Merge staging-next into staging

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -43,6 +43,11 @@ test script).
 
 ## Shell access to VMs in interactive mode {#sec-nixos-test-shell-access}
 
+::: {.warning}
+Using `shell_interact()` is deprecated. Use the
+[interactive SSH backdoor](#sec-nixos-test-ssh-access) instead.
+:::
+
 The function `<yourmachine>.shell_interact()` grants access to a shell running
 inside a virtual machine. To use it, replace `<yourmachine>` with the name of a
 virtual machine defined in the test, for example: `machine.shell_interact()`.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -75,6 +75,8 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
+- The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
+
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -6,6 +6,7 @@ import warnings
 from pathlib import Path
 
 import ptpython.ipython
+import ptpython.repl
 from colorama import Fore, Style
 
 from test_driver.debug import Debug, DebugAbstract, DebugNop
@@ -174,6 +175,7 @@ def main() -> None:
         if args.interactive:
             history_dir = os.getcwd()
             history_path = os.path.join(history_dir, ".nixos-test-history")
+            ptpython.repl.enable_deprecation_warnings()
             ptpython.ipython.embed(
                 user_ns=driver.test_symbols(),
                 history_filename=history_path,

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -926,6 +926,7 @@ class QemuMachine(BaseMachine):
 
         return (rc, output.decode(errors="replace"))
 
+    @warnings.deprecated("Use the SSH backdoor instead")
     def shell_interact(self, address: str | None = None) -> None:
         """
         Allows you to directly interact with the guest shell. This should
@@ -1492,6 +1493,7 @@ class NspawnMachine(BaseMachine):
 
     machine_sock_path: Path
     machine_sock: socket.socket | None
+    notify_thread: threading.Thread | None
 
     @staticmethod
     def machine_name_from_start_command(start_command: str) -> str:
@@ -1522,6 +1524,12 @@ class NspawnMachine(BaseMachine):
 
         self.start_command = start_command
         self.process = None
+        self.notify_thread = None
+        # State maintained by the notify-socket drainer thread (see
+        # `_drain_notify_socket`). Guarded by `_notify_lock`.
+        self._notify_lock = threading.Lock()
+        self._notify_ready = False
+        self._notify_leader_pid: int | None = None
 
         self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"
 
@@ -1556,43 +1564,76 @@ class NspawnMachine(BaseMachine):
     def is_up(self) -> bool:
         return self.process is not None
 
-    def _poll_socket(self) -> tuple[bool, int | None]:
-        """Non-blocking check of container status via socket.
-        Returns (is_ready, leader_pid).
+    def _drain_notify_socket(self) -> None:
+        """Continuously drain the container's `sd_notify` socket (NOTIFY_SOCKET)
+        for the whole lifetime of the container, recording readiness and the
+        leader PID as they arrive.
+
+        Draining must not stop after boot: the container's PID 1 re-sends
+        `READY=1` on every `systemctl daemon-reexec` (the same Manager.Reexecute
+        that switch-to-configuration issues on a systemd change). If nothing
+        reads the socket, its receive buffer fills and PID 1 blocks in
+        `sendmsg()` to NOTIFY_SOCKET while re-executing -- it never finishes
+        re-initializing, and every later `systemctl` call inside the container
+        hangs or fails with `Transport endpoint is not connected`.
         """
         assert self.machine_sock is not None
-        ready = False
-        leader_pid = None
-        try:
-            data, _ = self.machine_sock.recvfrom(4096)
-            msg = data.decode()
-            for line in msg.splitlines():
+        sock = self.machine_sock
+        proc = self.process
+        assert proc is not None
+        # Bound the thread to the container's lifetime: on
+        # `wait_for_shutdown()` only non-None `proc.poll()` ends the loop.
+        # On exit of PID 1, any datagrams still queued are stale, so drop them.
+        while proc.poll() is None:
+            try:
+                # Block (with a timeout so we notice the container exiting)
+                # rather than busy-poll; we just need to keep the buffer empty.
+                sock.settimeout(0.5)
+                data, _ = sock.recvfrom(4096)
+            except (TimeoutError, BlockingIOError):
+                continue
+            except OSError:
+                break
+            ready = False
+            leader_pid = None
+            for line in data.decode(errors="replace").splitlines():
                 if line == "READY=1":
                     ready = True
                 if line.startswith("X_NSPAWN_LEADER_PID="):
                     leader_pid = int(line.split("=")[1])
-        except OSError:
-            pass
-        return ready, leader_pid
+            if ready or leader_pid is not None:
+                with self._notify_lock:
+                    if ready:
+                        self._notify_ready = True
+                    if leader_pid is not None:
+                        self._notify_leader_pid = leader_pid
 
     @cached_property
     def get_systemd_process(self) -> int:
-        """Block until startup is complete and return the PID of the container's systemd process."""
-        assert self.process is not None
+        """Block until startup is complete and return the PID of the container's systemd process.
 
-        container_pid: int | None = None
-        is_ready = False
+        Readiness and the leader PID are reported over NOTIFY_SOCKET, which is
+        drained by `_drain_notify_socket` (started in `start()`); we just wait
+        for that thread to record both.
+        """
+        assert self.process is not None
 
         start_time = time.monotonic()
         last_warning = start_time
         delay = 0.01
         max_delay = 0.5
 
-        while not is_ready or container_pid is None:
-            # Poll the socket until we have the container leader PID
+        # Poll the socket until we have the container leader PID
+        while True:
             if self.process.poll() is not None:
                 raise MachineError("systemd-nspawn process exited unexpectedly")
 
+            with self._notify_lock:
+                is_ready = self._notify_ready
+                container_pid = self._notify_leader_pid
+            if is_ready and container_pid is not None:
+                return container_pid
+
             # Print periodic warnings every 10s so the user knows we aren't deadlocked
             now = time.monotonic()
             if now - last_warning > 10.0:
@@ -1601,18 +1642,8 @@ class NspawnMachine(BaseMachine):
                 )
                 last_warning = now
 
-            # Poll and update our local tracking variables
-            ready_now, pid_now = self._poll_socket()
-            if ready_now:
-                is_ready = True
-            if pid_now:
-                container_pid = pid_now
-
-            if not (is_ready and container_pid):
-                time.sleep(delay)
-                delay = min(delay * 2, max_delay)
-
-        return container_pid
+            time.sleep(delay)
+            delay = min(delay * 2, max_delay)
 
     def _execute(
         self,
@@ -1726,7 +1757,6 @@ class NspawnMachine(BaseMachine):
 
         self.machine_sock = socket.socket(family=socket.AF_UNIX, type=socket.SOCK_DGRAM)
         self.machine_sock.bind(str(self.machine_sock_path))
-        self.machine_sock.setblocking(False)
 
         self.process = subprocess.Popen(
             [self.start_command],
@@ -1742,6 +1772,13 @@ class NspawnMachine(BaseMachine):
 
         self.log(f"systemd-nspawn running (pid {self.process.pid})")
 
