diff --git a/.github/labeler.yml b/.github/labeler.yml
index eca2a2527037..485bcce6a8a4 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -385,9 +385,11 @@
     - changed-files:
       - any-glob-to-any-file:
         - nixos/modules/virtualisation/xen*
-        - pkgs/applications/virtualization/xen/**
+        - pkgs/by-name/xe/xen/*
+        - pkgs/by-name/qe/qemu_xen/*
         - pkgs/by-name/xe/xen-guest-agent/*
         - pkgs/by-name/xt/xtf/*
+        - pkgs/build-support/xen/*
         - pkgs/development/ocaml-modules/xen*/*
         - pkgs/development/ocaml-modules/vchan/*
 
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 77828110cc4f..e0127bd3d47d 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -411,7 +411,7 @@ let
     };
   };
 
-  pythonEnv =  testPython.withPackages (ps: [ ps.my-editable ]);
+  pythonEnv =  myPython.withPackages (ps: [ ps.my-editable ]);
 
 in pkgs.mkShell {
   packages = [ pythonEnv ];
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index f5d1d3016a78..cae573c3452a 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -252,7 +252,7 @@ In addition to numerous new and updated packages, this release has the following
   }
   ```
 
-- The default module options for [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall), [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) and [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) have been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
+- The default module options for [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall), [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) and `services.unifi-video.openFirewall` have been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
 
 - The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using
 
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index a5fc0ff324ab..ead196249848 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -54,12 +54,11 @@
   was added through the `boot.initrd.systemd.dmVerity` option.
 
 - The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
-  - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems.
+  - This release includes Xen [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes) and support for booting the hypervisor on EFI systems.
   ::: {.warning}
     Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
   :::
-  - There are two flavours of Xen available by default: `xen`, which includes all built-in components, and `xen-slim`, which replaces the built-in components with their Nixpkgs equivalents.
-    - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer available in any of the Xen Project Hypervisor packages.
+  - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer included in the Xen build.
   - The OCaml-based Xen Store can now be configured using  [`virtualisation.xen.store.settings`](#opt-virtualisation.xen.store.settings).
   - The `virtualisation.xen.bridge` options have been deprecated in this release cycle. Users who need network bridges are encouraged to set up their own networking configurations.
 
@@ -187,6 +186,12 @@
   - `transmission-gtk`: `~/.config/transmission`
   - `transmission-daemon` using NixOS module: `${config.services.transmission.home}/.config/transmission-daemon` (defaults to `/var/lib/transmission/.config/transmission-daemon`)
 
+- The default `mongodb` version has been updated from 5.0 to 7.0.
+  For more information, see the compatibility changes for MongoDB [6.0](https://www.mongodb.com/docs/manual/release-notes/6.0-compatibility/) and [7.0](https://www.mongodb.com/docs/manual/release-notes/7.0-compatibility/).
+
+- `unifi` has been updated to UniFi 8.
+  `unifi7` was removed as it is vulnerable to CVE-2024-42025 and required a version of MongoDB that has reached end of life.
+
 - `androidenv.androidPkgs_9_0` has been removed, and replaced with `androidenv.androidPkgs` for a more complete Android SDK including support for Android 9 and later.
 
 - `grafana` has been updated to version 11.1. This version doesn't support setting `http_addr` to a hostname anymore, an IP address is expected.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index bf9b3db4b967..193cb43118f4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1375,7 +1375,6 @@
   ./services/video/mirakurun.nix
   ./services/video/photonvision.nix
   ./services/video/mediamtx.nix
-  ./services/video/unifi-video.nix
   ./services/video/v4l2-relayd.nix
   ./services/wayland/cage.nix
   ./services/wayland/hypridle.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 63f612eec960..762c3ddbae9a 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -108,6 +108,7 @@ in
       used instead.
     '')
     (mkRemovedOptionModule [ "services" "tvheadend" ] "The tvheadend package and the corresponding module have been removed as nobody was willing to maintain them and they were stuck on an unmaintained version that required FFmpeg 4; please see https://github.com/NixOS/nixpkgs/pull/332259 if you are interested in maintaining a newer version.")
+    (mkRemovedOptionModule [ "services" "unifi-video" ] "The unifi-video package and the corresponding module have been removed as the software has been unsupported since 2021 and requires a MongoDB version that has reached end of life.")
     (mkRemovedOptionModule [ "services" "venus" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "wakeonlan"] "This module was removed in favor of enabling it with networking.interfaces.<name>.wakeOnLan")
     (mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index 38908e3d6f1d..8c5bc82ffcb1 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -2,8 +2,8 @@
 let
   cfg = config.services.unifi;
   stateDir = "/var/lib/unifi";
-  cmd = lib.escapeShellArgs ([ "@${cfg.jrePackage}/bin/java" "java" ]
-    ++ lib.optionals (lib.versionAtLeast (lib.getVersion cfg.jrePackage) "16") [
+  cmd = lib.escapeShellArgs ([
+      "@${cfg.jrePackage}/bin/java" "java"
       "--add-opens=java.base/java.lang=ALL-UNNAMED"
       "--add-opens=java.base/java.time=ALL-UNNAMED"
       "--add-opens=java.base/sun.security.util=ALL-UNNAMED"
@@ -27,24 +27,19 @@ in
       '';
     };
 
-    services.unifi.jrePackage = lib.mkOption {
-      type = lib.types.package;
-      default = if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3") then pkgs.jdk11 else pkgs.jre8;
-      defaultText = lib.literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8'';
-      description = ''
-        The JRE package to use. Check the release notes to ensure it is supported.
+    services.unifi.jrePackage = lib.mkPackageOption pkgs "jdk" {
+      default = "jdk17_headless";
+      extraDescription = ''
+        Check the UniFi controller release notes to ensure it is supported.
       '';
     };
 
-    services.unifi.unifiPackage = lib.mkPackageOption pkgs "unifi5" { };
+    services.unifi.unifiPackage = lib.mkPackageOption pkgs "unifi" {
+      default = "unifi8";
+    };
 
     services.unifi.mongodbPackage = lib.mkPackageOption pkgs "mongodb" {
-      default = "mongodb-5_0";
-      extraDescription = ''
-        ::: {.note}
-        unifi7 officially only supports mongodb up until 4.4 but works with 5.0.
-        :::
-      '';
+      default = "mongodb-7_0";
     };
 
     services.unifi.openFirewall = lib.mkOption {
@@ -92,6 +87,29 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    assertions = [
+      {
+        assertion = lib.versionAtLeast config.system.stateVersion "24.11"
+        || (
+          options.services.unifi.unifiPackage.highestPrio < (lib.mkOptionDefault { }).priority
+          && options.services.unifi.mongodbPackage.highestPrio < (lib.mkOptionDefault { }).priority
+        );
+        message = ''
+          Support for UniFi < 8 has been dropped; please explicitly set
+          `services.unifi.unifiPackage` and `services.unifi.mongodbPackage`.
+
+          Note that the previous default MongoDB version was 5.0 and MongoDB
+          only supports migrating one major version at a time; therefore, you
+          may wish to set `services.unifi.mongodbPackage = pkgs.mongodb-6_0;`
+          and activate your configuration before upgrading again to the default
+          `mongodb-7_0` supported by `unifi8`.
+
+          For more information, see the MongoDB upgrade notes:
+          <https://www.mongodb.com/docs/manual/release-notes/7.0-upgrade-standalone/#upgrade-recommendations-and-checklists>
+        '';
+      }
+    ];
+
     users.users.unifi = {
       isSystemUser = true;
       group = "unifi";
diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix
deleted file mode 100644
index 99c04bafd141..000000000000
--- a/nixos/modules/services/video/unifi-video.nix
+++ /dev/null
@@ -1,252 +0,0 @@
-{ config, lib, options, pkgs, utils, ... }:
-with lib;
-let
-  cfg = config.services.unifi-video;
-  opt = options.services.unifi-video;
-  mainClass = "com.ubnt.airvision.Main";
-  cmd = ''
-    ${pkgs.jsvc}/bin/jsvc \
-    -cwd ${stateDir} \
-    -debug \
-    -verbose:class \
-    -nodetach \
-    -user unifi-video \
-    -home ${cfg.jrePackage}/lib/openjdk \
-    -cp ${pkgs.commonsDaemon}/share/java/commons-daemon-1.2.4.jar:${stateDir}/lib/airvision.jar \
-    -pidfile ${cfg.pidFile} \
-    -procname unifi-video \
-    -Djava.security.egd=file:/dev/./urandom \
-    -Xmx${toString cfg.maximumJavaHeapSize}M \
-    -Xss512K \
-    -XX:+UseG1GC \
-    -XX:+UseStringDeduplication \
-    -XX:MaxMetaspaceSize=768M \
-    -Djava.library.path=${stateDir}/lib \
-    -Djava.awt.headless=true \
-    -Djavax.net.ssl.trustStore=${stateDir}/etc/ufv-truststore \
-    -Dfile.encoding=UTF-8 \
-    -Dav.tempdir=/var/cache/unifi-video
-  '';
-
-  mongoConf = pkgs.writeTextFile {
-    name = "mongo.conf";
-    executable = false;
-    text = ''
-      # for documentation of all options, see https://www.mongodb.com/docs/manual/reference/configuration-options/
-
-      storage:
-         dbPath: ${cfg.dataDir}/db
-         journal:
-            enabled: true
-         syncPeriodSecs: 60
-
-      systemLog:
-         destination: file
-         logAppend: true
-         path: ${stateDir}/logs/mongod.log
-
-      net:
-         port: 7441
-         bindIp: 127.0.0.1
-         http:
-            enabled: false
-
-      operationProfiling:
-         slowOpThresholdMs: 500
-         mode: off
-    '';
-  };
-
-
-  mongoWtConf = pkgs.writeTextFile {
-    name = "mongowt.conf";
-    executable = false;
-    text = ''
-      # for documentation of all options, see:
-      #   https://www.mongodb.com/docs/manual/reference/configuration-options/
-
-      storage:
-         dbPath: ${cfg.dataDir}/db-wt
-         journal:
-            enabled: true
-         wiredTiger:
-            engineConfig:
-               cacheSizeGB: 1
-
-      systemLog:
-         destination: file
-         logAppend: true
-         path: logs/mongod.log
-
-      net:
-         port: 7441
-         bindIp: 127.0.0.1
-
-      operationProfiling:
-         slowOpThresholdMs: 500
-         mode: off
-    '';
-  };
-
-  stateDir = "/var/lib/unifi-video";
-
-in
-{
-
-  options.services.unifi-video = {
-
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether or not to enable the unifi-video service.
-      '';
-    };
-
-    jrePackage = mkPackageOption pkgs "jre8" { };
-
-    unifiVideoPackage = mkPackageOption pkgs "unifi-video" { };
-
-    mongodbPackage = mkPackageOption pkgs "mongodb" {
-      default = "mongodb-5_0";
-    };
-
-    logDir = mkOption {
-      type = types.str;
-      default = "${stateDir}/logs";
-      description = ''
-        Where to store the logs.
-      '';
-    };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "${stateDir}/data";
-      description = ''
-        Where to store the database and other data.
-      '';
-    };
-
-    openFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether or not to open the required ports on the firewall.
-      '';
-    };
-
-    maximumJavaHeapSize = mkOption {
-      type = types.nullOr types.int;
-      default = 1024;
-      example = 4096;
-      description = ''
-        Set the maximum heap size for the JVM in MB.
-      '';
-    };
-
-    pidFile = mkOption {
-      type = types.path;
-      default = "${cfg.dataDir}/unifi-video.pid";
-      defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"'';
-      description = "Location of unifi-video pid file.";
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-
-    warnings = optional
-      (options.services.unifi-video.openFirewall.highestPrio >= (mkOptionDefault null).priority)
-      "The current services.unifi-video.openFirewall = true default is deprecated and will change to false in 22.11. Set it explicitly to silence this warning.";
-
-    users.users.unifi-video = {
-      description = "UniFi Video controller daemon user";
-      home = stateDir;
-      group = "unifi-video";
-      isSystemUser = true;
-    };
-    users.groups.unifi-video = {};
-
-    networking.firewall = mkIf cfg.openFirewall {
-      # https://help.ui.com/hc/en-us/articles/217875218-UniFi-Video-Ports-Used
-      allowedTCPPorts = [
-        7080 # HTTP portal
-        7443 # HTTPS portal
-        7445 # Video over HTTP (mobile app)
-        7446 # Video over HTTPS (mobile app)
-        7447 # RTSP via the controller
-        7442 # Camera management from cameras to NVR over WAN
-      ];
-      allowedUDPPorts = [
-        6666 # Inbound camera streams sent over WAN
-      ];
-    };
-
-    systemd.tmpfiles.rules = [
-      "d '${stateDir}' 0700 unifi-video unifi-video - -"
-      "d '/var/cache/unifi-video' 0700 unifi-video unifi-video - -"
-
-      "d '${stateDir}/logs' 0700 unifi-video unifi-video - -"
-      "C '${stateDir}/etc' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/etc"
-      "C '${stateDir}/webapps' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/webapps"
-      "C '${stateDir}/email' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/email"
-      "C '${stateDir}/fw' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/fw"
-      "C '${stateDir}/lib' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/lib"
-
-      "d '${stateDir}/data' 0700 unifi-video unifi-video - -"
-      "d '${stateDir}/data/db' 0700 unifi-video unifi-video - -"
-      "C '${stateDir}/data/system.properties' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/etc/system.properties"
-
-      "d '${stateDir}/bin' 0700 unifi-video unifi-video - -"
-      "f '${stateDir}/bin/evostreamms' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/evostreamms"
-      "f '${stateDir}/bin/libavcodec.so.54' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/libavcodec.so.54"
-      "f '${stateDir}/bin/libavformat.so.54' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/libavformat.so.54"
-      "f '${stateDir}/bin/libavutil.so.52' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/libavutil.so.52"
-      "f '${stateDir}/bin/ubnt.avtool' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/ubnt.avtool"
-      "f '${stateDir}/bin/ubnt.updater' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/bin/ubnt.updater"
-      "C '${stateDir}/bin/mongo' 0700 unifi-video unifi-video - ${cfg.mongodbPackage}/bin/mongo"
-      "C '${stateDir}/bin/mongod' 0700 unifi-video unifi-video - ${cfg.mongodbPackage}/bin/mongod"
-      "C '${stateDir}/bin/mongoperf' 0700 unifi-video unifi-video - ${cfg.mongodbPackage}/bin/mongoperf"
-      "C '${stateDir}/bin/mongos' 0700 unifi-video unifi-video - ${cfg.mongodbPackage}/bin/mongos"
-
-      "d '${stateDir}/conf' 0700 unifi-video unifi-video - -"
-      "C '${stateDir}/conf/evostream' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/evostream"
-      "Z '${stateDir}/conf/evostream' 0700 unifi-video unifi-video - -"
-      "L+ '${stateDir}/conf/mongodv3.0+.conf' 0700 unifi-video unifi-video - ${mongoConf}"
-      "L+ '${stateDir}/conf/mongodv3.6+.conf' 0700 unifi-video unifi-video - ${mongoConf}"
-      "L+ '${stateDir}/conf/mongod-wt.conf' 0700 unifi-video unifi-video - ${mongoWtConf}"
-      "L+ '${stateDir}/conf/catalina.policy' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/catalina.policy"
-      "L+ '${stateDir}/conf/catalina.properties' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/catalina.properties"
-      "L+ '${stateDir}/conf/context.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/context.xml"
-      "L+ '${stateDir}/conf/logging.properties' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/logging.properties"
-      "L+ '${stateDir}/conf/server.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/server.xml"
-      "L+ '${stateDir}/conf/tomcat-users.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/tomcat-users.xml"
-      "L+ '${stateDir}/conf/web.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/web.xml"
-    ];
-
-    systemd.services.unifi-video = {
-      description = "UniFi Video NVR daemon";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ] ;
-      unitConfig.RequiresMountsFor = stateDir;
-      # Make sure package upgrades trigger a service restart
-      restartTriggers = [ cfg.unifiVideoPackage cfg.mongodbPackage ];
-      path = with pkgs; [ gawk coreutils busybox which jre8 lsb-release libcap util-linux ];
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${(removeSuffix "\n" cmd)} ${mainClass} start";
-        ExecStop = "${(removeSuffix "\n" cmd)} stop ${mainClass} stop";
-        Restart = "on-failure";
-        UMask = "0077";
-        User = "unifi-video";
-        WorkingDirectory = "${stateDir}";
-      };
-    };
-  };
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "unifi-video" "openPorts" ] [ "services" "unifi-video" "openFirewall" ])
-  ];
-
-  meta.maintainers = with lib.maintainers; [ rsynnest ];
-}
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index 9b6ec543dae5..2911c0c1d97c 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -8,6 +8,35 @@
 }:
 
 let
+  inherit (builtins) readFile;
+  inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule mkIf;
+  inherit (lib.options)
+    mkOption
+    mkEnableOption
+    literalExpression
+    mkPackageOption
+    ;
+  inherit (lib.types)
+    listOf
+    str
+    ints
+    lines
+    enum
+    path
+    submodule
+    addCheck
+    float
+    bool
+    int
+    nullOr
+    ;
+  inherit (lib.lists) optional optionals;
+  inherit (lib.strings) hasSuffix optionalString;
+  inherit (lib.meta) getExe;
+  inherit (lib.attrsets) optionalAttrs;
+  inherit (lib.trivial) boolToString;
+  inherit (lib.teams.xen) members;
+
   cfg = config.virtualisation.xen;
 
   xenBootBuilder = pkgs.writeShellApplication {
@@ -22,7 +51,7 @@ let
         gnused
         jq
       ])
-      ++ lib.lists.optionals (cfg.efi.bootBuilderVerbosity == "info") (
+      ++ optionals (cfg.efi.bootBuilderVerbosity == "info") (
         with pkgs;
         [
           bat
@@ -36,12 +65,12 @@ let
     # We disable SC2016 because we don't want to expand the regexes in the sed commands.
     excludeShellChecks = [ "SC2016" ];
 
-    text = builtins.readFile ./xen-boot-builder.sh;
+    text = readFile ./xen-boot-builder.sh;
   };
 in
 
 {
-  imports = with lib.modules; [
+  imports = [
     (mkRemovedOptionModule
       [
         "virtualisation"
@@ -123,59 +152,33 @@ in
 
   options.virtualisation.xen = {
 
-    enable = lib.options.mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect";
+    enable = mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect";
 
-    debug = lib.options.mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production";
+    debug = mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production";
 
-    trace = lib.options.mkOption {
-      type = lib.types.bool;
+    trace = mkOption {
+      type = bool;
       default = cfg.debug;
-      defaultText = lib.options.literalExpression "false";
+      defaultText = literalExpression "false";
       example = true;
       description = "Whether to enable Xen debug tracing and logging for Domain 0.";
     };
 
-    package = lib.options.mkOption {
-      type = lib.types.package;
-      default = pkgs.xen;
-      defaultText = lib.options.literalExpression "pkgs.xen";
-      example = lib.options.literalExpression "pkgs.xen-slim";
-      description = ''
-        The package used for Xen Project Hypervisor.
-      '';
-      relatedPackages = [
-        "xen"
-        "xen-slim"
-      ];
-    };
+    package = mkPackageOption pkgs "Xen Hypervisor" { default = [ "xen" ]; };
 
     qemu = {
-      package = lib.options.mkOption {
-        type = lib.types.package;
-        default = pkgs.xen;
-        defaultText = lib.options.literalExpression "pkgs.xen";
-        example = lib.options.literalExpression "pkgs.qemu_xen";
-        description = ''
-          The package with QEMU binaries that runs in Domain 0
-          and virtualises the unprivileged domains.
-        '';
-        relatedPackages = [
-          "xen"
-          {
-            name = "qemu_xen";
-            comment = "For use with `pkgs.xen-slim`.";
-          }
-        ];
+      package = mkPackageOption pkgs "QEMU (with Xen Hypervisor support)" {
+        default = [ "qemu_xen" ];
       };
-      pidFile = lib.options.mkOption {
-        type = lib.types.path;
+      pidFile = mkOption {
+        type = path;
         default = "/run/xen/qemu-dom0.pid";
         example = "/var/run/xen/qemu-dom0.pid";
         description = "Path to the QEMU PID file.";
       };
     };
 
-    bootParams = lib.options.mkOption {
+    bootParams = mkOption {
       default = [ ];
       example = ''
         [
@@ -184,7 +187,7 @@ in
           "vga=ask"
         ]
       '';
-      type = lib.types.listOf lib.types.str;
+      type = listOf str;
       description = ''
         Xen Command Line parameters passed to Domain 0 at boot time.
