          };
+
+          ecs_use_precise_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask. This option is to be used only on private networks where knowledge of the terminal endpoint may be required for security purposes (eg. DNS Firewalling). Not a good option on the internet where IP address may be used to identify the user and not only the approximate location.
+            '';
+          };
+        };
+      };
+      default = { };
+      example = {
+        listen = [ ":8153" ];
+        upstream = [ "udp:127.0.0.1:53" ];
+      };
+      description = "Configuration of doh-server in toml. See example in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf";
+    };
+
+    useACMEHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "doh.example.com";
+      description = ''
+        A host of an existing Let's Encrypt certificate to use.
+        *Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using [](#opt-security.acme.certs).*
+      '';
+    };
+
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/path/to/doh-server.conf";
+      description = ''
+        The config file for the doh-server.
+        Setting this option will override any configuration applied by the `settings` option.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.doh-server.configFile = lib.mkDefault (toml.generate "doh-server.conf" cfg.settings);
+    services.doh-server.settings = lib.mkIf (cfg.useACMEHost != null) (
+      let
+        sslCertDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
+      in
+      {
+        cert = "${sslCertDir}/cert.pem";
+        key = "${sslCertDir}/key.pem";
+      }
+    );
+    systemd.services.doh-server = {
+      description = "DNS-over-HTTPS Server";
+      documentation = [ "https://github.com/m13253/dns-over-https" ];
+      after = [
+        "network.target"
+      ] ++ lib.optional (cfg.useACMEHost != null) "acme-${cfg.useACMEHost}.service";
+      wants = lib.optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        ExecStart = "${cfg.package}/bin/doh-server -conf ${cfg.configFile}";
+        LimitNOFILE = 1048576;
+        Restart = "always";
+        RestartSec = 3;
+        Type = "simple";
+        DynamicUser = true;
+        SupplementaryGroups = lib.optional (cfg.useACMEHost != null) "acme";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ DictXiong ];
+  meta.doc = ./doh-server.md;
+}

From 6741ae9fa743ef33c24143365770f3fb86be16d0 Mon Sep 17 00:00:00 2001
From: ben9986 <38633150+Ben9986@users.noreply.github.com>
Date: Tue, 7 Jan 2025 22:59:55 +0000
Subject: [PATCH 34/35] krohnkite: 0.9.8.4 -> 0.9.8.5

---
 pkgs/kde/third-party/krohnkite/default.nix       | 6 +++---
 pkgs/kde/third-party/krohnkite/package-lock.json | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/kde/third-party/krohnkite/default.nix b/pkgs/kde/third-party/krohnkite/default.nix
index ddf7c3b2f121..75c3b01995a8 100644
--- a/pkgs/kde/third-party/krohnkite/default.nix
+++ b/pkgs/kde/third-party/krohnkite/default.nix
@@ -9,16 +9,16 @@
 }:
 buildNpmPackage rec {
   pname = "krohnkite";
-  version = "0.9.8.4";
+  version = "0.9.8.5";
 
   src = fetchFromGitHub {
     owner = "anametologin";
     repo = "krohnkite";
     tag = version;
-    hash = "sha256-VVHusFuQ/awfFV4izId7VPYCrS8riTavhpB2KpJ9084=";
+    hash = "sha256-DcNU0nx6KHztfMPFs5PZtZIeu4hDxNYIJa5E1fwMa0Q=";
   };
 
-  npmDepsHash = "sha256-k44SltKLR/Y8qWFCLW2jBWElk9JGn+0azQn0G1f0vuY=";
+  npmDepsHash = "sha256-Q/D6s0wOPSEziE1dBXgTakjhXCGvzhvLVS7zXcZlPCI=";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/kde/third-party/krohnkite/package-lock.json b/pkgs/kde/third-party/krohnkite/package-lock.json
index 114667dcd9d1..3360fa3a9c42 100644
--- a/pkgs/kde/third-party/krohnkite/package-lock.json
+++ b/pkgs/kde/third-party/krohnkite/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "krohnkite",
-  "version": "0.9.8.4",
+  "version": "0.9.8.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "krohnkite",
-      "version": "0.9.8.4",
+      "version": "0.9.8.5",
       "license": "MIT",
       "devDependencies": {
         "mocha": "^10.4.0",

From c8c0c9252e6df67c8e2f83565b2d30d24fc14aa3 Mon Sep 17 00:00:00 2001
From: Dionysis Grigoropoulos <dgrig@erethon.com>
Date: Wed, 8 Jan 2025 00:55:26 +0200
Subject: [PATCH 35/35] zizmor: 1.0.0 -> 1.0.1

Changes:
https://github.com/woodruffw/zizmor/releases/tag/v1.0.1

Additionally remove the openssl dependency as it's not needed because
zizmor uses a Rust TLS stack.

Closes #371940
---
 pkgs/by-name/zi/zizmor/package.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index 2237a8a24497..679b060fb7c1 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -3,25 +3,22 @@
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
-  openssl,
   testers,
   zizmor,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zizmor";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = "zizmor";
     tag = "v${version}";
-    hash = "sha256-95YtFlnC8xFBz1v+qC3rh7jEUp+4JBoMGgVQd/6IFwE=";
+    hash = "sha256-1NpwBjJlpaP3iyTfrgMwO/1qR74/MNBYjtf4+wCe4m8=";
   };
 
-  cargoHash = "sha256-imq7ElZcC9E4nDkHaaFiBf8r1VuMtw5zOn9O7EzIPkQ=";
-
-  buildInputs = [ openssl ];
+  cargoHash = "sha256-feAfHkcLvEdFblehPGtLO01Vl9QpOueuJrpEujlv4qY=";
 
   nativeBuildInputs = [ pkg-config ];