+        # Keep the notify socket drained for the container's whole lifetime, so
+        # PID 1 never blocks re-sending `READY=1` on `daemon-reexec`.
+        self.notify_thread = threading.Thread(
+            target=self._drain_notify_socket, daemon=True
+        )
+        self.notify_thread.start()
+
         journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
         journal_thread.start()
 

nixos/modules/programs/immersed.nix

@@ -26,6 +26,12 @@ in
     programs.immersed = {
       enable = lib.mkEnableOption "immersed";
 
+      openPorts = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open firewall ports for Immersed";
+      };
+
       package = lib.mkPackageOption pkgs "immersed" { };
     };
   };
@@ -43,6 +49,15 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+
+    # https://immersed.helpscoutdocs.com/article/23-connection-troubleshooting-linux
+    networking.firewall = lib.mkIf cfg.openPorts {
+      allowedTCPPorts = [ 21000 ];
+      allowedUDPPorts = [
+        21000
+        21010
+      ];
+    };
   };
 
   meta.maintainers = pkgs.immersed.meta.maintainers;

nixos/tests/all-tests.nix

@@ -152,6 +152,7 @@ in
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
+    nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };

nixos/tests/nspawn-daemon-reexec-dbus.nix

@@ -0,0 +1,79 @@
+# Regression test for an nspawn-only systemd re-exec failure that broke D-Bus.
+#
+# Demonstrates `systemctl show` keeps working on `daemon-reexec`.
+#
+# Trigger: `systemctl daemon-reexec` issues a D-Bus `Manager.Reexecute`, like
+# `switch-to-configuration-ng` on a systemd package change.
+#
+# Root cause: inside nspawn test containers PID 1 re-send `READY=1` on the
+# `NOTIFY_SOCKET` on re-exec. The test driver stopped draining that socket
+# after boot, so until drained its receive buffer filled and `systemctl` hung /
+# errored `Failed to connect to bus: Transport endpoint is not connected`.
+{ ... }:
+{
+  name = "nspawn-daemon-reexec-dbus";
+
+  # `containers.<name>` => systemd-nspawn machine (vs `nodes.<name>` => QEMU).
+  # An empty container boots full systemd + D-Bus, which is all we need.
+  containers.machine = { };
+
+  testScript = # python
+    ''
+      import re
+
+      BUS_BROKEN = re.compile(
+          r"Transport endpoint is not connected|Failed to connect to bus"
+      )
+
+      # Without the fix the notify socket's receive buffer fills after 10
+      # undrained `READY=1` resends, so PID 1 blocks then.
+      REEXECS = 10
+
+
+      def bus_broken():
+          """Whether the in-container D-Bus is unusable. A broken bus prints a
+          transport error or hangs until `timeout` kills it (status 124); both
+          count as broken."""
+          status, out = machine.execute(
+              "timeout 10 systemctl show -p ActiveState --value "
+              "multi-user.target 2>&1",
+              check_return=False,
+              timeout=20,
+          )
+          return status != 0 or bool(BUS_BROKEN.search(out)), status, out
+
+
+      machine.start()
+      machine.wait_for_unit("multi-user.target", timeout=120)
+
+      # Pre-reexec sanity: the bus works and shows no break.
+      broken, status, out = bus_broken()
+      assert not broken, (
+          f"bus already broken before any reexec: status={status} out={out!r}"
+      )
+      machine.log(f"pre-reexec sanity OK: {out.strip()!r}")
+
+      broke_at = None
+      for i in range(1, REEXECS + 1):
+          # The same D-Bus Manager.Reexecute that switch-to-configuration issues
+          # on a systemd change.
+          machine.execute(
+              "timeout 30 systemctl daemon-reexec",
+              check_return=False,
+              timeout=45,
+          )
+          broken, status, out = bus_broken()
+          machine.log(f"[reexec {i}] status={status} out={out.strip()!r}")
+          if broken:
+              broke_at = i
+              break
+
+      assert broke_at is None, (
+          f"nspawn D-Bus broke after daemon-reexec #{broke_at} of {REEXECS} "
+          "(systemctl hung or returned a bus transport error). The re-exec'd "
+          "PID 1 never finished re-initialising -- the test driver stopped "
+          "draining the notify socket, so PID 1's READY=1 resend blocked. "
+          "Never observed on QEMU."
+      )
+    '';
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix

@@ -15,9 +15,9 @@ let
 
   # Usage:
   # treesit-grammars.with-grammars (p: [ p.tree-sitter-bash p.tree-sitter-c ... ])
-  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter.builtGrammars);
+  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter-grammars.derivations);
 
-  with-all-grammars = grammarPackage pkgs.tree-sitter.allGrammars;
+  with-all-grammars = grammarPackage pkgs.tree-sitter-grammars.allGrammars;
 in
 {
   inherit with-grammars with-all-grammars;

pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

@@ -4,6 +4,7 @@
   symlinkJoin,
   vimUtils,
   tree-sitter,
+  tree-sitter-grammars,
   neovim,
   neovimUtils,
   runCommand,
@@ -127,7 +128,7 @@ let
   withPlugins =
     f:
     let
-      selectedGrammars = f (tree-sitter.builtGrammars // builtGrammars);
+      selectedGrammars = f (tree-sitter-grammars.derivations // builtGrammars);
 
       grammarPlugins = map grammarToPlugin selectedGrammars;
 

pkgs/by-name/co/code-cursor/sources.json

@@ -1,22 +1,22 @@
 {
-  "version": "3.9.8",
+  "version": "3.9.16",
   "vscodeVersion": "1.105.1",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/x64/Cursor-3.9.8-x86_64.AppImage",
-      "hash": "sha256-xcyFowrW5yzIDCwbFGmpDRSNa3OUXsHwpLkbyNcSzqM="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/x64/Cursor-3.9.16-x86_64.AppImage",
+      "hash": "sha256-dG61VYGMHPip57ldzNICEi1yPc4s1dON+MlDGiKadKc="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/arm64/Cursor-3.9.8-aarch64.AppImage",
-      "hash": "sha256-ZhRMvfJkt8NZT45tYxfO2gBFaVw6hR2nVeRzmrxQfeE="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/arm64/Cursor-3.9.16-aarch64.AppImage",
+      "hash": "sha256-7tkupyy8EFeOpzQqoHQsYxWQlFoW6VBpXkuCJsRIhRw="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-IOQsZQAncDgZGEnCZWg/LQqD/PquFifBmuk2hnJ1L/s="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-5sAj/FiPAs1facGmNKgXiNzs1Kc1ht9eXYU1aZ1VoUA="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-GxpBKyx0Yo3e8AUS9Oxei/hHm1m3JdxMKjX7qAxUGm4="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-pnSsOvyFiBKJsPUPkfnSY1l+LEzz3g5kbepIco7dDIM="
     }
   }
 }

