Merge master into staging-next

2025-07-06 16:43:42 +00:00 · 2025-07-06 16:43:42 +00:00 · 07ab953baa
commit 07ab953baa
parent 761a9a8108 736cea88d1
47 changed files with 5688 additions and 9311 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -23897,6 +23897,14 @@
    githubId = 18124752;
    email = "m@rvinvogt.com";
  };
+  srxl = {
+    name = "Ruby Iris Juric";
+    email = "ruby@srxl.me";
+    matrix = "@ruby:isincredibly.gay";
+    github = "Sorixelle";
+    githubId = 38685302;
+    keys = [ { fingerprint = "2D76 76C7 A28E 16FC 75C7  268D 1B55 6ED8 4B0E 303A"; } ];
+  };
  Srylax = {
    name = "Srylax";
    email = "srylax+nixpkgs@srylax.dev";
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@ -52,7 +52,9 @@

 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).

-[dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
+- [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
+
+- [Sharkey](https://joinsharkey.org), a Sharkish microblogging platform. Available as [services.sharkey](#opt-services.sharkey.enable).

 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1660,6 +1660,7 @@
  ./services/web-apps/screego.nix
  ./services/web-apps/selfoss.nix
  ./services/web-apps/sftpgo.nix
+  ./services/web-apps/sharkey.nix
  ./services/web-apps/shiori.nix
  ./services/web-apps/silverbullet.nix
  ./services/web-apps/simplesamlphp.nix
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -252,12 +252,12 @@ in

    systemd.services.searx = mkIf (!cfg.runInUwsgi) {
      description = "Searx server, the meta search engine.";
-      wantedBy = [
-        "network.target"
-        "multi-user.target"
-      ];
+      wantedBy = [ "multi-user.target" ];
      requires = [ "searx-init.service" ];
-      after = [ "searx-init.service" ];
+      after = [
+        "searx-init.service"
+        "network.target"
+      ];
      serviceConfig =
        {
          User = "searx";
--- a/nixos/modules/services/web-apps/sharkey.nix
+++ b/nixos/modules/services/web-apps/sharkey.nix
@ -0,0 +1,300 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.sharkey;
+
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "config.yml" cfg.settings;
+in
+{
+  options.services.sharkey =
+    let
+      inherit (lib)
+        mkEnableOption
+        mkOption
+        mkPackageOption
+        types
+        ;
+    in
+    {
+      enable = mkEnableOption "Sharkey, a Sharkish microblogging platform";
+      package = mkPackageOption pkgs "sharkey" { };
+
+      environmentFiles = mkOption {
+        type = types.listOf types.path;
+        default = [ ];
+        example = [ "/run/secrets/sharkey-env" ];
+        description = ''
+          List of paths to files containing environment variables for Sharkey to use at runtime.
+
+          This is useful for keeping secrets out of the Nix store. See
+          https://docs.joinsharkey.org/docs/install/configuration/ for how to configure Sharkey using environment
+          variables.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to open ports in the NixOS firewall for Sharkey.
+        '';
+      };
+
+      setupMeilisearch = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to automatically set up a local Meilisearch instance and configure Sharkey to use it.
+
+          You need to ensure `services.meilisearch.masterKeyEnvironmentFile` is correctly configured for a working
+          Meilisearch setup. You also need to configure Sharkey to use an API key obtained from Meilisearch with the
+          `MK_CONFIG_MEILISEARCH_APIKEY` environment variable, and set `services.sharkey.settings.meilisearch.index` to
+          the created index. See https://docs.joinsharkey.org/docs/customisation/search/meilisearch/ for how to create
+          an API key and index.
+        '';
+      };
+
+      setupPostgresql = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to automatically set up a local PostgreSQL database and configure Sharkey to use it.
+        '';
+      };
+
+      setupRedis = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to automatically set up a local Redis cache and configure Sharkey to use it.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            url = mkOption {
+              type = types.str;
+              example = "https://blahaj.social/";
+              description = ''
+                The full URL that the Sharkey instance will be publically accessible on.
+
+                Do NOT change this after initial setup!
+              '';
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 3000;
+              description = ''
+                The port that Sharkey will listen on.
+              '';
+            };
+
+            address = mkOption {
+              type = types.str;
+              default = "0.0.0.0";
+              example = "127.0.0.1";
+              description = ''
+                The address that Sharkey binds to.
+              '';
+            };
+
+            socket = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              example = "/run/sharkey/sharkey.sock";
+              description = ''
+                If specified, creates a UNIX socket at the given path that Sharkey listens on.
+              '';
+            };
+
+            mediaDirectory = mkOption {
+              type = types.path;
+              default = "/var/lib/sharkey";
+              description = ''
+                Path to the folder where Sharkey stores uploaded media such as images and attachments.
+              '';
+            };
+
+            fulltextSearch.provider = mkOption {
+              type = types.enum [
+                "sqlLike"
+                "sqlPgroonga"
+                "sqlTsvector"
+                "meilisearch"
+              ];
+              default = "sqlLike";
+              example = "sqlPgroonga";
+              description = ''
+                Which provider to use for full text search.
+
+                All options other than `sqlLike` require extra setup - see the comments in
+                https://activitypub.software/TransFem-org/Sharkey/-/blob/develop/.config/example.yml for details.
+
+                If `sqlPgroonga` is set, and `services.sharkey.setupPostgres` is `true`, the pgroonga extension will
+                automatically be setup. You still need to create an index manually.
+
+                If using Meilisearch, consider setting `services.sharkey.setupMeilisearch` instead, which will
+                configure Meilisearch for you.
+              '';
+            };
+
+            id = mkOption {
+              type = types.enum [
+                "aid"
+                "aidx"
+                "meid"
+                "ulid"
+                "objectid"
+              ];
+              default = "aidx";
+              description = ''
+                The ID generation method for Sharkey to use.
+
+                Do NOT change this after initial setup!
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Configuration options for Sharkey.
+
+          See https://activitypub.software/TransFem-org/Sharkey/-/blob/develop/.config/example.yml for a list of all
+          available configuration options.
+        '';
+      };
+    };
+
+  config =
+    let
+      inherit (lib) mkDefault mkIf mkMerge;
+    in
+    mkIf cfg.enable (mkMerge [
+      {
+        systemd.services.sharkey = {
+          description = "Sharkey";
+          documentation = [ "https://docs.joinsharkey.org/" ];
+          wantedBy = [ "multi-user.target" ];
+          startLimitBurst = 5;
+          startLimitIntervalSec = 60;
+          environment.MISSKEY_CONFIG_DIR = "/etc/sharkey";
+
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${lib.getExe cfg.package} migrateandstart";
+            EnvironmentFile = cfg.environmentFiles;
+            DynamicUser = true;
+            TimeoutSec = 60;
+            Restart = "always";
+            SyslogIdentifier = "sharkey";
+            ConfigurationDirectory = "sharkey";
+            RuntimeDirectory = "sharkey";
+            StateDirectory = "sharkey";
+            CapabilityBoundingSet = "";
+            LockPersonality = true;
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateUsers = true;
+            PrivateTmp = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            ReadWritePaths = [ cfg.settings.mediaDirectory ];
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "~@cpu-emulation @debug @mount @obsolete @privileged @resources"
+              "@chown"
+            ];
+            UMask = "0077";
+          };
+        };
+
+        environment.etc."sharkey/default.yml".source = configFile;
+      }
+      (mkIf cfg.openFirewall {
+        networking.firewall.allowedTCPPorts = [ cfg.settings.port ];
+      })
+      (mkIf cfg.setupMeilisearch {
+        services.meilisearch = {
+          enable = mkDefault true;
+          environment = mkDefault "production";
+        };
+
+        services.sharkey.settings = {
+          fulltextSearch.provider = "meilisearch";
+          meilisearch = {
+            host = config.services.meilisearch.listenAddress;
+            port = config.services.meilisearch.listenPort;
+          };
+        };
+
+        systemd.services.sharkey = {
+          after = [ "meilisearch.service" ];
+          wants = [ "meilisearch.service" ];
+        };
+      })
+      (mkIf cfg.setupPostgresql {
+        services.postgresql = {
+          enable = mkDefault true;
+          ensureDatabases = [ "sharkey" ];
+          ensureUsers = [
+            {
+              name = "sharkey";
+              ensureDBOwnership = true;
+            }
+          ];
+
+          extensions = mkIf (cfg.settings.fulltextSearch.provider == "sqlPgroonga") (ps: [ ps.pgroonga ]);
+        };
+
+        services.sharkey.settings.db = {
+          host = "/run/postgresql";
+          db = "sharkey";
+        };
+
+        systemd.services.sharkey = {
+          after = [ "postgresql.target" ];
+          bindsTo = [ "postgresql.target" ];
+        };
+      })
+      (mkIf cfg.setupRedis {
+        services.redis.servers.sharkey.enable = mkDefault true;
+
+        services.sharkey.settings.redis.path = config.services.redis.servers.sharkey.unixSocket;
+
+        systemd.services.sharkey = {
+          after = [ "redis-sharkey.service" ];
+          bindsTo = [ "redis-sharkey.service" ];
+
+          serviceConfig.SupplementaryGroups = [
+            config.services.redis.servers.sharkey.group
+          ];
+        };
+      })
+    ]);
+
+  meta.maintainers = with lib.maintainers; [ srxl ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1277,6 +1277,7 @@ in
  sgt-puzzles = runTest ./sgt-puzzles.nix;
  shadow = runTest ./shadow.nix;
  shadowsocks = handleTest ./shadowsocks { };
+  sharkey = runTest ./web-apps/sharkey.nix;
  shattered-pixel-dungeon = runTest ./shattered-pixel-dungeon.nix;
  shiori = runTest ./shiori.nix;
  signal-desktop = runTest ./signal-desktop.nix;
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@ -81,7 +81,7 @@ in
          '';
        };
        systemd.services.postgresql-setup.postStart = lib.mkAfter ''
-          $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
+          psql -tAd miniflux -c 'CREATE EXTENSION hstore;'
        '';
        networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
      };
--- a/nixos/tests/web-apps/sharkey.nix
+++ b/nixos/tests/web-apps/sharkey.nix
@ -0,0 +1,55 @@
+{ lib, ... }:
+
+let
+  meilisearchKey = "TESTKEY-naXRkVX7nhvLaGOmGGuicDKxZAj0khEaoOZPeEZafv8w9j8V6aKb0NVdXRChL5kR";
+in
+{
+  name = "sharkey";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.sharkey = {
+        enable = true;
+        setupMeilisearch = true;
+        environmentFiles = [ "/run/secrets/sharkey-env" ];
+        settings = {
+          url = "http://exampleurl.invalid";
+          meilisearch.index = "exampleurl_invalid";
+        };
+      };
+
+      services.meilisearch.masterKeyEnvironmentFile = pkgs.writeText "meilisearch-key" ''
+        MEILI_MASTER_KEY=${meilisearchKey}
+      '';
+    };
+
+  testScript =
+    let
+      createIndexPayload = builtins.toJSON {
+        description = "Sharkey API key";
+        actions = [ "*" ];
+        indexes = [ "exampleurl_invalid---notes" ];
+        expiresAt = null;
+      };
+    in
+    ''
+      import json
+
+      with subtest("Setting up Meilisearch API key and index"):
+          machine.wait_for_unit("meilisearch.service")
+          machine.wait_for_open_port(7700)
+
+          json_body = '${createIndexPayload}'
+          create_index_result = json.loads(machine.succeed(f"curl -s -X POST 'http://localhost:7700/keys' -H 'Content-Type: application/json' -H 'Authorization: Bearer ${meilisearchKey}' --data-binary '{json_body}'"))
+          machine.succeed(f"mkdir /run/secrets; echo 'MK_CONFIG_MEILISEARCH_APIKEY={create_index_result["key"]}' > /run/secrets/sharkey-env")
+
+      with subtest("Testing Sharkey is running and listening to HTTP requests"):
+          machine.systemctl("restart sharkey")
+          machine.wait_for_open_port(3000)
+
+          machine.succeed("curl --fail http://localhost:3000")
+    '';
+
+  meta.maintainers = with lib.maintainers; [ srxl ];
+}
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@ -32,12 +32,12 @@