         Note: these are different from `boot.kernelParams`. See
@@ -193,8 +196,8 @@ in
     };
 
     efi = {
-      bootBuilderVerbosity = lib.options.mkOption {
-        type = lib.types.enum [
+      bootBuilderVerbosity = mkOption {
+        type = enum [
           "default"
           "info"
           "debug"
@@ -218,11 +221,11 @@ in
         '';
       };
 
-      path = lib.options.mkOption {
-        type = lib.types.path;
+      path = mkOption {
+        type = path;
         default = "${cfg.package.boot}/${cfg.package.efi}";
-        defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
-        example = lib.options.literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
+        defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
+        example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
         description = ''
           Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file
           on `$boot/boot/xen.efi`, but an unpatched Xen build may install it
@@ -234,10 +237,10 @@ in
     };
 
     dom0Resources = {
-      maxVCPUs = lib.options.mkOption {
+      maxVCPUs = mkOption {
         default = 0;
         example = 4;
-        type = lib.types.ints.unsigned;
+        type = ints.unsigned;
         description = ''
           Amount of virtual CPU cores allocated to Domain 0 on boot.
           If set to 0, all cores are assigned to Domain 0, and
@@ -245,10 +248,10 @@ in
         '';
       };
 
-      memory = lib.options.mkOption {
+      memory = mkOption {
         default = 0;
         example = 512;
-        type = lib.types.ints.unsigned;
+        type = ints.unsigned;
         description = ''
           Amount of memory (in MiB) allocated to Domain 0 on boot.
           If set to 0, all memory is assigned to Domain 0, and
@@ -256,11 +259,11 @@ in
         '';
       };
 
-      maxMemory = lib.options.mkOption {
+      maxMemory = mkOption {
         default = cfg.dom0Resources.memory;
-        defaultText = lib.options.literalExpression "config.virtualisation.xen.dom0Resources.memory";
+        defaultText = literalExpression "config.virtualisation.xen.dom0Resources.memory";
         example = 1024;
-        type = lib.types.ints.unsigned;
+        type = ints.unsigned;
         description = ''
           Maximum amount of memory (in MiB) that Domain 0 can
           dynamically allocate to itself. Does nothing if set
@@ -271,8 +274,8 @@ in
     };
 
     domains = {
-      extraConfig = lib.options.mkOption {
-        type = lib.types.lines;
+      extraConfig = mkOption {
+        type = lines;
         default = "";
         example = ''
           XENDOMAINS_SAVE=/persist/xen/save
@@ -288,28 +291,28 @@ in
     };
 
     store = {
-      path = lib.options.mkOption {
-        type = lib.types.path;
+      path = mkOption {
+        type = path;
         default = "${cfg.package}/bin/oxenstored";
-        defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored";
-        example = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/xenstored";
+        defaultText = literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored";
+        example = literalExpression "\${config.virtualisation.xen.package}/bin/xenstored";
         description = ''
           Path to the Xen Store Daemon. This option is useful to
           switch between the legacy C-based Xen Store Daemon, and
           the newer OCaml-based Xen Store Daemon, `oxenstored`.
         '';
       };
-      type = lib.options.mkOption {
-        type = lib.types.enum [
+      type = mkOption {
+        type = enum [
           "c"
           "ocaml"
         ];
-        default = if (lib.strings.hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c";
+        default = if (hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c";
         internal = true;
         readOnly = true;
         description = "Helper internal option that determines the type of the Xen Store Daemon based on cfg.store.path.";
       };
-      settings = lib.options.mkOption {
+      settings = mkOption {
         default = { };
         example = {
           enableMerge = false;
@@ -324,34 +327,34 @@ in
           The OCaml-based Xen Store Daemon configuration. This
           option does nothing with the C-based `xenstored`.
         '';
-        type = lib.types.submodule {
+        type = submodule {
           options = {
-            pidFile = lib.options.mkOption {
+            pidFile = mkOption {
               default = "/run/xen/xenstored.pid";
               example = "/var/run/xen/xenstored.pid";
-              type = lib.types.path;
+              type = path;
               description = "Path to the Xen Store Daemon PID file.";
             };
-            testEAGAIN = lib.options.mkOption {
+            testEAGAIN = mkOption {
               default = cfg.debug;
-              defaultText = lib.options.literalExpression "config.virtualisation.xen.debug";
+              defaultText = literalExpression "config.virtualisation.xen.debug";
               example = true;
-              type = lib.types.bool;
+              type = bool;
               visible = false;
               description = "Randomly fail a transaction with EAGAIN. This option is used for debugging purposes only.";
             };
-            enableMerge = lib.options.mkOption {
+            enableMerge = mkOption {
               default = true;
               example = false;
-              type = lib.types.bool;
+              type = bool;
               description = "Whether to enable transaction merge support.";
             };
             conflict = {
-              burstLimit = lib.options.mkOption {
+              burstLimit = mkOption {
                 default = 5.0;
                 example = 15.0;
-                type = lib.types.addCheck (
-                  lib.types.float
+                type = addCheck (
+                  float
                   // {
                     name = "nonnegativeFloat";
                     description = "nonnegative floating point number, meaning >=0";
@@ -369,12 +372,12 @@ in
                   domain's requests are ignored.
                 '';
               };
-              maxHistorySeconds = lib.options.mkOption {
+              maxHistorySeconds = mkOption {
                 default = 5.0e-2;
                 example = 1.0;
-                type = lib.types.addCheck (
-                  lib.types.float // { description = "nonnegative floating point number, meaning >=0"; }
-                ) (n: n >= 0);
+                type = addCheck (float // { description = "nonnegative floating point number, meaning >=0"; }) (
+                  n: n >= 0
+                );
                 description = ''
                   Limits applied to domains whose writes cause other domains' transaction
                   commits to fail. Must include decimal point.
@@ -384,10 +387,10 @@ in
                   is the minimum pause-time during which a domain will be ignored.
                 '';
               };
-              rateLimitIsAggregate = lib.options.mkOption {
+              rateLimitIsAggregate = mkOption {
                 default = true;
                 example = false;
-                type = lib.types.bool;
+                type = bool;
                 description = ''
                   If the conflict.rateLimitIsAggregate option is `true`, then after each
                   tick one point of conflict-credit is given to just one domain: the
@@ -408,16 +411,16 @@ in
               };
             };
             perms = {
-              enable = lib.options.mkOption {
+              enable = mkOption {
                 default = true;
                 example = false;
-                type = lib.types.bool;
+                type = bool;
                 description = "Whether to enable the node permission system.";
               };
-              enableWatch = lib.options.mkOption {
+              enableWatch = mkOption {
                 default = true;
                 example = false;
-                type = lib.types.bool;
+                type = bool;
                 description = ''
                   Whether to enable the watch permission system.
 
@@ -432,144 +435,142 @@ in
               };
             };
             quota = {
-              enable = lib.options.mkOption {
+              enable = mkOption {
                 default = true;
                 example = false;
-                type = lib.types.bool;
+                type = bool;
                 description = "Whether to enable the quota system.";
               };
-              maxEntity = lib.options.mkOption {
+              maxEntity = mkOption {
                 default = 1000;
                 example = 1024;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Entity limit for transactions.";
               };
-              maxSize = lib.options.mkOption {
+              maxSize = mkOption {
                 default = 2048;
                 example = 4096;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Size limit for transactions.";
               };
-              maxWatch = lib.options.mkOption {
+              maxWatch = mkOption {
                 default = 100;
                 example = 256;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Maximum number of watches by the Xenstore Watchdog.";
               };
-              transaction = lib.options.mkOption {
+              transaction = mkOption {
                 default = 10;
                 example = 50;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Maximum number of transactions.";
               };
-              maxRequests = lib.options.mkOption {
+              maxRequests = mkOption {
                 default = 1024;
                 example = 1024;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Maximum number of requests per transaction.";
               };
-              maxPath = lib.options.mkOption {
+              maxPath = mkOption {
                 default = 1024;
                 example = 1024;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Path limit for the quota system.";
               };
-              maxOutstanding = lib.options.mkOption {
+              maxOutstanding = mkOption {
                 default = 1024;
                 example = 1024;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Maximum outstanding requests, i.e. in-flight requests / domain.";
               };
-              maxWatchEvents = lib.options.mkOption {
+              maxWatchEvents = mkOption {
                 default = 1024;
                 example = 2048;
-                type = lib.types.ints.positive;
+                type = ints.positive;
                 description = "Maximum number of outstanding watch events per watch.";
               };
             };
-            persistent = lib.options.mkOption {
+            persistent = mkOption {
               default = false;
               example = true;
-              type = lib.types.bool;
+              type = bool;
               description = "Whether to activate the filed base backend.";
             };
             xenstored = {
               log = {
-                file = lib.options.mkOption {
+                file = mkOption {
                   default = "/var/log/xen/xenstored.log";
                   example = "/dev/null";
-                  type = lib.types.path;
+                  type = path;
                   description = "Path to the Xen Store log file.";
                 };
-                level = lib.options.mkOption {
+                level = mkOption {
                   default = if cfg.trace then "debug" else null;
-                  defaultText = lib.options.literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null";
+                  defaultText = literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null";
                   example = "error";
-                  type = lib.types.nullOr (
-                    lib.types.enum [
-                      "debug"
-                      "info"
-                      "warn"
-                      "error"
-                    ]
-                  );
+                  type = nullOr (enum [
+                    "debug"
+                    "info"
+                    "warn"
+                    "error"
+                  ]);
                   description = "Logging level for the Xen Store.";
                 };
                 # The hidden options below have no upstream documentation whatsoever.
                 # The nb* options appear to alter the log rotation behaviour, and
                 # the specialOps option appears to affect the Xenbus logging logic.
-                nbFiles = lib.options.mkOption {
+                nbFiles = mkOption {
                   default = 10;
                   example = 16;
-                  type = lib.types.int;
+                  type = int;
                   visible = false;
                   description = "Set `xenstored-log-nb-files`.";
                 };
               };
               accessLog = {
-                file = lib.options.mkOption {
+                file = mkOption {
                   default = "/var/log/xen/xenstored-access.log";
                   example = "/var/log/security/xenstored-access.log";
-                  type = lib.types.path;
+                  type = path;
                   description = "Path to the Xen Store access log file.";
                 };
-                nbLines = lib.options.mkOption {
+                nbLines = mkOption {
                   default = 13215;
                   example = 16384;
-                  type = lib.types.int;
+                  type = int;
                   visible = false;
                   description = "Set `access-log-nb-lines`.";
                 };
-                nbChars = lib.options.mkOption {
+                nbChars = mkOption {
                   default = 180;
                   example = 256;
-                  type = lib.types.int;
+                  type = int;
                   visible = false;
                   description = "Set `acesss-log-nb-chars`.";
                 };
-                specialOps = lib.options.mkOption {
+                specialOps = mkOption {
                   default = false;
                   example = true;
-                  type = lib.types.bool;
+                  type = bool;
                   visible = false;
                   description = "Set `access-log-special-ops`.";
                 };
               };
               xenfs = {
-                kva = lib.options.mkOption {
+                kva = mkOption {
                   default = "/proc/xen/xsd_kva";
                   example = cfg.store.settings.xenstored.xenfs.kva;
-                  type = lib.types.path;
+                  type = path;
                   visible = false;
                   description = ''
                     Path to the Xen Store Daemon KVA location inside the XenFS pseudo-filesystem.
                     While it is possible to alter this value, some drivers may be hardcoded to follow the default paths.
                   '';
                 };
-                port = lib.options.mkOption {
+                port = mkOption {
                   default = "/proc/xen/xsd_port";
                   example = cfg.store.settings.xenstored.xenfs.port;
-                  type = lib.types.path;
+                  type = path;
                   visible = false;
                   description = ''
                     Path to the Xen Store Daemon userspace port inside the XenFS pseudo-filesystem.
@@ -578,11 +579,11 @@ in
                 };
               };
             };
-            ringScanInterval = lib.options.mkOption {
+            ringScanInterval = mkOption {
               default = 20;
               example = 30;
-              type = lib.types.addCheck (
-                lib.types.int
+              type = addCheck (
+                int
                 // {
                   name = "nonzeroInt";
                   description = "nonzero signed integer, meaning !=0";
@@ -602,7 +603,7 @@ in
 
   ## Implementation ##
 
-  config = lib.modules.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     assertions = [
       {
         assertion = pkgs.stdenv.hostPlatform.isx86_64;
@@ -639,18 +640,18 @@ in
     ];
 
     virtualisation.xen.bootParams =
-      lib.lists.optionals cfg.trace [
+      optionals cfg.trace [
         "loglvl=all"
         "guest_loglvl=all"
       ]
       ++
-        lib.lists.optional (cfg.dom0Resources.memory != 0)
+        optional (cfg.dom0Resources.memory != 0)
           "dom0_mem=${toString cfg.dom0Resources.memory}M${
-            lib.strings.optionalString (
+            optionalString (
               cfg.dom0Resources.memory != cfg.dom0Resources.maxMemory
             ) ",max:${toString cfg.dom0Resources.maxMemory}M"
           }"
-      ++ lib.lists.optional (
+      ++ optional (
         cfg.dom0Resources.maxVCPUs != 0
       ) "dom0_max_vcpus=${toString cfg.dom0Resources.maxVCPUs}";
 
@@ -701,7 +702,7 @@ in
 
       # See the `xenBootBuilder` script in the main `let...in` statement of this file.
       loader.systemd-boot.extraInstallCommands = ''
-        ${lib.meta.getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity}
+        ${getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity}
       '';
     };
 
@@ -744,7 +745,7 @@ in
 
             XENSTORED="${cfg.store.path}"
             QEMU_XEN="${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386}"
-            ${lib.strings.optionalString cfg.trace ''
+            ${optionalString cfg.trace ''
               XENSTORED_TRACE=yes
               XENCONSOLED_TRACE=all
             ''}
@@ -756,10 +757,10 @@ in
           '';
         }
         # The OCaml-based Xen Store Daemon requires /etc/xen/oxenstored.conf to start.
-        // lib.attrsets.optionalAttrs (cfg.store.type == "ocaml") {
+        // optionalAttrs (cfg.store.type == "ocaml") {
           "xen/oxenstored.conf".text = ''
             pid-file = ${cfg.store.settings.pidFile}
-            test-eagain = ${lib.trivial.boolToString cfg.store.settings.testEAGAIN}
+            test-eagain = ${boolToString cfg.store.settings.testEAGAIN}
             merge-activate = ${toString cfg.store.settings.enableMerge}
             conflict-burst-limit = ${toString cfg.store.settings.conflict.burstLimit}
             conflict-max-history-seconds = ${toString cfg.store.settings.conflict.maxHistorySeconds}
@@ -775,7 +776,7 @@ in
             quota-path-max = ${toString cfg.store.settings.quota.maxPath}
             quota-maxoutstanding = ${toString cfg.store.settings.quota.maxOutstanding}
             quota-maxwatchevents = ${toString cfg.store.settings.quota.maxWatchEvents}
-            persistent = ${lib.trivial.boolToString cfg.store.settings.persistent}
+            persistent = ${boolToString cfg.store.settings.persistent}
             xenstored-log-file = ${cfg.store.settings.xenstored.log.file}
             xenstored-log-level = ${
               if isNull cfg.store.settings.xenstored.log.level then
@@ -787,7 +788,7 @@ in
             access-log-file = ${cfg.store.settings.xenstored.accessLog.file}
             access-log-nb-lines = ${toString cfg.store.settings.xenstored.accessLog.nbLines}
             acesss-log-nb-chars = ${toString cfg.store.settings.xenstored.accessLog.nbChars}
-            access-log-special-ops = ${lib.trivial.boolToString cfg.store.settings.xenstored.accessLog.specialOps}
+            access-log-special-ops = ${boolToString cfg.store.settings.xenstored.accessLog.specialOps}
             ring-scan-interval = ${toString cfg.store.settings.ringScanInterval}
             xenstored-kva = ${cfg.store.settings.xenstored.xenfs.kva}
             xenstored-port = ${cfg.store.settings.xenstored.xenfs.port}
@@ -870,5 +871,5 @@ in
       };
     };
   };
-  meta.maintainers = lib.teams.xen.members;
+  meta.maintainers = members;
 }
diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index 1a260814f8b8..d82d5080e69c 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -34,7 +34,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       node = {...}: {
         environment.systemPackages = with pkgs; [
           # remember to update mongodb.passthru.tests if you change this
-          mongodb-5_0
+          mongodb-7_0
         ];
       };
     };
@@ -42,7 +42,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     testScript = ''
       node.start()
     ''
-      + runMongoDBTest pkgs.mongodb-5_0
+      + runMongoDBTest pkgs.mongodb-7_0
       + ''
         node.shutdown()
       '';
diff --git a/nixos/tests/unifi.nix b/nixos/tests/unifi.nix
index 789b11b55985..15de78045501 100644
--- a/nixos/tests/unifi.nix
+++ b/nixos/tests/unifi.nix
@@ -31,6 +31,5 @@ let
     '';
   };
 in with pkgs; {
-  unifi7 = makeAppTest unifi7;
   unifi8 = makeAppTest unifi8;
 }
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 1c5fe1a56a42..6351b9d71bf1 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -236,7 +236,10 @@ in
     let
       vscodeRipgrep =
         if stdenv.hostPlatform.isDarwin then
-          "Contents/Resources/app/node_modules.asar.unpacked/@vscode/ripgrep/bin/rg"
+          if lib.versionAtLeast version "1.94.0" then
+            "Contents/Resources/app/node_modules/@vscode/ripgrep/bin/rg"
+          else
+            "Contents/Resources/app/node_modules.asar.unpacked/@vscode/ripgrep/bin/rg"
         else
           "resources/app/node_modules/@vscode/ripgrep/bin/rg";
     in
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 3b797c957e83..619cc9daeba6 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -38,6 +38,8 @@
 , hostCpuOnly ? false
 , hostCpuTargets ? (if toolsOnly
                     then [ ]
+                    else if xenSupport
+                    then [ "i386-softmmu" ]
                     else if hostCpuOnly
                     then (lib.optional stdenv.hostPlatform.isx86_64 "i386-softmmu"
                           ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
@@ -50,6 +52,8 @@
 , qemu-utils # for tests attribute
 }:
 
+assert lib.assertMsg (xenSupport -> hostCpuTargets == [ "i386-softmmu" ]) "Xen should not use any other QEMU architecture other than i386.";
+
 let
   hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;
 
diff --git a/pkgs/applications/virtualization/xen/4.17/default.nix b/pkgs/applications/virtualization/xen/4.17/default.nix
deleted file mode 100644
index d270c37f2ce8..000000000000
--- a/pkgs/applications/virtualization/xen/4.17/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  lib,
-  fetchpatch,
-  callPackage,
-  ocaml-ng,
-  ...
-}@genericDefinition:
-
-let
-  upstreamPatches = import ../generic/patches.nix {
-    inherit lib;
-    inherit fetchpatch;
-  };
-
-  upstreamPatchList = lib.lists.flatten (
-    with upstreamPatches;
-    [
-      QUBES_REPRODUCIBLE_BUILDS
-      XSA_462
-    ]
-  );
-in
-
-callPackage (import ../generic/default.nix {
-  pname = "xen";
-  branch = "4.17";
-  version = "4.17.5";
-  latest = false;
-  pkg = {
-    xen = {
-      rev = "430ce6cd936546ad883ecd1c85ddea32d790604b";
-      hash = "sha256-UoMdXRW0yWSaQPPV0rgoTZVO2ghdnqWruBHn7+ZjKzI=";
-      patches = [ ] ++ upstreamPatchList;
-    };
-    qemu = {
-      rev = "ffb451126550b22b43b62fb8731a0d78e3376c03";
-      hash = "sha256-G0hMPid9d3fd1jAY7CiZ33xUZf1hdy96T1VUKFGeHSk=";
-      patches = [ ];
-    };
-    seaBIOS = {
-      rev = "d239552ce7220e448ae81f41515138f7b9e3c4db";
-      hash = "sha256-UKMceJhIprN4/4Xe4EG2EvKlanxVcEi5Qcrrk3Ogiik=";
-      patches = [ ];
-    };
-    ovmf = {
-      rev = "7b4a99be8a39c12d3a7fc4b8db9f0eab4ac688d5";
-      hash = "sha256-Qq2RgktCkJZBsq6Ch+6tyRHhme4lfcN7d2oQfxwhQt8=";
-      patches = [ ];
-    };
-    ipxe = {
-      rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
-      hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
-      patches = [ ];
-    };
-  };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/4.18/default.nix b/pkgs/applications/virtualization/xen/4.18/default.nix
deleted file mode 100644
index 21d6de13f1b0..000000000000
--- a/pkgs/applications/virtualization/xen/4.18/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  lib,
-  fetchpatch,
-  callPackage,
-  ocaml-ng,
-  ...
