Merge branch 'staging' into staging-next

Conflicts:
      pkgs/by-name/ba/bacon/package.nix
      pkgs/by-name/be/beancount-language-server/package.nix
      pkgs/by-name/fl/flake-edit/package.nix
      pkgs/by-name/fw/fw/package.nix
      pkgs/by-name/im/impression/package.nix
      pkgs/by-name/in/inori/package.nix
      pkgs/by-name/pi/pika-backup/package.nix
      pkgs/by-name/ri/rip2/package.nix
      pkgs/by-name/sn/sniffnet/package.nix
      pkgs/by-name/sy/syndicate_utils/package.nix
      pkgs/development/tools/misc/texlab/default.nix
In the cases where an update collided with cargoHash change,
I took the hash from the update.

ci/OWNERS

@@ -245,6 +245,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
+/pkgs/by-name/ps/psqlodbc @NixOS/postgres
 /pkgs/servers/sql/postgresql @NixOS/postgres
 /pkgs/development/tools/rust/cargo-pgrx @NixOS/postgres
 /nixos/modules/services/databases/postgresql.md @NixOS/postgres

doc/languages-frameworks/python.section.md

@@ -183,7 +183,15 @@ following are specific to `buildPythonPackage`:
   [`makeWrapper`](#fun-makeWrapper) set `PATH` and `PYTHONPATH` environment variables before calling
   the binary. Additional arguments here can allow a developer to set environment
   variables which will be available when the binary is run. For example,
-  `makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]`.
+  `makeWrapperArgs = ["--set" "FOO" "BAR" "--set" "BAZ" "QUX"]`.
+
+  ::: {.note}
+  When `__structuredAttrs = false`, the attribute `makeWrapperArgs` is passed as a space-separated string to the build script. Developers should use `prependToVar` or `appendToVar` to add arguments to it in build phases, or use `__structuredAttrs = true` to ensure that `makeWrapperArgs` is passed as a Bash array.
+
+  For compatibility purposes,
+  when `makeWrapperArgs` shell variable is specified as a space-separated string (instead of a Bash array) in the build script, the string content is Bash-expanded before concatenated into the `wrapProgram` command. Still, developers should not rely on such behaviours, but use `__structuredAttrs = true` to specify flags containing spaces (e.g. `makeWrapperArgs = [ "--set" "GREETING" "Hello, world!" ]`), or use -pre and -post phases to specify flags with Bash-expansions (e.g. `preFixup = ''makeWrapperArgs+=(--prefix PATH : "$SOME_PATH")`'').
+  :::
+
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
   defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications to `""`.
 * `pypaBuildFlags ? []`: A list of strings. Arguments to be passed to `python -m build --wheel`.
@@ -1273,7 +1281,7 @@ Using the example above, the analogous `pytestCheckHook` usage would be:
   ];
 
   # requires additional data
-  pytestFlagsArray = [
+  pytestFlags = [
     "tests/"
     "--ignore=tests/integration"
   ];
@@ -1433,7 +1441,7 @@ automatically add `pythonRelaxDepsHook` if either `pythonRelaxDeps` or
     unittestCheckHook
   ];
 
-  unittestFlagsArray = [
+  unittestFlags = [
     "-s" "tests" "-v"
   ];
 }
@@ -2002,7 +2010,7 @@ Occasionally packages don't make use of a common test framework, which may then
 
 * Non-working tests can often be deselected. Most Python modules
   do follow the standard test protocol where the pytest runner can be used.
-  `pytest` supports the `-k` and `--ignore` parameters to ignore test
+  `pytest` supports the `-k` and `--ignore-glob` parameters to ignore test
   methods or classes as well as whole files. For `pytestCheckHook` these are
   conveniently exposed as `disabledTests` and `disabledTestPaths` respectively.
 
@@ -2019,11 +2027,17 @@ Occasionally packages don't make use of a common test framework, which may then
     ];
 
     disabledTestPaths = [
-      "this/file.py"
+      "path/to/performance.py"
+      "path/to/connect-*.py"
     ];
   }
   ```
 
+  ::: {.note}
+  If the test path to disable contains characters like `*`, `?`, `[`, and `]`,
+  quote them with square brackets (`[*]`, `[?]`, `[[]`, and `[]]`) to match literally.
+  :::
+
 * Tests that attempt to access `$HOME` can be fixed by using the following
   work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
 * Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.

doc/stdenv/stdenv.chapter.md

@@ -1371,6 +1371,20 @@ This setup hook moves any systemd user units installed in the `lib/` subdirector
 
 This hook only runs when compiling for Linux.
 
+### `no-broken-symlinks.sh` {#no-broken-symlinks.sh}
+
+This setup hook checks for, reports, and (by default) fails builds when "broken" symlinks are found. A symlink is considered "broken" if it's dangling (the target doesn't exist) or reflexive (it refers to itself).
+
+This hook can be disabled by setting `dontCheckForBrokenSymlinks`.
+
+::: {.note}
+The hook only considers symlinks with targets inside the Nix store.
+:::
+
+::: {.note}
+The check for reflexivity is direct and does not account for transitivity, so this hook will not prevent cycles in symlinks.
+:::
+
 ### `set-source-date-epoch-to-latest.sh` {#set-source-date-epoch-to-latest.sh}
 
 This sets `SOURCE_DATE_EPOCH` to the modification time of the most recent file.

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -24,6 +24,8 @@
 
 - The default Elixir version has been updated to 1.18.
 
+- `buildPythonPackage`, `buildPythonApplication` and the Python building setup hooks now support both `__structuredAttrs = true` and `__structuredAttrs = false`.
+
 - `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
 
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
@@ -160,6 +162,16 @@
   instead of the python tester launcher. You can still refer to the python
   launcher via `python3Packages.toPythonApplication python3Packages.playwright`
 
+- The representation of the flags attributes as shell/environment variables for most Python building setup hooks are now the same as `stdenv.mkDerivation` and other build helpers -- they are space-separated environment variables when `__structuredAttrs = false` and Bash arrays when `__structuredAttrs = true`, and are concatenated to the command without Bash-evaluation. The following behaviour changes are introduced during the conversion:
+
+  - The following flags are no longer Bash-expanded before concatenated to the command:
+    - `disabledTests` and `disabledTestPaths` for `pytestCheckHook`. (`disabledTestPaths` used to be expanded twice before concatenation.)
+    - `setupPyBuildFlags` and `setupPyGlobalFlags` for `setuptoolsBuildHook`.
+
+  - `pytestFlags` and `unittestFlags` replace `pytestFlagsArray` and `unittestFlagsArray` and become the new and conforming interface.
+
+  - `pytestFlagsArray` and `unittestFlagsArray` are kept for compatibility purposes. They continue to be Bash-expanded before concatenated. This compatibility layer will be removed in future releases.
+
 - `strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
   and `withGstreamer`/`withVlc` override options have been removed due to this.
 

nixos/tests/postgresql/anonymizer.nix

@@ -109,7 +109,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.anonymizer.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.anonymizer.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/pgjwt.nix

@@ -50,7 +50,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.pgjwt.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.pgjwt.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/pgvecto-rs.nix

@@ -74,7 +74,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.pgvecto-rs.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.pgvecto-rs.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -129,7 +129,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -109,7 +109,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/postgresql.nix

@@ -263,7 +263,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/timescaledb.nix

@@ -93,7 +93,7 @@ in
 #   NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.postgresql.timescaledb
 lib.dontRecurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.timescaledb.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.timescaledb.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/tsja.nix

@@ -43,7 +43,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.tsja.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.tsja.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/wal2json.nix

@@ -45,7 +45,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.wal2json.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.wal2json.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

pkgs/applications/audio/ladspa-plugins/default.nix

@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
     perlPackages.perl
     perlPackages.XMLParser
     pkg-config
+    perlPackages.perl
+    perlPackages.XMLParser
   ];
   buildInputs = [
     fftw

pkgs/applications/audio/listenbrainz-mpd/default.nix

@@ -26,7 +26,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-QBc0avci232UIxzTKlS0pjL7cCuvwAFgw6dSwdtYAtU=";
   };
 
-  cargoHash = "sha256-jnDS9tIJ387A2P9oUSYB3tXrXjwwVmQ26erIIlHBkao=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-NQXXR6b1XZDihVoRNFJLXtMNjlzOIzkc4rthwx0A7AE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/audio/lpd8editor/default.nix

@@ -2,7 +2,7 @@
   lib,
   qt5,
   stdenv,
-  git,
+  gitMinimal,
   fetchFromGitHub,
   cmake,
   alsa-lib,
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-    git
+    gitMinimal
     qt5.wrapQtAppsHook
   ];
 

pkgs/applications/audio/minidsp/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-8bKP9/byVRKj1P1MP3ZVg8yw0WaNB0BcqarCti7B8CA=";
   };
 
-  cargoHash = "sha256-GUrYEFpTo83lKuDyENaVN3VhnZ2Y/igtsbEY7kNa1os=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-JIm0XcgqXGPXlkQ1rhG5D38bQkQT9K44F71ZaCT2g8o=";
 