 stdenv.mkDerivation rec {
  pname = "bitwig-studio-unwrapped";
-  version = "5.3.8";
+  version = "5.3.11";

  src = fetchurl {
    name = "bitwig-studio-${version}.deb";
    url = "https://www.bitwig.com/dl/Bitwig%20Studio/${version}/installer_linux/";
-    hash = "sha256-ccDgNsKskEsaL3G5ISZUMckvFosMALFzEzOM9D4/Xgo=";
+    hash = "sha256-8u8ljljHKGV6m2421vxYSiDTb1iyNLgP3DlLIEKuzXo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/libretro/cores/snes9x.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "snes9x";
-  version = "0-unstable-2025-06-18";
+  version = "0-unstable-2025-07-03";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
-    rev = "a168e789719d6bc8e06110d517d98c3d098d5834";
-    hash = "sha256-Kxi+/Uie0a7gmlNEj351Nlybb16W4A4joC8JSN1rvsU=";
+    rev = "68acd5bfa3146d7124233e3e372f6ffb5d8d0dcf";
+    hash = "sha256-X3O4GirNXzjMNYH7UrItNpYGT+8NWPsKl+sAs036OCU=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -19,16 +19,16 @@ let
    }:
    buildGoModule rec {
      pname = stname;
-      version = "1.29.7";
+      version = "1.30.0";

      src = fetchFromGitHub {
        owner = "syncthing";
        repo = "syncthing";
        tag = "v${version}";
-        hash = "sha256-DEdXHthnCArVynSQLF01hEEKYn85+q9Bia+b3G2wL+Q=";
+        hash = "sha256-GKyzJ2kzs2h/tfb3StSleGBofiKk6FwVcSkCjsJRvRY=";
      };

-      vendorHash = "sha256-j2eOKorXObhbDf3hR1ru/W4tnc/2e3dGtWcSjxkA10w=";
+      vendorHash = "sha256-Soky/3wEmP1QRy8xfL68sTHi3CSl4nbCINmG0DY2Qys=";

      nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
        # Recent versions of macOS seem to require binaries to be signed when
--- a/pkgs/build-support/xen/default.nix
+++ b/pkgs/build-support/xen/default.nix
@ -1,374 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoPatchelfHook,
-  cmake,
-  pkg-config,
-  testers,
-  which,
-  fetchgit,
-
-  # Xen
-  acpica-tools,
-  bison,
-  bzip2,
-  dev86,
-  e2fsprogs,
-  flex,
-  libnl,
-  libuuid,
-  lzo,
-  ncurses,
-  ocamlPackages,
-  perl,
-  python3Packages,
-  systemdMinimal,
-  xz,
-  yajl,
-  zlib,
-  zstd,
-
-  # Optional Components
-  seabios-qemu,
-  systemSeaBIOS ? seabios-qemu,
-  OVMF,
-  ipxe,
-  checkpolicy,
-  binutils-unwrapped-all-targets,
-
-  # Documentation
-  pandoc,
-
-  # Scripts
-  bridge-utils,
-  coreutils,
-  diffutils,
-  gawk,
-  gnugrep,
-  gnused,
-  inetutils,
-  iproute2,
-  iptables,
-  multipath-tools,
-  nbd,
-  openvswitch,
-  util-linux,
-}:
-
-{
-  pname,
-  branch ? lib.versions.majorMinor version,
-  version,
-  vendor ? "nixos",
-  upstreamVersion ? version,
-  withFlask ? false,
-  withSeaBIOS ? true,
-  withOVMF ? true,
-  withIPXE ? true,
-  rev,
-  hash,
-  patches ? [ ],
-  meta ? { },
-}:
-
-let
-  inherit (lib)
-    enableFeature
-    getExe'
-    licenses
-    makeSearchPathOutput
-    optional
-    optionalString
-    optionals
-    systems
-    teams
-    versionOlder
-    warn
-    ;
-  inherit (systems.inspect.patterns) isLinux isAarch64;
-  inherit (licenses)
-    cc-by-40
-    gpl2Only
-    lgpl21Only
-    mit
-    ;
-
-  # Mark versions older than minSupportedVersion as EOL.
-  minSupportedVersion = "4.17";
-
-  #TODO: fix paths instead.
-  scriptEnvPath = makeSearchPathOutput "out" "bin" [
-    bridge-utils
-    coreutils
-    diffutils
-    gawk
-    gnugrep
-    gnused
-    inetutils
-    iproute2
-    iptables
-    multipath-tools
-    nbd
-    openvswitch
-    perl
-    util-linux.bin
-    which
-  ];
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version patches;
-
-  outputs = [
-    "out"
-    "man"
-    "doc"
-    "dev"
-    "boot"
-  ];
-
-  src = fetchgit {
-    url = "https://xenbits.xenproject.org/git-http/xen.git";
-    inherit rev hash;
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    bison
-    cmake
-    flex
-    pandoc
-    pkg-config
-    python3Packages.setuptools
-  ];
-  buildInputs =
-    [
-      # Xen
-      acpica-tools
-      bzip2
-      dev86
-      e2fsprogs.dev
-      libnl
-      libuuid
-      lzo
-      ncurses
-      perl
-      python3Packages.python
-      xz
-      yajl
-      zlib
-      zstd
-
-      # oxenstored
-      ocamlPackages.findlib
-      ocamlPackages.ocaml
-
-      # Python Fixes
-      python3Packages.wrapPython
-    ]
-    ++ optional withFlask checkpolicy
-    ++ optional (versionOlder version "4.19") systemdMinimal;
-
-  configureFlags = [
-    "--enable-systemd"
-    "--disable-qemu-traditional"
-    "--with-system-qemu"
-    (if withSeaBIOS then "--with-system-seabios=${systemSeaBIOS.firmware}" else "--disable-seabios")
-    (if withOVMF then "--with-system-ovmf=${OVMF.mergedFirmware}" else "--disable-ovmf")
-    (if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
-    (enableFeature withFlask "xsmpolicy")
-  ];
-
-  makeFlags =
-    [
-      "SUBSYSTEMS=${toString finalAttrs.buildFlags}"
-
-      "PREFIX=$(out)"
-      "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
-
-      "XEN_WHOAMI=${pname}"
-      "XEN_DOMAIN=${vendor}"
-
-      "GIT=${coreutils}/bin/false"
-      "WGET=${coreutils}/bin/false"
-      "EFI_VENDOR=${vendor}"
-      "INSTALL_EFI_STRIP=1"
-      "LD=${getExe' binutils-unwrapped-all-targets "ld"}"
-    ]
-    # These flags set the CONFIG_* options in /boot/xen.config
-    # and define if the default policy file is built. However,
-    # the Flask binaries always get compiled by default.
-    ++ optionals withFlask [
-      "XSM_ENABLE=y"
-      "FLASK_ENABLE=y"
-    ];
-
-  buildFlags = [
-    "xen"
-    "tools"
-    "docs"
-  ];
-
-  enableParallelBuilding = true;
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=maybe-uninitialized"
-    "-Wno-error=array-bounds"
-  ];
-
-  dontUseCmakeConfigure = true;
-
-  # Remove in-tree QEMU sources, we don't need them in any circumstance.
-  prePatch = "rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional";
-
-  postPatch =
-    # The following patch forces Xen to install xen.efi on $out/boot
-    # instead of $out/boot/efi/efi/nixos, as the latter directory
-    # would otherwise need to be created manually. This also creates
-    # a more consistent output for downstreams who override the
-    # vendor attribute above.
-    ''
-      substituteInPlace xen/Makefile \
-        --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
-                  "\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
-    ''
-
-    # The following patch fixes the call to /bin/mkdir on the
-    # launch_xenstore.sh helper script.
-    + ''
-      substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
-        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
-    ''
-
-    # The following expression fixes the paths called by Xen's systemd
-    # units, so we can use them in the NixOS module.
-    + ''
-      substituteInPlace \
-        tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
-        --replace-fail /bin/grep ${gnugrep}/bin/grep
-      substituteInPlace \
-       tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
-        --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
-    '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir --parents $out $out/share $boot
-    cp -prvd dist/install/nix/store/*/* $out/
-    cp -prvd dist/install/etc $out
-    cp -prvd dist/install/boot $boot
-
-    runHook postInstall
-  '';
-
-  postInstall =
-    # Wrap xencov_split, xenmon and xentrace_format.
-    ''
-      wrapPythonPrograms
-    ''
-
-    # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
-    + ''
-      wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
-    ''
-
-    # Fix shebangs in Xen's various scripts.
-    #TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
-    + ''
-      shopt -s extglob
-      for i in $out/etc/xen/scripts/!(*.sh); do
-        sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
-      done
-    '';
-
-  postFixup =
-    ''
-      addAutoPatchelfSearchPath $out/lib
-      autoPatchelf $out/libexec/xen/bin
-    ''
-    # Flask is particularly hard to disable. Even after
-    # setting the make flags to `n`, it still gets compiled.
-    # If withFlask is disabled, delete the extra binaries.
-    + optionalString (!withFlask) ''
-      rm -f $out/bin/flask-*
-    '';
-
-  passthru = {
-    efi = "boot/xen-${upstreamVersion}.efi";
-    flaskPolicy =
-      if withFlask then
-        warn "This Xen was compiled with FLASK support, but the FLASK file does not match the Xen version number. Please hardcode the path to the FLASK file instead." "boot/xenpolicy-${version}"
-      else
-        throw "This Xen was compiled without FLASK support.";
-    # This test suite is very simple, as Xen's userspace
-    # utilities require the hypervisor to be booted.
-    tests = {
-      pkg-config = testers.hasPkgConfigModules {
-        package = finalAttrs.finalPackage;
-        moduleNames = [
-          "xencall"
-          "xencontrol"
-          "xendevicemodel"
-          "xenevtchn"
-          "xenforeignmemory"
-          "xengnttab"
-          "xenguest"
-          "xenhypfs"
-          "xenlight"
-          "xenstat"
-          "xenstore"
-          "xentoolcore"
-          "xentoollog"
-          "xenvchan"
-          "xlutil"
-        ];
-      };
-    };
-  };
-
-  meta = {
-    inherit branch;
-
-    description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
-    longDescription =
-      ''
-        The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
-        hypervisor*, which allows multiple virtual machines, known as domains, to run
-        concurrently with the host on the physical machine. On a typical *type-2
-        hypervisor*, the virtual machines run as applications on top of the
-        host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
-        virtualise **Unprivileged Domains**.
-
-        Use with the `qemu_xen` package.
-      ''
-      + "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
-      + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${upstreamVersion}` file is available on the `boot` output of this package."
-      + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
-      + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
-      + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains.";
-
-    homepage = "https://xenproject.org/";
-    downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
-    changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
-
-    license = [
-      # Documentation.
-      cc-by-40
-      # Most of Xen is licensed under the GPL v2.0.
-      gpl2Only
-      # Xen Libraries and the `xl` command-line utility.
-      lgpl21Only
-      # Development headers in $dev/include.
-      mit
-    ];
-
-    teams = [ teams.xen ];
-    knownVulnerabilities = optional (versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
-
-    mainProgram = "xl";
-
-    platforms = [ isLinux ];
-    badPlatforms = [ isAarch64 ];
-  } // meta;
-})
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "andcli";
-  version = "2.1.3";
+  version = "2.2.0";

