Merge branch 'staging' into staging-next

doc/languages-frameworks/haskell.section.md

@@ -260,6 +260,14 @@ the same package with the `previousIntermediates` argument to support
 incremental builds. See [“Incremental builds”](#haskell-incremental-builds) for
 more information. Defaults to `false`.
 
+`dontConvertCabalFileToUnix`
+: By default, `haskellPackages.mkDerivation` converts the `.cabal` file of a
+given package to Unix line endings.
+This is intended to work around
+[Hackage converting revised `.cabal` files to DOS line endings](https://github.com/haskell/hackage-server/issues/316)
+which frequently causes patches to stop applying.
+You can pass `true` to disable this behavior.
+
 `enableLibraryProfiling`
 : Whether to enable [profiling][profiling] for libraries contained in the
 package. Enabled by default if supported.
@@ -1249,8 +1257,8 @@ it does for the unstable branches.
 ### Why is topic X not covered in this section? Why is section Y missing? {#haskell-why-not-covered}
 
 We have been working on [moving the nixpkgs Haskell documentation back into the
-nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). Since this
-process has not been completed yet, you may find some topics missing here
+nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). <!-- krank:ignore-line -->
+Since this process has not been completed yet, you may find some topics missing here
 covered in the old [haskell4nix docs](https://haskell4nix.readthedocs.io/).
 
 If you feel any important topic is not documented at all, feel free to comment

doc/redirects.json

@@ -119,6 +119,12 @@
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
+  "libcxxhardeningextensive": [
+    "index.html#libcxxhardeningextensive"
+  ],
+  "libcxxhardeningfast": [
+    "index.html#libcxxhardeningfast"
+  ],
   "julec-hook": [
     "index.html#julec-hook"
   ],
@@ -247,6 +253,9 @@
   "sec-building-packages-with-llvm-using-clang-stdenv": [
     "index.html#sec-building-packages-with-llvm-using-clang-stdenv"
   ],
+  "sec-darwin-availability-checks": [
+    "index.html#sec-darwin-availability-checks"
+  ],
   "sec-darwin-libcxx-deployment-targets": [
     "index.html#sec-darwin-libcxx-deployment-targets"
   ],
@@ -1224,7 +1233,8 @@
     "index.html#sec-purity-in-nixpkgs"
   ],
   "sec-hardening-in-nixpkgs": [
-    "index.html#sec-hardening-in-nixpkgs"
+    "index.html#sec-hardening-in-nixpkgs",
+    "index.html#pie"
   ],
   "sec-hardening-flags-enabled-by-default": [
     "index.html#sec-hardening-flags-enabled-by-default"
@@ -1259,9 +1269,6 @@
   "sec-hardening-flags-disabled-by-default": [
     "index.html#sec-hardening-flags-disabled-by-default"
   ],
-  "pie": [
-    "index.html#pie"
-  ],
   "shadowstack": [
     "index.html#shadowstack"
   ],

doc/release-notes/rl-2511.section.md

@@ -12,6 +12,18 @@
 - The default GHC version has been updated from 9.8 to 9.10.
   `haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.
 
+- **This release of Nixpkgs requires macOS Sonoma 14.0 or newer, as announced in the 25.05 release notes.**
+  The default SDK is now 14.4, but the minimum version is 14.0.
+  cc-wrapper will enforce that availability annotations are used or an appropriate deployment target is set.
+  See the Darwin platform notes for details.
+
+- **We expect to drop support for `x86_64-darwin` by Nixpkgs 26.11,** in light of Apple’s announcement that macOS 26 will be the final version to support Intel Macs.
+  When support is fully removed, we will no longer build packages for the platform or guarantee that it can build at all.
+  This may happen in stages, depending on our available build and maintenance resources and decisions made by projects we rely on.
+
+  By the time of 26.11’s release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
 - Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations.
   If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target.
   See the Darwin platform documentation for more details.
@@ -49,6 +61,8 @@
 
 - GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.
 
+- The `haskellPackages.mkDerivation` builder now converts packages' cabal files to Unix line endings before `patchPhase`. This behavior can be disabled using `dontConvertCabalFileToUnix`.
+
 - `webkitgtk_4_0` has been removed because it depends on an unmaintained version of security-critical libsoup library (`libsoup_2`) and the support will be [dropped upstream soon](https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html).
 
 - Support for bootstrapping native GHC compilers on 32‐bit ARM and little‐endian 64‐bit PowerPC has been dropped.
@@ -102,6 +116,8 @@
 
 - `forgejo` main program has been renamed to `bin/forgejo` from the previous `bin/gitea`.
 
+- the "pie" hardening flag has been removed. compilers are expected to enable PIE by default, as has been common practice since 2016 outside of nixpkgs. If a package needs "pie" disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalance of default PIE toolchains most packages incompatible with PIE already pass no-pie.
+
 - `wayclip` now uses the `ext-data-control-v1` Wayland protocol instead of `wlr-data-control-unstable-v1`.
 
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
@@ -215,9 +231,10 @@
 - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
   Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
 
-- NetBox was updated to `>= 4.3.0`. Have a look at the breaking changes
-  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
-  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
+- NetBox was updated to `>= 4.4.0`. Have a look at the breaking changes
+  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.3.0)
+  and the [4.4 release](https://github.com/netbox-community/netbox/releases/tag/v4.4.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_4;` in your configuration.
 
 - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.
 
@@ -269,6 +286,8 @@
 
 - Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations.
 
+- Added `npmRegistryOverrides` and `npmRegistryOverridesString` option to the nixpkgs `config`, to allow for setting a default `npmRegistryOverridesString` for all `fetchNpmDeps` invocations.
+
 - The `dockerTools.streamLayeredImage` builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren't used elsewhere.
 
 - The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
@@ -288,7 +307,7 @@
 
 - `idris2` supports being instantiated with a package environment with `idris.withPackages (p: [ ])`
 
-- New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
+- New hardening flags `strictflexarrays1`, `strictflexarrays3`, `glibcxxassertions`, `libcxxhardeningfast` and `libcxxhardeningextensive` were made available.
 
 - `gramps` has been updated to 6.0.0
   Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.
@@ -313,8 +332,6 @@
   and beware that the migration may take several hours depending on your library size and state.
   The process must not be interrupted.
 
-- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
-
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 
@@ -331,6 +348,8 @@
 
 - `nix-prefetch-git`: Added a `--no-add-path` argument to disable adding the path to the store; this is useful when working with a [read-only store](https://nix.dev/manual/nix/2.28/command-ref/new-cli/nix3-help-stores#store-experimental-local-overlay-store-read-only).
 
+- `fetchNpmDeps`: Add `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+
 - `sftpman` has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI.
   For more information, [check the project's README](https://github.com/spantaleev/sftpman-rs#is-sftpman-v2-compatible-with-sftpman-v1).
 

doc/stdenv/platform-notes.chapter.md

@@ -47,6 +47,17 @@ See below for how to use a newer deployment target.
 For example, `std::print` depends on features that are only available on macOS 13.3 or newer.
 To make them available, set the deployment target to 13.3 using `darwinMinVersionHook`.
 
+#### Package fails to build due to missing API availability checks {#sec-darwin-availability-checks}
+
+This is normally a bug in the package or a misconfigured deployment target.
+* If it is using an API from a newer release (e.g., from macOS 26.0 while targeting macOS 14.0), it needs to use an availability check.
+  The code should be patched to use [`__builtin_available`](https://clang.llvm.org/docs/LanguageExtensions.html#objective-c-available).
+  Note that while the linked documentation is for Objective-C, it is applicable to C and C++ except that you use `__builtin_available` in place of `@available`.
+* If the package intends to require the newer platform (i.e., it does not support running on older versions with reduced functionality), use `darwinMinVersionHook` to set the deployment target to the required version.
+  See below for how to use a newer deployment target.
+* If the package actually handles this through some other mechanism (e.g., MoltenVK relies on the running platform’s MSL version), the error can be suppressed.
+  To suppress the error, add `-Wno-error=unguarded-availability` to `env.NIX_CFLAGS_COMPILE`.
+
 #### Package requires a non-default SDK or fails to build due to missing frameworks or symbols {#sec-darwin-troubleshooting-using-sdks}
 
 In some cases, you may have to use a non-default SDK.
@@ -106,13 +117,10 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a
 Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use.
 Generally, only the last SDK release for a major version is packaged.
 
-| Xcode version      | SDK version        | Nixpkgs attribute            |
-|--------------------|--------------------|------------------------------|
-| 12.0–12.5.1        | 11.3               | `apple-sdk_11` / `apple-sdk` |
-| 13.0–13.4.1        | 12.3               | `apple-sdk_12`               |
-| 14.0–14.3.1        | 13.3               | `apple-sdk_13`               |
-| 15.0–15.4          | 14.4               | `apple-sdk_14`               |
-| 16.0               | 15.0               | `apple-sdk_15`               |
+| Xcode version      | SDK version        | Nixpkgs attribute             |
+|--------------------|--------------------|-------------------------------|
+| 15.0–15.4          | 14.4               | `apple-sdk_14` / `apple-sdk`  |
+| 16.0               | 15.0               | `apple-sdk_15`                |
 
 
 #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}

doc/stdenv/stdenv.chapter.md

@@ -1631,19 +1631,6 @@ The following flags are disabled by default and should be enabled with `hardenin
 
 This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
 
-#### `pie` {#pie}
-
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
-
-  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
-
-  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
-
-Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
-
-Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
-If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
-
 #### `strictflexarrays1` {#strictflexarrays1}
 
 This flag adds the `-fstrict-flex-arrays=1` compiler option, which reduces the cases the compiler treats as "flexible arrays" to those declared with length `[1]`, `[0]` or (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler.
@@ -1688,6 +1675,18 @@ Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on
 
 These checks may have an impact on performance in some cases.
 
+#### `libcxxhardeningfast` {#libcxxhardeningfast}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.
+
+Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.
+
+#### `libcxxhardeningextensive` {#libcxxhardeningextensive}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application.
+
+Enabling this flag implies enablement of checks from `libcxxhardeningfast`. Disabling this flag does not imply disablement of checks from `libcxxhardeningfast`.
+
 #### `pacret` {#pacret}
 
 This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.

lib/systems/default.nix

@@ -360,8 +360,8 @@ let
             null;
         # The canonical name for this attribute is darwinSdkVersion, but some
         # platforms define the old name "sdkVer".
-        darwinSdkVersion = final.sdkVer or "11.3";
-        darwinMinVersion = final.darwinSdkVersion;
+        darwinSdkVersion = final.sdkVer or "14.4";
+        darwinMinVersion = "14.0";
         darwinMinVersionVariable =
           if final.isMacOS then
             "MACOSX_DEPLOYMENT_TARGET"

nixos/modules/services/web-apps/netbox.nix

@@ -109,10 +109,10 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_3 else pkgs.netbox_4_2;
+        if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_4 else pkgs.netbox_4_2;
       defaultText = lib.literalExpression ''
         if lib.versionAtLeast config.system.stateVersion "25.11"
-        then pkgs.netbox_4_3
+        then pkgs.netbox_4_4
         else pkgs.netbox_4_2;
       '';
       description = ''

nixos/tests/all-tests.nix

@@ -1006,6 +1006,7 @@ in
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
   netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; };
+  netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
   netdata = runTest ./netdata.nix;
   networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
   networking.networkmanager = handleTest ./networking/networkmanager.nix { };

nixos/tests/login.nix

@@ -48,13 +48,12 @@
         machine.wait_for_file("/home/alice/done")
 
     with subtest("Systemd gives and removes device ownership as needed"):
-        # Change back to /dev/snd/timer after systemd-258.1
-        machine.succeed("getfacl /dev/dri/card0 | grep -q alice")
+        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
         machine.send_key("alt-f1")
         machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
-        machine.fail("getfacl /dev/dri/card0 | grep -q alice")
+        machine.fail("getfacl /dev/snd/timer | grep -q alice")
         machine.succeed("chvt 2")
-        machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice")
+        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
 
     with subtest("Virtual console logout"):
         machine.send_chars("exit\n")

nixos/tests/web-apps/netbox-upgrade.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_2";
-  newNetbox = "netbox_4_3";
+  oldNetbox = "netbox_4_3";
+  newNetbox = "netbox_4_4";
 
   apiVersion =
     version:

nixos/tests/web-apps/netbox/testScript.py

@@ -61,7 +61,7 @@ def compare(a: str, b: str):
     return 0
 
 with subtest("Home screen loads"):
-    machine.succeed(
+    machine.wait_until_succeeds(
         "curl -sSfL http://[::1]:8001 | grep '<title>Home | NetBox</title>'"
     )
 

pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix

@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     faust2lv2
   ];
 
