From ed5c3f93c5d03b9c80969290fa5a15c4b1f62150 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sun, 24 Nov 2024 08:38:35 +0000
Subject: [PATCH 01/32] heaptrack: add patch for GCC 14

---
 pkgs/development/tools/profiling/heaptrack/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/profiling/heaptrack/default.nix b/pkgs/development/tools/profiling/heaptrack/default.nix
index 88de0065e8ec..bc21f8178771 100644
--- a/pkgs/development/tools/profiling/heaptrack/default.nix
+++ b/pkgs/development/tools/profiling/heaptrack/default.nix
@@ -1,5 +1,5 @@
 {
-  lib, stdenv, mkDerivation, fetchFromGitHub, cmake, extra-cmake-modules, makeBinaryWrapper,
+  lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch, cmake, extra-cmake-modules, makeBinaryWrapper,
   zlib, boost179, libunwind, elfutils, sparsehash, zstd,
   qtbase, kio, kitemmodels, threadweaver, kconfigwidgets, kcoreaddons, kdiagram
 }:
@@ -15,6 +15,14 @@ mkDerivation rec {
     hash = "sha256-pP+s60ERnmOctYTe/vezCg0VYzziApNY0QaF3aTccZU=";
   };
 
+  patches = [
+    # cmake: Fix C compatibility of libunwind probes
+    (fetchpatch {
+      url = "https://invent.kde.org/sdk/heaptrack/-/commit/c6c45f3455a652c38aefa402aece5dafa492e8ab.patch";
+      hash = "sha256-eou53UUQX+S7yrz2RS95GwkAnNIZY/aaze0eAdjnbPU=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules makeBinaryWrapper ];
   buildInputs = [
     zlib boost179 libunwind sparsehash zstd

From d2b95778b58ac46c3127e022eb68abae7140ddcf Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sun, 24 Nov 2024 08:38:35 +0000
Subject: [PATCH 02/32] heaptrack: unpin Boost

---
 pkgs/development/tools/profiling/heaptrack/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/profiling/heaptrack/default.nix b/pkgs/development/tools/profiling/heaptrack/default.nix
index bc21f8178771..43c4a28d9a7b 100644
--- a/pkgs/development/tools/profiling/heaptrack/default.nix
+++ b/pkgs/development/tools/profiling/heaptrack/default.nix
@@ -1,6 +1,6 @@
 {
   lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch, cmake, extra-cmake-modules, makeBinaryWrapper,
-  zlib, boost179, libunwind, elfutils, sparsehash, zstd,
+  zlib, boost, libunwind, elfutils, sparsehash, zstd,
   qtbase, kio, kitemmodels, threadweaver, kconfigwidgets, kcoreaddons, kdiagram
 }:
 
@@ -25,7 +25,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake extra-cmake-modules makeBinaryWrapper ];
   buildInputs = [
-    zlib boost179 libunwind sparsehash zstd
+    zlib boost libunwind sparsehash zstd
     qtbase kio kitemmodels threadweaver kconfigwidgets kcoreaddons kdiagram
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     elfutils

From 7d0c25dca2b4db015bda6e7fb3fdcd3eb536889e Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 21 Dec 2024 12:00:00 +0000
Subject: [PATCH 03/32] nixos/sane: ensure saned can access usb scanners

For a user to be able to scan with an USB scanner, it must have write access
to the corresponding file in /dev/bus/usb. Enabling the sane module
adds SANE's upstream hwdb file and udev rules to udev search path. The
hwdb file tags the scanner as `libsane_matched` and a builtin (from
systemd upstream) udev rule marks all `libsane_matched` devices as
uaccess. When a physical user logins, logind adds an acl allowing them
to write to the device.

Unfortunately, saned is a daemon. Therefore, uaccess has no effect for
it, and if no other udev rule changes the device to belong to the
scanner group or the lp group, (there are such rules, but they are not
complete enough, in that some scanners known by SANE rules are not known
by these rules), it will not be able to write to the scanner.

This solves this by adding a udev rule so that all libsane_matched
devices have an acl rules so that users in the scanner group can write.

A similar rule is present on Arch and Debian at least.

Note that we don't chgroup the file instead, because this posed problems
in the past: scanners are often also printers, and a device's group
cannot be simultaneously lp and scanner.

Fixes: https://github.com/NixOS/nixpkgs/issues/361981
---
 nixos/modules/services/hardware/sane.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix
index 7afdb630b0a7..4a7398721f23 100644
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@@ -184,6 +184,12 @@ in
       environment.etc."sane-config".source = config.hardware.sane.configDir;
       environment.etc."sane-libs".source = "${saneConfig}/lib/sane";
       services.udev.packages = backends;
+      # sane sets up udev rules that tag scanners with `uaccess`. This way, physically logged in users
+      # can access them without belonging to the `scanner` group. However, the `scanner` user used by saned
+      # does not have a real logind seat, so `uaccess` is not enough.
+      services.udev.extraRules = ''
+        ENV{DEVNAME}!="", ENV{libsane_matched}=="yes", RUN+="${pkgs.acl}/bin/setfacl -m g:scanner:rw $env{DEVNAME}"
+      '';
 
       users.groups.scanner.gid = config.ids.gids.scanner;
       networking.firewall.allowedUDPPorts = lib.mkIf config.hardware.sane.openFirewall [ 8612 ];

From 18a8d8b4d8fcdb980070db5990963db95025e609 Mon Sep 17 00:00:00 2001
From: r17x <ri7nz@evilfactory.id>
Date: Sat, 21 Dec 2024 05:48:02 +0700
Subject: [PATCH 04/32] ocamlPackages.httpun-ws-lwt: init at 0.2.0

---
 .../ocaml-modules/httpun-ws/lwt.nix           | 27 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/httpun-ws/lwt.nix

diff --git a/pkgs/development/ocaml-modules/httpun-ws/lwt.nix b/pkgs/development/ocaml-modules/httpun-ws/lwt.nix
new file mode 100644
index 000000000000..e1f604d633cd
--- /dev/null
+++ b/pkgs/development/ocaml-modules/httpun-ws/lwt.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  buildDunePackage,
+  lwt,
+  digestif,
+  httpun-ws,
+  gluten-lwt,
+}:
+
+buildDunePackage {
+  pname = "httpun-ws-lwt";
+
+  inherit (httpun-ws) src version;
+
+  propagatedBuildInputs = [
+    httpun-ws
+    lwt
+    digestif
+    gluten-lwt
+  ];
+
+  doCheck = true;
+
+  meta = httpun-ws.meta // {
+    description = "Lwt support for httpun-ws";
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 1eb7e48874fd..38a06ba1011e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -705,6 +705,7 @@ let
 
     httpun-ws = callPackage ../development/ocaml-modules/httpun-ws { };
 
+    httpun-ws-lwt = callPackage ../development/ocaml-modules/httpun-ws/lwt.nix { };
     hxd = callPackage ../development/ocaml-modules/hxd { };
 
     ### I ###

From 8f8ffca8adb9cac9bf27a8f0ac58ca307d96f7b5 Mon Sep 17 00:00:00 2001
From: MilesCranmer <miles.cranmer@gmail.com>
Date: Tue, 24 Dec 2024 14:36:32 -0500
Subject: [PATCH 05/32] rip2: set up updateScript

---
 pkgs/by-name/ri/rip2/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/ri/rip2/package.nix b/pkgs/by-name/ri/rip2/package.nix
index c14b829c510b..fcce093a2b23 100644
--- a/pkgs/by-name/ri/rip2/package.nix
+++ b/pkgs/by-name/ri/rip2/package.nix
@@ -5,6 +5,7 @@
   versionCheckHook,
   installShellFiles,
   stdenv,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,6 +37,8 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/rip completions zsh)
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Safe and ergonomic alternative to rm";
     homepage = "https://github.com/MilesCranmer/rip2";

From d2d7c7e3e36eeeb3fd0756009533113c26d06c04 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Fri, 22 Nov 2024 00:04:52 +0000
Subject: [PATCH 06/32] ruff: Build as a standalone without Python

Using `buildPythonPackage` make `ruff` propagate the Python used for the build, which might not be the same Python as you want in your development shell.

https://github.com/NixOS/nixpkgs/pull/350654 changed the ruff top-level attribute to be built with Python modules.
This doesn't actually make much sense, we have versioned Python sets, and including just the one Python in the top-level package isn't helpful, and causes issues downstream related to PATH & PYTHONPATH.

