From 76f6b5efdf7d75fdc0ad7c82bee58cbad1692e1c Mon Sep 17 00:00:00 2001
From: George Macon <george.macon@gtri.gatech.edu>
Date: Thu, 26 Sep 2024 16:10:03 -0400
Subject: [PATCH 01/33] unrar-free: add setupHook

This adds a setupHook to unrar-free which is parallel to the one in
unrar. This enables the unpackPhase to automatically use unrar-free to
unpack RAR files.
---
 pkgs/by-name/un/unrar-free/package.nix   | 2 ++
 pkgs/by-name/un/unrar-free/setup-hook.sh | 5 +++++
 2 files changed, 7 insertions(+)
 create mode 100644 pkgs/by-name/un/unrar-free/setup-hook.sh

diff --git a/pkgs/by-name/un/unrar-free/package.nix b/pkgs/by-name/un/unrar-free/package.nix
index 72ca626c8933..755d9de906f7 100644
--- a/pkgs/by-name/un/unrar-free/package.nix
+++ b/pkgs/by-name/un/unrar-free/package.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ libarchive ];
 
+  setupHook = ./setup-hook.sh;
+
   meta = {
     description = "Free utility to extract files from RAR archives";
     longDescription = ''
diff --git a/pkgs/by-name/un/unrar-free/setup-hook.sh b/pkgs/by-name/un/unrar-free/setup-hook.sh
new file mode 100644
index 000000000000..347bf4c125d2
--- /dev/null
+++ b/pkgs/by-name/un/unrar-free/setup-hook.sh
@@ -0,0 +1,5 @@
+unpackCmdHooks+=(_tryUnrarFree)
+_tryUnrarFree() {
+    if ! [[ "$curSrc" =~ \.rar$ ]]; then return 1; fi
+    unrar-free -x "$curSrc" >/dev/null
+}

From 14f9807285df12a3a11d265c8ffd2ce6ea384410 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Jan 2025 00:12:46 +0000
Subject: [PATCH 02/33] python312Packages.openstackdocstheme: 3.4.0 -> 3.4.1

---
 .../development/python-modules/openstackdocstheme/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/openstackdocstheme/default.nix b/pkgs/development/python-modules/openstackdocstheme/default.nix
index c0e75fcab9b9..ce3b63ff8844 100644
--- a/pkgs/development/python-modules/openstackdocstheme/default.nix
+++ b/pkgs/development/python-modules/openstackdocstheme/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "openstackdocstheme";
-  version = "3.4.0";
+  version = "3.4.1";
   pyproject = true;
 
   disabled = pythonAtLeast "3.13";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YA3nY7Q6UM9sviGRUh08EwwLEjneO2KAh4Hsr/hn25U=";
+    hash = "sha256-OPT2rGO967RlJ17iEm5oMuaxqZ8Y8ya+gKMzU0qaGzk=";
   };
 
   postPatch = ''

From 7602b3414386eff22d812294669be0120ea563a7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 6 Jan 2025 06:15:23 +0000
Subject: [PATCH 03/33] moodle: 4.4.5 -> 4.5.1

---
 pkgs/servers/web-apps/moodle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index c9d8a4318c55..5c6548c8b9f5 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, writeText, plugins ? [ ], nixosTests }:
 
 let
-  version = "4.4.5";
+  version = "4.5.1";
 
   versionParts = lib.take 2 (lib.splitVersion version);
   # 4.2 -> 402, 3.11 -> 311
@@ -78,7 +78,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/download.php/direct/stable${stableVersion}/${pname}-${version}.tgz";
-    hash = "sha256-CronmobN0OFZHhMCmruPae34j1FNrvMLO02q1VlQfgY=";
+    hash = "sha256-ycqtEu2KjPpP9rM74QNMssnP1kY3sG1MAHYxbELkGd0=";
   };
 
   phpConfig = writeText "config.php" ''

From be04a5d17ecc374056cafa82e19a0086190dc0bf Mon Sep 17 00:00:00 2001
From: FliegendeWurst <arne.keller@posteo.de>
Date: Wed, 8 Jan 2025 12:32:19 +0100
Subject: [PATCH 04/33] sile: fix strictDeps build

---
 pkgs/by-name/si/sile/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/si/sile/package.nix b/pkgs/by-name/si/sile/package.nix
index dd67e16272b9..307df39ca282 100644
--- a/pkgs/by-name/si/sile/package.nix
+++ b/pkgs/by-name/si/sile/package.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     zstd
     pkg-config
+    fontconfig # fc-match
     jq
     cargo
     rustc
@@ -101,6 +102,8 @@ stdenv.mkDerivation (finalAttrs: {
       gentium
     ];
   };
+  strictDeps = true;
+  env.LUA = "${finalAttrs.finalPackage.passthru.luaEnv}/bin/lua";
 
   enableParallelBuilding = true;
 

From a6101134869246170bfed1dfbc0af8b59ae9e032 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Jan 2025 07:25:17 +0000
Subject: [PATCH 05/33] python312Packages.pyinstrument: 4.7.3 -> 5.0.0

---
 pkgs/development/python-modules/pyinstrument/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyinstrument/default.nix b/pkgs/development/python-modules/pyinstrument/default.nix
index 38cec05b049a..060094a6cfd7 100644
--- a/pkgs/development/python-modules/pyinstrument/default.nix
+++ b/pkgs/development/python-modules/pyinstrument/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyinstrument";
-  version = "4.7.3";
+  version = "5.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "joerick";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-Dvpx6Bf4obHL3inzIHhOrM3u/7X+0NRfEAyynDjtEwE=";
+    hash = "sha256-uJ9KRgSETuxpeEIpBKFz66+Qci86jy36lKkUKpvmKIg=";
   };
 
   nativeBuildInputs = [

From 06cbdf0c35384f71b20bf4ff30008869b1e47aa1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Jan 2025 07:40:32 +0000
Subject: [PATCH 06/33] python312Packages.graph-tool: 2.80 -> 2.85

---
 pkgs/development/python-modules/graph-tool/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/graph-tool/default.nix b/pkgs/development/python-modules/graph-tool/default.nix
index 2521c23eb0cc..a11145e36594 100644
--- a/pkgs/development/python-modules/graph-tool/default.nix
+++ b/pkgs/development/python-modules/graph-tool/default.nix
@@ -32,12 +32,12 @@ let
 in
 buildPythonPackage rec {
   pname = "graph-tool";
-  version = "2.80";
+  version = "2.85";
   format = "other";
 
   src = fetchurl {
     url = "https://downloads.skewed.de/graph-tool/graph-tool-${version}.tar.bz2";
-    hash = "sha256-wacOB12+co+tJdw/WpqVl4gKbW/2hDW5HSHwtE742+Y=";
+    hash = "sha256-GX0JUz5G7gtLemwlY1prQvCxIxpuyclo+1LN68j2H9o=";
   };
 
   postPatch = ''

From db0dc6e40e977e88ed3f40088ded70d1f7108a3b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 19 Dec 2024 11:03:22 +0200
Subject: [PATCH 07/33] python312Packages.python-yakh: init at 0.4.1

---
 .../python-modules/python-yakh/default.nix    | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/python-yakh/default.nix

diff --git a/pkgs/development/python-modules/python-yakh/default.nix b/pkgs/development/python-modules/python-yakh/default.nix
new file mode 100644
index 000000000000..a3fba540022b
--- /dev/null
+++ b/pkgs/development/python-modules/python-yakh/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  # NOTE that this is not https://pypi.org/project/yakh/
+  pname = "python-yakh";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "petereon";
+    repo = "yakh";
+    rev = "v${version}";
+    hash = "sha256-mXG0fit+0MLOkn2ezRzLboDGKxkES/T7kyWAfaF0EQQ=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  pythonImportsCheck = [
+    "yakh"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Yet Another Keypress Handler";
+    homepage = "https://pypi.org/project/python-yakh";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index eba465c9e2c1..e22d86593482 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10801,6 +10801,8 @@ self: super: with self; {
 
   python-idzip = callPackage ../development/python-modules/python-idzip { };
 
+  python-yakh = callPackage ../development/python-modules/python-yakh { };
+
   pythonfinder = callPackage ../development/python-modules/pythonfinder { };
 
   pytomorrowio = callPackage ../development/python-modules/pytomorrowio { };

From b16e822a4046cabbba4970d96776f95275406dce Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 19 Dec 2024 11:03:41 +0200
Subject: [PATCH 08/33] python312Packages.questo: init at 0.4.1