-}@genericDefinition:
-
-let
-  upstreamPatches = import ../generic/patches.nix {
-    inherit lib;
-    inherit fetchpatch;
-  };
-
-  upstreamPatchList = lib.lists.flatten (
-    with upstreamPatches;
-    [
-      QUBES_REPRODUCIBLE_BUILDS
-      XSA_462
-    ]
-  );
-in
-
-callPackage (import ../generic/default.nix {
-  pname = "xen";
-  branch = "4.18";
-  version = "4.18.3";
-  latest = false;
-  pkg = {
-    xen = {
-      rev = "bd51e573a730efc569646379cd59ccba967cde97";
-      hash = "sha256-OFiFdpPCXR+sWjzFHCORtY4DkWyggvxkcsGdgEyO1ts=";
-      patches = [ ] ++ upstreamPatchList;
-    };
-    qemu = {
-      rev = "0df9387c8983e1b1e72d8c574356f572342c03e6";
-      hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ=";
-      patches = [ ];
-    };
-    seaBIOS = {
-      rev = "ea1b7a0733906b8425d948ae94fba63c32b1d425";
-      hash = "sha256-J2FuT+FXn9YoFLSfxDOxyKZvKrys59a6bP1eYvEXVNU=";
-      patches = [ ];
-    };
-    ovmf = {
-      rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16";
-      hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s=";
-      patches = [ ];
-    };
-    ipxe = {
-      rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
-      hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
-      patches = [ ];
-    };
-  };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/4.19/default.nix b/pkgs/applications/virtualization/xen/4.19/default.nix
deleted file mode 100644
index a1b133704285..000000000000
--- a/pkgs/applications/virtualization/xen/4.19/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  fetchpatch,
-  callPackage,
-  ocaml-ng,
-  ...
-}@genericDefinition:
-
-let
-  upstreamPatches = import ../generic/patches.nix {
-    inherit lib;
-    inherit fetchpatch;
-  };
-
-  upstreamPatchList = lib.lists.flatten (
-    with upstreamPatches;
-    [
-      QUBES_REPRODUCIBLE_BUILDS
-      XSA_460
-      XSA_461
-      XSA_462
-    ]
-  );
-in
-
-callPackage (import ../generic/default.nix {
-  pname = "xen";
-  branch = "4.19";
-  version = "4.19.0";
-  latest = true;
-  pkg = {
-    xen = {
-      rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239";
-      hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q=";
-      patches = [ ] ++ upstreamPatchList;
-    };
-    qemu = {
-      rev = "0df9387c8983e1b1e72d8c574356f572342c03e6";
-      hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ=";
-      patches = [ ];
-    };
-    seaBIOS = {
-      rev = "a6ed6b701f0a57db0569ab98b0661c12a6ec3ff8";
-      hash = "sha256-hWemj83cxdY8p+Jhkh5GcPvI0Sy5aKYZJCsKDjHTUUk=";
-      patches = [ ];
-    };
-    ovmf = {
-      rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16";
-      hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s=";
-      patches = [ ];
-    };
-    ipxe = {
-      rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
-      hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
-      patches = [ ];
-    };
-  };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/README.md b/pkgs/applications/virtualization/xen/README.md
deleted file mode 100644
index 07087e2fee23..000000000000
--- a/pkgs/applications/virtualization/xen/README.md
+++ /dev/null
@@ -1,209 +0,0 @@
-<p align="center">
-  <a href="https://xenproject.org/">
-    <picture>
-      <source
-        media="(prefers-color-scheme: light)"
-        srcset="https://downloads.xenproject.org/Branding/Logos/Green+Black/xen_project_logo_dualcolor_2000x832.png">
-      <source
-        media="(prefers-color-scheme: dark)"
-        srcset="https://xenproject.org/wp-content/uploads/sites/79/2018/09/logo_xenproject.png">
-      <img
-        src="https://downloads.xenproject.org/Branding/Logos/Green+Black/xen_project_logo_dualcolor_2000x832.png"
-        width="512px"
-        alt="Xen Project Logo">
-    </picture>
-  </a>
-</p>
-
-# Xen Project Hypervisor <a href="https://xenproject.org/"><img src="https://downloads.xenproject.org/Branding/Mascots/Xen-Fu-Panda-2000px.png" width="48px" align="top" alt="Xen Fu Panda"></a>
-
-This directory includes the build recipes for the [Xen Project Hypervisor](https://xenproject.org/).
-
-Some other notable packages that compose the Xen Project Ecosystem include:
-
-- `ocamlPackages.xenstore`: Mirage's `oxenstore` implementation.
-- `ocamlPackages.vchan`: Mirage's `xen-vchan` implementation.
-- `ocamlPackages.xenstore-tool`: XAPI's `oxenstore` utilities.
-- `xen-guest-agent`: Guest drivers for UNIX domUs.
-- `win-pvdrivers`: Guest drivers for Windows domUs.
-- `xtf`: The Xen Test Framework.
-
-## Updating
-
-### Automatically
-
-An automated update script is available in this directory. To produce up-to-date
-files for all supported Xen branches, simply run `./update.sh`, and follow the
-instructions given to you by the script. Notably, it will request that you verify
-the Xen Project code signing PGP key. This README understands that the fingerprint
-of that key is [`23E3 222C 145F 4475 FA80 60A7 83FE 14C9 57E8 2BD9`](https://keys.openpgp.org/search?q=pgp%40xen.org),
-but you should verify this information by seeking the fingerprint from other trusted
-sources, as this document may be compromised. Once the PGP key is verified, it will
-use `git verify-tag` to ascertain the validity of the cloned Xen sources.
-
-After the script is done, follow the steps in
-[**For Both Update Methods**](#for-both-update-methods) below.
-
-#### Downstream Patch Names
-
-The script expects local patch names to follow a certain specification.
-Please name any required patches using the template below:
-
-```console
-0000-project-description-branch.patch
-```
-
-Where:
-
-1. The first four numbers define the patch order.
-   **0001** will be applied after **0000**, and so on.
-1. `project` means the name of the source the patch should be applied to.
-   - If you are applying patches to the main Xen sources, use `xen`.
-   - For the pre-fetched QEMU, use `qemu`.
-   - For SeaBIOS, use `seabios`.
-   - For OVMF, use `ovmf`.
-   - For iPXE, use `ipxe`.
-1. `description` is a string with uppercase and lowercase letters, numbers and
-   dashes. It describes the patch name and what it does to the upstream code.
-1. `branch` is the branch for which this patch is supposed to patch.
-   It should match the name of the directory it is in.
-
-For example, a patch fixing `xentop`'s output in the 4.15 branch should have
-the following name: `0000-xen-xentop-output-4.15.patch`, and it should be added
-to the `4.15/` directory.
-
-### Manually
-
-The script is not infallible, and it may break in the future. If that happens,
-open a PR fixing the script, and update Xen manually:
-
-1. Check the support matrix to see which branches are security-supported.
-1. Create one directory per branch.
-1. [Update](https://xenbits.xenproject.org/gitweb/) the `default.nix` files for
-   the branches that already exist and copy a new one to any branches that do
-   not yet exist in Nixpkgs.
-   - Do not forget to set the `branch`, `version`, and `latest` attributes for
-     each of the `default.nix` files.
-   - The revisions are preferably commit hashes, but tag names are acceptable
-     as well.
-
-### For Both Update Methods
-
-1. Update `packages.nix` and `../../../top-level/all-packages.nix` with the new
-   versions. Don't forget the `slim` packages!
-1. Make sure all branches build. (Both the `standard` and `slim` versions)
-1. Use the NixOS module to test if dom0 boots successfully on all new versions.
-1. Make sure the `meta` attributes evaluate to something that makes sense. The
-   following one-line command is useful for testing this:
-
-   ```console
-   xenToEvaluate=xen; echo -e "\033[1m$(nix eval .#"$xenToEvaluate".meta.description --raw 2> /dev/null)\033[0m\n\n$(nix eval .#"$xenToEvaluate".meta.longDescription --raw 2> /dev/null)"
-   ```
-
-   Change the value of `xenToEvaluate` to evaluate all relevant Xen packages.
-1. Run `xtf --all --host` as root when booted into the Xen update, and make
-   sure no tests fail.
-1. Clean up your changes and commit them, making sure to follow the
-   [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md).
-1. Open a PR and await a review from the current maintainers.
-
-## Features
-
-### Pre-fetched Sources
-
-On a typical Xen build, the Xen Makefiles will fetch more required sources with
-`git` and `wget`. Due to the Nix Sandbox, build-time fetching will fail, so we
-pre-fetch the required sources before building.[^1] To accomplish this, we have
-a `prefetchedSources` attribute that contains the required derivations, if they
-are requested by the main Xen build.
-
-### EFI
-
-Building `xen.efi` requires an `ld` with PE support.[^2]
-
-We use a `makeFlag` to override the `$LD` environment variable to point to our
-patched `efiBinutils`. For more information, see the comment in `./generic/default.nix`.
-
-> [!TIP]
-> If you are certain you will not be running Xen in an x86 EFI environment, disable
-the `withEFI` flag with an [override](https://nixos.org/manual/nixpkgs/stable/#chap-overrides)
-to save you the need to compile `efiBinutils`.
-
-### Default Overrides
-
-By default, Xen also builds
-[QEMU](https://www.qemu.org/),
-[SeaBIOS](https://www.seabios.org/SeaBIOS),
-[OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF) and
-[iPXE](https://ipxe.org/).
-
-- QEMU is used for stubdomains and handling devices.
-- SeaBIOS is the default legacy BIOS ROM for HVM domains.
-- OVMF is the default UEFI ROM for HVM domains.
-- iPXE provides a PXE boot environment for HVMs.
-
-However, those packages are already available on Nixpkgs, and Xen does not
-necessarily need to build them into the main hypervisor build. For this reason,
-we also have the `withInternal<Component>` flags, which enables and disables
-building those built-in components. The two most popular Xen configurations will
-be the default build, with all built-in components, and a `slim` build, with none
-of those components. To simplify this process, the `./packages.nix` file includes
-the `xen-slim` package overrides that have all `withInternal<Component>` flags
-disabled. See the `meta.longDescription` attribute for the `xen-slim` packages
-for more information.
-
-## Security
-
-We aim to support all **security-supported** versions of Xen at any given time.
-See the [Xen Support Matrix](https://xenbits.xen.org/docs/unstable/support-matrix.html)
-for a list of versions. As soon as a version is no longer **security-supported**,
-it should be removed from Nixpkgs.
-
-> [!CAUTION]
-> Pull requests that introduce XSA patches
-should have the `1.severity: security` label.
-
-### Maintainers
-
-Xen is a particularly complex piece of software, so we are always looking for new
-maintainers. Help out by [making and triaging issues](https://github.com/NixOS/nixpkgs/issues/new/choose),
-[sending build fixes and improvements through PRs](https://github.com/NixOS/nixpkgs/compare),
-updating the branches, and [patching security flaws](https://xenbits.xenproject.org/xsa/).
-
-We are also looking for testers, particularly those who can test Xen on AArch64
-machines. Open issues for any build failures or runtime errors you find!
-
-## Tests
-
-So far, we only have had one simple automated test that checks for
-the correct `pkg-config` output files.
-
-Due to Xen's nature as a type-1 hypervisor, it is not a trivial matter to design
-new tests, as even basic functionality requires a machine booted in a dom0
-kernel. For this reason, most testing done with this package must be done
-manually in a NixOS machine with `virtualisation.xen.enable` set to `true`.
-
-Another unfortunate thing is that none of the Xen commands have a `--version`
-flag. This means that `testers.testVersion` cannot ascertain the Xen version.
-The only way to verify that you have indeed built the correct version is to
-boot into the freshly built Xen kernel and run `xl info`.
-
-<p align="center">
-  <a href="https://xenproject.org/">
-    <img
-      src="https://downloads.xenproject.org/Branding/Mascots/Xen%20Big%20Panda%204242x3129.png"
-      width="96px"
-      alt="Xen Fu Panda">
-  </a>
-</p>
-
-[^1]: We also produce fake `git`, `wget` and `hostname` binaries that do nothing,
-      to prevent the build from failing because Xen cannot fetch the sources that
-      were already fetched by Nix.
-[^2]: From the [Xen Documentation](https://xenbits.xenproject.org/docs/unstable/misc/efi.html):
-      > For x86, building `xen.efi` requires `gcc` 4.5.x or above (4.6.x or newer
-      recommended, as 4.5.x was probably never really tested for this purpose)
-      and `binutils` 2.22 or newer. Additionally, the `binutils` build must be
-      configured to include support for the x86_64-pep emulation (i.e.
-      `--enable-targets=x86_64-pep` or an option of equivalent effect should be
-      passed to the configure script).
diff --git a/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch b/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch
deleted file mode 100644
index d96023d1946a..000000000000
--- a/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Hack to make etherboot use pre-fetched iPXE.
-
-diff --git a/tools/firmware/etherboot/Makefile b/tools/firmware/etherboot/Makefile
-index ed9e11305f..979a3acea8 100644
---- a/tools/firmware/etherboot/Makefile
-+++ b/tools/firmware/etherboot/Makefile
-@@ -16,6 +16,7 @@ IPXE_TARBALL_URL ?= $(XEN_EXTFILES_URL)/ipxe-git-$(IPXE_GIT_TAG).tar.gz
-
- D=ipxe
- T=ipxe.tar.gz
-+G=ipxe.git
-
- ROMS = $(addprefix $D/src/bin/, $(addsuffix .rom, $(ETHERBOOT_NICS)))
- ROM = $D/src/bin/ipxe.bin
-@@ -41,9 +42,9 @@ $T:
- 	fi
- 	mv _$T $T
-
--$D/src/arch/i386/Makefile: $T Config
--	rm -rf $D
--	gzip -dc $T | tar xf -
-+$D/src/arch/i386/Makefile: $G Config
-+	mkdir $D
-+	cp -a $G/* $D
- 	for i in $$(cat patches/series) ; do                 \
- 	    patch -d $D -p1 --quiet <patches/$$i || exit 1 ; \
- 	done
diff --git a/pkgs/applications/virtualization/xen/generic/default.nix b/pkgs/applications/virtualization/xen/generic/default.nix
deleted file mode 100644
index d4d0d235eef2..000000000000
--- a/pkgs/applications/virtualization/xen/generic/default.nix
+++ /dev/null
@@ -1,728 +0,0 @@
-versionDefinition:
-{
-  lib,
-  stdenv,
-  autoPatchelfHook,
-  cmake,
-  ninja,
-  pkg-config,
-  testers,
-  which,
-
-  fetchgit,
-  fetchFromGitHub,
-
-  # Xen
-  acpica-tools,
-  bison,
-  bzip2,
-  dev86,
-  e2fsprogs,
-  flex,
-  libnl,
-  libuuid,
-  lzo,
-  ncurses,
-  ocamlPackages,
-  perl,
-  python3Packages,
-  systemdMinimal,
-  xz,
-  yajl,
-  zlib,
-  zstd,
-
-  # Xen Optional
-  withInternalQEMU ? true,
-  pixman,
-  glib,
-
-  withInternalSeaBIOS ? true,
-  withSeaBIOS ? !withInternalSeaBIOS,
-  seabios,
-
-  withInternalOVMF ? true,
-  withOVMF ? !withInternalOVMF,
-  OVMF,
-  nasm,
-
-  withInternalIPXE ? true,
-  withIPXE ? !withInternalIPXE,
-  ipxe,
-
-  withFlask ? false,
-  checkpolicy,
-
-  efiVendor ? "nixos", # Allow downstreams with custom branding to quickly override the EFI Vendor string.
-  withEFI ? true,
-  binutils-unwrapped,
-
-  # Documentation
-  pandoc,
-
-  # Scripts
-  bridge-utils,
-  coreutils,
-  diffutils,
-  gawk,
-  gnugrep,
-  gnused,
-  inetutils,
-  iproute2,
-  iptables,
-  multipath-tools,
-  nbd,
-  openvswitch,
-  util-linux,
-  ...
-}@packageDefinition:
-
-let
-  #TODO: fix paths instead.
-  scriptEnvPath = lib.strings.makeSearchPathOutput "out" "bin" [
-    bridge-utils
-    coreutils
-    diffutils
-    gawk
-    gnugrep
-    gnused
-    inetutils
-    iproute2
-    iptables
-    multipath-tools
-    nbd
-    openvswitch
-    perl
-    util-linux.bin
-    which
-  ];
-
-  # Inherit attributes from a versionDefinition.
-  inherit (versionDefinition)
-    pname
-    branch
-    version
-    latest
-    pkg
-    ;
-
-  # Mark versions older than minSupportedVersion as EOL.
-  minSupportedVersion = "4.17";
-
-  ## Pre-fetched Source Handling ##
-
-  # Main attribute set for sources needed to build tools and firmwares.
-  # Each source takes in:
-  # * A `src` attribute, which contains the actual fetcher,
-  # * A 'patches` attribute, which is a list of patches that need to be applied in the source.
-  # * A `path` attribute, which is the destination of the source inside the Xen tree.
-  prefetchedSources =
-    lib.attrsets.optionalAttrs withInternalQEMU {
-      qemu = {
-        src = fetchgit {
-          url = "https://xenbits.xenproject.org/git-http/qemu-xen.git";
-          fetchSubmodules = true;
-          inherit (pkg.qemu) rev hash;
-        };
-        patches = lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.qemu) pkg.qemu.patches;
-        path = "tools/qemu-xen";
-      };
-    }
-    // lib.attrsets.optionalAttrs withInternalSeaBIOS {
-      seaBIOS = {
-        src = fetchgit {
-          url = "https://xenbits.xenproject.org/git-http/seabios.git";
-          inherit (pkg.seaBIOS) rev hash;
-        };
-        patches = lib.lists.optionals (lib.attrsets.hasAttrByPath [
-          "patches"
-        ] pkg.seaBIOS) pkg.seaBIOS.patches;
-        path = "tools/firmware/seabios-dir-remote";
-      };
-    }
-    // lib.attrsets.optionalAttrs withInternalOVMF {
-      ovmf = {
-        src = fetchgit {
-          url = "https://xenbits.xenproject.org/git-http/ovmf.git";
-          fetchSubmodules = true;
-          inherit (pkg.ovmf) rev hash;
-        };
-        patches = lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.ovmf) pkg.ovmf.patches;
-        path = "tools/firmware/ovmf-dir-remote";
-      };
-    }
-    // lib.attrsets.optionalAttrs withInternalIPXE {
-      ipxe = {
-        src = fetchFromGitHub {
-          owner = "ipxe";
-          repo = "ipxe";
-          inherit (pkg.ipxe) rev hash;
-        };
-        patches = lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.ipxe) pkg.ipxe.patches;
-        path = "tools/firmware/etherboot/ipxe.git";
-      };
-    };
-
-  # Gets a list containing the names of the top-level attribute for each pre-fetched
-  # source, to be used in the map functions below.
-  prefetchedSourcesList = lib.attrsets.mapAttrsToList (name: value: name) prefetchedSources;
-
-  # Produces bash commands that will copy each pre-fetched source.
-  copyPrefetchedSources =
-    # Finish the deployment by concatnating the list of commands together.
-    lib.strings.concatLines (
-      # Iterate on each pre-fetched source.
-      builtins.map (
-        source:
-        # Only produce a copy command if patches exist.
-        lib.strings.optionalString (lib.attrsets.hasAttrByPath [ "${source}" ] prefetchedSources)
-          # The actual copy command. `src` is always an absolute path to a fetcher output
-          # inside the /nix/store, and `path` is always a path relative to the Xen root.
-          # We need to `mkdir -p` the target directory first, and `chmod +w` the contents last,
-          # as the copied files will still be edited by the postPatchPhase.