See my related [uv PR](https://github.com/NixOS/nixpkgs/pull/357113#issue-2670270577).
---
 pkgs/by-name/ru/ruff-lsp/package.nix          |  2 +-
 pkgs/by-name/ru/ruff/package.nix              | 57 ++++++-------------
 .../python-modules/ruff/default.nix           | 35 ++++++++++++
 pkgs/top-level/python-packages.nix            |  4 +-
 4 files changed, 54 insertions(+), 44 deletions(-)
 create mode 100644 pkgs/development/python-modules/ruff/default.nix

diff --git a/pkgs/by-name/ru/ruff-lsp/package.nix b/pkgs/by-name/ru/ruff-lsp/package.nix
index 97b905e340c3..6214bb2d9332 100644
--- a/pkgs/by-name/ru/ruff-lsp/package.nix
+++ b/pkgs/by-name/ru/ruff-lsp/package.nix
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
     pytest-asyncio
     python-lsp-jsonrpc
-    ruff.bin
+    ruff
     versionCheckHook
   ];
   versionCheckProgramArg = [ "--version" ];
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index c9e2e78427f2..662b7409ec8e 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -1,11 +1,12 @@
 {
   lib,
   stdenv,
-  python3Packages,
-  fetchFromGitHub,
   rustPlatform,
+  fetchFromGitHub,
   installShellFiles,
+
   rust-jemalloc-sys,
+  buildPackages,
   versionCheckHook,
 
   # passthru
@@ -14,15 +15,9 @@
   nix-update-script,
 }:
 
-python3Packages.buildPythonPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "ruff";
   version = "0.8.4";
-  pyproject = true;
-
-  outputs = [
-    "bin"
-    "out"
-  ];
 
   src = fetchFromGitHub {
     owner = "astral-sh";
@@ -31,46 +26,29 @@ python3Packages.buildPythonPackage rec {
     hash = "sha256-c5d2XaoEjCHWMdjTLD6CnwP8rpSXTUrmKSs0QWQ6UG0=";
   };
 
-  # Do not rely on path lookup at runtime to find the ruff binary
-  postPatch = ''
-    substituteInPlace python/ruff/__main__.py \
-      --replace-fail \
-        'ruff_exe = "ruff" + sysconfig.get_config_var("EXE")' \
-        'return "${placeholder "bin"}/bin/ruff"'
-  '';
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-jbUjsIJRpkKYc+qHN8tkcZrcjPTFJfdCsatezzdX4Ss=";
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-jbUjsIJRpkKYc+qHN8tkcZrcjPTFJfdCsatezzdX4Ss=";
-  };
-
-  nativeBuildInputs =
-    [ installShellFiles ]
-    ++ (with rustPlatform; [
-      cargoSetupHook
-      maturinBuildHook
-      cargoCheckHook
-    ]);
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = [
     rust-jemalloc-sys
   ];
 
   postInstall =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
     ''
-      mkdir -p $bin/bin
-      mv $out/bin/ruff $bin/bin/
-      rmdir $out/bin
-    ''
-    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       installShellCompletion --cmd ruff \
-        --bash <($bin/bin/ruff generate-shell-completion bash) \
-        --fish <($bin/bin/ruff generate-shell-completion fish) \
-        --zsh <($bin/bin/ruff generate-shell-completion zsh)
+        --bash <(${emulator} $out/bin/ruff generate-shell-completion bash) \
+        --fish <(${emulator} $out/bin/ruff generate-shell-completion fish) \
+        --zsh <(${emulator} $out/bin/ruff generate-shell-completion zsh)
     '';
 
   # Run cargo tests
-  cargoCheckType = "debug";
+  checkType = "debug";
+
   # tests do not appear to respect linker options on doctests
   # Upstream issue: https://github.com/rust-lang/cargo/issues/14189
   # This causes errors like "error: linker `cc` not found" on static builds
@@ -106,12 +84,11 @@ python3Packages.buildPythonPackage rec {
     "--skip=unix::symlink_inside_workspace"
   ];
 
-  nativeCheckInputs = [
+  nativeInstallCheckInputs = [
     versionCheckHook
   ];
   versionCheckProgramArg = [ "--version" ];
-
-  pythonImportsCheck = [ "ruff" ];
+  doInstallCheck = true;
 
   passthru = {
     tests =
diff --git a/pkgs/development/python-modules/ruff/default.nix b/pkgs/development/python-modules/ruff/default.nix
new file mode 100644
index 000000000000..8f5efa9a240b
--- /dev/null
+++ b/pkgs/development/python-modules/ruff/default.nix
@@ -0,0 +1,35 @@
+{
+  buildPythonPackage,
+  pkgs,
+  rustPlatform,
+  installShellFiles,
+}:
+
+buildPythonPackage {
+  inherit (pkgs.ruff)
+    pname
+    version
+    src
+    cargoDeps
+    postInstall
+    meta
+    ;
+
+  # Do not rely on path lookup at runtime to find the ruff binary
+  postPatch = ''
+    substituteInPlace python/ruff/__main__.py \
+      --replace-fail \
+        'ruff_exe = "ruff" + sysconfig.get_config_var("EXE")' \
+        'return "${placeholder "out"}/bin/ruff"'
+  '';
+
+  pyproject = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "ruff" ];
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1a026f7d4d41..87b860855f5d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14282,9 +14282,7 @@ self: super: with self; {
 
   rubymarshal = callPackage ../development/python-modules/rubymarshal { };
 
-  ruff = toPythonModule (pkgs.ruff.override {
-    python3Packages = self;
-  });
+  ruff = callPackage ../development/python-modules/ruff { };
 
   ruff-api = callPackage ../development/python-modules/ruff-api { };
 

From 65e618753ce2d0cfde15e7aa5396e0fd01c3732b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Dec 2024 12:40:48 +0000
Subject: [PATCH 07/32] dep-tree: 0.23.0 -> 0.23.1

---
 pkgs/by-name/de/dep-tree/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/dep-tree/package.nix b/pkgs/by-name/de/dep-tree/package.nix
index 5c276b5686ff..57848ec9d392 100644
--- a/pkgs/by-name/de/dep-tree/package.nix
+++ b/pkgs/by-name/de/dep-tree/package.nix
@@ -32,7 +32,7 @@ let
     };
   };
   pname = "dep-tree";
-  version = "0.23.0";
+  version = "0.23.1";
 in
 buildGoModule {
   inherit pname version;
@@ -41,7 +41,7 @@ buildGoModule {
     owner = "gabotechs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Vd6g9UE3XEFGjCK8tFfOphYcNx+zeBS9rBVz0MDLe1I=";
+    hash = "sha256-Y+zNx+p8xmM0L4C5IELtepm7TQDhpxOVzgc1HxdFa0w=";
   };
 
   vendorHash = "sha256-KoVOjZq+RrJ2gzLnANHPPtbEY1ztC0rIXWD9AXAxqMg=";

From 7054001387eebc73f2232ae35b92288e58ddd2dc Mon Sep 17 00:00:00 2001
From: Florian Brandes <florian.brandes@posteo.de>
Date: Wed, 25 Dec 2024 16:24:28 +0100
Subject: [PATCH 08/32] spice-gtk: fix darwin build

fixes the error clang: error: unknown argument: '-export-symbols'
and also unknown argument --version-script=[...]