---
 .../python-modules/questo/default.nix         | 52 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/development/python-modules/questo/default.nix

diff --git a/pkgs/development/python-modules/questo/default.nix b/pkgs/development/python-modules/questo/default.nix
new file mode 100644
index 000000000000..c1f8ad3b4b8f
--- /dev/null
+++ b/pkgs/development/python-modules/questo/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  python-yakh,
+  rich,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "questo";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "petereon";
+    repo = "questo";
+    rev = "v${version}";
+    hash = "sha256-XCxSH2TSU4YdfyqfLpVSEeDeU1S24C+NezP1IL5qj/4=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    python-yakh
+    rich
+  ];
+
+  pythonImportsCheck = [
+    "questo"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "A library of extensible and modular CLI prompt elements";
+    homepage = "https://github.com/petereon/questo";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e22d86593482..f48e7ed099e8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13749,6 +13749,8 @@ self: super: with self; {
 
   querystring-parser = callPackage ../development/python-modules/querystring-parser { };
 
+  questo = callPackage ../development/python-modules/questo { };
+
   questionary = callPackage ../development/python-modules/questionary { };
 
   queuelib = callPackage ../development/python-modules/queuelib { };

From 5082194b99693b91b6544677c132838f4f1e33a7 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 19 Dec 2024 11:05:25 +0200
Subject: [PATCH 09/33] python312Packages.beaupy: init at 3.10.1

---
 .../python-modules/beaupy/default.nix         | 56 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/beaupy/default.nix

diff --git a/pkgs/development/python-modules/beaupy/default.nix b/pkgs/development/python-modules/beaupy/default.nix
new file mode 100644
index 000000000000..33e5a8e5eeca
--- /dev/null
+++ b/pkgs/development/python-modules/beaupy/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  emoji,
+  python-yakh,
+  questo,
+  rich,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "beaupy";
+  version = "3.10.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "petereon";
+    repo = "beaupy";
+    rev = "v${version}";
+    hash = "sha256-tN78OV0Ks1MIdqVh8yisTgK4dOaKqYlZxvIoCa44eAI=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    emoji
+    python-yakh
+    questo
+    rich
+  ];
+
+  pythonImportsCheck = [
+    "beaupy"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "A Python library of interactive CLI elements you have been looking for";
+    homepage = "https://github.com/petereon/beaupy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f48e7ed099e8..e5dd681a2d8c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1591,6 +1591,8 @@ self: super: with self; {
 
   beartype = callPackage ../development/python-modules/beartype { };
 
+  beaupy = callPackage ../development/python-modules/beaupy { };
+
   beautiful-date = callPackage ../development/python-modules/beautiful-date { };
 
   beautifulsoup4 = callPackage ../development/python-modules/beautifulsoup4 { };

From 56de4acce806158dcd6078248988ae171c5536f4 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 15 Jan 2025 10:59:08 +0100
Subject: [PATCH 10/33] envoy: 1.32.3 -> 1.33.0

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../0001-nixpkgs-use-system-Python.patch      |  27 ++--
 ...04-nixpkgs-patch-boringssl-for-gcc14.patch |   4 +-
 ...05-deps-Bump-rules_rust-0.54.1-37056.patch | 128 ------------------
 pkgs/by-name/en/envoy/0006-gcc-warnings.patch | 127 -----------------
 .../envoy/0007-protobuf-remove-Werror.patch   |  19 ---
 pkgs/by-name/en/envoy/package.nix             |  31 +----
 6 files changed, 20 insertions(+), 316 deletions(-)
 delete mode 100644 pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
 delete mode 100644 pkgs/by-name/en/envoy/0006-gcc-warnings.patch
 delete mode 100644 pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch

diff --git a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
index e9cb4d5526e9..da29f34774c9 100644
--- a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
+++ b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
@@ -5,18 +5,15 @@ Subject: [PATCH] nixpkgs: use system Python
 
 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
- bazel/python_dependencies.bzl | 11 ++++-------
+ bazel/python_dependencies.bzl |  9 ++++-----
  bazel/repositories_extra.bzl  | 17 +----------------
- 2 files changed, 5 insertions(+), 23 deletions(-)
+ 2 files changed, 5 insertions(+), 21 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 9f2b336b1a36ca0d2f04a40ac1809b30ff21df27..53a2c93c59492a12ef4a6ecfc0c8a679f0df73f7 100644
+index 9867dc3a46dbe780eb3c02bad8f6a22a2c7fd97e..ff8685e0e437aee447218e912f1cf3e494755cf4 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
-@@ -1,28 +1,25 @@
- load("@com_google_protobuf//bazel:system_python.bzl", "system_python")
--load("@envoy_toolshed//:packages.bzl", "load_packages")
--load("@python3_12//:defs.bzl", "interpreter")
+@@ -3,25 +3,24 @@ load("@envoy_toolshed//:packages.bzl", "load_packages")
  load("@rules_python//python:pip.bzl", "pip_parse")
  
  def envoy_python_dependencies():
@@ -28,30 +25,30 @@ index 9f2b336b1a36ca0d2f04a40ac1809b30ff21df27..53a2c93c59492a12ef4a6ecfc0c8a679
 +    )
      pip_parse(
          name = "base_pip3",
--        python_interpreter_target = interpreter,
+-        python_interpreter_target = "@python3_12_host//:python",
          requirements_lock = "@envoy//tools/base:requirements.txt",
          extra_pip_args = ["--require-hashes"],
      )
  
      pip_parse(
          name = "dev_pip3",
--        python_interpreter_target = interpreter,
+-        python_interpreter_target = "@python3_12_host//:python",
          requirements_lock = "@envoy//tools/dev:requirements.txt",
          extra_pip_args = ["--require-hashes"],
      )
  
      pip_parse(
          name = "fuzzing_pip3",
--        python_interpreter_target = interpreter,
+-        python_interpreter_target = "@python3_12_host//:python",
          requirements_lock = "@rules_fuzzing//fuzzing:requirements.txt",
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f131184fe4 100644
+index 7a9d3bbb53b567a8f398abaefe5ff044056d4d21..a5b75718de667883824e4320e2d563830b02f5d2 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
-@@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
- load("@bazel_features//:deps.bzl", "bazel_features_deps")
+@@ -3,19 +3,11 @@ load("@bazel_features//:deps.bzl", "bazel_features_deps")
+ load("@com_google_protobuf//bazel/private:proto_bazel_features.bzl", "proto_bazel_features")
  load("@emsdk//:deps.bzl", emsdk_deps = "deps")
  load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime/remote:crates.bzl", "crate_repositories")
 -load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
@@ -71,7 +68,7 @@ index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f1
          ignore_root_user_error = False):
      bazel_features_deps()
      emsdk_deps()
-@@ -22,11 +14,4 @@ def envoy_dependencies_extra(
+@@ -23,13 +15,6 @@ def envoy_dependencies_extra(
      crate_repositories()
      py_repositories()
  