-          ''
-            echo "Copying ${prefetchedSources.${source}.src} -> ${prefetchedSources.${source}.path}"
-            mkdir --parents ${prefetchedSources.${source}.path}
-            cp --recursive --no-target-directory ${prefetchedSources.${source}.src} ${
-              prefetchedSources.${source}.path
-            }
-            chmod --recursive +w ${prefetchedSources.${source}.path}
-          ''
-      ) prefetchedSourcesList
-    );
-
-  # Produces strings with `patch` commands to be ran on postPatch.
-  # These deploy the .patch files for each pre-fetched source.
-  deployPrefetchedSourcesPatches =
-    # Finish the deployment by concatnating the list of commands together.
-    lib.strings.concatLines (
-      # The double map functions create a list of lists. Flatten it so we can concatnate it.
-      lib.lists.flatten (
-        # Iterate on each pre-fetched source.
-        builtins.map (
-          source:
-          # Iterate on each available patch.
-          (builtins.map (
-            patch:
-            # Only produce a patch command if patches exist.
-            lib.strings.optionalString
-              (lib.attrsets.hasAttrByPath [
-                "${source}"
-                "patches"
-              ] prefetchedSources)
-              # The actual patch command. It changes directories to the correct source each time.
-              ''
-                echo "Applying patch ${patch} to ${source}."
-                patch --directory ${prefetchedSources.${source}.path} --strip 1 < ${patch}
-              ''
-          ) prefetchedSources.${source}.patches)
-        ) prefetchedSourcesList
-      )
-    );
-
-  ## XSA Patches Description Builder ##
-
-  # Sometimes patches are sourced through a path, like ./0000-xen.patch.
-  # This would break the patch attribute parser functions, so we normalise
-  # all patches sourced through paths by setting them to a { type = "path"; }
-  # attribute set.
-  # Patches from fetchpatch are already attribute sets.
-  normalisedPatchList = builtins.map (
-    patch:
-    if !builtins.isAttrs patch then
-      if builtins.isPath patch then
-        { type = "path"; }
-      else
-        throw "xen/generic/default.nix: normalisedPatchList attempted to normalise something that is not a Path or an Attribute Set."
-    else
-      patch
-  ) pkg.xen.patches;
-
-  # Simple counter for the number of attrsets (patches) in the patches list after normalisation.
-  numberOfPatches = lib.lists.count (patch: builtins.isAttrs patch) normalisedPatchList;
-
-  # builtins.elemAt's index begins at 0, so we subtract 1 from the number of patches in order to
-  # produce the range that will be used in the following builtin.map calls.
-  availablePatchesToTry = lib.lists.range 0 (numberOfPatches - 1);
-
-  # Takes in an attrByPath input, and outputs the attribute value for each patch in a list.
-  # If a patch does not have a given attribute, returns `null`. Use lib.lists.remove null
-  # to remove these junk values, if necessary.
-  retrievePatchAttributes =
-    attributeName:
-    builtins.map (
-      x: lib.attrsets.attrByPath attributeName null (builtins.elemAt normalisedPatchList x)
-    ) availablePatchesToTry;
-
-  # Produces a list of newline-separated strings that lists the vulnerabilities this
-  # Xen is NOT affected by, due to the applied Xen Security Advisory patches. This is
-  # then used in meta.longDescription, to let users know their Xen is patched against
-  # known vulnerabilities, as the package version isn't always the best indicator.
-  #
-  # Produces something like this: (one string for each XSA)
-  #  * [Xen Security Advisory #1](https://xenbits.xenproject.org/xsa/advisory-1.html): **Title for XSA.**
-  #  >Description of issue in XSA
-  #Extra lines
-  #are not indented,
-  #but markdown should be
-  #fine with it.
-  #  Fixes:
-  #  * [CVE-1999-00001](https://www.cve.org/CVERecord?id=CVE-1999-00001)
-  #  * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002)
-  #  * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003)
-  writeAdvisoryDescription =
-    if (lib.lists.remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then
-      lib.lists.zipListsWith (a: b: a + b)
-        (lib.lists.zipListsWith (a: b: a + "**" + b + ".**\n  >")
-          (lib.lists.zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ")
-            (lib.lists.remove null (retrievePatchAttributes [ "xsa" ]))
-            (
-              lib.lists.remove null (retrievePatchAttributes [
-                "meta"
-                "homepage"
-              ])
-            )
-          )
-          (
-            lib.lists.remove null (retrievePatchAttributes [
-              "meta"
-              "description"
-            ])
-          )
-        )
-        (
-          lib.lists.remove null (retrievePatchAttributes [
-            "meta"
-            "longDescription"
-          ])
-        )
-    else
-      [ ];
-
-  ## Binutils Override ##
-
-  # Originally, there were two versions of binutils being used: the standard one and
-  # this patched one. Unfortunately, that required patches to the Xen Makefiles, and
-  # quickly became too complex to maintain. The new solution is to simply build this
-  # efi-binutils derivation and use it for the whole build process, except if
-  # enableEFI is disabled; it'll then use `binutils`.
-  efiBinutils = binutils-unwrapped.overrideAttrs (oldAttrs: {
-    name = "efi-binutils";
-    configureFlags = oldAttrs.configureFlags ++ [ "--enable-targets=x86_64-pep" ];
-    doInstallCheck = false; # We get a spurious failure otherwise, due to a host/target mismatch.
-    meta.mainProgram = "ld"; # We only really care for `ld`.
-  });
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version;
-
-  outputs = [
-    "out" # TODO: Split $out in $bin for binaries and $lib for libraries.
-    "man" # Manual pages for Xen userspace utilities.
-    "doc" # The full Xen documentation in HTML format.
-    "dev" # Development headers.
-    "boot" # xen.gz kernel, policy file if Flask is enabled, xen.efi if EFI is enabled.
-    # TODO: Python package to be in separate output/package.
-  ];
-
-  # Main Xen source.
-  src = fetchgit {
-    url = "https://xenbits.xenproject.org/git-http/xen.git";
-    inherit (pkg.xen) rev hash;
-  };
-
-  patches =
-    # Generic Xen patches that apply to all Xen versions.
-    [ ./0000-xen-ipxe-src-generic.patch ]
-    # Gets the patches from the pkg.xen.patches attribute from the versioned files.
-    ++ lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.xen) pkg.xen.patches;
-
-  nativeBuildInputs =
-    [
-      autoPatchelfHook
-      bison
-      cmake
-      flex
-      pandoc
-      pkg-config
-      python3Packages.setuptools
-    ]
-    ++ lib.lists.optionals withInternalQEMU [
-      ninja
-      python3Packages.sphinx
-    ];
-  buildInputs =
-    [
-      # Xen
-      acpica-tools
-      bzip2
-      dev86
-      e2fsprogs.dev
-      libnl
-      libuuid
-      lzo
-      ncurses
-      perl
-      python3Packages.python
-      xz
-      yajl
-      zlib
-      zstd
-
-      # oxenstored
-      ocamlPackages.findlib
-      ocamlPackages.ocaml
-
-      # Python Fixes
-      python3Packages.wrapPython
-    ]
-    ++ lib.lists.optionals withInternalQEMU [
-      glib
-      pixman
-    ]
-    ++ lib.lists.optional withInternalOVMF nasm
-    ++ lib.lists.optional withFlask checkpolicy
-    ++ lib.lists.optional (lib.strings.versionOlder version "4.19") systemdMinimal;
-
-  configureFlags =
-    [
-      "--enable-systemd"
-      "--disable-qemu-traditional"
-    ]
-    ++ lib.lists.optional (!withInternalQEMU) "--with-system-qemu"
-
-    ++ lib.lists.optional withSeaBIOS "--with-system-seabios=${seabios}/share/seabios"
-    ++ lib.lists.optional (!withInternalSeaBIOS && !withSeaBIOS) "--disable-seabios"
-
-    ++ lib.lists.optional withOVMF "--with-system-ovmf=${OVMF.firmware}"
-    ++ lib.lists.optional withInternalOVMF "--enable-ovmf"
-
-    ++ lib.lists.optional withIPXE "--with-system-ipxe=${ipxe}"
-    ++ lib.lists.optional withInternalIPXE "--enable-ipxe"
-
-    ++ lib.lists.optional withFlask "--enable-xsmpolicy";
-
-  makeFlags =
-    [
-      "PREFIX=$(out)"
-      "CONFIG_DIR=/etc"
-      "XEN_SCRIPT_DIR=$(CONFIG_DIR)/xen/scripts"
-      "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
-    ]
-    ++ lib.lists.optionals withEFI [
-      "EFI_VENDOR=${efiVendor}"
-      "INSTALL_EFI_STRIP=1"
-      "LD=${lib.meta.getExe efiBinutils}" # See the comment in the efiBinutils definition above.
-    ]
-    # These flags set the CONFIG_* options in /boot/xen.config
-    # and define if the default policy file is built. However,
-    # the Flask binaries always get compiled by default.
-    ++ lib.lists.optionals withFlask [
-      "XSM_ENABLE=y"
-      "FLASK_ENABLE=y"
-    ]
-    ++ (pkg.xen.makeFlags or [ ]);
-
-  buildFlags = [
-    "xen" # Build the Xen Hypervisor.
-    "tools" # Build the userspace tools, such as `xl`.
-    "docs" # Build the Xen Documentation
-  ];
-
-  enableParallelBuilding = true;
-
-  env.NIX_CFLAGS_COMPILE = builtins.toString (
-    [
-      "-Wno-error=maybe-uninitialized"
-      "-Wno-error=array-bounds"
-    ]
-    ++ lib.lists.optionals withInternalOVMF [
-      "-Wno-error=format-security"
-      "-Wno-error=use-after-free"
-      "-Wno-error=vla-parameter"
-      "-Wno-error=dangling-pointer"
-      "-Wno-error=stringop-overflow"
-    ]
-  );
-
-  dontUseCmakeConfigure = true;
-  dontUseNinjaBuild = withInternalQEMU;
-
-  prePatch =
-    # Xen's stubdoms, tools and firmwares need various sources that
-    # are usually fetched at build time using wget and git. We can't
-    # have that, so we pre-fetch them in the versioned Nix expressions,
-    # and produce fake wget and git executables for debugging purposes.
-    #
-    # We also produce a fake hostname executable to prevent spurious
-    # command-not-found errors during compilation.
-    #
-    # The snippet below produces executables that simply print in stdout
-    # what they were supposed to fetch, and exit gracefully.
-    ''
-      mkdir fake-bin
-
-      cat > fake-bin/wget << EOF
-      #!${stdenv.shell} -e
-      echo ===== FAKE WGET: Not fetching \$*
-      [ -e \$3 ]
-      EOF
-
-      cat > fake-bin/git << EOF
-      #!${stdenv.shell}
-      echo ===== FAKE GIT: Not cloning \$*
-      [ -e \$3 ]
-      EOF
-
-      cat > fake-bin/hostname << EOF
-      #!${stdenv.shell}
-      echo ${efiVendor}
-      [ -e \$3 ]
-      EOF
-
-      chmod +x fake-bin/*
-      export PATH=$PATH:$PWD/fake-bin
-    ''
-
-    # Remove in-tree QEMU sources, as we either pre-fetch them through
-    # the versioned Nix expressions if withInternalQEMU is true, or we
-    # don't build QEMU at all if withInternalQEMU is false.
-    + ''
-      rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional
-    ''
-
-    # Call copyPrefetchedSources, which copies all aviable sources to their correct positions.
-    + ''
-      ${copyPrefetchedSources}
-    '';
-
-  postPatch =
-    # The following patch forces Xen to install xen.efi on $out/boot
-    # instead of $out/boot/efi/efi/nixos, as the latter directory
-    # would otherwise need to be created manually. This also creates
-    # a more consistent output for downstreams who override the
-    # efiVendor attribute above.
-    ''
-      substituteInPlace xen/Makefile \
-        --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
-                  "\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
-    ''
-
-    # The following patch fixes the call to /bin/mkdir on the
-    # launch_xenstore.sh helper script.
-    + ''
-      substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
-        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
-    ''
-
-    # The following expression fixes the paths called by Xen's systemd
-    # units, so we can use them in the NixOS module.
-    + ''
-      substituteInPlace \
-        tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
-        --replace-fail /bin/grep ${gnugrep}/bin/grep
-      substituteInPlace \
-       tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
-        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
-    ''
-
-    # # Call deployPrefetchedSourcesPatches, which patches all pre-fetched sources with their specified patchlists.
-    + ''
-      ${deployPrefetchedSourcesPatches}
-    ''
-    # Patch shebangs for QEMU and OVMF build scripts.
-    + lib.strings.optionalString withInternalQEMU ''
-      patchShebangs --build tools/qemu-xen/scripts/tracetool.py
-    ''
-    + lib.strings.optionalString withInternalOVMF ''
-      patchShebangs --build tools/firmware/ovmf-dir-remote/OvmfPkg/build.sh tools/firmware/ovmf-dir-remote/BaseTools/BinWrappers/PosixLike/{AmlToC,BrotliCompress,build,GenFfs,GenFv,GenFw,GenSec,LzmaCompress,TianoCompress,Trim,VfrCompile}
-    '';
-
-  installPhase =
-    let
-      cpFlags = builtins.toString [
-        "--preserve=mode,ownership,timestamps,link"
-        "--recursive"
-        "--verbose"
-        "--no-dereference"
-      ];
-    in
-    # Run the preInstall tasks.
-    ''
-      runHook preInstall
-    ''
-
-    # Create $out directories and copy build output.
-    + ''
-      mkdir --parents $out $out/share $boot
-      cp ${cpFlags} dist/install/nix/store/*/* $out/
-      cp ${cpFlags} dist/install/etc $out
-      cp ${cpFlags} dist/install/boot $boot
-    ''
-
-    # Run the postInstall tasks.
-    + ''
-      runHook postInstall
-    '';
-
-  postInstall =
-    # Wrap xencov_split, xenmon and xentrace_format.
-    ''
-      wrapPythonPrograms
-    ''
-
-    # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
-    + ''
-      wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
-    ''
-
-    # Fix shebangs in Xen's various scripts.
-    #TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
-    + ''
-      shopt -s extglob
-      for i in $out/etc/xen/scripts/!(*.sh); do
-        sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
-      done
-    '';
-
-  postFixup =
-    # Fix binaries in $out/libexec/xen/bin.
-    ''
-      addAutoPatchelfSearchPath $out/lib
-      autoPatchelf $out/libexec/xen/bin
-    ''
-    # Flask is particularly hard to disable. Even after
-    # setting the make flags to `n`, it still gets compiled.
-    # If withFlask is disabled, delete the extra binaries.
-    + lib.strings.optionalString (!withFlask) ''
-      rm -f $out/bin/flask-*
-    '';
-
-  passthru = {
-    efi =
-      if withEFI then "boot/xen-${version}.efi" else throw "This Xen was compiled without an EFI binary.";
-    flaskPolicy =
-      if withFlask then
-        "boot/xenpolicy-${version}"
-      else
-        throw "This Xen was compiled without FLASK support.";
-    qemu-system-i386 =
-      if withInternalQEMU then
-        "libexec/xen/bin/qemu-system-i386"
-      else
-        throw "This Xen was compiled without a built-in QEMU.";
-    # This test suite is very simple, as Xen's userspace
-    # utilities require the hypervisor to be booted.
-    tests = {
-      pkg-config = testers.hasPkgConfigModules {
-        package = finalAttrs.finalPackage;
-        moduleNames = [
-          "xencall"
-          "xencontrol"
-          "xendevicemodel"
-          "xenevtchn"
-          "xenforeignmemory"
-          "xengnttab"
-          "xenguest"
-          "xenhypfs"
-          "xenlight"
-          "xenstat"
-          "xenstore"
-          "xentoolcore"
-          "xentoollog"
-          "xenvchan"
-          "xlutil"
-        ];
-      };
-    };
-  };
-
-  meta =
-    if
-      !(lib.attrsets.hasAttrByPath [
-        "meta"
-      ] versionDefinition)
-    then
-      {
-        inherit branch;
-
-        # Short description for Xen.
-        description =
-          "Xen Project Hypervisor"
-          # The "and related components" addition is automatically hidden if said components aren't being built.
-          + lib.strings.optionalString (prefetchedSources != { }) " and related components"
-          # To alter the description inside the paranthesis, edit ./packages.nix.
-          + lib.strings.optionalString (lib.attrsets.hasAttrByPath [
-            "meta"
-            "description"
-          ] packageDefinition) " (${packageDefinition.meta.description})";
-
-        # Long description for Xen.
-        longDescription =
-          # Starts with the longDescription from ./packages.nix.
-          (packageDefinition.meta.longDescription or "")
-          + lib.strings.optionalString (!withInternalQEMU) (
-            "\nUse with `qemu_xen_${lib.strings.stringAsChars (x: if x == "." then "_" else x) branch}`"
-            + lib.strings.optionalString latest " or `qemu_xen`"
-            + ".\n"
-          )
-          # Then, if any of the optional with* components are being built, add the "Includes:" string.
-          +
-            lib.strings.optionalString
-              (
-                withInternalQEMU
-                || withInternalSeaBIOS
-                || withInternalOVMF
-                || withInternalIPXE
-                || withEFI
-                || withFlask
-              )
-              (
-                "\nIncludes:"
-                # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't
-                # that many optional components, we just use lib.strings.optionalString, because it's simpler.
-                # Optional components that aren't being built are automatically hidden.
-                + lib.strings.optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
-                + lib.strings.optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package."
-                + lib.strings.optionalString withInternalQEMU "\n* `qemu-xen`: The Xen Project's mirror of [QEMU](https://www.qemu.org/)."
-                + lib.strings.optionalString withInternalSeaBIOS "\n* `seabios-xen`: The Xen Project's mirror of [SeaBIOS](https://www.seabios.org/SeaBIOS)."
-                + lib.strings.optionalString withInternalOVMF "\n* `ovmf-xen`: The Xen Project's mirror of [OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF)."
-                + lib.strings.optionalString withInternalIPXE "\n* `ipxe-xen`: The Xen Project's pinned version of [iPXE](https://ipxe.org/)."
-              )
-          # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to.
-          # This will hopefully give users the peace of mind that their Xen is secure, without needing
-          # to search the source code for the XSA patches.
-          + lib.strings.optionalString (writeAdvisoryDescription != [ ]) (
-            "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n"
-            + lib.strings.removeSuffix "\n" (lib.strings.concatLines writeAdvisoryDescription)
-          );
-
-        homepage = "https://xenproject.org/";
-        downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
-        changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
-
-        license = with lib.licenses; [
-          # Documentation.
-          cc-by-40
-          # Most of Xen is licensed under the GPL v2.0.
-          gpl2Only
-          # Xen Libraries and the `xl` command-line utility.
-          lgpl21Only
-          # Development headers in $dev/include.
-          mit
-        ];
-
-        # This automatically removes maintainers from EOL versions of Xen, so we aren't bothered about versions we don't explictly support.
-        maintainers = lib.lists.optionals (lib.strings.versionAtLeast version minSupportedVersion) lib.teams.xen.members;
-        knownVulnerabilities = lib.lists.optional (lib.strings.versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
-
-        mainProgram = "xl";
-
-        # Evaluates to x86_64-linux.
-        platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64;
-
-      }
-    else
-      versionDefinition.meta;
-})
diff --git a/pkgs/applications/virtualization/xen/packages.nix b/pkgs/applications/virtualization/xen/packages.nix
deleted file mode 100644
index fe759709770f..000000000000
--- a/pkgs/applications/virtualization/xen/packages.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  python3Packages,
-  python311Packages,
-  callPackage,
-}:
-let
-  standard = {
-    # Broken with python 3.12+ when using internal QEMU due to https://github.com/NixOS/nixpkgs/issues/253751
-    python3Packages = python311Packages;
-    meta = {
-      description = "Standard";
-      longDescription = ''
-        Standard version of the Xen Project Hypervisor. Uses forks of QEMU, SeaBIOS,
-        OVMF and iPXE provided by the Xen Project. This provides the vanilla Xen
-        experience, but wastes space and build time. A typical NixOS setup that runs
-        lots of VMs will usually need to build two different versions of QEMU when using
-        this Xen derivation (one fork and upstream).
-      '';
-    };
-  };
-  slim = {
-    inherit python3Packages;
-    meta = {
-      description = "Without Internal Components";
-      longDescription = ''
-        Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages
-        as much as possible. Instead of using the Xen Project forks for various internal
-        components, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These
-        components may ocasionally get out of sync with the hypervisor itself, but this
-        builds faster and uses less space than the default derivation.
-      '';
-    };
-  };
-in
-# TODO: generalise this to automatically generate both Xen variants for each ./<version>/default.nix.