   cargoBuildFlags = [ "-p minidsp -p minidsp-daemon" ];
 

pkgs/applications/audio/muso/default.nix

@@ -35,7 +35,8 @@ rustPlatform.buildRustPackage rec {
     cp share/* $out/share/muso/
   '';
 
-  cargoHash = "sha256-+UVUejKCfjC6zdW315wmu7f3A5GmnoQ3rIk8SK6LIRI=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-L0ZQoz9J5Hxg98puk1RbKuybLboIoOsy5qqGnvEPi1U=";
 
   meta = with lib; {
     broken = stdenv.hostPlatform.isDarwin;

pkgs/applications/audio/parrot/default.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage {
     hash = "sha256-3YTXIKj1iqCB+tN7/0v1DAaMM6aJiSxBYHO98uK8KFo=";
   };
 
-  cargoHash = "sha256-3G7NwSZaiocjgfdtmJVWfMZOHCNhC08NgolPa9AvPfE=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-be/gGKCd8/VgcjzhyMKDl5TzAuavm1rPNYBm8RLTP90=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/blockchains/electrs/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-L26jzAn8vwnw9kFd6ciyYS/OLEFTbN8doNKy3P8qKRE=";
   };
 
-  cargoHash = "sha256-/0XS4xF5gzEBWXS39f0FsIK1dFwmGT4McaExR/srB5Y=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-dqVnIiaGXnoKLvwQm/aiwSptKksikNGgAOu704rhDPA=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ rustPlatform.bindgenHook ];

pkgs/applications/blockchains/lighthouse/default.nix

@@ -7,7 +7,7 @@
 , nix-update-script
 , openssl
 , pkg-config
-, postgresql
+, libpq
 , protobuf
 , rustPlatform
 , rust-jemalloc-sys
@@ -130,7 +130,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   nativeCheckInputs = [
-    postgresql
+    libpq
   ];
 
   passthru = {

pkgs/applications/blockchains/snarkos/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+z9dgg5HdR+Gomug03gI1zdCU6t4SBHkl1Pxoq69wrc=";
   };
 
-  cargoHash = "sha256-qW/ZV4JqpNqqh8BYc+/d5g8junwhdZ38NhHclx+k/0M=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-riUOxmuXDP5+BPSPu5+cLBP43bZxAqvVG/k5kvThSAs=";
 
   # buildAndTestSubdir = "cli";
 

pkgs/applications/blockchains/teos/default.nix

@@ -32,7 +32,8 @@ in
     pname = "teos";
     inherit version src;
 
-    cargoHash = "sha256-U0imKEPszlBOaS6xEd3kfzy/w2SYe3EY/E1e0L+ViDk=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-lod5I94T4wGwXEDtvh2AyaDYM0byCfaSBP8emKV7+3M=";
 
     buildAndTestSubdir = "teos";
 
@@ -58,7 +59,8 @@ in
     pname = "teos-watchtower-plugin";
     inherit version src;
 
-    cargoHash = "sha256-3ke1qTFw/4I5dPLuPjIGp1n2C/eRfPB7A6ErMFfwUzE=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-lod5I94T4wGwXEDtvh2AyaDYM0byCfaSBP8emKV7+3M=";
 
     buildAndTestSubdir = "watchtower-plugin";
 

pkgs/applications/blockchains/zcash/default.nix

@@ -7,7 +7,7 @@
   cxx-rs,
   db62,
   fetchFromGitHub,
-  git,
+  gitMinimal,
   hexdump,
   lib,
   libevent,
@@ -42,13 +42,14 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
       --replace "linker = \"aarch64-linux-gnu-gcc\"" ""
   '';
 
-  cargoHash = "sha256-Mz8mr/RDcOfwJvXhY19rZmWHP8mUeEf9GYD+3JAPNOw=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-VBqasLpxqI4kr73Mr7OVuwb2OIhUwnY9CTyZZOyEElU=";
 
   nativeBuildInputs = [
     autoreconfHook
     cargo
     cxx-rs
-    git
+    gitMinimal
     hexdump
     makeWrapper
     pkg-config

pkgs/applications/display-managers/greetd/default.nix

@@ -18,7 +18,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-jgvYnjt7j4uubpBxrYM3YiUfF1PWuHAN1kwnv6Y+bMg=";
   };
 
-  cargoHash = "sha256-M52Kj14X+vMPKeGwi5pbEuh3F9/a3eVjhsbZI06Jkzs=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-JwTLZawY9+M09IDbMPoNUcNrnW1C2OVlEVn1n7ol6dY=";
 
   nativeBuildInputs = [
     scdoc

pkgs/applications/display-managers/greetd/regreet.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-f8Xvno5QqmWz4SUiFYDvs8lFU1ZaqQ8gpTaVzWxW4T8=";
   };
 
-  cargoHash = "sha256-XdJbghHT2NR+pWAsgayz748C8yw/Rv86lNfvjABwJws=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-abCQ3RsnZ/a1DbjQFOiA7Xs7bbqSJxwNps8yV6Q4FIw=";
 
   buildFeatures = [ "gtk4_8" ];
 

pkgs/applications/display-managers/greetd/tuigreet.nix

@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-e0YtpakEaaWdgu+bMr2VFoUc6+SUMFk4hYtSyk5aApY=";
   };
 
-  cargoHash = "sha256-RkJjAmZ++4nc/lLh8g0LxGq2DjZGxQEjFOl8Yzx116A=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-w6ZOqpwogKoN4oqqI1gFqY8xAnfvhEBVaL8/6JXpKXs=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/display-managers/greetd/wlgreet.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-TQTHFBOTxtSuzrAG4cjZ9oirl80xc0rPdYeLJ0t39DQ=";
   };
 
-  cargoHash = "sha256-+YGhfEq2RltPq5oLLh1h+vGphDpoGZNVdvzko3P1iUQ=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ITo9qvcT5aOybWLV7kn9BZbux6uxx1RwRGWCGQYdZ2I=";
 
   nativeBuildInputs = [ autoPatchelfHook ];
   buildInputs = [ gcc-unwrapped ];

pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/module.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage {
     hash = "sha256-DiqC7z1AQbXsSXc77AGRilWi3HfEg0YoHrXu54O3Clo=";
   };
 
-  cargoHash = "sha256-ZRWzkojcNlgdjXUvmdR/vjJx9k3xRvV0Yz7+8TN+8qc=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ygFXKniCCOyXndPOTKoRbd4W1OR2CSA2jr7yxpwkw28=";
 
   checkFlags = [
     # flaky test

pkgs/applications/editors/emacs/make-emacs.nix

@@ -32,6 +32,7 @@
   jansson,
   libXaw,
   libXcursor,
+  libXft,
   libXi,
   libXpm,
   libgccjit,
@@ -69,6 +70,7 @@
   withAcl ? false,
   withAlsaLib ? false,
   withAthena ? false,
+  withCairo ? withX,
   withCsrc ? true,
   withDbus ? stdenv.hostPlatform.isLinux,
   withGTK3 ? withPgtk && !noGui,
@@ -333,7 +335,6 @@ mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withX [
       Xaw3d
-      cairo
       giflib
       libXaw
       libXpm
@@ -342,6 +343,12 @@ mkDerivation (finalAttrs: {
       librsvg
       libtiff
     ]
+    ++ lib.optionals withCairo [
+      cairo
+    ]
+    ++ lib.optionals (withX && !withCairo) [
+      libXft
+    ]
     ++ lib.optionals withXinput2 [
       libXi
     ]
@@ -396,8 +403,8 @@ mkDerivation (finalAttrs: {
       else if withX then
         [
           (lib.withFeatureAs true "x-toolkit" toolkit)
-          (lib.withFeature true "cairo")
-          (lib.withFeature true "xft")
+          (lib.withFeature withCairo "cairo")
+          (lib.withFeature (!withCairo) "xft")
         ]
       else if withPgtk then
         [

pkgs/applications/editors/nano/default.nix

@@ -7,7 +7,7 @@
   texinfo,
   writeScript,
   common-updater-scripts,
-  git,
+  gitMinimal,
   nix,
   coreutils,
   gnused,
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
       PATH=${
         lib.makeBinPath [
           common-updater-scripts
-          git
+          gitMinimal
           nix
           coreutils
           gnused

pkgs/applications/editors/neovim/gnvim/default.nix

@@ -18,7 +18,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-VyyHlyMW/9zYECobQwngFARQYqcoXmopyCHUwHolXfo=";
   };
 
-  cargoHash = "sha256-uhObLKoQE+r0/ocWA26MpJsSt9RAzKG1XmZsXat+ohg=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-+i4fFiuNmc2+aFyOW2FxRZXINN1XF0nDJVsFYnIHI24=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0990";
+  version = "9.1.1046";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-KKjJCuGczwYP+NVx5f6YQRsKR0zW44ciNNvmjQ03ytM=";
+    hash = "sha256-bH3p78fWUNQRhluUvqQ5uJ+PxNhz7T7wA/4zxUDH130=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh

@@ -11,7 +11,7 @@ discover_modules() {
 
     while IFS= read -r lua_file; do
         # Ignore certain infra directories
-        if [[ "$lua_file" =~ debug/|scripts?/|tests?/|spec/ || "$lua_file" =~ .*\meta.lua ]]; then
+        if [[ "$lua_file" =~ (^|/)(debug|script|scripts|test|tests|spec)(/|$) || "$lua_file" =~ .*\meta.lua ]]; then
             continue
         # Ignore optional telescope and lualine modules
         elif [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then

pkgs/applications/editors/vim/plugins/non-generated/LanguageClient-neovim/default.nix

@@ -17,7 +17,8 @@ let
     pname = "LanguageClient-neovim-bin";
     inherit version src;
 
-    cargoHash = "sha256-H34UqJ6JOwuSABdOup5yKeIwFrGc83TUnw1ggJEx9o4=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-1tfeowqvjEjMXIfrhr388YhlZrk3ns+Y/2odQnkLw7k=";
   };
 in
 vimUtils.buildVimPlugin {

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -21,7 +21,8 @@ let
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-7W7uuyzqTTlvZAkeRYRIfkxYVbOv5h7elH8noZe1VMQ=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-KbGRt5gKsXFRFMTcwK0db53Ul7M3jMFda4m+sRjXi2Y=";
 
     nativeBuildInputs = [
       pkg-config

pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix

@@ -22,7 +22,8 @@ let
 
     sourceRoot = "${src.name}/generator";
 
-    cargoHash = "sha256-6n37n8oHIHrz3S1+40nuD0Ud3l0iNgXig1ZwrgsnYTI=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-tg4BO4tPzHhJTowL7RiAuBo4i440FehpGmnz9stTxfI=";
 
     nativeBuildInputs = [
       pkg-config

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

@@ -19,7 +19,8 @@ let
     pname = "cord.nvim-rust";
     inherit version src;
 
-    cargoHash = "sha256-wYXJ4+8b3PtHzL2jdplNHrjIBzbAzA7jdvLZ7Vz+Yz8=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-UJdSQNaYaZxvmfuHwePzGhQ3Pv+Cm7YaRK1L0CJhtEc=";
 
     installPhase =
       let

pkgs/applications/editors/vim/plugins/non-generated/nvim-spectre/default.nix

@@ -20,7 +20,8 @@ let
     inherit version src;
     sourceRoot = "${src.name}/spectre_oxi";
 
-    cargoHash = "sha256-UieSVIITsk6iqd68JKFYYBTSDm4kPs+a9V+Y0gB9kFU=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-0szVL45QRo3AuBMf+WQ0QF0CS1B9HWPxfF6l6TJtv6Q=";
 
     preCheck = ''
       mkdir tests/tmp/

pkgs/applications/editors/vim/plugins/non-generated/sg-nvim/default.nix

@@ -21,7 +21,8 @@ let
     pname = "sg-nvim-rust";
     inherit version src;
 