@@ -83,3 +80,5 @@ index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f1
 -    )
 -
      aspect_bazel_lib_dependencies()
+ 
+     if not native.existing_rule("proto_bazel_features"):
diff --git a/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
index 4c31f1e8a90c..157ad5287120 100644
--- a/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
+++ b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
@@ -42,10 +42,10 @@ index 0000000000000000000000000000000000000000..8dcad4cc11f691eec93efa29075c1d35
 + // FIPS functions.
 + 
 diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 5cb573770f0aeac7b42d803673c8c520b5e35131..e864ef24db4bf837ef50d90c8eca316eba939d74 100644
+index cd15ec36f45f5958f4e65d314af78a0ef7c5dc78..935bf8a1ced67c094e4e900ba84bf39033bd3bbb 100644
 --- a/bazel/repositories.bzl
 +++ b/bazel/repositories.bzl
-@@ -264,6 +264,7 @@ def _boringssl():
+@@ -263,6 +263,7 @@ def _boringssl():
          patch_args = ["-p1"],
          patches = [
              "@envoy//bazel:boringssl_static.patch",
diff --git a/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch b/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
deleted file mode 100644
index 5537128a4582..000000000000
--- a/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "dependency-envoy[bot]"
- <148525496+dependency-envoy[bot]@users.noreply.github.com>
-Date: Fri, 8 Nov 2024 21:09:22 +0000
-Subject: [PATCH] deps: Bump `rules_rust` -> 0.54.1 (#37056)
-
-Fix #37054
-
-Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
-Signed-off-by: Ryan Northey <ryan@synca.io>
----
- bazel/repository_locations.bzl                | 10 ++++++---
- .../dynamic_modules/sdk/rust/Cargo.Bazel.lock | 21 +++++++++++--------
- 2 files changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
-index 85a125d44ece6c655f94aab3d986d96ab837897f..cfe7d145b59b691f6455b58b1baaae48276b7e9f 100644
---- a/bazel/repository_locations.bzl
-+++ b/bazel/repository_locations.bzl
-@@ -1465,12 +1465,16 @@ REPOSITORY_LOCATIONS_SPEC = dict(
-         license = "Emscripten SDK",
-         license_url = "https://github.com/emscripten-core/emsdk/blob/{version}/LICENSE",
-     ),
-+    # After updating you may need to run:
-+    #
-+    #     CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
-+    #
-     rules_rust = dict(
-         project_name = "Bazel rust rules",
-         project_desc = "Bazel rust rules (used by Wasm)",
-         project_url = "https://github.com/bazelbuild/rules_rust",
--        version = "0.51.0",
--        sha256 = "042acfb73469b2d1848fe148d81c3422c61ea47a9e1900f1c9ec36f51e8e7193",
-+        version = "0.54.1",
-+        sha256 = "af4f56caae50a99a68bfce39b141b509dd68548c8204b98ab7a1cafc94d5bb02",
-         # Note: rules_rust should point to the releases, not archive to avoid the hassle of bootstrapping in crate_universe.
-         # This is described in https://bazelbuild.github.io/rules_rust/crate_universe.html#setup, otherwise bootstrap
-         # is required which in turn requires a system CC toolchains, not the bazel controlled ones.
-@@ -1482,7 +1486,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
-         ],
-         implied_untracked_deps = ["rules_cc"],
-         extensions = ["envoy.wasm.runtime.wasmtime"],
--        release_date = "2024-09-19",
-+        release_date = "2024-11-07",
-         cpe = "N/A",
-         license = "Apache-2.0",
-         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",
-diff --git a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
-index fa6012f406464428b37d548eecd6cec3fdaf901b..6af752304b65af39aa621fa201a8c0108931dad0 100644
---- a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
-+++ b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
-@@ -1,5 +1,5 @@
- {
--  "checksum": "96b309ddded40cf6f46a62829d15a02d7253b4cc94af2ac1890e492f9c07e93f",
-+  "checksum": "b550022ca979d6b55c6dbee950bbf18368e4b8da16973c4e88e292b4d6f28e81",
-   "crates": {
-     "aho-corasick 1.1.3": {
-       "name": "aho-corasick",
-@@ -2149,9 +2149,6 @@
-     "aarch64-apple-ios-sim": [
-       "aarch64-apple-ios-sim"
-     ],
--    "aarch64-fuchsia": [
--      "aarch64-fuchsia"
--    ],
-     "aarch64-linux-android": [
-       "aarch64-linux-android"
-     ],
-@@ -2159,6 +2156,9 @@
-     "aarch64-pc-windows-msvc": [
-       "aarch64-pc-windows-msvc"
-     ],
-+    "aarch64-unknown-fuchsia": [
-+      "aarch64-unknown-fuchsia"
-+    ],
-     "aarch64-unknown-linux-gnu": [
-       "aarch64-unknown-linux-gnu"
-     ],
-@@ -2197,8 +2197,8 @@
-       "aarch64-apple-darwin",
-       "aarch64-apple-ios",
-       "aarch64-apple-ios-sim",
--      "aarch64-fuchsia",
-       "aarch64-linux-android",
-+      "aarch64-unknown-fuchsia",
-       "aarch64-unknown-linux-gnu",
-       "aarch64-unknown-nixos-gnu",
-       "aarch64-unknown-nto-qnx710",
-@@ -2213,9 +2213,9 @@
-       "s390x-unknown-linux-gnu",
-       "x86_64-apple-darwin",
-       "x86_64-apple-ios",
--      "x86_64-fuchsia",
-       "x86_64-linux-android",
-       "x86_64-unknown-freebsd",
-+      "x86_64-unknown-fuchsia",
-       "x86_64-unknown-linux-gnu",
-       "x86_64-unknown-nixos-gnu"
-     ],
-@@ -2264,15 +2264,15 @@
-     "wasm32-wasi": [
-       "wasm32-wasi"
-     ],
-+    "wasm32-wasip1": [
-+      "wasm32-wasip1"
-+    ],
-     "x86_64-apple-darwin": [
-       "x86_64-apple-darwin"
-     ],
-     "x86_64-apple-ios": [
-       "x86_64-apple-ios"
-     ],
--    "x86_64-fuchsia": [
--      "x86_64-fuchsia"
--    ],
-     "x86_64-linux-android": [
-       "x86_64-linux-android"
-     ],
-@@ -2283,6 +2283,9 @@
-     "x86_64-unknown-freebsd": [
-       "x86_64-unknown-freebsd"
-     ],
-+    "x86_64-unknown-fuchsia": [
-+      "x86_64-unknown-fuchsia"
-+    ],
-     "x86_64-unknown-linux-gnu": [
-       "x86_64-unknown-linux-gnu"
-     ],
diff --git a/pkgs/by-name/en/envoy/0006-gcc-warnings.patch b/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
deleted file mode 100644
index a0c7dd94a263..000000000000
--- a/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From 448e4e14f4f188687580362a861ae4a0dbb5b1fb Mon Sep 17 00:00:00 2001
-From: "Krinkin, Mike" <krinkin.m.u@gmail.com>
-Date: Sat, 16 Nov 2024 00:40:40 +0000
-Subject: [PATCH] [contrib] Disable GCC warnings and broken features (#37131)
-
-Currently contrib does not build with GCC because of various false
-positive compiler warnings turned to errors and a GCC compiler bug.
-
-Let's first start with the bug, in GCC apparently
-using -gsplit-dwarf (debug fission) and -fdebug-types-section (used to
-optimize the size of debug inforamtion), when used together, can result
-in a linker failure.
-
-Refer to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885 for the GCC
-bug report of this issue. When it comes to Envoy, optimized builds with
-GCC are affected on at least GCC 11 (used by --config=docker-gcc) and
-GCC 12 (and I'm pretty sure the bug isn't fixed in any newer versions
-either, though I didn't check each version).
-
-Given that we cannot have both debug fission and a debug types section,
-we decided to abandon the debug types sections and keep the fission.
-
-That being said, apparently both of those options are unmaintained in
-GCC which poses a question of long term viability of using those or GCC.
-
-Other changes in this commit disable GCC compiler errors for various
-warnings that happen when building contrib. I checked those warnings and
-didn't find any true
-positive.
-
-And additionally, for warnings that exists in both Clang and GCC, Clang
-warnings don't trigger, so Clang also disagrees with GCC here.
-
-Additionally missing-requires warning is new and does not exist in GCC
-11, but exists in later versions of GCC, so to avoid breaking on this
-warning for future versions of GCC I disabled it, but also tell GCC to
-not complain if it sees a flag related to an unknwon diagnostic.
-
-This is the last change required to make GCC contrib builds work (you
-can find more context and discussions in
-https://github.com/envoyproxy/envoy/issues/31807)
-
-Risk Level: Low
-Testing: building with --config=gcc and --config=docker-gcc
-Docs Changes: N/A
-Release Notes: N/A
-Platform Specific Features: N/A
-Fixes #31807
-
-Signed-off-by: Mikhail Krinkin <krinkin.m.u@gmail.com>
----
- .bazelrc                 | 18 +++++++++++++++++-
- bazel/envoy_internal.bzl | 16 +++++++++++++++-
- 2 files changed, 32 insertions(+), 2 deletions(-)
-
-diff --git a/.bazelrc b/.bazelrc
-index e0e4899cecf1..7df94c77944c 100644
---- a/.bazelrc
-+++ b/.bazelrc
-@@ -57,9 +57,9 @@ test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
- # Allow tags to influence execution requirements
- common --experimental_allow_tags_propagation
- 
-+build:linux --copt=-fdebug-types-section
- # Enable position independent code (this is the default on macOS and Windows)
- # (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
--build:linux --copt=-fdebug-types-section
- build:linux --copt=-fPIC
- build:linux --copt=-Wno-deprecated-declarations
- build:linux --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
-@@ -95,6 +95,21 @@ build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
- build:gcc --test_env=HEAPCHECK=
- build:gcc --action_env=BAZEL_COMPILER=gcc
- build:gcc --action_env=CC=gcc --action_env=CXX=g++
-+# This is to work around a bug in GCC that makes debug-types-section
-+# option not play well with fission:
-+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885
-+build:gcc --copt=-fno-debug-types-section
-+# These trigger errors in multiple places both in Envoy dependecies
-+# and in Envoy code itself when using GCC.
-+# And in all cases the reports appear to be clear false positives.
-+build:gcc --copt=-Wno-error=restrict
-+build:gcc --copt=-Wno-error=uninitialized
-+build:gcc --cxxopt=-Wno-missing-requires
-+# We need this because -Wno-missing-requires options is rather new
-+# in GCC, so flags -Wno-missing-requires exists in GCC 12, but does
-+# not in GCC 11 and GCC 11 is what is used in docker-gcc
-+# configuration currently
-+build:gcc --cxxopt=-Wno-unknown-warning
- 
- # Clang-tidy
- # TODO(phlax): enable this, its throwing some errors as well as finding more issues
-@@ -375,6 +390,7 @@ build:docker-clang-libc++ --config=docker-sandbox
- build:docker-clang-libc++ --config=rbe-toolchain-clang-libc++
- 
- build:docker-gcc --config=docker-sandbox
-+build:docker-gcc --config=gcc
- build:docker-gcc --config=rbe-toolchain-gcc
- 
- build:docker-asan --config=docker-sandbox
-diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
-index 015659851c1b..27ecaa0bbf47 100644
---- a/bazel/envoy_internal.bzl
-+++ b/bazel/envoy_internal.bzl
-@@ -68,7 +68,21 @@ def envoy_copts(repository, test = False):
-                    "-Wc++2a-extensions",
-                    "-Wrange-loop-analysis",
-                ],
--               repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
-+               repository + "//bazel:gcc_build": [
-+                   "-Wno-maybe-uninitialized",
-+                   # GCC implementation of this warning is too noisy.
-+                   #
-+                   # It generates warnings even in cases where there is no ambiguity
-+                   # between the overloaded version of a method and the hidden version
-+                   # from the base class. E.g., when the two have different number of
-+                   # arguments or incompatible types and therefore a wrong function
-+                   # cannot be called by mistake without triggering a compiler error.
-+                   #
-+                   # As a safeguard, this warning is only disabled for GCC builds, so
-+                   # if Clang catches a problem in the code we would get a warning
-+                   # anyways.
-+                   "-Wno-error=overloaded-virtual",
-+               ],
-                # Allow 'nodiscard' function results values to be discarded for test code only
-                # TODO(envoyproxy/windows-dev): Replace /Zc:preprocessor with /experimental:preprocessor
-                # for msvc versions between 15.8 through 16.4.x. see
diff --git a/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch b/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
deleted file mode 100644
index 196a499ec651..000000000000
--- a/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -Naur a/bazel/protobuf.patch b/bazel/protobuf.patch
---- a/bazel/protobuf.patch	2025-01-06 23:00:26.683972526 +0100
-+++ b/bazel/protobuf.patch	2025-01-07 00:53:33.997482569 +0100
-@@ -149,3 +149,15 @@
-  #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
-  #define PROTOBUF_DEBUG true
-  #else
-+diff -Naur a/build_defs/cpp_opts.bzl b/build_defs/cpp_opts.bzl
-+--- a/build_defs/cpp_opts.bzl	2025-01-06 23:02:56.356552216 +0100
-++++ b/build_defs/cpp_opts.bzl	2025-01-07 00:23:30.534047300 +0100
-+@@ -22,7 +22,7 @@
-+         "-Woverloaded-virtual",
-+         "-Wno-sign-compare",
-+         "-Wno-nonnull",
-+-        "-Werror",
-++        "-Wno-maybe-uninitialized",
-+     ],
-+ })
-+ 
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 823e2c180b41..1af918135653 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -30,16 +30,16 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.32.3";
-    rev = "58bd599ebd5918d4d005de60954fcd2cb00abd95";
-    hash = "sha256-5HpxcsAPoyVOJ3Aem+ZjSLa8Zu6s76iCMiWJbp8RjHc=";
+    version = "1.33.0";
+    rev = "b0f43d67aa25c1b03c97186a200cc187f4c22db3";
+    hash = "sha256-zqekRpOlaA2IrwwFUEwASa1uokET98h5sr7EwzWgcbU=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-YFXNatolLM9DdwkMnc9SWsa6Z6/aGzqLmo/zKE7OFy0=";
-      aarch64-linux = "sha256-AjG1OBjPjiSwWCmIJgHevSQHx8+rzRgmLsw3JwwD0hk=";
+      x86_64-linux = "sha256-A4faXoO0WiXLrepk7DV88NavL/fytZa2UPepC+QkR3E=";
+      aarch64-linux = "sha256-vA/Wgf5bu/+Hlgc93h5lvhbPlsiSR10TuZ0qn5v0UaM=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -64,27 +64,6 @@ buildBazelPackage rec {
 
