staging-next 2026-07-15 (#541843)

2026-07-20 15:41:43 +00:00
parent 49abf689d6 edc768bb34
commit 307e8e4aa0
672 changed files with 8229 additions and 2812 deletions
@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.
@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.
@@ -2920,7 +2920,8 @@
  "setup-hook-mpi-check": [
    "index.html#setup-hook-mpi-check"
  ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
    "index.html#setup-hook-omp-check"
  ],
  "ninja": [
@@ -31,6 +31,9 @@
  By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.

+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.

 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
@@ -116,8 +116,6 @@

  # test
  callPackage,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -254,11 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
    autoreconfHook
  ]
  ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];

  buildInputs = [
    gnutls
@@ -424,15 +418,10 @@ stdenv.mkDerivation (finalAttrs: {
      NATIVE_FULL_AOT = "1";
      LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
    }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      # workaround for ld64 hardening issue
-      #
-      # TODO: Clean up on `staging`
-      NIX_CFLAGS_COMPILE =
-        "-fuse-ld=lld"
-        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-        # See https://github.com/NixOS/nixpkgs/issues/127902
-        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs (variant == "macport") {
+      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+      # See https://github.com/NixOS/nixpkgs/issues/127902
+      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
    };

  enableParallelBuilding = true;
@@ -4,7 +4,7 @@
  stdenv,
 }:
 rec {
-  version = "9.2.0541";
+  version = "9.2.0782";

  outputs = [
    "out"
@@ -15,7 +15,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
  };

  enableParallelBuilding = true;
@@ -14,8 +14,6 @@
    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
    sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
  },
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 let
@@ -39,10 +37,6 @@ stdenv.mkDerivation {
  nativeBuildInputs = [
    gettext
    pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];
  buildInputs = [
    ncurses
@@ -50,13 +44,6 @@ stdenv.mkDerivation {
    gawk
  ];

-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
-  };
-
  strictDeps = true;

  configureFlags = [
@@ -48,9 +48,6 @@
  darwinSupport ? config.vim.darwin or false, # Enable Darwin support
  ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
  sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
-
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 let
@@ -172,9 +169,7 @@ stdenv.mkDerivation {
  ++ lib.optional nlsSupport gettext
  ++ lib.optional perlSupport perl
  ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner
-  # TODO: Clean up on `staging`
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optional waylandSupport wayland-scanner;

  buildInputs = [
    ncurses
@@ -201,10 +196,7 @@ stdenv.mkDerivation {
  ++ lib.optional sodiumSupport libsodium;

  # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";

  preConfigure = lib.optionalString ftNixSupport ''
    cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim
@@ -17,8 +17,6 @@
  # This can be set to one of the `darwin.xcode_*` packages as well.
  # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
  withXcodePath ? null,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 # Try to match MacVim's documented script interface compatibility
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    pkg-config
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
  ];
  buildInputs = [
    # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -192,8 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
  # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
  hardeningDisable = common.hardeningDisable ++ [ "format" ];
  # os_log also enables -Werror,-Wformat by default
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";

  # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
  # it's not clear what system-level components it may require, so for now we'll just allow full
@@ -34,7 +34,6 @@
  libjxl,
  libicns,
  apple-sdk_15,
-  llvmPackages,
  nix-update-script,
 }:

@@ -66,11 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    gobject-introspection
-  ]
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];

  buildInputs = [
@@ -107,12 +101,6 @@ stdenv.mkDerivation (finalAttrs: {

  dontWrapQtApps = true;

-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  cmakeFlags = [
    # We're allowed to used the API ID of the Snap package:
    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
@@ -27,7 +27,6 @@
  pkg-config,
  bison,
  which,
-  llvmPackages,
  jdk,
  blas,
  lapack,
@@ -69,10 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    tzdata
    which
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
-
+  ];
  buildInputs = [
    bzip2
    gfortran
@@ -130,11 +126,6 @@ stdenv.mkDerivation (finalAttrs: {

  dontDisableStatic = static;

-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  preConfigure = ''
    configureFlagsArray=(
      --disable-lto
@@ -40,6 +40,9 @@ lib.extendMkDerivation {
    {
      name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";

+      strictDeps = true;
+      __structuredAttrs = true;
+
      dontBuild = true;

      installPhase =
@@ -53,10 +53,13 @@
  ];

  # GCC
+  # The commented out ones don't seem to be keeping up with the latest releases
+  # as of 2026-07-07 they don't have tarballs for 14.4 or 15.3
  gcc = [
-    "https://mirror.koddos.net/gcc/"
-    "https://bigsearcher.com/mirrors/gcc/"
-    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
+    # "https://mirror.koddos.net/gcc/"
+    # "https://bigsearcher.com/mirrors/gcc/"
+    "https://mirrorservice.org/sites/sourceware.org/pub/gcc/"
+    # "ftp://ftp.nluug.nl/mirror/languages/gcc/"
    "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
    "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
    "ftp://gcc.gnu.org/pub/gcc/"
@@ -320,10 +320,15 @@ lib.extendMkDerivation {
              }

              getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                else
                  find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                fi
@@ -3,6 +3,8 @@
 # assertExecutable FILE
 assertExecutable() {
    local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
    [[ -f "$file" && -x "$file" ]] || \
        die "Cannot wrap '$file' because it is not an executable file"
 }
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alsa-lib";
-  version = "1.2.16";
+  version = "1.2.16.1";

  src = fetchurl {
    url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
+    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
  };

  patches = [
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
    description = "ALSA, the Advanced Linux Sound Architecture libraries";
    mainProgram = "aserver";

@@ -9,11 +9,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alsa-ucm-conf";
-  version = "1.2.16";
+  version = "1.2.16.1";

  src = fetchurl {
    url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
+    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
  };

  patches = [
@@ -47,6 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  meta = {
    homepage = "https://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
    description = "ALSA Use Case Manager configuration";

    longDescription = ''
@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
    description = "ALSA, the Advanced Linux Sound Architecture utils";
    longDescription = ''
      The Advanced Linux Sound Architecture (ALSA) provides audio and
@@ -30,15 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
  '';

-  patches = [
-    (fetchpatch {
-      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
-      # Patches generated yacc parser code to compile with format-security
-      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
-      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
-    })
-  ];
-
  nativeBuildInputs = [
    bison
    flex
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3

 import argparse
+import errno
 import os
 import pprint
 import subprocess
@@ -195,6 +196,12 @@ def populate_cache(initial: list[Path], recursive: bool =False) -> None:
            except ELFError:
                # Not an ELF file in the right format
                pass
+            except OSError as e:
+                if e.errno == errno.EINVAL:
+                    # pyelftools can raise EINVAL for certain compressed sections.
+                    pass
+                else:
+                    raise


 def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
@@ -343,6 +350,10 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app

    except ELFError:
        return []
+    except OSError as e:
+        if e.errno == errno.EINVAL:
+            return []
+        raise

    # these platforms are packaged in nixpkgs with ld.so in a separate derivation
    # than libc.so and friends. keep_libc is mandatory.
@@ -11,7 +11,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bash-completion";
-  version = "2.17.0";
+  version = "2.18.0";

  # Using fetchurl because fetchGithub or fetchzip will have trouble on
  # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
  # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
  src = fetchurl {
    url = "https://github.com/scop/bash-completion/releases/download/${finalAttrs.version}/bash-completion-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
+    hash = "sha256-iLz4UST3f3Ty8vi80WrEOC2AeoJ+3nQqZJQMcRauoz8=";
  };

  postPatch = ''
@@ -3,7 +3,7 @@
  stdenv,
  lapack-reference,
  openblas,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
  isILP64 ? false,
  blasProvider ? openblas,
 }:
@@ -188,7 +188,7 @@ stdenv.mkDerivation {
  ];

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];

  meta = (blasProvider'.meta or { }) // {
@@ -5,6 +5,12 @@
  perl,
  python3,

+  # sets BLIS_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking blis during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading
+  checkPhaseThreadLimitHook,
+
  # Enable BLAS interface with 64-bit integer width.
  blas64 ? false,

@@ -36,6 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
    python3
  ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
  doCheck = true;

  enableParallelBuilding = true;
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  llvmPackages,
  testers,
  nix-update-script,
 }:
@@ -18,12 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Qw5c9dp7wpuOcQSLsg1pfJ+NbrEtme2o6nKD3Ba3A3M=";
  };

-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  nativeBuildInputs = [ llvmPackages.lld ];
-
  env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  env.NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";

  installPhase = ''
    runHook preInstall
@@ -4,6 +4,7 @@
  acl,
  e2fsprogs,
  fetchFromGitHub,
+  fetchpatch,
  libb2,
  lz4,
  openssh,
@@ -32,6 +33,26 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    hash = "sha256-pMZr9cVr84b948b5Iuevpy6AtMeYo/Ma8uFLuagAYy4=";
  };