  subPackages = [ "cmd/andcli" ];

@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
    owner = "tjblackheart";
    repo = "andcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MfhChaowSkCggeyubYdlcmU3+dd+yXlVrgdr85xjlI8=";
+    hash = "sha256-wAatlCckSpa/BE4UVR/L6SkVmNyW2/cl//JOy62EaLc=";
  };

-  vendorHash = "sha256-C5XW3nxTUjcH6YaFYSxuKdtMF5SvrbOjErWIQXNwSJA=";
+  vendorHash = "sha256-/rmx9g7OfsZXr3zb1UfR1qLxdV2/ELzc/wXn0fJRzbE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/av/avrdudess/package.nix
+++ b/pkgs/by-name/av/avrdudess/package.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "avrdudess";
-  version = "2.18";
+  version = "2.19";

  src = fetchurl {
    url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v${finalAttrs.version}/AVRDUDESS-${finalAttrs.version}-portable.zip";
-    hash = "sha256-N93FLiXp1WwhI5KwH6sho2wyFtkbODwCHOpEVbVnYdc=";
+    hash = "sha256-CXwwbg2hEMzt30j6AO7+v/8WfRsHzNhDgLc9W8/CQzI=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@ -130,9 +130,9 @@

  storage-preview = mkAzExtension rec {
    pname = "storage-preview";
-    version = "1.0.0b5";
+    version = "1.0.0b6";
    url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
-    hash = "sha256-gs4uQrnpXm03iPyP+i5DnFWvQ43+ZHN4wSZiNRVZU7g=";
+    hash = "sha256-467PbUh6rCPndvAXeZ5tMgCH34HL36Kzd9DzYlM63EA=";
    description = "Provides a preview for upcoming storage features";
    propagatedBuildInputs = with python3Packages; [ azure-core ];
    meta.maintainers = with lib.maintainers; [ katexochen ];
--- a/pkgs/by-name/bt/btop/package.nix
+++ b/pkgs/by-name/bt/btop/package.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "btop";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "aristocratos";
    repo = "btop";
    rev = "v${version}";
-    hash = "sha256-4x2vGmH2dfHZHG+zj2KGsL/pRNIZ8K8sXYRHy0io5IE=";
+    hash = "sha256-4H9UjewJ7UFQtTQYwvHZL3ecPiChpfT6LEZwbdBCIa0=";
  };

  nativeBuildInputs =
@ -38,6 +38,11 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=$(out)" ];

+  # fix build on darwin (see https://github.com/NixOS/nixpkgs/pull/422218#issuecomment-3039181870 and https://github.com/aristocratos/btop/pull/1173)
+  cmakeFlags = [
+    (lib.cmakeBool "BTOP_LTO" (!stdenv.hostPlatform.isDarwin))
+  ];
+
  postInstall = ''
    ${removeReferencesTo}/bin/remove-references-to -t ${stdenv.cc.cc} $(readlink -f $out/bin/btop)
  '';
--- a/pkgs/by-name/cf/cfn-changeset-viewer/package.nix
+++ b/pkgs/by-name/cf/cfn-changeset-viewer/package.nix
@ -0,0 +1,39 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  versionCheckHook,
+}:
+
+buildNpmPackage rec {
+  pname = "cfn-changeset-viewer";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "trek10inc";
+    repo = "cfn-changeset-viewer";
+    tag = version;
+    hash = "sha256-ONgjU07wyC1NoNtTsQO5LbVQiC8gsHqsyYv3Upc0hWQ=";
+  };
+
+  npmDepsHash = "sha256-ICaGtofENMaAjk/KGRn8RgpMAICSttx4AIcbi1HsW8Q=";
+
+  dontNpmBuild = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "CLI to view the changes calculated in a CloudFormation ChangeSet in a more human-friendly way";
+    homepage = "https://github.com/trek10inc/cfn-changeset-viewer";
+    license = lib.licenses.mit;
+    mainProgram = "cfn-changeset-viewer";
+    maintainers = with lib.maintainers; [ surfaceflinger ];
+  };
+}
--- a/pkgs/by-name/dn/dnsproxy/package.nix
+++ b/pkgs/by-name/dn/dnsproxy/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "dnsproxy";
-  version = "0.76.0";
+  version = "0.76.1";

  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "dnsproxy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-R5/Y1nUyjqB4Q9v3KSn9Bav+5ub9jIFMdRor2xl4bIo=";
+    hash = "sha256-XbFa0KN5RYcdjXHKSnSs0ba+9YDFGZN/DafV4gOSow0=";
  };

-  vendorHash = "sha256-BIp02IL2/JgW4qRH5inZKstt+9CWHsX9ZAyOLoQa1go=";
+  vendorHash = "sha256-87WXRBzV7ROsWAhtS8vcpvj4x1yIcFDaEje8inAqwoo=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/el/elkhound/package.nix
+++ b/pkgs/by-name/el/elkhound/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "elkhound";
-  version = "unstable-2020-04-13";
+  version = "0-unstable-2020-04-13";

  src = fetchFromGitHub {
    owner = "WeiDUorg";
    repo = "elkhound";
    rev = "a7eb4bb2151c00cc080613a770d37560f62a285c";
-    sha256 = "sha256-Y96OFpBNrD3vrKoEZ4KdJuI1Q4RmYANsu7H3ZzfaA6g=";
+    hash = "sha256-Y96OFpBNrD3vrKoEZ4KdJuI1Q4RmYANsu7H3ZzfaA6g=";
  };

  postPatch = ''
@ -32,6 +32,8 @@ stdenv.mkDerivation rec {
    perl
  ];

+  cmakeFlags = [ "-Wno-dev" ]; # it vomits warnings that only upstream cares about
+
  installPhase = ''
    runHook preInstall