pkgs/by-name/di/diffsitter/package.nix

@@ -4,32 +4,19 @@
   linkFarm,
   makeWrapper,
   rustPlatform,
-  tree-sitter,
+  tree-sitter-grammars,
   gitUpdater,
   versionCheckHook,
 }:
 
 let
   # based on https://github.com/NixOS/nixpkgs/blob/aa07b78b9606daf1145a37f6299c6066939df075/pkgs/development/tools/parsing/tree-sitter/default.nix#L85-L104
-  withPlugins =
-    grammarFn:
-    let
-      grammars = grammarFn tree-sitter.builtGrammars;
-    in
-    linkFarm "grammars" (
-      map (
-        drv:
-        let
-          name = lib.strings.getName drv;
-        in
-        {
-          name = "lib" + (lib.strings.removeSuffix "-grammar" name) + ".so";
-          path = "${drv}/parser";
-        }
-      ) grammars
-    );
+  grammarToAttrSet = drv: {
+    name = "lib" + (lib.strings.removeSuffix "-grammar" (lib.strings.getName drv)) + ".so";
+    path = "${drv}/parser";
+  };
 
-  libPath = withPlugins (_: tree-sitter.allGrammars);
+  libPath = linkFarm "grammars" (map grammarToAttrSet tree-sitter-grammars.allGrammars);
 in
 rustPlatform.buildRustPackage rec {
   pname = "diffsitter";

pkgs/by-name/di/diskwatch/package.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "diskwatch";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "diskwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pveHyT3ljQQ9GdOMhZhcY7QD/pMvL3fLrbM6D5fO+h4=";
+    hash = "sha256-8tQXcbY/sguw42vE0p5Q8/psmwfYQihWcSIsApI4OmE=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-PufgQqJGsPMBcnNV/QXQnE/wrI4FAJWXLvoHEqLQm5k=";
+  cargoHash = "sha256-kO6g5JJogNN5xqD5Qoj6Ncd6scA7PFAjg6y0AWnNhAM=";
 
   nativeCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/dj/django-upgrade/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "django-upgrade";
-  version = "1.30.0";
+  version = "1.31.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adamchainz";
     repo = "django-upgrade";
     tag = finalAttrs.version;
-    hash = "sha256-IiGwYq6TTNiNIx1jrzQlLiULWNZlam7onJJGFFJ/hVM=";
+    hash = "sha256-6x1542ieT+G/r3IiCw4aLePY3HLzpycI7FOBqHm1fmE=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/dt/dtc/package.nix

@@ -49,8 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
         }
       );
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   nativeBuildInputs = [
     meson
     ninja

pkgs/by-name/he/helix/package.nix

@@ -6,7 +6,7 @@
   helix-unwrapped,
   removeReferencesTo,
   pkgs,
-  tree-sitter,
+  tree-sitter-grammars,
   lockedGrammars ? lib.importJSON ./grammars.json,
   grammarsOverlay ? (
     final: prev: {
@@ -66,13 +66,9 @@ let
         }
     ) prev;
 
-  tree-sitter-grammars =
+  helixTreeSitterGrammars =
     lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
-      (
-        tree-sitter.grammarsScope.overrideScope (
-          lib.composeExtensions lockedVersionsOverlay grammarsOverlay
-        )
-      );
+      (tree-sitter-grammars.overrideScope (lib.composeExtensions lockedVersionsOverlay grammarsOverlay));
 
   # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
   # See here: https://github.com/helix-editor/helix/pull/14982
@@ -82,7 +78,7 @@ let
     lib.concatMapAttrsStringSep "\n" (_: grammar: ''
       install -D ${grammar}/parser $out/${grammar.language}.so
       ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
-    '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
+    '') helixTreeSitterGrammars
   );
 
   lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);
@@ -113,7 +109,7 @@ symlinkJoin {
   passthru = {
     updateScript = ./update.sh;
     runtime = runtimeDir;
-    inherit tree-sitter-grammars;
+    tree-sitter-grammars = helixTreeSitterGrammars;
   };
 
   meta = {

pkgs/by-name/im/immersed/linux.nix

@@ -25,6 +25,13 @@ appimageTools.wrapAppImage {
 
   extraPkgs =
     pkgs: with pkgs; [
+      libva
+      # VAAPI backends
+      intel-media-driver
+      intel-vaapi-driver
+      nvidia-vaapi-driver
+      mesa
+      # Other dependencies
       libgpg-error
       fontconfig
       libGL

pkgs/by-name/jj/jjui/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "jjui";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IcJImxowBuQy9MBsz4QesDJM484qSvfQxPx4ykQ0ttA=";
+    hash = "sha256-ZbmCPCTsSbphLUy+lrTt4/6DVq70edKGI59U0HDbawE=";
   };
 
   vendorHash = "sha256-thGlfZ0SwHpynYydxu6Sg8OUe5kr7jiPKvl6BXS5BWA=";

pkgs/by-name/mo/mongodb-compass/package.nix

@@ -52,7 +52,7 @@
 
 let
   pname = "mongodb-compass";
-  version = "1.49.9";
+  version = "1.49.10";
 
   selectSystem =
     attrs:
@@ -67,9 +67,9 @@ let
       }
     }";
     hash = selectSystem {
-      x86_64-linux = "sha256-Fx//NMDHqVaLwthOM7FeSgUXkvLOSbw5EH1qp1dgPcM=";
-      x86_64-darwin = "sha256-l5Jx0BUQR++tkF0cpctxhku6lB2rHEydp7roJy9AGFc=";
-      aarch64-darwin = "sha256-HCKt1rq6P7Uy6NJiFRBBp4YdpAdhwQQjEGT5h7IcyWE=";
+      x86_64-linux = "sha256-faD8sIbnho5urBWE0btcmD7tXT8eQCNyJYzpIyI+bA4=";
+      x86_64-darwin = "sha256-Ddue3jSvQecBjxQlyh/+ujrF9NheZ9PS0Dq7J08SJr8=";
+      aarch64-darwin = "sha256-HGOJPYC4+CgLQQ3BNUTNZUln5oqPkC8ewHft99LCZQ8=";
     };
   };
 