+  patches = [
+    (fetchpatch {
+      name = "msgspec-1.2.0-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/364438f58c86aebd157b55bd2202afaf5945e008.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-YhZDD6i2cn7p00Dgmpqi8uGJzFZzixMZmHPcZroB1sE=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/8abdd3b8bf065dceecd52d2b22d92b3c407a7c1d.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-bvSRxEzNvejG6PQFkeNDuQB7Zd4/EYPEZkrgjpgQ9Ss=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-unpacker-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/b09bbed3de095d6ac9d69a42a486ec18523046dc.patch";
+      hash = "sha256-F8CIqOcQOLdYn7srsev2op0pgkgt8zdkc5DQUH1c6xg=";
+    })
+  ];
+
  postPatch = ''
    # sandbox does not support setuid/setgid/sticky bits
    substituteInPlace src/borg/testsuite/archiver.py \
@@ -103,7 +124,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    py
    pytest-benchmark
    pytest-xdist
-    pytestCheckHook
+    pytest9_0CheckHook
    versionCheckHook
  ];

@@ -18,7 +18,7 @@

 stdenv.mkDerivation rec {
  pname = "c-ares";
-  version = "1.34.6";
+  version = "1.34.8";

  strictDeps = true;
  __structuredAttrs = true;
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
  src = fetchurl {
    # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
    url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";
-    hash = "sha256-kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=";
+    hash = "sha256-wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g=";
  };

  outputs = [
@@ -5,7 +5,6 @@
  apple-sdk,
  darwin,
  xcbuildHook,
-  llvmPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -32,8 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    xcbuildHook
    darwin.autoSignDarwinBinariesHook
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
  ];

  buildInputs = [
@@ -45,9 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
    "-configuration Release"
  ];

-  # TODO: Remove once #536365 reaches this branch
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
  installPhase = ''
    runHook preInstall

@@ -42,20 +42,9 @@ lib.extendMkDerivation {
        # https://github.com/rust-secure-code/cargo-auditable/issues/235
        "--skip=test_proc_macro"
        "--skip=test_self_hosting"
-      ]
-      # TODO: Clean up on `staging`.
-      ++
-        lib.optionals
-          (
-            stdenv.hostPlatform.isMusl
-            || stdenv.hostPlatform.isAarch32
-            || stdenv.hostPlatform.isDarwin
-            || stdenv.hostPlatform.isMsvc
-          )
-          [
-            # Expects `linker = "rust-lld"` to work.
-            "--skip=test_bare_linker"
-          ];
+        # Expects `linker = "rust-lld"` to work.
+        "--skip=test_bare_linker"
+      ];

      postInstall = ''
        installManPage cargo-auditable/cargo-auditable.1
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "catch2";
-  version = "3.15.0";
+  version = "3.15.2";

  src = fetchFromGitHub {
    owner = "catchorg";
    repo = "Catch2";
    tag = "v${version}";
-    hash = "sha256-1GBzS8jgJXb82BMMRuHWqszB1Xwg6wohmCuINWE7QoU=";
+    hash = "sha256-Fb8dnuaKQwLxYmGDZy38ZsCKk6RwE4PSidD1xmnb1rU=";
  };

  patches = lib.optionals stdenv.cc.isClang [
@@ -0,0 +1,32 @@
+setupThreadLimit() {
+  # Limit number of threads used during checks. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+
+  # global value to override all of these at once
+  NIX_CHECK_PHASE_DEFAULT_NUM_THREADS="${NIX_CHECK_PHASE_DEFAULT_NUM_THREADS:-1}"
+
+  thread_vars=(
+    OMP_NUM_THREADS
+    OPENBLAS_NUM_THREADS
+    MKL_NUM_THREADS
+    BLIS_NUM_THREADS
+    VECLIB_MAXIMUM_THREADS
+    NUMBA_NUM_THREADS
+    NUMEXPR_NUM_THREADS
+  )
+
+  echo "setting known thread variables to default: $NIX_CHECK_PHASE_DEFAULT_NUM_THREADS"
+  for var in "${thread_vars[@]}"; do
+    export "$var=${!var:-$NIX_CHECK_PHASE_DEFAULT_NUM_THREADS}"
+    printf " %s=%s" "$var" "${!var}"
+  done
+  printf "\n"
+}
+
+
+if [[ -z "${dontLimitCheckPhaseThreads-}" ]]; then
+    echo "Using checkPhaseThreadLimitHook"
+    preCheckHooks+=('setupThreadLimit')
+    preInstallCheckHooks+=('setupThreadLimit')
+fi
@@ -0,0 +1,15 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "check-phase-thread-limit-hook";
+
+  __structuredAttrs = true;
+
+  meta = {
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh
@@ -46,16 +46,3 @@ index 15a1e2c0c3..33bb304cf7 100644
         OUTPUT_VARIABLE OSX_VERSION
         OUTPUT_STRIP_TRAILING_WHITESPACE
         )
-diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index ddc975c202..8ff651fd90 100644
--- a/Utilities/cmcurl/CMakeLists.txt
-+++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -127,7 +127,7 @@
-     set(OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
-   else()
-     execute_process(
-      COMMAND sw_vers -productVersion
-+      COMMAND @sw_vers@ -productVersion
-       OUTPUT_VARIABLE OSX_VERSION
-       OUTPUT_STRIP_TRAILING_WHITESPACE
-       )
@@ -39,13 +39,13 @@ index 260b6631c0..ffb8fcd8d2 100644
     if(ProcessorCount_cmd_sysctl)
       execute_process(COMMAND ${ProcessorCount_cmd_sysctl} -n hw.ncpu
 diff --git a/Source/kwsys/ProcessUNIX.c b/Source/kwsys/ProcessUNIX.c
-index a918b8d9a7..36145707e1 100644
+index 8c22b4e43a..6d9ccef5e7 100644
 --- a/Source/kwsys/ProcessUNIX.c
 +++ b/Source/kwsys/ProcessUNIX.c
-@@ -2503,7 +2503,7 @@
-    have two integers to store: the pid and then the ppid.  */
+@@ -2503,7 +2503,7 @@ static pid_t kwsysProcessFork(kwsysProcess* cp,
 #if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) ||       \
-   defined(__OpenBSD__) || defined(__GLIBC__) || defined(__GNU__)
+   defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GLIBC__) ||        \
+   defined(__GNU__)
 -#  define KWSYSPE_PS_COMMAND "ps axo pid,ppid"
 +#  define KWSYSPE_PS_COMMAND "@ps@ axo pid,ppid"
 #  define KWSYSPE_PS_FORMAT "%d %d\n"
@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString isMinimalBuild "-minimal"
    + lib.optionalString cursesUI "-cursesUI"
    + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.2";
+  version = "4.3.4";

  src = fetchurl {
    url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
+    hash = "sha256-/e/4l7nrSddkU58rHtxut+FEDfMlZ4qXwZeEmekxrdo=";
  };

  patches = [
@@ -157,10 +157,10 @@ index 2a2f478fd7..f22281bdca 100644
 list(REMOVE_DUPLICATES _CPACK_IFW_PATHS)
 
 diff --git a/Modules/FindBLAS.cmake b/Modules/FindBLAS.cmake
-index b45a279b94..884ccc0e32 100644
+index 9f986a78e7..5a6a9758ea 100644
 --- a/Modules/FindBLAS.cmake
 +++ b/Modules/FindBLAS.cmake
-@@ -1098,16 +1098,8 @@
+@@ -1112,16 +1112,10 @@ if(BLA_VENDOR MATCHES "ACML" OR BLA_VENDOR STREQUAL "All")
     ((BLA_VENDOR STREQUAL "ACML_GPU") AND (NOT BLAS_ACML_GPU_LIB_DIRS))
     )
   # try to find acml in "standard" paths
@@ -176,9 +176,11 @@ index b45a279b94..884ccc0e32 100644
 -  endif()
 +  set(_ACML_ROOT)
 +  set(_ACML_GPU_ROOT)
-   list(GET _ACML_ROOT 0 _ACML_ROOT)
-   list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
+  list(GET _ACML_ROOT 0 _ACML_ROOT)
+  list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
   if(_ACML_ROOT)
+     list(GET _ACML_ROOT 0 _ACML_ROOT)
+     list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
 diff --git a/Modules/FindCUDA.cmake b/Modules/FindCUDA.cmake
 index bceb615ca0..2350b15655 100644
 --- a/Modules/FindCUDA.cmake
@@ -229,26 +231,13 @@ index bceb615ca0..2350b15655 100644
 
 # Example of how to find an include file from the CUDA_SDK_ROOT_DIR
 diff --git a/Modules/FindCUDAToolkit.cmake b/Modules/FindCUDAToolkit.cmake
-index b00cd26b7e..f5f74ebe1d 100644
+index df36f9a19b..825d1e7386 100644
 --- a/Modules/FindCUDAToolkit.cmake
 +++ b/Modules/FindCUDAToolkit.cmake
-@@ -776,12 +776,6 @@
-       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
-         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
-         break()
-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
-        break()
-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
-        break()
-       endif()
-     endforeach()
-   endfunction()
-@@ -864,18 +858,8 @@
-   # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
-   # directory is the desired location.
-   if(NOT CUDAToolkit_ROOT_DIR)
+@@ -830,18 +830,9 @@ else()
+     # We will also search the default symlink location /usr/local/cuda first since
+     # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
+     # directory is the desired location.
 -    if(UNIX)
 -      if(NOT APPLE)
 -        set(platform_base "/usr/local/cuda-")
@@ -258,14 +247,14 @@ index b00cd26b7e..f5f74ebe1d 100644
 -    else()
 -      set(platform_base "C:\\Program Files\\NVIDIA GPU Computing Toolkit\\CUDA\\v")
 -    endif()
-
+ 
     # Build out a descending list of possible cuda installations, e.g.
 -    file(GLOB possible_paths "${platform_base}*")
 +    set(possible_paths)
     # Iterate the glob results and create a descending list.
     set(versions)
     foreach(p ${possible_paths})
-@@ -891,14 +875,6 @@
+@@ -857,14 +848,6 @@ else()
 