-  # ld: crtbegin.o: relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
-  # ld: failed to set dynamic section sizes: bad value
-  hardeningDisable = [ "pie" ];
-
   enableParallelBuilding = true;
 
   dontWrapQtApps = true;

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1833";
+  version = "9.1.1869";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-bcHTwrJt7ERsIYydCj+Um4AY7sREtkdkqlEA0OdgnuM=";
+    hash = "sha256-AHx4AHsJAsEE5LRzKgBeV3LoCaoHUB+0/gq7kOHObMk=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/emulators/wine/base.nix

@@ -40,12 +40,6 @@ let
     };
   } ./setup-hook-darwin.sh;
 
-  # Using the 14.4 SDK allows Wine to use `os_sync_wait_on_address` for its futex implementation on Darwin.
-  # It does an availability check, so older systems will still work.
-  darwinFrameworks = lib.optionals stdenv.hostPlatform.isDarwin (
-    toBuildInputs pkgArches (pkgs: [ pkgs.apple-sdk_14 ])
-  );
-
   # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
   # because they will put Darwin in `meta.badPlatforms`.
   darwinUnsupportedFlags = [
@@ -168,7 +162,6 @@ stdenv.mkDerivation (
           pkgs.libGL
           pkgs.libdrm
         ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin darwinFrameworks
         ++ lib.optionals x11Support (
           with pkgs.xorg;
           [
@@ -213,11 +206,7 @@ stdenv.mkDerivation (
     # LD_LIBRARY_PATH.
     NIX_LDFLAGS = toString (
       map (path: "-rpath " + path) (
-        map (x: "${lib.getLib x}/lib") (
-          [ stdenv.cc.cc ]
-          # Avoid adding rpath references to non-existent framework `lib` paths.
-          ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs
-        )
+        map (x: "${lib.getLib x}/lib") [ stdenv.cc.cc ]
         # libpulsecommon.so is linked but not found otherwise
         ++ lib.optionals supportFlags.pulseaudioSupport (
           map (x: "${lib.getLib x}/lib/pulseaudio") (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ]))

pkgs/applications/networking/cluster/linkerd/generic.nix

@@ -31,11 +31,6 @@ buildGoModule rec {
     env GOFLAGS="" go generate ./jaeger/static
     env GOFLAGS="" go generate ./multicluster/static
     env GOFLAGS="" go generate ./viz/static
-
-    # Necessary for building Musl
-    if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
-        export GOFLAGS="-buildmode=pie $GOFLAGS"
-    fi
   '';
 
   tags = [

pkgs/applications/networking/irc/weechat/default.nix

@@ -158,8 +158,6 @@ stdenv.mkDerivation rec {
   ++ lib.concatMap (p: p.buildInputs) enabledPlugins
   ++ extraBuildInputs;
 
-  hardeningEnable = [ "pie" ];
-
   env.NIX_CFLAGS_COMPILE =
     "-I${python}/include/${python.libPrefix}"
     # Fix '_res_9_init: undefined symbol' error

pkgs/applications/networking/sync/rsync/default.nix

@@ -19,7 +19,6 @@
   enableZstd ? true,
   zstd,
   nixosTests,
-  fakeroot,
 }:
 
 stdenv.mkDerivation rec {
@@ -58,9 +57,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional enableOpenSSL openssl
   ++ lib.optional enableXXHash xxHash;
 
-  # fakeroot doesn't work well on darwin anymore, apparently
-  checkInputs = lib.optionals (!stdenv.isDarwin) [ fakeroot ];
-
   configureFlags = [
     (lib.enableFeature enableLZ4 "lz4")
     (lib.enableFeature enableOpenSSL "openssl")

pkgs/applications/office/pdfmixtool/default.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  mkDerivation,
-  fetchFromGitLab,
-  fetchpatch,
-  fetchpatch2,
-  cmake,
-  pkg-config,
-  qtbase,
-  qttools,
-  qpdf,
-  podofo,
-  imagemagick,
-}:
-
-mkDerivation rec {
-  pname = "pdfmixtool";
-  version = "1.1.1";
-
-  src = fetchFromGitLab {
-    owner = "scarpetta";
-    repo = "pdfmixtool";
-    rev = "v${version}";
-    hash = "sha256-fgtRKUG6J/CM6cXUTHWAPemqL8loWZT3wZmGdRHldq8=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    imagemagick
-    qtbase
-    qttools
-    qpdf
-    podofo
-  ];
-
-  patches = [
-    # fix incompatibility with qpdf11.3.0 usage of c++17 - delete this patch when we reach pdfmixtool version > v1.1.1
-    (fetchpatch {
-      url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/bd5f78c3a4d977d9b0c74302ce2521c737189b43.diff";
-      hash = "sha256-h2g5toFqgEEnObd2TYQms1a1WFTgN7VsIHyy0Uyq4/I=";
-    })
-    # https://gitlab.com/scarpetta/pdfmixtool/-/merge_requests/14
-    (fetchpatch2 {
-      url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/268291317ccd1805dc1c801ff88641ba06c6a7f0.patch";
-      hash = "sha256-56bDoFtE+IOQHcV9xPfyrgYYFvTfB0QiLIfRl91irb0=";
-    })
-  ];
-
-  meta = with lib; {
-    description = "Application to split, merge, rotate and mix PDF files";
-    mainProgram = "pdfmixtool";
-    homepage = "https://gitlab.com/scarpetta/pdfmixtool";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ onny ];
-  };
-}

pkgs/applications/version-management/git/default.nix

@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.51.0";
+  version = "2.51.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
+    hash = "sha256-Iz1xQ6LVjmB1Xu6bdvVZ7HPqKzwpf1tQMWKs6VlmtOM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -489,6 +489,12 @@ stdenv.mkDerivation (finalAttrs: {
     disable_test t5319-multi-pack-index
     disable_test t6421-merge-partial-clone
     disable_test t7504-commit-msg-hook
+    disable_test t5515-fetch-merge-logic
+    disable_test t4104-apply-boundary
+    disable_test t7002-mv-sparse-checkout
+    disable_test t4122-apply-symlink-inside
+    disable_test t7513-interpret-trailers
+    disable_test t2200-add-update
 
     # Fails reproducibly on ZFS on Linux with formD normalization
     disable_test t0021-conversion

pkgs/applications/virtualization/qemu/default.nix

@@ -32,8 +32,6 @@
   socat,
   libslirp,
   libcbor,
-  apple-sdk_13,
-  darwinMinVersionHook,
   guestAgentSupport ?
     (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
   numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@@ -128,14 +126,6 @@ assert lib.assertMsg (
 
 let
   hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;
-
-  # needed in buildInputs and depsBuildBuild
-  # check log for warnings eg: `warning: 'hv_vm_config_get_max_ipa_size' is only available on macOS 13.0`
-  # to indicate if min version needs to get bumped.
-  darwinSDK = [
-    apple-sdk_13
-    (darwinMinVersionHook "13")
-  ];
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -156,7 +146,6 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ]
-  ++ lib.optionals stdenv.buildPlatform.isDarwin darwinSDK
   ++ lib.optionals hexagonSupport [ pkg-config ];
 
   nativeBuildInputs = [
@@ -205,7 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!userOnly) [ curl ]
   ++ lib.optionals ncursesSupport [ ncurses ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin darwinSDK
   ++ lib.optionals seccompSupport [ libseccomp ]
   ++ lib.optionals numaSupport [ numactl ]
   ++ lib.optionals alsaSupport [ alsa-lib ]

pkgs/build-support/bintools-wrapper/add-hardening.sh

@@ -15,7 +15,7 @@ for flag in @hardening_unsupported_flags@; do
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(pie relro bindnow)
+  declare -a allHardeningFlags=(relro bindnow)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -36,16 +36,6 @@ fi
 
 for flag in "${!hardeningEnableMap[@]}"; do
   case $flag in
-    pie)
-      if [[ ! (" ${params[*]} " =~ " -shared " \
-            || " ${params[*]} " =~ " -static " \
-            || " ${params[*]} " =~ " -r " \
-            || " ${params[*]} " =~ " -Ur " \
-            || " ${params[*]} " =~ " -i ") ]]; then
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningLDFlags+=('-pie')
-      fi
-      ;;
     relro)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
       hardeningLDFlags+=('-z' 'relro')

pkgs/build-support/bintools-wrapper/default.nix

@@ -49,30 +49,15 @@
     "format"
     "fortify"
     "fortify3"
+    "libcxxhardeningextensive"
+    "libcxxhardeningfast"
     "pic"
     "relro"
     "stackclashprotection"
     "stackprotector"
     "strictoverflow"
     "zerocallusedregs"
-  ]
-  ++ lib.optional (
-    with stdenvNoCC;
-    lib.any (x: x) [
-      # OpenBSD static linking requires PIE
-      (with targetPlatform; isOpenBSD && isStatic)
-      (lib.all (x: x) [
-        # Musl-based platforms will keep "pie", other platforms will not.
-        # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
-        # in the nixpkgs manual to inform users about the defaults.
-        (targetPlatform.libc == "musl")
-        # Except when:
-        #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
-        #    - static armv7l, where compilation fails.
-        (!(targetPlatform.isAarch && targetPlatform.isStatic))
-      ])
-    ]
-  ) "pie",
+  ],
 }:
 
 assert propagateDoc -> bintools ? man;

pkgs/build-support/build-mozilla-mach/142-relax-apple-sdk.patch

@@ -1,13 +0,0 @@
-diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure
-index 37c00230c853..dd89bea24392 100644
---- a/build/moz.configure/toolchain.configure
-+++ b/build/moz.configure/toolchain.configure
-@@ -233,7 +233,7 @@ with only_when(host_is_osx | target_is_osx):
-     )
- 
-     def mac_sdk_min_version():
--        return "15.5"
-+        return "15.2"
- 
-     @depends(
-         "--with-macos-sdk",

pkgs/build-support/build-mozilla-mach/default.nix

@@ -327,15 +327,6 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
-    ++
-      lib.optionals
-        (
-          lib.versionAtLeast version "141.0.2"
-          || (lib.versionAtLeast version "140.2.0" && lib.versionOlder version "141.0")
-        )
-        [
-          ./142-relax-apple-sdk.patch
-        ]
     ++ extraPatches;
 
   postPatch = ''

pkgs/build-support/buildenv/builder.pl

@@ -15,7 +15,7 @@ $SIG{__DIE__}  = sub { die "pkgs.buildEnv error: ", @_ };
 my $out = $ENV{"out"};
 my $extraPrefix = $ENV{"extraPrefix"};
 
-my @pathsToLink = split ' ', $ENV{"pathsToLink"};
+my @pathsToLink = @{decode_json $ENV{"pathsToLinkJSON"}};
 
 sub isInPathsToLink($path) {
     $path = "/" if $path eq "";

pkgs/build-support/buildenv/default.nix

@@ -105,6 +105,7 @@ lib.makeOverridable (
           nativeBuildInputs
           buildInputs
           ;
+        pathsToLinkJSON = builtins.toJSON pathsToLink;
         pkgs = builtins.toJSON chosenOutputs;
         extraPathsFrom = lib.optional includeClosures (writeClosure pathsForClosure);
         preferLocalBuild = true;

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -35,3 +35,7 @@ elif [[ $0 != *cpp ]]; then
         extraBefore+=(-mabi=@explicitAbiValue@)
     fi
 fi
+
+if [[ "@darwinMinVersion@" ]]; then
+    extraBefore+=(-Werror=unguarded-availability)
+fi

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -25,6 +25,13 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   hardeningEnableMap["strictflexarrays1"]=1
 fi
 
+# libcxxhardeningextensive implies libcxxhardeningfast enablement - make explicit before
+# we filter unsupported flags because unsupporting libcxxhardeningextensive
+# doesn't mean we should unsupport libcxxhardeningfast too
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+  hardeningEnableMap["libcxxhardeningfast"]=1
+fi
+
 
 # Remove unsupported flags.
 for flag in @hardening_unsupported_flags@; do
@@ -37,6 +44,10 @@ for flag in @hardening_unsupported_flags@; do
   if [[ "$flag" = 'strictflexarrays1' ]] ; then
     unset -v "hardeningEnableMap['strictflexarrays3']"
   fi
+  # libcxxhardeningfast being unsupported implies libcxxhardeningextensive is unsupported
+  if [[ "$flag" = 'libcxxhardeningfast' ]] ; then
+    unset -v "hardeningEnableMap['libcxxhardeningextensive']"
+  fi
 done
 
 
@@ -50,9 +61,14 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   unset -v "hardeningEnableMap['strictflexarrays1']"
 fi
 