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py

@@ -25,7 +25,7 @@ SSH_DEFAULT_OPTS: Final = [
     "-o",
     "ControlMaster=auto",
     "-o",
-    f"ControlPath={tmpdir.TMPDIR_PATH / 'ssh-%C'}",
+    f"ControlPath={tmpdir.SSH_CONTROL_PATH}",
     "-o",
     "ControlPersist=60",
 ]

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/tmpdir.py

@@ -1,38 +1,86 @@
 import logging
+import os
 from pathlib import Path
-from tempfile import TemporaryDirectory, gettempdir
+from tempfile import TemporaryDirectory
 from typing import Final
 
 logger: Final = logging.getLogger(__name__)
 
+# The Linux kernel hardcodes a limit of 108 bytes for Unix sockets [0],
+# but that includes one NULL byte at the very end, so the logical max
+# length is 107 bytes.
+# [0]: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/uapi/linux/un.h?h=v6.18.37#n7
+LINUX_MAX_SOCKET_LENGTH: Final = 107
 
-# Very long tmp dirs lead to "too long for Unix domain socket"
-# SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
-# This is also required for Linux, if the user tries to build
-# from inside a shell using `--target-host`, which will cause
-# ssh to fail with "ControlPath too long"
+# OpenSSH expands %C to `conn_hash_hex` [0],
+# which is the result of calling `ssh_connection_hash` [1],
+# which computes a sha1 digest [2],
+# which is 20 bytes long [3].
+# which gets hex encoded [4] to double that length [5].
 #
-# The constant is based on a worst case example FQDN, e.g.:
-# `ec2-123-123-123-123.ap-southeast-2.compute.amazonaws.com` (56 bytes).
-# The `ControlPath` can maximum be 108 bytes. Given the prefix
-# that is used for the tempdir, ie. `nixos-rebuild.47i6dz8c` (22 bytes),
-# we have 30 bytes left to work with.
-# This should be fine for the usual temp folders:
-# /tmp/tmp.7hBqN2Fm5H (19)
-# /var/tmp/tmp.7hBqN2Fm5H (23)
-# /run/user/1000/tmp.7hBqN2Fm5H (29)
+# [0]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/sshconnect.h#L70
+# [1]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/ssh.c#L1464-L1465
+# [2]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/readconf.c#L345
+# [3]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/openbsd-compat/sha1.h#L15
+# [4]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/readconf.c#L360
+# [5]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/misc.c#L1627
+OPENSSH_PERCENT_C_LENGTH: Final = 40
+
+# OpenSSH adds a suffix to the given control path [0].
+# There's 1 character for a `.` separator, followed by 16 random characters [1].
+# [0]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/mux.c#L1348
+# [1]: https://github.com/openssh/openssh-portable/blob/V_10_3_P1/mux.c#L1324
+OPENSSH_CONTROL_PATH_SUFFIX_LENGTH: Final = 1 + 16
+
+# Carefully compute a maximum allowed length for a tmpdir, otherwise ssh crashes with errors like this:
+# > unix_listener: path "/home/runner/work/_temp/nixos-rebuild.aw8hzmq7/ssh-ea7c10de83787b1dec3f06ef20ee26b38c6bb0a5.x9MDykk4gmASsl3R"
+# > too long for Unix domain socket
+#
+# The full path to our tmpdir must be short enough for the resulting Unix domain
+# sockets that OpenSSH creates to fit within `LINUX_MAX_SOCKET_LENGTH`.
+# It's common for system configured temp dirs to be more
+# than a few characters:
+# - macOS sets long TMPDIR paths.
+# - Nix dev shells set a longer TMPDIR
+# - GitHub actions set TMPDIR to something like `/home/runner/work/_temp`.
+#
+# Breaking down the socket path into its component pieces:
+#
+# /home/runner/work/_temp/nixos-rebuild.aw8hzmq7/ssh-ea7c10de83787b1dec3f06ef20ee26b38c6bb0a5.x9MDykk4gmASsl3R
+# |-------------- TMPDIR ----------------------|^|----------------- ssh-%C -----------------||---------------|
+#                                               |                                                   |
+#                                Note the path separator character.                   OPENSSH_CONTROL_PATH_SUFFIX_LENGTH
+#
+MAX_TMPDIR_LENGTH: Final = (
+    LINUX_MAX_SOCKET_LENGTH
+    - 1  # Path separator between tmpdir and the socket name.
+    # Keep the following in sync with `SSH_CONTROL_PATH`.
+    - len("ssh-")
+    - OPENSSH_PERCENT_C_LENGTH
+    - OPENSSH_CONTROL_PATH_SUFFIX_LENGTH
+)
+
+
 def make_tmpdir() -> TemporaryDirectory[str]:
-    tmp = gettempdir()
-    if len(tmp) >= 30:
+    prefix = "nixos-rebuild."
+    tmpdir = TemporaryDirectory(prefix=prefix)
+    if len(os.fsencode(tmpdir.name)) > MAX_TMPDIR_LENGTH:
+        short_tmpdir = TemporaryDirectory(prefix=prefix, dir="/tmp")
         logger.debug(
-            "tempdir '%s' exceeds 30 bytes limit, defaulting to /tmp instead",
-            tmp,
+            "tempdir '%s' exceeds %s bytes limit, defaulting to '%s' instead",
+            tmpdir,
+            MAX_TMPDIR_LENGTH,
+            short_tmpdir,
         )
 
-        return TemporaryDirectory(prefix="nixos-rebuild.", dir="/tmp")
+        tmpdir.cleanup()
+        return short_tmpdir
 
-    return TemporaryDirectory(prefix="nixos-rebuild.")
+    return tmpdir
 
 
 TMPDIR: Final = make_tmpdir()
 TMPDIR_PATH: Final = Path(TMPDIR.name)
+
+# Keep this in sync with `MAX_TMPDIR_LENGTH`!
+SSH_CONTROL_PATH: Final = str(TMPDIR_PATH / "ssh-%C")

