Merge master into staging-next

pkgs/by-name/fi/filebeat8/package.nix

@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.16";
+  version = "8.19.17";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OBPaSbPAp7SvhEi2yycgT70yRfCtIEdkL4/GSR2YrO4=";
+    hash = "sha256-Xpth1SoXMXCUh/DFf3wA+Ql6SedtUB7tCYzDElpX5Lc=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-aCoXzWnNsctxJmsfeUyVSLkUY59adtIn2JxxGKPBob8=";
+  vendorHash = "sha256-Wxk+eI0XfBpQqqUNuskyr+/bTRqT38hszdkz/LJweQo=";
 
   subPackages = [ "filebeat" ];
 

pkgs/by-name/ft/ft2-clone/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ft2-clone";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vIo+7yb8QjzHAj68N2rHHc1o2knaBn6hCatDeKr+5gs=";
+    hash = "sha256-e0oIn/g5bWYMFhvd54reacGI8/s7pMfujnEPzYnUbF4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/in/intelli-shell/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "intelli-shell";
-  version = "3.4.4";
+  version = "3.4.5";
 
   src = fetchFromGitHub {
     owner = "lasantosr";
     repo = "intelli-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/DkR2s6xHXhQxwJEEs4vXK7Zc4lwLQvBnqUqW75h0Do=";
+    hash = "sha256-jC5hvyefEEU8odiPaUWtWm8o2oHyS7ZOw4nJdvylb0U=";
   };
 
-  cargoHash = "sha256-9/ZxPYgkETIKRizrlz+Pb9oWUYEeoSSmGk8EjzQO7PY=";
+  cargoHash = "sha256-g/sJJiwUl+N4ryFXhrbSIaOl0zzXKbehGyxTNamtua8=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/io/ioping/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  pkgsCross,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,13 +16,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9lJEjns8ttjgI52ZXeWgL77GMd7o7IvefBJ5UH9y9ks=";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [
+    "PREFIX=$(out)"
+    "CC:=$(CC)"
+  ];
 
   outputs = [
     "out"
     "man"
   ];
 
+  passthru.tests = {
+    aarch64-cross = pkgsCross.aarch64-multiplatform.ioping;
+  };
+
   meta = {
     description = "Disk I/O latency measuring tool";
     maintainers = with lib.maintainers; [ raskin ];