@ -51,5 +53,6 @@ stdenv.mkDerivation rec {
    license = licenses.bsd3;
    maintainers = with maintainers; [ peterhoeg ];
    platforms = platforms.unix;
+    mainProgram = "elkhound";
  };
 }
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@ -12,7 +12,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ente-web";
-  version = "1.1.0";
+  version = "1.1.53";

  src = fetchFromGitHub {
    owner = "ente-io";
@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
    sparseCheckout = [ "web" ];
    tag = "photos-v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-rHz/QlH3t+J2oz0s5LuWkgxGZmdiPFZXTuDI5yFajrA=";
+    hash = "sha256-LYFkqB44pS7WLa4HEnYrnRanh04P82ydsqiZYHNAshc=";
  };
  sourceRoot = "${finalAttrs.src.name}/web";

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-9BumlPzvG6dmuoFGdCAALzKpJATA3ibb1SkLtofAasI=";
+    hash = "sha256-8uqKlqBnYTft3P7r1rQaEqn7ixj55yWnSLKTNi/0MZA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/es/eslint/package-lock.json
+++ b/pkgs/by-name/es/eslint/package-lock.json
--- a/pkgs/by-name/es/eslint/package.nix
+++ b/pkgs/by-name/es/eslint/package.nix
@ -2,17 +2,18 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  nix-update-script,
  stdenv,
 }:
 buildNpmPackage rec {
  pname = "eslint";
-  version = "9.20.0";
+  version = "9.30.1";

  src = fetchFromGitHub {
    owner = "eslint";
    repo = "eslint";
    tag = "v${version}";
-    hash = "sha256-ahERh5Io2J/Uz9fgY875ldPtzjiasqxZ0ppINwYNoB4=";
+    hash = "sha256-IMML65KsmFLdTniciHWiw5ao0hSwILbHvz/Zx72+Mi8=";
  };

  # NOTE: Generating lock-file
@ -24,12 +25,16 @@ buildNpmPackage rec {
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-F3EUANBvniczR7QxNfo1LlksYPxXt16uqJDFzN6u64Y=";
+  npmDepsHash = "sha256-EurssIJmb6g7CmsYkUqtEdyDfvCs4Sc3VO6/4jTeP5Y=";
  npmInstallFlags = [ "--omit=dev" ];

  dontNpmBuild = true;
  dontNpmPrune = true;

+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--generate-lockfile" ];
+  };
+
  meta = {
    description = "Find and fix problems in your JavaScript code";
    homepage = "https://eslint.org";
--- a/pkgs/by-name/gl/glmark2/package.nix
+++ b/pkgs/by-name/gl/glmark2/package.nix
@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
  postInstall = ''
    for binary in $out/bin/glmark2*; do
      wrapProgram $binary \
-        --set LD_LIBRARY_PATH ${libGL}/lib
+        --prefix LD_LIBRARY_PATH ":" ${libGL}/lib
    done
  '';

--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "7.1.1-6";
+  version = "7.1.1-7";
 in

 (ffmpeg_7-full.override {
@ -14,7 +14,7 @@ in
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    rev = "v${version}";
-    hash = "sha256-mXPiNSI/c1CEblUxOC69gRRcPgDlopmHGHFE2r7RaHk=";
+    hash = "sha256-QzmMhLwlFO9TOCLQaTpoCgNwPpertRA3h1+JMzOEULE=";
  };
 }).overrideAttrs
  (old: {
--- a/pkgs/by-name/ko/kopia/package.nix
+++ b/pkgs/by-name/ko/kopia/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "kopia";
-  version = "0.19.0";
+  version = "0.20.1";

  src = fetchFromGitHub {
    owner = "kopia";
    repo = "kopia";
    tag = "v${version}";
-    hash = "sha256-PfxMs9MwoI+4z8vZ1sVlIEal3TOmA06997jWwShNfrE=";
+    hash = "sha256-hKtrHv7MQjA/AQ/frjP2tPT6zqVPPGnBxYuhWtUgIl0=";
  };

-  vendorHash = "sha256-E9wF3mBm6pLHKVMMz3gvcXzb1wQkosecrmEk8c+2gcU=";
+  vendorHash = "sha256-npNSNlS8gvbxtB4KeaiSsCUzxwJ0kwvnzDda/CZRVmM=";

  subPackages = [ "." ];

--- a/pkgs/by-name/ma/maa-cli/package.nix
+++ b/pkgs/by-name/ma/maa-cli/package.nix
@ -14,13 +14,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "maa-cli";
-  version = "0.5.5";
+  version = "0.5.6";

  src = fetchFromGitHub {
    owner = "MaaAssistantArknights";
    repo = "maa-cli";
    rev = "v${version}";
-    hash = "sha256-WOl/d4q7l6t5BZYOf2lih/eIBTiswRBYWALmXx5ffio=";
+    hash = "sha256-xPaOF/eX9lOhZqP6CXiKjSZTbF/zwynR5r2PrO2y8gk=";
  };

  nativeBuildInputs = [
@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
  buildFeatures = [ "git2" ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1KTPvL5JdxN1TPfS0H6Rxi4o8dzMAolHSti9xUKChL8=";
+  cargoHash = "sha256-HEgR+hlE0pRJYL2l/IyuBTEFxa+DXsuSThzOI12EWHI=";

  # maa-cli would only search libMaaCore.so and resources in itself's path
  # https://github.com/MaaAssistantArknights/maa-cli/issues/67
--- a/pkgs/by-name/mc/mcp-k8s-go/package.nix
+++ b/pkgs/by-name/mc/mcp-k8s-go/package.nix
@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "mcp-k8s-go";
-  version = "0.3.5";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "strowk";
    repo = "mcp-k8s-go";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6DKhcUwXBap7Ts+T46GJJxKS6LXTfScZZEQV0PhuVfQ=";
+    hash = "sha256-13FwrG/eqR9bVrQ3CAIY7cFyj+EScWABnKIBo7Pm1w8=";
  };

-  vendorHash = "sha256-nP9cVXV1qyYancePz1mMNq911Ou7k5nVckQzbM05HpQ=";
+  vendorHash = "sha256-BPmocRaqqV7p5Yjto3UEbzc2vdlyRSGkdPye3EWXEe4=";

  doCheck = false;

--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@ -17,18 +17,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "1.98.2";
+  version = "1.100.1";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-V+8iTaTPld3Fr+n7xpXrI7bkBiS2HZkMkYzRocssc8g=";
+    hash = "sha256-S5GGJRLTpr1HfXnXRXO6hcVjgjRWvbknABEsGkTq428=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-WD5iLBbfXRDiGjc6h23AfOTwiEUb6cg1Q40dfHItQXc=";
+    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "nats-server";
-  version = "2.11.5";
+  version = "2.11.6";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = "nats-server";
    rev = "v${version}";
-    hash = "sha256-7EY1fRy8YMg4vAduwCKFG9ooEwbdimFIZWQxtIGLRcM=";
+    hash = "sha256-E1gEH4wiGvPE8v2wUkojNIBKUCwmchqo+Hi3hsweCBk=";
  };

  vendorHash = "sha256-b2L1Ef/vqS+OpZTaBbJ/saHWCFjq0jmLrvs4ujgk4ro=";
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@ -11,7 +11,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "openapi-python-client";
-  version = "0.25.1";
+  version = "0.25.2";
  pyproject = true;

  src = fetchFromGitHub {
@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
    owner = "openapi-generators";
    repo = "openapi-python-client";
    tag = "v${version}";
-    hash = "sha256-8ehqUYYFBkYgXm/fHOf3d6Gpz9zPoPekfdF22FO1TSE=";
+    hash = "sha256-B+GVv1Q/OwbtHDMGNYkPkZgvHqncrAkdvZ6ECwhIbLE=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@ -23,6 +23,8 @@ buildGoModule rec {
    "-X main.version=v${version}"
  ];

+  __darwinAllowLocalNetworking = true; # for tests
+
  meta = with lib; {
    homepage = "https://github.com/FairwindsOps/pluto";
    description = "Find deprecated Kubernetes apiVersions";
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -223,7 +223,9 @@ python.pkgs.buildPythonApplication rec {

  postInstall = ''
    mkdir -p $out/bin
-    cp ./src/manage.py $out/bin/pretix-manage
+    cp ./src/manage.py $out/${python.sitePackages}/pretix/manage.py
+    makeWrapper $out/${python.sitePackages}/pretix/manage.py $out/bin/pretix-manage \
+      --prefix PYTHONPATH : "$PYTHONPATH"