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py

@@ -0,0 +1,56 @@
+import contextlib
+import os
+import tempfile
+import typing
+from pathlib import Path
+
+from nixos_rebuild.tmpdir import MAX_TMPDIR_LENGTH, make_tmpdir
+
+
+@contextlib.contextmanager
+def system_tempdir(path: Path) -> typing.Generator[None]:
+    path.mkdir(exist_ok=True)
+
+    # `tempfile` caches the tempdir, you must clear it for it to recompute.
+    tempfile.tempdir = None
+
+    og_tmpdir = os.environ.get("TMPDIR")
+
+    try:
+        os.environ["TMPDIR"] = str(path)
+        assert Path(tempfile.gettempdir()) == path
+        yield
+    finally:
+        if og_tmpdir is None:
+            del os.environ["TMPDIR"]
+        else:
+            os.environ["TMPDIR"] = og_tmpdir
+
+
+def test_make_tmpdir() -> None:
+    # Basic test: whatever the default system temp dir happens to be.
+    tmpdir = make_tmpdir()
+    tmp = Path(tmpdir.name)
+    assert tmp.exists()
+    assert tmp.is_dir()
+    assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
+
+    # Test with a short system temp dir. We should use it unmodified.
+    with system_tempdir(Path("/tmp/not-too-long")):
+        tmpdir = make_tmpdir()
+        tmp = Path(tmpdir.name)
+
+        assert tmp.exists()
+        assert tmp.is_dir()
+        assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
+
+    # Test with a long system temp dir. We should ignore
+    # it and fall back to something short enough for OpenSSH to
+    # create sockets in.
+    with system_tempdir(Path("/tmp/long" + ("g" * MAX_TMPDIR_LENGTH))):
+        tmpdir = make_tmpdir()
+        tmp = Path(tmpdir.name)
+
+        assert tmp.exists()
+        assert tmp.is_dir()
+        assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH

pkgs/by-name/rm/rmux/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rmux";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "Helvesec";
     repo = "rmux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W+H5MBh+EPkppdDaHMTPUVM1ZpPca/MeVOs/GM1x8UQ=";
+    hash = "sha256-73pSH4wowEWYyKQf1htbB0RnCw3qHe0rENr66eyFnM4=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-kGZczNoHKHWR4fpAvXRhldpYHVgSkIOgAa/OUSaZVvs=";
+  cargoHash = "sha256-YcCYMEM+u+Vq5mzqlL1rqyJmSYt2VxZNBt6cJ4t0Als=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/rq/rqlite/package.nix

@@ -12,13 +12,13 @@ buildGoModule (
   in
   {
     pname = "rqlite";
-    version = "10.2.4";
+    version = "10.2.6";
 
     src = fetchFromGitHub {
       owner = "rqlite";
       repo = "rqlite";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-Ays/H+nlS7Rien+0zutLMDx3cJDdURQNvXZn1XSwzuw=";
+      hash = "sha256-YFEvsEjpJSYoGEqYxVP9Qo6JRTD1peVP9a3Bf1hsdLU=";
     };
 
     vendorHash = "sha256-rWyDyypKbettuwL8tfXmkvKtIg5fm5EzZud2/5RL0kY=";

pkgs/by-name/sa/savepagenow/package.nix

@@ -16,8 +16,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sha256 = "sha256-ztM1g71g8SN1LTyFF7sxaLhC3+nVsC9fJwfYPjkUsdE=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   build-system = with python3Packages; [ setuptools-scm ];
 
   dependencies = with python3Packages; [

pkgs/by-name/se/secretspec/package.nix

@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "secretspec";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-Oj1CaiL0uGhlyrJK+xfKLH3f9wYDQTIiDTxop3BTnNs=";
+    hash = "sha256-pOlfDWFjhndp+Wq/UzL/bYcgQHkWTrnuUd7w2WiqJog=";
   };
 
-  cargoHash = "sha256-5VKiagAQnUIL1i36hQ+zUgScfBkg0uwKG3FMQdrlIq4=";
+  cargoHash = "sha256-ITv4MGpg11mnp5YbfUd/xd7dLl2ll21ybGCyTO4UAx4=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];

pkgs/by-name/sk/skypilot/package.nix

@@ -46,8 +46,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace sky/setup_files/dependencies.py --replace-fail 'casbin' 'pycasbin'
     substituteInPlace pyproject.toml --replace-fail 'buildkite-test-collector' ""