pkgs/by-name/kr/krunkit/boot-test.nix

@@ -0,0 +1,126 @@
+{
+  krunkit,
+  lib,
+  nixos,
+  pkgs,
+  runCommand,
+}:
+
+let
+  linuxPkgs = import pkgs.path {
+    system = "aarch64-linux";
+  };
+
+  nixosConfig =
+    (nixos {
+      nixpkgs.pkgs = linuxPkgs;
+
+      imports = [ "${pkgs.path}/nixos/modules/profiles/qemu-guest.nix" ];
+
+      boot = {
+        kernelParams = [ "console=hvc0" ];
+        loader = {
+          efi.canTouchEfiVariables = false;
+          systemd-boot.enable = true;
+        };
+      };
+
+      documentation.enable = false;
+      environment.defaultPackages = [ ];
+
+      fileSystems = {
+        "/" = {
+          device = "/dev/disk/by-label/nixos";
+          fsType = "ext4";
+        };
+
+        "/boot" = {
+          device = "/dev/disk/by-label/ESP";
+          fsType = "vfat";
+        };
+      };
+
+      systemd.services.krunkit-boot-ok = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "multi-user.target" ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          echo krunkit-boot-ok >/dev/hvc0
+        '';
+      };
+
+      system.stateVersion = lib.trivial.release;
+    }).config;
+
+  image = import "${pkgs.path}/nixos/lib/make-disk-image.nix" {
+    inherit lib;
+    config = nixosConfig;
+    pkgs = linuxPkgs;
+
+    additionalSpace = "64M";
+    baseName = "krunkit-nixos";
+    bootSize = "128M";
+    copyChannel = false;
+    format = "raw";
+    partitionTableType = "efi";
+  };
+in
+runCommand "krunkit-nixos-boot-test"
+  {
+    requiredSystemFeatures = [ "apple-virt" ];
+
+    meta.platforms = [ "aarch64-darwin" ];
+  }
+  ''
+    image=${image}/krunkit-nixos.img
+    disk=$TMPDIR/disk.img
+    console=$TMPDIR/console.log
+    log=$TMPDIR/krunkit.log
+
+    cp "$image" "$disk"
+    chmod u+w "$disk"
+    touch "$console" "$log"
+
+    cleanup() {
+      set +e
+      if [ -n "''${pid:-}" ]; then
+        kill "$pid" >/dev/null 2>&1
+        for _ in $(seq 1 20); do
+          kill -0 "$pid" >/dev/null 2>&1 || break
+          sleep 1
+        done
+        kill -KILL "$pid" >/dev/null 2>&1
+      fi
+    }
+    trap cleanup EXIT
+
+    ${krunkit}/bin/krunkit \
+      --cpus 1 \
+      --memory 1024 \
+      --log-file "$log" \
+      --device "virtio-blk,path=$disk,format=raw" \
+      --device "virtio-serial,logFilePath=$console" &
+    pid=$!
+
+    for _ in $(seq 1 120); do
+      if grep -q krunkit-boot-ok "$console"; then
+        touch "$out"
+        exit 0
+      fi
+
+      if ! kill -0 "$pid" >/dev/null 2>&1; then
+        echo "krunkit exited before the guest reached multi-user.target"
+        wait "$pid"
+        cat "$log"
+        cat "$console"
+        exit 1
+      fi
+
+      sleep 1
+    done
+
+    echo "timed out waiting for krunkit guest boot marker"
+    cat "$log"
+    cat "$console"
+    exit 1
+  ''

pkgs/by-name/kr/krunkit/package.nix

@@ -1,4 +1,5 @@
 {
+  callPackage,
   cargo,
   darwin,
   pkg-config,
@@ -43,10 +44,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
+  postInstall = ''
+    install -Dm444 edk2/KRUN_EFI.silent.fd $out/share/krunkit/KRUN_EFI.silent.fd
+  '';
+
   # This is necessary in order for the binary to keep its entitlements
   dontStrip = true;
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests.boot = callPackage ./boot-test.nix {
+      krunkit = finalAttrs.finalPackage;
+    };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Launch configurable virtual machines with libkrun";

pkgs/by-name/op/open-webui/package.nix

@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-ec/pmmjuFDYsL4MwHbTiw8PxG9iMHM/ntGfJIm3OpH8=";
+    hash = "sha256-tJ9b5up5FoX5TrmpwMWevyA/o3Ai/lKsHu+nahc2Ttc=";
   };
 
   frontend = buildNpmPackage rec {
@@ -30,7 +30,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-hHBTbiEaZsyfZWpwiNNbGOJTt6Bor0FKClYrCY5mjzE=";
+    npmDepsHash = "sha256-yw/1n1jBCUtt8wUqJmIkB3W53wsXTKuAFG/EMwcTpx8=";
 
     npmFlags = [ "--force" ];
 

pkgs/by-name/op/openimageio/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "3.1.14.1";
+  version = "3.1.15.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gAW9pUK0oPGoeNRBCS7i444PQ3b6f9Pa0UJwhSJV9ss=";
+    hash = "sha256-ebB9f0QkW83ZT6ydbpV2srvSaFayw1OM3HjI8rqPL4k=";
   };
 
   outputs = [

pkgs/by-name/po/podman-desktop/package.nix

@@ -16,6 +16,7 @@
   jq,
   gnugrep,
   podman,
+  krunkit,
 }:
 
 let
@@ -120,7 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase =
     let
-      commonWrapperArgs = "--prefix PATH : ${lib.makeBinPath [ podman ]}";
+      prefixPackages = lib.makeBinPath (
+        [ podman ] ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform krunkit) krunkit
+      );
+      commonWrapperArgs = "--prefix PATH : ${prefixPackages}";
     in
     (
       ''