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
---
 pkgs/by-name/sp/spice-gtk/package.nix | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/sp/spice-gtk/package.nix b/pkgs/by-name/sp/spice-gtk/package.nix
index 182946d721bf..5dc9fa557a6b 100644
--- a/pkgs/by-name/sp/spice-gtk/package.nix
+++ b/pkgs/by-name/sp/spice-gtk/package.nix
@@ -155,17 +155,24 @@ stdenv.mkDerivation rec {
       "-Dcoroutine=gthread" # Fixes "Function missing:makecontext"
     ];
 
-  postPatch = ''
-    # get rid of absolute path to helper in store so we can use a setuid wrapper
-    substituteInPlace src/usb-acl-helper.c \
-      --replace 'ACL_HELPER_PATH"/' '"'
-    # don't try to setcap/suid in a nix builder
-    substituteInPlace src/meson.build \
-      --replace "meson.add_install_script('../build-aux/setcap-or-suid'," \
-      "# meson.add_install_script('../build-aux/setcap-or-suid',"
+  postPatch =
+    ''
+      # get rid of absolute path to helper in store so we can use a setuid wrapper
+      substituteInPlace src/usb-acl-helper.c \
+        --replace-fail 'ACL_HELPER_PATH"/' '"'
+      # don't try to setcap/suid in a nix builder
+      substituteInPlace src/meson.build \
+        --replace-fail "meson.add_install_script('../build-aux/setcap-or-suid'," \
+        "# meson.add_install_script('../build-aux/setcap-or-suid',"
 
-    patchShebangs subprojects/keycodemapdb/tools/keymap-gen
-  '';
+      patchShebangs subprojects/keycodemapdb/tools/keymap-gen
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # don't use version script and don't export symbols
+      substituteInPlace src/meson.build \
+        --replace-fail "spice_gtk_version_script = [" "# spice_gtk_version_script = [" \
+        --replace-fail ",--version-script=@0@'.format(spice_client_glib_syms_path)" "'"
+    '';
 
   meta = with lib; {
     description = "GTK 3 SPICE widget";

From 21615559ece58cad4164a5cc74694a8fc3322926 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Dec 2024 00:41:19 +0000
Subject: [PATCH 09/32] broot: 1.44.2 -> 1.44.3

---
 pkgs/by-name/br/broot/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/br/broot/package.nix b/pkgs/by-name/br/broot/package.nix
index f42b934c6909..df98fa357568 100644
--- a/pkgs/by-name/br/broot/package.nix
+++ b/pkgs/by-name/br/broot/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.44.2";
+  version = "1.44.3";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rMAGnC1CcHYPLh199a+aKgVdm/xheUQIRSvF+HqeZQE=";
+    hash = "sha256-45QNcnx9sEjm02woIpxxLuir4Kep8SPlSZDdiifZNL8=";
   };
 
-  cargoHash = "sha256-DVH7dKJEkyBnjNtLK/xfO+Hlw+rr3wTKqyooj5JM2is=";
+  cargoHash = "sha256-2hqpltfKE8fIFlvXMQfXVT41jPILL/INXQRUHfi1EhY=";
 
   nativeBuildInputs = [
     installShellFiles

From f298cd74e67a841289fd0f10ef4ee85cfbbc4133 Mon Sep 17 00:00:00 2001
From: totaltaxamount <shieldscoen@gmail.com>
Date: Thu, 26 Dec 2024 19:04:05 -0700
Subject: [PATCH 10/32] dmraid: patch dmevent_tool.c to compile on modern gcc
 versions

---
 pkgs/os-specific/linux/dmraid/default.nix     |  5 ++++-
 .../linux/dmraid/fix-dmevent_tool.patch       | 20 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch

diff --git a/pkgs/os-specific/linux/dmraid/default.nix b/pkgs/os-specific/linux/dmraid/default.nix
index ab366ad88ad5..78ccf00831e4 100644
--- a/pkgs/os-specific/linux/dmraid/default.nix
+++ b/pkgs/os-specific/linux/dmraid/default.nix
@@ -16,7 +16,10 @@ stdenv.mkDerivation rec {
   };
 
   patches =
-    [ ./hardening-format.patch ]
+    [
+      ./hardening-format.patch
+      ./fix-dmevent_tool.patch
+    ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [
       (fetchpatch {
         url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/006-musl-libc.patch";
diff --git a/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch b/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
new file mode 100644
index 000000000000..b7ef83cfa9b3
--- /dev/null
+++ b/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
@@ -0,0 +1,20 @@
+--- a/1.0.0.rc16/tools/dmevent_tool.c.old	2024-12-26 18:39:04.294039876 -0700
++++ a/1.0.0.rc16/tools/dmevent_tool.c	2024-12-26 18:45:59.416784807 -0700
+@@ -123,7 +123,7 @@
+ }
+ 
+ /* Increment option counters. */
+-static _process_opt(int opt, const char *cmd)
++static int _process_opt(int opt, const char *cmd)
+ {
+ 	struct opt_def_struct {
+ 		const char opt;		/* Option character. */
+@@ -148,7 +148,7 @@
+ 
+ 			optc[o->type]++;
+ 			optc[OPT_SUM]++;
+-			return;
++			return 0;
+ 		}
+ 	}
+ 

From b5d22b3c2a96ef72892868a7f6d5e6fd070ed18f Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 27 Dec 2024 14:01:33 +0400
Subject: [PATCH 11/32] =?UTF-8?q?devcontainer:=200.71.0=20=E2=86=92=200.72?=
 =?UTF-8?q?.0,=20fix=20build?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/de/devcontainer/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index c21b758b9af9..d852ff4e50c8 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -4,7 +4,7 @@
   fetchYarnDeps,
   fetchFromGitHub,
   fixup-yarn-lock,
-  nodejs,
+  nodejs_20,
   python3,
   makeBinaryWrapper,
   git,
@@ -12,15 +12,19 @@
   yarn,
   docker-compose,
 }:
+
+let
+  nodejs = nodejs_20; # does not build with 22
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "devcontainers";
     repo = "cli";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-plIDK5nOvLKFlRVlPHgpjHPhIh0NAWHmbaKsnYCU/7k=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3rSWD6uxwcMQdHBSmmAQ0aevqevVXINigCj06jjEcRc=";
   };
 
   yarnOfflineCache = fetchYarnDeps {

From 0dc79dda75c0cfb314daabd288f8385788665138 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 27 Dec 2024 13:23:49 +0100
Subject: [PATCH 12/32] python312Packages.pynordpool: 0.2.3 -> 0.2.4

Diff: https://github.com/gjohansson-ST/pynordpool/compare/refs/tags/v0.2.3...v0.2.4

Changelog: https://github.com/gjohansson-ST/pynordpool/releases/tag/v0.2.4
---
 pkgs/development/python-modules/pynordpool/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pynordpool/default.nix b/pkgs/development/python-modules/pynordpool/default.nix
index 3b2f0d6b51a0..38246ac14072 100644
--- a/pkgs/development/python-modules/pynordpool/default.nix
+++ b/pkgs/development/python-modules/pynordpool/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pynordpool";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "gjohansson-ST";
     repo = "pynordpool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QNPq2KKUDgxf2VQ/O+/dywLY6RcHfU2RaC2sohjVmaI=";
+    hash = "sha256-OGCVNVFbJfhjNKKpLRUvZIj7ZIYz/IVlt9xEPJb5W8E=";
   };
 
   build-system = [ poetry-core ];

From 7cbf57cb44a7074ab1d446ad437c683c9222ada6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 27 Dec 2024 13:25:18 +0100
Subject: [PATCH 13/32] python312Packages.bloodyad: 2.1.5 -> 2.1.7

Diff: https://github.com/CravateRouge/bloodyAD/compare/refs/tags/v2.1.5...v2.1.7

Changelog: https://github.com/CravateRouge/bloodyAD/releases/tag/v2.1.7
---
 pkgs/development/python-modules/bloodyad/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bloodyad/default.nix b/pkgs/development/python-modules/bloodyad/default.nix
index 34a601035813..5a37bd80e879 100644
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bloodyad";
-  version = "2.1.5";
+  version = "2.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "CravateRouge";
     repo = "bloodyAD";
     rev = "refs/tags/v${version}";
-    hash = "sha256-98Fm5c2BWRTuazVMM3v7s2ad5M0nOFQ+H+60whYhnDE=";
+    hash = "sha256-0BzVZ1aIjcq6D95hBjO+ahHaA48bmyaPAYHTAwQHaQg=";
   };
 
   build-system = [ hatchling ];