+# now make libcxxhardeningfast and libcxxhardeningextensive mutually exclusive
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+  unset -v "hardeningEnableMap['libcxxhardeningfast']"
+fi
+
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow glibcxxassertions format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pic strictoverflow libcxxhardeningfast libcxxhardeningextensive glibcxxassertions format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -115,27 +131,26 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling glibcxxassertions >&2; fi
       hardeningCFlagsBefore+=('-D_GLIBCXX_ASSERTIONS')
       ;;
+    libcxxhardeningfast)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningfast >&2; fi
+      hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST')
+      ;;
+    libcxxhardeningextensive)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningextensive >&2; fi
+      hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE')
+      ;;
     stackprotector)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
     stackclashprotection)
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackclashprotection >&2; fi
       hardeningCFlagsBefore+=('-fstack-clash-protection')
       ;;
     nostrictaliasing)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling nostrictaliasing >&2; fi
       hardeningCFlagsBefore+=('-fno-strict-aliasing')
       ;;
-    pie)
-      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-      hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
-      if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
-      fi
-      ;;
     pic)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
       hardeningCFlagsBefore+=('-fPIC')

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -140,6 +140,15 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
     params=(${kept+"${kept[@]}"})
 fi
 
+# Some build systems such as Bazel and SwiftPM use `clang` instead of `clang++`,
+# which will find the libc++ headers in the sysroot for C++ files.
+if [[ "$isCxx" = 0 && "@isClang@" ]]; then
+# This duplicates the behavior of a native toolchain, which can find the
+# libc++ headers but requires `-lc++` to be specified explicitly when linking.
+    isCxx=1
+    cxxLibrary=0
+fi
+
 if [[ "$isCxx" = 1 ]]; then
     if [[ "$cxxInclude" = 1 ]]; then
         #

pkgs/build-support/cc-wrapper/default.nix

@@ -753,14 +753,14 @@ stdenvNoCC.mkDerivation {
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
-        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+        include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
       for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
-        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+        include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
     + optionalString (libcxx.isLLVM or false) ''
-      include -isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      include -cxx-isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
     # GCC NG friendly libc++

pkgs/build-support/go/module.nix

@@ -250,6 +250,9 @@ lib.extendMkDerivation {
             export GOPATH="$TMPDIR/go"
             export GOPROXY=off
             export GOSUMDB=off
+            if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then
+              export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker)
+            fi
             cd "$modRoot"
           ''
           + lib.optionalString (finalAttrs.vendorHash != null) ''
@@ -266,13 +269,6 @@ lib.extendMkDerivation {
             }
           ''
           + ''
-
-            # currently pie is only enabled by default in pkgsMusl
-            # this will respect the `hardening{Disable,Enable}` flags if set
-            if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
-              export GOFLAGS="-buildmode=pie $GOFLAGS"
-            fi
-
             runHook postConfigure
           ''
         );

pkgs/build-support/node/fetch-npm-deps/default.nix

@@ -12,6 +12,7 @@
   cacert,
   prefetch-npm-deps,
   fetchNpmDeps,
+  config,
 }:
 
 {
@@ -68,6 +69,7 @@
             hash,
             forceGitDeps ? false,
             forceEmptyCache ? false,
+            npmRegistryOverridesString ? "{}",
           }:
           testers.invalidateFetcherByDrvHash fetchNpmDeps {
             inherit
@@ -75,6 +77,7 @@
               hash
               forceGitDeps
               forceEmptyCache
+              npmRegistryOverridesString
               ;
 
             src = makeTestSrc { inherit name src; };
@@ -175,6 +178,23 @@
 
           hash = "sha256-FhxlJ0HdJMPiWe7+n1HaGLWOr/2HJEPwiS65uqXZM8Y=";
         };
+
+        # Test that npmRegistryOverrides work
+        npmRegistryOverrides = makeTest {
+          name = "npm-registry-overrides";
+
+          src = fetchurl {
+            url = "https://cyberchaos.dev/yuka/trainsearch/-/raw/e3cba6427e8ecfd843d0f697251ddaf5e53c2327/package-lock.json";
+            postFetch = "sed -i 's/registry.npmjs.org/broken.link/' $out";
+            hash = "sha256-Qo24ei1d9Ql4zCLjQJ04zVgS4qhBUpew9NZrhrsBds4=";
+          };
+
+          npmRegistryOverridesString = builtins.toJSON {
+            "broken.link" = "https://registry.npmjs.org";
+          };
+
+          hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
+        };
       };
 
     meta = with lib; {
@@ -192,6 +212,9 @@
       forceGitDeps ? false,
       forceEmptyCache ? false,
       nativeBuildInputs ? [ ],
+      # A string with a JSON attrset specifying registry mirrors, for example
+      #   {"registry.example.org": "my-mirror.local/registry.example.org"}
+      npmRegistryOverridesString ? config.npmRegistryOverridesString,
       ...
     }@args:
     let
@@ -243,6 +266,8 @@
         # `{ "registry.example.com": "example-registry-bearer-token", ... }`
         impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_TOKENS" ];
 
+        NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
+
         SSL_CERT_FILE =
           if
             (

pkgs/build-support/node/fetch-npm-deps/src/util.rs

@@ -18,6 +18,22 @@ use std::{
 use url::Url;
 
 pub fn get_url(url: &Url) -> Result<Body, anyhow::Error> {
+    let url_ = url.clone();
+    let mut url = url.clone();
+    // Respect NIX_NPM_REGISTRY_OVERRIDES environment variable, which should be a JSON mapping in the shape of:
+    // `{ "registry.example.com": "my-registry.local", ... }`
+    if let Some(host) = url.host_str() {
+        if let Ok(npm_mirrors) = env::var("NIX_NPM_REGISTRY_OVERRIDES") {
+            if let Ok(mirrors) = serde_json::from_str::<Map<String, Value>>(&npm_mirrors) {
+                if let Some(mirror) = mirrors.get(host).and_then(serde_json::Value::as_str) {
+                    let mirror_url = Url::parse(mirror)?;
+                    url.set_path(&(mirror_url.path().to_owned() + url.path()));
+                    url.set_host(Some(mirror_url.host_str().expect(format!("Mirror URL without host part: {mirror_url}").as_str())))?;
+                    eprintln!("Replaced URL {url_} with {url}");
+                }
+            }
+        }
+    }
     let mut request = Request::get(url.as_str()).redirect_policy(RedirectPolicy::Limit(10));
 
     // Respect SSL_CERT_FILE if environment variable exists

pkgs/build-support/ocaml/oasis.nix

@@ -20,48 +20,47 @@
   ...
 }@args:
 
-if args ? minimumOCamlVersion && lib.versionOlder ocaml.version args.minimumOCamlVersion then
-  throw "${pname}-${version} is not available for OCaml ${ocaml.version}"
-else
+stdenv.mkDerivation (
+  args
+  // {
+    name = "ocaml${ocaml.version}-${pname}-${version}";
 
-  stdenv.mkDerivation (
-    args
-    // {
-      name = "ocaml${ocaml.version}-${pname}-${version}";
+    nativeBuildInputs = [
+      ocaml
+      findlib
+      ocamlbuild
+      ocaml_oasis
+    ]
+    ++ nativeBuildInputs;
 
-      nativeBuildInputs = [
-        ocaml
-        findlib
-        ocamlbuild
-        ocaml_oasis
-      ]
-      ++ nativeBuildInputs;
+    inherit createFindlibDestdir;
+    inherit dontStrip;
 
-      inherit createFindlibDestdir;
-      inherit dontStrip;
+    strictDeps = true;
 
-      strictDeps = true;
+    buildPhase = ''
+      runHook preBuild
+      oasis setup
+      ocaml setup.ml -configure --prefix $OCAMLFIND_DESTDIR --exec-prefix $out
+      ocaml setup.ml -build
+      runHook postBuild
+    '';
 
-      buildPhase = ''
-        runHook preBuild
-        oasis setup
-        ocaml setup.ml -configure --prefix $OCAMLFIND_DESTDIR --exec-prefix $out
-        ocaml setup.ml -build
-        runHook postBuild
-      '';
+    checkPhase = ''
+      runHook preCheck
+      ocaml setup.ml -test
+      runHook postCheck
+    '';
 
-      checkPhase = ''
-        runHook preCheck
-        ocaml setup.ml -test
-        runHook postCheck
-      '';
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      ocaml setup.ml -install
+      runHook postInstall
+    '';
 
-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out
-        ocaml setup.ml -install
-        runHook postInstall
-      '';
-
-    }
-  )
+    meta = args.meta // {
+      broken = args ? minimumOCamlVersion && lib.versionOlder ocaml.version args.minimumOCamlVersion;
+    };
+  }
+)

pkgs/build-support/setup-hooks/copy-desktop-items.sh

@@ -28,8 +28,10 @@ copyDesktopItems() {
         return
     fi
 
+    concatTo desktopItemsArray desktopItems
+
     applications="${!outputBin}/share/applications"
-    for desktopItem in $desktopItems; do
+    for desktopItem in "${desktopItemsArray[@]}"; do
         if [[ -f "$desktopItem" ]]; then
             echo "Copying '$desktopItem' into '${applications}'"
             install -D -m 444 -t "${applications}" "$desktopItem"

pkgs/by-name/_1/_1fps/package.nix

@@ -4,7 +4,6 @@
   buildGoModule,
   xorg,
   stdenv,
-  apple-sdk_14,
 }:
 buildGoModule rec {
   pname = "1fps";
@@ -25,8 +24,7 @@ buildGoModule rec {
     xorg.libX11
     xorg.libXtst
     xorg.libXi
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin apple-sdk_14;
+  ];
 
   meta = {
     description = "Encrypted Screen Sharing";

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -150,9 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Linking fails without this
   hardeningDisable = [ "format" ];
 
-  # Pie needs to be enabled or else it segfaults
-  hardeningEnable = [ "pie" ];
-
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb

pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json

@@ -1,538 +1,4 @@
 {
-  "11.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-92v9tuNLqvalwYV4AqQllA8yN9fqGjSpc4MNAmFPrbk=",
-      "version": "60178.100.1"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-dSSbt9ZoL/Tq2xXwvvXsDmD3Xru7igzdK1MxGL1K+Aw=",
-      "version": "300.6.1"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "20.100.1"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-w0YhZ38RBfnxSc74Q8r5UdK+WiWOSAX46r5hahHLnSg=",
-      "version": "59"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-7H3WcZC/HuS9xsTNDWRqt+1JzUNK4ndvd4u2ru0GGRE=",
-      "version": "428"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-2xppN8RJ9cxrHWjPQ4bUIjtupPbzfmrm3rXnT/9QVfc=",
-      "version": "483"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-kfhmZy8veqI3/XHDtOTKmKj6P7s+j0B+BiAbcjhGq0M=",
-      "version": "442"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-WDq2Ak72Jw6gYNIKgZkiexA6LzccrPn1kpSbW5U50ek=",
-      "version": "257.40.1"
-    },
-    "IOGraphics": {
-      "hash": "sha256-kEP4RWIZwu3ZPIq9IAPUKM0gIXHr8xD50SnGNFCQRcI=",
-      "version": "585.1"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-QASfvttke+AUx55In4DD4vsQGzC3nbe+MugQQ4ddXGU=",
-      "version": "1633.100.36"
-    },
-    "IOKitUser": {
-      "hash": "sha256-NQCRrufElx00B7CqqslBi5BTxf5Zs4lcMcJig4Eab0k=",
-      "version": "1845.100.19"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-HqTKzrX75mMFYYbxNKwPdXmI7h7t/QWuO3W1Qo//zIo=",
-      "version": "151.40.1"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-dy6CYz/z6SwPw0YfC6GLZO2u62Xy8otMDUNrZ5JhTDY=",
-      "version": "260.100.1"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-v01g/EtMW/STZQ1neKDMyUGL7sgaCzlwXN0VDaj/Mf0=",
-      "version": "1439.100.3"
-    },
-    "Libinfo": {
-      "hash": "sha256-T7KO6zfswjyTIKSdZJCbvfsdqQfPMLj5nheX9iSIl9o=",
-      "version": "542.40.3"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-vcDjdwB5OiTEUdl8ISezzpoHeFttkdvkulY/YbUOZjk=",
-      "version": "279.40.4"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
-      "version": "26"
-    },
-    "Libsystem": {
-      "hash": "sha256-24T9aD4W71prcpr3MnnaU3pfxIzIwkOz39OyhCwPO/E=",
-      "version": "1292.100.5"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-o5MyyqDpERvNPvbEfXNgqMIq0YpQV0+ju72C9g/9OdI=",
-      "version": "59754.100.106"
-    },
-    "architecture": {
-      "hash": "sha256-pIX9pEXE1Xjll9qwiWrMRwqw6G4g0isto/ALHsmkUSc=",
-      "version": "279"
-    },
-    "configd": {
-      "hash": "sha256-WEorIW5Vl8E9/aB0RBTY2bhkfVOF3tckjNztGDOOueA=",
-      "version": "1109.101.1"
-    },
-    "copyfile": {
-      "hash": "sha256-3BHFM67dvwUpinzF0pSX3QiUbIsqtLo77WzB3tMbTW4=",
-      "version": "173.40.2"
-    },
-    "dtrace": {
-      "hash": "sha256-FfyaYjEMDeL9wGdUyZ4eJdkbkp/WpdTGyBvaorwKSi8=",
-      "version": "370.40.1"
-    },
-    "dyld": {
-      "hash": "sha256-dtDTh6YqubBI4Z+QeytwGgUmU6tutvonIWHqzw6zuxo=",
-      "version": "851.27"
-    },
-    "eap8021x": {
-      "hash": "sha256-Ap7qumn/oKYe424n2NW6QkuivgDyLoJgDfl30Q5O7Jo=",
-      "version": "304.100.1"
-    },
-    "hfs": {
-      "hash": "sha256-MSnc1pB8DcB+mn308snTD1uRQ7Ro4aWyFuLdWjHtAG4=",
-      "version": "556.100.11"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-UgmMnDUosaC2yI7IyQ7mkNwZ6/oft77ay+SmGSoycIw=",
-      "version": "79"
-    },
-    "libdispatch": {
-      "hash": "sha256-K8QL9NfjGsj8c0jbocKegmKBqydimpKu8yRXnQQqdH8=",
-      "version": "1271.100.5"
-    },
-    "libmalloc": {
-      "hash": "sha256-k3dJk7S0Lom3B28vRI9QxIuo0AOkd9OHzWO7MandfUw=",
-      "version": "317.100.9"
-    },
-    "libplatform": {
-      "hash": "sha256-BSIGgKj5B6Dr0KQiIl2LSA3+ZEhzk/snQeCauErcq6k=",
-      "version": "254.80.2"
-    },
-    "libpthread": {
-      "hash": "sha256-cGaDXLTztUYppbMvv41qj5RqONXfhfdHpt9dqY6+5Lc=",
-      "version": "454.100.8"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-eqcv174vIwWYXrIhzph+KO1zG8TdK5jRFVgsaAlV9es=",
-      "version": "1310.100.10"
-    },
-    "objc4": {
-      "hash": "sha256-rqOPyN9S4KbMhCCVvtyEmGxTWzy+tsh0kfu3k47szXo=",
-      "version": "818.2"
-    },
-    "ppp": {
-      "hash": "sha256-pSOlu/yXQhopCHDLnmhUnQeU89MkXhkQB0ZrN9r3qyk=",
-      "version": "877.40.2"
-    },
-    "removefile": {
-      "hash": "sha256-B79A9AQ1/cB+zlmVKWcEXVOJHW6rOrX40S/hrMuWqXU=",
-      "version": "49.101.1"
-    },
-    "xnu": {
-      "hash": "sha256-M1XWippH55VUJu4aosRFX8j9aOm/PONYVjPZOPufD80=",
-      "version": "7195.101.1"
-    }
-  },
-  "12.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-HTGBUE6vHjS80CFTiIQ8F17m8Yd2ZRHccvFu2CA2P9U=",
-      "version": "60191.100.1"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-CuBFZeX2JTKIab2xpp+Yvn66bCl4+aKOv9TvzJef20c=",
-      "version": "340.2"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "22"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
-      "version": "61"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-ruAomp5Lv7zuPu9vHsNKoPtDvD1AIrRARsPMpcx/fh0=",
-      "version": "430"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
-      "version": "487"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
-      "version": "445"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
-      "version": "260"
-    },
-    "IOGraphics": {
-      "hash": "sha256-lzxBrPLlF01+2jFKRJtSnwpf0r05C0H3tM7Q0N1RUPA=",
-      "version": "594"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-EQQHAS8WKUoTxZscixylc2ZMoD4UYBlHRUj2O7Ikgac=",
-      "version": "1787.100.13"
-    },
-    "IOKitUser": {
-      "hash": "sha256-Cdfa/YXM0W4O15femcU0G1Xcpbm+iADWIBWIdzoeuTE=",
-      "version": "1955.100.5"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-odUZJQq8lb3UYk7F8dBi1Hds00M+kwdlyGwZkVkSwTg=",
-      "version": "160.100.2"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-2b32qe1z7Z+Od1dVlAGdM142DdF8cBaRC+ElysSuAQ4=",
-      "version": "290.100.6"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-obalDxsbE+7gm7YwznUbfxL7MCriamQFP3DrXleNwU4=",
-      "version": "1507.100.9"
-    },
-    "Libinfo": {
-      "hash": "sha256-OjnnSHEcifcWarVyXiHvYg/9jbCQy5/lzaq6fJRriy0=",
-      "version": "554"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-JXG0kHEdoIs6krVZ4+KsRVES4AuNjnQi8qF+XKSp5jE=",
-      "version": "301"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
-      "version": "26"
-    },
-    "Libsystem": {
-      "hash": "sha256-mPPAxo67wWLtemO+PuKg1Ui0zKEfjnYVj/qX1/0kNBs=",
-      "version": "1311.100.3"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-cIqfXcfQOZonxaKndH80xC5YmmveHw+TxHOxqvc9u8I=",
-      "version": "60158.100.133"
-    },
-    "architecture": {
-      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
-      "version": "280.100.2"
-    },
-    "configd": {
-      "hash": "sha256-X34mjXdil4HeBLyqY4tyBWdmpjsOFTJDdDE81UQf708=",
-      "version": "1163.100.19.0.2"
-    },
-    "copyfile": {
-      "hash": "sha256-3/zI3j/m9b13hebjCsOLry3Mf8ADdWJgrtQOdD0huG0=",
-      "version": "180.100.3"
-    },
-    "dtrace": {
-      "hash": "sha256-q8H6slCN4RwJ5TxC5s3og6cIbjALySP5ODfVw6a/a+M=",
-      "version": "375"
-    },
-    "dyld": {
-      "hash": "sha256-v1kk/Z3eI2sufNm2rx3FRbA/f9BeKJ3t9i9W7tTksXg=",
-      "version": "955"
-    },
-    "eap8021x": {
-      "hash": "sha256-SayP1d2KWoRShykBA/NrQCuRnPoxlTiaLwifoqm0Gkg=",
-      "version": "315.100.2"
-    },
-    "hfs": {
-      "hash": "sha256-q1yOIei98oudGAoBMNPRTV5EOYpXFL7iYmlCYsKsG0o=",
-      "version": "583.100.10"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-Ez75a0m+fJas7mGqFeDjjpc7sFDnyirRbtLMTYQDVxw=",
-      "version": "79.1"
-    },
-    "libdispatch": {
-      "hash": "sha256-/VbSUtnWyToWOUyAAg/3wImbJ2w5k1tbJkt827x2lIE=",
-      "version": "1325.100.36"
-    },
-    "libmalloc": {
-      "hash": "sha256-tyYce5nk0N923MbzoGzkGqunoKwArbTiZl8PCppYpso=",
-      "version": "374.100.5"
-    },
-    "libplatform": {
-      "hash": "sha256-JUD2NdS310OhZ0F8gnOvoD8AgEtWRtPahKDw5iE2QJU=",
-      "version": "273.100.5"
-    },
-    "libpthread": {
-      "hash": "sha256-al8QumtH7/D04oJ4LUSYW+6OdX0Ko3S3rwYU53n9/54=",
-      "version": "486.100.11"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-hsV0VYTPoO5YpaxrUXpXFy97LxlERzrQT0FRfCMOwic=",
-      "version": "1557.101.2"
-    },
-    "objc4": {
-      "hash": "sha256-MKXnfZL46VtmAQMolqd7ATF9fYjCNstapGQfcH4uVwo=",
-      "version": "841.13"
-    },
-    "ppp": {
-      "hash": "sha256-YyCE19T3rcM1G5jdXuYXuBXblJgR/nelvjpq+9maMhw=",
-      "version": "884"
-    },
-    "removefile": {
-      "hash": "sha256-xF1VtTUhoiGsFQsvuFnFYemwiCdsKeriFJv51vRLqmw=",
-      "version": "60"
-    },
-    "xnu": {
-      "hash": "sha256-bfFmDfRBSvoWMdQYVstsJRbcq+15lDjVFqk+0XYWpy8=",
-      "version": "8020.101.4"
-    }
-  },
-  "13.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-tftAQbs5xIOc5VZLVAKXAUvle9WO/i33/pQ3D64l/yI=",
-      "version": "600016.100.4"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-CuBFZeX2JTKIab2xpp+Yvn66bCl4+aKOv9TvzJef20c=",
-      "version": "440.2"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "22"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
-      "version": "61"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-IUytBKhhCgg0vtI+7q8d5kxpOUgO3tQD7TMy++jrorc=",
-      "version": "431"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
-      "version": "487"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
-      "version": "445"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
-      "version": "260"
-    },
-    "IOGraphics": {
-      "hash": "sha256-KubCz8DNwf1WuF7LrtARM2VJugFDP0wfHoUhnIz/faQ=",
-      "version": "596.1"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-7UFMBdF5k9aVFVuoL2riozzKmn8uOt87Aitt8j6XkN8=",
-      "version": "1915.100.21"
-    },
-    "IOKitUser": {
-      "hash": "sha256-hgFRHPAuoqSf6aRUBUyfU2y2+dBUA34DKwLHLwhPNms=",
-      "version": "2022.100.19"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-SwZvXLSB9cMHssZU4dCogGVoV64qYdGN1CGYV3FZ6tk=",
-      "version": "170"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-g4oCrxM5VtHm8h1M+zM81Ar1LsaaiJZLej5fT8EHPG4=",
-      "version": "302.100.1"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-dqbdWtBuaRq3IHnSUPH2aj8h/X4zCwUNSOeSdwfKvN8=",
-      "version": "1534.100.14"
-    },
-    "Libinfo": {
-      "hash": "sha256-iUyndeUXx7FFZ/jgJ6jRwda3IChOaMs4dZW/ISuAJ1E=",
-      "version": "564.101.1"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-7AwTfogvCUMdoabxf413ENWXtFTOM6AUldccoPQ89sU=",
-      "version": "312"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
-      "version": "31"
-    },
-    "Libsystem": {
-      "hash": "sha256-IIksf0yCg3GdME3HofYzD1MRC+ofsPhHcxddmNd7V2M=",
-      "version": "1319.100.3"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-lPq58QIx+H9DouTXAUJSMf1X7dj9V6xu3c8VWr2R1IY=",
-      "version": "60420.101.4"
-    },
-    "architecture": {
-      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
-      "version": "282"
-    },
-    "configd": {
-      "hash": "sha256-M/fRAnUw2wObhCQp9a6zQbCGhACCQHpju4/1+KGlkjg=",
-      "version": "1241.100.11"
-    },
-    "copyfile": {
-      "hash": "sha256-te3WcQudrXPqnTM1s/AtsTdu7VIXf5dIASy+IGnIxv0=",
-      "version": "191.100.3"
-    },
-    "dtrace": {
-      "hash": "sha256-7jAG66hG9qmqpRbECazMD1Pyi53CWTOGNnZca1NpcxE=",
-      "version": "397"
-    },
-    "dyld": {
-      "hash": "sha256-OkDOTV86EB44LxsqwTD4ZncMcr7iqSHXxw+6U+AP7oU=",
-      "version": "1066.8"
-    },
-    "eap8021x": {
-      "hash": "sha256-FMG+IGVPpcwrRe2/OKpFycrY/EFPZkge2vX61NgorGg=",
-      "version": "336.100.6"
-    },
-    "hfs": {
-      "hash": "sha256-Au5VDrYRBerI1I6rjC0lVDwB5IBwGARrAdcTI4M+Fx0=",
-      "version": "627.100.6"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-V1tpp/XG6baETunJt029rI6wp6moYSnFprt+bNGaQ40=",
-      "version": "87"
-    },
-    "libdispatch": {
-      "hash": "sha256-d1VObN11bNdtNJlZQqp2y8yP4lit5Wbj+4/aN3StsPc=",
-      "version": "1415.100.11"
-    },
-    "libmalloc": {
-      "hash": "sha256-jcR1AO/chcZzfAvELkC+U3q9tzxqPdwgLcHrnkQmN4M=",
-      "version": "425.100.7"
-    },
-    "libplatform": {
-      "hash": "sha256-+BB23YGGT0hA326Dh+3k2UvAqBdEJ84A6yGA/ccrihg=",
-      "version": "292.100.1"
-    },
-    "libpthread": {
-      "hash": "sha256-/l17vMWhfAs0YhIHi+l84vGVxpGFOzocvxxii7B+WUk=",
-      "version": "514.100.2"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-M4yfQsdlKwes5M2QOEEfjv7ldSVZw7oGXLISaDcObjs=",
-      "version": "1807.101.2"
-    },
-    "objc4": {
-      "hash": "sha256-qOV9YfP59WP8Izp+IvM/aiYTW8fCoq21uxU64OcIHk8=",
-      "version": "876"
-    },
-    "ppp": {
-      "hash": "sha256-Sg5c5qOSk5TaS4pgXZ+eAy/iuGBa1oFML0dkj463DcE=",
-      "version": "1010"
-    },
-    "removefile": {
-      "hash": "sha256-oQorWHlJ0ctekCTUsLXHko8k1aCKBJ00A2FHkRd4B3E=",
-      "version": "68"
-    },
-    "xnu": {
-      "hash": "sha256-w9/lDZ/E54YzYQkOWptNpX5GomgI/fvZLAy7NY3O+IQ=",
-      "version": "8796.101.5"
-    }
-  },
   "14.4": {
     "CarbonHeaders": {
       "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",