     # With a descending list of versions, populate possible paths to search.
     set(search_paths)
@@ -280,6 +269,19 @@ index b00cd26b7e..f5f74ebe1d 100644
 
     # Now search for the toolkit again using the platform default search paths.
     _CUDAToolkit_find_root_dir(SEARCH_PATHS "${search_paths}" FIND_FLAGS PATH_SUFFIXES bin)
+@@ -889,12 +872,6 @@ else()
+       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
+         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
+         break()
+-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+       endif()
+     endforeach()
+   endfunction()
 diff --git a/Modules/FindCoin3D.cmake b/Modules/FindCoin3D.cmake
 index 1d89c604e0..5b70e71a87 100644
 --- a/Modules/FindCoin3D.cmake
@@ -579,10 +581,10 @@ index 82156747d3..cc3f2a64af 100644
        "Ice-${Ice_VERSION_SLICE2CPP_FULL}/slice"
        "Ice-${Ice_VERSION_SLICE2CPP_SHORT}/slice"
 diff --git a/Modules/FindJNI.cmake b/Modules/FindJNI.cmake
-index 10dcc51776..e272bd9583 100644
+index a70b00f330..1962b55d4a 100644
 --- a/Modules/FindJNI.cmake
 +++ b/Modules/FindJNI.cmake
-@@ -363,51 +363,6 @@
+@@ -367,56 +367,6 @@ if (WIN32)
 endif()
 
 set(_JNI_JAVA_DIRECTORIES_BASE
@@ -604,6 +606,11 @@ index 10dcc51776..e272bd9583 100644
 -  # Arch Linux specific paths for default JVM
 -  /usr/lib/jvm/default
 -  # Ubuntu specific paths for default JVM
+-  /usr/lib/jvm/java-26-openjdk-{libarch}
+-  /usr/lib/jvm/java-25-openjdk-{libarch}    # Ubuntu 24.04 LTS
+-  /usr/lib/jvm/java-24-openjdk-{libarch}
+-  /usr/lib/jvm/java-23-openjdk-{libarch}
+-  /usr/lib/jvm/java-22-openjdk-{libarch}
 -  /usr/lib/jvm/java-21-openjdk-{libarch}    # Ubuntu 23.04
 -  /usr/lib/jvm/java-20-openjdk-{libarch}    # Ubuntu 22.10
 -  /usr/lib/jvm/java-19-openjdk-{libarch}    # Ubuntu 22.04 LTS
@@ -1093,28 +1100,28 @@ index edef791cb8..5515f44710 100644
 
 find_path(PHP4_FOUND_INCLUDE_PATH main/php.h
 diff --git a/Modules/FindPerlLibs.cmake b/Modules/FindPerlLibs.cmake
-index 330700e183..7fc89df6eb 100644
+index fbe1aade72..34562e7807 100644
 --- a/Modules/FindPerlLibs.cmake
 +++ b/Modules/FindPerlLibs.cmake
-@@ -141,10 +141,6 @@
+@@ -176,10 +176,6 @@ if (PERL_EXECUTABLE)
     PATHS
       "${PERL_UPDATE_ARCHLIB}/CORE"
       "${PERL_ARCHLIB}/CORE"
-      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
-      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
-      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
-      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
   )
 
   ### PERL_LIBRARY
-@@ -154,10 +150,6 @@
+@@ -189,10 +185,6 @@ if (PERL_EXECUTABLE)
     PATHS
       "${PERL_UPDATE_ARCHLIB}/CORE"
       "${PERL_ARCHLIB}/CORE"
-      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
-      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
-      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
-      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
   )
 
 endif ()
@@ -1343,17 +1350,21 @@ index 2c62a5f17f..772a8d88f6 100644
   PATH_SUFFIXES
     bin lib/qt lib/qt3 qt qt3 qt/bin qt3/bin lib/qt/bin lib/qt3/bin
 diff --git a/Modules/FindRuby.cmake b/Modules/FindRuby.cmake
-index 18b9e35855..dba9976565 100644
+index 863f70a7f2..17e3ac606a 100644
 --- a/Modules/FindRuby.cmake
 +++ b/Modules/FindRuby.cmake
-@@ -367,7 +367,6 @@
-           HINTS
-           ${Ruby_HDR_DIR}
-           ${Ruby_ARCH_DIR}
-          /usr/lib/ruby/${_Ruby_VERSION_SHORT}/i586-linux-gnu/
- )
+@@ -366,11 +366,6 @@ if (NOT Ruby_EXECUTABLE AND Ruby_FIND_VIRTUALENV MATCHES "^(FIRST|ONLY)$")
+   endif ()
+ endif ()
 
- set(Ruby_INCLUDE_DIRS ${Ruby_INCLUDE_DIR})
+-# Check for Homebrew Ruby (non-virtualenv, common on MacOS)
+-if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+-  _RUBY_CHECK_BREW()
+-endif ()
+-
+ # Fallback to system installed Ruby
+ if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+   _RUBY_CHECK_SYSTEM()
 diff --git a/Modules/FindSDL.cmake b/Modules/FindSDL.cmake
 index a720dcc3df..73e222a27c 100644
 --- a/Modules/FindSDL.cmake
@@ -1644,6 +1655,20 @@ index 7c4f123a1d..4cfd53de9f 100644
 
 if(NOT CMAKE_CROSSCOMPILING)
   execute_process(COMMAND @sw_vers@ -productVersion
+@@ -277,13 +277,6 @@ if(NOT CMAKE_OSX_SYSROOT)
+     RESULT_VARIABLE _result
+   )
+   unset(_sdk_macosx)
+-
+-  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES_EXCLUDE
+-    # Without -isysroot, some compiler drivers implicitly pass -L/usr/local/lib
+-    # to the linker.  Since the macOS dynamic loader does not search it by
+-    # default, it is not a fully-implemented implicit link directory.
+-    /usr/local/lib
+-  )
+ endif()
+ 
+ #----------------------------------------------------------------------------
 diff --git a/Modules/Platform/Darwin.cmake b/Modules/Platform/Darwin.cmake
 index 42c6b35424..f2985f3765 100644
 --- a/Modules/Platform/Darwin.cmake
@@ -1905,10 +1930,10 @@ index b977d955ca..5ff835298d 100644
     set(_jar_doc "NOTSET")
 
 diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index 8ff651fd90..9659deedf5 100644
+index 2c6a6e6a19..3a43da619a 100644
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -1826,43 +1826,6 @@
+@@ -1566,43 +1566,6 @@ if(_curl_ca_bundle_supported)
   endif()
   mark_as_advanced(CURL_CA_PATH_SET)
 
@@ -1929,8 +1954,8 @@ index 8ff651fd90..9659deedf5 100644
 -        if(EXISTS "${_search_ca_bundle_path}")
 -          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
 -          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
-            STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -          break()
 -        endif()
 -      endforeach()
@@ -1943,8 +1968,8 @@ index 8ff651fd90..9659deedf5 100644
 -        unset(_curl_ca_files_found)
 -        message(STATUS "Found CA path: ${_search_ca_path}")
 -        set(CURL_CA_PATH "${_search_ca_path}" CACHE
-          STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -      endif()
 -    endif()
 -  endif()
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  ];

  nativeCheckInputs = with python3.pkgs; [
-    aspell-python
+    aspell-python-py3
    chardet
    pytestCheckHook
    pytest-cov-stub
@@ -6,6 +6,8 @@
  perl,
  nixosTests,
  autoreconfHook,
+  buildPackages,
+  runtimeShellPackage,
  brotliSupport ? false,
  brotli,
  c-aresSupport ? false,
@@ -82,6 +84,9 @@ assert
    ]) > 1
  );

+let
+  isCross = !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
  version = "8.21.0";
@@ -241,7 +246,20 @@ stdenv.mkDerivation (finalAttrs: {
    ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}
    ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
    ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
+  ''
+  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
+  # source along with all the scripts patched in `postPatch` above.
+  # `patchShebangs` at that stage causes the host intended wcurl script to get
+  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
+  # make sure this doesn't happen we disallow it, and fix it above in the
+  # postInstall, and also with the conditional hostPlatform's
+  # runtimeShellPackage added in buildInputs.
+  + lib.optionalString isCross ''
+    patchShebangs --update --host "''${!outputBin}/bin"
  '';
+  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  buildInputs = lib.optional isCross runtimeShellPackage;

  passthru =
    let
@@ -103,8 +103,7 @@ stdenv.mkDerivation rec {
    pkg-config
    wrapGAppsHook3
    saxon # Use Saxon instead of libxslt to fix XSLT generate-id() consistency issues
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  ];

  buildInputs = [
    SDL2
@@ -185,12 +184,6 @@ stdenv.mkDerivation rec {
    "-DUSE_KWALLET=OFF"
  ];