From 54dab203604e8a705ac6f9dc9a15241f9c99fc71 Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Fri, 27 Dec 2024 11:28:53 -0500
Subject: [PATCH 14/32] libfm: fix build

taken from https://github.com/ravenports/ravensource/tree/ad0d95339e569e69acfdd3e80cbe0bf4b9de1982/bucket_09/libfm/patches

closes #368573
---
 pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch  | 11 +++++++++++
 .../li/libfm/0002-exo-icon-view-key-press-event.patch | 11 +++++++++++
 pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch   | 11 +++++++++++
 pkgs/by-name/li/libfm/0004-create-icon-view.patch     | 11 +++++++++++
 pkgs/by-name/li/libfm/package.nix                     |  7 +++++++
 5 files changed, 51 insertions(+)
 create mode 100644 pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch
 create mode 100644 pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch
 create mode 100644 pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch
 create mode 100644 pkgs/by-name/li/libfm/0004-create-icon-view.patch

diff --git a/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch b/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch
new file mode 100644
index 000000000000..997300c07e3f
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch
@@ -0,0 +1,11 @@
+--- a/src/actions/action.c
++++ b/src/actions/action.c
+@@ -2047,7 +2047,7 @@
+ 	gchar* _tmp9_ = NULL;
+ 	_tmp0_ = fm_all_actions;
+ 	g_hash_table_remove_all (_tmp0_);
+-	_tmp2_ = _tmp1_ = g_get_system_data_dirs ();
++	_tmp2_ = _tmp1_ = (gchar **)g_get_system_data_dirs ();
+ 	dirs = _tmp2_;
+ 	dirs_length1 = _vala_array_length (_tmp1_);
+ 	_dirs_size_ = dirs_length1;
diff --git a/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch b/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch
new file mode 100644
index 000000000000..6f0965430112
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/exo/exo-icon-view.c
++++ b/src/gtk/exo/exo-icon-view.c
+@@ -2819,7 +2819,7 @@
+   /* allocate a new event to forward */
+   new_event = gdk_event_copy ((GdkEvent *) event);
+   g_object_unref (G_OBJECT (new_event->key.window));
+-  new_event->key.window = g_object_ref (G_OBJECT (gtk_widget_get_window (icon_view->priv->search_entry)));
++  new_event->key.window = (GdkWindow *)g_object_ref (G_OBJECT (gtk_widget_get_window (icon_view->priv->search_entry)));
+ 
+   /* send the event to the search entry. If the "preedit-changed" signal is
+    * emitted during this event, priv->search_imcontext_changed will be set.
diff --git a/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch b/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch
new file mode 100644
index 000000000000..6106ec9280f5
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/fm-dnd-dest.c
++++ b/src/gtk/fm-dnd-dest.c
+@@ -458,7 +458,7 @@
+             gtk_action_set_sensitive(act, FALSE);
+         }
+     }
+-    ri.menu = g_object_ref(gtk_ui_manager_get_widget(ui, "/popup"));
++    ri.menu = (GtkMenu *)g_object_ref(gtk_ui_manager_get_widget(ui, "/popup"));
+     g_signal_connect(ri.menu, "selection-done", G_CALLBACK(gtk_widget_destroy), NULL);
+     unmap_handler = g_signal_connect(ri.menu, "unmap",
+                                      G_CALLBACK(run_unmap_handler), &ri);
diff --git a/pkgs/by-name/li/libfm/0004-create-icon-view.patch b/pkgs/by-name/li/libfm/0004-create-icon-view.patch
new file mode 100644
index 000000000000..6a16b6446c89
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0004-create-icon-view.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/fm-standard-view.c
++++ b/src/gtk/fm-standard-view.c
+@@ -637,7 +637,7 @@
+                                 "text", FM_FOLDER_MODEL_COL_NAME );
+     if(fv->renderer_text)
+         g_object_unref(fv->renderer_text);
+-    fv->renderer_text = g_object_ref_sink(render);
++    fv->renderer_text = (FmCellRendererText *)g_object_ref_sink(render);
+     exo_icon_view_set_search_column((ExoIconView*)fv->view, FM_FOLDER_MODEL_COL_NAME);
+     g_signal_connect(fv->view, "item-activated", G_CALLBACK(on_icon_view_item_activated), fv);
+     g_signal_connect(fv->view, "selection-changed", G_CALLBACK(on_sel_changed), fv);
diff --git a/pkgs/by-name/li/libfm/package.nix b/pkgs/by-name/li/libfm/package.nix
index 8ce1a0b2ccfe..d762036a22d0 100644
--- a/pkgs/by-name/li/libfm/package.nix
+++ b/pkgs/by-name/li/libfm/package.nix
@@ -27,6 +27,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-pQQmMDBM+OXYz/nVZca9VG8ii0jJYBU+02ajTofK0eU=";
   };
 
+  patches = [
+    ./0001-fm-load-all-actions.patch
+    ./0002-exo-icon-view-key-press-event.patch
+    ./0003-ask-action-on-drop.patch
+    ./0004-create-icon-view.patch
+  ];
+
   nativeBuildInputs = [
     vala
     pkg-config

From 51a9200c0d8670525ad8df3a7bf321325b10325d Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Fri, 27 Dec 2024 17:36:51 +0000
Subject: [PATCH 15/32] nixos-rebuild-ng: remote-build{,-flake} ->
 build-remote{,-flake}

---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py     | 4 ++--
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 4 ++--
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py    | 8 ++++----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index f2adccb9ed9e..c3138a9c5042 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -395,7 +395,7 @@ def execute(argv: list[str]) -> None:
                 case (_, True, _, _):
                     raise NRError(f"--rollback is incompatible with '{action}'")
                 case (_, False, Remote(_), Flake(_)):
-                    path_to_config = nix.remote_build_flake(
+                    path_to_config = nix.build_remote_flake(
                         attr,
                         flake,
                         build_host,
@@ -412,7 +412,7 @@ def execute(argv: list[str]) -> None:
                         **flake_build_flags,
                     )
                 case (_, False, Remote(_), None):
-                    path_to_config = nix.remote_build(
+                    path_to_config = nix.build_remote(
                         attr,
                         build_attr,
                         build_host,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index c26a771c26f8..99b02b497aee 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -70,7 +70,7 @@ def build_flake(
     return Path(r.stdout.strip())
 
 
-def remote_build(
+def build_remote(
     attr: str,
     build_attr: BuildAttr,
     build_host: Remote | None,
@@ -124,7 +124,7 @@ def remote_build(
         run_wrapper(["rm", "-rf", remote_tmpdir], remote=build_host, check=False)
 
 
-def remote_build_flake(
+def build_remote_flake(
     attr: str,
     flake: Flake,
     build_host: Remote,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index c2bef1fffe97..d589b23ea4d0 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -76,7 +76,7 @@ def test_build_flake(mock_run: Any) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 @patch(get_qualified_name(n.uuid4, n), autospec=True)
-def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
+def test_build_remote(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     build_host = m.Remote("user@host", [], None)
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
@@ -97,7 +97,7 @@ def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     mock_run.side_effect = run_wrapper_side_effect
     mock_uuid4.side_effect = [uuid.UUID(int=1), uuid.UUID(int=2)]
 
-    assert n.remote_build(
+    assert n.build_remote(
         "config.system.build.toplevel",
         m.BuildAttr("<nixpkgs/nixos>", "preAttr"),
         build_host,
@@ -164,12 +164,12 @@ def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     autospec=True,
     return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
 )
-def test_remote_build_flake(mock_run: Any, monkeypatch: Any) -> None:
+def test_build_remote_flake(mock_run: Any, monkeypatch: Any) -> None:
     flake = m.Flake.parse(".#hostname")
     build_host = m.Remote("user@host", [], None)
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
-    assert n.remote_build_flake(
+    assert n.build_remote_flake(
         "config.system.build.toplevel",
         flake,
         build_host,

From 255c9b06272135ac3fc9b100098f947cbab69b2f Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Fri, 27 Dec 2024 17:41:13 +0000
Subject: [PATCH 16/32] nixos-rebuild-ng: TypeAlias -> type

---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index 11a0d9188294..4af16b62485b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -1,8 +1,8 @@
 import logging
 from collections.abc import Mapping, Sequence
-from typing import Any, TypeAlias, assert_never, override
+from typing import Any, assert_never, override
 
-Args: TypeAlias = bool | str | list[str] | int | None
+type Args = bool | str | list[str] | int | None
 
 
 class LogFormatter(logging.Formatter):

From 58e948dccc833978897748595de8db82b722c644 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Fri, 27 Dec 2024 18:03:02 +0000
Subject: [PATCH 17/32] nixos-rebuild-ng: add missing copy_flags for `nix copy`