-rec {
-  xen_4_19 = callPackage ./4.19/default.nix {
-    inherit (standard) meta python3Packages;
-  };
-  xen_4_19-slim = xen_4_19.override {
-    withInternalQEMU = false;
-    withInternalSeaBIOS = false;
-    withInternalOVMF = false;
-    withInternalIPXE = false;
-    inherit (slim) meta python3Packages;
-  };
-
-  xen_4_18 = callPackage ./4.18/default.nix {
-    inherit (standard) meta python3Packages;
-  };
-  xen_4_18-slim = xen_4_18.override {
-    withInternalQEMU = false;
-    withInternalSeaBIOS = false;
-    withInternalOVMF = false;
-    withInternalIPXE = false;
-    inherit (slim) meta python3Packages;
-  };
-
-  xen_4_17 = callPackage ./4.17/default.nix {
-    inherit (standard) meta python3Packages;
-  };
-  xen_4_17-slim = xen_4_17.override {
-    withInternalQEMU = false;
-    withInternalSeaBIOS = false;
-    withInternalOVMF = false;
-    withInternalIPXE = false;
-    inherit (slim) meta;
-    # Broken with python 3.12+ due to distutils missing.
-    python3Packages = python311Packages;
-  };
-}
diff --git a/pkgs/applications/virtualization/xen/update.sh b/pkgs/applications/virtualization/xen/update.sh
deleted file mode 100755
index e5012768b4e8..000000000000
--- a/pkgs/applications/virtualization/xen/update.sh
+++ /dev/null
@@ -1,202 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gitMinimal curl gnupg nix-prefetch-git nixfmt-rfc-style
-# shellcheck disable=SC2206,SC2207 shell=bash
-set -o errexit
-set -o pipefail
-set -o nounset
-
-#TODO: Use `jq` instead of `sed`.
-#TODO: Accept the small security drawback and make this script runnable by r-ryantm.
-
-# This script expects to be called in an interactive terminal somewhere inside Nixpkgs.
-echo "Preparing..."
-nixpkgs=$(git rev-parse --show-toplevel)
-xenPath="$nixpkgs/pkgs/applications/virtualization/xen"
-rm -rf /tmp/xenUpdateScript
-mkdir /tmp/xenUpdateScript
-
-# Import and verify PGP key.
-curl --silent --output /tmp/xenUpdateScript/xen.asc https://keys.openpgp.org/vks/v1/by-fingerprint/23E3222C145F4475FA8060A783FE14C957E82BD9
-gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import /tmp/xenUpdateScript/xen.asc
-fingerprint="$(gpg --homedir /tmp/xenUpdateScript/.gnupg --with-colons --fingerprint "pgp@xen.org" 2>/dev/null | awk -F: '/^pub:.*/ { getline; print $10}')"
-echo -e "Please ascertain through multiple external sources that the \e[1;32mXen Project PGP Key Fingerprint\e[0m is indeed \e[1;33m$fingerprint\e[0m. If that is not the case, \e[1;31mexit immediately\e[0m."
-read -r -p $'Press \e[1;34menter\e[0m to continue with a pre-filled expected fingerprint, or input an arbitrary PGP fingerprint to match with the key\'s fingerprint: ' userInputFingerprint
-userInputFingerprint=${userInputFingerprint:-"23E3222C145F4475FA8060A783FE14C957E82BD9"}
-
-# Clone xen.git.
-echo -e "Cloning \e[1;34mxen.git\e[0m..."
-git clone --quiet https://xenbits.xenproject.org/git-http/xen.git /tmp/xenUpdateScript/xen
-cd /tmp/xenUpdateScript/xen
-
-# Get list of versions and branches.
-versionList="$(git tag --list "RELEASE-*" | sed s/RELEASE-//g | sed s/4.1.6.1//g | sort --numeric-sort)"
-latestVersion=$(echo "$versionList" | tr ' ' '\n' | tail --lines=1)
-branchList=($(echo "$versionList" | tr ' ' '\n' | sed s/\.[0-9]*$//g | awk '!seen[$0]++'))
-
-# Figure out which versions we're actually going to install.
-minSupportedBranch="$(grep "  minSupportedVersion = " "$xenPath"/generic/default.nix | sed s/'  minSupportedVersion = "'//g | sed s/'";'//g)"
-supportedBranches=($(for version in "${branchList[@]}"; do if [ "$(printf '%s\n' "$minSupportedBranch" "$version" | sort -V | head -n1)" = "$minSupportedBranch" ]; then echo "$version"; fi; done))
-supportedVersions=($(for version in "${supportedBranches[@]}"; do echo "$versionList" | tr ' ' '\n' | grep "$version" | tail --lines=1; done))
-
-echo -e "\e[1mNOTE\e[0m: As we're also pre-fetching the submodules, QEMU and OVMF may take a very long time to fetch."
-
-# Main loop that installs every supportedVersion.
-for version in "${supportedVersions[@]}"; do
-    echo -e "\n------------------------------------------------"
-    branch=${version/%.[0-9]/}
-    if [[ "$version" == "$latestVersion" ]]; then
-        latest=true
-        echo -e "\nFound \e[1;34mlatest\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."
-    else
-        latest=false
-        echo -e "\nFound \e[1;33msecurity-supported\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."
-    fi
-
-    # Verify PGP key automatically. If the fingerprint matches what the user specified, or the default fingerprint, then we consider it trusted.
-    cd /tmp/xenUpdateScript/xen
-    if [[ "$fingerprint" = "$userInputFingerprint" ]]; then
-        echo "$fingerprint:6:" | gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import-ownertrust
-        (git verify-tag RELEASE-"$version" 2>/dev/null && echo -e "\n\e[1;32mSuccessfully authenticated Xen $version.\e[0m") || (echo -e "\e[1;31merror:\e[0m Unable to verify tag \e[1;32mRELEASE-$version\e[0m.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or a \e[1;31msupply chain attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1)
-    else
-        echo -e "\e[1;31merror:\e[0m Unable to verify \e[1;34mpgp@xen.org\e[0m's fingerprint.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or an \e[1;31mimpersonation attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1
-    fi
-
-    git switch --quiet --detach RELEASE-"$version"
-
-    # Originally we told people to go check the Makefile themselves.
-    echo -e -n "\nDetermining source versions from Xen Makefiles..."
-    qemuVersion="$(grep "QEMU_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"QEMU_UPSTREAM_REVISION ?= "//g)"
-    seaBIOSVersion="$(grep "SEABIOS_UPSTREAM_REVISION ?= rel-" /tmp/xenUpdateScript/xen/Config.mk | sed s/"SEABIOS_UPSTREAM_REVISION ?= "//g)"
-    ovmfVersion="$(grep "OVMF_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"OVMF_UPSTREAM_REVISION ?= "//g)"
-    miniOSVersion="$(grep "MINIOS_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"MINIOS_UPSTREAM_REVISION ?= "//g)"
-    ipxeVersion="$(grep "IPXE_GIT_TAG :=" /tmp/xenUpdateScript/xen/tools/firmware/etherboot/Makefile | sed s/"IPXE_GIT_TAG := "//g)"
-    echo "done!"
-
-    # Use `nix-prefetch-git` to fetch `rev`s and `hash`es.
-    echo "Pre-fetching sources and determining hashes..."
-    echo -e -n "  \e[1;32mXen\e[0m..."
-    fetchXen=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/xen.git --rev RELEASE-"$version" --quiet)
-    finalVersion="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"
-    hash="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"
-    echo "done!"
-    echo -e -n "  \e[1;36mQEMU\e[0m..."
-    fetchQEMU=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/qemu-xen.git --rev "$qemuVersion" --quiet --fetch-submodules)
-    finalQEMUVersion="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"
-    qemuHash="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"
-    echo "done!"
-    echo -e -n "  \e[1;36mSeaBIOS\e[0m..."
-    fetchSeaBIOS=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/seabios.git --rev "$seaBIOSVersion" --quiet)
-    finalSeaBIOSVersion="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"
-    seaBIOSHash="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"
-    echo "done!"
-    echo -e -n "  \e[1;36mOVMF\e[0m..."
-    ovmfHash="$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/ovmf.git --rev "$ovmfVersion" --quiet --fetch-submodules | grep -ie hash | sed s/'  "hash": "'//g | sed s/'",'//g)"
-    echo "done!"
-    echo -e -n "  \e[1;36miPXE\e[0m..."
-    ipxeHash="$(nix-prefetch-git --url https://github.com/ipxe/ipxe.git --rev "$ipxeVersion" --quiet | grep -ie hash | sed s/'  "hash": "'//g | sed s/'",'//g)"
-    echo "done!"
-
-    cd "$xenPath"
-
-    echo -e "\nFound the following revisions:\n  \e[1;32mXen\e[0m:     \e[1;33m$finalVersion\e[0m (\e[1;33m$hash\e[0m)\n  \e[1;36mQEMU\e[0m:    \e[1;33m$finalQEMUVersion\e[0m (\e[1;33m$qemuHash\e[0m)\n  \e[1;36mSeaBIOS\e[0m: \e[1;33m$finalSeaBIOSVersion\e[0m (\e[1;33m$seaBIOSHash\e[0m)\n  \e[1;36mOVMF\e[0m:    \e[1;33m$ovmfVersion\e[0m (\e[1;33m$ovmfHash\e[0m)\n  \e[1;36miPXE\e[0m:    \e[1;33m$ipxeVersion\e[0m (\e[1;33m$ipxeHash\e[0m)"
-
-    # Set OCaml Version
-    read -r -p $'\nEnter the corresponding \e[1;33mOCaml\e[0m version for \e[1;32mXen '"$version"$'\e[0m, or press \e[1;34menter\e[0m for the default value of \e[1;32m4_14\e[0m: ' ocamlVersion
-    ocamlVersion=${ocamlVersion:-"4_14"}
-
-    mkdir -p "$branch"/
-    rm -f "$branch"/default.nix
-
-    # Prepare any .patch files that are called by Nix through a path value.
-    echo -e "\nPlease add any required patches to version \e[1;32m$branch\e[0m in \e[1;34m$branch/\e[0m, and press \e[1;34menter\e[0m when done."
-    read -r -p $'Remember to follow the naming specification as defined in \e[1;34m./README.md\e[0m.'
-
-    echo -e "\nDiscovering patches..."
-    discoveredXenPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-xen-*-$branch.patch" -printf "./%f ")"
-    discoveredQEMUPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-qemu-*-$branch.patch" -printf "./%f ")"
-    discoveredSeaBIOSPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-seabios-*-$branch.patch" -printf "./%f ")"
-    discoveredOVMFPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ovmf-*-$branch.patch" -printf "./%f ")"
-    discoveredIPXEPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ipxe-*-$branch.patch" -printf "./%f ")"
-
-    discoveredXenPatchesEcho=${discoveredXenPatches:-"\e[1;31mNone found!\e[0m"}
-    discoveredQEMUPatchesEcho=${discoveredQEMUPatches:-"\e[1;31mNone found!\e[0m"}
-    discoveredSeaBIOSPatchesEcho=${discoveredSeaBIOSPatches:-"\e[1;31mNone found!\e[0m"}
-    discoveredOVMFPatchesEcho=${discoveredOVMFPatches:-"\e[1;31mNone found!\e[0m"}
-    discoveredIPXEPatchesEcho=${discoveredIPXEPatches:-"\e[1;31mNone found!\e[0m"}
-
-    echo -e "Found the following patches:\n  \e[1;32mXen\e[0m:     \e[1;33m$discoveredXenPatchesEcho\e[0m\n  \e[1;36mQEMU\e[0m:    \e[1;33m$discoveredQEMUPatchesEcho\e[0m\n  \e[1;36mSeaBIOS\e[0m: \e[1;33m$discoveredSeaBIOSPatchesEcho\e[0m\n  \e[1;36mOVMF\e[0m:    \e[1;33m$discoveredOVMFPatchesEcho\e[0m\n  \e[1;36miPXE\e[0m:    \e[1;33m$discoveredIPXEPatchesEcho\e[0m"
-
-    # Prepare patches that are called in ./patches.nix.
-    defaultPatchListInit=("QUBES_REPRODUCIBLE_BUILDS" "XSA_460" "XSA_461" )
-    read -r -a defaultPatchList -p $'\nWould you like to override the \e[1;34mupstreamPatches\e[0m list for \e[1;32mXen '"$version"$'\e[0m? If no, press \e[1;34menter\e[0m to use the default patch list: [ \e[1;34m'"${defaultPatchListInit[*]}"$' \e[0m]: '
-    defaultPatchList=(${defaultPatchList[@]:-${defaultPatchListInit[@]}})
-    upstreamPatches=${defaultPatchList[*]}
-
-    # Write and format default.nix file.
-    echo -e -n "\nWriting updated \e[1;34mversionDefinition\e[0m..."
-    cat >"$branch"/default.nix <<EOF
-{
-  lib,
-  fetchpatch,
-  callPackage,
-  ocaml-ng,
-  ...
-}@genericDefinition:
-
-let
-  upstreamPatches = import ../generic/patches.nix {
-    inherit lib;
-    inherit fetchpatch;
-  };
-
-  upstreamPatchList = lib.lists.flatten (with upstreamPatches; [
-    $upstreamPatches
-  ]);
-in
-
-callPackage (import ../generic/default.nix {
-  pname = "xen";
-  branch = "$branch";
-  version = "$version";
-  latest = $latest;
-  pkg = {
-    xen = {
-      rev = "$finalVersion";
-      hash = "$hash";
-      patches = [ $discoveredXenPatches ] ++ upstreamPatchList;
-    };
-    qemu = {
-      rev = "$finalQEMUVersion";
-      hash = "$qemuHash";
-      patches = [ $discoveredQEMUPatches ];
-    };
-    seaBIOS = {
-      rev = "$finalSeaBIOSVersion";
-      hash = "$seaBIOSHash";
-      patches = [ $discoveredSeaBIOSPatches ];
-    };
-    ovmf = {
-      rev = "$ovmfVersion";
-      hash = "$ovmfHash";
-      patches = [ $discoveredOVMFPatches ];
-    };
-    ipxe = {
-      rev = "$ipxeVersion";
-      hash = "$ipxeHash";
-      patches = [ $discoveredIPXEPatches ];
-    };
-  };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_$ocamlVersion; } // genericDefinition)
-EOF
-echo done!
-
-    echo -n "Formatting..."
-    nixfmt "$branch"/default.nix
-    echo done!
-
-    echo -e "\n\e[1;32mSuccessfully produced $branch/default.nix.\e[0m"
-done
-
-echo -e -n "\nCleaning up..."
-rm -rf /tmp/xenUpdateScript
-echo done!
diff --git a/pkgs/build-support/xen/default.nix b/pkgs/build-support/xen/default.nix
new file mode 100644
index 000000000000..9b57c335c8dd
--- /dev/null
+++ b/pkgs/build-support/xen/default.nix
@@ -0,0 +1,481 @@
+{
+  lib,
+  stdenv,
+  autoPatchelfHook,
+  cmake,
+  pkg-config,
+  testers,
+  which,
+  fetchgit,
+  fetchpatch,
+
+  # Xen
+  acpica-tools,
+  bison,
+  bzip2,
+  dev86,
+  e2fsprogs,
+  flex,
+  libnl,
+  libuuid,
+  lzo,
+  ncurses,
+  ocamlPackages,
+  perl,
+  python3Packages,
+  systemdMinimal,
+  xz,
+  yajl,
+  zlib,
+  zstd,
+
+  # Optional Components
+  seabios,
+  OVMF,
+  ipxe,
+  checkpolicy,
+  binutils-unwrapped-all-targets,
+
+  # Documentation
+  pandoc,
+
+  # Scripts
+  bridge-utils,
+  coreutils,
+  diffutils,
+  gawk,
+  gnugrep,
+  gnused,
+  inetutils,
+  iproute2,
+  iptables,
+  multipath-tools,
+  nbd,
+  openvswitch,
+  util-linux,
+}:
+
+{
+  pname,
+  branch ? lib.versions.majorMinor version,
+  version,
+  vendor ? "nixos",
+  withEFI ? true,
+  withFlask ? false,
+  withSeaBIOS ? true,
+  withOVMF ? true,
+  withIPXE ? true,
+  useDefaultPatchList ? true,
+  rev,
+  hash,
+  patches ? [ ],
+  meta ? { },
+}:
+
+let
+  # Inherit helper functions from lib and builtins.
+  inherit (builtins) elemAt isAttrs;
+  inherit (lib.strings)
+    concatLines
+    enableFeature
+    makeSearchPathOutput
+    optionalString
+    removeSuffix
+    versionOlder
+    ;
+  inherit (lib.platforms) linux aarch64;
+  inherit (lib) teams;
+  inherit (lib.licenses)
+    cc-by-40
+    gpl2Only
+    lgpl21Only
+    mit
+    ;
+  inherit (lib.meta) getExe';
+  inherit (lib.lists)
+    count
+    flatten
+    optional
+    optionals
+    range
+    remove
+    zipListsWith
+    ;
+  inherit (lib.attrsets) attrByPath;
+
+  # Mark versions older than minSupportedVersion as EOL.
+  minSupportedVersion = "4.16";
+
+  ## Generic Patch Handling ##
+
+  upstreamPatches = import ./patches.nix {
+    inherit lib fetchpatch;
+  };
+
+  upstreamPatchList = flatten (
+    with upstreamPatches;
+    [
+      QUBES_REPRODUCIBLE_BUILDS
+      XSA_460
+      XSA_461
+      XSA_462
+    ]
+  );
+
+  ## XSA Patches Description Builder ##
+
+  # Simple counter for the number of attrsets (patches) in the patches list after normalisation.
+  numberOfPatches = count (patch: isAttrs patch) upstreamPatchList;
+
+  # builtins.elemAt's index begins at 0, so we subtract 1 from the number of patches in order to
+  # produce the range that will be used in the following builtin.map calls.
+  availablePatchesToTry = range 0 (numberOfPatches - 1);
+
+  # Takes in an attrByPath input, and outputs the attribute value for each patch in a list.
+  # If a patch does not have a given attribute, returns `null`. Use lib.lists.remove null
+  # to remove these junk values, if necessary.
+  retrievePatchAttributes =
+    attributeName:
+    map (x: attrByPath attributeName null (elemAt upstreamPatchList x)) availablePatchesToTry;
+
+  # Produces a list of newline-separated strings that lists the vulnerabilities this
+  # Xen is NOT affected by, due to the applied Xen Security Advisory patches. This is
+  # then used in meta.longDescription, to let users know their Xen is patched against
+  # known vulnerabilities, as the package version isn't always the best indicator.
+  #
+  # Produces something like this: (one string for each XSA)
+  #  * [Xen Security Advisory #1](https://xenbits.xenproject.org/xsa/advisory-1.html): **Title for XSA.**
+  #  >Description of issue in XSA
+  #Extra lines
+  #are not indented,
+  #but markdown should be
+  #fine with it.
+  #  Fixes:
+  #  * [CVE-1999-00001](https://www.cve.org/CVERecord?id=CVE-1999-00001)
+  #  * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002)
+  #  * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003)
+  writeAdvisoryDescription =
+    if (remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then
+      zipListsWith (a: b: a + b)
+        (zipListsWith (a: b: a + "**" + b + ".**\n  >")
+          (zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ")
+            (remove null (retrievePatchAttributes [ "xsa" ]))
+            (
+              remove null (retrievePatchAttributes [
+                "meta"
+                "homepage"
+              ])
+            )
+          )
+          (
+            remove null (retrievePatchAttributes [
+              "meta"
+              "description"
+            ])
+          )
+        )
+        (
+          remove null (retrievePatchAttributes [
+            "meta"
+            "longDescription"
+          ])
+        )
+    else
+      [ ];
+
+  #TODO: fix paths instead.
+  scriptEnvPath = makeSearchPathOutput "out" "bin" [
+    bridge-utils
+    coreutils
+    diffutils
+    gawk
+    gnugrep
+    gnused
+    inetutils
+    iproute2
+    iptables
+    multipath-tools
+    nbd
+    openvswitch
+    perl
+    util-linux.bin
+    which
+  ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version;
+
+  # TODO: Split $out in $bin for binaries and $lib for libraries.
+  # TODO: Python package to be in separate output/package.
+  outputs = [
+    "out"
+    "man"
+    "doc"
+    "dev"
+    "boot"
+  ];
+
+  # Main Xen source.