-    cargoHash = "sha256-4GaBrIMPuPOPeMVlDlb9XBe2txeM4196sdZ1r8bu7Kk=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-yY/5w2ztmTKJAYDxBJND8itCOwRNi1negiFq3PyFaSM=";
 
     nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/editors/vim/plugins/non-generated/sniprun/default.nix

@@ -24,7 +24,8 @@ let
     pname = "sniprun-bin";
     inherit version src;
 
-    cargoHash = "sha256-eZcWS+DWec0V9G6hBnZRUNcb3uZeSiBhn4Ed9KodFV8=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-j3i86I5Lmt0+fQONikHnxfeLEbiyFSairgjHXmjZfTk=";
 
     nativeBuildInputs = [ makeWrapper ];
 

pkgs/applications/editors/vim/plugins/non-generated/vim-markdown-composer/default.nix

@@ -17,7 +17,8 @@ let
   vim-markdown-composer-bin = rustPlatform.buildRustPackage {
     pname = "vim-markdown-composer-bin";
     inherit src version;
-    cargoHash = "sha256-z5hjY2RUbM5NLfRtyfiHi4PjMnKdAflaZsHw53lgU2E=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-xzlEIaDEYDbxJ6YqzF+lSHcB9O+brClw026YI1YeNUc=";
     # tests require network access
     doCheck = false;
   };

pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/adapter.nix

@@ -13,7 +13,8 @@ rustPlatform.buildRustPackage {
   pname = "${pname}-adapter";
   inherit version src;
 
-  cargoHash = "sha256-e/Jki/4pCs0qzaBVR4iiUhdBFmWlTZYREQkuFSoWYFo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-7tGX8wt2bb1segoWbBEBwZbznOaAiAyh9i/JC5FKUBU=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ lldb ];
 

pkgs/applications/editors/zee/default.nix

@@ -33,7 +33,8 @@ rustPlatform.buildRustPackage rec {
   # see https://github.com/zee-editor/zee#syntax-highlighting
   ZEE_DISABLE_GRAMMAR_BUILD = 1;
 
-  cargoHash = "sha256-fBBjtjM7AnyAL6EOFstL4h6yS+UoLgxck6Mc0tJcXaI=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-auwbpavF/WZQIE/htYXJ4di6xoRtXkBBkP/Bj4lFp6U=";
 
   meta = with lib; {
     description = "Modern text editor for the terminal written in Rust";

pkgs/applications/gis/grass/default.nix

@@ -27,7 +27,7 @@
 , netcdf
 , pdal
 , pkg-config
-, postgresql
+, libpq
 , proj
 , python3Packages
 , readline
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxml2
     netcdf
     pdal
-    postgresql
+    libpq
     proj
     readline
     sqlite
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-openmp"
     "--with-pdal"
     "--with-postgres"
-    "--with-postgres-libs=${postgresql.lib}/lib/"
+    "--with-postgres-libs=${libpq}/lib/"
     "--with-proj-includes=${proj.dev}/include"
     "--with-proj-libs=${proj}/lib"
     "--with-proj-share=${proj}/share/proj"

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -21,6 +21,7 @@
   grass,
   gsl,
   hdf5,
+  libpq,
   libspatialindex,
   libspatialite,
   libzip,
@@ -28,7 +29,6 @@
   ninja,
   openssl,
   pdal,
-  postgresql,
   proj,
   protobuf,
   python3,
@@ -116,13 +116,13 @@ mkDerivation rec {
       geos
       gsl
       hdf5
+      libpq
       libspatialindex
       libspatialite
       libzip
       netcdf
       openssl
       pdal
-      postgresql
       proj
       protobuf
       qca-qt5

pkgs/applications/gis/qgis/unwrapped.nix

@@ -27,7 +27,7 @@
 , ninja
 , openssl
 , pdal
-, postgresql
+, libpq
 , proj
 , protobuf
 , python3
@@ -119,7 +119,7 @@ in mkDerivation rec {
     netcdf
     openssl
     pdal
-    postgresql
+    libpq
     proj
     protobuf
     qca-qt5

pkgs/applications/gis/whitebox-tools/default.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-kvtfEEydwonoDux1VbAxqrF/Hf8Qh8mhprYnROGOC6g=";
   };
 
-  cargoHash = "sha256-6v/3b6BHh/n7M2ZhLVKRvv0Va2xbLUSsxUb5paOStbQ=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-yQFGuhEGgkaa5N4uUIZ/0GFzP9CsPtiFet0hUppIQzQ=";
 
   buildInputs = [
     atk

pkgs/applications/graphics/drawpile/default.nix

@@ -76,9 +76,9 @@ mkDerivation rec {
     sha256 = "sha256-NS1aQlWpn3f+SW0oUjlYwHtOS9ZgbjFTrE9grjK5REM=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-V36yiwraXK7qlJd1r8EtEA4ULxlgvMEmpn/ka3m9GjA=";
+    hash = "sha256-rY4zWSCBfVXvl6p9GvtDg/PFZfLkWTl8FTYdlKTzWYM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/emulsion/default.nix

@@ -49,7 +49,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-0t+MUZu1cvkJSL9Ly9kblH8fMr05KuRpOo+JDn/VUc8=";
   };
 
-  cargoHash = "sha256-detJZRnxT3FubaF/A4w2pFdhW03BH0gsaeuNFYu+cBw=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-1s5kCUxn4t1A40QHuygGKaqphLmcl+EYfx++RZQmL00=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/graphics/gnome-decoder/default.nix

@@ -38,10 +38,10 @@ clangStdenv.mkDerivation rec {
     hash = "sha256-qSPuEVW+FwC9OJa+dseIy4/2bhVdTryJSJNSpes9tpY=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-MbfukvqlzZPnWNtWCwYn7lABqBxtZWvPDba9Deah+w8=";
+    hash = "sha256-xQlzSsvwDNK3Z8xnUQgCU6Q8+ls0Urks778pYwN2X1Y=";
   };
 
   preFixup = ''

pkgs/applications/graphics/gnome-obfuscate/default.nix

@@ -33,10 +33,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/Plvvn1tle8t/bsPcsamn5d81CqnyGCyGYPF6j6U5NI=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-9lrxK2psdIPGsOC6p8T+3AGPrX6PjrK9mFirdJqBSMM=";
+    hash = "sha256-Llgn+dYNKZ9Mles9f9Xor+GZoCCQ0cERkXz4MicZglY=";
   };
 
   env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {

pkgs/applications/graphics/menyoki/default.nix

@@ -23,7 +23,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-owP3G1Rygraifdc4iPURQ1Es0msNhYZIlfrtj0CSU6Y=";
   };
 
-  cargoHash = "sha256-NtXjlGkX8AzSw98xHPymzdnTipMIunyDbpSr4eVowa0=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-6FRc/kEhGJXIZ+6GXeYj5j7QVmvZgIQgtDPvt94hlho=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional stdenv.hostPlatform.isLinux pkg-config;
 

pkgs/applications/misc/binocle/default.nix

@@ -26,7 +26,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-WAk7xIrCRfVofn4w+gP5E3wnSZbXm/6MZWlNmtoLm20=";
   };
 
-  cargoHash = "sha256-ZmY88WcoQiDLSXkBbnE/+jPX713qh6n+nyNXeWWTBKA=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-AUmDubbi6y1SaHZazr2xZc+16SQhI6WBnPg6I7rv3K4=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/applications/misc/cobalt/default.nix

@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-6fsKEIgcBu0SE/f0TNfvTdpZX3zc5Bd0F1T82COOqVQ=";
   };
 
-  cargoHash = "sha256-g25Pw3BlRbuaGjsQav6mU9zVyS1mVUKkgKDOILm8R6U=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-NLSdYGZy+FWjA5N1zGf3Lajg2qo4TJ86AzlKVrHxwaU=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
 

pkgs/applications/misc/eureka-ideas/default.nix

@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-NJ1O8+NBG0y39bMOZeah2jSZlvnPrtpCtXrgAYmVrAc=";
   };
 
-  cargoHash = "sha256-tNUWW0HgXl+tM9uciApLSkLDDkzrvAiWmiYs2y/dEOM=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nTYMKJ5OCApqooIF1dsDLriPfYjkZkTdtzpkJya/5ag=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/misc/inherd-quake/default.nix

@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-HKAR4LJm0lrQgTOCqtYIRFbO3qHtPbr4Fpx2ek1oJ4Q=";
   };
 
-  cargoHash = "sha256-svvtZyfN91OT3yqxH6TgFhGYg9drpXsts4p2WqSHG8w=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-klxigm3RpTfwbENva2WmOPaiJEV2yujY323xRkAML0I=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/misc/inlyne/default.nix

@@ -25,7 +25,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-j4DEau7LZxIoVIIYwCUgqmkSgdRxWzF5/vOS0lvjgUk=";
   };
 
-  cargoHash = "sha256-fMovzaP+R0CUwJy1HKATH2tPrIPwzGtubF1WHUoQDRY=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-9Ev/D58MU0aMleM6NFG7MsXqGlhi0eAujqYaLDuPjIY=";
 
   nativeBuildInputs =
     [

pkgs/applications/misc/klipper-estimator/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-EjfW2qeq0ehGhjE2Psz5g/suYMZPvtQi2gaYb+NCa2U=";
   };
 
-  cargoHash = "sha256-bboXG2nBrK2hVzB43um6EUgLPlSa8huyPH7VOJ48Nkk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-wMgFkzgoHjvE+5t+cA5OW2COXbUj/5tWXz0Zp9cd5lw=";
 
   buildInputs =
     [ openssl ]

pkgs/applications/misc/mdzk/default.nix

@@ -22,7 +22,8 @@ rustPlatform.buildRustPackage rec {
     ./update-mdbook-for-rust-1.64.patch
   ];
 
-  cargoHash = "sha256-5zGUBvmf68tCk5jGrNn+ukgYbiKzrlmZvWrYgoJf2zk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-+x4pOtszvdzI/zR55ezcxlS52GrWQTuBn7vbnqDTVac=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
 

pkgs/applications/misc/openbangla-keyboard/default.nix

@@ -61,13 +61,13 @@ stdenv.mkDerivation rec {
       zstd
     ];
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     postPatch = ''
       cp ${./Cargo.lock} Cargo.lock
     '';
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-XMleyP2h1aBhtjXhuGHyU0BN+tuL12CGoj+kLY5uye0=";
+    hash = "sha256-qZMTZi7eqEp5kSmVx7qdS7eDKOzSv9fMjWT0h/MGyeY=";
   };
 
   cmakeFlags =

pkgs/applications/misc/pastel/default.nix

@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-kr2aLRd143ksVx42ZDO/NILydObinn3AwPCniXVVmY0=";
   };
 
-  cargoHash = "sha256-+Cw/aAXkSbYLqc7TGWsMUJNo88v0s1Cq1m4V84j3gXE=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-u+1KDcC2KGqvmOk6k7hOHE16TMvDg92eMOdNMQQszug=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
 

pkgs/applications/misc/pgmodeler/default.nix

@@ -9,7 +9,7 @@
   qmake,
   qtwayland,
   qtsvg,
-  postgresql,
+  libpq,
   cups,
   libxml2,
 }:
@@ -37,17 +37,16 @@ stdenv.mkDerivation rec {
       "CONFIG+=release"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "PGSQL_INC=${lib.getDev postgresql}/include"
-      "PGSQL_LIB=${lib.getLib postgresql}/lib/libpq.dylib"
+      "PGSQL_INC=${lib.getDev libpq}/include"
+      "PGSQL_LIB=${lib.getLib libpq}/lib/libpq.dylib"
       "XML_INC=${libxml2.dev}/include/libxml2"
       "XML_LIB=${libxml2.out}/lib/libxml2.dylib"
       "PREFIX=${placeholder "out"}/Applications/pgModeler.app/Contents"
     ];
 
-  # todo: libpq would suffice here. Unfortunately this won't work, if one uses only postgresql.lib here.