pkgs/by-name/ap/apple-sdk/metadata/versions.json

@@ -1,28 +1,4 @@
 {
-  "11": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235110/https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "11.3",
-    "hash": "sha256-/go8utcx3jprf6c8V/DUbXwsmNYSFchOAai1OaJs3Bg="
-  },
-  "12": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235341/https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "12.3",
-    "hash": "sha256-qG21ssNUmkqxPLTXALGP2N/RBHu8NMlI1dWvGlV+Wm8="
-  },
-  "13": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/15/62/032-84673-A_7A1TG1RF8Z/xpc8q44ggn2pkn82iwr0fi1zeb9cxi8ath/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235949/https://swcdn.apple.com/content/downloads/15/62/032-84673-A_7A1TG1RF8Z/xpc8q44ggn2pkn82iwr0fi1zeb9cxi8ath/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "13.3",
-    "hash": "sha256-zZ4pbgoXunLGwdYDemxOfyH4CE5WGfMy2s5jN+0q4B4="
-  },
   "14": {
     "urls": [
       "https://swcdn.apple.com/content/downloads/14/48/052-59890-A_I0F5YGAY0Y/p9n40hio7892gou31o1v031ng6fnm9sb3c/CLTools_macOSNMOS_SDK.pkg",

pkgs/by-name/ar/ares/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   alsa-lib,
-  apple-sdk_14,
+  apple-sdk,
   cmake,
   fetchFromGitHub,
   gtk3,
@@ -55,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_14
     moltenvk
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
@@ -73,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (replaceVars ./darwin-build-fixes.patch {
-      sdkVersion = apple-sdk_14.version;
+      sdkVersion = apple-sdk.version;
     })
   ];
 

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.8.0";
+  version = "18.10.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FJEXIxdeg6ExXvrQ3dtugMK5xw+NwWyB+ld9rj7okoU=";
+    hash = "sha256-bfSa3RtVXxHt3usDqqpE/oXKKDUZOrf+tD9uL59fr6M=";
   };
 
-  cargoHash = "sha256-xJPSMu22Bq9Panrafsd5vUSnEQYuJB19OEZaAq8z0mw=";
+  cargoHash = "sha256-67ffivZVCly1GWA3fJ9mT8nGv2EGd6eCthbaIu/IW3M=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
@@ -41,13 +41,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --zsh <($out/bin/atuin gen-completions -s zsh)
   '';
 
-  passthru = {
-    tests = {
-      inherit (nixosTests) atuin;
-    };
-    updateScript = nix-update-script { };
-  };
-
   checkFlags = [
     # tries to make a network access
     "--skip=registration"
@@ -56,11 +49,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # PermissionDenied (Operation not permitted)
     "--skip=change_password"
     "--skip=multi_user_test"
-    "--skip=store::var::tests::build_vars"
-    # Tries to touch files
-    "--skip=build_aliases"
   ];
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) atuin;
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";
     homepage = "https://github.com/atuinsh/atuin";

pkgs/by-name/au/audit/package.nix

@@ -117,8 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pythonImportsCheck = [ "audit" ];
 
-  enableParallelChecking = false;
-  doCheck = true;
+  doCheck = false;
 
   postInstall = ''
     installShellCompletion --bash init.d/audit.bash_completion
@@ -156,6 +155,11 @@ stdenv.mkDerivation (finalAttrs: {
       static = pkgsStatic.audit or null;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       audit = nixosTests.audit;
+      # Broken on a hardened kernel
+      package = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
+        pname = previousAttrs.pname + "-test";
+        doCheck = true;
+      });
     };
   };
 

pkgs/by-name/az/azahar/package.nix

@@ -42,8 +42,6 @@
   gamemode,
   enableGamemode ? lib.meta.availableOn stdenv.hostPlatform gamemode,
   nix-update-script,
-  darwinMinVersionHook,
-  apple-sdk_12,
   fetchpatch2,
 }:
 let
@@ -129,10 +127,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [
     moltenvk
-
-    # error: 'lowPowerModeEnabled' is unavailable: not available on macOS
-    apple-sdk_12
-    (darwinMinVersionHook "12.0")
   ];
 
   postPatch = ''

pkgs/by-name/ba/bakelite/package.nix

@@ -16,7 +16,6 @@ stdenv.mkDerivation {
     hash = "sha256-rRJrtCcgfbqC/4qQiTVeUUcPqoJlNfitYRqIO58AmpA=";
   };
 
-  hardeningEnable = [ "pie" ];
   preBuild = ''
     # pipe2() is only exposed with _GNU_SOURCE
     # Upstream makefile explicitly uses -O3 to improve SHA-3 performance

pkgs/by-name/ba/balena-cli/package.nix

@@ -9,7 +9,6 @@
   python3,
   udev,
   cctools,
-  apple-sdk_12,
 }:
 
 let
@@ -44,13 +43,9 @@ buildNpmPackage' rec {
     cctools
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      udev
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple-sdk_12
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    udev
+  ];
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/balena";

pkgs/by-name/ba/bash-completion/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bash-completion";
-  version = "2.16.0";
+  version = "2.17.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/bash-completion/releases/download/${version}/bash-completion-${version}.tar.xz";
-    hash = "sha256-M2m9XkGKdfuZCGOSWu1bQgOYrOuzIOxMAwaz6uI/EHo=";
+    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
   };
 
   postPatch = ''

pkgs/by-name/be/bespokesynth/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   gitUpdater,
-  apple-sdk_11,
   cmake,
   pkg-config,
   ninja,
@@ -120,9 +119,6 @@ stdenv.mkDerivation (finalAttrs: {
     xcb-util-cursor
     pcre
     mount
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_11
   ];
 
   postInstall =

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  apple-sdk_14,
   buildNpmPackage,
   cargo,
   copyDesktopItems,
@@ -124,10 +123,6 @@ buildNpmPackage' rec {
     darwin.autoSignDarwinBinariesHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_14
-  ];
-
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'

pkgs/by-name/bm/bmake/package.nix

@@ -3,7 +3,6 @@
   bc,
   fetchurl,
   getopt,
-  ksh,
   pkgsMusl ? { },
   stdenv,
   tzdata,
@@ -39,9 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeCheckInputs = [
     bc
     tzdata
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.libc != "musl") [
-    ksh
   ];
 
   # The generated makefile is a small wrapper for calling ./boot-strap with a

pkgs/by-name/ca/catch2_3/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-eeqqzHMeXLRiXzbY+ay8gJ/YDuxDj3f6+d6eXA1uZHE=";
+    hash = "sha256-7Dx7PhtRwkbo8vHF57sAns2fQZ442D3cMyCt25RvzJc=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

pkgs/by-name/cc/cctools/meson.build

@@ -12,7 +12,7 @@ project(
             '-DCCTB_PROJECT=cctools',
             '-DCCTB_PROJVERS=cctools-@version@',
             '-DCCTB_VERSION=@version@',
-            '-DCURRENT_PROJECT_VERSION="@version@"',
+            '-DCURRENT_PROJECT_VERSION="cctools-@version@"',
             '-DCODEDIRECTORY_SUPPORT',
             '-DLTO_SUPPORT',
         ],

pkgs/by-name/ch/choose-gui/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   xcbuild,
-  apple-sdk_11,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,8 +18,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xcbuild ];
 
-  buildInputs = [ apple-sdk_11 ];
-
   buildPhase = ''
     runHook preBuild
     xcodebuild -configuration Release SYMROOT="./output" HOME="$(mktemp -d)" build

pkgs/by-name/ch/chromaprint/package.nix

@@ -75,12 +75,12 @@ stdenv.mkDerivation (finalAttrs: {
       };
 
       # sha256 because actual output of fpcalc is quite long
-      expectedHash = "c47ae40e02caf798ff5ab4d91ff00cfdca8f6786c581662436941d3e000c9aac";
+      expectedHash = "e2895130bcbe7190184379021daa60c5f5d476da4a2fecb06df7160819662e20";
     in
     ''
       runHook preCheck
       tests/all_tests
-      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
+      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc -plain ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
       runHook postCheck
     '';
 

pkgs/by-name/ch/chrony/package.nix

@@ -62,8 +62,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = true;
 
-  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
-
   passthru.tests = {
     inherit (nixosTests) chrony chrony-ptp;
   };

pkgs/by-name/cm/cmake/setup-hook.sh

@@ -39,13 +39,6 @@ cmakeConfigurePhase() {
     prependToVar cmakeFlags "-DCMAKE_RANLIB=$(command -v $RANLIB)"
     prependToVar cmakeFlags "-DCMAKE_STRIP=$(command -v $STRIP)"
 
-    # on macOS we want to prefer Unix-style headers to Frameworks
-    # because we usually do not package the framework
-    prependToVar cmakeFlags "-DCMAKE_FIND_FRAMEWORK=LAST"
-
-    # correctly detect our clang compiler
-    prependToVar cmakeFlags "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
-
     # This installs shared libraries with a fully-specified install
     # name. By default, cmake installs shared libraries with just the
     # basename as the install name, which means that, on Darwin, they

pkgs/by-name/da/dash/package.nix

@@ -7,15 +7,19 @@
   libedit,
   runCommand,
   dash,
+
+  # Reverse dependency smoke tests
+  tests,
+  patchRcPathPosix,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.12";
+  version = "0.5.13.1";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-akdKxG6LCzKRbExg32lMggWNMpfYs4W3RQgDDKSo8oo=";
+    hash = "sha256-2ScbzgnBJ9mGbiXAEVgt3HWrmIlYoEvE2FU6O48w43A=";
   };
 
   strictDeps = true;
@@ -43,6 +47,19 @@ stdenv.mkDerivation (finalAttrs: {
         [ -s $out/success ]
         grep -q "Hello World" $out/success
       '';
+
+      /**
+        Reverse dependency smoke tests. Build success of `dash.tests` informs
+        whether an update makes it into staging.
+      */
+      reverseDependencies = lib.recurseIntoAttrs {
+        writers = lib.recurseIntoAttrs {
+          simple = tests.writers.simple.dash;
+          bin = tests.writers.bin.dash;
+        };
+        # Not sure if effective smoke test, but cheap
+        patch-rc-path-posix = patchRcPathPosix.tests.test-posix;
+      };
     };
   };
 

pkgs/by-name/dn/dnsmasq/package.nix

@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "PKG_CONFIG=${buildPackages.pkg-config}/bin/${buildPackages.pkg-config.targetPrefix}pkg-config"
   ];
 
-  hardeningEnable = [ "pie" ];
+  enableParallelBuilding = true;
 
   postBuild = lib.optionalString stdenv.hostPlatform.isLinux ''
     make -C contrib/lease-tools

pkgs/by-name/do/double-conversion/package.nix

@@ -4,17 +4,19 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
-  enableStatic ? stdenv.hostPlatform.isStatic,
+  ninja,
+  ctestCheckHook,
+  testers,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "double-conversion";
   version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "double-conversion";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
   };
 
@@ -30,22 +32,46 @@ stdenv.mkDerivation rec {
       url = "https://github.com/google/double-conversion/commit/0604b4c18815aadcf7f4b78dfa6bfcb91a634ed7.patch";
       hash = "sha256-cJBp1ou1O/bMQ/7kvcX52dWbUdhmPfQ9aWmEhQdyhis=";
     })
+    (fetchpatch {
+      name = "double-conversion-add-pkg-config.patch";
+      url = "https://github.com/google/double-conversion/commit/ddfd18c58ecc32fc74afc1083bb8774240b54efb.patch";
+      hash = "sha256-/pKCL19vS8fNwCm27yTNP+32ApHTH5dEGpnsMI11Lf4=";
+    })
   ];
 