---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 1 +
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py    | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 99b02b497aee..b776585d1b43 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -192,6 +192,7 @@ def copy_closure(
             [
                 "nix",
                 "copy",
+                *dict_to_flags(copy_flags),
                 "--from",
                 f"ssh://{from_host.host}",
                 "--to",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index d589b23ea4d0..d8bd5464aa76 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -237,9 +237,9 @@ def test_copy_closure(monkeypatch: Any) -> None:
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, None, build_host)
+        n.copy_closure(closure, None, build_host, copy_flag=True)
         mock_run.assert_called_with(
-            ["nix-copy-closure", "--from", "user@build.host", closure],
+            ["nix-copy-closure", "--copy-flag", "--from", "user@build.host", closure],
             extra_env={
                 "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-opt"])
             },
@@ -251,11 +251,12 @@ def test_copy_closure(monkeypatch: Any) -> None:
         "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-target-opt"])
     }
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, target_host, build_host)
+        n.copy_closure(closure, target_host, build_host, copy_flag=True)
         mock_run.assert_called_with(
             [
                 "nix",
                 "copy",
+                "--copy-flag",
                 "--from",
                 "ssh://user@build.host",
                 "--to",

From a376797b7bc66e627f19d29b60f8e60d199dceaf Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Fri, 27 Dec 2024 18:59:47 +0000
Subject: [PATCH 18/32] nixos-rebuild-ng: replace usage of kwargs

---
 .../src/nixos_rebuild/__init__.py             | 37 ++++++++++--------
 .../nixos-rebuild-ng/src/nixos_rebuild/nix.py | 38 +++++++++----------
 .../src/nixos_rebuild/utils.py                |  8 +++-
 .../nixos-rebuild-ng/src/tests/test_main.py   |  6 ++-
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 17 +++++----
 .../nixos-rebuild-ng/src/tests/test_utils.py  |  1 +
 6 files changed, 61 insertions(+), 46 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index c3138a9c5042..8204c499fe65 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -262,8 +262,8 @@ def parse_args(
 def reexec(
     argv: list[str],
     args: argparse.Namespace,
-    build_flags: dict[str, Args],
-    flake_build_flags: dict[str, Args],
+    build_flags: Args,
+    flake_build_flags: Args,
 ) -> None:
     drv = None
     attr = "config.system.build.nixos-rebuild"
@@ -271,10 +271,18 @@ def reexec(
         # Parsing the args here but ignore ask_sudo_password since it is not
         # needed and we would end up asking sudo password twice
         if flake := Flake.from_arg(args.flake, Remote.from_arg(args.target_host, None)):
-            drv = nix.build_flake(attr, flake, **flake_build_flags, no_link=True)
+            drv = nix.build_flake(
+                attr,
+                flake,
+                flake_build_flags | {"no_link": True},
+            )
         else:
             build_attr = BuildAttr.from_arg(args.attr, args.file)
-            drv = nix.build(attr, build_attr, **build_flags, no_out_link=True)
+            drv = nix.build(
+                attr,
+                build_attr,
+                build_flags | {"no_out_link": True},
+            )
     except CalledProcessError:
         logger.warning(
             "could not build a newer version of nixos-rebuild, "
@@ -350,7 +358,7 @@ def execute(argv: list[str]) -> None:
     flake = Flake.from_arg(args.flake, target_host)
 
     if can_run and not flake:
-        nixpkgs_path = nix.find_file("nixpkgs", **build_flags)
+        nixpkgs_path = nix.find_file("nixpkgs", build_flags)
         rev = nix.get_nixpkgs_rev(nixpkgs_path)
         if nixpkgs_path and rev:
             (nixpkgs_path / ".version-suffix").write_text(rev)
@@ -370,7 +378,10 @@ def execute(argv: list[str]) -> None:
 
             dry_run = action == Action.DRY_BUILD
             no_link = action in (Action.SWITCH, Action.BOOT)
+            build_flags |= {"no_out_link": no_link, "dry_run": dry_run}
+            flake_build_flags |= {"no_link": no_link, "dry_run": dry_run}
             rollback = bool(args.rollback)
+
             match action:
                 case Action.BUILD_VM:
                     attr = "config.system.build.vm"
@@ -407,9 +418,7 @@ def execute(argv: list[str]) -> None:
                     path_to_config = nix.build_flake(
                         attr,
                         flake,
-                        no_link=no_link,
-                        dry_run=dry_run,
-                        **flake_build_flags,
+                        flake_build_flags=flake_build_flags,
                     )
                 case (_, False, Remote(_), None):
                     path_to_config = nix.build_remote(
@@ -424,9 +433,7 @@ def execute(argv: list[str]) -> None:
                     path_to_config = nix.build(
                         attr,
                         build_attr,
-                        no_out_link=no_link,
-                        dry_run=dry_run,
-                        **build_flags,
+                        build_flags=build_flags,
                     )
                 case never:
                     # should never happen, but mypy is not smart enough to
@@ -442,7 +449,7 @@ def execute(argv: list[str]) -> None:
                     path_to_config,
                     to_host=target_host,
                     from_host=build_host,
-                    **copy_flags,
+                    copy_flags=copy_flags,
                 )
                 if action in (Action.SWITCH, Action.BOOT):
                     nix.set_profile(
@@ -468,7 +475,7 @@ def execute(argv: list[str]) -> None:
                     f"Done. The virtual machine can be started by running '{vm_path}'"
                 )
         case Action.EDIT:
-            nix.edit(flake, **flake_build_flags)
+            nix.edit(flake, flake_build_flags)
         case Action.DRY_RUN:
             assert False, "DRY_RUN should be a DRY_BUILD alias"
         case Action.LIST_GENERATIONS:
@@ -488,9 +495,9 @@ def execute(argv: list[str]) -> None:
                 print(tabulate(generations, headers=headers))
         case Action.REPL:
             if flake:
-                nix.repl_flake("toplevel", flake, **flake_build_flags)
+                nix.repl_flake("toplevel", flake, flake_build_flags)
             else:
-                nix.repl("system", build_attr, **build_flags)
+                nix.repl("system", build_attr, build_flags)
         case _:
             assert_never(action)
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index b776585d1b43..d0435504a019 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -32,7 +32,7 @@ logger = logging.getLogger(__name__)
 def build(
     attr: str,
     build_attr: BuildAttr,
-    **build_flags: Args,
+    build_flags: Args | None = None,
 ) -> Path:
     """Build NixOS attribute using classic Nix.
 
@@ -52,7 +52,7 @@ def build(
 def build_flake(
     attr: str,
     flake: Flake,
-    **flake_build_flags: Args,
+    flake_build_flags: Args | None = None,
 ) -> Path:
     """Build NixOS attribute using Flakes.
 
@@ -74,9 +74,9 @@ def build_remote(
     attr: str,
     build_attr: BuildAttr,
     build_host: Remote | None,
-    build_flags: dict[str, Args] | None = None,
-    instantiate_flags: dict[str, Args] | None = None,
-    copy_flags: dict[str, Args] | None = None,
+    build_flags: Args | None = None,
+    instantiate_flags: Args | None = None,
+    copy_flags: Args | None = None,
 ) -> Path:
     # We need to use `--add-root` otherwise Nix will print this warning:
     # > warning: you did not specify '--add-root'; the result might be removed
@@ -89,12 +89,12 @@ def build_remote(
             build_attr.to_attr(attr),
             "--add-root",
             tmpdir.TMPDIR_PATH / uuid4().hex,
-            *dict_to_flags(instantiate_flags or {}),
+            *dict_to_flags(instantiate_flags),
         ],
         stdout=PIPE,
     )
     drv = Path(r.stdout.strip()).resolve()
-    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    copy_closure(drv, to_host=build_host, from_host=None, copy_flags=copy_flags)
 
     # Need a temporary directory in remote to use in `nix-store --add-root`
     r = run_wrapper(
@@ -109,7 +109,7 @@ def build_remote(
                 drv,
                 "--add-root",
                 remote_tmpdir / uuid4().hex,
-                *dict_to_flags(build_flags or {}),
+                *dict_to_flags(build_flags),
             ],
             remote=build_host,
             stdout=PIPE,
@@ -128,9 +128,9 @@ def build_remote_flake(
     attr: str,
     flake: Flake,
     build_host: Remote,
-    flake_build_flags: dict[str, Args] | None = None,
-    copy_flags: dict[str, Args] | None = None,
-    build_flags: dict[str, Args] | None = None,
+    flake_build_flags: Args | None = None,
+    copy_flags: Args | None = None,
+    build_flags: Args | None = None,
 ) -> Path:
     r = run_wrapper(
         [
@@ -139,12 +139,12 @@ def build_remote_flake(
             "eval",
             "--raw",
             flake.to_attr(attr, "drvPath"),
-            *dict_to_flags(flake_build_flags or {}),
+            *dict_to_flags(flake_build_flags),
         ],
         stdout=PIPE,
     )
     drv = Path(r.stdout.strip())
-    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    copy_closure(drv, to_host=build_host, from_host=None, copy_flags=copy_flags)
     r = run_wrapper(
         [
             "nix",
@@ -152,7 +152,7 @@ def build_remote_flake(
             "build",
             f"{drv}^*",
             "--print-out-paths",
-            *dict_to_flags(build_flags or {}),
+            *dict_to_flags(build_flags),
         ],
         remote=build_host,
         stdout=PIPE,
@@ -164,7 +164,7 @@ def copy_closure(
     closure: Path,
     to_host: Remote | None,
     from_host: Remote | None = None,
-    **copy_flags: Args,
+    copy_flags: Args | None = None,
 ) -> None:
     """Copy a nix closure to or from host to localhost.
 