+  src = fetchgit {
+    url = "https://xenbits.xenproject.org/git-http/xen.git";
+    inherit rev hash;
+  };
+
+  patches = optionals useDefaultPatchList upstreamPatchList ++ patches;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    bison
+    cmake
+    flex
+    pandoc
+    pkg-config
+    python3Packages.setuptools
+  ];
+  buildInputs = [
+    # Xen
+    acpica-tools
+    bzip2
+    dev86
+    e2fsprogs.dev
+    libnl
+    libuuid
+    lzo
+    ncurses
+    perl
+    python3Packages.python
+    xz
+    yajl
+    zlib
+    zstd
+
+    # oxenstored
+    ocamlPackages.findlib
+    ocamlPackages.ocaml
+
+    # Python Fixes
+    python3Packages.wrapPython
+  ] ++ optional withFlask checkpolicy ++ optional (versionOlder version "4.19") systemdMinimal;
+
+  configureFlags = [
+    "--enable-systemd"
+    "--disable-qemu-traditional"
+    "--with-system-qemu"
+    (if withSeaBIOS then "--with-system-seabios=${seabios}/share/seabios" else "--disable-seabios")
+    (if withOVMF then "--with-system-ovmf=${OVMF.firmware}" else "--disable-ovmf")
+    (if withIPXE then "--with-system-ipxe=${ipxe}" else "--disable-ipxe")
+    (enableFeature withFlask "xsmpolicy")
+  ];
+
+  makeFlags =
+    [
+      "SUBSYSTEMS=${toString finalAttrs.buildFlags}"
+
+      "PREFIX=$(out)"
+      "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
+
+      "XEN_WHOAMI=${pname}"
+      "XEN_DOMAIN=${vendor}"
+
+      "GIT=${coreutils}/bin/false"
+      "WGET=${coreutils}/bin/false"
+    ]
+    ++ optionals withEFI [
+      "EFI_VENDOR=${vendor}"
+      "INSTALL_EFI_STRIP=1"
+      "LD=${getExe' binutils-unwrapped-all-targets "ld"}"
+    ]
+    # These flags set the CONFIG_* options in /boot/xen.config
+    # and define if the default policy file is built. However,
+    # the Flask binaries always get compiled by default.
+    ++ optionals withFlask [
+      "XSM_ENABLE=y"
+      "FLASK_ENABLE=y"
+    ];
+
+  buildFlags = [
+    "xen"
+    "tools"
+    "docs"
+  ];
+
+  enableParallelBuilding = true;
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=array-bounds"
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  # Remove in-tree QEMU sources, we don't need them in any circumstance.
+  prePatch = "rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional";
+
+  postPatch =
+    # The following patch forces Xen to install xen.efi on $out/boot
+    # instead of $out/boot/efi/efi/nixos, as the latter directory
+    # would otherwise need to be created manually. This also creates
+    # a more consistent output for downstreams who override the
+    # vendor attribute above.
+    ''
+      substituteInPlace xen/Makefile \
+        --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
+                  "\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
+    ''
+
+    # The following patch fixes the call to /bin/mkdir on the
+    # launch_xenstore.sh helper script.
+    + ''
+      substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
+        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
+    ''
+
+    # The following expression fixes the paths called by Xen's systemd
+    # units, so we can use them in the NixOS module.
+    + ''
+      substituteInPlace \
+        tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
+        --replace-fail /bin/grep ${gnugrep}/bin/grep
+      substituteInPlace \
+       tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
+        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
+    '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir --parents $out $out/share $boot
+    cp -prvd dist/install/nix/store/*/* $out/
+    cp -prvd dist/install/etc $out
+    cp -prvd dist/install/boot $boot
+
+    runHook postInstall
+  '';
+
+  postInstall =
+    # Wrap xencov_split, xenmon and xentrace_format.
+    ''
+      wrapPythonPrograms
+    ''
+
+    # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
+    + ''
+      wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
+    ''
+
+    # Fix shebangs in Xen's various scripts.
+    #TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
+    + ''
+      shopt -s extglob
+      for i in $out/etc/xen/scripts/!(*.sh); do
+        sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
+      done
+    '';
+
+  postFixup =
+    ''
+      addAutoPatchelfSearchPath $out/lib
+      autoPatchelf $out/libexec/xen/bin
+    ''
+    # Flask is particularly hard to disable. Even after
+    # setting the make flags to `n`, it still gets compiled.
+    # If withFlask is disabled, delete the extra binaries.
+    + optionalString (!withFlask) ''
+      rm -f $out/bin/flask-*
+    '';
+
+  passthru = {
+    efi =
+      if withEFI then "boot/xen-${version}.efi" else throw "This Xen was compiled without an EFI binary.";
+    flaskPolicy =
+      if withFlask then
+        "boot/xenpolicy-${version}"
+      else
+        throw "This Xen was compiled without FLASK support.";
+    # This test suite is very simple, as Xen's userspace
+    # utilities require the hypervisor to be booted.
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+        moduleNames = [
+          "xencall"
+          "xencontrol"
+          "xendevicemodel"
+          "xenevtchn"
+          "xenforeignmemory"
+          "xengnttab"
+          "xenguest"
+          "xenhypfs"
+          "xenlight"
+          "xenstat"
+          "xenstore"
+          "xentoolcore"
+          "xentoollog"
+          "xenvchan"
+          "xlutil"
+        ];
+      };
+    };
+  };
+
+  meta = {
+    inherit branch;
+
+    description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
+    longDescription =
+      ''
+        The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
+        hypervisor*, which allows multiple virtual machines, known as domains, to run
+        concurrently with the host on the physical machine. On a typical *type-2
+        hypervisor*, the virtual machines run as applications on top of the
+        host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
+        virtualise **Unprivileged Domains**.
+
+        Use with the `qemu_xen` package.
+      ''
+      # Then, if any of the optional with* components are being built, add the "Includes:" string.
+      + optionalString (withEFI || withFlask) (
+        "\nIncludes:"
+        # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't
+        # that many optional components, we just use lib.strings.optionalString, because it's simpler.
+        # Optional components that aren't being built are automatically hidden.
+        + optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
+        + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package."
+        + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
+        + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
+        + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains."
+      )
+      # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to.
+      # This will hopefully give users the peace of mind that their Xen is secure, without needing
+      # to search the source code for the XSA patches.
+      + optionalString (writeAdvisoryDescription != [ ]) (
+        "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n"
+        + removeSuffix "\n" (concatLines writeAdvisoryDescription)
+      );
+
+    homepage = "https://xenproject.org/";
+    downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
+    changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
+
+    license = [
+      # Documentation.
+      cc-by-40
+      # Most of Xen is licensed under the GPL v2.0.
+      gpl2Only
+      # Xen Libraries and the `xl` command-line utility.
+      lgpl21Only
+      # Development headers in $dev/include.
+      mit
+    ];
+
+    maintainers = teams.xen.members;
+    knownVulnerabilities = optional (versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
+
+    mainProgram = "xl";
+
+    #TODO: Migrate meta.platforms to the new lib.systems.inspect.patterns.* format.
+    platforms = linux;
+    badPlatforms = aarch64;
+  } // meta;
+})
diff --git a/pkgs/applications/virtualization/xen/generic/patches.nix b/pkgs/build-support/xen/patches.nix
similarity index 94%
rename from pkgs/applications/virtualization/xen/generic/patches.nix
rename to pkgs/build-support/xen/patches.nix
index 4bb58d5a4216..66ca02e52dd9 100644
--- a/pkgs/applications/virtualization/xen/generic/patches.nix
+++ b/pkgs/build-support/xen/patches.nix
@@ -6,6 +6,9 @@
 { lib, fetchpatch }:
 
 let
+  inherit (builtins) concatStringsSep;
+  inherit (lib.strings) optionalString concatMapStrings;
+
   xsaPatch =
     {
       id,
@@ -16,8 +19,7 @@ let
       cve ? null,
     }:
     (fetchpatch {
-      name =
-        "XSA-" + id + lib.strings.optionalString (cve != null) ("-" + builtins.concatStringsSep "+" cve);
+      name = "XSA-" + id + optionalString (cve != null) ("-" + concatStringsSep "+" cve);
       url = "https://xenbits.xen.org/xsa/xsa${id}.patch";
       inherit hash;
       passthru = {
@@ -37,9 +39,7 @@ let
               "  _No CVE was assigned to this XSA._"
             else
               "  Fixes:${
-                  lib.strings.concatMapStrings (
-                    x: "\n  * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")"
-                  ) cve
+                  concatMapStrings (x: "\n  * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")") cve
                 }"
           );
         homepage = "https://xenbits.xenproject.org/xsa/advisory-${id}.html";
diff --git a/pkgs/by-name/li/libvmi/package.nix b/pkgs/by-name/li/libvmi/package.nix
index 4eb6f54ba336..a1f314497b7b 100644
--- a/pkgs/by-name/li/libvmi/package.nix
+++ b/pkgs/by-name/li/libvmi/package.nix
@@ -19,7 +19,7 @@
   libkvmi,
 
   xenSupport ? true,
-  xen-slim,
+  xen,
 }:
 
 let
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
       json_c
       libvirt
     ]
-    ++ lib.optionals xenSupport [ xen-slim ]
+    ++ lib.optionals xenSupport [ xen ]
     ++ lib.optionals (!legacyKVM) [ libkvmi ]
     ++ lib.optionals withVMIFS [ fuse ];
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
   postFixup = lib.optionalString xenSupport ''
     libvmi="$lib/lib/libvmi.so.${libVersion}"
     oldrpath=$(patchelf --print-rpath "$libvmi")
-    patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen-slim ]}" "$libvmi"
+    patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen ]}" "$libvmi"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
index ba333024e414..9a409f8da5e7 100644
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -9,13 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-hello";
-  version = "0.2.2";
+  version = "0.2.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-hello";
     rev = "refs/tags/v${version}";
-    hash = "sha256-czvKUuSAGEqtjIcIW9mm/LlUsvkGknHbwuXJw5YGT5A=";
+    hash = "sha256-WE6jtVZfsWJREZghU93v8EAq16MiERYnq3Y0g2caYPs=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +29,9 @@ python3Packages.buildPythonApplication rec {
     gtk-layer-shell
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = [
     python3Packages.pygobject3
   ];
 
@@ -52,6 +55,12 @@ python3Packages.buildPythonApplication rec {
     install -D -m 644 -t "$out/share/nwg-hello/" img/*
   '';
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   # Upstream has no tests
   doCheck = false;
   pythonImportsCheck = [ "nwg_hello" ];
diff --git a/pkgs/by-name/qe/qemu_xen/package.nix b/pkgs/by-name/qe/qemu_xen/package.nix
new file mode 100644
index 000000000000..0ea5571923e7
--- /dev/null
+++ b/pkgs/by-name/qe/qemu_xen/package.nix
@@ -0,0 +1 @@
+{ qemu }: qemu.override { xenSupport = true; }
diff --git a/pkgs/by-name/sl/slskd/package.nix b/pkgs/by-name/sl/slskd/package.nix
index ed60e90b7c63..f7ffdb02d4db 100644
--- a/pkgs/by-name/sl/slskd/package.nix
+++ b/pkgs/by-name/sl/slskd/package.nix
@@ -50,6 +50,10 @@ buildDotnetModule rec {
 
   testProjectFile = "tests/slskd.Tests.Unit/slskd.Tests.Unit.csproj";
   doCheck = true;
+  disabledTests = [
+    # Random failures on OfBorg, cause unknown
+    "slskd.Tests.Unit.Transfers.Uploads.UploadGovernorTests+ReturnBytes.Returns_Bytes_To_Bucket"
+  ];
 
   postBuild = ''
     pushd "$npmRoot"
diff --git a/pkgs/by-name/xe/xen-guest-agent/package.nix b/pkgs/by-name/xe/xen-guest-agent/package.nix
index b0223a6311ed..09c42e570911 100644
--- a/pkgs/by-name/xe/xen-guest-agent/package.nix
+++ b/pkgs/by-name/xe/xen-guest-agent/package.nix
@@ -4,7 +4,7 @@
   rustPlatform,
   llvmPackages,
   pkg-config,
-  xen-slim,
+  xen,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "xen-guest-agent";
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ xen-slim ];
+  buildInputs = [ xen ];
 
   postInstall =
     # Install the sample systemd service.
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
 
   postFixup =
     # Add the Xen libraries in the runpath so the guest agent can find libxenstore.
-    "patchelf $out/bin/xen-guest-agent --add-rpath ${xen-slim.out}/lib";
+    "patchelf $out/bin/xen-guest-agent --add-rpath ${xen}/lib";
 
   meta = {
     description = "Xen agent running in Linux/BSDs (POSIX) VMs";
diff --git a/pkgs/by-name/xe/xen/README.md b/pkgs/by-name/xe/xen/README.md
new file mode 100644
index 000000000000..df3b71b3c956
--- /dev/null
+++ b/pkgs/by-name/xe/xen/README.md
@@ -0,0 +1,133 @@
+<p align="center">
+  <a href="https://xenproject.org/">
+    <picture>
+      <source
+        media="(prefers-color-scheme: light)"
+        srcset="https://downloads.xenproject.org/Branding/Logos/Green+Black/xen_project_logo_dualcolor_2000x832.png">
+      <source
+        media="(prefers-color-scheme: dark)"
+        srcset="https://xenproject.org/wp-content/uploads/sites/79/2018/09/logo_xenproject.png">
+      <img
+        src="https://downloads.xenproject.org/Branding/Logos/Green+Black/xen_project_logo_dualcolor_2000x832.png"
+        width="512px"
+        alt="Xen Project Logo">
+    </picture>
+  </a>
+</p>
+
+# Xen Project Hypervisor <a href="https://xenproject.org/"><img src="https://downloads.xenproject.org/Branding/Mascots/Xen-Fu-Panda-2000px.png" width="48px" align="top" alt="Xen Fu Panda"></a>
+
+This directory begins the [Xen Project Hypervisor](https://xenproject.org/) build process.
+
+Some other notable packages that compose the Xen Project Ecosystem include:
+
+- `ocamlPackages.xenstore`: Mirage's `oxenstore` implementation.
+- `ocamlPackages.vchan`: Mirage's `xen-vchan` implementation.
+- `ocamlPackages.xenstore-tool`: XAPI's `oxenstore` utilities.
+- `xen-guest-agent`: Guest drivers for UNIX domUs.
+- `win-pvdrivers`: Guest drivers for Windows domUs.
+- `xtf`: The Xen Test Framework.
+
+## Updating
+
+### Manually
+
+1. [Update](https://xenbits.xenproject.org/gitweb/) the `package.nix` file for
+   the latest branch of Xen.
+   - Do not forget to set the `branch`, `version`, and `latest` attributes.
+   - The revisions are preferably commit hashes, but tag names are acceptable
+     as well.
+1. Make sure it builds.
+1. Use the NixOS module to test if dom0 boots successfully on the new version.
+1. Make sure the `meta` attributes evaluate to something that makes sense. The
+   following one-line command is useful for testing this:
+
+   ```console
+   echo -e "\033[1m$(nix eval .#xen.meta.description --raw 2> /dev/null)\033[0m\n\n$(nix eval .#xen.meta.longDescription --raw 2> /dev/null)"
+   ```
+
+1. Run `xtf --all --host` as root when booted into the Xen update, and make
+   sure no important tests fail.
+1. Clean up your changes and commit them, making sure to follow the
+   [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md).
+1. Open a PR and await a review from the current maintainers.
+
+## Features
+
+### Generic Builder
+
+`buildXenPackage` is a helpful utility capable of building Xen when passed
+certain attributes. The `package.nix` file on this directory includes all
+important attributes for building a Xen package with Nix. Downstreams can
+pin their Xen revision or include extra patches if the default Xen package
+does not meet their needs.
+
+### EFI
+
+Building `xen.efi` requires an `ld` with PE support.[^2]
+
+We use a `makeFlag` to override the `$LD` environment variable to point to our
+patched `efiBinutils`. For more information, see the comment in `pkgs/build-support/xen/default.nix`.
+
+> [!TIP]
+> If you are certain you will not be running Xen in an x86 EFI environment, disable
+the `withEFI` flag with an [override](https://nixos.org/manual/nixpkgs/stable/#chap-overrides)
+to save you the need to compile `efiBinutils`.
+
+## Security
+
+We aim to support the **latest** version of Xen at any given time.
+See the [Xen Support Matrix](https://xenbits.xen.org/docs/unstable/support-matrix.html)
+for a list of versions. As soon as a version is no longer the newest, it should
+be removed from Nixpkgs (`master`). If you need earlier versions of Xen, consider
+building your own Xen by following the instructions in the **Generic Builder**
+section.
+
+> [!CAUTION]
+> Pull requests that introduce XSA patches
+should have the `1.severity: security` label.
+
+### Maintainers
+
+Xen is a particularly complex piece of software, so we are always looking for new
+maintainers. Help out by [making and triaging issues](https://github.com/NixOS/nixpkgs/issues/new/choose),
+[sending build fixes and improvements through PRs](https://github.com/NixOS/nixpkgs/compare),
+updating the branches, and [patching security flaws](https://xenbits.xenproject.org/xsa/).
+
+We are also looking for testers, particularly those who can test Xen on AArch64
+machines. Open issues for any build failures or runtime errors you find!
+
+## Tests
+
+So far, we only have had one simple automated test that checks for
+the correct `pkg-config` output files.
+
+Due to Xen's nature as a type-1 hypervisor, it is not a trivial matter to design
+new tests, as even basic functionality requires a machine booted in a dom0
+kernel. For this reason, most testing done with this package must be done
+manually in a NixOS machine with `virtualisation.xen.enable` set to `true`.
+
+Another unfortunate thing is that none of the Xen commands have a `--version`
+flag. This means that `testers.testVersion` cannot ascertain the Xen version.
+The only way to verify that you have indeed built the correct version is to
+boot into the freshly built Xen kernel and run `xl info`.
+
+<p align="center">
+  <a href="https://xenproject.org/">
+    <img
+      src="https://downloads.xenproject.org/Branding/Mascots/Xen%20Big%20Panda%204242x3129.png"
+      width="96px"
+      alt="Xen Fu Panda">
+  </a>
+</p>
+
+[^1]: We also produce fake `git`, `wget` and `hostname` binaries that do nothing,
+      to prevent the build from failing because Xen cannot fetch the sources that
+      were already fetched by Nix.
+[^2]: From the [Xen Documentation](https://xenbits.xenproject.org/docs/unstable/misc/efi.html):
+      > For x86, building `xen.efi` requires `gcc` 4.5.x or above (4.6.x or newer
+      recommended, as 4.5.x was probably never really tested for this purpose)
+      and `binutils` 2.22 or newer. Additionally, the `binutils` build must be
+      configured to include support for the x86_64-pep emulation (i.e.
+      `--enable-targets=x86_64-pep` or an option of equivalent effect should be
+      passed to the configure script).