-  nativeBuildInputs = [ cmake ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-  cmakeFlags = lib.optional (!enableStatic) "-DBUILD_SHARED_LIBS=ON";
+  nativeBuildInputs = [
+    cmake
+    ninja
+    ctestCheckHook
+  ];
+
+  doCheck = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" stdenv.hostPlatform.hasSharedLibraries)
+  ];
 
   # Case sensitivity issue
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     rm BUILD
   '';
 
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
+    pkgConfigModules = [ "double-conversion" ];
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
     homepage = "https://github.com/google/double-conversion";
     license = licenses.bsd3;
     platforms = platforms.unix ++ platforms.windows;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ fzakaria ];
   };
-}
+})

pkgs/by-name/dr/drawterm/package.nix

@@ -5,7 +5,6 @@
   unstableGitUpdater,
   installShellFiles,
   makeWrapper,
-  apple-sdk_13,
   xorg,
   pkg-config,
   wayland-scanner,
@@ -54,8 +53,7 @@ stdenv.mkDerivation {
     ++ lib.optionals withXorg [
       xorg.libX11
       xorg.libXt
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin apple-sdk_13;
+    ];
 
   makeFlags =
     lib.optional withWayland "CONF=linux"

pkgs/by-name/ec/echidna/package.nix

@@ -96,7 +96,7 @@ haskellPackages.mkDerivation rec {
     makeWrapper
   ];
 
-  preConfigure = ''
+  prePatch = ''
     hpack
   '';
 

pkgs/by-name/ed/edencommon/package.nix

@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "edencommon";
-  version = "2025.09.15.00";
+  version = "2025.10.13.00";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookexperimental";
     repo = "edencommon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KyJAosCLGnpEG968GV9BOyOrsoHS7BbRatTfBqzTelU=";
+    hash = "sha256-yR0J1tfzdAFopApKsiv9yUXlU0W0Q6n6ZlmKlcVbi0E=";
   };
 
   patches = [

pkgs/by-name/ei/eigen/include-dir.patch

@@ -1,57 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,5 +1,5 @@
- # cmake_minimum_require must be the first command of the file
--cmake_minimum_required(VERSION 3.5.0)
-+cmake_minimum_required(VERSION 3.7.0)
- 
- project(Eigen3)
- 
-@@ -443,7 +443,7 @@ set(PKGCONFIG_INSTALL_DIR
-     CACHE PATH "The directory relative to CMAKE_INSTALL_PREFIX where eigen3.pc is installed"
-     )
- 
--foreach(var INCLUDE_INSTALL_DIR CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
-+foreach(var CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
-   # If an absolute path is specified, make it relative to "{CMAKE_INSTALL_PREFIX}".
-   if(IS_ABSOLUTE "${${var}}")
-     file(RELATIVE_PATH "${var}" "${CMAKE_INSTALL_PREFIX}" "${${var}}")
-@@ -466,13 +466,6 @@ install(FILES
-   DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel
-   )
- 
--if(EIGEN_BUILD_PKGCONFIG)
--    configure_file(eigen3.pc.in eigen3.pc @ONLY)
--    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
--        DESTINATION ${PKGCONFIG_INSTALL_DIR}
--        )
--endif()
--
- install(DIRECTORY Eigen DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel)
- 
- 
-@@ -593,8 +586,15 @@ set ( EIGEN_VERSION_MAJOR  ${EIGEN_WORLD_VERSION} )
- set ( EIGEN_VERSION_MINOR  ${EIGEN_MAJOR_VERSION} )
- set ( EIGEN_VERSION_PATCH  ${EIGEN_MINOR_VERSION} )
- set ( EIGEN_DEFINITIONS "")
--set ( EIGEN_INCLUDE_DIR "${CMAKE_INSTALL_PREFIX}/${INCLUDE_INSTALL_DIR}" )
- set ( EIGEN_ROOT_DIR ${CMAKE_INSTALL_PREFIX} )
-+GNUInstallDirs_get_absolute_install_dir(EIGEN_INCLUDE_DIR INCLUDE_INSTALL_DIR)
-+
-+if(EIGEN_BUILD_PKGCONFIG)
-+    configure_file(eigen3.pc.in eigen3.pc @ONLY)
-+    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
-+        DESTINATION ${PKGCONFIG_INSTALL_DIR}
-+        )
-+endif()
- 
- include (CMakePackageConfigHelpers)
- 
---- a/eigen3.pc.in
-+++ b/eigen3.pc.in
-@@ -6,4 +6,4 @@ Description: A C++ template library for linear algebra: vectors, matrices, and r
- Requires:
- Version: @EIGEN_VERSION_NUMBER@
- Libs:
--Cflags: -I${prefix}/@INCLUDE_INSTALL_DIR@
-+Cflags: -I@EIGEN_INCLUDE_DIR@

pkgs/by-name/ei/eigen/package.nix

@@ -1,43 +1,60 @@
 {
   lib,
+
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
+
+  # nativeCheckInputs
+  ctestCheckHook,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "eigen";
-  version = "3.4.0-unstable-2022-05-19";
+  version = "3.4.1";
 
   src = fetchFromGitLab {
     owner = "libeigen";
     repo = "eigen";
-    rev = "e7248b26a1ed53fa030c5c459f7ea095dfd276ac";
-    hash = "sha256-uQ1YYV3ojbMVfHdqjXRyUymRPjJZV3WHT36PTxPRius=";
+    tag = finalAttrs.version;
+    hash = "sha256-NSq1tUfy2thz5gtsyASsKeYE4vMf71aSG4uXfrX86rk=";
   };
 
   patches = [
-    ./include-dir.patch
+    # fix bug1213 test
+    # ref https://gitlab.com/libeigen/eigen/-/merge_requests/2005 merged upstream
+    (fetchpatch {
+      url = "https://gitlab.com/libeigen/eigen/-/commit/3e1367a3b5efcdc8ce716db77a322cedeb5e01b4.patch";
+      hash = "sha256-oykUbzaZeVW1A8nBoiMtJvh68Zpu7PDFtAfAjtTQoC0=";
+    })
   ];
 
-  # ref. https://gitlab.com/libeigen/eigen/-/merge_requests/977
-  # This was merged upstream and can be removed on next release
-  postPatch = ''
-    substituteInPlace Eigen/src/SVD/BDCSVD.h --replace-fail \
-      "if (l == 0) {" \
-      "if (i >= k && l == 0) {"
-  '';
+  nativeBuildInputs = [
+    cmake
+  ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
 
-  meta = with lib; {
+  cmakeFlags = [
+    (lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel
+  ];
+
+  # too many flaky tests
+  doCheck = false;
+
+  meta = {
     homepage = "https://eigen.tuxfamily.org";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
-    license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [
       sander
       raskin
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ei/eigenrand/package.nix

@@ -2,6 +2,7 @@
   cmake,
   eigen,
   fetchFromGitHub,
+  fetchpatch,
   gtest,
   lib,
   stdenv,
@@ -18,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mrpkWIb6kfLvppmIfzhjF1/3m1zSd8XG1D07V6Zjlu0=";
   };
 
+  patches = [
+    # ref. https://github.com/bab2min/EigenRand/pull/61 merged upstream
+    (fetchpatch {
+      name = "support-eigen-341.patch";
+      url = "https://github.com/bab2min/EigenRand/commit/8114df93b4c8a84a4f853380f0875a2c9d683cd0.patch";
+      hash = "sha256-2KivLlyYGSRZurtxLghNfWwUNEUNWZdC6q+H65EPLnQ=";
+    })
+  ];
+
   # Avoid downloading googletest: we already have it.
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace-fail \

pkgs/by-name/el/elfutils/package.nix

@@ -28,11 +28,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   pname = "elfutils";
-  version = "0.193";
+  version = "0.194";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-eFf0S2JPTY1CHfhRqq57FALP5rzdLYBJ8V/AfT3edjU=";
+    hash = "sha256-CeL/Az05uqiziKLX+8U5C/3pmuO3xnx9qvdDP7zw8B4=";
   };
 
   patches = [
@@ -110,18 +110,6 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "strictflexarrays3" ];
 
-  # build elfutils out-of-source-tree to avoid ./stack inclusion
-  # as a c++ header on libc++: https://sourceware.org/PR33103
-  preConfigure =
-    if (stdenv.targetPlatform.useLLVM or false) then
-      ''
-        mkdir build-tree
-        cd build-tree
-      ''
-    else
-      null;
-  configureScript = if (stdenv.targetPlatform.useLLVM or false) then "../configure" else null;
-
   configureFlags = [
     "--program-prefix=eu-" # prevent collisions with binutils
     "--enable-deterministic-archives"
@@ -146,14 +134,6 @@ stdenv.mkDerivation rec {
     && (stdenv.hostPlatform == stdenv.buildPlatform);
   doInstallCheck = !stdenv.hostPlatform.isMusl && (stdenv.hostPlatform == stdenv.buildPlatform);
 
-  preCheck = ''
-    # Workaround lack of rpath linking:
-    #   ./dwarf_srclang_check: error while loading shared libraries:
-    #     libelf.so.1: cannot open shared object file: No such file or directory
-    # Remove once https://sourceware.org/PR32929 is fixed.
-    export LD_LIBRARY_PATH="$PWD/libelf:$LD_LIBRARY_PATH"
-  '';
-
   passthru.updateScript = gitUpdater {
     url = "https://sourceware.org/git/elfutils.git";
     rev-prefix = "elfutils-";

pkgs/by-name/fa/faustPhysicalModeling/package.nix

@@ -26,10 +26,6 @@ stdenv.mkDerivation rec {
     bash
   ];
 
-  # ld: /nix/store/*-gcc-14-20241116/lib/gcc/x86_64-unknown-linux-gnu/14.2.1/crtbegin.o:
-  #  relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
-  hardeningDisable = [ "pie" ];
-
   dontWrapQtApps = true;
 
   buildPhase = ''

pkgs/by-name/fb/fb303/package.nix

@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fb303";
-  version = "2025.09.15.00";
+  version = "2025.10.13.00";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fb303";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6suO1SE8+WASQiHLtiieu3nrjEYqSPnKxw7nHkQ4br0=";
+    hash = "sha256-IF3fQY8QfDBo8DoLFIFuZD8OgrrJfXLXDgFcsD1CmaY=";
   };
 
   patches = [
@@ -75,6 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
       kylesferrazza
       emily
       techknowlogick
+      lf-
     ];
   };
 })

pkgs/by-name/fb/fbthrift/package.nix

@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fbthrift";
-  version = "2025.09.15.00";
+  version = "2025.10.13.00";
 
   outputs = [
     # Trying to split this up further into `bin`, `out`, and `dev`
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fbthrift";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4u3SbbmSgtvnW3/VH3CfQrEddAlkQuUl9dmnGGKL4mE=";
+    hash = "sha256-6Vlmb7PfPl9hyJkpH0vsF4mjNTOxd4lu8CWPE0rRvVo=";
   };
 
   patches = [
@@ -135,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
       kylesferrazza
       emily
       techknowlogick
+      lf-
     ];
   };
 })

pkgs/by-name/fi/fizz/package.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fizz";
-  version = "2025.09.15.00";
+  version = "2025.10.13.00";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookincubator";
     repo = "fizz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8j8Nt8XCbMGui7bELhvP+o8E2bqYobkXLhvZVkzCMzU=";
+    hash = "sha256-MNkPf289QGZ1x6Yr2E8vnlCFan94Opjiw6RItodWGaw=";
   };
 
   patches = [
@@ -116,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
       kylesferrazza
       emily
       techknowlogick
+      lf-
     ];
   };
 })

pkgs/by-name/fl/fluidsynth/package.nix

@@ -6,7 +6,6 @@
   pkg-config,
   cmake,
   alsa-lib,
-  glib,
   libjack2,
   libsndfile,
   libpulseaudio,
@@ -14,13 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.4.8";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rOPoRV0NWrlFZohqQ76gnXvt4/ryEI4nSlX+mNW+qf8=";
+    hash = "sha256-ouPCbXg9vgxSAHsReC7dmF1cstQZ1HaUoWcLChE35Hk=";
+    fetchSubmodules = true;
   };
 
   outputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    glib
+    stdenv.cc.cc.lib
     libsndfile
     libjack2
   ]
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     "-Denable-framework=off"
+    "-Dosal=cpp11"
+    "-Denable-libinstpatch=0"
   ];
 
   meta = {

pkgs/by-name/fo/folly/fix-stdexcept-include.patch

@@ -1,22 +0,0 @@
-From dc06cc3162afb148c19cd0931d8fe489d639217a Mon Sep 17 00:00:00 2001
-From: Uilian Ries <uilianries@gmail.com>
-Date: Tue, 9 Sep 2025 16:48:26 +0200
-Subject: [PATCH] Add missing header for std::runtime_error
-
-Signed-off-by: Uilian Ries <uilianries@gmail.com>
----
- folly/hash/Checksum.cpp | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/folly/hash/Checksum.cpp b/folly/hash/Checksum.cpp
-index 1d42d6a6e5f..aeafdb20b1b 100644
---- a/folly/hash/Checksum.cpp
-+++ b/folly/hash/Checksum.cpp
-@@ -17,6 +17,7 @@
- #include <folly/hash/Checksum.h>
- 
- #include <algorithm>
-+#include <stdexcept>
- 
- #include <boost/crc.hpp>
- 

pkgs/by-name/fo/folly/package.nix

@@ -41,7 +41,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "folly";
-  version = "2025.09.15.00";
+  version = "2025.10.13.00";
 