       # use system C/C++ tools
       ./0003-nixpkgs-use-system-C-C-toolchains.patch
-
-      # patch boringssl to work with GCC 14
-      # vendored patch from https://boringssl.googlesource.com/boringssl/+/c70190368c7040c37c1d655f0690bcde2b109a0d
-      ./0004-nixpkgs-patch-boringssl-for-gcc14.patch
-
-      # update rust rules to work with rustc v1.83
-      # cherry-pick of https://github.com/envoyproxy/envoy/commit/019f589da2cc8da7673edd077478a100b4d99436
-      # drop with v1.33.x
-      ./0005-deps-Bump-rules_rust-0.54.1-37056.patch
-
-      # patch gcc flags to work with GCC 14
-      # (silences erroneus -Werror=maybe-uninitialized and others)
-      # cherry-pick of https://github.com/envoyproxy/envoy/commit/448e4e14f4f188687580362a861ae4a0dbb5b1fb
-      # drop with v1.33.x
-      ./0006-gcc-warnings.patch
-
-      # Remove "-Werror" from protobuf build
-      # This is fixed in protobuf v28 and later:
-      # https://github.com/protocolbuffers/protobuf/commit/f5a1b178ad52c3e64da40caceaa4ca9e51045cb4
-      # drop with v1.33.x
-      ./0007-protobuf-remove-Werror.patch
     ];
     postPatch = ''
       chmod -R +w .

From 53b6c10a53440f759255365e4e1e61aaa97f335e Mon Sep 17 00:00:00 2001
From: weriomat <engel@weriomat.com>
Date: Wed, 15 Jan 2025 18:00:52 +0100
Subject: [PATCH 11/33] pingvin-share: 1.8.0 -> 1.8.1

---
 pkgs/servers/pingvin-share/backend.nix  | 2 +-
 pkgs/servers/pingvin-share/default.nix  | 4 ++--
 pkgs/servers/pingvin-share/frontend.nix | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/pingvin-share/backend.nix b/pkgs/servers/pingvin-share/backend.nix
index 4a8330992cdd..7f9f9c3fa287 100644
--- a/pkgs/servers/pingvin-share/backend.nix
+++ b/pkgs/servers/pingvin-share/backend.nix
@@ -31,7 +31,7 @@ buildNpmPackage {
     prisma
   ];
 
-  npmDepsHash = "sha256-zzN4r2hednmm5DFnK/RRTKPq0vWiGhG+WyNTPNNP1vc=";
+  npmDepsHash = "sha256-04SWe/Ww9ZKfJZsME11+UT2VglwiWF9FpEoFFQXygxk=";
   makeCacheWritable = true;
   npmFlags = [ "--legacy-peer-deps" ];
 
diff --git a/pkgs/servers/pingvin-share/default.nix b/pkgs/servers/pingvin-share/default.nix
index dd46f4e0d383..31f1b197b7f6 100644
--- a/pkgs/servers/pingvin-share/default.nix
+++ b/pkgs/servers/pingvin-share/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "1.8.0";
+  version = "1.8.1";
   src = fetchFromGitHub {
     owner = "stonith404";
     repo = "pingvin-share";
     rev = "v${version}";
-    hash = "sha256-cgB2cnpWdQFqdz9Lxyl87MOvhELge0YwwY0AoKqL8BU=";
+    hash = "sha256-d34VlsYhaIMXsdb0194hF84j2aqzbtX/GKzicIa9+J0=";
   };
 in
 
diff --git a/pkgs/servers/pingvin-share/frontend.nix b/pkgs/servers/pingvin-share/frontend.nix
index b9248737fb7f..73ccc8aae14d 100644
--- a/pkgs/servers/pingvin-share/frontend.nix
+++ b/pkgs/servers/pingvin-share/frontend.nix
@@ -23,7 +23,7 @@ buildNpmPackage {
   buildInputs = [ vips ];
   nativeBuildInputs = [ pkg-config ];
 