    # Trim packages size
    rm -rfv $out/${python.sitePackages}/pretix/static.dist/node_prefix
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@ -0,0 +1,166 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  nixosTests,
+  bash,
+  cairo,
+  cctools,
+  ffmpeg-headless,
+  jemalloc,
+  makeWrapper,
+  nodejs,
+  pango,
+  pixman,
+  pkg-config,
+  pnpm_9,
+  python3,
+  vips,
+  xcbuild,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sharkey";
+  version = "2025.4.3";
+
+  src = fetchFromGitLab {
+    domain = "activitypub.software";
+    owner = "TransFem-org";
+    repo = "Sharkey";
+    tag = finalAttrs.version;
+    hash = "sha256-B268bSR5VFyJ/TaWg3xxpnP4oRj07XUpikJZ2Tb9FEY=";
+    fetchSubmodules = true;
+  };
+
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
+  };
+
+  nativeBuildInputs =
+    [
+      makeWrapper
+      nodejs
+      pkg-config
+      pnpm_9.configHook
+      python3
+    ]
+    ++ (lib.optionals stdenv.hostPlatform.isDarwin [
+      cctools
+      xcbuild
+    ]);
+
+  buildInputs = [
+    cairo
+    pango
+    pixman
+    vips
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    # pnpm.fetchDeps doesn't run build scripts, so we need to run postinstall for this package otherwise the frontend
+    # build fails
+    pushd node_modules/.pnpm/node_modules/v-code-diff
+    pnpm postinstall
+    popd
+
+    # rebuild some node modules that have native dependencies
+    export npm_config_nodedir=${nodejs}
+
+    pushd node_modules/.pnpm/node_modules/re2
+    pnpm rebuild
+    popd
+
+    pushd node_modules/.pnpm/node_modules/sharp
+    pnpm run install
+    popd
+
+    pushd node_modules/.pnpm/node_modules/canvas
+    pnpm run install
+    popd
+
+    pnpm build
+    node scripts/trim-deps.mjs
+    pnpm prune --prod --ignore-scripts
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    let
+      binPath = lib.makeBinPath [
+        bash
+        nodejs
+        pnpm_9
+      ];
+      libPath = lib.makeLibraryPath [
+        ffmpeg-headless
+        jemalloc
+        stdenv.cc.cc
+      ];
+    in
+    ''
+      runHook preInstall
+
+      # adapted from repo dockerfile
+      # https://activitypub.software/TransFem-org/Sharkey/-/blob/develop/Dockerfile?ref_type=heads
+      mkdir -p $out/sharkey
+      cp -r built fluent-emojis node_modules package.json pnpm-workspace.yaml $out/sharkey/
+
+      mkdir -p $out/sharkey/packages/backend
+      cp -r packages/backend/{assets,built,migration,node_modules,ormconfig.js,package.json} $out/sharkey/packages/backend/
+      mkdir -p $out/sharkey/packages/backend/scripts
+      cp -r packages/backend/scripts/check_connect.js $out/sharkey/packages/backend/scripts/
+
+      mkdir -p $out/sharkey/packages/megalodon
+      cp -r packages/megalodon/{lib,node_modules,package.json} $out/sharkey/packages/megalodon/
+
+      mkdir -p $out/sharkey/packages/misskey-{bubble-game,js,reversi}
+      cp -r packages/misskey-bubble-game/{built,node_modules,package.json} $out/sharkey/packages/misskey-bubble-game/
+      cp -r packages/misskey-js/{built,node_modules,package.json} $out/sharkey/packages/misskey-js/
+      cp -r packages/misskey-reversi/{built,node_modules,package.json} $out/sharkey/packages/misskey-reversi/
+
+      mkdir -p $out/sharkey/packages/frontend{,-embed}
+      cp -r packages/frontend/assets $out/sharkey/packages/frontend/
+      cp -r packages/frontend-embed/assets $out/sharkey/packages/frontend-embed/
+
+      mkdir -p $out/sharkey/tossface-emojis
+      cp -r tossface-emojis/dist $out/sharkey/tossface-emojis/
+
+      # create a wrapper script for running sharkey commands (ie. alias for pnpm run)
+      makeWrapper ${lib.getExe pnpm_9} $out/bin/sharkey \
+        --chdir $out/sharkey \
+        --add-flags run \
+        --set-default NODE_ENV production \
+        --prefix PATH : ${binPath} \
+        --prefix LD_LIBRARY_PATH : ${libPath}
+
+      runHook postInstall
+    '';
+
+  fixupPhase = ''
+    runHook preFixup
+
+    # cleanup dangling symlinks in node_modules, referencing workspace packages we don't include in the final output
+    rm -r $out/sharkey/node_modules/.pnpm/node_modules/{sw,misskey-js-type-generator,frontend-shared}
+
+    # remove packageManager line from package.json; tries to download a different pnpm version into $HOME otherwise
+    sed -i -e '9d' $out/sharkey/package.json
+
+    runHook postFixup
+  '';
+
+  passthru.tests.sharkey = nixosTests.sharkey;
+
+  meta = {
+    description = "Sharkish microblogging platform";
+    homepage = "https://joinsharkey.org";
+    changelog = "https://activitypub.software/TransFem-org/Sharkey/-/releases/${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "sharkey";
+    maintainers = with lib.maintainers; [ srxl ];
+  };
+})
--- a/pkgs/by-name/sw/swagger-typescript-api/missing-hashes.json
+++ b/pkgs/by-name/sw/swagger-typescript-api/missing-hashes.json
@ -1,12 +1,12 @@
 {
-  "@biomejs/cli-darwin-arm64@npm:2.0.0": "764c0c31fd9d3f7f6c865747dc21cfb41a18489ef9a0ee46ad77e90cb06c29d42c4e8c33a00287c61f20cf192a91977a83c66785f34a3fe537c828147737f4d9",
-  "@biomejs/cli-darwin-x64@npm:2.0.0": "9af332e2e23b1dc0f203eee0b62b45881e08c8e842b698aeca77372e22f3bbdc25877d12449a3e5fbb53acc8e218684b264fb5e7a1695852221aa3b23e97f348",
-  "@biomejs/cli-linux-arm64-musl@npm:2.0.0": "59457823a3500202f2b5d9172f2a35bf48db7013bc61361a4ad4af990dbeca55731937ba4226c2b4e8a0dbfcc32d4affd034c9533c18c56dabe530858b5852b1",
-  "@biomejs/cli-linux-arm64@npm:2.0.0": "e0678a17ccfac6579c164f9417ed17d39fb6e040d38def2f315db36c8becdaba379ad6555c0d71de8db341ce14afa97f9ef4c5f5c6fd0a0f91f189f35ce0ed38",
-  "@biomejs/cli-linux-x64-musl@npm:2.0.0": "a40735fe8d2f450415615abd8269057b93c1e2845b08b86df147621bb520c1c706d4b6d1cfb1efcf3d0f2ec7d97c5170a2e9a25cb50784b2bddecf4bfb81f5a6",
-  "@biomejs/cli-linux-x64@npm:2.0.0": "33bc0f45b046c0d199ea3fca52b75c071fefeb53508b740a60148e3cc07f06e5e5283e07241bd3eeb62f521433f54b1b8b2eb82c77b55a678fd0d233f06deba7",
-  "@biomejs/cli-win32-arm64@npm:2.0.0": "6039e24f9116c805247267e710b3b18464daefade5ddaf032b5993fe68b2b421b62a8ec8e53d16ec1cd43babb70d27b43e2dc9704e8a9a7dd47d3e68d29ac3be",
-  "@biomejs/cli-win32-x64@npm:2.0.0": "82dee9ae7ddd811b2a8cda3530f0bca3babd85204daf56e54d721a0114355d8006f473262a14d235b697308962db4c46b275f1d4fa53cb6c626bba73cc5493e3",
+  "@biomejs/cli-darwin-arm64@npm:2.0.5": "0ff323d033dcbbd5b3ca36db38797710ae334e75979b59cb2c9a507d54a86864312425144583534132c26be03f874adb51ccf28b767687afda0e69e79c37558d",
+  "@biomejs/cli-darwin-x64@npm:2.0.5": "29a30e069d5c17a92251508be6b75285b692cfdac2919723f053d0de1ad769a61a76b1169539c6e65b297b609fb5be897e6b9f690df0cdbf431b8fb4759f5d44",
+  "@biomejs/cli-linux-arm64-musl@npm:2.0.5": "b4af94b86d85fbe57c59dfb3d099853f75badb21bfcc47565a44ddcd01e58cca4acec491265ddd38ac501e8bfcff22c97d0ea96a244a0be6e3ebd18e38fd6c3a",
+  "@biomejs/cli-linux-arm64@npm:2.0.5": "78f4ff67d4cb14dfed2a942d26e24be375cf1bb2d66f50247748bbdcea18505ccd03e30489f2fe34c7a2705f093a68b26e7c6c08c17a19c130de1b3a0d41cb35",
+  "@biomejs/cli-linux-x64-musl@npm:2.0.5": "f70b57ca309e00398078f88b4873108626d01262fd8e28f4b8719a709e778ab45d28b4bd4277d059c79c3cf45aca5c020b482701e49a34598d202427057e658b",
+  "@biomejs/cli-linux-x64@npm:2.0.5": "6c7827dd705bfc5b751ba9c6377a3c847c772aefd64655345b1b5ab1da96af6c931626087223fa03aa88d1ccb4f58cef63cc5224199051385efa0baf86c139ec",