@@ -222,7 +222,7 @@ def copy_closure(
                 nix_copy_closure(to_host, to=True)
 
 
-def edit(flake: Flake | None, **flake_flags: Args) -> None:
+def edit(flake: Flake | None, flake_flags: Args | None = None) -> None:
     "Try to find and open NixOS configuration file in editor."
     if flake:
         run_wrapper(
@@ -251,7 +251,7 @@ def edit(flake: Flake | None, **flake_flags: Args) -> None:
             raise NRError("cannot find NixOS config file")
 
 
-def find_file(file: str, **nix_flags: Args) -> Path | None:
+def find_file(file: str, nix_flags: Args | None = None) -> Path | None:
     "Find classic Nix file location."
     r = run_wrapper(
         ["nix-instantiate", "--find-file", file, *dict_to_flags(nix_flags)],
@@ -421,14 +421,14 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
         )
 
 
-def repl(attr: str, build_attr: BuildAttr, **nix_flags: Args) -> None:
+def repl(attr: str, build_attr: BuildAttr, nix_flags: Args | None = None) -> None:
     run_args = ["nix", "repl", "--file", build_attr.path]
     if build_attr.attr:
         run_args.append(build_attr.attr)
     run_wrapper([*run_args, *dict_to_flags(nix_flags)])
 
 
-def repl_flake(attr: str, flake: Flake, **flake_flags: Args) -> None:
+def repl_flake(attr: str, flake: Flake, flake_flags: Args | None = None) -> None:
     expr = Template(
         files(__package__).joinpath(FLAKE_REPL_TEMPLATE).read_text()
     ).substitute(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index 4af16b62485b..edf4d8ccdaa3 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -2,7 +2,8 @@ import logging
 from collections.abc import Mapping, Sequence
 from typing import Any, assert_never, override
 
-type Args = bool | str | list[str] | int | None
+type Arg = bool | str | list[str] | int | None
+type Args = dict[str, Arg]
 
 
 class LogFormatter(logging.Formatter):
@@ -19,7 +20,10 @@ class LogFormatter(logging.Formatter):
         return formatter.format(record)
 
 
-def dict_to_flags(d: Mapping[str, Args]) -> list[str]:
+def dict_to_flags(d: Args | None) -> list[str]:
+    if not d:
+        return []
+
     flags = []
     for key, value in d.items():
         flag = f"--{'-'.join(key.split('_'))}"
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 23fd55283fce..79c02b395d37 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -123,8 +123,8 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
                     "<nixpkgs/nixos>",
                     "--attr",
                     "config.system.build.toplevel",
-                    "--no-out-link",
                     "-vvv",
+                    "--no-out-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -188,8 +188,8 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
                     "build",
                     "--print-out-paths",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel",
-                    "--no-link",
                     "-v",
+                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -349,6 +349,7 @@ def test_execute_nix_switch_flake_build_host(
                     "eval",
                     "--raw",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel.drvPath",
+                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -371,6 +372,7 @@ def test_execute_nix_switch_flake_build_host(
                     "build",
                     f"'{config_path}^*'",
                     "--print-out-paths",
+                    "--no-out-link",
                 ],
                 check=True,
                 stdout=PIPE,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index d8bd5464aa76..0afb8471f1c7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -21,7 +21,9 @@ from .helpers import get_qualified_name
 )
 def test_build(mock_run: Any, monkeypatch: Any) -> None:
     assert n.build(
-        "config.system.build.attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag="foo"
+        "config.system.build.attr",
+        m.BuildAttr("<nixpkgs/nixos>", None),
+        {"nix_flag": "foo"},
     ) == Path("/path/to/file")
     mock_run.assert_called_with(
         [
@@ -55,8 +57,7 @@ def test_build_flake(mock_run: Any) -> None:
     assert n.build_flake(
         "config.system.build.toplevel",
         flake,
-        no_link=True,
-        nix_flag="foo",
+        {"no_link": True, "nix_flag": "foo"},
     ) == Path("/path/to/file")
     mock_run.assert_called_with(
         [
@@ -237,7 +238,7 @@ def test_copy_closure(monkeypatch: Any) -> None:
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, None, build_host, copy_flag=True)
+        n.copy_closure(closure, None, build_host, {"copy_flag": True})
         mock_run.assert_called_with(
             ["nix-copy-closure", "--copy-flag", "--from", "user@build.host", closure],
             extra_env={
@@ -251,7 +252,7 @@ def test_copy_closure(monkeypatch: Any) -> None:
         "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-target-opt"])
     }
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, target_host, build_host, copy_flag=True)
+        n.copy_closure(closure, target_host, build_host, {"copy_flag": True})
         mock_run.assert_called_with(
             [
                 "nix",
@@ -287,7 +288,7 @@ def test_copy_closure(monkeypatch: Any) -> None:
 def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
     # Flake
     flake = m.Flake.parse(".#attr")
-    n.edit(flake, commit_lock_file=True)
+    n.edit(flake, {"commit_lock_file": True})
     mock_run.assert_called_with(
         [
             "nix",
@@ -472,7 +473,7 @@ def test_list_generations(mock_get_generations: Any, tmp_path: Path) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl(mock_run: Any) -> None:
-    n.repl("attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag=True)
+    n.repl("attr", m.BuildAttr("<nixpkgs/nixos>", None), {"nix_flag": True})
     mock_run.assert_called_with(
         ["nix", "repl", "--file", "<nixpkgs/nixos>", "--nix-flag"]
     )
@@ -483,7 +484,7 @@ def test_repl(mock_run: Any) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl_flake(mock_run: Any) -> None:
-    n.repl_flake("attr", m.Flake(Path("flake.nix"), "myAttr"), nix_flag=True)
+    n.repl_flake("attr", m.Flake(Path("flake.nix"), "myAttr"), {"nix_flag": True})
     # See nixos-rebuild-ng.tests.repl for a better test,
     # this is mostly for sanity check
     assert mock_run.call_count == 1
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
index b1cd52e0b121..de573a2b55a2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
@@ -4,6 +4,7 @@ import nixos_rebuild.utils as u
 
 
 def test_dict_to_flags() -> None:
+    assert u.dict_to_flags(None) == []
     r1 = u.dict_to_flags(
         {
             "test_flag_1": True,

From 94af3fd60e4111d782fcaeca3844b30c424f8295 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Fri, 27 Dec 2024 15:57:56 -0500
Subject: [PATCH 19/32] python312Packages.debugpy: fix hash due to
 .gitattributes

---
 pkgs/development/python-modules/debugpy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index d3d212926c55..e907a0daa7da 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "debugpy";
     tag = "v${version}";
-    hash = "sha256-jq/0Z6Oo/9gjJlziYJIjIC5i9YMayUdPYSGTjnDL8yU=";
+    hash = "sha256-C/cLUMQNmiLn3z93LOg++3WeDUihMR9O3XKouL4uPqw=";
   };
 
   patches =

From 8c23517cc6c65bd65b947d68988cbebdfb148f5d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 27 Dec 2024 22:15:44 +0100
Subject: [PATCH 20/32] python312Packages.tencentcloud-sdk-python: 3.0.1290 ->
 3.0.1291

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/refs/tags/3.0.1290...3.0.1291