-  npmDepsHash = "sha256-wQIQHRVj8weUh/VOBdYVr8Q4ZE9u4rGJbQr0+NE6XG0=";
+  npmDepsHash = "sha256-J+EFv5F1twvexJHS0pcH9TQi2e6cDK3xV+iHPcuimnw=";
   makeCacheWritable = true;
   npmFlags = [ "--legacy-peer-deps" ];
 

From 0b2927007047865d73ab0bb258e3600402224ea9 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 15 Jan 2025 18:45:07 +0100
Subject: [PATCH 12/33] envoy: add test to check deps derivation for storepaths

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/en/envoy/package.nix | 36 +++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 1af918135653..efe2718208fb 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -19,6 +19,10 @@
   python3,
   linuxHeaders,
   nixosTests,
+  runCommandLocal,
+  gnutar,
+  gnugrep,
+  envoy,
 
   # v8 (upstream default), wavm, wamr, wasmtime, disabled
   wasmRuntime ? "wamr",
@@ -242,6 +246,38 @@ buildBazelPackage rec {
     envoy = nixosTests.envoy;
     # tested as a core component of Pomerium
     pomerium = nixosTests.pomerium;
+
+    deps-store-free =
+      runCommandLocal "${envoy.name}-deps-store-free-test"
+        {
+          nativeBuildInputs = [
+            gnutar
+            gnugrep
+          ];
+        }
+        ''
+          touch $out
+          tar -xf ${envoy.deps}
+          grep -r /nix/store external && status=$? || status=$?
+          case $status in
+            1)
+              echo "No match found."
+              ;;
+            0)
+              echo
+              echo "Error: Found references to /nix/store in envoy.deps derivation"
+              echo "This is a reproducibility issue, as the hash of the fixed-output derivation"
+              echo "will change in case the store path of the input changes."
+              echo
+              echo "Replace the store path in fetcherAttrs.preInstall."
+              exit 1
+              ;;
+            *)
+              echo "An unexpected error occurred."
+              exit $status
+              ;;
+          esac
+        '';
   };
 
   meta = with lib; {

From 3fcfdc900139dd1e8b7e37762b9dc59820968fab Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 15 Jan 2025 21:04:25 +0100
Subject: [PATCH 13/33] envoy: remove store paths from deps

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/en/envoy/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index efe2718208fb..757343e39f2d 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -42,8 +42,8 @@ let
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-A4faXoO0WiXLrepk7DV88NavL/fytZa2UPepC+QkR3E=";
-      aarch64-linux = "sha256-vA/Wgf5bu/+Hlgc93h5lvhbPlsiSR10TuZ0qn5v0UaM=";
+      x86_64-linux = "sha256-4CQkHlXbDpRiqzeyserVf9PpLx3ME7TtZ2H88ggog6U=";
+      aarch64-linux = "sha256-FxkfBWiG0NIInl28w+l4YvaV2VFuCtjn5VBAKvJoxM8=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -135,7 +135,9 @@ buildBazelPackage rec {
         -e 's,${stdenv.shellPackage},__NIXSHELL__,' \
         $bazelOut/external/com_github_luajit_luajit/build.py \
         $bazelOut/external/local_config_sh/BUILD \
-        $bazelOut/external/*_pip3/BUILD.bazel
+        $bazelOut/external/*_pip3/BUILD.bazel \
+        $bazelOut/external/rules_rust/util/process_wrapper/private/process_wrapper.sh \
+        $bazelOut/external/rules_rust/crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
 
       rm -r $bazelOut/external/go_sdk
       rm -r $bazelOut/external/local_jdk

From 25dd08a3705bdaf62ab63962a0d613a35469abeb Mon Sep 17 00:00:00 2001
From: NovaViper <coder.nova99@mailbox.org>
Date: Thu, 9 Jan 2025 11:37:29 -0600
Subject: [PATCH 14/33] maintainers: add novaviper

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 03d64eb7af50..861845cd85bb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16635,6 +16635,12 @@
     githubId = 126072875;
     name = "nova madeline";
   };
+  novaviper = {
+    email = "coder.nova99@mailbox.org";
+    github = "novaviper";
+    githubId = 7191115;
+    name = "Nova Leary";
+  };
   novoxd = {
     email = "radnovox@gmail.com";
     github = "novoxd";

From d5bc05a4c961f27e4400b3f15e26a7dc41b0ed84 Mon Sep 17 00:00:00 2001
From: NovaViper <coder.nova99@mailbox.org>
Date: Thu, 9 Jan 2025 11:38:30 -0600
Subject: [PATCH 15/33] tmuxPlugins.tmux-which-key: init at unstable-2024-06-08

---
 pkgs/misc/tmux-plugins/default.nix            |  4 ++
 .../tmux-plugins/tmux-which-key/default.nix   | 45 +++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/misc/tmux-plugins/tmux-which-key/default.nix

diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 39aabfb30332..70e994389e80 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -882,6 +882,10 @@ in rec {
     };
   };
 
+  tmux-which-key = pkgs.callPackage ./tmux-which-key {
+    inherit mkTmuxPlugin;
+  };
+
   yank = mkTmuxPlugin {
     pluginName = "yank";
     version = "unstable-2023-07-19";
diff --git a/pkgs/misc/tmux-plugins/tmux-which-key/default.nix b/pkgs/misc/tmux-plugins/tmux-which-key/default.nix
new file mode 100644
index 000000000000..a86ffb6a0308
--- /dev/null
+++ b/pkgs/misc/tmux-plugins/tmux-which-key/default.nix
@@ -0,0 +1,45 @@
+{
+  mkTmuxPlugin,
+  fetchFromGitHub,
+  lib,
+  check-jsonschema,
+  python3,
+}:
+mkTmuxPlugin {
+  pluginName = "tmux-which-key";
+  rtpFilePath = "plugin.sh.tmux";
+  version = "0-unstable-2024-06-08";
+  buildInputs = [
+    check-jsonschema
+    (python3.withPackages (ps: with ps; [ pyyaml ]))
+  ];
+
+  postPatch = ''
+    substituteInPlace plugin.sh.tmux --replace-fail \
+      python3 "${lib.getExe (python3.withPackages (ps: with ps; [ pyyaml ]))}"
+  '';
+
+  preInstall = ''
+    rm -rf plugin/pyyaml
+    ln -s ${python3.pkgs.pyyaml.src} plugin/pyyaml
+  '';
+
+  postInstall = ''
+    patchShebangs plugin.sh.tmux plugin/build.py
+  '';
+
+  src = fetchFromGitHub {
+    owner = "alexwforsythe";
+    repo = "tmux-which-key";
+    rev = "1f419775caf136a60aac8e3a269b51ad10b51eb6";
+    hash = "sha256-X7FunHrAexDgAlZfN+JOUJvXFZeyVj9yu6WRnxMEA8E=";
+  };
+
+  meta = {
+    homepage = "https://github.com/alexwforsythe/tmux-which-key";
+    description = "Tmux plugin that allows users to select actions from a customizable popup menu";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ novaviper ];
+  };
+}

From 68bfff5d6fcc3f80e6a1b0fe383867d5b34bd703 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Jan 2025 20:39:01 +0000
Subject: [PATCH 16/33] lrcget: 0.9.0 -> 0.9.1

---
 pkgs/by-name/lr/lrcget/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lr/lrcget/package.nix b/pkgs/by-name/lr/lrcget/package.nix
index 1cf6cebca767..a0a980af632a 100644
--- a/pkgs/by-name/lr/lrcget/package.nix
+++ b/pkgs/by-name/lr/lrcget/package.nix
@@ -18,18 +18,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lrcget";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "tranxuanthang";
     repo = "lrcget";
     rev = "${version}";
-    hash = "sha256-XaQV3YwG15VLcgFJLGsRxCz4n50vAIYxXk09c0GKn5g=";
+    hash = "sha256-ia+on2VZeOzxsZAELhXjq6wSo4Jtn8oZNXZ9hByHtYs=";
   };
 
   sourceRoot = "${src.name}/src-tauri";
 
-  cargoHash = "sha256-l8HMkMMXiYlmaZx+tHE0CXZa2bZakSO/uvJ1lq44Ybk=";
+  cargoHash = "sha256-xGOUR4DWVi5Sx9AEnvIeeRaF2kb5YAv1BBruAk712L8=";
 
   frontend = buildNpmPackage {
     inherit version src;

From 5cf8e529e8be04bfdf297e2ecc11a0f08b1f895e Mon Sep 17 00:00:00 2001
From: Leon Riesebos <28567817+lriesebos@users.noreply.github.com>
Date: Thu, 16 Jan 2025 17:03:31 -0500
Subject: [PATCH 17/33] openfortivpn-webview: 1.2.0 -> 1.2.3