-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  # darktable changed its rpath handling in commit
  # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
  # binaries can't find libdarktable.so, so change LD_LIBRARY_PATH in
@@ -98,6 +98,11 @@ let
            tag = version;
            hash = "sha256-ZYEjT/yShfA4+zpbGOtaFOx1nSSOWPtMvskPhHv3c9U=";
          };
+
+          postPatch = ''
+            substituteInPlace py_ext/setup.py \
+              --replace-fail "0.2.0" "${version}"
+          '';
        }
      );
    };
@@ -1,16 +1,11 @@
 {
  lib,
  stdenv,
-  python312,
+  python3Packages,
  fetchFromGitHub,
 }:

-let
-  # more-itertools unsupported on 3.13
-  python3 = python312;
-in
-
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dmarc-metrics-exporter";
  version = "1.3.1";

@@ -25,15 +20,14 @@ python3.pkgs.buildPythonApplication (finalAttrs: {

  pythonRelaxDeps = true;

-  build-system = with python3.pkgs; [
+  build-system = with python3Packages; [
    poetry-core
  ];

  dependencies =
-    with python3.pkgs;
+    with python3Packages;
    [
      bite-parser
-      dataclasses-serialization
      prometheus-client
      pydantic
      structlog
@@ -42,7 +36,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    ]
    ++ uvicorn.optional-dependencies.standard;

-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
    aiohttp
    pytest-asyncio
    pytestCheckHook
@@ -152,11 +152,12 @@ stdenv.mkDerivation (finalAttrs: {
      );
      LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
    in
+    # FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB).
    ''
      runHook preInstallCheck
      (($(ulimit -n) < 1024)) && ulimit -n 1024

-      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}
+      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"}

      runHook postInstallCheck
    '';
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.3",
-  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
-  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
-  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
+  "version": "1.5.4",
+  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
+  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
+  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
 }
@@ -35,8 +35,6 @@
  withShared ? true,

  nix-update-script,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -70,10 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals withDocs [
    doxygen
    graphviz
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];

  buildInputs =
@@ -145,12 +139,6 @@ stdenv.mkDerivation (finalAttrs: {

    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
-  ]
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
  ];

  preBuild = lib.optionalString (withCairo && withShared && stdenv.hostPlatform.isDarwin) ''
@@ -46,8 +46,6 @@
  withExamples ? (stdenv.buildPlatform == stdenv.hostPlatform),

  nix-update-script,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 # pango support depends on Xft
@@ -86,10 +84,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals withDocs [
    doxygen
    graphviz
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];

  buildInputs =
@@ -175,12 +169,6 @@ stdenv.mkDerivation (finalAttrs: {

    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
-  ]
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
  ];

  postBuild = lib.optionalString withDocs ''
@@ -60,7 +60,7 @@ let
    yubico
    setuptools
    jinja2
-    augeas
+    python-augeas
    samba
    ifaddr
  ];
@@ -13,8 +13,6 @@
  vulkan-headers,
  vulkan-loader,
  libx11,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -43,10 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
    ninja
    pkg-config
    python3
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];
  buildInputs = [
    aemu
@@ -66,8 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
      "-framework QuartzCore"
      "-needed-lvulkan"
    ];
-    # TODO: Clean up on `staging`.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
  };

  # dlopens libvulkan.
@@ -1,15 +0,0 @@
-diff -ur a/Makefile b/Makefile
--- a/Makefile	2026-02-14 15:58:16.624434564 -0500
-+++ b/Makefile	2026-02-14 15:59:25.701016105 -0500
-@@ -4059,9 +4059,9 @@
- contrib/libgit-sys/libgitpub.a: $(LIBGIT_HIDDEN_EXPORT)
- 	$(AR) $(ARFLAGS) $@ $^
- 
-contrib/credential/osxkeychain/git-credential-osxkeychain: contrib/credential/osxkeychain/git-credential-osxkeychain.o $(LIB_FILE) GIT-LDFLAGS
-+contrib/credential/osxkeychain/git-credential-osxkeychain: contrib/credential/osxkeychain/git-credential-osxkeychain.o $(LIB_FILE) $(RUST_LIB) GIT-LDFLAGS
- 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) \
-		$(filter %.o,$^) $(LIB_FILE) $(EXTLIBS) -framework Security -framework CoreFoundation
-+		$(filter %.o,$^) $(LIB_FILE) $(RUST_LIB) $(EXTLIBS) -framework Security -framework CoreFoundation
- 
- contrib/credential/osxkeychain/git-credential-osxkeychain.o: contrib/credential/osxkeychain/git-credential-osxkeychain.c GIT-CFLAGS
- 	$(QUIET_LINK)$(CC) -o $@ -c $(dep_args) $(compdb_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $<
@@ -55,6 +55,7 @@
  rustSupport ? lib.meta.availableOn stdenv.hostPlatform rustc,
  cargo,
  rustc,
+  nix-update-script,
 }:

 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
@@ -62,7 +63,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.54.0";
+  version = "2.55.0";
  svn = subversionClient.override { perlBindings = perlSupport; };
  gitwebPerlLibs = with perlPackages; [
    CGI
@@ -104,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
        }.tar.xz"
      else
        "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-9okWI2TBDeee+Jqo2/SHMesFfjTtu9IKylEM4BVGgaM=";
+    hash = "sha256-RX/bBNyHKOAH1GiGleaRLm9oByeSDypAvxHqzBdQU1c=";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -132,17 +133,6 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
      hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
    })
-    # Address test failure (new in 2.52.0) caused by `git-gui--askyesno` being
-    # installed by `make install`.
-    (fetchurl {
-      name = "expect-gui--askyesno-failure-in-t1517.patch";
-      url = "https://lore.kernel.org/git/20251201031040.1120091-1-brianmlyles@gmail.com/raw";
-      hash = "sha256-vvhbvg74OIMzfksHiErSnjOZ+W0M/T9J8GOQ4E4wKbU=";
-    })
-  ]
-  ++ lib.optionals rustSupport [
-    # The above patch doesn’t work with Rust support enabled.
-    ./osxkeychain-link-rust_lib.patch
  ]
  ++ lib.optionals withSsh [
    # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
@@ -271,7 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
  # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
  ++ lib.optional stdenv.hostPlatform.isDarwin "TKFRAMEWORK=/nonexistent"
  # Starting with future Git version 3.0.0, rust will be mandatory. For now, it's optional.
-  ++ lib.optional rustSupport "WITH_RUST=YesPlease";
+  ++ lib.optional (!rustSupport) "NO_RUST=YesPlease";

  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    stdenv.shellPackage
@@ -492,6 +482,13 @@ stdenv.mkDerivation (finalAttrs: {
  installCheckFlags = [
    "DEFAULT_TEST_TARGET=prove"
    "PERL_PATH=${buildPackages.perl}/bin/perl"
+
+    # Without setting debug explicitly, the test suite inherits the value of
+    # debug from the environment, which -- if separateDebugInfo is true -- will
+    # be the debug output path.  The test suite then prints out extra debug
+    # info, as if `--debug` were passed on the command line, which causes test
+    # failures because that info can't be interpreted by the test harness.
+    "debug="
  ];

  nativeInstallCheckInputs = lib.optional (
@@ -552,6 +549,18 @@ stdenv.mkDerivation (finalAttrs: {
    disable_test t7513-interpret-trailers
    disable_test t2200-add-update

+    # Fails when run with GIT_TEST_INSTALLED, that is, when we're testing an
+    # installed package rather than the build output prior to installation.
+    # This test is fragile when testing an installed package even in Nix's
+    # otherwise clean build environment, upstream haven't been keen on patching
+    # individual failures when they crop up, and nobody has yet managed to
+    # rewrite the test to be less fragile.
+    #
+    # See in particular the below messages and discussions around them:
+    # https://lore.kernel.org/git/xmqqect7fhnp.fsf@gitster.g/
+    # https://lore.kernel.org/git/20251201031040.1120091-1-brianmlyles@gmail.com/
+    disable_test t1517-outside-repo
+
    # Fails reproducibly on ZFS on Linux with formD normalization
    disable_test t0021-conversion
    disable_test t3910-mac-os-precompose
@@ -616,7 +625,17 @@ stdenv.mkDerivation (finalAttrs: {
      };
    }
    // tests.fetchgit;
-    updateScript = ./update.sh;
+
+    # We get the source from the release packages, since that contains a few
+    # extra files that make the build easier without already having a Git
+    # installation.  We get the version from GitHub, however, as that provides
+    # a nicer API for checking what the latest version is.
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--url"
+        "https://github.com/git/git"
+      ];
+    };
  };

  meta = {
@@ -1,19 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts jq git
-
-set -eu -o pipefail
-
-oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion git" | tr -d '"')"
-latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '{}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
-targetVersion="${1:-$latestTag}"
-
-if [ ! "${oldVersion}" = "${targetVersion}" ]; then
-  update-source-version git "${targetVersion}"
-  nixpkgs="$(git rev-parse --show-toplevel)"
-  default_nix="$nixpkgs/pkgs/applications/version-management/git/default.nix"
-  nix-build -A git
-  git add "${default_nix}"
-  git commit -m "git: ${oldVersion} -> ${targetVersion}"
-else
-  echo "git is already up-to-date"
-fi
@@ -17,10 +17,8 @@
  runtimeShell,
  # List of Node.js runtimes the package should support
  nodeRuntimes ? [
-    # Node.js 20.x has reached EOL and is marked as insecure in Nixpkgs, thus omitted here
    "node24"
  ],
-  nodejs_20,
  nodejs_24,
 }:

@@ -28,7 +26,7 @@
 assert builtins.all (
  x:
  builtins.elem x [
-    "node20"
+    # Node.js 20.x has reached EOL and was removed from Nixpkgs, thus omitted here
    "node24"
  ]
 ) nodeRuntimes;
@@ -250,9 +248,6 @@ buildDotnetModule (finalAttrs: {
    export GITHUB_ACTIONS_RUNNER_TRACE=1
    mkdir -p _layout/externals
  ''
-  + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
-    ln -s ${nodejs_20} _layout/externals/node20
-  ''
  + lib.optionalString (lib.elem "node24" nodeRuntimes) ''
    ln -s ${nodejs_24} _layout/externals/node24
  '';
@@ -294,9 +289,6 @@ buildDotnetModule (finalAttrs: {
    # link the Alpine Node flavors.
    mkdir -p $out/lib/externals
  ''
-  + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
-    ln -s ${nodejs_20} $out/lib/externals/node20
-  ''
  + lib.optionalString (lib.elem "node24" nodeRuntimes) ''
    ln -s ${nodejs_24} $out/lib/externals/node24
  ''
@@ -20,9 +20,6 @@
  libxkbcommon,
  libdecor,
  withMinecraftPatch ? false,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 let
  version = "3.4";
@@ -61,11 +58,7 @@ stdenv.mkDerivation {
    cmake
    pkg-config
  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    fixDarwinDylibNames
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
-  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -93,9 +86,6 @@ stdenv.mkDerivation {
  cmakeFlags = [
    # Static linking isn't supported
    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
  ];

  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {
@@ -24,8 +24,6 @@
  gi-docgen,
  # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
  util-linuxMinimal ? null,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
  buildPackages,

  # this is just for tests (not in the closure of any regular package)
@@ -209,10 +207,6 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals withDtrace [
    systemtap' # for dtrace
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];

  propagatedBuildInputs = [
@@ -256,13 +250,6 @@ stdenv.mkDerivation (finalAttrs: {
      "-DG_DISABLE_CAST_CHECKS"
    ];
    DETERMINISTIC_BUILD = 1;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64 hardening issue.
-    #
-    # TODO: Clean up on `staging`.
-    CC_LD = "lld";
-    OBJC_LD = "lld";
  };

  postPatch = ''
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
    # consumers of the CMake config file to fail at the configuration step.
    # Explicitly disabling unwind support sidesteps the issue.
    "-DWITH_UNWIND=OFF"
+    # Enable pkg-config support so that a `.pc` file is generated.
+    "-DWITH_PKGCONFIG=ON"
  ];

  doCheck = true;
@@ -0,0 +1,85 @@
+diff --git a/src/xattrs.c b/src/xattrs.c
+index 86a7e59cbc..c872ae308d 100644
+--- a/src/xattrs.c
+++ b/src/xattrs.c
+@@ -139,13 +139,13 @@
+ #ifdef HAVE_POSIX_ACLS
+ 
+ /* acl-at wrappers, TODO: move to gnulib in future? */
+-static acl_t acl_get_file_at (int, const char *, acl_type_t);
+-static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
+static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
+static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
+ static int file_has_acl_at (int, char const *, struct stat const *);
+-static int acl_delete_def_file_at (int, char const *);
+static int tar_acl_delete_def_file_at (int, char const *);
+ 
+-/* acl_get_file_at */
+-#define AT_FUNC_NAME acl_get_file_at
+/* tar_acl_get_file_at */
+#define AT_FUNC_NAME tar_acl_get_file_at
+ #define AT_FUNC_RESULT acl_t
+ #define AT_FUNC_FAIL (acl_t)NULL
+ #define AT_FUNC_F1 acl_get_file
+@@ -159,8 +159,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_set_file_at */
+-#define AT_FUNC_NAME acl_set_file_at
+/* tar_acl_set_file_at */
+#define AT_FUNC_NAME tar_acl_set_file_at
+ #define AT_FUNC_F1 acl_set_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS   , acl_type_t type, acl_t acl
+ #define AT_FUNC_POST_FILE_ARGS          , type, acl
+@@ -170,8 +170,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_delete_def_file_at */
+-#define AT_FUNC_NAME acl_delete_def_file_at
+/* tar_acl_delete_def_file_at */
+#define AT_FUNC_NAME tar_acl_delete_def_file_at
+ #define AT_FUNC_F1 acl_delete_def_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS
+ #define AT_FUNC_POST_FILE_ARGS
+@@ -299,10 +299,10 @@
+       /* No "default" IEEE 1003.1e ACL set for directory.  At this moment,
+          FILE_NAME may already have inherited default acls from parent
+          directory;  clean them up. */
+-      if (acl_delete_def_file_at (chdir_fd, file_name))
+      if (tar_acl_delete_def_file_at (chdir_fd, file_name))
+         WARNOPT (WARN_XATTR_WRITE,
+                 (0, errno,
+-                 _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+                 _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+                    "for file '%s'"),
+                  file_name));
+       return;
+@@ -316,11 +316,11 @@
+       return;
+     }
+ 
+-  if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+  if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+     /* warn even if filesystem does not support acls */
+     WARNOPT (WARN_XATTR_WRITE,
+ 	     (0, errno,
+-	      _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+	      _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+ 	      file_name));
+ 
+   acl_free (acl);
+@@ -357,10 +357,10 @@
+   char *val = NULL;
+   acl_t acl;
+ 
+-  if (!(acl = acl_get_file_at (parentfd, file_name, type)))
+  if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
+     {
+       if (errno != ENOTSUP)
+-        call_arg_warn ("acl_get_file_at", file_name);
+        call_arg_warn ("tar_acl_get_file_at", file_name);
+       return;
+     }
+ 
@@ -24,9 +24,17 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-TWL/NzQux67XSFNTI5MMfPlKz3HDWRiCsmp+pQ8+3BY=";
  };

-  # GNU tar fails to link libiconv even though the configure script detects it.
-  # https://savannah.gnu.org/bugs/index.php?64441
-  patches = [ ./link-libiconv.patch ];
+  patches = [
+    # GNU tar fails to link libiconv even though the configure script detects it.
+    # https://savannah.gnu.org/bugs/index.php?64441
+    ./link-libiconv.patch
+
+    # acl 2.4.0 adds functions that have name conflicts with internal
+    # (`static`) functions from GNU tar. we prefix `tar_` to these names to
+    # avoid this, matching the approach from
+    # https://lists.gnu.org/archive/html/bug-tar/2026-06/msg00013.html
+    ./acl-2.4.0-name-conflicts.patch
+  ];

  # gnutar tries to call into gettext between `fork` and `exec`,
  # which is not safe on darwin.
@@ -22,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gpgme";
-  version = "2.1.0";
+  version = "2.1.2";

  outputs = [
    "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnupg/gpgme/gpgme-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-hBxepT/CYln0+/DovemC3qG4ocoMt35oHIKwUFZr+Ss=";
+    hash = "sha256-BoepWymYccQUH1B8D3QN5rQpyawGfQ+k4GLjJk31+3c=";
  };

  postPatch = ''
@@ -22,7 +22,7 @@
  libxrender,
  python3,
  withXorg ? true,
-  withQuartz ? false,
+  withQuartz ? stdenv.hostPlatform.isDarwin,

  # for passthru.tests
  exiv2,
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
  pname = "grpc";
-  version = "1.81.0"; # N.B: if you change this, please update:
+  version = "1.82.1"; # N.B: if you change this, please update:
  # pythonPackages.grpcio
  # pythonPackages.grpcio-channelz
  # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "grpc";
    repo = "grpc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o1wfHrgD2VE6HcPPEWQPQZXrMh+8+GNoUjbCQoRlIWg=";
+    hash = "sha256-w4tl1y1GITlfeHTsSAZm45d8HQVzqSBVEQXoEqO0h5g=";
    fetchSubmodules = true;
  };