pkgs/by-name/tr/tree-sitter/grammars/README.md

@@ -109,6 +109,59 @@ This includes build-related flags and metadata.
 }
 ```
 
+## Overriding the Grammar Set
+
+Use `pkgs.tree-sitter-grammars.overrideScope` when adding a grammar or replacing a grammar that another package should consume.
+`pkgs.tree-sitter-grammars` is the scoped package set used for grammar overrides and scoped helpers such as `derivations`, `allGrammars`, and `withPlugins`.
+
+```nix
+let
+  grammars = pkgs.tree-sitter-grammars.overrideScope (
+    final: prev: {
+      tree-sitter-foolang = pkgs.tree-sitter.buildGrammar {
+        language = "foolang";
+        version = "0.42.0";
+        src = pkgs.fetchFromGitHub {
+          owner = "example";
+          repo = "tree-sitter-foolang";
+          rev = "v0.42.0";
+          hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        };
+      };
+
+      tree-sitter-rust = prev.tree-sitter-rust.overrideAttrs (_: {
+        version = "custom";
+        src = pkgs.fetchFromGitHub {
+          owner = "example";
+          repo = "tree-sitter-rust";
+          rev = "custom";
+          hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        };
+      });
+    }
+  );
+in
+grammars.withPlugins (p: [
+  p.tree-sitter-foolang
+  p.tree-sitter-rust
+])
+```
+
+The scoped `withPlugins` helper receives derivations from the same overridden scope, so added or replaced grammars are visible.
+
+The set also carries package-set helpers (`callPackage`, `newScope`, `overrideScope`, …) alongside the grammars, so do not iterate it directly.
+Use one of its grammar-only views instead; each reflects any `overrideScope`:
+
+- `pkgs.tree-sitter-grammars.derivations` — attrset of every grammar derivation, including grammars marked broken.
+- `pkgs.tree-sitter-grammars.allGrammars` — list of the non-broken grammar derivations.
+- `pkgs.tree-sitter-grammars.withPlugins` — build a grammar link farm.
+
+```nix
+builtins.attrValues pkgs.tree-sitter-grammars.derivations
+```
+
+`pkgs.tree-sitter.builtGrammars` remains the plain attribute set generated directly from [grammar-sources.nix](grammar-sources.nix); use it when you specifically want the stock grammars without any scope overrides.
+
 ## Building WebAssembly Parsers
 
 `buildGrammar` builds a native `$out/parser`.

pkgs/by-name/tr/tree-sitter/package.nix

@@ -75,26 +75,12 @@ let
   */
   builtGrammars = lib.mapAttrs (_: lib.makeOverridable buildGrammar) grammars;
 
-  /**
-    # Extensible package set for tree-sitter grammars.
-    # Provides .override and .extend for customization.
-    # Note: Use builtGrammars (not this) when iterating over grammars,
-    # as this includes package set functions alongside derivations
-  */
-  grammarsScope = lib.makeScope newScope (self: builtGrammars);
+  grammarDerivationsFrom = lib.filterAttrs (
+    name: value: lib.hasPrefix "tree-sitter-" name && lib.isDerivation value
+  );
 
-  # Usage:
-  # pkgs.tree-sitter.withPlugins (p: [ p.tree-sitter-c p.tree-sitter-java ... ])
-  #
-  # or for all grammars:
-  # pkgs.tree-sitter.withPlugins (_: pkgs.tree-sitter.allGrammars)
-  # which is equivalent to
-  # pkgs.tree-sitter.withPlugins (p: builtins.attrValues p)
-  withPlugins =
-    grammarFn:
-    let
-      grammars = grammarFn builtGrammars;
-    in
+  mkGrammarLinkFarm =
+    grammars:
     linkFarm "grammars" (
       map (
         drv:
@@ -112,7 +98,32 @@ let
       ) grammars
     );
 
-  allGrammars = lib.filter (p: !(p.meta.broken or false)) (lib.attrValues builtGrammars);
+  /**
+    Extensible package set of compiled tree-sitter grammars.
+
+    Exposed as `pkgs.tree-sitter-grammars` and `pkgs.tree-sitter.grammarsScope`.
+    Customize with `.overrideScope`; overrides propagate to every consumer that
+    reads the scope, including the grammar-only views below (which the
+    `pkgs.tree-sitter` passthru re-exports so there is a single source of truth):
+
+      `.derivations`  attrset of every grammar derivation
+      `.allGrammars`  list of non-broken grammar derivations
+      `.withPlugins`  build a grammar link farm
+
+    The scope also carries package-set helpers (`callPackage`, `overrideScope`,
+    …) alongside the grammars, so prefer one of the views above when iterating.
+  */
+  grammarsScope = lib.makeScope newScope (
+    self:
+    builtGrammars
+    // {
+      derivations = grammarDerivationsFrom self;
+      allGrammars = lib.filter (p: !(p.meta.broken or false)) (
+        lib.attrValues (grammarDerivationsFrom self)
+      );
+      withPlugins = grammarFn: mkGrammarLinkFarm (grammarFn (grammarDerivationsFrom self));
+    }
+  );
 
   isWasi = stdenv.hostPlatform.isWasi;
 
@@ -237,14 +248,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru = {
     inherit
-      grammars
       buildGrammar
       builtGrammars
+      grammars
       grammarsScope
-      withPlugins
-      allGrammars
       ;
 
+    # Keep legacy `pkgs.tree-sitter` views wired to the overridable scope.
+    inherit (grammarsScope) allGrammars withPlugins;
+
     updateScript = nix-update-script { };
 
     tests = {

pkgs/by-name/ty/ty/package.nix

@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.54";
+  version = "0.0.56";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-hbVH0dCUHkWKD9IG/CYhYI4TfLgpk++tPOkCD36eVSg=";
+    hash = "sha256-H5Tin3+OFSmlC2b86gPISE0ZK6+vR+ijYtJBzeyBgL4=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-Bf6nsUnNMYapP0YN0SBkTPoP1czmj35tPwN1awyKhUw=";
+  cargoHash = "sha256-suXPAZAQ4dddcHBwmdrpC4cUEs7CgTmW9Bn/v9Roe0U=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

pkgs/by-name/un/unifont/package.nix

@@ -9,21 +9,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unifont";
-  version = "17.0.04";
+  version = "17.0.05";
 
   otf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.otf";
-    hash = "sha256-0fZkqXU7nGt/81cSh0njK10+7pDHwDYYNj+r1Do5tbc=";
+    hash = "sha256-hXAaubHiUe4W9N8AsT8i6sMR1yt9q0J6fZdf5/UGRwI=";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.pcf.gz";
-    hash = "sha256-21hNQMglGdfPrx8VWP3lMT+/Guga7uoKbm72MqXjxJY=";
+    hash = "sha256-kld9gZ/QPhsu7IcqtFghB4qed4B6+Gp9IbbaOP72HNw=";
   };
 
   bdf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.bdf.gz";
-    hash = "sha256-mi3kgmOIJCdxEhx/4A5BJSPDGDGLjuOOa+bNRU5+yAI=";
+    hash = "sha256-2wERwGbt/nWD8Nd62+y7pGPwBkOjfcO5ZRrpNJVDSH8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xc/xclock/package.nix

@@ -2,10 +2,10 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
+  versionCheckHook,
   wrapWithXFileSearchPathHook,
   libx11,
   libxaw,
@@ -19,7 +19,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xclock";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -27,17 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "app";
     repo = "xclock";
     tag = "xclock-${finalAttrs.version}";
-    hash = "sha256-ZgUb+iVO45Az/C+2YJ1TXxcTLk3zQjM1GGv2E69WNfo=";
+    hash = "sha256-sytAl9vXBdxjTM0NnAgRNK34yqn/6zJeCQ/9bH3xaOc=";
