Merge master into staging-next

doc/release-notes/rl-2511.section.md

@@ -60,8 +60,6 @@
 
 - `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
 
-- NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start `getty@tty1.service`, even if the system is forced to boot into `multi-user.target` instead of `graphical.target`.
-
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.
 
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -133,6 +133,8 @@
 
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.
 
+- NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start `getty@tty1.service`, even if the system is forced to boot into `multi-user.target` instead of `graphical.target`.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/services/search/meilisearch.nix

@@ -237,6 +237,45 @@ in
         WorkingDirectory = "%S/meilisearch";
         RuntimeDirectory = "meilisearch";
         RuntimeDirectoryMode = "0700";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        PrivateTmp = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+
+        NoNewPrivileges = true;
+
+        # Meilisearch does not support listening on AF_UNIX sockets,
+        # so we currently restrict it to only AF_INET and AF_INET6.
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+
+        CapabilityBoundingSet = "";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+
+        UMask = "0077";
       };
     };
   };

pkgs/by-name/gh/gh/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.76.1";
+  version = "2.76.2";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-5m7BIjJqggQZYwxfUlsU+WBw6BxK0PBQYOSrw3I7gLA=";
+    hash = "sha256-tIA2zFXGmnaTuhO6UNzlk01/20CPg5RQ4Kz1UMmbTGc=";
   };
 
   vendorHash = "sha256-NXyqWeiESkLVb2Bb88MoD+4ssvfOy0HGHFAOrT83t0c=";

pkgs/by-name/gi/givaro/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   automake,
   autoconf,
   libtool,
@@ -11,41 +10,16 @@
 }:
 stdenv.mkDerivation rec {
   pname = "givaro";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "givaro";
     tag = "v${version}";
-    sha256 = "sha256-KR0WJc0CSvaBnPRott4hQJhWNBb/Wi6MIhcTExtVobQ=";
+    sha256 = "sha256-vSkWmKqpbVk1qdsqCU7qF7o+YgV5YRc9p4mlgl6yrto=";
   };
 
   patches = [
-    # Pull upstream fix for gcc-13:
-    #   https://github.com/linbox-team/givaro/pull/218
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/linbox-team/givaro/commit/c7744bb133496cd7ac04688f345646d505e1bf52.patch";
-      hash = "sha256-aAA5o8Va10v0Pqgcpx7qM0TAZiNQgXoR6N9xecj7tDA=";
-    })
-    (fetchpatch {
-      name = "clang-16.patch";
-      url = "https://github.com/linbox-team/givaro/commit/a81d44b3b57c275bcb04ab00db79be02561deaa2.patch";
-      hash = "sha256-sSk+VWffoEjZRTJcHRISLHPyW6yuvI1u8knBOfxNUIE=";
-    })
-    # https://github.com/linbox-team/givaro/issues/226
-    (fetchpatch {
-      name = "gcc-14.patch";
-      url = "https://github.com/linbox-team/givaro/commit/b0cf33e1d4437530c7e4b3db90b6c80057a7f2f3.patch";
-      includes = [ "src/kernel/integer/random-integer.h" ];
-      hash = "sha256-b2Q8apP9ueEqIUtibTeP47x6TlroRzLgAxuv5ZM1EUw=";
-    })
-    # https://github.com/linbox-team/givaro/issues/232
-    (fetchpatch {
-      name = "clang-19.patch";
-      url = "https://github.com/linbox-team/givaro/commit/a18baf5227d4f3e81a50850fe98e0d954eaa3ddb.patch";
-      hash = "sha256-IR0IHhCqbxgtsST30vxM9ak1nGtt0apxcLUQ1kS1DHw=";
-    })
     # skip gmp version check for cross-compiling, our version is new enough
     ./skip-gmp-check.patch
   ];

pkgs/by-name/hy/hydra/package.nix

@@ -130,14 +130,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hydra";
-  version = "0-unstable-2025-06-15";
+  version = "0-unstable-2025-07-17";
   # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "ed500ca4345f7edaa6c3d84027a7599d38b15a29";
-    hash = "sha256-Mxz4n40VKxA2ILtIHX6fObgcy2WlgsM+ERfpjuVJ0BU=";
+    rev = "b812bb5017cac055fa56ffeac5440b6365830d67";
+    hash = "sha256-XmoecWRUvUX8jf0U0cGyP4AfLHb0D2D4Ec69jqwrWVI=";
   };
 