+  "@biomejs/cli-win32-arm64@npm:2.0.5": "5c2584ab24a217335f818a50cb8a47e9dca742f45d109c0e4bd519900ea3de140980c07c91ce0af9f7989c96bd6cf6606ad8086142b7fa692dbc124ed996e34c",
+  "@biomejs/cli-win32-x64@npm:2.0.5": "f5b3228d90cd8212d01587e1011db7d61c84832a53e3ee491c18f875f349d75a3127183f660bd7edef4bbfaf1b6590039b694137c96aad90d8db4a18292fc384",
  "@esbuild/aix-ppc64@npm:0.25.5": "fb872b34a2843293dc60e809968fedf93e0d8f7174b062decffae6ba861eb56aaea0cd0aba87ba99162ceb2a690f0cde4fc29c000b52c035e40c91ec7861d43e",
  "@esbuild/android-arm64@npm:0.25.5": "c818e799b19b5587466bf68a27b578ccaaf866c1d144573fbde7659e3fd3f555422ec3e67f5bd186a87648957d1b6e74df4f847edea7219c16979c9916f36e91",
  "@esbuild/android-arm@npm:0.25.5": "a5384933f9f2ffcadce2be49da6ff43249fe42f32a04071316434e9f633fc20c8d4029072e9a53555620c3531045786297607b852579eee30b6dbc3bc9d98cd9",
@ -32,18 +32,18 @@
  "@esbuild/win32-arm64@npm:0.25.5": "a77d395251c8a62ab0cec07d5230222823fa02fbf3ef008d94b5213a335c9f949872c3f1c2f947abaa28098b669018e429af42f59616e049860a0072f3b006de",
  "@esbuild/win32-ia32@npm:0.25.5": "ff1b6cbe835082aef5b93c3e2012d51be431d05c6ae5f90a5bc89687c687e8e2340c262dedddd124b27b511616bbc4088b5a4a949d3147f677084dc6ec572629",
  "@esbuild/win32-x64@npm:0.25.5": "266e69e8d37bd4deb77443588e49472e4e9791178cb39e1692eabb67cf65d8e85a932ac468e7ebb2072c8a9ee23ad413c8f0f7d954c474f643cedbbf7aad952a",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-beta.15": "266648537808df9caae910755a91056f2d003cb5207316724712fb814c779a356c871ea173d0c550dc94360ce544b07e1cd9db4e7bf91064d5ed9e4ea495b9c8",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-beta.15": "2c9af888858c6cc612ffb9bbcb14651ae6e09b9c6aad3b9b572fe3a26b61f9f7daa27ca9f51f14e9becdeca956b77250c92ae38095acd9c3631e509a4e94cc98",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-beta.15": "ce94ccfbfd65469131d133d814ccee8db1de85ba3518dc0b324e754fcdafdca567951473d781230549d33cdc38cfcdc4324fafade529e0530009580d4fc30c21",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-beta.15": "062140a92a3311dde57bff3f96af99559258293a14e05cbe5a55d9c7e646e98c88cbabb2d3a227a0d51a996bf44a32ae0c8407db137b1b44c0aed257d763b370",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-beta.15": "1b26e2315b364bb2542a96061d2e34564ebcca2191a9247fe3af34d2343bf50636686e33cc1104fda513432f90a2dc6a68d71b7b585edee1cf8bf21600edf142",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-beta.15": "5bc4e640c1b247fadfca7345f2c1264102d0cd8edaef0018d2a86bf617956b13daf35bf7a8e428cb162f2a68e5d3464b3c34780e08c935ddae01dbf58860b3c7",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-beta.15": "daa99ebcc0cd856cfa60e3da63e88ad4168e598a6accb8c95ae0f4c014027d678bcab8c141605e4fd497fe949e719a953328f3042b410cf91c2572acfeac8e50",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-beta.15": "24504dc0f657c0acd8e361c3741e1fad7903188b8aecc1a823eb39c40528f88739330a1bf3d1f95d2a01cc0ecd6b5fc5325450abd67f7764bc5d44e496c7feb7",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-beta.15": "f1b8d470e876e23b422f83775ed0f8390be272c832bc6adfcea418c39d45a260f8fbf0209686d02fa244b891232b3c94ee33a41eb383b4d5b5914ba9dca7631e",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-beta.15": "a3122e3d53634dded2dcd8854adc8159727726befdd62bdfaa81f40232ab1588b75507a8d6be7ea60741f17bd3be71cd30efc61a87df60ed2c858d89c1b65d87",
-  "@rolldown/binding-win32-ia32-msvc@npm:1.0.0-beta.15": "af0db10de1a3d28cf3c70fd39d6da10952e5c7e9ab878d43f016a4fbfd9d2749ca92d73f3832162588da84f56ae1a1f90101191923774f29ad0747a0f111bdf4",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-beta.15": "a3e625f53aecf21d353a13858ba752e911f9520019cab4afa979988d23dd9d3b27d2462fd5394c57d6dd6337d18772950ab08ce1ba73c95040cbbac390b20fdd",
+  "@rolldown/binding-darwin-arm64@npm:1.0.0-beta.9-commit.d91dfb5": "a4636b96d36bfaccc655f9de258cef17daedd025463309657ed213b63b4226aeb6901eaa05d00d577e486bfb4d4ef99ee1457d8d7a8b5170afe07c86d2a5c18d",
+  "@rolldown/binding-darwin-x64@npm:1.0.0-beta.9-commit.d91dfb5": "a7b89d92f33ad9a718de70c56452dc481962e5396b32d66cbc08e588f45fa090ed6e3b7d8fc2ec641acf3de2a550b6d05416b14179ed4fcc8d336fdbd697d40b",
+  "@rolldown/binding-freebsd-x64@npm:1.0.0-beta.9-commit.d91dfb5": "7da382e43eeada73dec31bb63680432f129fa17efed7ed211da0c9915a89c9dfa2e8ec35aa7f07a4be99a36eb14df67059a375ac4bc5e6a5cdc16e02f7a9bd3c",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-beta.9-commit.d91dfb5": "cb5a7635fc2c39049c1fba8376d3b23f58240dbe2cbdc127d0dc8f2b8900537298bb8b52abde5b6e941cf22d8f69466433048db573c683947bf797f92f28baee",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-beta.9-commit.d91dfb5": "8ff267e66b1f59e9317d5b9d89e00a3e11172ae5b5cca17985e92cd52672ef59cd2d6292263700ff8edb02b53420865f655e6ed7f4b4ad8680e4ee0d99dcf5a7",
+  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-beta.9-commit.d91dfb5": "7b320fbdc870cb7f2f75e89058ac50a675c05236df12739b98ce287ad07cce53474699bf19b729577c3de62d80c2fbd988cbbb8bc29e06c88fc42a8ece176b19",
+  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-beta.9-commit.d91dfb5": "99679e1c7e290c7d747d6deb420357522fb0fab1fd022cf79f84534243af2eac15988c8ef5d1b50c679fdc915788360bf744c4e0c9e47952aa0985f23ee58e80",
+  "@rolldown/binding-linux-x64-musl@npm:1.0.0-beta.9-commit.d91dfb5": "2ce172ea44980ca6b86636a13cce7d70104e25f75caaa0c4d6d9199721825a896a74b11bc32fecbc2756aa829d7e10f4701b2f3544b77cfa4da3c2cea0d72e1c",
+  "@rolldown/binding-wasm32-wasi@npm:1.0.0-beta.9-commit.d91dfb5": "3516b21ab1982990435d550a23c153393ce1a2c9308b6df6614438c14ef1206d50c5e7dd214c403a42c9f4e695b574122abc8009df5171ebb79e685da14e7562",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-beta.9-commit.d91dfb5": "17086030865bbfb6668d04f882926035fc1f72db81c3415a8f81e6196b9f849eabd6f2a62066e83f87255fcec106fe274353c8f5ff9c782417b6eddc664a129c",
+  "@rolldown/binding-win32-ia32-msvc@npm:1.0.0-beta.9-commit.d91dfb5": "ecd226ec05f9f863d97de98ca4d7cb9026bcb0cd2fff12e325209664eaca1fa131744ad72d1352b522567adfe4967ca73e50987f96ab475b50e9b96456dd50cf",
+  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-beta.9-commit.d91dfb5": "9e50f65fb7ad451a6eb4f9305650605e7a4efdd6873ad9412520edb8fd4c7f0bb67aa9922dbf1bad055c01a0de677eace73abf4285409cb9defae93956a83b24",
  "@rollup/rollup-android-arm-eabi@npm:4.43.0": "8e37e27b359200197cddf9c1aa5bb5f2d0d8e640fe30f0ccc4b77d9c730b2fdda6f3b6f97a0afc45c5113f23637f98c5c89abf982a222cc3f6b00192a2a998fa",
  "@rollup/rollup-android-arm64@npm:4.43.0": "6e7ee0f496d30cfeca8d930c512f331053d87076b67f06303339ef19120dca5895bc2072ab3da7b99fb93f6c6c275d4d874a66bff08afeac4cea5447cdc709a3",
  "@rollup/rollup-darwin-arm64@npm:4.43.0": "7b76fb8e7ccc40ff17f9584b0cdacce22e384ce1229860b0971417236884d100362a79a12cdcbd0254dcd0f68d7db6cfe11c60f38e7a672cf62b0b8abe6834e9",
--- a/pkgs/by-name/sw/swagger-typescript-api/package.nix
+++ b/pkgs/by-name/sw/swagger-typescript-api/package.nix
@ -8,7 +8,7 @@
 }:
 let
  pname = "swagger-typescript-api";
-  version = "13.2.3";
+  version = "13.2.7";
  yarn-berry = yarn-berry_4;
 in
 stdenv.mkDerivation (finalAttrs: {
@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "acacode";
    repo = "swagger-typescript-api";
    rev = version;
-    hash = "sha256-6sAp6RD3zplZL5FXharrlYXld/0Cb3EIPEf/T2+BEeE=";
+    hash = "sha256-sK1zqpxQLnO5/6Spw/fgFcwotwb7vHX/aQUCW601HBQ=";
  };