   };
 
-  patches = [
-    # meson build system patch
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/xorg/app/xclock/-/commit/28e10bd26ac7e02fe8a4fb8016bb115f8d664032.patch";
-      hash = "sha256-KdrS7VneJqwVPB+TRJoMmtR03Ju3PvvUMYfXz5tII6k=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -62,6 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "appdefaultdir" "${placeholder "out"}/share/X11/app-defaults")
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=xclock-(.*)" ]; };
 
   meta = {
@@ -77,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
       mit
     ];
     mainProgram = "xclock";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ booxter ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/development/python-modules/amd-aiter/default.nix

@@ -90,7 +90,6 @@ buildPythonPackage (finalAttrs: {
     BUILD_TARGET = "rocm";
     PREBUILD_KERNELS = "0";
     ROCM_PATH = "${rocmPackages.clr}";
-    SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
   };
 
   build-system = [

pkgs/development/python-modules/cvxopt/default.nix

@@ -45,7 +45,6 @@ buildPythonPackage rec {
     CVXOPT_BUILD_DSDP = "0";
     CVXOPT_SUITESPARSE_LIB_DIR = "${lib.getLib suitesparse}/lib";
     CVXOPT_SUITESPARSE_INC_DIR = "${lib.getDev suitesparse}/include";
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
   }
   // lib.optionalAttrs withGsl {
     CVXOPT_BUILD_GSL = "1";

pkgs/development/python-modules/fastjet/default.nix

@@ -76,8 +76,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = {
     description = "Jet-finding in the Scikit-HEP ecosystem";
     homepage = "https://github.com/scikit-hep/fastjet";

pkgs/development/python-modules/flash-attn-4/default.nix

@@ -36,8 +36,6 @@ buildPythonPackage (finalAttrs: {
   # The top-level setup.py builds the classic compiled flash-attn and excludes flash_attn.cute.
   sourceRoot = "${finalAttrs.src.name}/flash_attn/cute";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   build-system = [
     setuptools
     setuptools-scm

pkgs/development/python-modules/formulaic/default.nix

@@ -29,6 +29,7 @@ buildPythonPackage rec {
     hash = "sha256-C4IUuyxBbW2DUxF4at8/736ZMmVZrFRRp+RxrJfmLkY=";
   };
 
+  # project uses a version-file that is not present in tagged releases
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   build-system = [

pkgs/development/python-modules/geoarrow-c/default.nix

@@ -41,8 +41,6 @@ buildPythonPackage rec {
     rm -v ./bootstrap.py
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
     pyarrow

pkgs/development/python-modules/geoarrow-pandas/default.nix

@@ -25,8 +25,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dependencies = [
     geoarrow-pyarrow
     geoarrow-types

pkgs/development/python-modules/geoarrow-pyarrow/default.nix

@@ -51,8 +51,6 @@ buildPythonPackage rec {
     pyarrow-hotfix
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
   ];

pkgs/development/python-modules/geoarrow-types/default.nix

@@ -22,8 +22,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
   ];

pkgs/development/python-modules/icalendar-compatibility/default.nix

@@ -46,8 +46,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "icalendar_compatibility" ];
 
-  # env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = {
     homepage = "https://icalendar-compatibility.readthedocs.io/en/latest/";
     changelog = "https://icalendar-compatibility.readthedocs.io/en/latest/changes.html";

pkgs/development/python-modules/linearmodels/default.nix

@@ -34,6 +34,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-/unFszNGaEPsoXDtaS3tsLnsX4A6e7Y88O8pDrf4nKc=";
   };
 
+  # tries to execute linearmodels/_build/git_version.py at build time
+  # which would require keeping the .git tree
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools_scm>=9.2.0,<10" "setuptools_scm"
@@ -46,8 +50,6 @@ buildPythonPackage (finalAttrs: {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   dependencies = [
     formulaic
     mypy-extensions

pkgs/development/python-modules/nicegui-highcharts/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nicegui-highcharts";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zauberzeug";
     repo = "nicegui-highcharts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/lQ2E2kcFjS3FbuOgixAu1E24dzwR/ppT0DRlRjrp6E=";
+    hash = "sha256-wzpgTDXTI3INQrkio6lgge07r+76wUKd193mt5ugc6g=";
   };
 
   pythonRelaxDeps = [ "docutils" ];

pkgs/development/python-modules/nipreps-versions/default.nix

@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-B2wtLurzgk59kTooH51a2dewK7aEyA0dAm64Wp+tqhM=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     flit-scm
     setuptools-scm

pkgs/development/python-modules/niworkflows/default.nix

@@ -52,6 +52,9 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-AMUOiIL33kcJtlKT+L5QwcUh8mBBkf80uzOQZFKDauo=";
   };
 
+  # fails to determine the version automatically
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
   pythonRelaxDeps = [ "traits" ];
 
   build-system = [
@@ -84,8 +87,6 @@ buildPythonPackage (finalAttrs: {
     transforms3d
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   nativeCheckInputs = [
     pytest-cov-stub
     pytest-env

pkgs/development/python-modules/pandera/default.nix

@@ -59,8 +59,6 @@ buildPythonPackage (finalAttrs: {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   dependencies = [
     packaging
     pydantic

pkgs/development/python-modules/pillow-jpls/default.nix

@@ -30,8 +30,6 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-Rc4/S8BrYoLdn7eHDBaoUt1Qy+h0TMAN5ixCAuRmfPU=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   dontUseCmakeConfigure = true;
 
   postPatch = ''

pkgs/development/python-modules/plotly/default.nix

@@ -37,32 +37,17 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plotly";
-  version = "6.7.0";
+  version = "6.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gykhl1aBgKCkJVv507UJk4xdYaruV/aU+JLYmvyFYbY=";
+    hash = "sha256-bXMFCRieoWNQZZA9eDTcZqO1vu71CMIk4+TlL0R9+5A=";
   };
 
-  patches = [
-    # https://numpy.org/devdocs/release/2.4.0-notes.html#removed-numpy-in1d
-    # Upstream PR: https://github.com/plotly/plotly.py/pull/5522
-    ./numpy-2.4-in1d.patch
-  ];
-
-  postPatch = ''
-    # `pytest_ignore_collect` takes only `collection_path` starting with
-    # pytest 9. Most of the paths referenced in `plotly/conftest.py`
-    # don't exist anymore and wouldn't be collected anyway, so we can just
-    # remove the file.
-    # https://docs.pytest.org/en/latest/deprecations.html#py-path-local-arguments-for-hooks-replaced-with-pathlib-path
-    # Upstream PR: https://github.com/plotly/plotly.py/pull/5521
-    rm plotly/conftest.py
-  '';
-
   env.SKIP_NPM = true;
 
   build-system = [

pkgs/development/python-modules/plotly/numpy-2.4-in1d.patch

@@ -1,38 +0,0 @@
-From 9531e7ff00be577560f2cebf6739343646d3c770 Mon Sep 17 00:00:00 2001
-From: Tom Hunze <dev@thunze.de>
-Date: Mon, 23 Feb 2026 19:21:45 +0100