   buildInputs =
     [
-      postgresql
+      libpq
       qtsvg
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ]

pkgs/applications/misc/pomodoro/default.nix

@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-ZA1q1YVJcdSUF9NTikyT3vrRnqbsu5plzRI2gMu+qnQ=";
   };
 
-  cargoHash = "sha256-6ZhWStZebXSwrej36DXifrsrmR1SWW3PwGUX0hqPwE4=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-oXOf9G0BMSbFFAsmRaAZzaquFva1i1gJ4ISqJkqSx4k=";
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
 
   meta = with lib; {

pkgs/applications/misc/pueue/default.nix

@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-b4kZ//+rO70uZh1fvI4A2dbCZ7ymci9g/u5keMBWYf8=";
   };
 
-  cargoHash = "sha256-sTpxcJs5I7LzVw56ka5PlFixJSiJeCae9serS0FhmuA=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-MDUBP1NI50I8sSXHYFiAdyL8C2DloCjnq8pr7PsBBIE=";
 
   nativeBuildInputs =
     [

pkgs/applications/misc/reddsaver/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "07xsrc0w0z7w2w0q44aqnn1ybf9vqry01v3xr96l1xzzc5mkqdzf";
   };
 
-  cargoHash = "sha256-l+fxk9gkM+pStBVJcsN4P2tNCuFIiBaAxpq9SLlvJHk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-xYtdGhuieFudfJz+LxUjP7mV8uItaIvLahCH7vBWTtg=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;

pkgs/applications/misc/stork/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-qGcEhoytkCkcaA5eHc8GVgWvbOIyrO6BCp+EHva6wTw=";
   };
 
-  cargoHash = "sha256-a7ADTJ0VmKiZBr951JIAOSPWucsBl5JnM8eQHWssRM4=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nN2aNNBq2YDOY9H9682hvwrlI5WTg7s1EPi68UuBTBM=";
 
   checkFlags = [
     # Fails for 1.6.0, but binary works fine

pkgs/applications/misc/terminal-typeracer/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-S3OW6KihRd6ReTWUXRb1OWC7+YoxehjFRBxcnJVgImU=";
   };
 
-  cargoHash = "sha256-OwbFIbKB/arj+3gq2tfEq8yTKSUPBQNYJNzrWvDv4A4=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-WYqbG0iSVvnRLCy5Qs4wr72LjQ6uPgskVWP62Af0RQ8=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/misc/visidata/default.nix

@@ -40,7 +40,7 @@
   zstandard,
   zulip,
   # other
-  git,
+  gitMinimal,
   withPcap ? true,
   dpkt,
   dnslib,
@@ -121,7 +121,7 @@ buildPythonApplication rec {
     ++ lib.optional withXclip xclip;
 
   nativeCheckInputs = [
-    git
+    gitMinimal
   ];
 
   # check phase uses the output bin, which is not possible when cross-compiling

pkgs/applications/networking/browsers/asuka/default.nix

@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+rj6P3ejc4Qb/uqbf3N9MqyqDT7yg9JFE0yfW/uzd6M=";
   };
 
-  cargoHash = "sha256-XrFpvH3qiMvpgbH7Q+KC1zFAqJT4rjxux6Q5KLY2ufI=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-aNHkhcvOdK6sf6nWxCNPxcktYhrnmLdMrLqWb/1QBQ4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/networking/feedreaders/tuifeed/default.nix

@@ -15,7 +15,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-JG/l6NfN5RqBpz9NVcVY3mP/iE31TXvw+Vjq8N8rNIY=";
   };
 
-  cargoHash = "sha256-QKSNbpVRtSKp2q1jVPYTS8XCMtQAyg3AWvD/6+OjI7Y=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-UlZDT/i3UB0wGGpuSBBvVPqRbzGHneDJs57pHn11E5k=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 

pkgs/applications/networking/geph/default.nix

@@ -38,7 +38,8 @@ in
       hash = "sha256-6YWPsSRIZpvVCIGZ1z7srobDvVzLr0o2jBcB/7kbK7I=";
     };
 
-    cargoHash = "sha256-c9Sq3mdotvB/oNIiOLTrAAUnUdkaye7y1l+29Uwjfm8=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-igIYTlI3hqvlOTgdwouA9YussP9h0pOHUUTCjA2LE5U=";
 
     nativeBuildInputs = [ perl ];
 

pkgs/applications/networking/gopher/phetch/default.nix

@@ -27,7 +27,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-J+ka7/B37WzVPPE2Krkd/TIiVwuKfI2QYWmT0JHgBGQ=";
   };
 
-  cargoHash = "sha256-y3Y5PnZ51Zc3LmVTijUGnb0KaGm28sWOSYxjuM3A1Zk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-2lbQAM3gdytXsoMFzKwLWA1hvQIJf1vBdMRpYx/VLVg=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/networking/instant-messengers/teamspeak/server.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  postgresql,
+  libpq,
   autoPatchelfHook,
   writeScript,
 }:
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     stdenv.cc.cc
-    postgresql.lib
+    libpq
   ];
 
   nativeBuildInputs = [ autoPatchelfHook ];

pkgs/applications/networking/instant-messengers/twitch-tui/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-uo9QEwSRIJKjWza8dEQXDCMQ/ydKBk/BX2TaVhX+k1M=";
   };
 
-  cargoHash = "sha256-QYT5Aqwl2m/+SZlw55Ep3dIfmESSNowN30JJ52mY/Lk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-H/MAbN7wCg74bNWt5xlNaukvGJLYyzuynYtIqxBOcbo=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/irc/tiny/default.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-phjEae2SS3zkSpuhhE4iscUM8ij8DT47YLIMATMG/+Q=";
   };
 
-  cargoHash = "sha256-DvFrRH6wObMvkRxS8vh3tlCrZNAiuZHfN0ARagMfG2k=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-lyjTl0kbtfQdqSqxti1181+oDVYP4U++v2JEOYvI7aM=";
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isLinux pkg-config;
   buildInputs =

pkgs/applications/networking/mhost/default.nix

@@ -18,7 +18,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-6jn9jOCh96d9y2l1OZ5hgxg7sYXPUFzJiiT95OR7lD0=";
   };
 
-  cargoHash = "sha256-d2JYT/eJaGm8pfmjsuSZiQxlzcsypFH53F/9joW0J6I=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-n+ZVsdR+X7tMqZFYsjsWSUr6OkD90s44EFORqRldCNE=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     Security

pkgs/applications/networking/mujmap/default.nix

@@ -18,7 +18,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-Qb9fEPQrdn+Ek9bdOMfaPIxlGGpQ9RfQZOeeqoOf17E=";
   };
 
-  cargoHash = "sha256-nnAYjutjxtEpDNoWTnlESDO4Haz14wZxY4gdyzdLgBU=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-LyiJYKhoSXVf1P+nu56Wgp+z8biPpt0tWgPZQrB2NNQ=";
 
   buildInputs = [
     notmuch

pkgs/applications/networking/p2p/gnunet/default.nix

@@ -3,7 +3,7 @@
 , makeWrapper, ncurses, pkg-config, libxml2, sqlite, zlib
 , libpulseaudio, libopus, libogg, jansson, libsodium
 
-, postgresqlSupport ? true, postgresql }:
+, postgresqlSupport ? true, libpq }:
 
 stdenv.mkDerivation rec {
   pname = "gnunet";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     adns curl gmp gnutls libextractor libgcrypt libgnurl libidn
     libmicrohttpd libunistring libxml2 ncurses gettext libsodium
     sqlite zlib libpulseaudio libopus libogg jansson
-  ] ++ lib.optional postgresqlSupport postgresql;
+  ] ++ lib.optional postgresqlSupport libpq;
 
   preConfigure = ''
     # Brute force: since nix-worker chroots don't provide

pkgs/applications/networking/p2p/synapse-bt/default.nix

@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-2irXNgEK9BjRuNu3DUMElmf2vIpGzwoFneAEe97GRh4=";
   };
 
-  cargoHash = "sha256-TwXouPYM7Hg1HEr2KnEPScYFkC52PcQ5kb5aGP1gj9U=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ebqUH01h4B3Aq3apSKpae8ncaFirbrZiDxjiQM9kzg4=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =

pkgs/applications/networking/sync/rsync/CVE-2024-12084/0001-Some-checksum-buffer-fixes.patch

@@ -1,151 +0,0 @@
-From 0902b52f6687b1f7952422080d50b93108742e53 Mon Sep 17 00:00:00 2001
-From: Wayne Davison <wayne@opencoder.net>
-Date: Tue, 29 Oct 2024 22:55:29 -0700
-Subject: [PATCH 1/2] Some checksum buffer fixes.