@@ -17,7 +17,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gssdp";
-  version = "1.6.5";
+  version = "1.6.6";

  outputs = [
    "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
+    hash = "sha256-dn0idSVM4O/q6sZEGf+fTwrUcNE072cvXFVrKrt4a8s=";
  };

  depsBuildBuild = [
@@ -9,8 +9,6 @@
  gtk ? gtk3,
  gtk3,
  gobject-introspection,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 stdenv.mkDerivation rec {
@@ -30,8 +28,6 @@ stdenv.mkDerivation rec {
    pkg-config
    gtk-doc
    gobject-introspection
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
  ];
  buildInputs = [ glib ];
  propagatedBuildInputs = [ gtk ];
@@ -40,13 +36,6 @@ stdenv.mkDerivation rec {
    gtkdocize
  '';

-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  meta = {
    description = "Provides integration for GTK applications into the Mac desktop";
    license = lib.licenses.lgpl21;
@@ -27,8 +27,6 @@
  gdktarget ? if stdenv.hostPlatform.isDarwin then "quartz" else "x11",
  cupsSupport ? config.gtk2.cups or stdenv.hostPlatform.isLinux,
  xineramaSupport ? stdenv.hostPlatform.isLinux,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 let
@@ -58,19 +56,13 @@ stdenv.mkDerivation (finalAttrs: {
    gtkCleanImmodulesCache
  ];

-  nativeBuildInputs =
-    finalAttrs.setupHooks
-    ++ [
-      gdk-pixbuf
-      gettext
-      gobject-introspection
-      perl
-      pkg-config
-    ]
-    # TODO: Clean up on `staging`
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      llvmPackages.lld
-    ];
+  nativeBuildInputs = finalAttrs.setupHooks ++ [
+    gdk-pixbuf
+    gettext
+    gobject-introspection
+    perl
+    pkg-config
+  ];

  patches = [
    ./patches/2.0-immodules.cache.patch
@@ -128,19 +120,12 @@ stdenv.mkDerivation (finalAttrs: {
    "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
  ];

-  env =
-    lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = toString [
-        "-Wno-error=implicit-int"
-        "-Wno-error=incompatible-pointer-types"
-      ];
-    }
-    # Fix for ld64 hardening issue
-    #
-    # TODO: Clean up on `staging`
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_CFLAGS_LINK = "-fuse-ld=lld";
-    };
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-int"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };

  enableParallelBuilding = true;

@@ -58,8 +58,6 @@
  broadwaySupport ? true,
  wayland-scanner,
  testers,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:

 let
@@ -144,10 +142,6 @@ stdenv.mkDerivation (finalAttrs: {
      ]
  ++ lib.optionals waylandSupport [
    wayland-scanner
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
  ];

  buildInputs =
@@ -219,17 +213,7 @@ stdenv.mkDerivation (finalAttrs: {

  # These are the defines that'd you'd get with --enable-debug=minimum (default).
  # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  env = {
-    NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # workaround for ld64 hardening issue
-    #
-    # TODO: Clean up on `staging`
-
-    CC_LD = "lld";
-    OBJC_LD = "lld";
-  };
+  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";

  postPatch = ''
    # See https://github.com/NixOS/nixpkgs/issues/132259
@@ -60,7 +60,6 @@
  compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages,
  cups,
  libexecinfo,
-  llvmPackages,
  broadwaySupport ? true,
  testers,
  darwinMinVersionHook,
@@ -131,10 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals vulkanSupport [
    shaderc # for glslc
  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    llvmPackages.lld
-  ]
  ++ finalAttrs.setupHooks;

  buildInputs = [
@@ -226,10 +221,6 @@ stdenv.mkDerivation (finalAttrs: {
  }
  // lib.optionalAttrs stdenv.hostPlatform.isMusl {
    NIX_LDFLAGS = "-lexecinfo";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
  };

  postPatch = ''
@@ -0,0 +1,13 @@
+diff --git a/src/hdr_histogram.c b/src/hdr_histogram.c
+index b2041f8..a5dd8d7 100644
+--- a/src/hdr_histogram.c
+++ b/src/hdr_histogram.c
+@@ -36,7 +36,7 @@
+ 
+ /* Runtime-dispatched AVX2 path: keep the rest of this TU at the project's
+    baseline ISA so the shipped binary does not silently require AVX2. */
+-#if (defined(__x86_64__) || defined(_M_X64) || defined(__i386__) || defined(_M_IX86)) \
+#if (defined(__x86_64__) || defined(_M_X64)) \
+     && (defined(__GNUC__) || defined(__clang__)) && !defined(__INTEL_COMPILER)
+ #  define HDR_HAS_AVX2_DISPATCH 1
+ #  include <immintrin.h>
@@ -11,15 +11,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hdrhistogram_c";
-  version = "0.11.9";
+  version = "0.11.10";

  src = fetchFromGitHub {
    owner = "HdrHistogram";
    repo = "HdrHistogram_c";
    tag = finalAttrs.version;
-    hash = "sha256-9Xp+gPqJpB7xZr5dzyc9Via9gxG9q/EriCx3cm++0kU=";
+    hash = "sha256-LMZj7vuxOA1bgU/J10IKnyNe3R0dk2AA1ydLTHun4vg=";
  };

+  # Fix build on i686 by not trying to build AVX2 code
+  # Submitted upstream: https://github.com/HdrHistogram/HdrHistogram_c/pull/143
+  ${if stdenv.hostPlatform.isi686 then "patches" else null} = [
+    ./no-avx2-i386.patch
+  ];
+
  buildInputs = [ zlib ];
  nativeBuildInputs = [
    cmake
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hwdata";
-  version = "0.408";
+  version = "0.409";

  src = fetchFromGitHub {
    owner = "vcrhonek";
    repo = "hwdata";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
+    hash = "sha256-WJ7oe94rTb+gzuawafpx7YyNTUzZe7ZWE0ZWWQKoyCA=";
  };

  doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
@@ -6,8 +6,6 @@
  writableTmpDirAsHomeHook,
  versionCheckHook,
  nix-update-script,
-  llvmPackages,
-  stdenv,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -29,17 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  nativeBuildInputs = [
    installShellFiles
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
  ];

-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  postInstall = ''
    installManPage $src/docs/iamb.{1,5}
    install -D $src/docs/iamb.svg -t $out/share/icons/hicolor/scalable/apps
@@ -23,7 +23,6 @@
  nix-update-script,
  autoPatchelfHook,
  makeWrapper,
-  llvmPackages,
 }:

 let
@@ -62,9 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    makeWrapper
  ]
-  ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];

  buildInputs = [
    capstone
@@ -106,13 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "CMAKE_INSTALL_NAME_DIR" "@executable_path/../Frameworks")
  ];

-  env = {
-    NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";

  # Comment out fixup_bundle in PostprocessBundle.cmake as we are not building a standalone application
  postPatch = ''
@@ -4,9 +4,13 @@
  fetchFromGitHub,

  # nativeBuildInputs
+  cmake,
  nasm,
-  autoreconfHook,

+  # buildInputs
+  zlib,
+
+  # nativeInstallCheckInputs
  versionCheckHook,

  # passthru
@@ -18,32 +22,45 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "isa-l";
-  version = "2.32.0";
+  version = "2.32.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "intel";
    repo = "isa-l";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LvxAlyBUSYEVLrMGcLii7bGvN1GZY/noYRSrBqsGiMI=";
+    hash = "sha256-JizQXhfDCL8aWEv52TBuXw06HA/8t7Ram/q9vSp5/DI=";
  };

  nativeBuildInputs = [
+    cmake
    nasm
-    autoreconfHook
  ];

-  # configure.ac has two code paths for assembler detection:
-  # 1. When AS is unset: searches for nasm and tests with correct nasm syntax
-  # 2. When AS is set: tests with yasm-style syntax that nasm rejects
-  # AM_PROG_AS sets AS=as, so we must unset it to use path 1.
-  preConfigure = ''
-    unset AS
-  '';
+  buildInputs = [
+    zlib
+  ];
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-DVERSION=\"${finalAttrs.version}\""
+    ];
+  };
+  cmakeFlags = [
+    (lib.cmakeBool "ISAL_BUILD_IGZIP_CLI" true)
+
+    # https://github.com/NixOS/nixpkgs/issues/144170
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+  ];

  nativeInstallCheckInputs = [
    versionCheckHook
  ];
  doInstallCheck = true;
+  doCheck = true;

  passthru = {
    tests = {
@@ -96,12 +113,5 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/intel/isa-l/releases/tag/v${finalAttrs.version}";
    maintainers = with lib.maintainers; [ jbedo ];
    platforms = lib.platforms.all;
-    badPlatforms = [
-      # <instantiation>:4:26: error: unexpected token in argument list
-      #  movk x7, p4_low_b1, lsl 16
-      "aarch64-darwin"
-      # https://github.com/intel/isa-l/issues/188
-      "i686-linux"
-    ];
  };
 })
@@ -51,6 +51,14 @@ stdenv.mkDerivation (finalAttrs: {
    # `rtree_read.constprop.0` shows up in some builds but
    # not others, so we fall back to O2:
    ./o3-to-o2.patch
+
+    # Active profiling may make xallocx decline to grow non-page-aligned
+    # allocations, so test/integration/extent can observe decommit without
+    # the matching commit on platforms with real decommit/commit.
+    #
+    # A (longer) patch addressing the failure posted upstream at:
+    # https://github.com/jemalloc/jemalloc/pull/2954
+    ./skip-extent-test-with-prof-active.patch
  ];