  nativeBuildInputs = [
@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-qW+1EyLfjTcXiMpDmcsHB6Mb2o0fTuMSX2U6G0T7viQ=";
+    hash = "sha256-KyE+Wmbx8hN9ewOyNk5imlrae7kqZgOYoyCg+K/dC+k=";
  };

  buildPhase = ''
--- a/pkgs/by-name/we/weidu/package.nix
+++ b/pkgs/by-name/we/weidu/package.nix
@ -10,8 +10,8 @@
 }:

 let
-  # 1. Needs ocaml >= 4.04 and <= 4.11 (patched against 4.14)
-  # 2. ocaml 4.10 defaults to safe (immutable) strings so we need a version with
+  # 1. Needs ocaml >= 4.04 and <= 4.11 but works with 4.14 when patched
+  # 2. ocaml 4.10+ defaults to safe (immutable) strings so we need a version with
  #    that disabled as weidu is strongly dependent on mutable strings
  ocaml' = ocaml-ng.ocamlPackages_4_14_unsafe_string.ocaml;

@ -36,9 +36,9 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substitute sample.Configuration Configuration \
-      --replace /usr/bin ${lib.makeBinPath [ ocaml' ]} \
-      --replace /usr/local/bin ${lib.makeBinPath [ ocaml' ]} \
-      --replace elkhound ${elkhound}/bin/elkhound
+      --replace-fail /usr/bin ${lib.makeBinPath [ ocaml' ]} \
+      --replace-fail /usr/local/bin ${lib.makeBinPath [ ocaml' ]} \
+      --replace-fail elkhound ${lib.getExe elkhound}

    mkdir -p obj/{.depend,x86_LINUX}

@ -78,5 +78,6 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ peterhoeg ];
    # should work fine on Windows
    platforms = platforms.unix;
+    mainProgram = "weidu";
  };
 }
--- a/pkgs/by-name/xe/xen/0001-makefile-efi-output-directory.patch
+++ b/pkgs/by-name/xe/xen/0001-makefile-efi-output-directory.patch
@ -0,0 +1,35 @@
+From 7f802ceac03252ad5182ee8c69ebb01da24a307c Mon Sep 17 00:00:00 2001
+From: Fernando Rodrigues <alpha@sigmasquadron.net>
+Date: Fri, 4 Jul 2025 18:07:01 +0000
+Subject: [PATCH 1/2] xen/Makefile: patch .efi output directory
+
+This is necessary so the build does not fail when Xen tries to install
+.efi files to $boot/efi/nixos and panics when the directory doesn't
+exist. It also has the benefit of installing the files in a location
+that is easier to access.
+
+Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
+
+diff --git a/xen/Makefile b/xen/Makefile
+index 6bf0b0ea9e..907cd89f7e 100644
+--- a/xen/Makefile
+++ b/xen/Makefile
+@@ -527,6 +527,6 @@ _install: $(TARGET)$(CONFIG_XEN_INSTALL_SUFFIX)
+ 			$(if $(efi-strip-opt), \
+ 			     $(STRIP) $(efi-strip-opt) -p -o $(TARGET).efi.stripped $(TARGET).efi && \
+-			     $(INSTALL_DATA) $(TARGET).efi.stripped $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi ||) \
+-			$(INSTALL_DATA) $(TARGET).efi $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
+			     $(INSTALL_DATA) $(TARGET).efi.stripped $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi ||) \
+			$(INSTALL_DATA) $(TARGET).efi $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
+ 		elif [ "$(D)" = "$(patsubst $(shell cd $(XEN_ROOT) && pwd)/%,%,$(D))" ]; then \
+ 			echo 'EFI installation only partially done (EFI_VENDOR not set)' >&2; \
+@@ -560,5 +560,5 @@ _uninstall:
+ 	rm -f $(D)$(EFI_DIR)/$(T).efi
+ 	if [ -n '$(EFI_MOUNTPOINT)' -a -n '$(EFI_VENDOR)' ]; then \
+-		rm -f $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
+		rm -f $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
+ 	fi
+
+--
+2.49.0
+
--- a/pkgs/by-name/xe/xen/0002-scripts-external-executable-calls.patch
+++ b/pkgs/by-name/xe/xen/0002-scripts-external-executable-calls.patch
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@ -1,13 +1,191 @@
 {
-  buildXenPackage,
-  python3Packages,
+  lib,
+  stdenv,
+  testers,
+  fetchgit,
  fetchpatch,
+  replaceVars,
+
+  # Xen
+  acpica-tools,
+  autoPatchelfHook,
+  binutils-unwrapped-all-targets,
+  bison,
+  bzip2,
+  cmake,
+  dev86,
+  e2fsprogs,
+  flex,
+  libnl,
+  libuuid,
+  lzo,
+  ncurses,
+  ocamlPackages,
+  perl,
+  pkg-config,
+  python3Packages,
+  systemd,
+  xz,
+  yajl,
+  zlib,
+  zstd,
+
+  # Optional Components
+  withFlask ? false,
+  checkpolicy,
+  withIPXE ? true,
+  ipxe,
+  withOVMF ? true,
+  OVMF,
+  withSeaBIOS ? true,
+  seabios-qemu,
+
+  # Documentation
+  pandoc,
+
+  # Scripts
+  bridge-utils,
+  coreutils,
+  diffutils,
+  drbd,
+  gawk,
+  gnugrep,
+  gnused,
+  inetutils,
+  iproute2,
+  iptables,
+  kmod,
+  multipath-tools,
+  nbd,
+  openiscsi,
+  openvswitch,
+  psmisc,
+  util-linux,
+  which,
 }:

-buildXenPackage.override { inherit python3Packages; } {
+let
+  inherit (lib)
+    enableFeature
+    genAttrs
+    getExe
+    getExe'
+    licenses
+    optionalString
+    optionals
+    systems
+    teams
+    versionOlder
+    versions
+    warn
+    ;
+  inherit (systems.inspect.patterns) isLinux isAarch64;
+  inherit (licenses)
+    cc-by-40
+    gpl2Only
+    lgpl21Only
+    mit
+    ;
+
+  # Mark versions older than minSupportedVersion as EOL.
+  minSupportedVersion = "4.17";
+
+  scriptDeps =
+    let
+      mkTools = pkg: tools: genAttrs tools (tool: getExe' pkg tool);
+    in
+    (genAttrs [
+      "CONFIG_DIR"
+      "CONFIG_LEAF_DIR"
+      "LIBEXEC_BIN"
+      "XEN_LOG_DIR"
+      "XEN_RUN_DIR"
+      "XEN_SCRIPT_DIR"
+      "qemu_xen_systemd"
+      "sbindir"
+    ] (_: null))
+    // (mkTools coreutils [
+      "basename"
+      "cat"
+      "cp"
+      "cut"
+      "dirname"
+      "head"
+      "ls"
+      "mkdir"
+      "mktemp"
+      "readlink"
+      "rm"
+      "seq"
+      "sleep"
+      "stat"
+    ])
+    // (mkTools drbd [
+      "drbdadm"
+      "drbdsetup"
+    ])
+    // (mkTools gnugrep [
+      "egrep"
+      "grep"
+    ])
+    // (mkTools iproute2 [
+      "bridge"
+      "ip"
+      "tc"
+    ])
+    // (mkTools iptables [
+      "arptables"
+      "ip6tables"
+      "iptables"
+    ])
+    // (mkTools kmod [
+      "modinfo"
+      "modprobe"
+      "rmmod"
+    ])
+    // (mkTools libnl [
+      "nl-qdisc-add"
+      "nl-qdisc-delete"
+      "nl-qdisc-list"
+    ])
+    // (mkTools util-linux [
+      "flock"
+      "logger"
+      "losetup"
+      "prlimit"
+    ])
+    // {
+      awk = getExe' gawk "awk";
+      brctl = getExe bridge-utils;
+      diff = getExe' diffutils "diff";
+      ifconfig = getExe' inetutils "ifconfig";
+      iscsiadm = getExe' openiscsi "iscsiadm";
+      killall = getExe' psmisc "killall";
+      multipath = getExe' multipath-tools "multipath";
+      nbd-client = getExe' nbd "nbd-client";
+      ovs-vsctl = getExe' openvswitch "ovs-vsctl";
+      sed = getExe gnused;
+      systemd-notify = getExe' systemd "systemd-notify";
+      which = getExe which;
+    };
+in
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "xen";
  version = "4.20.0";
+
+  # This attribute can be overriden to correct the file paths in
+  # `passthru` when building an unstable Xen.
+  upstreamVersion = finalAttrs.version;
+  # Useful for further identifying downstream Xen variants. (i.e. Qubes)
+  vendor = "nixos";
+
  patches = [
+    ./0001-makefile-efi-output-directory.patch
+
+    (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)
+
+    # XSA #469
    (fetchpatch {
      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.20-01.patch";
      hash = "sha256-go743oBhYDuxsK0Xc6nK/WxutQQwc2ERtLKhCU9Dnng=";
@ -36,11 +214,228 @@ buildXenPackage.override { inherit python3Packages; } {
      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.20-07.patch";
      hash = "sha256-+BsCJa01R2lrbu7tEluGrYSAqu2jJcrpFNUoLMY466c=";
    })
+
+    # XSA #470
    (fetchpatch {
      url = "https://xenbits.xenproject.org/xsa/xsa470.patch";
      hash = "sha256-zhMZ6pCZtt0ocgsMFVqthMaof46lMMTaYmlepMXVJqM=";
    })
  ];
-  rev = "3ad5d648cda5add395f49fc3704b2552aae734f7";
-  hash = "sha256-v2DRJv+1bym8zAgU74lo1HQ/9rUcyK3qc4Eec4RpcEY=";
-}
+
+  outputs = [
+    "out"
+    "man"
+    "doc"
+    "dev"
+    "boot"
+  ];
+
+  src = fetchgit {
+    url = "https://xenbits.xenproject.org/git-http/xen.git";
+    rev = "3ad5d648cda5add395f49fc3704b2552aae734f7";
+    hash = "sha256-v2DRJv+1bym8zAgU74lo1HQ/9rUcyK3qc4Eec4RpcEY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      acpica-tools
+      autoPatchelfHook
+      bison
+      cmake
+      dev86
+      flex
+      pandoc
+      perl
+      pkg-config
+
+      # oxenstored
+      ocamlPackages.findlib
+      ocamlPackages.ocaml
+    ]
+    ++ (with python3Packages; [
+      python
+      setuptools
+      wrapPython
+    ]);
+
+  buildInputs =
+    [
+      bzip2
+      e2fsprogs.dev
+      libnl
+      libuuid
+      lzo
+      ncurses
+      xz
+      yajl
+      zlib
+      zstd
+    ]
+    ++ optionals withFlask [ checkpolicy ]
+    ++ optionals (versionOlder finalAttrs.version "4.19") [ systemd ];
+
+  configureFlags = [
+    "--enable-systemd"
+    "--disable-qemu-traditional"
+    "--with-system-qemu"
+    (if withSeaBIOS then "--with-system-seabios=${seabios-qemu.firmware}" else "--disable-seabios")
+    (if withOVMF then "--with-system-ovmf=${OVMF.mergedFirmware}" else "--disable-ovmf")
+    (if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
+    (enableFeature withFlask "xsmpolicy")
+  ];
+
+  makeFlags =
+    [
+      "SUBSYSTEMS=${toString finalAttrs.buildFlags}"
+
+      "PREFIX=$(out)"
+      "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
+
+      "XEN_WHOAMI=${finalAttrs.pname}"
+      "XEN_DOMAIN=${finalAttrs.vendor}"
+
+      "GIT=${getExe' coreutils "false"}"
+      "WGET=${getExe' coreutils "false"}"
+      "EFI_VENDOR=${finalAttrs.vendor}"
+      "INSTALL_EFI_STRIP=1"
+      "LD=${getExe' binutils-unwrapped-all-targets "ld"}"
+    ]
+    # These flags set the CONFIG_* options in /boot/xen.config
+    # and define if the default policy file is built. However,
+    # the Flask binaries always get compiled by default.
+    ++ optionals withFlask [
+      "XSM_ENABLE=y"
+      "FLASK_ENABLE=y"
+    ];
+
+  buildFlags = [
+    "xen"
+    "tools"
+    "docs"
+  ];
+
+  enableParallelBuilding = true;
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=array-bounds"
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  # Remove in-tree QEMU sources, we don't need them in any circumstance.
+  prePatch = "rm -rf tools/qemu-xen tools/qemu-xen-traditional";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out $out/share $boot
+    cp -prvd dist/install/nix/store/*/* $out/
+    cp -prvd dist/install/etc $out
+    cp -prvd dist/install/boot $boot
+
+    runHook postInstall
+  '';
+
+  postInstall =
+    # Wrap xencov_split, xenmon and xentrace_format.
+    # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
+    ''
+      wrapPythonPrograms
+      wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
+    '';
+
+  postFixup =
+    ''
+      addAutoPatchelfSearchPath $out/lib
+      autoPatchelf $out/libexec/xen/bin
+    ''
+    # Flask is particularly hard to disable. Even after
+    # setting the make flags to `n`, it still gets compiled.
+    # If withFlask is disabled, delete the extra binaries.
+    + optionalString (!withFlask) ''
+      rm -f $out/bin/flask-*
+    '';
+
+  passthru = {
+    efi = "boot/xen-${finalAttrs.upstreamVersion}.efi";
+    flaskPolicy =
+      if withFlask then
+        warn "This Xen was compiled with FLASK support, but the FLASK file may not match the Xen version number. Please hardcode the path to the FLASK file instead." "boot/xenpolicy-${finalAttrs.upstreamVersion}"
+      else
+        throw "This Xen was compiled without FLASK support.";
+    # This test suite is very simple, as Xen's userspace
+    # utilities require the hypervisor to be booted.
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+        moduleNames = [
+          "xencall"
+          "xencontrol"
+          "xendevicemodel"
+          "xenevtchn"
+          "xenforeignmemory"
+          "xengnttab"
+          "xenguest"
+          "xenhypfs"
+          "xenlight"
+          "xenstat"
+          "xenstore"
+          "xentoolcore"
+          "xentoollog"
+          "xenvchan"
+          "xlutil"
+        ];
+      };
+    };
+  };
+
+  meta = {
+    branch = versions.majorMinor finalAttrs.version;
+
+    description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
+    longDescription =
+      ''
+        The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
+        hypervisor*, which allows multiple virtual machines, known as domains, to run
+        concurrently with the host on the physical machine. On a typical *type-2
+        hypervisor*, the virtual machines run as applications on top of the
+        host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
+        virtualise **Unprivileged Domains**.
+
+        Use with the `qemu_xen` package.
+      ''
+      + "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${finalAttrs.meta.branch}-testing/misc/efi.html), available on the `boot` output of this package."
+      + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy` file is available on the `boot` output of this package."
+      + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
+      + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
+      + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains.";
+
+    homepage = "https://xenproject.org/";
+    downloadPage = "https://downloads.xenproject.org/release/xen/${finalAttrs.version}/";
+    changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${finalAttrs.meta.branch}_Release_Notes";
+
+    license = [
+      # Documentation.
+      cc-by-40
+      # Most of Xen is licensed under the GPL v2.0.
+      gpl2Only
+      # Xen Libraries and the `xl` command-line utility.
+      lgpl21Only
+      # Development headers in $dev/include.
+      mit
+    ];
+
+    teams = [ teams.xen ];
+    knownVulnerabilities = optionals (versionOlder finalAttrs.version minSupportedVersion) [
+      "The Xen Project Hypervisor version ${finalAttrs.version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html"
+    ];
+
+    mainProgram = "xl";
+
+    platforms = [ isLinux ];
+    badPlatforms = [ isAarch64 ];
+  };
+})
--- a/pkgs/development/python-modules/compressai/default.nix
+++ b/pkgs/development/python-modules/compressai/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,