-
-- Put sum2_array into sum_struct to hold an array of sum2 checksums
-  that are each xfer_sum_len bytes.
-- Remove sum2 buf from sum_buf.
-- Add macro sum2_at() to access each sum2 array element.
-- Throw an error if a sums header has an s2length larger than
-  xfer_sum_len.
----
- io.c     | 3 ++-
- match.c  | 8 ++++----
- rsync.c  | 5 ++++-
- rsync.h  | 4 +++-
- sender.c | 4 +++-
- 5 files changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/io.c b/io.c
-index a99ac0ec..bb60eeca 100644
---- a/io.c
-+++ b/io.c
-@@ -55,6 +55,7 @@ extern int read_batch;
- extern int compat_flags;
- extern int protect_args;
- extern int checksum_seed;
-+extern int xfer_sum_len;
- extern int daemon_connection;
- extern int protocol_version;
- extern int remove_source_files;
-@@ -1977,7 +1978,7 @@ void read_sum_head(int f, struct sum_struct *sum)
- 		exit_cleanup(RERR_PROTOCOL);
- 	}
- 	sum->s2length = protocol_version < 27 ? csum_length : (int)read_int(f);
--	if (sum->s2length < 0 || sum->s2length > MAX_DIGEST_LEN) {
-+	if (sum->s2length < 0 || sum->s2length > xfer_sum_len) {
- 		rprintf(FERROR, "Invalid checksum length %d [%s]\n",
- 			sum->s2length, who_am_i());
- 		exit_cleanup(RERR_PROTOCOL);
-diff --git a/match.c b/match.c
-index cdb30a15..36e78ed2 100644
---- a/match.c
-+++ b/match.c
-@@ -232,7 +232,7 @@ static void hash_search(int f,struct sum_struct *s,
- 				done_csum2 = 1;
- 			}
- 
--			if (memcmp(sum2,s->sums[i].sum2,s->s2length) != 0) {
-+			if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0) {
- 				false_alarms++;
- 				continue;
- 			}
-@@ -252,7 +252,7 @@ static void hash_search(int f,struct sum_struct *s,
- 					if (i != aligned_i) {
- 						if (sum != s->sums[aligned_i].sum1
- 						 || l != s->sums[aligned_i].len
--						 || memcmp(sum2, s->sums[aligned_i].sum2, s->s2length) != 0)
-+						 || memcmp(sum2, sum2_at(s, aligned_i), s->s2length) != 0)
- 							goto check_want_i;
- 						i = aligned_i;
- 					}
-@@ -271,7 +271,7 @@ static void hash_search(int f,struct sum_struct *s,
- 						if (sum != s->sums[i].sum1)
- 							goto check_want_i;
- 						get_checksum2((char *)map, l, sum2);
--						if (memcmp(sum2, s->sums[i].sum2, s->s2length) != 0)
-+						if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0)
- 							goto check_want_i;
- 						/* OK, we have a re-alignment match.  Bump the offset
- 						 * forward to the new match point. */
-@@ -290,7 +290,7 @@ static void hash_search(int f,struct sum_struct *s,
- 			 && (!updating_basis_file || s->sums[want_i].offset >= offset
- 			  || s->sums[want_i].flags & SUMFLG_SAME_OFFSET)
- 			 && sum == s->sums[want_i].sum1
--			 && memcmp(sum2, s->sums[want_i].sum2, s->s2length) == 0) {
-+			 && memcmp(sum2, sum2_at(s, want_i), s->s2length) == 0) {
- 				/* we've found an adjacent match - the RLL coder
- 				 * will be happy */
- 				i = want_i;
-diff --git a/rsync.c b/rsync.c
-index cd288f57..b130aba5 100644
---- a/rsync.c
-+++ b/rsync.c
-@@ -437,7 +437,10 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr, cha
-   */
- void free_sums(struct sum_struct *s)
- {
--	if (s->sums) free(s->sums);
-+	if (s->sums) {
-+		free(s->sums);
-+		free(s->sum2_array);
-+	}
- 	free(s);
- }
- 
-diff --git a/rsync.h b/rsync.h
-index d3709fe0..8ddbe702 100644
---- a/rsync.h
-+++ b/rsync.h
-@@ -958,12 +958,12 @@ struct sum_buf {
- 	uint32 sum1;	        /**< simple checksum */
- 	int32 chain;		/**< next hash-table collision */
- 	short flags;		/**< flag bits */
--	char sum2[SUM_LENGTH];	/**< checksum  */
- };
- 
- struct sum_struct {
- 	OFF_T flength;		/**< total file length */
- 	struct sum_buf *sums;	/**< points to info for each chunk */
-+	char *sum2_array;	/**< checksums of length xfer_sum_len */
- 	int32 count;		/**< how many chunks */
- 	int32 blength;		/**< block_length */
- 	int32 remainder;	/**< flength % block_length */
-@@ -982,6 +982,8 @@ struct map_struct {
- 	int status;		/* first errno from read errors		*/
- };
- 
-+#define sum2_at(s, i)	((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
-+
- #define NAME_IS_FILE		(0)    /* filter name as a file */
- #define NAME_IS_DIR		(1<<0) /* filter name as a dir */
- #define NAME_IS_XATTR		(1<<2) /* filter name as an xattr */
-diff --git a/sender.c b/sender.c
-index 3d4f052e..ab205341 100644
---- a/sender.c
-+++ b/sender.c
-@@ -31,6 +31,7 @@ extern int log_before_transfer;
- extern int stdout_format_has_i;
- extern int logfile_format_has_i;
- extern int want_xattr_optim;
-+extern int xfer_sum_len;
- extern int csum_length;
- extern int append_mode;
- extern int copy_links;
-@@ -94,10 +95,11 @@ static struct sum_struct *receive_sums(int f)
- 		return(s);
- 
- 	s->sums = new_array(struct sum_buf, s->count);
-+	s->sum2_array = new_array(char, s->count * xfer_sum_len);
- 
- 	for (i = 0; i < s->count; i++) {
- 		s->sums[i].sum1 = read_int(f);
--		read_buf(f, s->sums[i].sum2, s->s2length);
-+		read_buf(f, sum2_at(s, i), s->s2length);
- 
- 		s->sums[i].offset = offset;
- 		s->sums[i].flags = 0;
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12084/0002-Another-cast-when-multiplying-integers.patch

@@ -1,39 +0,0 @@
-From 42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1 Mon Sep 17 00:00:00 2001
-From: Wayne Davison <wayne@opencoder.net>
-Date: Tue, 5 Nov 2024 11:01:03 -0800
-Subject: [PATCH 2/2] Another cast when multiplying integers.