Signed-off-by: Leon Riesebos <28567817+lriesebos@users.noreply.github.com>
---
 pkgs/by-name/op/openfortivpn-webview/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openfortivpn-webview/package.nix b/pkgs/by-name/op/openfortivpn-webview/package.nix
index e0887c17d80d..903b03bdf261 100644
--- a/pkgs/by-name/op/openfortivpn-webview/package.nix
+++ b/pkgs/by-name/op/openfortivpn-webview/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0";
+  version = "1.2.3";
 in
 buildNpmPackage {
   pname = "openfortivpn-webview";
@@ -16,7 +16,7 @@ buildNpmPackage {
       owner = "gm-vm";
       repo = "openfortivpn-webview";
       rev = "v${version}-electron";
-      hash = "sha256-HheqDjlWxHJS0+OEhRTwANs9dyz3lhhCmWh+YH4itOk=";
+      hash = "sha256-jGDCFdqRfnYwUgVs3KO1pDr52JgkYVRHi2KvABaZFl4=";
     })
     + "/openfortivpn-webview-electron";
 
@@ -27,7 +27,7 @@ buildNpmPackage {
     runHook postInstall
   '';
 
-  npmDepsHash = "sha256-Vf8R0+RXHlXwPOnPENw8ooxIXT3kSppQmB2yk5TWEwg=";
+  npmDepsHash = "sha256-NKGu9jZMc+gd4BV1PnF4ukCNkjdUpZIJlYJ7ZzO+5WI=";
   dontNpmBuild = true;
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 

From edfcedcabb5152362e2b6b4d03e719a1e7c22d0d Mon Sep 17 00:00:00 2001
From: Gavin John <gavinnjohn@gmail.com>
Date: Thu, 16 Jan 2025 15:55:26 -0800
Subject: [PATCH 18/33] envision: look ma, it's more missing dependencies!

*internal screaming*
---
 pkgs/by-name/en/envision/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/en/envision/package.nix b/pkgs/by-name/en/envision/package.nix
index 40b06fe28f96..d48df7666f52 100644
--- a/pkgs/by-name/en/envision/package.nix
+++ b/pkgs/by-name/en/envision/package.nix
@@ -76,6 +76,8 @@ buildFHSEnv {
       pkgs.wivrn.buildInputs
       ++ pkgs.wivrn.nativeBuildInputs
       ++ (with pkgs; [
+        avahi
+        ffmpeg
         glib
         libmd
         ninja
@@ -97,7 +99,11 @@ buildFHSEnv {
         libwebp
         openssl
         openxr-loader
+        pipewire
+        pulseaudio
+        systemd
         vulkan-loader
+        x264
       ])
       ++ (with pkgs; [
         android-tools # For adb installing WiVRn APKs

From 034d7591ed30481dc0bc61fb254b685462370633 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 17 Jan 2025 02:01:47 +0200
Subject: [PATCH 19/33] python312Packages.mplcursors: init at 0.6

---
 .../python-modules/mplcursors/default.nix     | 53 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 55 insertions(+)
 create mode 100644 pkgs/development/python-modules/mplcursors/default.nix

diff --git a/pkgs/development/python-modules/mplcursors/default.nix b/pkgs/development/python-modules/mplcursors/default.nix
new file mode 100644
index 000000000000..1a1c2dda4c4a
--- /dev/null
+++ b/pkgs/development/python-modules/mplcursors/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  matplotlib,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "mplcursors";
+  version = "0.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "anntzer";
+    repo = "mplcursors";
+    rev = "v${version}";
+    hash = "sha256-L5pJqRpgPRQEsRDoP10+Pi8uzH5TQNBuGRx7hIL1x7s=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    matplotlib
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mplcursors"
+  ];
+
+  meta = {
+    description = "Interactive data selection cursors for Matplotlib";
+    homepage = "https://github.com/anntzer/mplcursors";
+    changelog = "https://github.com/anntzer/mplcursors/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a6a004a1d6b3..184c55eac740 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8479,6 +8479,8 @@ self: super: with self; {
 
   mpldatacursor = callPackage ../development/python-modules/mpldatacursor { };
 
+  mplcursors = callPackage ../development/python-modules/mplcursors { };
+
   mplfinance = callPackage ../development/python-modules/mplfinance { };
 
   mplhep = callPackage ../development/python-modules/mplhep { };

From d0169965cf1ce1cd68e50a63eabff7c8b8959743 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Fri, 17 Jan 2025 01:36:18 +0100
Subject: [PATCH 20/33] ollama: 0.5.5 -> 0.5.7

---
 pkgs/by-name/ol/ollama/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index ba8b14584d6c..89e8e1ee22bd 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -43,13 +43,13 @@ assert builtins.elem acceleration [
 let
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.5.5";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${version}";
-    hash = "sha256-tfq4PU+PQWw9MaBQtI/+vr3GR8be9R22c3JyM43RPwA=";
+    hash = "sha256-DW7gHNyW1ML8kqgMFsqTxS/30bjNlWmYmeov2/uZn00=";
     fetchSubmodules = true;
   };
 

From 3682230c1884d9be76bbdc03c98f557be0acec83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Jan 2025 00:39:36 +0000
Subject: [PATCH 21/33] python312Packages.python-manilaclient: 5.1.0 -> 5.2.0

---
 .../python-modules/python-manilaclient/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 995f3536e50b..c886b2154fb2 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "5.1.0";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Kv3xEYB6przlEUTzIbkLY654l9N8Gb3YsFqQRTKZpI8=";
+    hash = "sha256-bknD1MTDSS7e4SkUqf+yaj57PdSfzGDy3Nv+piQILlg=";
   };
 
   build-system = [

From fb1c3f7ab4b31d20a493cd3ef10be035a2e0193a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Jan 2025 02:59:02 +0000
Subject: [PATCH 22/33] rekor-cli: 1.3.7 -> 1.3.8

---
 pkgs/tools/security/rekor/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 108195f0ed55..df48f30a4f2a 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -14,13 +14,13 @@ let
     }:
     buildGoModule rec {
       inherit pname;
-      version = "1.3.7";
+      version = "1.3.8";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-Y9hXCO82SvnoxGsk3l2YkoakzxpHGZXew3gnl3+kX1k=";
+        hash = "sha256-YZLDn9Y2aTHaInzlOnG3P9xSKHeC/+Do0iU3pQ0LVOA=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -33,7 +33,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-Gya0lTY3Im7b6HIkYoqb+nwNgOEqt1OookJZlbibBqs=";
+      vendorHash = "sha256-BT4InZvbtpDyduyUT/EHom22l1OMObuXqpG8iFwV0r8=";
 
       nativeBuildInputs = [ installShellFiles ];
 

From a56a570736e7bdf01bbcbe7a426f44b296fc4f7a Mon Sep 17 00:00:00 2001
From: Alex Galvin <alex.v.galvin@gmail.com>
Date: Fri, 9 Feb 2024 17:39:24 -0500
Subject: [PATCH 23/33] maintainers: add av-gal

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 03d64eb7af50..0dd6f2b7563c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2333,6 +2333,12 @@
     githubId = 59499799;
     keys = [ { fingerprint = "A0FF 4F26 6B80 0B86 726D  EA5B 3C23 C7BD 9945 2036"; } ];
   };
+  av-gal = {
+    email = "alex.v.galvin@gmail.com";
+    github = "av-gal";
+    githubId = 32237198;
+    name = "Alex Galvin";
+  };
   avh4 = {
     email = "gruen0aermel@gmail.com";
     github = "avh4";

From 445d7f2f8252d89e93d2836df7c97872171007a1 Mon Sep 17 00:00:00 2001
From: Alex Galvin <alex.v.galvin@gmail.com>
Date: Fri, 9 Feb 2024 17:51:04 -0500
Subject: [PATCH 24/33] autobrr: init at 1.57.0