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
new file mode 100644
index 000000000000..6f527cda1e7b
--- /dev/null
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -0,0 +1,11 @@
+{
+  buildXenPackage,
+  python3Packages,
+}:
+
+buildXenPackage.override { inherit python3Packages; } {
+  pname = "xen";
+  version = "4.19.0";
+  rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239";
+  hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q=";
+}
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index edffc11d361b..2bdc0ed09ebd 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "yamlscript";
-  version = "0.1.76";
+  version = "0.1.79";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-+3UKOHfiY5GUkvvciNNFXBiAX1QQV4BUIFN+EhbjSEs=";
+    hash = "sha256-Jx3mnAgsTi/5nqcy6DVYPoM4GlQJf+10uuQzhUWp5ZU=";
   };
 
   executable = "ys";
diff --git a/pkgs/development/coq-modules/coq-lsp/default.nix b/pkgs/development/coq-modules/coq-lsp/default.nix
index ee33c1a148b5..d9ddb25636fd 100644
--- a/pkgs/development/coq-modules/coq-lsp/default.nix
+++ b/pkgs/development/coq-modules/coq-lsp/default.nix
@@ -8,18 +8,18 @@
   useDune = true;
 
   release."0.1.8+8.16".sha256 = "sha256-dEEAK5IXGjHB8D/fYJRQG/oCotoXJuWLxXB0GQlY2eo=";
-  release."0.1.9+8.17".sha256 = "sha256-BCsVRKSE9txeKgDfTsu7hQ6MebC+dX2AAqDF9iL7bYE=";
-  release."0.2.0+8.18".sha256 = "sha256-OByBB1CLmj2N0AEieBXLVvP6OLGqi0HXra2jE9k3hXU=";
-  release."0.2.0+8.19".sha256 = "sha256-G/UurWHxR2VzjClZCDHYcz7wAQAaYZt+DsADSXMybdk=";
-  release."0.2.0+8.20".sha256 = "sha256-+KRiYK+YCHC4R6/yDenRI8SqZiZ29X24xlDzegbPfrw=";
+  release."0.2.2+8.17".sha256 = "sha256-dWPAwePbfTf2t+ydSd1Cnr2kKTDbvedmxm2+Z6F5zuM=";
+  release."0.2.2+8.18".sha256 = "sha256-0J/XaSvhnKHRlcWfG1xbUOyN4LDtK1SEahE9kpV7GK4=";
+  release."0.2.2+8.19".sha256 = "sha256-E2zO2SOU3nmTFf1yA1gefyIWTViUGNTTJ4r6fZYl6UY=";
+  release."0.2.2+8.20".sha256 = "sha256-9yHisA3YJ/KuolU53qcQAjuSIAZPY+4rnkWV9dpLc6c=";
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = isEq "8.16"; out = "0.1.8+8.16"; }
-    { case = isEq "8.17"; out = "0.1.9+8.17"; }
-    { case = isEq "8.18"; out = "0.2.0+8.18"; }
-    { case = isEq "8.19"; out = "0.2.0+8.19"; }
-    { case = isEq "8.20"; out = "0.2.0+8.20"; }
+    { case = isEq "8.17"; out = "0.2.2+8.17"; }
+    { case = isEq "8.18"; out = "0.2.2+8.18"; }
+    { case = isEq "8.19"; out = "0.2.2+8.19"; }
+    { case = isEq "8.20"; out = "0.2.2+8.20"; }
   ] null;
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index ee4af8214a37..e4c6afce8a61 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -78,7 +78,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.46.0";
+  version = "2.46.1";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-1NQzBA8ZAVFWDFC96ECFAIn4e61P76nr20quhWo99Do=";
+    hash = "sha256-KhT6rDWa/5QdC8REPrVTfjcCvK8xawoSng5l8/+OqsA=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/development/python-modules/anthropic/default.nix b/pkgs/development/python-modules/anthropic/default.nix
index ce0eb296ec26..2c38ef988fdc 100644
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "anthropic";
-  version = "0.34.2";
+  version = "0.35.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "anthropics";
     repo = "anthropic-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JSc1Atl6nN0eOJf4dx7tkb05creU43zRM08HKorznW4=";
+    hash = "sha256-/lA44YwUWwm8ZswCBneT3sutcpQ2GPv0S2bHTUGiwwg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/chess/default.nix b/pkgs/development/python-modules/chess/default.nix
index 50cb9306969f..81f990fe75bb 100644
--- a/pkgs/development/python-modules/chess/default.nix
+++ b/pkgs/development/python-modules/chess/default.nix
@@ -2,14 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  python,
+  setuptools,
   pythonOlder,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "chess";
-  version = "1.10.0";
-  format = "setuptools";
+  version = "1.11.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -17,14 +18,16 @@ buildPythonPackage rec {
     owner = "niklasf";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jfPg1W9Qp0DlAbMXaFqZ6Ri2zMOW6EKUHwi7Azn/yl0=";
+    hash = "sha256-+YNEm1QppXeeIjOKfCSQoQmuSzBsW4ws0ej/whjTAPg=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "chess" ];
 
-  checkPhase = ''
-    ${python.interpreter} ./test.py -v
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "test.py" ];
 
   meta = with lib; {
     description = "Chess library with move generation, move validation, and support for common formats";
diff --git a/pkgs/development/python-modules/lcn-frontend/default.nix b/pkgs/development/python-modules/lcn-frontend/default.nix
index 2ddb12711b41..310d407fa70a 100644
--- a/pkgs/development/python-modules/lcn-frontend/default.nix
+++ b/pkgs/development/python-modules/lcn-frontend/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lcn-frontend";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   src = fetchPypi {
     pname = "lcn_frontend";
     inherit version;
-    hash = "sha256-bOR2BFYHZjRVhlH72ljqp4WKtWdqBkzZNyrmtuIzmIM=";
+    hash = "sha256-S/7NUduAiekQ5CDOw8JRCTO9mbvLW6MmB/n8iQQPkok=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/gnulib/default.nix b/pkgs/development/tools/gnulib/default.nix
index 1a5f173317d1..42159a21cd91 100644
--- a/pkgs/development/tools/gnulib/default.nix
+++ b/pkgs/development/tools/gnulib/default.nix
@@ -1,13 +1,13 @@
-{ lib, stdenv, fetchFromSavannah, python3, perl }:
+{ lib, stdenv, fetchgit, python3, perl }:
 
 stdenv.mkDerivation rec {
   pname = "gnulib";
-  version = "20231109";
+  version = "20241001";
 
-  src = fetchFromSavannah {
-    repo = "gnulib";
-    rev = "2dd1a7984c6b3e6056cef7e3f9933e0039c21634";
-    hash = "sha256-QtWf3mljEnr0TTogkoKN63Y5HTm14A2e/sIXX3xe2SE=";
+  src = fetchgit {
+    url = "https://git.savannah.gnu.org/git/gnulib.git";
+    rev = "0a01f6737dc5666c730bdfe6a038da53a4156cc2";
+    hash = "sha256-kbmXnXXoaTPGwjUJvnHWCQFS2KGQ9fsjIyloNmkKdc4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/terramate/default.nix b/pkgs/development/tools/misc/terramate/default.nix
index 341919bd41a4..5d2be8f5a4c8 100644
--- a/pkgs/development/tools/misc/terramate/default.nix
+++ b/pkgs/development/tools/misc/terramate/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.10.4";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-raVB0c/TZK/NKv/J1t8nrPAeABd5gQhjeuKL8kYm9YI=";
+    hash = "sha256-6IG6wIKz13yBR+LZYkabfckUomIEcjpGbHZ7HCvGs7M=";
   };
 
   vendorHash = "sha256-kjzpXOoyTwjpYLBqDuB6Eup5Yzgej2U+HUo4z8V+cEI=";
@@ -28,6 +28,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Adds code generation, stacks, orchestration, change detection, data sharing and more to Terraform";
     homepage = "https://github.com/terramate-io/terramate";
+    changelog = "https://github.com/terramate-io/terramate/releases/tag/v${version}";
     license = licenses.mpl20;
     maintainers = with maintainers; [ dit7ya ];
   };
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/games/quakespasm/default.nix
index 5b124cb464d1..28c925b5249e 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
     ./quakespasm-darwin-makefile-improvements.patch
   ];
 
+  # Quakespasm tries to set a 10.6 deployment target, but that’s too low for SDL2.
+  postPatch = ''
+    sed -i Makefile.darwin -e '/-mmacosx-version-min/d'
+  '';
+
   nativeBuildInputs = [
     copyDesktopItems
     pkg-config
diff --git a/pkgs/games/quakespasm/vulkan.nix b/pkgs/games/quakespasm/vulkan.nix
index d4fdc41b4a32..10c647fb17aa 100644
--- a/pkgs/games/quakespasm/vulkan.nix
+++ b/pkgs/games/quakespasm/vulkan.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vkquake";
-  version = "1.31.1.1";
+  version = "1.31.2";
 
   src = fetchFromGitHub {
     owner = "Novum";
     repo = "vkQuake";
     rev = version;
-    sha256 = "sha256-GSCH8U5N95I/gj5KIzAnpsU4i2xJuzXcccuKKAskk8Q=";
+    sha256 = "sha256-7JE1KBavZt8u55KpWMmQOJJuxlW99ICnaQI4MbTgGdw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/nosql/mongodb/5.0.nix b/pkgs/servers/nosql/mongodb/5.0.nix
deleted file mode 100644
index 84c0991515b0..000000000000
--- a/pkgs/servers/nosql/mongodb/5.0.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ stdenv, callPackage, lib, sasl, boost
-, Security, CoreFoundation, cctools
-, avxSupport ? stdenv.hostPlatform.avxSupport
-, nixosTests
-}:
-
-let
-  buildMongoDB = callPackage ./mongodb.nix {
-    inherit sasl boost Security CoreFoundation cctools;
-  };
-  variants = if stdenv.hostPlatform.isLinux then
-    {
-      version = "5.0.29";
-      sha256 = "sha256-27+SXo0fjFwJFFm/NhpDhq95dMwiN8RCJO7j5ic49Ls=";
-      patches = [ ./fix-build-with-boost-1.79-5_0-linux.patch ];
-    }
-  else lib.optionalAttrs stdenv.hostPlatform.isDarwin
-    {
-      version = "5.0.3"; # at least darwin has to stay on 5.0.3 until the SDK used by nixpkgs is bumped to 10.13
-      sha256 = "1p9pq0dfd6lynvnz5p1c8dqp4filzrz86j840xwxwx82dm1zl6p0";
-      patches = [ ./fix-build-with-boost-1.79-5_0.patch ]; # no darwin in name to prevent unnecessary rebuild
-    };
-in
-buildMongoDB {
-  inherit avxSupport;
-  version = variants.version;
-  sha256 = variants.sha256;
-  patches = [
-    ./forget-build-dependencies-4-4.patch
-    ./asio-no-experimental-string-view-4-4.patch
-    ./fix-gcc-Wno-exceptions-5.0.patch
-    # Fix building with python 3.12 since the imp module was removed
-    ./mongodb-python312.patch
-  ] ++ variants.patches;
-  passthru.tests = { inherit (nixosTests) mongodb; };
-}
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
index 7132039908b0..a3567e5234d8 100644
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ b/pkgs/servers/nosql/mongodb/6.0.nix
@@ -25,5 +25,5 @@ buildMongoDB {
     # Fix building with python 3.12 since the imp module was removed
     ./mongodb-python312.patch
   ];
-  # passthru.tests = { inherit (nixosTests) mongodb; }; # currently tests mongodb-5_0
+  # passthru.tests = { inherit (nixosTests) mongodb; }; # currently tests mongodb-7_0
 }
diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index ec7136119472..ccd5eade79b8 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -7,6 +7,7 @@
   CoreFoundation,
   cctools,
   avxSupport ? stdenv.hostPlatform.avxSupport,
+  nixosTests,
 }:
 
 let
@@ -34,4 +35,7 @@ buildMongoDB {
     # Fix building with python 3.12 since the imp module was removed
     ./mongodb-python312.patch
   ];
+  passthru.tests = {
+    inherit (nixosTests) mongodb;
+  };
 }
diff --git a/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view-4-4.patch b/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view-4-4.patch
deleted file mode 100644
index b27145d57ecf..000000000000
--- a/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view-4-4.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/src/third_party/asio-master/asio/include/asio/detail/config.hpp
---- b/src/third_party/asio-master/asio/include/asio/detail/config.hpp
-@@ -831,20 +831,8 @@
- #     endif // (__cplusplus >= 201402)
- #    endif // (_LIBCPP_VERSION < 7000)
- #   else // defined(ASIO_HAS_CLANG_LIBCXX)
--#    if (__cplusplus >= 201402)
--#     if __has_include(<experimental/string_view>)
--#      define ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW 1
--#     endif // __has_include(<experimental/string_view>)
--#    endif // (__cplusplus >= 201402)
- #   endif // // defined(ASIO_HAS_CLANG_LIBCXX)
- #  endif // defined(__clang__)
--#  if defined(__GNUC__)
--#   if ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 9)) || (__GNUC__ > 4)
--#    if (__cplusplus >= 201402)
--#     define ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW 1
--#    endif // (__cplusplus >= 201402)
--#   endif // ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 9)) || (__GNUC__ > 4)
--#  endif // defined(__GNUC__)
- # endif // !defined(ASIO_DISABLE_STD_EXPERIMENTAL_STRING_VIEW)
- #endif // !defined(ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW)
- 
diff --git a/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0-linux.patch b/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0-linux.patch
deleted file mode 100644
index eb205bd92894..000000000000
--- a/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0-linux.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From fb846bdbd07cc3b8ada6179dccd974072c2b69da Mon Sep 17 00:00:00 2001
-From: Et7f3 <cadeaudeelie@gmail.com>
-Date: Tue, 19 Jul 2022 22:01:56 +0200
-Subject: [PATCH] build: Upgrade boost to 1.79.0
-
-We can see in src/third_party/boost/boost/version.hpp that vendored version of
-boost is BOOST_LIB_VERSION "1_76"
-
-We can also see the doc desbribe 2 headers to use filesystems lib: One is
-src/third_party/boost/boost/filesystem/fstream.hpp that contains (175-177)
-  typedef basic_ifstream<char> ifstream;
-  typedef basic_ofstream<char> ofstream;
-  typedef basic_fstream<char> fstream;
-
-So this mean they mostly forgot to include a header and include-what-you-use
-would catch this error.
-
-In upstream they fixed in a simmilar way
-https://github.com/mongodb/mongo/commit/13389dc222fc372442be8c147e09685bb9a26a3a
----
- src/mongo/db/storage/storage_repair_observer.cpp    | 1 +
- src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp | 1 +
- src/mongo/shell/shell_utils_extended.cpp            | 1 +
- src/mongo/util/processinfo_linux.cpp                | 1 +
- src/mongo/util/stacktrace_threads.cpp               | 1 +
- 5 files changed, 5 insertions(+)
-
-diff --git a/src/mongo/db/storage/storage_repair_observer.cpp b/src/mongo/db/storage/storage_repair_observer.cpp
-index 22b76a6a39c..453f48229cd 100644
---- a/src/mongo/db/storage/storage_repair_observer.cpp
-+++ b/src/mongo/db/storage/storage_repair_observer.cpp
-@@ -42,6 +42,7 @@
- #endif
- 
- #include <boost/filesystem/path.hpp>
-+#include <boost/filesystem/fstream.hpp>
- 
- #include "mongo/db/dbhelpers.h"
- #include "mongo/db/operation_context.h"
-diff --git a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-index 2f032e4..d1a90e0 100644
---- a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-+++ b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-@@ -37,6 +37,7 @@
-
- #include <boost/filesystem.hpp>
- #include <boost/filesystem/path.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <pcrecpp.h>
-
- #include "mongo/base/simple_string_data_comparator.h"
-diff --git a/src/mongo/shell/shell_utils_extended.cpp b/src/mongo/shell/shell_utils_extended.cpp
-index fbdddc1318d..e37d4c93a11 100644
---- a/src/mongo/shell/shell_utils_extended.cpp
-+++ b/src/mongo/shell/shell_utils_extended.cpp
-@@ -37,6 +37,7 @@
- #endif
- 
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <fmt/format.h>
- #include <fstream>
- 
-diff --git a/src/mongo/util/processinfo_linux.cpp b/src/mongo/util/processinfo_linux.cpp
-index eae0e9b7764..d5cd40f6039 100644
---- a/src/mongo/util/processinfo_linux.cpp
-+++ b/src/mongo/util/processinfo_linux.cpp
-@@ -52,6 +52,7 @@
- #endif
- 
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <boost/none.hpp>
- #include <boost/optional.hpp>
- #include <fmt/format.h>
-diff --git a/src/mongo/util/stacktrace_threads.cpp b/src/mongo/util/stacktrace_threads.cpp
-index d2ee29d24b4..d485fa22367 100644
---- a/src/mongo/util/stacktrace_threads.cpp
-+++ b/src/mongo/util/stacktrace_threads.cpp
-@@ -36,6 +36,7 @@
- #include <array>
- #include <atomic>
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <cstdint>
- #include <cstdlib>
- #include <dirent.h>
--- 
-2.32.1 (Apple Git-133)
-
diff --git a/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0.patch b/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0.patch
deleted file mode 100644
index d00ed5e77d67..000000000000
--- a/pkgs/servers/nosql/mongodb/fix-build-with-boost-1.79-5_0.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From fb846bdbd07cc3b8ada6179dccd974072c2b69da Mon Sep 17 00:00:00 2001
-From: Et7f3 <cadeaudeelie@gmail.com>
-Date: Tue, 19 Jul 2022 22:01:56 +0200
-Subject: [PATCH] build: Upgrade boost to 1.79.0
-
-We can see in src/third_party/boost/boost/version.hpp that vendored version of
-boost is BOOST_LIB_VERSION "1_76"
-
-We can also see the doc desbribe 2 headers to use filesystems lib: One is
-src/third_party/boost/boost/filesystem/fstream.hpp that contains (175-177)
-  typedef basic_ifstream<char> ifstream;
-  typedef basic_ofstream<char> ofstream;
-  typedef basic_fstream<char> fstream;
-
-So this mean they mostly forgot to include a header and include-what-you-use
-would catch this error.
-
-In upstream they fixed in a simmilar way
-https://github.com/mongodb/mongo/commit/13389dc222fc372442be8c147e09685bb9a26a3a
----
- src/mongo/db/storage/storage_repair_observer.cpp    | 1 +
- src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp | 1 +
- src/mongo/shell/shell_utils_extended.cpp            | 1 +
- src/mongo/util/processinfo_linux.cpp                | 1 +
- src/mongo/util/stacktrace_threads.cpp               | 1 +
- 5 files changed, 5 insertions(+)
-
-diff --git a/src/mongo/db/storage/storage_repair_observer.cpp b/src/mongo/db/storage/storage_repair_observer.cpp
-index 22b76a6a39c..453f48229cd 100644
---- a/src/mongo/db/storage/storage_repair_observer.cpp
-+++ b/src/mongo/db/storage/storage_repair_observer.cpp
-@@ -42,6 +42,7 @@
- #endif
- 
- #include <boost/filesystem/path.hpp>
-+#include <boost/filesystem/fstream.hpp>
- 
- #include "mongo/db/dbhelpers.h"
- #include "mongo/db/operation_context.h"
-diff --git a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-index 07fabadd634..2924a2c74af 100644
---- a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-+++ b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
-@@ -37,6 +37,7 @@
- 
- #include <boost/filesystem.hpp>
- #include <boost/filesystem/path.hpp>
-+#include <boost/filesystem/fstream.hpp>
- 
- #include "mongo/base/simple_string_data_comparator.h"
- #include "mongo/bson/bsonobjbuilder.h"
-diff --git a/src/mongo/shell/shell_utils_extended.cpp b/src/mongo/shell/shell_utils_extended.cpp
-index fbdddc1318d..e37d4c93a11 100644
---- a/src/mongo/shell/shell_utils_extended.cpp
-+++ b/src/mongo/shell/shell_utils_extended.cpp
-@@ -37,6 +37,7 @@
- #endif
- 
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <fmt/format.h>
- #include <fstream>
- 
-diff --git a/src/mongo/util/processinfo_linux.cpp b/src/mongo/util/processinfo_linux.cpp
-index eae0e9b7764..d5cd40f6039 100644
---- a/src/mongo/util/processinfo_linux.cpp
-+++ b/src/mongo/util/processinfo_linux.cpp
-@@ -52,6 +52,7 @@
- #endif
- 
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <boost/none.hpp>
- #include <boost/optional.hpp>
- #include <fmt/format.h>
-diff --git a/src/mongo/util/stacktrace_threads.cpp b/src/mongo/util/stacktrace_threads.cpp
-index d2ee29d24b4..d485fa22367 100644
---- a/src/mongo/util/stacktrace_threads.cpp
-+++ b/src/mongo/util/stacktrace_threads.cpp
-@@ -36,6 +36,7 @@
- #include <array>
- #include <atomic>
- #include <boost/filesystem.hpp>
-+#include <boost/filesystem/fstream.hpp>
- #include <cstdint>
- #include <cstdlib>
- #include <dirent.h>
--- 
-2.32.1 (Apple Git-133)
-
diff --git a/pkgs/servers/nosql/mongodb/fix-gcc-Wno-exceptions-5.0.patch b/pkgs/servers/nosql/mongodb/fix-gcc-Wno-exceptions-5.0.patch
deleted file mode 100644
index b8803911968b..000000000000
--- a/pkgs/servers/nosql/mongodb/fix-gcc-Wno-exceptions-5.0.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From e78b2bf6eaa0c43bd76dbb841add167b443d2bb0 Mon Sep 17 00:00:00 2001
-From: Mark Benvenuto <mark.benvenuto@mongodb.com>
-Date: Mon, 21 Jun 2021 11:36:56 -0400
-Subject: [PATCH] SERVER-57688 Fix debug gcc 11 and clang 12 builds on Fedora
- 34
-
----
- SConstruct                              | 4 ----
- src/mongo/db/query/plan_summary_stats.h | 4 +++-
- src/mongo/util/shim_boost_assert.cpp    | 1 +
- 3 files changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/SConstruct b/SConstruct
-index 25fd4a248d0c..23cff6f9da53 100644
---- a/SConstruct
-+++ b/SConstruct
-@@ -3108,10 +3108,6 @@ def doConfigure(myenv):
-         # harmful to capture unused variables we are suppressing for now with a plan to fix later.