  nativeBuildInputs = [
@@ -60,6 +68,8 @@ stdenv.mkDerivation (finalAttrs: {
  configureFlags = [
    "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
    "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
+    # Profiling is inert unless enabled at runtime
+    "--enable-prof"
  ]
  # see the comment on stripPrefix
  ++ lib.optional stripPrefix "--with-jemalloc-prefix="
@@ -0,0 +1,24 @@
+diff --git a/test/integration/extent.sh b/test/integration/extent.sh
+index 39fb0a73..ee9f3ed4 100644
+--- a/test/integration/extent.sh
+++ b/test/integration/extent.sh
+@@ -1,5 +1,19 @@
+ #!/bin/sh
+ 
+# With active profiling, xallocx may decline to grow non-page-aligned
+# allocations.  On platforms with real decommit/commit, this can make this
+# test observe a successful decommit without the matching commit.
+case ",${MALLOC_CONF_ALL}," in
+  *,prof:true,*)
+    case ",${MALLOC_CONF_ALL}," in
+      *,prof_active:false,*)
+        ;;
+      *)
+        return 1
+        ;;
+    esac
+esac
+
+ if [ "x${enable_fill}" = "x1" ] ; then
+   export MALLOC_CONF="junk:false"
+ fi
@@ -45,8 +45,6 @@
  makeBinaryWrapper,
  darwin,
  cairo,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:

 with python3Packages;
@@ -119,8 +117,6 @@ buildPythonApplication rec {
    imagemagick
    libicns # For the png2icns tool.
    darwin.autoSignDarwinBinariesHook
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    wayland-scanner
@@ -157,10 +153,6 @@ buildPythonApplication rec {
    CGO_ENABLED = 0;
    GOFLAGS = "-trimpath";
    GOTOOLCHAIN = "local";
-  }
-  # TODO: Clean up on `staging`.
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
  };

  configurePhase = ''
@@ -9,7 +9,7 @@ let
 in
 assert lib.versionAtLeast kresd.version "6.0.0";
 python3Packages.buildPythonPackage {
-  pname = "knot-resolver-manager_6";
+  pname = "knot-resolver";
  inherit (kresd) version src;
  pyproject = true;

@@ -77,7 +77,7 @@ python3Packages.buildPythonPackage {

  doCheck = python3Packages.stdenv.hostPlatform.isLinux; # maybe in future
  nativeCheckInputs = with python3Packages; [
-    augeas
+    python-augeas
    dnspython
    lief
    pytestCheckHook
@@ -138,6 +138,9 @@ stdenv.mkDerivation (finalAttrs: {
    xar
  ];

+  # ld built with this fails to link glib's gio
+  hardeningDisable = [ "libcxxhardeningfast" ];
+
  dontUseCmakeConfigure = true; # CMake is only needed because it’s used by Meson to find LLVM.

  # Note for overrides: ld64 cannot be built as a debug build because of UB in its iteration implementations,
@@ -10,7 +10,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lerc";
-  version = "4.1.0";
+  version = "4.1.1";

  outputs = [
    "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "esri";
    repo = "lerc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+X30DQuq2oT/sTe8usUaNK1V+UTNvXJW7IAJVIr8m78=";
+    hash = "sha256-YTNIydQLCBzsuvPWA6qnOkOIPf9JlByJdNHkTevE7Z0=";
  };

  # Required to get the freebsd-ports patch to apply.
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libadwaita";
-  version = "1.9.1";
+  version = "1.9.2";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GNOME";
    repo = "libadwaita";
    tag = finalAttrs.version;
-    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
+    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
  };

  depsBuildBuild = [
@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postInstall = ''
-    mkdir -p "$out/lib/pkgconfig"
-    cat >"$out/lib/pkgconfig/libajantv2.pc" <<EOF
+    mkdir -p "$dev/lib/pkgconfig"
+    cat >"$dev/lib/pkgconfig/libajantv2.pc" <<EOF
    prefix=$out
    libdir=\''${prefix}/lib
-    includedir=\''${prefix}/include/libajantv2
+    includedir=$dev/include/libajantv2

    Name: libajantv2
    Description: Library for controlling AJA NTV2 video devices
@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libapparmor";
-  version = "5.0.0";
+  version = "5.0.1";

  src = fetchFromGitLab {
    owner = "apparmor";
    repo = "apparmor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
+    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
  };
  sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";

@@ -14,11 +14,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libevent";
-  version = "2.1.12";
+  version = "2.1.13";

  src = fetchurl {
    url = "https://github.com/libevent/libevent/releases/download/release-${finalAttrs.version}-stable/libevent-${finalAttrs.version}-stable.tar.gz";
-    sha256 = "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj";
+    hash = "sha256-9+k4O4wLqoG2h+W17swBvu+vGxm2QVHZXtYWR/56MVw=";
  };

  patches = [
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libffi";
-  version = "3.5.2";
+  version = "3.7.0";

  src = fetchurl {
    url =
      with finalAttrs;
      "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw=";
+    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
  };

  # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
    ./freebsd-tsan-pthread.patch
  ];

+  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
+
  strictDeps = true;
  outputs = [
    "out"
@@ -31,7 +31,7 @@ in

 stdenv.mkDerivation rec {
  pname = "libjxl";
-  version = "0.11.2";
+  version = "0.12.0";

  outputs = [
    "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    owner = "libjxl";
    repo = "libjxl";
    tag = "v${version}";
-    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
+    hash = "sha256-rJyvJo1ZveE1pvMErK9ilFQA0NXkD2ka93L+1gXeqf8=";
    # There are various submodules in `third_party/`.
    fetchSubmodules = true;
  };
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
  # that the cmake build can apparently use:
  #     OpenGL/GLUT (for Examples -> comparison with sjpeg)
  #     viewer (see `cmakeFlags`)
-  #     plugins like for GDK and GIMP (see `cmakeFlags`)

  # Vendored libraries:
  # `libjxl` currently vendors many libraries as git submodules that they
@@ -127,7 +126,6 @@ stdenv.mkDerivation rec {
  ++ lib.optionals enablePlugins [
    # Enable plugins, such as:
    # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
-    # * the `gimp` one, which allows GIMP to load jpeg-xl files
    "-DJPEGXL_ENABLE_PLUGINS=ON"
  ]
  ++ lib.optionals stdenv.hostPlatform.isStatic [
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
  };

-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+  patches = [
    (fetchpatch {
      name = "libcxx-compat.patch";
      url = "https://github.com/awesomized/libmemcached/commit/547460c12287a34a5993045157a0e13e14203f92.patch";
@@ -64,7 +64,7 @@ let
        export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
        export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
      ''
-      + lib.optionalString stdenv.hostPlatform.isElf ''
+      + lib.optionalString (stdenv.hostPlatform.isElf && buildShared) ''
        # Bail if any shared object has executable stack enabled. This can
        # happen when an object produced from an assmbly file in libcrypto is
        # missing a .note.GNU-stack section. An executable stack is dangerous
@@ -151,23 +151,10 @@ in
    ];
  };

-  # 4.3 was released April 2026 and will become unsupported one year after the
-  # release of OpenBSD 7.9.
+  # 4.3 was released April 2026 and will become unsupported on May 19, 2027,
+  # one year after the release of OpenBSD 7.9.
  libressl_4_3 = generic {
-    version = "4.3.1";
-    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
-    patches = [
-      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
-      # 4.3 started requiring executable stack because some objects were missing
-      # a .note.GNU-stack section; will probably be included in the next release.
-      (fetchpatch {
-        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
-        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
-        # This patch is written to be applied with -p0, with no leading path
-        # component, but Nix applies with -p1 by default, so we add it to not
-        # break compatibility with how other patches must be applied.
-        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
-      })
-    ];
+    version = "4.3.2";
+    hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
  };
 }
@@ -1,5 +1,5 @@
 {
-  libressl_4_2,
+  libressl_4_3,
 }:

-libressl_4_2
+libressl_4_3
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  getopt,
  util-linuxMinimal,
  which,
@@ -13,31 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libseccomp";
-  version = "2.6.0";
+  version = "2.6.1";

  src = fetchurl {
    url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz";
-    hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw=";
+    hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4=";
  };

-  patches = [
-    # Remove when version > 2.6.0
-    # Fixes test failures on big-endian archs
-    (fetchpatch {
-      name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
-      hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
-    })
-
-    # Remove when version > 2.6.0
-    # Fixes OOB reads & tests on musl
-    (fetchpatch {
-      name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
-      hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
-    })
-  ];
-
  outputs = [
    "out"
    "lib"
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libsepol";
-  version = "3.10";
+  version = "3.11";
  se_url = "https://github.com/SELinuxProject/selinux/releases/download";

  outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
+    hash = "sha256-efPSyI9Et+tc9U2XkuAyMil+F/l6F5Fj8nUAmaAPFk0=";
  };

  nativeBuildInputs = [ flex ];
@@ -8,6 +8,9 @@
  openssl,
  libsodium,

+  withGssapi ? false,
+  krb5,
+
  # for passthru.tests
  ffmpeg,
  sshping,
@@ -28,20 +31,29 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