   outputs = [

pkgs/by-name/im/immich-public-proxy/package.nix

@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.11.5";
+  version = "1.12.1";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-jSAQbACWEt/gyZbr4sOM17t3KZoxPOM0RZFbsLZfcRM=";
+    hash = "sha256-m0E7YNdN2K81AwyBBBKZNrZaNis+qakdViVih+1Wk2E=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-av+XKzrTl+8xizYFZwCTmaLNsbBnusf03I1Uvkp0sF8=";
+  npmDepsHash = "sha256-GtX2mRfw4eo3WKfxdMoOAryQKHddFPcVCuXhHmLA/Oc=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''

pkgs/by-name/li/linbox/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   givaro,
   pkg-config,
@@ -16,41 +15,15 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "linbox";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "linbox";
     rev = "v${version}";
-    sha256 = "sha256-mW84a98KPLqcHMjX3LIYTmVe0ngUdz6RJLpoDaAqKU8=";
+    sha256 = "sha256-WUSQI9svxbrDTtWBjCF2XMhRFdKwCht8XBmJIJ3DR1E=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/linbox-team/linbox/commit/4be26e9ef0eaf36a9909e5008940e8bf7dc625b6.patch";
-      sha256 = "PX0Tik7blXOV2vHUq92xMxaADkNoNGiax4qrjQyGK6U=";
-    })
-    (fetchpatch {
-      name = "gcc-14.patch";
-      url = "https://github.com/linbox-team/linbox/commit/b8f2d4ccdc0af4418d14f72caf6c4d01969092a3.patch";
-      includes = [
-        "linbox/matrix/sparsematrix/sparse-ell-matrix.h"
-        "linbox/matrix/sparsematrix/sparse-ellr-matrix.h"
-      ];
-      hash = "sha256-sqwgHkECexR2uX/SwYP7r9ZGHnGG+i4RXtfnvWsVQlk=";
-    })
-    (fetchpatch {
-      name = "clang-19.patch";
-      url = "https://github.com/linbox-team/linbox/commit/4f7a9bc830696b2f2c0219feaa74e85202700412.patch";
-      hash = "sha256-DoKh8/+2WPbMhN9MhpKmQ5sKmizD9iE81zS/XI0aM9Q=";
-    })
-    (fetchpatch {
-      name = "clang-19.patch";
-      url = "https://github.com/linbox-team/linbox/commit/4a1e1395804d4630ec556c61ba3f2cb67e140248.patch";
-      hash = "sha256-sCe/8hb27RuMxU1XXWsVU5gaGk2V+T6Ee7yrC5G5Hsc=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

pkgs/by-name/ve/veloren/package.nix

@@ -14,9 +14,9 @@
 let
   # Note: use this to get the release metadata
   # https://gitlab.com/api/v4/projects/10174980/repository/tags/v{version}
-  version = "0.16.0";
-  date = "2023-03-30-03:28";
-  rev = "80fe5ca64b40fbf3e0e393a44f8880a79a6a5380";
+  version = "0.17.0";
+  date = "2024-12-28-12:49";
+  rev = "a1be5a7bece7af43ebd76910eb0020c1cf3c0798";
 in
 
 rustPlatform.buildRustPackage {
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage {
     owner = "veloren";
     repo = "veloren";
     inherit rev;
-    hash = "sha256-h2hLO227aeK2oEFfdGMgmtMkA9cn9AgQ9w6myb+8W8c=";
+    hash = "sha256-AnmXn4GWzxu27FUyQIIVnANtu3sr0NIi7seN7buAtL8=";
   };
 
   cargoPatches = [
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage {
     ./fix-assets-path.patch
   ];
 
-  cargoHash = "sha256-3XHuAgue0Id1oxCJ8NLZ4wYjMfND+C1iIW+AnMKXd54=";
+  cargoHash = "sha256-Uj0gFcStWhIS+GbM/Hn/vD2PrA0ftzEnMnCwV0n0g7g=";
 
   postPatch = ''
     # Force vek to build in unstable mode
@@ -61,10 +61,11 @@ rustPlatform.buildRustPackage {
   env = {
     # Enable unstable features, see https://gitlab.com/veloren/veloren/-/issues/264
     RUSTC_BOOTSTRAP = true;
+    RUSTC_BREAK_ON_ICE = true;
 
     # Set version info, required by veloren-common
     NIX_GIT_TAG = "v${version}";
-    NIX_GIT_HASH = "${lib.substring 0 7 rev}/${date}";
+    NIX_GIT_HASH = "${lib.substring 0 8 rev}/${date}";
 