   # split outputs to reduce downstream closure sizes
   outputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "folly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-//gx081nMFXAcUgkHQToiFHhECfLW22Fl0eXEsObxUs=";
+    hash = "sha256-k7PGxYF3HlNc5nPBV+MkELya/4yllkaMA37vcfES4NE=";
   };
 
   nativeBuildInputs = [
@@ -145,16 +145,6 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-QGNpS5UNEm+0PW9+agwUVILzpK9t020KXDGyP03OAwE=";
     })
 
-    # Fix an upstream regression with libstdc++.
-    #
-    # See:
-    #
-    # * <https://github.com/facebook/folly/issues/2487>
-    # * <https://github.com/facebook/folly/commit/bdbb73e0069b4084c83b7dd9b02c3118d37e2a8d>
-    # * <https://github.com/facebook/folly/pull/2490>
-    # * <https://github.com/facebook/folly/pull/2497>
-    ./fix-stdexcept-include.patch
-
     # Fix a GCC‐incompatible use of a private trait.
     #
     # Per Folly’s own documentation:
@@ -237,6 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
       pierreis
       emily
       techknowlogick
+      lf-
     ];
   };
 })

pkgs/by-name/fo/fontforge/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   fetchFromGitHub,
   lib,
-  fetchpatch,
   replaceVars,
   cmake,
   pkg-config,
@@ -34,46 +33,18 @@ assert withGTK -> withGUI;
 let
   py = python3.withPackages (ps: with ps; [ setuptools ]);
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fontforge";
-  version = "20230101";
+  version = "20251009";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = "fontforge";
-    rev = version;
-    sha256 = "sha256-/RYhvL+Z4n4hJ8dmm+jbA1Ful23ni2DbCRZC5A3+pP0=";
+    tag = finalAttrs.version;
+    hash = "sha256-tlpdd+x1mA+HeLXpy5LotNC6sabxI6U7S+m/qOn1jwc=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "CVE-2024-25081.CVE-2024-25082.patch";
-      url = "https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429.patch";
-      hash = "sha256-aRnir09FSQMT50keoB7z6AyhWAVBxjSQsTRvBzeBuHU=";
-    })
-
-    # Replace distutils use in the build script
-    (fetchpatch {
-      name = "replace-distutils.patch";
-      url = "https://github.com/fontforge/fontforge/commit/8c75293e924602ed09a9481b0eeb67ba6c623a81.patch";
-      includes = [ "pyhook/CMakeLists.txt" ];
-      hash = "sha256-3CEwC8vygmCztKRmeD45aZIqyoj8yk5CLwxX2SGP7z4=";
-    })
-
-    # Fixes translation compatibility with gettext 0.22
-    (fetchpatch {
-      name = "update-translation-compatibility.patch";
-      url = "https://github.com/fontforge/fontforge/commit/642d8a3db6d4bc0e70b429622fdf01ecb09c4c10.patch";
-      hash = "sha256-uO9uEhB64hkVa6O2tJKE8BLFR96m27d8NEN9UikNcvg=";
-    })
-
-    # Updates to new Python initialization API
-    (fetchpatch {
-      name = "modern-python-initialization-api.patch";
-      url = "https://github.com/fontforge/fontforge/commit/2f2ba54c15c5565acbde04eb6608868cbc871e01.patch";
-      hash = "sha256-qF4DqFpiZDbULi9+POPM73HF6pEot8BAFSVaVCNQrMU=";
-    })
-
     # Provide a Nix-controlled location for the initial `sys.path` entry.
     (replaceVars ./set-python-sys-path.patch { python = "${py}/${py.sitePackages}"; })
   ];
@@ -128,7 +99,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # The way $version propagates to $version of .pe-scripts (https://github.com/dejavu-fonts/dejavu-fonts/blob/358190f/scripts/generate.pe#L19)
-    export SOURCE_DATE_EPOCH=$(date -d ${version} +%s)
+    export SOURCE_DATE_EPOCH=$(date -d ${finalAttrs.version} +%s)
   '';
 
   meta = {
@@ -141,4 +112,4 @@ stdenv.mkDerivation rec {
       ulysseszhan
     ];
   };
-}
+})

pkgs/by-name/ge/geos/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
-  version = "3.14.0";
+  version = "3.14.1";
 
   src = fetchFromGitHub {
     owner = "libgeos";
     repo = "geos";
     tag = finalAttrs.version;
-    hash = "sha256-tPuAYNi2Gfc/2hj8SFqnvuDztXkSAEoGPcvXVULrLKg=";
+    hash = "sha256-lOf14Qva/bbbiywbSE7GbkDQftjY0RudTOaqjllnsj4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/gh/ghostunnel/package.nix

@@ -5,8 +5,6 @@
   lib,
   nixosTests,
   ghostunnel,
-  apple-sdk_12,
-  darwinMinVersionHook,
   writeScript,
   runtimeShell,
 }:
@@ -26,11 +24,6 @@ buildGoModule rec {
 
   deleteVendor = true;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_12
-    (darwinMinVersionHook "12.0")
-  ];
-
   # These tests don't exist for Linux, and on Darwin they attempt to use the macOS Keychain
   # which doesn't work from a nix build. Presumably other platform implementations of the
   # certstore would have similar issues, so it probably makes sense to skip them in

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2025-07-29";
+      _version = "0-unstable-2025-08-29";
     in
     _version,
-  rev ? "3a4f5cea73eca32e9586e8145f97b04cbd4a1aee",
-  hash ? "sha256-Z7bTto8BHnJzjvmKmcVAZ0/BrXimcAETV6YGKNTorQw=",
+  rev ? "5d0a4153b0bcc86c5a23310d5b648a587be3c56d",
+  hash ? "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/go/gopass-jsonapi/package.nix

@@ -8,7 +8,6 @@
   jq,
   gnupg,
   gopass,
-  apple-sdk_14,
 }:
 
 let
@@ -45,11 +44,6 @@ buildGoModule rec {
     makeWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    # For ScreenCaptureKit.h, see https://github.com/NixOS/nixpkgs/pull/358760#discussion_r1858327365
-    apple-sdk_14
-  ];
-
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/gr/grpc/package.nix

@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.75.1"; # N.B: if you change this, please update:
+  version = "1.76.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     tag = "v${version}";
-    hash = "sha256-SnKK52VLO4MM/ftfmzRV/LeLfOucdIyHMyWk6EKRfvM=";
+    hash = "sha256-f25ccZC0pJw00ETgxBtXU6+0OnlJsV7zXjK/ayiCIJY=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ha/harfbuzz/package.nix

@@ -130,7 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "OpenType text shaping engine";
     homepage = "https://harfbuzz.github.io/";
     changelog = "https://github.com/harfbuzz/harfbuzz/raw/${finalAttrs.version}/NEWS";
-    maintainers = [ ];
+    maintainers = [ maintainers.cobalt ];
     license = licenses.mit;
     platforms = platforms.unix ++ platforms.windows;
     pkgConfigModules = [

pkgs/by-name/ic/icecast/package.nix

@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
     libopus
   ];
 
-  hardeningEnable = [ "pie" ];
-
   meta = {
     description = "Server software for streaming multimedia";
     mainProgram = "icecast";

pkgs/by-name/in/inih/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "inih";
-  version = "61";
+  version = "62";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = "inih";
     rev = "r${version}";
-    hash = "sha256-tSmdd9uAXaRQtnqj0hKuT0wofcZcYjqgPbhtaR+cr84=";
+    hash = "sha256-jnMGOncnH+ffgtyNzA8tZPtxPCR/yq9jmPsJZE4BhXo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ip/iproute2/package.nix

@@ -26,20 +26,6 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchurl {
-      name = "musl-endian.patch";
-      url = "https://lore.kernel.org/netdev/20240712191209.31324-1-contact@hacktivis.me/raw";
-      hash = "sha256-MX+P+PSEh6XlhoWgzZEBlOV9aXhJNd20Gi0fJCcSZ5E=";
-    })
-    (fetchurl {
-      name = "musl-basename.patch";
-      url = "https://lore.kernel.org/netdev/20240804161054.942439-1-dilfridge@gentoo.org/raw";
-      hash = "sha256-47obv6mIn/HO47lt47slpTAFDxiQ3U/voHKzIiIGCTM=";
-    })
-  ]
-  # Temporarily gated to keep rebuild counts under control.
-  # The proper fix (targeted to staging) is done in https://github.com/NixOS/nixpkgs/pull/451397
-  ++ lib.optionals stdenv.hostPlatform.isMusl [
     (fetchurl {
       name = "musl-redefinition.patch";
       url = "https://lore.kernel.org/netdev/20251012124002.296018-1-yureka@cyberchaos.dev/raw";

pkgs/by-name/is/isc-cron/package.nix

@@ -35,8 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     "DESTROOT=$(out)"
   ];
 
-  hardeningEnable = [ "pie" ];
-
   unpackCmd = ''
     mkdir cron
     pushd cron

pkgs/by-name/jj/jj-pre-push/package.nix

@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  fetchpatch2,
 }:
 
 python3Packages.buildPythonApplication rec {

pkgs/by-name/ka/kanata/package.nix

@@ -2,8 +2,6 @@
   stdenv,
   lib,
   gnused,
-  apple-sdk_13,
-  darwinMinVersionHook,
   rustPlatform,
   karabiner-dk,
   fetchFromGitHub,
@@ -29,14 +27,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-LfjuQHR3vVUr2e0efVymnfCnyYkFRx7ZiNdSIjBZc5s=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_13
-    (darwinMinVersionHook "13.0")
-  ];
-
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     (writeShellScriptBin "sw_vers" ''
-      echo 'ProductVersion: 13.0'
+      echo 'ProductVersion: ${stdenv.hostPlatform.darwinMinVersion}'
     '')
   ];
 

pkgs/by-name/ke/kexec-tools/package.nix

@@ -12,22 +12,17 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.31";
+  version = "2.0.32";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "sha256-io81Ddxm4ckFo6tSWn6bqWyB4E5w72k5ewFVtnuSLDE=";
+    sha256 = "sha256-j4FCKl/SNiz2ywAbUR5TVWXtDzLC9EUfteto/tZxCl0=";
   };
 
   patches = [
-    # Fix for static builds, will likely be removable on the next release
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/patch/?id=daa29443819d3045338792b5ba950ed90e79d7a5";
-      hash = "sha256-Nq5HIcLY6KSvvrs2sbfE/vovMbleJYElHW9AVRU5rSA=";
-    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv2) [
     # Use ELFv2 ABI on ppc64be
@@ -42,7 +37,6 @@ stdenv.mkDerivation rec {
     "format"
     "pic"
     "relro"
-    "pie"
   ];
 
   # Prevent kexec-tools from using uname to detect target, which is wrong in

pkgs/by-name/ke/keydb/package.nix

@@ -57,8 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
-
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.hostPlatform.isDarwin;
   nativeCheckInputs = [

pkgs/by-name/ko/koboldcpp/package.nix

@@ -7,8 +7,6 @@
   tk,
   addDriverRunpath,
 
-  apple-sdk_13,
-
   koboldLiteSupport ? true,
 
   config,
@@ -71,7 +69,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     tk
   ]
   ++ finalAttrs.pythonInputs
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_13 ]
   ++ lib.optionals cublasSupport [
     cudaPackages.libcublas
     cudaPackages.cuda_nvcc

pkgs/by-name/ks/ksh/package.nix

@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/att/ast";
     license = lib.licenses.cpl10;
     maintainers = with lib.maintainers; [ sigmanificient ];
+    mainProgram = "ksh";
     platforms = lib.platforms.all;
   };
 

pkgs/by-name/la/ladybird/package.nix

@@ -27,7 +27,6 @@
   skia,
   nixosTests,
   unstableGitUpdater,
-  apple-sdk_14,
   libtommath,
   sdl3,
 }:
@@ -107,9 +106,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isLinux [
     libpulseaudio.dev
     qt6Packages.qtwayland
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_14
   ];
 
   cmakeFlags = [

pkgs/by-name/ld/ld64/package.nix

@@ -119,6 +119,9 @@ stdenv.mkDerivation (finalAttrs: {
     xar
   ];
 
+  # ld built with this fails to link glib's gio on x86_64 darwin
+  hardeningDisable = [ "libcxxhardeningfast" ];
+
   dontUseCmakeConfigure = true; # CMake is only needed because it’s used by Meson to find LLVM.
 