pkgs/by-name/xe/xenia-canary/package.nix

@@ -33,14 +33,14 @@ let
 in
 llvmPackages_20.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-06-29";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "9c8e34b29e276320a319a0a46f7713de60efa50c";
-    hash = "sha256-56WAS3woSzqNQf1GJNLLvHYdLhb5JWykJ1h+6yZmKOY=";
+    rev = "9588ce244dc2684d1573736a717a5d234bf7c2bb";
+    hash = "sha256-nQuBh4XOSSeIX51KLXLyv+gTk51I4/VNgSBrV835mBI=";
   };
 
   dontConfigure = true;

pkgs/by-name/xo/xorg-server/package.nix

@@ -152,8 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dxkb_bin_dir=${xkbcomp}/bin"
     "-Dxkb_dir=${xkeyboard-config}/share/X11/xkb"
     "-Dxkb_output_dir=$out/share/X11/xkb/compiled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+
     "-Dxcsecurity=true"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -177,6 +176,9 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
   '';
 
+  # avoid linux rebuilds
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
+
   # default X install symlinks this to Xorg, we want XQuartz
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -sf $out/bin/Xquartz $out/bin/X

pkgs/by-name/xq/xquartz/package.nix

@@ -240,12 +240,12 @@ stdenv.mkDerivation {
     cp ${fontsConf} $fontsConfPath
 
     substituteInPlace $out/bin/startx \
-      --replace "bindir=${xinit}/bin" "bindir=$out/bin" \
-      --replace 'defaultserver=${xorg-server}/bin/X' "defaultserver=$out/bin/Xquartz" \
-      --replace "${xinit}" "$out" \
-      --replace "${xorg-server}" "$out" \
-      --replace "eval xinit" "eval $out/bin/xinit" \
-      --replace "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
+      --replace-fail "${xinit}" "$out" \
+      --replace-fail "xserver=\"${xorg-server}/bin/X\"" "xserver=\"$out/bin/Xquartz\"" \
+      --replace-fail 'xinit="xinit"' "xinit=$out/bin/xinit" \
+      --replace-fail '"xauth"' "${lib.getExe xauth}" \
+      --replace-fail "xauth " '"$xauth" ' \
+      --replace-fail "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
 
     wrapProgram $out/bin/Xquartz \
       --set XQUARTZ_APP $out/Applications/XQuartz.app
@@ -262,9 +262,9 @@ stdenv.mkDerivation {
     EOF
 
     substituteInPlace $out/etc/X11/xinit/xinitrc \
-      --replace ${xinit} $out \
-      --replace xmodmap ${xmodmap}/bin/xmodmap \
-      --replace xrdb ${xrdb}/bin/xrdb
+      --replace-fail ${xinit} $out \
+      --replace-fail '"xmodmap"' ${xmodmap}/bin/xmodmap \
+      --replace-fail '"xrdb"' ${xrdb}/bin/xrdb
 
     mkdir -p $out/etc/X11/xinit/xinitrc.d
 
@@ -281,7 +281,7 @@ stdenv.mkDerivation {
     chmod +x $out/etc/X11/xinit/xinitrc.d/99-quartz-wm.sh
 
     substituteInPlace $out/etc/X11/xinit/privileged_startx.d/20-font_cache \
-      --replace ${xinit} $out
+      --replace-fail ${xinit} $out
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \

pkgs/development/python-modules/victron-mqtt/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "victron-mqtt";
-  version = "2026.6.7";
+  version = "2026.6.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomer-w";
     repo = "victron_mqtt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-06+vn0HKvml3VRvPnQHz832OQnbvjd8tJEcnE6TIer8=";
+    hash = "sha256-zwdSpfI1UtH9ZDYXk/0jozt9qTs5ZaMrg5c60HBnOWo=";
   };
 
   build-system = [