     # Save game data under user's home directory,
     # otherwise it defaults to $out/bin/../userdata

pkgs/development/compilers/go/binary.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     homepage = "https://go.dev/";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.golang ];
-    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    platforms = lib.platforms.darwin ++ lib.platforms.freebsd ++ lib.platforms.linux;
     badPlatforms = [
       # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
       # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware

pkgs/development/libraries/mesa/common.nix

@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.1.6";
+  version = "25.1.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-SHYYezt2ez9awvIATEC6wVMZMuJUsOYXxlugs1Q6q7U=";
+    hash = "sha256-dseMHUifLsszSAGCaZwgOwhj0/yfbRlBVVHQz25NdjY=";
   };
 
   meta = {

pkgs/kde/misc/ktextaddons/default.nix

@@ -9,11 +9,11 @@
 }:
 mkKdeDerivation rec {
   pname = "ktextaddons";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/ktextaddons/ktextaddons-${version}.tar.xz";
-    hash = "sha256-2YRlBaUvl72mTq0ZMDK8KVc+wxSB9HO+PFhvW4Mh7Nw=";
+    hash = "sha256-7JtimpC0shZgaGfoA08UszRDQgwreybz/UFNjB+jyuQ=";
   };
 
   extraBuildInputs = [

pkgs/os-specific/linux/acer-wmi-battery/default.nix

@@ -0,0 +1,46 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+}:
+
+let
+  release = "0.1.0-unstable-2025-04-24";
+
+in
+stdenv.mkDerivation {
+  pname = "acer-wmi-battery";
+  version = "${kernel.version}-${release}";
+
+  src = fetchFromGitHub {
+    owner = "frederik-h";
+    repo = "acer-wmi-battery";
+    rev = "0889d3ea54655eaa88de552b334911ce7375952f";
+    hash = "sha256-mI6Ob9BmNfwqT3nndWf3jkz8f7tV10odkTnfApsNo+A=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '/lib/modules/$(shell uname -r)/build' ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
+  '';
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name '*.ko' -exec xz -f {} \;
+    install -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86 *.ko.xz
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Driver for the Acer WMI battery health control interface";
+    homepage = "https://github.com/frederik-h/acer-wmi-battery";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ peterhoeg ];
+  };
+}

pkgs/os-specific/windows/default.nix

@@ -48,5 +48,7 @@ lib.makeScope newScope (
     pthreads = callPackage ./pthread-w32 { };
 
     libgnurx = callPackage ./libgnurx { };
+
+    sdk = callPackage ./msvcSdk { };
   }
 )

pkgs/os-specific/windows/msvcSdk/default.nix

@@ -0,0 +1,124 @@
+{
+  lib,
+  config,
+  stdenvNoCC,
+  xwin,
+  testers,
+  llvmPackages,
+}:
+let
+  version = (builtins.fromJSON (builtins.readFile ./manifest.json)).info.productSemanticVersion;
+
+  hashes = (builtins.fromJSON (builtins.readFile ./hashes.json));
+
+  host = stdenvNoCC.hostPlatform;
+  arch =
+    if host.isx86_64 then
+      "x86_64"
+    else if host.isAarch64 then
+      "aarch64"
+    else if host.isx86_32 then
+      "x86"
+    else if host.isAarch32 then
+      "aarch"
+    else
+      throw "Unsupported system";
+in
+if !config.microsoftVisualStudioLicenseAccepted then
+  throw ''
+    Microsoft Software License Terms are not accepted with config.microsoftVisualStudioLicenseAccepted.
+    Please read https://visualstudio.microsoft.com/license-terms/mt644918/ and if you agree, change your
+    config to indicate so.
+  ''
+else
+  stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit version;
+    pname = "msvc-sdk";
+    dontUnpack = true;
+
+    strictDeps = true;
+    nativeBuildInputs = [ xwin ];
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = hashes.${arch};
+
+    __structuredAttrs = true;
+    xwinArgs = [
+      "--accept-license"
+      "--cache-dir=xwin-out"
+      "--manifest=${./manifest.json}"
+      "--arch=${arch}"
+      "splat"
+      "--preserve-ms-arch-notation"
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      xwin "''${xwinArgs[@]}"
+      mkdir "$out"
+      mv xwin-out/splat/* "$out"
+
+      runHook postBuild
+    '';
+
+    dontFixup = true;
+    dontInstall = true;
+
+    passthru = {
+      updateScript = ./update.nu;
+      tests = {
+        hello-world = testers.runCommand {
+          name = "hello-msvc";
+
+          nativeBuildInputs = [
+            llvmPackages.clang-unwrapped
+            llvmPackages.bintools-unwrapped
+          ];
+
+          script = ''
+            set -euo pipefail
+
+            cat > hello.c <<- EOF
+            #include <stdio.h>
+
+            int main(int argc, char* argv[]) {
+                printf("Hello world!\n");
+                return 0;
+            }
+            EOF
+
+            clang-cl --target=x86_64-pc-windows-msvc -fuse-ld=lld \
+                /vctoolsdir ${finalAttrs.finalPackage}/crt \
+                /winsdkdir ${finalAttrs.finalPackage}/sdk \
+                ./hello.c -v
+
+            if test ! -f hello.exe; then
+              echo "hello.exe not found!"
+              exit 1
+            else
+              touch $out
+            fi
+          '';
+        };
+      };
+    };
+
+    meta = {
+      description = "MSVC SDK and Windows CRT for cross compiling";
+      homepage = "https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/";
+      maintainers = [ lib.maintainers.RossSmyth ];
+      license = {
+        deprecated = false;
+        fullName = "Microsoft Software License Terms";
+        shortName = "msvc";
+        spdxId = "unknown";
+        url = "https://www.visualstudio.com/license-terms/mt644918/";
+      };
+      platforms = lib.platforms.all;
+      # The arm manifest is missing critical pieces.
+      broken = stdenvNoCC.hostPlatform.isAarch;
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    };
+  })