-
----
- rsync.h  | 2 +-
- sender.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/rsync.h b/rsync.h
-index 8ddbe702..0f9e277f 100644
---- a/rsync.h
-+++ b/rsync.h
-@@ -982,7 +982,7 @@ struct map_struct {
- 	int status;		/* first errno from read errors		*/
- };
- 
--#define sum2_at(s, i)	((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
-+#define sum2_at(s, i)	((s)->sum2_array + ((size_t)(i) * xfer_sum_len))
- 
- #define NAME_IS_FILE		(0)    /* filter name as a file */
- #define NAME_IS_DIR		(1<<0) /* filter name as a dir */
-diff --git a/sender.c b/sender.c
-index ab205341..2bbff2fa 100644
---- a/sender.c
-+++ b/sender.c
-@@ -95,7 +95,7 @@ static struct sum_struct *receive_sums(int f)
- 		return(s);
- 
- 	s->sums = new_array(struct sum_buf, s->count);
--	s->sum2_array = new_array(char, s->count * xfer_sum_len);
-+	s->sum2_array = new_array(char, (size_t)s->count * xfer_sum_len);
- 
- 	for (i = 0; i < s->count; i++) {
- 		s->sums[i].sum1 = read_int(f);
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12085/0001-prevent-information-leak-off-the-stack.patch

@@ -1,27 +0,0 @@
-From cf620065502f065d4ea44f5df4f81295a738aa21 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Thu, 14 Nov 2024 09:57:08 +1100
-Subject: [PATCH] prevent information leak off the stack
-
-prevent leak of uninitialised stack data in hash_search
----
- match.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/match.c b/match.c
-index 36e78ed2..dfd6af2c 100644
---- a/match.c
-+++ b/match.c
-@@ -147,6 +147,9 @@ static void hash_search(int f,struct sum_struct *s,
- 	int more;
- 	schar *map;
- 
-+	// prevent possible memory leaks
-+	memset(sum2, 0, sizeof sum2);
-+
- 	/* want_i is used to encourage adjacent matches, allowing the RLL
- 	 * coding of the output to work more efficiently. */
- 	want_i = 0;
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0001-refuse-fuzzy-options-when-fuzzy-not-selected.patch

@@ -1,37 +0,0 @@
-From 3feb8669d875d03c9ceb82e208ef40ddda8eb908 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Sat, 23 Nov 2024 11:08:03 +1100
-Subject: [PATCH 1/4] refuse fuzzy options when fuzzy not selected
-
-this prevents a malicious server providing a file to compare to when
-the user has not given the fuzzy option
----
- receiver.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/receiver.c b/receiver.c
-index 6b4b369e..2d7f6033 100644
---- a/receiver.c
-+++ b/receiver.c
-@@ -66,6 +66,7 @@ extern char sender_file_sum[MAX_DIGEST_LEN];
- extern struct file_list *cur_flist, *first_flist, *dir_flist;
- extern filter_rule_list daemon_filter_list;
- extern OFF_T preallocated_len;
-+extern int fuzzy_basis;
- 
- extern struct name_num_item *xfer_sum_nni;
- extern int xfer_sum_len;
-@@ -716,6 +717,10 @@ int recv_files(int f_in, int f_out, char *local_name)
- 				fnamecmp = get_backup_name(fname);
- 				break;
- 			case FNAMECMP_FUZZY:
-+				if (fuzzy_basis == 0) {
-+					rprintf(FERROR_XFER, "rsync: refusing malicious fuzzy operation for %s\n", xname);
-+					exit_cleanup(RERR_PROTOCOL);
-+				}
- 				if (file->dirname) {
- 					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
- 					fnamecmp = fnamecmpbuf;
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0002-added-secure_relative_open.patch

@@ -1,103 +0,0 @@
-From 33385aefe4773e7a3982d41995681eb079c92d12 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Sat, 23 Nov 2024 12:26:10 +1100
-Subject: [PATCH 2/4] added secure_relative_open()
-
-this is an open that enforces no symlink following for all path
-components in a relative path
----
- syscall.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 74 insertions(+)
-
-diff --git a/syscall.c b/syscall.c
-index d92074aa..a4b7f542 100644
---- a/syscall.c
-+++ b/syscall.c
-@@ -33,6 +33,8 @@
- #include <sys/syscall.h>
- #endif
- 
-+#include "ifuncs.h"
-+
- extern int dry_run;
- extern int am_root;
- extern int am_sender;
-@@ -712,3 +714,75 @@ int do_open_nofollow(const char *pathname, int flags)
- 
- 	return fd;
- }
-+
-+/*
-+  open a file relative to a base directory. The basedir can be NULL,
-+  in which case the current working directory is used. The relpath
-+  must be a relative path, and the relpath must not contain any
-+  elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
-+  applies to all path components, not just the last component)
-+*/
-+int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
-+{
-+	if (!relpath || relpath[0] == '/') {
-+		// must be a relative path
-+		errno = EINVAL;
-+		return -1;
-+	}
-+
-+#if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
-+	// really old system, all we can do is live with the risks
-+	if (!basedir) {
-+		return open(relpath, flags, mode);
-+	}
-+	char fullpath[MAXPATHLEN];
-+	pathjoin(fullpath, sizeof fullpath, basedir, relpath);
-+	return open(fullpath, flags, mode);
-+#else
-+	int dirfd = AT_FDCWD;
-+	if (basedir != NULL) {
-+		dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
-+		if (dirfd == -1) {
-+			return -1;
-+		}
-+	}
-+	int retfd = -1;
-+
-+	char *path_copy = my_strdup(relpath, __FILE__, __LINE__);
-+	if (!path_copy) {
-+		return -1;
-+	}
-+	
-+	for (const char *part = strtok(path_copy, "/");
-+	     part != NULL;
-+	     part = strtok(NULL, "/"))
-+	{
-+		int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
-+		if (next_fd == -1 && errno == ENOTDIR) {
-+			if (strtok(NULL, "/") != NULL) {
-+				// this is not the last component of the path
-+				errno = ELOOP;
-+				goto cleanup;
-+			}
-+			// this could be the last component of the path, try as a file
-+			retfd = openat(dirfd, part, flags | O_NOFOLLOW, mode);
-+			goto cleanup;
-+		}
-+		if (next_fd == -1) {
-+			goto cleanup;
-+		}
-+		if (dirfd != AT_FDCWD) close(dirfd);
-+		dirfd = next_fd;
-+	}
-+
-+	// the path must be a directory
-+	errno = EINVAL;
-+
-+cleanup:
-+	free(path_copy);
-+	if (dirfd != AT_FDCWD) {
-+		close(dirfd);
-+	}
-+	return retfd;
-+#endif // O_NOFOLLOW, O_DIRECTORY
-+}
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0003-receiver-use-secure_relative_open-for-basis-file.patch

@@ -1,103 +0,0 @@
-From e59ef9939d3f0ccc8f9bab51442989a81be0c914 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Sat, 23 Nov 2024 12:28:13 +1100
-Subject: [PATCH 3/4] receiver: use secure_relative_open() for basis file
-
-this prevents attacks where the basis file is manipulated by a
-malicious sender to gain information about files outside the
-destination tree
----
- receiver.c | 42 ++++++++++++++++++++++++++----------------
- 1 file changed, 26 insertions(+), 16 deletions(-)
-
-diff --git a/receiver.c b/receiver.c
-index 2d7f6033..8031b8f4 100644
---- a/receiver.c
-+++ b/receiver.c
-@@ -552,6 +552,8 @@ int recv_files(int f_in, int f_out, char *local_name)
- 	progress_init();
- 
- 	while (1) {
-+		const char *basedir = NULL;
-+
- 		cleanup_disable();
- 
- 		/* This call also sets cur_flist. */
-@@ -722,27 +724,29 @@ int recv_files(int f_in, int f_out, char *local_name)
- 					exit_cleanup(RERR_PROTOCOL);
- 				}
- 				if (file->dirname) {
--					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
--					fnamecmp = fnamecmpbuf;
--				} else
--					fnamecmp = xname;
-+					basedir = file->dirname;
-+				}
-+				fnamecmp = xname;
- 				break;
- 			default:
- 				if (fnamecmp_type > FNAMECMP_FUZZY && fnamecmp_type-FNAMECMP_FUZZY <= basis_dir_cnt) {
- 					fnamecmp_type -= FNAMECMP_FUZZY + 1;
- 					if (file->dirname) {
--						stringjoin(fnamecmpbuf, sizeof fnamecmpbuf,
--							   basis_dir[fnamecmp_type], "/", file->dirname, "/", xname, NULL);
--					} else
--						pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], xname);
-+						pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], file->dirname);
-+						basedir = fnamecmpbuf;
-+					} else {
-+						basedir = basis_dir[fnamecmp_type];
-+					}
-+					fnamecmp = xname;
- 				} else if (fnamecmp_type >= basis_dir_cnt) {
- 					rprintf(FERROR,
- 						"invalid basis_dir index: %d.\n",
- 						fnamecmp_type);
- 					exit_cleanup(RERR_PROTOCOL);
--				} else
--					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], fname);
--				fnamecmp = fnamecmpbuf;
-+				} else {
-+					basedir = basis_dir[fnamecmp_type];
-+					fnamecmp = fname;
-+				}
- 				break;
- 			}
- 			if (!fnamecmp || (daemon_filter_list.head
-@@ -765,7 +769,7 @@ int recv_files(int f_in, int f_out, char *local_name)
- 		}
- 
- 		/* open the file */
--		fd1 = do_open(fnamecmp, O_RDONLY, 0);
-+		fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
- 
- 		if (fd1 == -1 && protocol_version < 29) {
- 			if (fnamecmp != fname) {
-@@ -776,14 +780,20 @@ int recv_files(int f_in, int f_out, char *local_name)
- 
- 			if (fd1 == -1 && basis_dir[0]) {
- 				/* pre-29 allowed only one alternate basis */
--				pathjoin(fnamecmpbuf, sizeof fnamecmpbuf,
--					 basis_dir[0], fname);
--				fnamecmp = fnamecmpbuf;
-+				basedir = basis_dir[0];
-+				fnamecmp = fname;
- 				fnamecmp_type = FNAMECMP_BASIS_DIR_LOW;
--				fd1 = do_open(fnamecmp, O_RDONLY, 0);
-+				fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
- 			}
- 		}
- 
-+		if (basedir) {
-+			// for the following code we need the full
-+			// path name as a single string
-+			pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basedir, fnamecmp);
-+			fnamecmp = fnamecmpbuf;
-+		}
-+
- 		one_inplace = inplace_partial && fnamecmp_type == FNAMECMP_PARTIAL_DIR;
- 		updating_basis_or_equiv = one_inplace
- 		    || (inplace && (fnamecmp == fname || fnamecmp_type == FNAMECMP_BACKUP));
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0004-disallow-.-elements-in-relpath-for-secure_relative_o.patch

@@ -1,37 +0,0 @@
-From c78e53edb802d04f7e4e070fe8314f2544749e7a Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Tue, 26 Nov 2024 09:16:31 +1100
-Subject: [PATCH 4/4] disallow ../ elements in relpath for secure_relative_open
-
----
- syscall.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/syscall.c b/syscall.c
-index a4b7f542..47c5ea57 100644
---- a/syscall.c
-+++ b/syscall.c
-@@ -721,6 +721,8 @@ int do_open_nofollow(const char *pathname, int flags)
-   must be a relative path, and the relpath must not contain any
-   elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
-   applies to all path components, not just the last component)
-+
-+  The relpath must also not contain any ../ elements in the path
- */
- int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
- {
-@@ -729,6 +731,11 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
- 		errno = EINVAL;
- 		return -1;
- 	}
-+	if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) {
-+		// no ../ elements allowed in the relpath
-+		errno = EINVAL;
-+		return -1;
-+	}
- 
- #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
- 	// really old system, all we can do is live with the risks
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12087/0001-Refuse-a-duplicate-dirlist.patch

@@ -1,45 +0,0 @@
-From 0ebc19ee486a8e928a68d8f98d07d40f176770aa Mon Sep 17 00:00:00 2001
-From: Wayne Davison <wayne@opencoder.net>
-Date: Thu, 14 Nov 2024 15:46:50 -0800
-Subject: [PATCH 1/2] Refuse a duplicate dirlist.