@ -93,6 +94,12 @@ buildPythonPackage rec {
    "test_find_close"
  ];

+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Cause pytest to hang on Darwin after the tests are done
+    "tests/test_eval_model.py"
+    "tests/test_train.py"
+  ];
+
  meta = {
    description = "PyTorch library and evaluation platform for end-to-end compression research";
    homepage = "https://github.com/InterDigitalInc/CompressAI";
--- a/pkgs/development/python-modules/django-pgpubsub/default.nix
+++ b/pkgs/development/python-modules/django-pgpubsub/default.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  poetry-core,
+  django,
+  django-pgtrigger,
+}:
+
+buildPythonPackage rec {
+  pname = "django-pgpubsub";
+  version = "1.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PaulGilmartin";
+    repo = "django-pgpubsub";
+    tag = version;
+    hash = "sha256-Gl6NfBaoj3WKLHwJElbb27CYVQ83s3f86NUOZE7lHCk=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+    --replace 'poetry.masonry.api' 'poetry.core.masonry.api' \
+    --replace 'poetry>=1.1.13' 'poetry-core>=1.0.0' \
+  '';
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    django
+    django-pgtrigger
+  ];
+
+  pythonImportsCheck = [ "pgpubsub" ];
+
+  meta = {
+    description = "Lightweight background tasks using Django Channels and PostgreSQL NOTIFY/LISTEN";
+    homepage = "https://github.com/PaulGilmartin/django-pgpubsub";
+    changelog = "https://github.com/PaulGilmartin/django-pgpubsub/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ raitobezarius ];
+  };
+}
--- a/pkgs/development/python-modules/pyiss/default.nix
+++ b/pkgs/development/python-modules/pyiss/default.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  voluptuous,
+  httmock,
+  unittestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyiss";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "HydrelioxGitHub";
+    repo = "pyiss";
+    tag = version;
+    hash = "sha256-bhxeu/06B6ba9RB9p++tRWN/Dp3KUel9DN166HryP1E=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    voluptuous
+  ];
+
+  nativeCheckInputs = [
+    httmock
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pyiss" ];
+
+  meta = {
+    description = "Python library to access International Space Station location and data";
+    homepage = "https://github.com/HydrelioxGitHub/pyiss";
+    changelog = "https://github.com/HydrelioxGitHub/pyiss/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "textual";
-  version = "3.5.0";
+  version = "3.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Textualize";
    repo = "textual";
    tag = "v${version}";
-    hash = "sha256-mr/pzW6EhB+STtVHW1a/+CivzPINHEvvYWnCizycjeo=";
+    hash = "sha256-zgDzsPSzwwZSgQINcZgFHXNHzEeNvsFMi6C9LBRffHY=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2805,7 +2805,8 @@
      ];
    "iss" =
      ps: with ps; [
-      ]; # missing inputs: pyiss
+        pyiss
+      ];
    "ista_ecotrend" =
      ps: with ps; [
        fnv-hash-fast
@ -7185,6 +7186,7 @@
    "iskra"
    "islamic_prayer_times"
    "israel_rail"
+    "iss"
    "ista_ecotrend"
    "isy994"
    "ituran"
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -373,6 +373,7 @@ mapAliases {
  buildBarebox = throw "buildBarebox has been removed due to lack of interest in maintaining it in nixpkgs"; # Added 2025-04-19
  buildGo122Module = throw "Go 1.22 is end-of-life, and 'buildGo122Module' has been removed. Please use a newer builder version."; # Added 2025-03-28
  buildGoPackage = throw "`buildGoPackage` has been deprecated and removed, see the Go section in the nixpkgs manual for details"; # Added 2024-11-18
+  buildXenPackage = throw "'buildXenPackage' has been removed as a custom Xen build can now be achieved by simply overriding 'xen'."; # Added 2025-05-12

  inherit (libsForQt5.mauiPackages) buho; # added 2022-05-17
  bwidget = tclPackages.bwidget; # Added 2024-10-02
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -14362,8 +14362,6 @@ with pkgs;
          ;
      };

-  buildXenPackage = callPackage ../build-support/xen { };
-
  gxneur = callPackage ../applications/misc/gxneur {
    inherit (gnome2) libglade GConf;
  };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3939,6 +3939,8 @@ self: super: with self; {

  django-pglocks = callPackage ../development/python-modules/django-pglocks { };

+  django-pgpubsub = callPackage ../development/python-modules/django-pgpubsub { };
+
  django-pgtrigger = callPackage ../development/python-modules/django-pgtrigger { };

  django-phonenumber-field = callPackage ../development/python-modules/django-phonenumber-field { };
@ -12904,6 +12906,8 @@ self: super: with self; {

  pyiskra = callPackage ../development/python-modules/pyiskra { };

+  pyiss = callPackage ../development/python-modules/pyiss { };
+
  pyisy = callPackage ../development/python-modules/pyisy { };

  pyituran = callPackage ../development/python-modules/pyituran { };