-         AddToCCFLAGSIfSupported(myenv, "-Wno-unused-lambda-capture")
- 
--        # This warning was added in clang-5 and incorrectly flags our implementation of
--        # exceptionToStatus(). See https://bugs.llvm.org/show_bug.cgi?id=34804
--        AddToCCFLAGSIfSupported(myenv, "-Wno-exceptions")
--
-         # Enable sized deallocation support.
-         AddToCXXFLAGSIfSupported(myenv, '-fsized-deallocation')
- 
-diff --git a/src/mongo/db/query/plan_summary_stats.h b/src/mongo/db/query/plan_summary_stats.h
-index 58677ab20d25..cfaa2053d16f 100644
---- a/src/mongo/db/query/plan_summary_stats.h
-+++ b/src/mongo/db/query/plan_summary_stats.h
-@@ -29,9 +29,11 @@
- 
- #pragma once
- 
--#include "mongo/util/container_size_helper.h"
-+#include <optional>
- #include <string>
- 
-+#include "mongo/util/container_size_helper.h"
-+
- namespace mongo {
- 
- /**
diff --git a/pkgs/servers/nosql/mongodb/forget-build-dependencies-4-4.patch b/pkgs/servers/nosql/mongodb/forget-build-dependencies-4-4.patch
deleted file mode 100644
index 1c3e0982a8c1..000000000000
--- a/pkgs/servers/nosql/mongodb/forget-build-dependencies-4-4.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- a/site_scons/mongo/generators.py
-+++ b/site_scons/mongo/generators.py
-@@ -34,30 +34,12 @@ def default_buildinfo_environment_data():
-             False,
-         ),
-         (
--            'ccflags',
--            '$CCFLAGS',
--            True,
--            False,
--        ),
--        (
-             'cxx',
-             '$CXX_VERSION',
-             True,
-             False,
-         ),
-         (
--            'cxxflags',
--            '$CXXFLAGS',
--            True,
--            False,
--        ),
--        (
--            'linkflags',
--            '$LINKFLAGS',
--            True,
--            False,
--        ),
--        (
-             'target_arch',
-             '$TARGET_ARCH',
-             True,
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 5836a925498f..37fc0a2e8a57 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -39,14 +39,10 @@ let
     psutil
     setuptools
     distutils
-  ] ++ lib.optionals (lib.versionAtLeast version "6.0") [
     packaging
     pymongo
   ]);
 
-  mozjsVersion = "60";
-  mozjsReplace = "defined(HAVE___SINCOS)";
-
   system-libraries = [
     "boost"
     "snappy"
@@ -114,13 +110,6 @@ in stdenv.mkDerivation rec {
     #include <string>'
     substituteInPlace src/mongo/db/exec/plan_stats.h --replace '#include <string>' '#include <optional>
     #include <string>'
-  '' + lib.optionalString (stdenv.hostPlatform.isDarwin && lib.versionOlder version "6.0") ''
-    substituteInPlace src/third_party/mozjs-${mozjsVersion}/extract/js/src/jsmath.cpp --replace '${mozjsReplace}' 0
-  '' + lib.optionalString stdenv.hostPlatform.isi686 ''
-
-    # don't fail by default on i686
-    substituteInPlace src/mongo/db/storage/storage_options.h \
-      --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '' + lib.optionalString (!avxSupport) ''
     substituteInPlace SConstruct \
       --replace-fail "default=['+sandybridge']," 'default=[],'
@@ -170,9 +159,7 @@ in stdenv.mkDerivation rec {
     runHook postInstallCheck
   '';
 
-  installTargets =
-    if (lib.versionAtLeast version "6.0") then "install-devcore"
-    else "install-core";
+  installTargets = "install-devcore";
 
   prefixKey = "DESTDIR=";
 
@@ -187,6 +174,5 @@ in stdenv.mkDerivation rec {
 
     maintainers = with maintainers; [ bluescreen303 offline ];
     platforms = subtractLists systems.doubles.i686 systems.doubles.unix;
-    broken = (versionOlder version "6.0" && stdenv.system == "aarch64-darwin");
   };
 }
diff --git a/pkgs/servers/unifi-video/default.nix b/pkgs/servers/unifi-video/default.nix
deleted file mode 100644
index 45a9b5c6fb61..000000000000
--- a/pkgs/servers/unifi-video/default.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{ dpkg
-, stdenv
-, lib
-, fetchurl
-, jre8
-, jsvc
-, lsb-release
-, libcap
-, util-linux
-, makeWrapper
-, autoPatchelfHook
-, glibc
-, gcc-unwrapped
-}:
-
-stdenv.mkDerivation rec {
-  pname = "unifi-video";
-  version = "3.10.13";
-  src = fetchurl {
-    urls = [ "https://dl.ui.com/firmwares/ufv/v${version}/unifi-video.Debian9_amd64.v${version}.deb" "https://archive.org/download/unifi-video.Debian9_amd64.v${version}/unifi-video.Debian9_amd64.v${version}.deb" ];
-    sha256 = "06mxjdizs4mhm1by8kj4pg5hhdi8ns6x75ggwyp1k6zb26jvvdny";
-  };
-
-  buildInputs = [ jre8 jsvc lsb-release libcap util-linux ];
-  nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook glibc gcc-unwrapped ];
-
-  unpackCmd = ''
-    runHook preUnpack
-
-    dpkg-deb -x $src .
-    rm -r etc
-
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -ar sbin $out/bin
-    cp -ar lib share $out
-    chmod +x $out/bin/*
-    wrapProgram $out/bin/unifi-video --set JAVA_HOME "${jre8}" --prefix PATH : ${lib.makeBinPath [ jre8 lsb-release libcap util-linux]}
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Unifi Video NVR (aka Airvision) is a software package for controlling Unifi cameras";
-    longDescription = ''
-      Unifi Video is the NVR server software which can monitor and
-      record footage from supported Unifi video cameras
-    '';
-    homepage = "https://www.ui.com";
-    downloadPage = "https://www.ui.com/download/unifi-video/";
-    sourceProvenance = with sourceTypes; [
-      binaryBytecode
-      binaryNativeCode
-    ];
-    license = licenses.unfree;
-    maintainers = [ maintainers.rsynnest ];
-    platforms = [ "x86_64-linux" ];
-    knownVulnerabilities = [ "Upstream support for Unifi Video ended January 1st, 2021." ];
-  };
-}
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index 1c7684f273a9..f207737ed080 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -46,13 +46,6 @@ let
 in rec {
   # see https://community.ui.com/releases / https://www.ui.com/download/unifi
 
-  unifi7 = generic {
-    version = "7.5.187";
-    suffix = "-f57f5bf7ab";
-    sha256 = "sha256-a5kl8gZbRnhS/p1imPl7soM0/QSFHdM0+2bNmDfc1mY=";
-    knownVulnerabilities = [ "CVE-2024-42025" ];
-  };
-
   unifi8 = generic {
     version = "8.4.62";
     suffix = "-i3q2j125cz";
diff --git a/pkgs/tools/misc/hdfview/default.nix b/pkgs/tools/misc/hdfview/default.nix
index 83597d45004e..3274762d87c3 100644
--- a/pkgs/tools/misc/hdfview/default.nix
+++ b/pkgs/tools/misc/hdfview/default.nix
@@ -1,12 +1,26 @@
-{ lib, stdenv, fetchurl, ant, jdk, hdf4, hdf5, makeDesktopItem, copyDesktopItems, strip-nondeterminism, stripJavaArchivesHook }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ant,
+  jdk,
+  hdf4,
+  hdf5,
+  makeDesktopItem,
+  copyDesktopItems,
+  strip-nondeterminism,
+  stripJavaArchivesHook,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hdfview";
-  version = "3.3.1";
+  version = "3.3.2";
 
-  src = fetchurl {
-    url = "https://support.hdfgroup.org/ftp/HDF5/releases/HDF-JAVA/hdfview-${version}/src/hdfview-${version}.tar.gz";
-    sha256 = "sha256-WcGYceMOB8gCycJSW4KdApy2gIBgTnE/d0PxGZClUqg=";
+  src = fetchFromGitHub {
+    owner = "HDFGroup";
+    repo = "hdfview";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-aJHeknkF38qDH9l+vuzdKFZZTcs/XMjtlHuu/LTF124=";
   };
 
   patches = [
@@ -46,27 +60,34 @@ stdenv.mkDerivation rec {
     desktopName = name;
     exec = name;
     icon = name;
-    comment = meta.description;
-    categories = [ "Science" "DataVisualization" ];
+    comment = finalAttrs.finalPackage.meta.description;
+    categories = [
+      "Science"
+      "DataVisualization"
+    ];
   };
 
-  installPhase = ''
-    runHook preInstall
-  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
-    mkdir -p $out/bin $out/lib
-    cp -a build/dist/HDFView/bin/HDFView $out/bin/
-    cp -a build/dist/HDFView/lib/app $out/lib/
-    cp -a build/dist/HDFView/lib/libapplauncher.so $out/lib/
-    ln -s ${jdk}/lib/openjdk $out/lib/runtime
+  installPhase =
+    ''
+      runHook preInstall
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir -p $out/bin $out/lib
+      cp -a build/dist/HDFView/bin/HDFView $out/bin/
+      cp -a build/dist/HDFView/lib/app $out/lib/
+      cp -a build/dist/HDFView/lib/libapplauncher.so $out/lib/
+      ln -s ${jdk}/lib/openjdk $out/lib/runtime
 
-    mkdir -p $out/share/applications $out/share/icons/hicolor/32x32/apps
-    cp src/HDFView.png $out/share/icons/hicolor/32x32/apps/
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    cp -a build/dist/HDFView.app $out/Applications/
-  '' + ''
-    runHook postInstall
-  '';
+      mkdir -p $out/share/applications $out/share/icons/hicolor/32x32/apps
+      cp src/HDFView.png $out/share/icons/hicolor/32x32/apps/
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      cp -a build/dist/HDFView.app $out/Applications/
+    ''
+    + ''
+      runHook postInstall
+    '';
 
   preFixup = ''
     # Remove build timestamp from javadoc files
@@ -77,8 +98,16 @@ stdenv.mkDerivation rec {
     description = "A visual tool for browsing and editing HDF4 and HDF5 files";
     license = lib.licenses.free; # BSD-like
     homepage = "https://www.hdfgroup.org/downloads/hdfview";
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    downloadPage = "https://github.com/HDFGroup/hdfview";
+    platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ jiegec ];
     mainProgram = "HDFView";
+    # Startup issue is described here:
+    # https://github.com/NixOS/nixpkgs/issues/340048 A possible solution is
+    # suggested here:
+    # https://forum.hdfgroup.org/t/building-hdfview-3-1-0-on-centos-6-swt-library-not-found/5698
+    # But it requires us to update swt, which is a bit hard, the swt update is tracked here:
+    # https://github.com/NixOS/nixpkgs/issues/219771
+    broken = true;
   };
-}
+})
diff --git a/pkgs/tools/misc/hdfview/disable-mac-signing.patch b/pkgs/tools/misc/hdfview/disable-mac-signing.patch
index d7d67f7ac608..f72c1c4c3928 100644
--- a/pkgs/tools/misc/hdfview/disable-mac-signing.patch
+++ b/pkgs/tools/misc/hdfview/disable-mac-signing.patch
@@ -1,8 +1,31 @@
-diff --git a/build.xml b/build.xml
-index 70ab3e2..9460321 100644
---- a/build.xml
-+++ b/build.xml
-@@ -1802,13 +1802,6 @@
+diff --git i/build.xml w/build.xml
+index 3bbd89b..5834e7c 100644
+--- i/build.xml
++++ w/build.xml
+@@ -1607,14 +1607,6 @@
+ 
+     <!-- package args for fixed jpackage -->
+     <target name="createJXPackageMac" depends="createJPackageBase" if="${isXMac}">
+-        <!-- unlock keychain -->
+-        <exec executable="security" dir="${dist.dir}" failonerror="true">
+-            <arg value="unlock-keychain" />
+-            <arg value="-p" />
+-            <arg value="${pass.keychain_key}" />
+-            <arg value="${name.keychain_key}" />
+-        </exec>
+-
+         <echo> JXPackage the mac application</echo>
+         <exec executable="${java.home}/bin/jpackage">
+             <!-- Basic usage -->
+@@ -1680,7 +1672,6 @@
+             <arg value="dmg" />
+             <arg value="--icon" />
+             <arg value="${basedir}/package_files/macosx/HDFView.icns" />
+-            <arg value="--mac-sign" />
+             <arg value="--mac-package-identifier" />
+             <arg value="HDFView.hdfgroup.org" />
+             <arg value="--mac-package-name" />
+@@ -2054,13 +2045,6 @@
              description="Create the final package for distribution" />
  
      <target name="createJPackageMac" depends="createJPackageBase" if="${isAppMac}">
@@ -10,13 +33,13 @@ index 70ab3e2..9460321 100644
 -        <exec executable="security" dir="${dist.dir}" failonerror="true">
 -            <arg value="unlock-keychain" />
 -            <arg value="-p" />
--            <arg value="${login.keychain_key}" />
--            <arg value="login.keychain" />
+-            <arg value="${pass.keychain_key}" />
+-            <arg value="${name.keychain_key}" />
 -        </exec>
  
          <echo> Create the mac jpackage</echo>
          <exec executable="${java.home}/bin/jpackage">
-@@ -1864,7 +1857,6 @@
+@@ -2116,7 +2100,6 @@
              <arg value="app-image" />
              <arg value="--icon" />
              <arg value="${basedir}/package_files/macosx/HDFView.icns" />
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index 9855a948783a..fc122ebd2f76 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # whois fails to link libiconv on Darwin.
+    NIX_LDFLAGS = "-liconv";
+  };
+
   nativeBuildInputs = [ perl gettext pkg-config ];
   buildInputs = [ libidn2 libiconv ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index acffb059ab04..a80d55ff72cd 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1035,6 +1035,7 @@ mapAliases {
   mongodb-4_0 = throw "mongodb-4_0 has been removed, it's end of life since April 2022"; # Added 2023-01-05
   mongodb-4_2 = throw "mongodb-4_2 has been removed, it's end of life since April 2023"; # Added 2023-06-06
   mongodb-4_4 = throw "mongodb-4_4 has been removed, it's end of life since April 2024"; # Added 2024-04-11
+  mongodb-5_0 = throw "mongodb-5_0 has been removed, it's end of life since October 2024"; # Added 2024-10-01
   moonlander = throw "'moonlander' has been removed due to it being broken and unmaintained"; # Added 2023-11-26
   moz-phab = mozphab; # Added 2022-08-09
   mozart-binary = throw "'mozart-binary' has been renamed to/replaced by 'mozart2-binary'"; # Converted to throw 2023-09-10
@@ -1606,8 +1607,10 @@ mapAliases {
   unicorn-emu = unicorn; # Added 2020-10-29
   uniffi-bindgen = throw "uniffi-bindgen has been removed since upstream no longer provides a standalone package for the CLI";
   unifi-poller = unpoller; # Added 2022-11-24
+  unifi-video = throw "unifi-video has been removed as it has been unsupported upstream since 2021"; # Added 2024-10-01
   unifi5 = throw "'unifi5' has been removed since its required MongoDB version is EOL."; # Added 2024-04-11
   unifi6 = throw "'unifi6' has been removed since its required MongoDB version is EOL."; # Added 2024-04-11
+  unifi7 = throw "'unifi7' has been removed since it is vulnerable to CVE-2024-42025 and its required MongoDB version is EOL."; # Added 2024-10-01
   unifiLTS = throw "'unifiLTS' has been removed since UniFi no longer has LTS and stable releases. Use `pkgs.unifi` instead."; # Added 2024-04-11
   unifiStable = throw "'unifiStable' has been removed since UniFi no longer has LTS and stable releases. Use `pkgs.unifi` instead."; # Converted to throw 2024-04-11
   untrunc = untrunc-anthwlock; # Added 2021-02-01
@@ -1702,6 +1705,12 @@ mapAliases {
   xcodebuild6 = throw "'xcodebuild6' has been renamed to/replaced by 'xcodebuild'"; # Added 2023-12-10
   xdg_utils = xdg-utils; # Added 2021-02-01
   xen-light = throw "'xen-light' has been renamed to/replaced by 'xen-slim'"; # Added 2024-06-30
+  xen-slim = throw "'xen-slim' has been renamed to 'xen'. The old Xen package with built-in components no longer exists"; # Added 2024-10-05
+  xen_4_16 = throw "While Xen 4.16 was still security-supported when it was removed from Nixpkgs, it would have reached its End of Life a couple of days after NixOS 24.11 released. To avoid shipping an insecure version of Xen, the Xen Project Hypervisor Maintenance Team decided to delete the derivation entirely"; # Added 2024-10-05
+  xen_4_17 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.17 would have been the 'n-2' version, it was removed"; # Added 2024-10-05
+  xen_4_18 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.18 would have been the 'n-1' version, it was removed"; # Added 2024-10-05
+  xen_4_19 = throw "Use 'xen' instead"; # Added 2024-10-05
+  xenPackages = throw "The attributes in the xenPackages set have been promoted to the top-level. (xenPackages.xen_4_19 -> xen)";
   xineLib = xine-lib; # Added 2021-04-27
   xineUI = xine-ui; # Added 2021-04-27
   xmlada = gnatPackages.xmlada; # Added 2024-02-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2e9088d7dacd..812c431c3846 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24829,13 +24829,7 @@ with pkgs;
   mariadb = mariadb_1011;
   mariadb-embedded = mariadb.override { withEmbedded = true; };
 
-  mongodb = hiPrio mongodb-6_0;
-
-  mongodb-5_0 = callPackage ../servers/nosql/mongodb/5.0.nix {
-    sasl = cyrus_sasl;
-    boost = boost179.override { enableShared = false; };
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-  };
+  mongodb = hiPrio mongodb-7_0;
 
   mongodb-6_0 = darwin.apple_sdk_11_0.callPackage ../servers/nosql/mongodb/6.0.nix {
     sasl = cyrus_sasl;
@@ -25314,15 +25308,12 @@ with pkgs;
     matomo-beta;
 
   inherit (callPackages ../servers/unifi { })
-    unifi7
     unifi8;
 
-  unifi = unifi7;
+  unifi = unifi8;
 
   unifi-protect-backup = callPackage ../applications/backup/unifi-protect-backup { };
 
-  unifi-video = callPackage ../servers/unifi-video { };
-
   unpackerr = callPackage ../servers/unpackerr {
     inherit (darwin.apple_sdk.frameworks) Cocoa WebKit;
   };
@@ -26387,13 +26378,6 @@ with pkgs;
     glusterfsSupport = lib.meta.availableOn stdenv.hostPlatform glusterfs && lib.meta.availableOn stdenv.hostPlatform libuuid;
   });
 
-  # See `xenPackages` source for explanations.
-  # Building with `xen` instead of `xen-slim` is possible, but makes no sense.
-  qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_19-slim; });
-  qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_18-slim; });
-  qemu_xen_4_17 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_17-slim; });
-  qemu_xen = qemu_xen_4_19;
-
   qemu_test = lowPrio (qemu.override { hostCpuOnly = true; nixosTestRunner = true; });
 
   quick-lint-js = callPackage ../development/tools/quick-lint-js { };
@@ -33821,10 +33805,7 @@ with pkgs;
 
   xdotool = callPackage ../tools/X11/xdotool { };
 
-  xenPackages = recurseIntoAttrs (callPackage ../applications/virtualization/xen/packages.nix {});
-
-  xen = xenPackages.xen_4_19;
-  xen-slim = xenPackages.xen_4_19-slim;
+  buildXenPackage = callPackage ../build-support/xen { };
 
   xkbset = callPackage ../tools/X11/xkbset { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7c8604ce6c5e..4400f9cd4041 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17591,7 +17591,7 @@ self: super: with self; {
     inherit (pkgs) graphviz;
   };
 
-  xen = toPythonModule (pkgs.xen-slim.override {
+  xen = toPythonModule (pkgs.xen.override {
     python3Packages = self;
   });