+  strictDeps = true;
+
+  __structuredAttrs = true;
+
  postPatch = ''
    # Fix headers to use libsodium instead of NaCl
    sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
  '';

-  # Don’t build examples, which are not installed and require additional dependencies not
-  # included in `buildInputs` such as libx11.
-  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+  cmakeFlags = [
+    # Don’t build examples, which are not installed and require additional dependencies not
+    # included in `buildInputs` such as libx11.
+    "-DWITH_EXAMPLES=OFF"
+
+    (lib.cmakeBool "USE_GSSAPI" withGssapi)
+  ];

  buildInputs = [
    zlib
    openssl
    libsodium
-  ];
+  ]
+  ++ lib.optional withGssapi krb5;

  nativeBuildInputs = [
    cmake
@@ -0,0 +1,3 @@
+{ libssh }:
+
+libssh.override { withGssapi = true; }
@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libxfont_2";
-  version = "2.0.7";
+  version = "2.0.8";

  outputs = [
    "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-i3uC/eukh2m2lDPo4/u5hKX2vzaLDV9Hq+7EnePljvs=";
+    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
  };

  strictDeps = true;
@@ -11,7 +11,6 @@
  apple-sdk_15,
  withAdditionalGuestAgents ? false,
  lima-additional-guestagents,
-  llvmPackages,
  writableTmpDirAsHomeHook,
  versionCheckHook,
  testers,
@@ -36,16 +35,7 @@ buildGoModule (finalAttrs: {
    # For checkPhase, and installPhase(required to build completion)
    writableTmpDirAsHomeHook
  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.sigtool
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    llvmPackages.lld
-  ];
-
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' llvmPackages.lld "ld64.lld"}";
-  };
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];

@@ -7,8 +7,6 @@
  fetchurl,
  fetchpatch,
  xcbuild,
-  lld,
-  llvm,
  python3,
  ninja,
  git,
@@ -184,13 +182,7 @@ stdenv.mkDerivation {
    ln -sf ${lib.getExe gn} buildtools/mac/gn
    chmod +x build/toolchain/apple/linker_driver.py
    patchShebangs build/toolchain/apple/linker_driver.py
-
-    # When 'use_lld=true' is set, llvm-ar is used instead of ar.
-    # The build config expects llvm-ar to be inside the provided clang base path,
-    # but this is not the case in nixpkgs.
-    substituteInPlace build/toolchain/apple/toolchain.gni \
-      --replace-fail "/bin/cp -Rc" "cp -a" \
-      --replace-fail '${"$"}{prefix}llvm-ar' '${lib.getExe' llvm "llvm-ar"}'
+    substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a"

    # nixpkgs calls the target "darwin" instead of "macos", and passing a different target
    # results in warnings by the nixpkgs compiler wrapper
@@ -218,10 +210,7 @@ stdenv.mkDerivation {
      cpio
      pkg-config
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xcbuild
-      lld
-    ];
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];

  buildInputs = [
    nasm
@@ -290,8 +279,7 @@ stdenv.mkDerivation {
    "rtc_enable_objc_symbol_export=true"
    "rtc_include_dav1d_in_internal_decoder_factory=true"
    "clang_use_chrome_plugins=false"
-    # ld64 traps on linking because of C++ hardening
-    "use_lld=true"
+    "use_lld=false"
    ''clang_base_path="${clang}"''
  ]);

@@ -309,12 +297,6 @@ stdenv.mkDerivation {
    "desktop_capture_objc"
  ];

-  env = {
-    # ensure install_name_tool has enough space in binary headers
-    # to replace rpaths with very long nix store paths
-    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-headerpad_max_install_names";
-  };
-
  postBuild =
    lib.optionalString stdenv.hostPlatform.isLinux ''
      objcopy --redefine-syms="${boringSslSymbols}" "libwebrtc.so"
@@ -2,7 +2,6 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  llvmPackages,
  versionCheckHook,
  nix-update-script,
 }:
@@ -22,14 +21,6 @@ buildGoModule rec {

  proxyVendor = true;

-  nativeBuildInputs = [ llvmPackages.lld ];
-
-  env = {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
  ldflags = [
    "-s"
    "-w"
@@ -6,6 +6,8 @@ set -euo pipefail
 # assertExecutable FILE
 assertExecutable() {
    local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
    [[ -f "$file" && -x "$file" ]] || \
        die "Cannot wrap '$file' because it is not an executable file"
 }
@@ -1,4 +1,8 @@
-{ callPackage, fetchurl }:
+{
+  lib,
+  stdenv,
+  callPackage,
+}:

 callPackage ./generic.nix {
  version = "4.1.0";
@@ -11,5 +15,11 @@ callPackage ./generic.nix {
    # * <https://github.com/openwrt/openwrt/pull/15479>
    # * <https://github.com/Mbed-TLS/mbedtls/issues/9003>
    ./0001-fix-gcc14-build.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    # Fixes build with GCC 15.3 on 32-bit platforms.
+    # See: https://github.com/Mbed-TLS/mbedtls/pull/10793
+    # Manually forward-ported to v4
+    ./fix-gcc153-32bit-v4.patch
  ];
 }
@@ -0,0 +1,12 @@
+--- a/tf-psa-crypto/core/tf_psa_crypto_common.h
+++ b/tf-psa-crypto/core/tf_psa_crypto_common.h
+@@ -332,7 +332,8 @@ static inline void mbedtls_xor_no_simd(unsigned char *r,
+         uint32_t x = mbedtls_get_unaligned_uint32(a + i) ^ mbedtls_get_unaligned_uint32(b + i);
+         mbedtls_put_unaligned_uint32(r + i, x);
+     }
+-#if defined(__IAR_SYSTEMS_ICC__)
+#if defined(__IAR_SYSTEMS_ICC__) || \
+    (defined(MBEDTLS_COMPILER_IS_GCC) && MBEDTLS_GCC_VERSION >= 150300)
+     if (n % 4 == 0) {
+         return;
+     }
@@ -0,0 +1,14 @@
+diff --git a/library/common.h b/library/common.h
+index 1f59b32426..8c756bcb07 100644
+--- a/library/common.h
+++ b/library/common.h
+@@ -332,7 +332,8 @@ static inline void mbedtls_xor_no_simd(unsigned char *r,
+         uint32_t x = mbedtls_get_unaligned_uint32(a + i) ^ mbedtls_get_unaligned_uint32(b + i);
+         mbedtls_put_unaligned_uint32(r + i, x);
+     }
+-#if defined(__IAR_SYSTEMS_ICC__)
+#if defined(__IAR_SYSTEMS_ICC__) || \
+    (defined(MBEDTLS_COMPILER_IS_GCC) && MBEDTLS_GCC_VERSION >= 150300)
+     if (n % 4 == 0) {
+         return;
+     }
@@ -1,4 +1,9 @@
-{ callPackage, fetchurl }:
+{
+  lib,
+  stdenv,
+  callPackage,
+  fetchurl,
+}:

 callPackage ./generic.nix {
  version = "3.6.6";
@@ -14,5 +19,10 @@ callPackage ./generic.nix {
      url = "https://raw.githubusercontent.com/openwrt/openwrt/52b6c9247997e51a97f13bb9e94749bc34e2d52e/package/libs/mbedtls/patches/100-fix-gcc14-build.patch";
      hash = "sha256-20bxGoUHkrOEungN3SamYKNgj95pM8IjbisNRh68Wlw=";
    })
+  ]
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    # Fixes build with GCC 15.3 on 32-bit platforms.
+    # See: https://github.com/Mbed-TLS/mbedtls/pull/10793
+    ./fix-gcc153-32bit.patch
  ];
 }
@@ -10,7 +10,7 @@
  pkg-config,
  python3,
  jonquil,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:

 assert (
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    gfortran
    pkg-config
    python3
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ]
  ++ lib.optionals (buildType == "meson") [
    meson
@@ -8,7 +8,7 @@
  installShellFiles,
 }:
 let
-  version = "0.5.3";
+  version = "0.5.4";
 in
 rustPlatform.buildRustPackage rec {
  inherit version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
    owner = "rust-lang";
    repo = "mdBook";
    tag = "v${version}";
-    hash = "sha256-RMJQn58hshBGQSpu30NdUOb3Prywn6NfhauSzFZ35xQ=";
+    hash = "sha256-1bUMFxPpb9H/pRdCOX0u8Tn8RPmJElDs7o9t5JtRFuU=";
  };

-  cargoHash = "sha256-LlImOjTQjMQURQ81Gn73v+DEHXqyyiz39K9T+MrE7S0=";
+  cargoHash = "sha256-OmlcPZuQ1RbyFrF5tuztucgtCA544UHJxEaXh/mfSHQ=";

  nativeBuildInputs = [ installShellFiles ];

--- a/Show More
+++ b/Show More