   # Note for overrides: ld64 cannot be built as a debug build because of UB in its iteration implementations,

pkgs/by-name/li/libadwaita/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.7.6";
+  version = "1.7.8";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-HpjP6VSkEAFeXIFXLbndQzEWJwVvHe6B3aSwCz6KiIM=";
+    hash = "sha256-KeBKrr5+PXSvdqVk74/JJL5F6U+GcDUod2rPwLQz0OY=";
   };
 
   depsBuildBuild = [

pkgs/by-name/li/libarchive/fix-darwin-tmpdir-handling.patch

@@ -1,22 +0,0 @@
-From 87bbe8ec8d343c70ae42ccb9606ec80ad73ceffb Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Tue, 29 Jul 2025 16:53:15 +0100
-Subject: [PATCH] Fix setup_mac_metadata when TMPDIR does not end with a slash
-
----
- libarchive/archive_read_disk_entry_from_file.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libarchive/archive_read_disk_entry_from_file.c b/libarchive/archive_read_disk_entry_from_file.c
-index 19d049770b..87389642db 100644
---- a/libarchive/archive_read_disk_entry_from_file.c
-+++ b/libarchive/archive_read_disk_entry_from_file.c
-@@ -364,7 +364,7 @@ setup_mac_metadata(struct archive_read_disk *a,
- 		tempdir = _PATH_TMP;
- 	archive_string_init(&tempfile);
- 	archive_strcpy(&tempfile, tempdir);
--	archive_strcat(&tempfile, "tar.md.XXXXXX");
-+	archive_strcat(&tempfile, "/tar.md.XXXXXX");
- 	tempfd = mkstemp(tempfile.s);
- 	if (tempfd < 0) {
- 		archive_set_error(&a->archive, errno,

pkgs/by-name/li/libarchive/package.nix

@@ -6,7 +6,6 @@
   attr,
   autoreconfHook,
   bzip2,
-  fetchpatch,
   glibcLocalesUtf8,
   lzo,
   openssl,
@@ -32,29 +31,15 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KN5SvQ+/g/OOa+hntMX3D8p5IEWO0smke5WK+DwrOH0=";
+    hash = "sha256-s7duwuNFyYq8obTS3qc6JewJ9f8LJhItlEx8wxnMgwk=";
   };
 
-  patches = [
-    # https://github.com/libarchive/libarchive/pull/2689
-    # Remove after next release.
-    (fetchpatch {
-      url = "https://github.com/libarchive/libarchive/commit/489d0b8e2f1fafd3b7ebf98f389ca67462c34651.patch?full_index=1";
-      hash = "sha256-r+tSJ+WA0VKCjg+8MfS5/RqcB+aAMZ2dK0YUh+U1q78=";
-    })
-    # Fix the tests on Darwin when `$TMPDIR` does not end with a slash
-    # and its parent directory is not writable by the build user, as on
-    # Nix ≥ 2.30.0 and Lix ≥ 2.91.2, ≥ 2.92.2, ≥ 2.93.1.
-    # <https://github.com/libarchive/libarchive/pull/2708>
-    ./fix-darwin-tmpdir-handling.patch
-  ];
-
   outputs = [
     "out"
     "lib"

pkgs/by-name/li/libdecor/package.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libdecor";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libdecor";
     repo = "libdecor";
     rev = version;
-    hash = "sha256-7h/Xfw8chzRmmWKcOyIB7KSL+ZzNGDpElfE22ReoJqY=";
+    hash = "sha256-l0MmNpC+449BaluynbzG5d0/v57F5rltOIBzBagkYbc=";
   };
 
   outputs = [

pkgs/by-name/li/libdrm/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.126";
+  version = "2.4.127";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-bKsW1NJZtqvJ9IUjOGNFQRSjwwfsqAZnmq0+2+lnv0I=";
+    hash = "sha256-BRrrPlQqV2IQGP/EQ/sIjdabeO7wzkgItgTOD+rJ9H8=";
   };
 
   outputs = [

pkgs/by-name/li/libedit/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libedit";
-  version = "20250104-3.1";
+  version = "20251016-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/libedit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-I3knAWlFUKU3IGMM0c1hZxAbV3Ot3ctBBPc0W3OlaKw=";
+    hash = "sha256-ITYrAGU7v8HHH3GnV42ma1tSA1WdQxNNLddxnjE84EE=";
   };
 
   outputs = [

pkgs/by-name/li/libfabric/package.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "2.3.0";
+  version = "2.3.1";
 
   enableParallelBuilding = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = "libfabric";
     rev = "v${version}";
-    sha256 = "sha256-pxSv6mg51It4+P1nAgXdWizTGpI31rn5+n3f4vD6ooY=";
+    sha256 = "sha256-Zaf7iGr2/HWiMcH7zERz5Y9YzJ0QpHCCs+bU+qmoQTI=";
   };
 
   outputs = [

pkgs/by-name/li/libjxl/package.nix

@@ -5,6 +5,7 @@
   fetchpatch,
   brotli,
   cmake,
+  ctestCheckHook,
   giflib,
   gperftools,
   gtest,
@@ -97,6 +98,10 @@ stdenv.mkDerivation rec {
     libhwy
   ];
 
+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
+
   cmakeFlags = [
     # For C dependencies like brotli, which are dynamically linked,
     # we want to use the system libraries, so that we don't have to care about
@@ -176,6 +181,30 @@ stdenv.mkDerivation rec {
   # https://github.com/NixOS/nixpkgs/pull/204030#issuecomment-1352768690
   doCheck = with stdenv; !(hostPlatform.isi686 || isDarwin && isx86_64);
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isBigEndian [
+    # https://github.com/libjxl/libjxl/issues/3629
+    "DecodeTest.ProgressionTestLosslessAlpha"
+    "DecodeTest.FlushTestLosslessProgressiveAlpha"
+    "EncodeTest.FrameSettingsTest"
+    "JxlTest.RoundtripAlphaResampling"
+    "JxlTest.RoundtripAlphaResamplingOnlyAlpha"
+    "JxlTest.RoundtripAlpha16"
+    "JxlTest.RoundtripProgressive"
+    "JxlTest.RoundtripProgressiveLevel2Slow"
+    "ModularTest.RoundtripLossyDeltaPalette"
+    "ModularTest.RoundtripLossy"
+    "ModularTest.RoundtripLossy16"
+    "PassesTest.ProgressiveDownsample2DegradesCorrectlyGrayscale"
+    "PassesTest.ProgressiveDownsample2DegradesCorrectly"
+  ];
+
+  ctestFlags = lib.optionals stdenv.hostPlatform.isBigEndian [
+    # https://github.com/libjxl/libjxl/issues/3629
+    # These didn't seem to be accepted via disabledTests
+    "--exclude-regex"
+    ".*bitSqueeze.*"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/libjxl/libjxl";
     description = "JPEG XL image format reference implementation";

pkgs/by-name/li/libnbd/package.nix

@@ -16,83 +16,80 @@
   autoreconfHook,
 }:
 
-lib.throwIf (buildOcamlBindings && !lib.versionAtLeast ocamlPackages.ocaml.version "4.05")
-  "OCaml binding are not available for OCaml < 4.05"
+stdenv.mkDerivation rec {
+  pname = "libnbd";
+  version = "1.22.1";
 
-  stdenv.mkDerivation
-  rec {
-    pname = "libnbd";
-    version = "1.22.1";
+  src = fetchurl {
+    url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
+    hash = "sha256-9oVJrU2YcXGnKaDf8SoHKGtG7vpH5355/DKIiYrchHI=";
+  };
 
-    src = fetchurl {
-      url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-      hash = "sha256-9oVJrU2YcXGnKaDf8SoHKGtG7vpH5355/DKIiYrchHI=";
-    };
-
-    nativeBuildInputs = [
-      bash-completion
-      pkg-config
-      perl
-      autoreconfHook
+  nativeBuildInputs = [
+    bash-completion
+    pkg-config
+    perl
+    autoreconfHook
+  ]
+  ++ lib.optionals buildPythonBindings [ python3 ]
+  ++ lib.optionals buildOcamlBindings (
+    with ocamlPackages;
+    [
+      findlib
+      ocaml
     ]
-    ++ lib.optionals buildPythonBindings [ python3 ]
-    ++ lib.optionals buildOcamlBindings (
-      with ocamlPackages;
-      [
-        findlib
-        ocaml
-      ]
-    );
+  );
 
-    buildInputs = [
-      fuse
-      fuse3
-      gnutls
-      libxml2
-    ];
+  buildInputs = [
+    fuse
+    fuse3
+    gnutls
+    libxml2
+  ];
 
-    postPatch = lib.optionalString buildOcamlBindings ''
-      substituteInPlace ocaml/Makefile.am \
-          --replace-fail '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib'
+  postPatch = lib.optionalString buildOcamlBindings ''
+    substituteInPlace ocaml/Makefile.am \
+        --replace-fail '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib'
+  '';
+
+  configureFlags = lib.optionals buildPythonBindings [
+    "--with-python-installdir=${placeholder "out"}/${python3.sitePackages}"
+  ];
+
+  installFlags = [ "bashcompdir=$(out)/share/bash-completion/completions" ];
+
+  postInstall = lib.optionalString buildPythonBindings ''
+    LIBNBD_PYTHON_METADATA='${placeholder "out"}/${python3.sitePackages}/nbd-${version}.dist-info/METADATA'
+    install -Dm644 -T ${./libnbd-metadata} $LIBNBD_PYTHON_METADATA
+    substituteAllInPlace $LIBNBD_PYTHON_METADATA
+  '';
+
+  meta = with lib; {
+    homepage = "https://gitlab.com/nbdkit/libnbd";
+    description = "Network Block Device client library in userspace";
+    longDescription = ''
+      NBD — Network Block Device — is a protocol for accessing Block Devices
+      (hard disks and disk-like things) over a Network.  This is the NBD client
+      library in userspace, a simple library for writing NBD clients.
+
+      The key features are:
+      - Synchronous API for ease of use.
+      - Asynchronous API for writing non-blocking, multithreaded clients. You
+        can mix both APIs freely.
+      - High performance.
+      - Minimal dependencies for the basic library.
+      - Well-documented, stable API.
+      - Bindings in several programming languages.
+      - Shell (nbdsh) for command line and scripting.
     '';
-
-    configureFlags = lib.optionals buildPythonBindings [
-      "--with-python-installdir=${placeholder "out"}/${python3.sitePackages}"
+    license = with licenses; lgpl21Plus;
+    maintainers = with maintainers; [
+      humancalico
     ];
-
-    installFlags = [ "bashcompdir=$(out)/share/bash-completion/completions" ];
-
-    postInstall = lib.optionalString buildPythonBindings ''
-      LIBNBD_PYTHON_METADATA='${placeholder "out"}/${python3.sitePackages}/nbd-${version}.dist-info/METADATA'
-      install -Dm644 -T ${./libnbd-metadata} $LIBNBD_PYTHON_METADATA
-      substituteAllInPlace $LIBNBD_PYTHON_METADATA
-    '';
-
-    meta = with lib; {
-      homepage = "https://gitlab.com/nbdkit/libnbd";
-      description = "Network Block Device client library in userspace";
-      longDescription = ''
-        NBD — Network Block Device — is a protocol for accessing Block Devices
-        (hard disks and disk-like things) over a Network.  This is the NBD client
-        library in userspace, a simple library for writing NBD clients.
-
-        The key features are:
-        - Synchronous API for ease of use.
-        - Asynchronous API for writing non-blocking, multithreaded clients. You
-          can mix both APIs freely.
-        - High performance.
-        - Minimal dependencies for the basic library.
-        - Well-documented, stable API.
-        - Bindings in several programming languages.
-        - Shell (nbdsh) for command line and scripting.
-      '';
-      license = with licenses; lgpl21Plus;
-      maintainers = with maintainers; [
-        humancalico
-      ];
-      platforms = with platforms; linux;
-    };
-  }
+    platforms = with platforms; linux;
+    broken = buildOcamlBindings && !lib.versionAtLeast ocamlPackages.ocaml.version "4.05";
+  };
+}
 # TODO: package the 1.6-stable version too
 # TODO: git version needs ocaml
 # TODO: bindings for go