---
 pkgs/by-name/au/autobrr/package.nix | 96 +++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 pkgs/by-name/au/autobrr/package.nix

diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
new file mode 100644
index 000000000000..da1b503e874f
--- /dev/null
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+  nodejs,
+  pnpm_9,
+  typescript,
+  versionCheckHook,
+}:
+
+let
+  pname = "autobrr";
+  version = "1.57.0";
+  src = fetchFromGitHub {
+    owner = "autobrr";
+    repo = "autobrr";
+    tag = "v${version}";
+    hash = "sha256-RVkeSrL3ZfEz+oCICi8JFJ6AaOBBumi5mnnQYE5Gjt8=";
+  };
+
+  autobrr-web = stdenvNoCC.mkDerivation {
+    pname = "${pname}-web";
+    inherit src version;
+
+    nativeBuildInputs = [
+      nodejs
+      pnpm_9.configHook
+      typescript
+    ];
+
+    sourceRoot = "${src.name}/web";
+
+    pnpmDeps = pnpm_9.fetchDeps {
+      inherit (autobrr-web)
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      hash = "sha256-mABHRuZfjq9qNanfGGv+xDhs3bSufaWRecJypic8SWo=";
+    };
+
+    postBuild = ''
+      pnpm run build
+    '';
+
+    installPhase = ''
+      cp -r dist $out
+    '';
+  };
+in
+buildGoModule rec {
+  inherit
+    autobrr-web
+    pname
+    version
+    src
+    ;
+
+  vendorHash = "sha256-rCtUE2/IwR6AnXQNgeH0TQ0BL7g6vi9L128xP0PwOXc=";
+
+  preBuild = ''
+    cp -r ${autobrr-web}/* web/dist
+  '';
+
+  ldflags = [
+    "-X main.version=${version}"
+    "-X main.commit=${src.tag}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/autobrrctl";
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "autobrr-web"
+    ];
+  };
+
+  meta = {
+    description = "Modern, easy to use download automation for torrents and usenet";
+    license = lib.licenses.gpl2Plus;
+    homepage = "https://autobrr.com/";
+    changelog = "https://autobrr.com/release-notes/v${version}";
+    maintainers = with lib.maintainers; [ av-gal ];
+    mainProgram = "autobrr";
+    platforms = with lib.platforms; darwin ++ freebsd ++ linux;
+  };
+}

From 468bfcc486101da10554cc1fa31aa13a36eb890d Mon Sep 17 00:00:00 2001
From: Alex Galvin <alex.v.galvin@gmail.com>
Date: Fri, 9 Feb 2024 17:55:06 -0500
Subject: [PATCH 25/33] nixos/autobrr: init

---
 .../manual/release-notes/rl-2505.section.md   |  2 +
 nixos/modules/module-list.nix                 |  1 +
 nixos/modules/services/misc/autobrr.nix       | 85 +++++++++++++++++++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/autobrr.nix                       | 25 ++++++
 5 files changed, 114 insertions(+)
 create mode 100644 nixos/modules/services/misc/autobrr.nix
 create mode 100644 nixos/tests/autobrr.nix

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index fd625646c11e..d6cf4e149779 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -77,6 +77,8 @@
 
 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
 
+- [autobrr](https://autobrr.com), a modern download automation tool for torrents and usenets. Available as [services.autobrr](#opt-services.autobrr.enable).
+
 - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
 
 - [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c8f6dbb22a37..f0700c5be267 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -747,6 +747,7 @@
   ./services/misc/anki-sync-server.nix
   ./services/misc/apache-kafka.nix
   ./services/misc/atuin.nix
+  ./services/misc/autobrr.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix
   ./services/misc/autosuspend.nix
diff --git a/nixos/modules/services/misc/autobrr.nix b/nixos/modules/services/misc/autobrr.nix
new file mode 100644
index 000000000000..097bcc10096e
--- /dev/null
+++ b/nixos/modules/services/misc/autobrr.nix
@@ -0,0 +1,85 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.autobrr;
+  configFormat = pkgs.formats.toml { };
+  configTemplate = configFormat.generate "autobrr.toml" cfg.settings;
+  templaterCmd = "${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v $(cat ${cfg.secretFile}) -o %S/autobrr/config.toml 'sessionSecret'";
+in
+{
+  options = {
+    services.autobrr = {
+      enable = lib.mkEnableOption "Autobrr";
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Autobrr web interface.";
+      };
+
+      secretFile = lib.mkOption {
+        type = lib.types.path;
+        description = "File containing the session secret for the Autobrr web interface.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule { freeformType = configFormat.type; };
+        default = {
+          host = "127.0.0.1";
+          port = "7474";
+          checkForUpdates = true;
+        };
+        example = {
+          logLevel = "DEBUG";
+        };
+        description = ''
+          Autobrr configuration options.
+
+          Refer to <https://autobrr.com/configuration/autobrr>
+          for a full list.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "autobrr" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? sessionSecret);
+        message = ''
+          Session secrets should not be passed via settings, as
+          these are stored in the world-readable nix store.
+
+          Use the secretFile option instead.'';
+      }
+    ];
+
+    systemd.services.autobrr = {
+      description = "Autobrr";
+      after = [
+        "syslog.target"
+        "network-online.target"
+      ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        StateDirectory = "autobrr";
+        ExecStartPre = "${lib.getExe pkgs.bash} -c '${templaterCmd}'";
+        ExecStart = "${lib.getExe pkgs.autobrr} --config %S/autobrr";
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.port ]; };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 837bdc7e9fdd..985859cf20fb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -144,6 +144,7 @@ in {
   auth-mysql = handleTest ./auth-mysql.nix {};
   authelia = handleTest ./authelia.nix {};
   auto-cpufreq = handleTest ./auto-cpufreq.nix {};
+  autobrr = handleTest ./autobrr.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
   ayatana-indicators = runTest ./ayatana-indicators.nix;
diff --git a/nixos/tests/autobrr.nix b/nixos/tests/autobrr.nix
new file mode 100644
index 000000000000..f73f7fbb0d4a
--- /dev/null
+++ b/nixos/tests/autobrr.nix
@@ -0,0 +1,25 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "autobrr";
+    meta.maintainers = with lib.maintainers; [ av-gal ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.autobrr = {
+          enable = true;
+          # We create this secret in the Nix store (making it readable by everyone).
+          # DO NOT DO THIS OUTSIDE OF TESTS!!
+          secretFile = pkgs.writeText "session_secret" "not-secret";
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("autobrr.service")
+      machine.wait_for_open_port(7474)
+      machine.succeed("curl --fail http://localhost:7474/")
+    '';
+  }
+)

From f85dd001888fb12014c3f717497cb5b5687fa2f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Jan 2025 05:45:29 +0000
Subject: [PATCH 26/33] python312Packages.oslo-concurrency: 6.2.0 -> 7.0.0

---
 pkgs/development/python-modules/oslo-concurrency/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oslo-concurrency/default.nix b/pkgs/development/python-modules/oslo-concurrency/default.nix
index 4fbc6bb45418..7d69dcfcbaee 100644
--- a/pkgs/development/python-modules/oslo-concurrency/default.nix
+++ b/pkgs/development/python-modules/oslo-concurrency/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-concurrency";
-  version = "6.2.0";
+  version = "7.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.concurrency";
     inherit version;
-    hash = "sha256-q515k1EZ4ryw7et/hYcjaveEQkSrhxU3ILjKhDfRvgI=";
+    hash = "sha256-DLNz7ioTICQfkt4FqNHPS0eGBl7vYeol08goain6R2U=";
   };
 
   postPatch = ''

From 247a45ca82b4ac7d7dbdc2b86cb2285986007bb6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Jan 2025 06:35:38 +0000
Subject: [PATCH 27/33] python312Packages.python-novaclient: 18.7.0 -> 18.8.0

---
 pkgs/development/python-modules/python-novaclient/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 481827342f53..a9aaf4e443c6 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.7.0";
+  version = "18.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lMrQ8PTBYc7VKl7NhdE0/Wc7mX2nGUoDHAymk0Q0Cw0=";
+    hash = "sha256-ZtDYHe5pvcaTfMo7h4Jh8YNJWcYHiRUnp4knoBzqiAA=";
   };
 
   nativeBuildInputs = [

From da39b977de212d00fad8bba11f9a6bf00e645857 Mon Sep 17 00:00:00 2001
From: "\"Gaetan Lepage\"" <"gaetan@glepage.com">
Date: Fri, 17 Jan 2025 08:57:40 +0100
Subject: [PATCH 28/33] vimPlugins.coq-lsp-nvim: init at 2024-10-28