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.0.1291/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 30c83cb86004..b3d177f36e9e 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1290";
+  version = "3.0.1291";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-sGIJKU3q+TGDMW6LWtbyiGq1wv1iFRQJ2MBtjK+zqqY=";
+    hash = "sha256-Kc+gnY1swnN2Rle/JHPJlopziYbCIFijRKVZx5Phs8w=";
   };
 
   build-system = [ setuptools ];

From 3dc1c99320480040f1abbe9a425986fcca9834ae Mon Sep 17 00:00:00 2001
From: Valentin Bruch <software@vbruch.eu>
Date: Fri, 27 Dec 2024 23:40:33 +0100
Subject: [PATCH 21/32] beamerpresenter: 0.2.5 -> 0.2.6

https://github.com/stiglers-eponym/BeamerPresenter/blob/main/CHANGELOG.md
---
 pkgs/applications/office/beamerpresenter/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index 5bfb8a260b0b..887ded477918 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "beamerpresenter";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "stiglers-eponym";
     repo = "BeamerPresenter";
     rev = "v${version}";
-    hash = "sha256-ofS0KMsn0KG8squIvMPxSCgE/qNK+Kd47psNziLBBoo=";
+    hash = "sha256-sPeWlPkWOPfLAoAC/+T7nyhPqvoaZg6aMOIVLjMqd2k=";
   };
 
   nativeBuildInputs = [

From f25fb0d388092d5ba828b467d25a7cbd1c2e6367 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Fri, 27 Dec 2024 23:21:27 +0000
Subject: [PATCH 22/32] nixos-rebuild-ng: fix eval flags for
 nix.build_remote_flake

---
 .../src/nixos_rebuild/__init__.py             | 33 ++++++++++---------
 .../nixos-rebuild-ng/src/nixos_rebuild/nix.py |  8 ++---
 .../nixos-rebuild-ng/src/tests/test_main.py   |  3 +-
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py |  4 +--
 4 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 8204c499fe65..73788bb8ccfe 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -43,19 +43,19 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
     common_build_flags.add_argument("--show-trace", action="store_true")
 
-    flake_build_flags = argparse.ArgumentParser(add_help=False)
-    flake_build_flags.add_argument("--accept-flake-config", action="store_true")
-    flake_build_flags.add_argument("--refresh", action="store_true")
-    flake_build_flags.add_argument("--impure", action="store_true")
-    flake_build_flags.add_argument("--offline", action="store_true")
-    flake_build_flags.add_argument("--no-net", action="store_true")
-    flake_build_flags.add_argument("--recreate-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-update-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-write-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-registries", action="store_true")
-    flake_build_flags.add_argument("--commit-lock-file", action="store_true")
-    flake_build_flags.add_argument("--update-input")
-    flake_build_flags.add_argument("--override-input", nargs=2)
+    flake_common_flags = argparse.ArgumentParser(add_help=False)
+    flake_common_flags.add_argument("--accept-flake-config", action="store_true")
+    flake_common_flags.add_argument("--refresh", action="store_true")
+    flake_common_flags.add_argument("--impure", action="store_true")
+    flake_common_flags.add_argument("--offline", action="store_true")
+    flake_common_flags.add_argument("--no-net", action="store_true")
+    flake_common_flags.add_argument("--recreate-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-update-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-write-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-registries", action="store_true")
+    flake_common_flags.add_argument("--commit-lock-file", action="store_true")
+    flake_common_flags.add_argument("--update-input")
+    flake_common_flags.add_argument("--override-input", nargs=2)
 
     classic_build_flags = argparse.ArgumentParser(add_help=False)
     classic_build_flags.add_argument("--no-build-output", "-Q", action="store_true")
@@ -74,7 +74,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     sub_parsers = {
         "common_flags": common_flags,
         "common_build_flags": common_build_flags,
-        "flake_build_flags": flake_build_flags,
+        "flake_common_flags": flake_common_flags,
         "classic_build_flags": classic_build_flags,
         "copy_flags": copy_flags,
     }
@@ -327,7 +327,8 @@ def execute(argv: list[str]) -> None:
     common_flags = vars(args_groups["common_flags"])
     common_build_flags = common_flags | vars(args_groups["common_build_flags"])
     build_flags = common_build_flags | vars(args_groups["classic_build_flags"])
-    flake_build_flags = common_build_flags | vars(args_groups["flake_build_flags"])
+    flake_common_flags = common_flags | vars(args_groups["flake_common_flags"])
+    flake_build_flags = common_build_flags | flake_common_flags
     copy_flags = common_flags | vars(args_groups["copy_flags"])
 
     if args.upgrade or args.upgrade_all:
@@ -410,9 +411,9 @@ def execute(argv: list[str]) -> None:
                         attr,
                         flake,
                         build_host,
+                        eval_flags=flake_common_flags,
                         flake_build_flags=flake_build_flags,
                         copy_flags=copy_flags,
-                        build_flags=build_flags,
                     )
                 case (_, False, None, Flake(_)):
                     path_to_config = nix.build_flake(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index d0435504a019..876a9a06c9c7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -128,9 +128,9 @@ def build_remote_flake(
     attr: str,
     flake: Flake,
     build_host: Remote,
-    flake_build_flags: Args | None = None,
+    eval_flags: Args | None = None,
     copy_flags: Args | None = None,
-    build_flags: Args | None = None,
+    flake_build_flags: Args | None = None,
 ) -> Path:
     r = run_wrapper(
         [
@@ -139,7 +139,7 @@ def build_remote_flake(
             "eval",
             "--raw",
             flake.to_attr(attr, "drvPath"),
-            *dict_to_flags(flake_build_flags),
+            *dict_to_flags(eval_flags),
         ],
         stdout=PIPE,
     )
@@ -152,7 +152,7 @@ def build_remote_flake(
             "build",
             f"{drv}^*",
             "--print-out-paths",
-            *dict_to_flags(build_flags),
+            *dict_to_flags(flake_build_flags),
         ],
         remote=build_host,
         stdout=PIPE,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 79c02b395d37..63ae24147929 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -349,7 +349,6 @@ def test_execute_nix_switch_flake_build_host(
                     "eval",
                     "--raw",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel.drvPath",
-                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -372,7 +371,7 @@ def test_execute_nix_switch_flake_build_host(
                     "build",
                     f"'{config_path}^*'",
                     "--print-out-paths",
-                    "--no-out-link",
+                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 0afb8471f1c7..a040d60e6368 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -174,9 +174,9 @@ def test_build_remote_flake(mock_run: Any, monkeypatch: Any) -> None:
         "config.system.build.toplevel",
         flake,
         build_host,
-        flake_build_flags={"flake": True},
+        eval_flags={"flake": True},
         copy_flags={"copy": True},
-        build_flags={"build": True},
+        flake_build_flags={"build": True},
     ) == Path("/path/to/file")
     mock_run.assert_has_calls(
         [

From 33de8dc7bf6e415074103433b61a3283c477000f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Dec 2024 00:55:04 +0000
Subject: [PATCH 23/32] taschenrechner: 1.4.0 -> 1.5.0

---
 pkgs/by-name/ta/taschenrechner/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/taschenrechner/package.nix b/pkgs/by-name/ta/taschenrechner/package.nix
index fa8d7170dd6f..48e8c181afaf 100644
--- a/pkgs/by-name/ta/taschenrechner/package.nix
+++ b/pkgs/by-name/ta/taschenrechner/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taschenrechner";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.fem-net.de";
     owner = "mabl";
     repo = "taschenrechner";
     rev = version;
-    hash = "sha256-5Vml6UeiWz7fNA+vEQ/Ita2YI8dGgDclqkzQ848AwVk=";
+    hash = "sha256-ZZVghL0R3p5sE8V9Z0MsmTiCacuE2RXohQQEYJYgp/o=";
   };
 
-  cargoHash = "sha256-BZGkdHR66O3GjKl9yM/bKxdGdvWFB/YO2Egg6V/wuB8=";
+  cargoHash = "sha256-xZ3Ki1HLzF7A1+83GQNTBgRjn802Z9ZAKENKB5CykCc=";
 
   meta = with lib; {
     description = "Cli-calculator written in Rust";

From 58c6135aa8095b8c474dd631af939e9426166826 Mon Sep 17 00:00:00 2001
From: John Chadwick <john@jchw.io>
Date: Fri, 27 Dec 2024 22:01:49 -0500
Subject: [PATCH 24/32] lxsession: fix build with gcc 14