pkgs/os-specific/windows/msvcSdk/hashes.json

@@ -0,0 +1,4 @@
+{
+  "x86_64": "sha256-s3iaz9SkV8H1j3rQ1ZWKe9I1o/42+buqxCnGAoA17j8=",
+  "x86": "sha256-ZiFms3GWhTrEcE6/nf3pUjpdux5PRI3AtOzxofk93pk="
+}

pkgs/os-specific/windows/msvcSdk/update.nu

@@ -0,0 +1,48 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell xwin
+
+use std/log
+use std/dirs
+
+const MANIFEST_URL = "https://aka.ms/vs/17/release/channel"
+
+const PATH = "pkgs/os-specific/windows/msvcSdk"
+
+def replace_hash [ p: path old: string new: string ] {
+  open $p
+  | str replace $old $new
+  | save -f $p
+}
+
+def main [] {
+  # Ensure the version is actually new
+  let current_version = nix eval -f "" windows.sdk.version --json | from json
+
+  let new_manifest = http get $MANIFEST_URL | decode | from json
+  let new_version = $new_manifest.info.productSemanticVersion
+
+  if $current_version == $new_version {
+      log info "Current Windows SDK manifest matches the newest version, exiting..."
+      exit 0
+  } else {
+    log info $"Previous version (current_version)\nNew version (new_version)"
+  }
+
+  $new_manifest | to json | append "\n" | str join | save -f ($PATH | path join manifest.json)
+
+  # TODO: Add arm once it isn't broken
+  let hashes = ["x86_64", "x86"] | par-each {
+    |arch|
+    let dir = mktemp -d
+
+    xwin --accept-license --cache-dir $dir --manifest $"($PATH | path join manifest.json)" --arch $arch splat --preserve-ms-arch-notation
+
+    let hash = nix hash path ($dir | path join splat)
+
+    {arch: $arch, hash: $hash}
+  } | transpose -r -d
+
+  log info $"New hashes:\n ($hashes)"
+
+  $hashes | to json | append "\n" | str join | save -f ($PATH | path join hashes.json)
+}

pkgs/top-level/config.nix

@@ -274,6 +274,18 @@ let
         }
       '';
     };
+
+    microsoftVisualStudioLicenseAccepted = mkOption {
+      type = types.bool;
+      default = false;
+      # getEnv part is in check-meta.nix
+      defaultText = literalExpression ''false || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1"'';
+      description = ''
+        If the Microsoft Visual Studio license has been accepted.
+
+        Please read https://www.visualstudio.com/license-terms/mt644918/ and enable this config if you accept.
+      '';
+    };
   };
 
 in

pkgs/top-level/linux-kernels.nix

@@ -364,6 +364,8 @@ in
         inherit (pkgs) oci-seccomp-bpf-hook; # added 2022-11
         inherit (pkgs) dpdk; # added 2024-03
 
+        acer-wmi-battery = callPackage ../os-specific/linux/acer-wmi-battery { };
+
         acpi_call = callPackage ../os-specific/linux/acpi-call { };
 
         ajantv2 = callPackage ../os-specific/linux/ajantv2 { };