---
 pkgs/applications/editors/vim/plugins/generated.nix  | 12 ++++++++++++
 .../editors/vim/plugins/vim-plugin-names             |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ff41c7c5c92f..f5e67658096a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2837,6 +2837,18 @@ final: prev:
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
+  coq-lsp-nvim = buildVimPlugin {
+    pname = "coq-lsp.nvim";
+    version = "2024-10-28";
+    src = fetchFromGitHub {
+      owner = "tomtomjhj";
+      repo = "coq-lsp.nvim";
+      rev = "6135ed25fc2a1b4b1b6451ed206dc38b493ff1a2";
+      sha256 = "1vlz2kgc82rhycxp4qcz2bwssnzbv16wvr3gsigbl8b7rxjv5ivr";
+    };
+    meta.homepage = "https://github.com/tomtomjhj/coq-lsp.nvim/";
+  };
+
   coq-thirdparty = buildVimPlugin {
     pname = "coq.thirdparty";
     version = "2024-12-01";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 9390c0fc83d7..3032214e0dfa 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -233,6 +233,7 @@ https://github.com/zbirenbaum/copilot-cmp/,HEAD,
 https://github.com/AndreM222/copilot-lualine/,HEAD,
 https://github.com/zbirenbaum/copilot.lua/,HEAD,
 https://github.com/github/copilot.vim/,,
+https://github.com/tomtomjhj/coq-lsp.nvim/,HEAD,
 https://github.com/ms-jpq/coq.artifacts/,HEAD,
 https://github.com/ms-jpq/coq.thirdparty/,HEAD,
 https://github.com/jvoorhis/coq.vim/,,

From 5396e99b865255702569d83366b185d75f25e813 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 17 Jan 2025 09:02:43 +0100
Subject: [PATCH 29/33] python312Packages.python-novaclient: update disabled

---
 pkgs/development/python-modules/python-novaclient/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index a9aaf4e443c6..7717ff1bea52 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   version = "18.8.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;

From 007496f756d0e604fdb72d7035ce86ebbfd04112 Mon Sep 17 00:00:00 2001
From: Augustin Trancart <augustin.trancart@gmail.com>
Date: Thu, 19 Dec 2024 23:28:16 +0100
Subject: [PATCH 30/33] postgis: add withSfcgal option

---
 pkgs/servers/sql/postgresql/ext/postgis.nix | 44 ++++++++++++++++-----
 1 file changed, 34 insertions(+), 10 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 1611fe05600e..133e25553d50 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -26,6 +26,8 @@
   automake,
   libtool,
   which,
+  sfcgal,
+  withSfcgal ? false,
 }:
 
 let
@@ -47,15 +49,18 @@ buildPostgresqlExtension (finalAttrs: {
     hash = "sha256-wh7Lav2vnKzGWuSvvMFvAaGV7ynD+KgPsFUgujdtzlA=";
   };
 
-  buildInputs = [
-    libxml2
-    geos
-    proj
-    gdal
-    json_c
-    protobufc
-    pcre2.dev
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
+  buildInputs =
+    [
+      libxml2
+      geos
+      proj
+      gdal
+      json_c
+      protobufc
+      pcre2.dev
+    ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin libiconv
+    ++ lib.optional withSfcgal sfcgal;
   nativeBuildInputs = [
     autoconf
     automake
@@ -87,7 +92,7 @@ buildPostgresqlExtension (finalAttrs: {
     "--with-gdalconfig=${gdal}/bin/gdal-config"
     "--with-jsondir=${json_c.dev}"
     "--disable-extension-upgrades-install"
-  ];
+  ] ++ lib.optional withSfcgal "--with-sfcgal=${sfcgal}/bin/sfcgal-config";
 
   makeFlags = [
     "PERL=${perl}/bin/perl"
@@ -130,6 +135,25 @@ buildPostgresqlExtension (finalAttrs: {
         end$$;
         -- st_makepoint goes through c code
         select st_makepoint(1, 1);
+      ''
+      + lib.optionalString withSfcgal ''
+        CREATE EXTENSION postgis_sfcgal;
+        do $$
+        begin
+          if postgis_sfcgal_version() <> '${sfcgal.version}' then
+            raise '"%" does not match "${sfcgal.version}"', postgis_sfcgal_version();
+          end if;
+        end$$;
+        CREATE TABLE geometries (
+          name varchar,
+          geom geometry(PolygonZ) NOT NULL
+        );
+
+        INSERT INTO geometries(name, geom) VALUES
+          ('planar geom', 'PolygonZ((1 1 0, 1 2 0, 2 2 0, 2 1 0, 1 1 0))'),
+          ('nonplanar geom', 'PolygonZ((1 1 1, 1 2 -1, 2 2 2, 2 1 0, 1 1 1))');
+
+        SELECT name from geometries where cg_isplanar(geom);
       '';
   };
 

From bf2ffa198c55aaea0127ae77031dd14613bade6e Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 17 Jan 2025 09:13:11 +0100
Subject: [PATCH 31/33] pylyzer: 0.0.76 -> 0.0.77

Diff: https://github.com/mtshiba/pylyzer/compare/refs/tags/v0.0.76...v0.0.77

Changelog: https://github.com/mtshiba/pylyzer/releases/tag/v0.0.77
---
 pkgs/by-name/py/pylyzer/package.nix | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/py/pylyzer/package.nix b/pkgs/by-name/py/pylyzer/package.nix
index 474b4438b2bb..7e969644a6db 100644
--- a/pkgs/by-name/py/pylyzer/package.nix
+++ b/pkgs/by-name/py/pylyzer/package.nix
@@ -7,24 +7,23 @@
   python3,
   makeWrapper,
   writeScriptBin,
-  which,
-  nix-update-script,
   versionCheckHook,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.76";
+  version = "0.0.77";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     tag = "v${version}";
-    hash = "sha256-1WBZ8i/JIIRRH11MNQma/o9VdMvN0eYopXt7Iwj1hZ8=";
+    hash = "sha256-MlDW3dNe9fdOzWp38VkjgoiqOYgBF+ezwTQE0+6SXCc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-dzp7HeEfM6UP3VgH56CQvnezZjg13YUszA+EsO2N4Os=";
+  cargoHash = "sha256-bkYRPwiB2BN4WNZ0HcOBiDbFyidftbHWyIDvJasnePc=";
 
   nativeBuildInputs = [
     git
@@ -45,20 +44,6 @@ rustPlatform.buildRustPackage rec {
     cp -r $HOME/.erg/ $out/lib/erg
   '';
 
-  nativeCheckInputs = [ which ];
-
-  checkFlags =
-    [
-      # this test causes stack overflow
-      # > thread 'exec_import' has overflowed its stack
-      "--skip=exec_import"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      # Dict({Str..Obj: Int}) does not implement Iterable(Str..Obj..Obj) and Indexable({"a"}..Obj, Int)
-      # https://github.com/mtshiba/pylyzer/issues/114
-      "--skip=exec_casting"
-    ];
-
   postFixup = ''
     wrapProgram $out/bin/pylyzer --set ERG_PATH $out/lib/erg
   '';

From 06bb5177c53580b9479b399db668177d0a708ccf Mon Sep 17 00:00:00 2001
From: FliegendeWurst <arne.keller@posteo.de>
Date: Fri, 17 Jan 2025 08:21:59 +0100
Subject: [PATCH 32/33] deepin.docparser: fix strictDeps build

---
 pkgs/desktops/deepin/library/docparser/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/desktops/deepin/library/docparser/default.nix b/pkgs/desktops/deepin/library/docparser/default.nix
index c1462f135d94..b30d4be40f74 100644
--- a/pkgs/desktops/deepin/library/docparser/default.nix
+++ b/pkgs/desktops/deepin/library/docparser/default.nix
@@ -8,6 +8,7 @@
   pugixml,
   libzip,
   libuuid,
+  libxml2,
   tinyxml-2,
 }:
 
@@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
     pugixml
     libzip
     libuuid
+    libxml2
     tinyxml-2
   ];
 

From f27773d6aba7fdc113122c2814718a325c02f87f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 17 Jan 2025 10:42:22 +0100
Subject: [PATCH 33/33] bacon: 3.7.0 -> 3.8.0

Diff: https://github.com/Canop/bacon/compare/refs/tags/v3.7.0...v3.8.0

Changelog: https://github.com/Canop/bacon/blob/v3.8.0/CHANGELOG.md
---
 pkgs/by-name/ba/bacon/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ba/bacon/package.nix b/pkgs/by-name/ba/bacon/package.nix
index f71293605050..1498df4f09bd 100644
--- a/pkgs/by-name/ba/bacon/package.nix
+++ b/pkgs/by-name/ba/bacon/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
@@ -9,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bacon";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${version}";
-    hash = "sha256-pw+EfmpDvMCKSHOeHiv06x13/tRuf053Zcj8z0eWnPs=";
+    hash = "sha256-IWjG1esLwiEnESmnDE5kpuMu+LFaNrIomgrZoktkA2Q=";
   };
 
-  cargoHash = "sha256-W1bDZSUBjPmb/7bOnE+E5byA0clJZ+qGJ4XYASAjfeU=";
+  cargoHash = "sha256-IQ8vTr5Z17ylcOCQ+iqKP6+tawZXd+pMiYoSH5h7Zjg=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = [ "--version" ];