-
----
- flist.c | 9 +++++++++
- rsync.h | 1 +
- 2 files changed, 10 insertions(+)
-
-diff --git a/flist.c b/flist.c
-index 464d556e..847b1054 100644
---- a/flist.c
-+++ b/flist.c
-@@ -2584,6 +2584,15 @@ struct file_list *recv_file_list(int f, int dir_ndx)
- 		init_hard_links();
- #endif
- 
-+	if (inc_recurse && dir_ndx >= 0) {
-+		struct file_struct *file = dir_flist->files[dir_ndx];
-+		if (file->flags & FLAG_GOT_DIR_FLIST) {
-+			rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
-+			exit_cleanup(RERR_PROTOCOL);
-+		}
-+		file->flags |= FLAG_GOT_DIR_FLIST;
-+	}
-+
- 	flist = flist_new(0, "recv_file_list");
- 	flist_expand(flist, FLIST_START_LARGE);
- 
-diff --git a/rsync.h b/rsync.h
-index 0f9e277f..b9a7101a 100644
---- a/rsync.h
-+++ b/rsync.h
-@@ -84,6 +84,7 @@
- #define FLAG_DUPLICATE (1<<4)	/* sender */
- #define FLAG_MISSING_DIR (1<<4)	/* generator */
- #define FLAG_HLINKED (1<<5)	/* receiver/generator (checked on all types) */
-+#define FLAG_GOT_DIR_FLIST (1<<5)/* sender/receiver/generator - dir_flist only */
- #define FLAG_HLINK_FIRST (1<<6)	/* receiver/generator (w/FLAG_HLINKED) */
- #define FLAG_IMPLIED_DIR (1<<6)	/* sender/receiver/generator (dirs only) */
- #define FLAG_HLINK_LAST (1<<7)	/* receiver/generator */
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12087/0002-range-check-dir_ndx-before-use.patch

@@ -1,27 +0,0 @@
-From b3e16be18d582dac1513c0a932d146b36e867b1b Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Tue, 26 Nov 2024 16:12:45 +1100
-Subject: [PATCH 2/2] range check dir_ndx before use
-
----
- flist.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/flist.c b/flist.c
-index 847b1054..087f9da6 100644
---- a/flist.c
-+++ b/flist.c
-@@ -2585,6 +2585,10 @@ struct file_list *recv_file_list(int f, int dir_ndx)
- #endif
- 
- 	if (inc_recurse && dir_ndx >= 0) {
-+		if (dir_ndx >= dir_flist->used) {
-+			rprintf(FERROR_XFER, "rsync: refusing invalid dir_ndx %u >= %u\n", dir_ndx, dir_flist->used);
-+			exit_cleanup(RERR_PROTOCOL);
-+		}
- 		struct file_struct *file = dir_flist->files[dir_ndx];
- 		if (file->flags & FLAG_GOT_DIR_FLIST) {
- 			rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12088/0001-make-safe-links-stricter.patch

@@ -1,136 +0,0 @@
-From 535f8f816539ba681ef0f12015d2cb587ae61b6d Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Sat, 23 Nov 2024 15:15:53 +1100
-Subject: [PATCH] make --safe-links stricter
-
-when --safe-links is used also reject links where a '../' component is
-included in the destination as other than the leading part of the
-filename
----
- testsuite/safe-links.test    | 55 ++++++++++++++++++++++++++++++++++++
- testsuite/unsafe-byname.test |  2 +-
- util1.c                      | 26 ++++++++++++++++-
- 3 files changed, 81 insertions(+), 2 deletions(-)
- create mode 100644 testsuite/safe-links.test
-
-diff --git a/testsuite/safe-links.test b/testsuite/safe-links.test
-new file mode 100644
-index 00000000..6e95a4b9
---- /dev/null
-+++ b/testsuite/safe-links.test
-@@ -0,0 +1,55 @@
-+#!/bin/sh
-+
-+. "$suitedir/rsync.fns"
-+
-+test_symlink() {
-+	is_a_link "$1" || test_fail "File $1 is not a symlink"
-+}
-+
-+test_regular() {
-+	if [ ! -f "$1" ]; then
-+		test_fail "File $1 is not regular file or not exists"
-+	fi
-+}
-+
-+test_notexist() {
-+        if [ -e "$1" ]; then
-+                test_fail "File $1 exists"
-+	fi
-+        if [ -h "$1" ]; then
-+                test_fail "File $1 exists as a symlink"
-+	fi
-+}
-+
-+cd "$tmpdir"
-+
-+mkdir from
-+
-+mkdir "from/safe"
-+mkdir "from/unsafe"
-+
-+mkdir "from/safe/files"
-+mkdir "from/safe/links"
-+
-+touch "from/safe/files/file1"
-+touch "from/safe/files/file2"
-+touch "from/unsafe/unsafefile"
-+
-+ln -s ../files/file1 "from/safe/links/"
-+ln -s ../files/file2 "from/safe/links/"
-+ln -s ../../unsafe/unsafefile "from/safe/links/"
-+ln -s a/a/a/../../../unsafe2 "from/safe/links/"
-+
-+#echo "LISTING FROM"
-+#ls -lR from
-+
-+echo "rsync with relative path and just -a"
-+$RSYNC -avv --safe-links from/safe/ to
-+
-+#echo "LISTING TO"
-+#ls -lR to
-+
-+test_symlink to/links/file1
-+test_symlink to/links/file2
-+test_notexist to/links/unsafefile
-+test_notexist to/links/unsafe2
-diff --git a/testsuite/unsafe-byname.test b/testsuite/unsafe-byname.test
-index 75e72014..d2e318ef 100644
---- a/testsuite/unsafe-byname.test
-+++ b/testsuite/unsafe-byname.test
-@@ -40,7 +40,7 @@ test_unsafe ..//../dest 		from/dir			unsafe
- test_unsafe ..				from/file			safe
- test_unsafe ../..			from/file			unsafe
- test_unsafe ..//..			from//file			unsafe
--test_unsafe dir/..			from				safe
-+test_unsafe dir/..			from				unsafe
- test_unsafe dir/../..			from				unsafe
- test_unsafe dir/..//..			from				unsafe
- 
-diff --git a/util1.c b/util1.c
-index da50ff1e..f260d398 100644
---- a/util1.c
-+++ b/util1.c
-@@ -1318,7 +1318,14 @@ int handle_partial_dir(const char *fname, int create)
-  *
-  * "src" is the top source directory currently applicable at the level
-  * of the referenced symlink.  This is usually the symlink's full path
-- * (including its name), as referenced from the root of the transfer. */
-+ * (including its name), as referenced from the root of the transfer.
-+ *
-+ * NOTE: this also rejects dest names with a .. component in other
-+ * than the first component of the name ie. it rejects names such as
-+ * a/b/../x/y. This needs to be done as the leading subpaths 'a' or
-+ * 'b' could later be replaced with symlinks such as a link to '.'
-+ * resulting in the link being transferred now becoming unsafe
-+ */
- int unsafe_symlink(const char *dest, const char *src)
- {
- 	const char *name, *slash;
-@@ -1328,6 +1335,23 @@ int unsafe_symlink(const char *dest, const char *src)
- 	if (!dest || !*dest || *dest == '/')
- 		return 1;
- 
-+	// reject destinations with /../ in the name other than at the start of the name
-+	const char *dest2 = dest;
-+	while (strncmp(dest2, "../", 3) == 0) {
-+	    dest2 += 3;
-+	    while (*dest2 == '/') {
-+		// allow for ..//..///../foo
-+		dest2++;
-+	    }
-+	}
-+	if (strstr(dest2, "/../"))
-+	    return 1;
-+
-+	// reject if the destination ends in /..