-Subject: [PATCH] Use `np.isin` instead of `np.in1d` to fix numpy 2.4 test
- compatibility
-
-https://numpy.org/devdocs/release/2.4.0-notes.html#removed-numpy-in1d
----
- tests/test_optional/test_px/test_px.py           | 2 +-
- tests/test_optional/test_px/test_px_functions.py | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tests/test_optional/test_px/test_px.py b/tests/test_optional/test_px/test_px.py
-index 6c65925a727..a74c4680540 100644
---- a/tests/test_optional/test_px/test_px.py
-+++ b/tests/test_optional/test_px/test_px.py
-@@ -36,7 +36,7 @@ def test_custom_data_scatter(backend):
-     )
-     for data in fig.data:
-         assert np.all(
--            np.in1d(data.customdata[:, 1], iris.get_column("petal_width").to_numpy())
-+            np.isin(data.customdata[:, 1], iris.get_column("petal_width").to_numpy())
-         )
-     # Hover and custom data, no repeated arguments
-     fig = px.scatter(
-diff --git a/tests/test_optional/test_px/test_px_functions.py b/tests/test_optional/test_px/test_px_functions.py
-index 0814898f89d..8220ec7a33a 100644
---- a/tests/test_optional/test_px/test_px_functions.py
-+++ b/tests/test_optional/test_px/test_px_functions.py
-@@ -307,7 +307,7 @@ def test_sunburst_treemap_with_path_color(constructor):
-     fig = px.sunburst(
-         df.to_native(), path=path, color="sectors", color_discrete_map=cmap
-     )
--    assert np.all(np.in1d(fig.data[0].marker.colors, list(cmap.values())))
-+    assert np.all(np.isin(fig.data[0].marker.colors, list(cmap.values())))
- 
-     # Numerical column in path
-     df = (

pkgs/development/python-modules/pyfatfs/default.nix

@@ -40,8 +40,6 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = {

pkgs/development/python-modules/riscv-model/default.nix

@@ -20,8 +20,6 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-H4N9Z8aK/xV5gCCdsL+oiR+XQfYtCfBRBGLqvuztX+o=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   build-system = [
     setuptools
     setuptools-scm

pkgs/development/python-modules/trsfile/default.nix

@@ -20,8 +20,6 @@ buildPythonPackage (finalAttrs: {
 
   pyproject = true;
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   build-system = [
     setuptools
     setuptools-scm

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -5,43 +5,38 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.176",
-        "hash": "sha256:1xj4ms4gd8ghd0l0dzsyi762dgpdrmqhc3f0arrp7sa0p8npf6da",
+        "version": "6.1.177",
+        "hash": "sha256:0c0ayz4nygcmz4865r7mcgmh7hic4fi7zysnj6vdlyj53bz9nlpn",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.210",
-        "hash": "sha256:008a55av0x9fa3fspcz43sycik143gqxg2agcalrax2yw5ma82wi",
+        "version": "5.15.211",
+        "hash": "sha256:0qfry534wl5sbm6b4hf6fxqrr6mzf1k9pa2435sqp4hp6vjm9fdy",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.259",
-        "hash": "sha256:02dn8rf9p0afkl8kbdv28ijq974zfnv8zdsqcqbmapjm19c8wpma",
+        "version": "5.10.260",
+        "hash": "sha256:113bka32apz5pfqjfnv97k9hf9arkn5asfcd6cw7snsh65qjka27",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.143",
-        "hash": "sha256:0ci9b6kjp7r2xwqifs2963l9ihk2rllk4zpl2kgzbny0r66izkns",
+        "version": "6.6.144",
+        "hash": "sha256:1hzcax2ypzhrjzmq4b0jyqyc4al0ncyfcj9pq36phl29gcqbh6gc",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.94",
-        "hash": "sha256:1ln83ljmc7wr1nrjjq1hp1m1vx54j7i6i15m3hqb73a1p4ra5679",
+        "version": "6.12.95",
+        "hash": "sha256:1xmrsi0kimirky4cailnkkrbd72pp9n8irfx6lfmss8yrcgwbs59",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.37",
-        "hash": "sha256:0maj2ap1m09bxl6a3g9wc65h9sdr6y8rwc5qcqlbavb4wq0d4g58",
+        "version": "6.18.38",
+        "hash": "sha256:0igh9xy1lk2hv2jni00dqyy27j4zqh86waw7i65ryvnmmc4fa9mc",
         "lts": true
     },
-    "7.0": {
-        "version": "7.0.14",
-        "hash": "sha256:160ggaq9rh50a39gz02fpia8maq85bwxhqlwsc03yafjhjvrk6fy",
-        "lts": false
-    },
     "7.1": {
-        "version": "7.1.2",
-        "hash": "sha256:0gw8nnq6nix9xk2dhb1jwmhnqjayrn3bn2akzg4lgqkvfa9qq69p",
+        "version": "7.1.3",
+        "hash": "sha256:1p6iknvzmd04alrf49zn8mxw863v0yzgznyckfhl4llgx1lc0hdy",
         "lts": false
     }
 }

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.37";
-      hash = "sha256-8H8V9z8fizt/2DCTTCme0DVYOfJ4431SFs0iubUHONE=";
+      version = "6.18.38";
+      hash = "sha256-PJq69EQXiOJKgQnegxsEcJqAaL10G542Joh5dBrZN0I=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.0.14";
-      hash = "sha256-9vb4ORzAppq5S/ukEhDHohNQBW+jWwGnjhv21HztWdk=";
+      version = "7.1.3";
+      hash = "sha256-EvxKUWDp0KAKhYO4rZKKx22RCGOimzPm5epchME/pJ8=";
     };
   };
 

pkgs/top-level/all-packages.nix

@@ -5410,7 +5410,7 @@ with pkgs;
 
   tflint-plugins = recurseIntoAttrs (callPackage ../development/tools/analysis/tflint-plugins { });
 
-  tree-sitter-grammars = recurseIntoAttrs tree-sitter.builtGrammars;
+  tree-sitter-grammars = recurseIntoAttrs tree-sitter.grammarsScope;
 
   uhdMinimal = uhd.override {
     enableUtils = false;

pkgs/top-level/linux-kernels.nix

@@ -92,14 +92,6 @@ in
           ];
         };
 
-        linux_7_0 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "7.0";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
         linux_7_1 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "7.1";
           kernelPatches = [
@@ -175,6 +167,7 @@ in
         linux_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream";
         linux_6_17 = throw "linux 6.17 was removed because it has reached its end of life upstream";
         linux_6_19 = throw "linux 6.19 was removed because it has reached its end of life upstream";
+        linux_7_0 = throw "linux 7.0 was removed because it has reached its end of life upstream";
 
         linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
         linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
@@ -674,7 +667,6 @@ in
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
     linux_6_18 = recurseIntoAttrs (packagesFor kernels.linux_6_18);
-    linux_7_0 = recurseIntoAttrs (packagesFor kernels.linux_7_0);
     linux_7_1 = recurseIntoAttrs (packagesFor kernels.linux_7_1);
   }
   // lib.optionalAttrs config.allowAliases {
@@ -689,6 +681,7 @@ in
     linux_6_16 = throw "linux 6.16 was removed because it reached its end of life upstream"; # Added 2025-10-22
     linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22
     linux_6_19 = throw "linux 6.19 was removed because it reached its end of life upstream"; # Added 2026-04-23
+    linux_7_0 = throw "linux 7.0 was removed because it has reached its end of life upstream"; # Added 2026-06-27
   };
 
   rpiPackages = {

pkgs/top-level/python-packages.nix

@@ -20343,7 +20343,7 @@ self: super: with self; {
             "tree-sitter-sshclientconfig"
             "tree-sitter-templ"
           ])
-        ) pkgs.tree-sitter.builtGrammars
+        ) pkgs.tree-sitter-grammars.derivations
       )
   );