---
 pkgs/desktops/lxde/core/lxsession/default.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/desktops/lxde/core/lxsession/default.nix b/pkgs/desktops/lxde/core/lxsession/default.nix
index 74e49b6bb273..ab6b77429d9a 100644
--- a/pkgs/desktops/lxde/core/lxsession/default.nix
+++ b/pkgs/desktops/lxde/core/lxsession/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   autoconf,
   automake,
@@ -28,7 +29,17 @@ stdenv.mkDerivation rec {
     sha256 = "17sqsx57ymrimm5jfmcyrp7b0nzi41bcvpxsqckmwbhl19g6c17d";
   };
 
-  patches = [ ./xmlcatalog_patch.patch ];
+  patches = [
+    ./xmlcatalog_patch.patch
+
+    # lxsession compilation is broken upstream as of GCC 14
+    # https://sourceforge.net/p/lxde/bugs/973/
+    (fetchpatch {
+      name = "0001-Fix-build-on-GCC-14.patch";
+      url = "https://sourceforge.net/p/lxde/bugs/973/attachment/0001-Fix-build-on-GCC-14.patch";
+      hash = "sha256-lxF3HZy5uLK7Cfu8W1A03syZf7OWXpHiU2Fk+xBl39g=";
+    })
+  ];
 
   nativeBuildInputs = [
     autoconf

From 68526a61402e31d4764fbe3a3f38c09bb3fc2ef8 Mon Sep 17 00:00:00 2001
From: Ryan Cao <70191398+ryanccn@users.noreply.github.com>
Date: Sat, 28 Dec 2024 12:31:36 +0800
Subject: [PATCH 25/32] cargo-cache: fix compilation on darwin

---
 pkgs/development/tools/rust/cargo-cache/default.nix | 6 ++----
 pkgs/top-level/all-packages.nix                     | 4 +---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-cache/default.nix b/pkgs/development/tools/rust/cargo-cache/default.nix
index 7b8b60ad4125..2021101430d8 100644
--- a/pkgs/development/tools/rust/cargo-cache/default.nix
+++ b/pkgs/development/tools/rust/cargo-cache/default.nix
@@ -3,8 +3,7 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  libiconv,
-  Security,
+  zlib,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,8 +20,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-275QREIcncgBk4ah/CivSz5N2m6s/XPCfp6JGChpr38=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libiconv
-    Security
+    zlib
   ];
 
   checkFlags = [ "offline_tests" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 040035177ea0..be8f29cb7d80 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6822,9 +6822,7 @@ with pkgs;
   cargo-bazel = callPackage ../development/tools/rust/cargo-bazel {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-cache = callPackage ../development/tools/rust/cargo-cache {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-cache = callPackage ../development/tools/rust/cargo-cache { };
   cargo-crev = callPackage ../development/tools/rust/cargo-crev {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
   };

From 99833b11834cf65ff9f50b576bd95dc41e668163 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Sat, 28 Dec 2024 13:46:04 +0800
Subject: [PATCH 26/32] jamesdsp: fix build

---
 pkgs/applications/audio/jamesdsp/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/applications/audio/jamesdsp/default.nix b/pkgs/applications/audio/jamesdsp/default.nix
index 6dd5c4bba8ba..823d11b55caa 100644
--- a/pkgs/applications/audio/jamesdsp/default.nix
+++ b/pkgs/applications/audio/jamesdsp/default.nix
@@ -66,6 +66,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   qmakeFlags = lib.optionals usePulseaudio [ "CONFIG+=USE_PULSEAUDIO" ];
 
+  # https://github.com/Audio4Linux/JDSP4Linux/issues/228
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=incompatible-pointer-types"
+    "-Wno-error=implicit-int"
+    "-Wno-error=implicit-function-declaration"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "jamesdsp";

From ea75d7fbb144536e2c7ff4d35a5b97a786749d1d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Dec 2024 06:36:13 +0000
Subject: [PATCH 27/32] opnborg: 0.1.49 -> 0.1.51

---
 pkgs/by-name/op/opnborg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index f531ea44bd8b..3adf8953bc38 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "opnborg";
-  version = "0.1.49";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     rev = "v${version}";
-    hash = "sha256-q6TwYTVDDNLc9iRFQT9oFtT6SyF1zlJbQ9JH+SRfiSc=";
+    hash = "sha256-HcQl5R+xzk5HUVBUecI7KsrCfz/WK80hZ4oCOSHOGs8=";
   };
 
   vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";

From bf655929352a55e4d443eb10667b84740bd6e708 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Sat, 28 Dec 2024 15:00:12 +0800
Subject: [PATCH 28/32] deepin.deepin-system-monitor: fix build with gcc 14

---
 pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
index 80415ec8640d..97ee4c8ba8f1 100644
--- a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   strictDeps = true;
 
   meta = with lib; {

From 3f4d0743199e0b31dbf65ee840377e9fc7428399 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 28 Dec 2024 02:04:27 +0100
Subject: [PATCH 29/32] =?UTF-8?q?gegl:=200.4.50=20=E2=86=92=200.4.52?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gegl/-/compare/GEGL_0_4_50...GEGL_0_4_52
---
 pkgs/development/libraries/gegl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index dc061e0da1ef..b81cbf65263a 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -38,7 +38,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gegl";
-  version = "0.4.50";
+  version = "0.4.52";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YISWmwbuhspxFCEzdz8n4T8C5aaiLCz85FLsqt23kME=";
+    hash = "sha256-yiEqD8PgRIxQWMUcpqDTD9+wKXHyHyiCDaK0kBOWAAo=";
   };
 
   nativeBuildInputs = [

From 8dadf0616b00a78245fb62761f98a44698be8a27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Dec 2024 08:42:58 +0000
Subject: [PATCH 30/32] ananicy-rules-cachyos: 0-unstable-2024-12-17 ->
 0-unstable-2024-12-27

---
 pkgs/by-name/an/ananicy-rules-cachyos/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 6b6d43f5233b..8479675f0be1 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-12-17";
+  version = "0-unstable-2024-12-27";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "c942e9a4a606a27fda4aff5754dd2e397ea5d310";
-    hash = "sha256-4qbvXaGh6zcTwn2dKbVZSfbroBQ9xh02FCq/0t/8sjY=";
+    rev = "8e8452c210f005e409f6b1eddbb2907e8db0a6d3";
+    hash = "sha256-73MltJrKlTvj+ijjhbNQsxGl05KGx+jioSrFGA6IdxE=";
   };
 
   dontConfigure = true;

From 1f3bead4878556157fab1481f6ca2736390d920c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Dec 2024 10:19:23 +0100
Subject: [PATCH 31/32] uv: 0.5.12 -> 0.5.13

Diff: https://github.com/astral-sh/uv/compare/None...0.5.13

Changelog: https://github.com/astral-sh/uv/blob/0.5.13/CHANGELOG.md
---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 0b73c101ce79..ad6684023ca2 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.5.12";
+  version = "0.5.13";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = version;
-    hash = "sha256-opTZzNi9cguceD3qdWsIxAYbymu25wFFKOIGhWu958Q=";
+    hash = "sha256-W24bw+fQk7DoHPGFtUiIPybxuCa03o1ngAXqVwU/Z7E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hplzzsbS81GRS8L0Goh7vvzyv6xCAe0CN6KRvJ0GUdc=";
+  cargoHash = "sha256-CN4ZqYeZktcQT0Pro8rfnzri6i0xranmYdroKzwkK6A=";
 
   nativeBuildInputs = [
     cmake

From 4b5bbe915e35867f863637ece936e5823851fc9e Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Dec 2024 10:44:41 +0100
Subject: [PATCH 32/32] nixos/zfs-replication: fix typo

---
 nixos/modules/services/backup/zfs-replication.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix
index f6dc40171d1b..ed635a35617b 100644
--- a/nixos/modules/services/backup/zfs-replication.nix
+++ b/nixos/modules/services/backup/zfs-replication.nix
@@ -92,7 +92,7 @@ in
             ++ (lib.optional cfg.followDelete "--follow-delete")
           );
         in
-        "${lib.getExe cfg.package} ${lib.concatStringSep " " args}";
+        "${lib.getExe cfg.package} ${lib.concatStringsSep " " args}";
       wantedBy = [
         "zfs-snapshot-daily.service"
         "zfs-snapshot-frequent.service"