-+	const size_t dlen = strlen(dest);
-+	if (dlen > 3 && strcmp(&dest[dlen-3], "/..") == 0)
-+	    return 1;
-+
- 	/* find out what our safety margin is */
- 	for (name = src; (slash = strchr(name, '/')) != 0; name = slash+1) {
- 		/* ".." segment starts the count over.  "." segment is ignored. */
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/CVE-2024-12747/0001-fixed-symlink-race-condition-in-sender.patch

@@ -1,187 +0,0 @@
-From f45f48055e548851bc7230f454dfeba139be6c04 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Wed, 18 Dec 2024 08:59:42 +1100
-Subject: [PATCH] fixed symlink race condition in sender
-
-when we open a file that we don't expect to be a symlink use
-O_NOFOLLOW to prevent a race condition where an attacker could change
-a file between being a normal file and a symlink
----
- checksum.c  |  2 +-
- flist.c     |  2 +-
- generator.c |  4 ++--
- receiver.c  |  2 +-
- sender.c    |  2 +-
- syscall.c   | 20 ++++++++++++++++++++
- t_unsafe.c  |  3 +++
- tls.c       |  3 +++
- trimslash.c |  2 ++
- util1.c     |  2 +-
- 10 files changed, 35 insertions(+), 7 deletions(-)
-
-diff --git a/checksum.c b/checksum.c
-index cb21882c..66e80896 100644
---- a/checksum.c
-+++ b/checksum.c
-@@ -406,7 +406,7 @@ void file_checksum(const char *fname, const STRUCT_STAT *st_p, char *sum)
- 	int32 remainder;
- 	int fd;
- 
--	fd = do_open(fname, O_RDONLY, 0);
-+	fd = do_open_checklinks(fname);
- 	if (fd == -1) {
- 		memset(sum, 0, file_sum_len);
- 		return;
-diff --git a/flist.c b/flist.c
-index 087f9da6..17832533 100644
---- a/flist.c
-+++ b/flist.c
-@@ -1390,7 +1390,7 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
- 
- 	if (copy_devices && am_sender && IS_DEVICE(st.st_mode)) {
- 		if (st.st_size == 0) {
--			int fd = do_open(fname, O_RDONLY, 0);
-+			int fd = do_open_checklinks(fname);
- 			if (fd >= 0) {
- 				st.st_size = get_device_size(fd, fname);
- 				close(fd);
-diff --git a/generator.c b/generator.c
-index 110db28f..3f13bb95 100644
---- a/generator.c
-+++ b/generator.c
-@@ -1798,7 +1798,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
- 
- 	if (write_devices && IS_DEVICE(sx.st.st_mode) && sx.st.st_size == 0) {
- 		/* This early open into fd skips the regular open below. */
--		if ((fd = do_open(fnamecmp, O_RDONLY, 0)) >= 0)
-+		if ((fd = do_open_nofollow(fnamecmp, O_RDONLY)) >= 0)
- 			real_sx.st.st_size = sx.st.st_size = get_device_size(fd, fnamecmp);
- 	}
- 
-@@ -1867,7 +1867,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
- 	}
- 
- 	/* open the file */
--	if (fd < 0 && (fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
-+	if (fd < 0 && (fd = do_open_checklinks(fnamecmp)) < 0) {
- 		rsyserr(FERROR, errno, "failed to open %s, continuing",
- 			full_fname(fnamecmp));
- 	  pretend_missing:
-diff --git a/receiver.c b/receiver.c
-index 8031b8f4..edfbb210 100644
---- a/receiver.c
-+++ b/receiver.c
-@@ -775,7 +775,7 @@ int recv_files(int f_in, int f_out, char *local_name)
- 			if (fnamecmp != fname) {
- 				fnamecmp = fname;
- 				fnamecmp_type = FNAMECMP_FNAME;
--				fd1 = do_open(fnamecmp, O_RDONLY, 0);
-+				fd1 = do_open_nofollow(fnamecmp, O_RDONLY);
- 			}
- 
- 			if (fd1 == -1 && basis_dir[0]) {
-diff --git a/sender.c b/sender.c
-index 2bbff2fa..a4d46c39 100644
---- a/sender.c
-+++ b/sender.c
-@@ -350,7 +350,7 @@ void send_files(int f_in, int f_out)
- 			exit_cleanup(RERR_PROTOCOL);
- 		}
- 
--		fd = do_open(fname, O_RDONLY, 0);
-+		fd = do_open_checklinks(fname);
- 		if (fd == -1) {
- 			if (errno == ENOENT) {
- 				enum logcode c = am_daemon && protocol_version < 28 ? FERROR : FWARNING;
-diff --git a/syscall.c b/syscall.c
-index 081357bb..8cea2900 100644
---- a/syscall.c
-+++ b/syscall.c
-@@ -45,6 +45,8 @@ extern int preallocate_files;
- extern int preserve_perms;
- extern int preserve_executability;
- extern int open_noatime;
-+extern int copy_links;
-+extern int copy_unsafe_links;
- 
- #ifndef S_BLKSIZE
- # if defined hpux || defined __hpux__ || defined __hpux
-@@ -788,3 +790,21 @@ cleanup:
- 	return retfd;
- #endif // O_NOFOLLOW, O_DIRECTORY
- }
-+
-+/*
-+  varient of do_open/do_open_nofollow which does do_open() if the
-+  copy_links or copy_unsafe_links options are set and does
-+  do_open_nofollow() otherwise
-+
-+  This is used to prevent a race condition where an attacker could be
-+  switching a file between being a symlink and being a normal file
-+
-+  The open is always done with O_RDONLY flags
-+ */
-+int do_open_checklinks(const char *pathname)
-+{
-+	if (copy_links || copy_unsafe_links) {
-+		return do_open(pathname, O_RDONLY, 0);
-+	}
-+	return do_open_nofollow(pathname, O_RDONLY);
-+}
-diff --git a/t_unsafe.c b/t_unsafe.c
-index 010cac50..e10619a2 100644
---- a/t_unsafe.c
-+++ b/t_unsafe.c
-@@ -28,6 +28,9 @@ int am_root = 0;
- int am_sender = 1;
- int read_only = 0;
- int list_only = 0;
-+int copy_links = 0;
-+int copy_unsafe_links = 0;
-+
- short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
- 
- int
-diff --git a/tls.c b/tls.c
-index e6b0708a..858f8f10 100644
---- a/tls.c
-+++ b/tls.c
-@@ -49,6 +49,9 @@ int list_only = 0;
- int link_times = 0;
- int link_owner = 0;
- int nsec_times = 0;
-+int safe_symlinks = 0;
-+int copy_links = 0;
-+int copy_unsafe_links = 0;
- 
- #ifdef SUPPORT_XATTRS
- 
-diff --git a/trimslash.c b/trimslash.c
-index 1ec928ca..f2774cd7 100644
---- a/trimslash.c
-+++ b/trimslash.c
-@@ -26,6 +26,8 @@ int am_root = 0;
- int am_sender = 1;
- int read_only = 1;
- int list_only = 0;
-+int copy_links = 0;
-+int copy_unsafe_links = 0;
- 
- int
- main(int argc, char **argv)
-diff --git a/util1.c b/util1.c
-index f260d398..d84bc414 100644
---- a/util1.c
-+++ b/util1.c
-@@ -365,7 +365,7 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
- 	int len;   /* Number of bytes read into `buf'. */
- 	OFF_T prealloc_len = 0, offset = 0;
- 
--	if ((ifd = do_open(source, O_RDONLY, 0)) < 0) {
-+	if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) {
- 		int save_errno = errno;
- 		rsyserr(FERROR_XFER, errno, "open %s", full_fname(source));
- 		errno = save_errno;
--- 
-2.34.1
-

pkgs/applications/networking/sync/rsync/raise-protocol-version-to-32.patch

@@ -1,26 +0,0 @@
-From 163e05b1680c4a3b448fa68d03c3fca9589f3bc4 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <andrew@tridgell.net>
-Date: Tue, 10 Dec 2024 13:34:01 +1100
-Subject: [PATCH 1/3] raise protocol version to 32
-
-make it easier to spot unpatched servers
----
- rsync.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rsync.h b/rsync.h
-index b9a7101a..9be1297b 100644
---- a/rsync.h
-+++ b/rsync.h
-@@ -111,7 +111,7 @@
- 
- /* Update this if you make incompatible changes and ALSO update the
-  * SUBPROTOCOL_VERSION if it is not a final (official) release. */
--#define PROTOCOL_VERSION 31
-+#define PROTOCOL_VERSION 32
- 
- /* This is used when working on a new protocol version or for any unofficial
-  * protocol tweaks.  It should be a non-zero value for each pre-release repo
--- 
-2.34.1
-

pkgs/applications/office/activitywatch/default.nix

@@ -187,7 +187,8 @@ rec {
 
     src = "${sources}/aw-server-rust";
 
-    cargoHash = "sha256-2KnfLNVw48VVQ1Ec8MS2MaiA3BpGeFd/uIrJRHhaJR8=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-E89E/LWBPHtb6vX94swodmE+UrWMrzQnm8AO5GeyuoA=";
 
     patches = [
       # Override version string with hardcoded value as it may be outdated upstream.

pkgs/applications/office/kexi/default.nix

@@ -30,8 +30,8 @@
   kreport,
   lcms2,
   libmysqlclient,
+  libpq,
   marble,
-  postgresql,
 }:
 
 mkDerivation rec {
@@ -74,8 +74,8 @@ mkDerivation rec {
     kreport
     lcms2
     libmysqlclient
+    libpq
     marble
-    postgresql
   ];
 
   propagatedUserEnvPkgs = [ kproperty ];

pkgs/applications/office/ledger-web/default.nix

@@ -3,7 +3,7 @@
   bundlerApp,
   bundlerUpdateScript,
   withPostgresql ? true,
-  postgresql,
+  libpq,
   withSqlite ? false,
   sqlite,
 }:
@@ -13,7 +13,7 @@ bundlerApp {
   gemdir = ./.;
   exes = [ "ledger_web" ];
 
-  buildInputs = lib.optional withPostgresql postgresql ++ lib.optional withSqlite sqlite;
+  buildInputs = lib.optional withPostgresql libpq ++ lib.optional withSqlite sqlite;
 
   passthru.updateScript = bundlerUpdateScript "ledger-web";
 

pkgs/applications/office/libreoffice/default.nix

@@ -113,7 +113,7 @@
 , kwindowsystem ? null
 , variant ? "fresh"
 , symlinkJoin
-, postgresql
+, libpq
 , makeFontsConf
 , amiri
 , caladea
@@ -395,7 +395,7 @@ in stdenv.mkDerivation (finalAttrs: {
     pam
     perl
     poppler
-    postgresql
+    libpq
     python311
     sane-backends
     unixODBC

pkgs/applications/science/machine-learning/finalfrontier/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-bnRzXIYairlBjv2JxU16UXYc5BB3VeKZNiJ4+XDzub4=";
   };
 
-  cargoHash = "sha256-C/D9EPfifyajrCyXE8w/qRuzWEoyJJIcj4xii94/9l4=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-AQiXRKOXV7kXiu9GbtPE0Rddy93t1Y5tuJmww4xFSaU=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/science/machine-learning/finalfusion-utils/default.nix

@@ -22,7 +22,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-suzivynlgk4VvDOC2dQR40n5IJHoJ736+ObdrM9dIqE=";
   };
 
-  cargoHash = "sha256-HekjmctuzOWs5k/ihhsV8vVkm6906jEnFf3yvhkrA5Y=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-X8ENEtjH1RHU2+VwtkHsyVYK37O8doMlLk94O2BGqy0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/science/misc/rink/default.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-2+ZkyWhEnnO/QgCzWscbMr0u5kwdv2HqPLjtiXDfv/o=";
   };
 
-  cargoHash = "sha256-j1pQfMjDNu57otOBTVBQEZIx80p4/beEUQdUkAJhvso=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-XvtEXBsdxUMJJntzzKVbUIjg78JpwyuUlTm6J3huDPE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/system/coolercontrol/coolercontrol-gui.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui/src-tauri";
 
-  cargoHash = "sha256-gjR54dZjVonyznfBGb3iNNdmPalE+a53MmkOEZj3+sY=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-C0oVtU6esXOkssKyJ4XzLV2vGCPbvVKgvf3wXo9L158=";
 
   buildFeatures = [ "custom-protocol" ];