Merge master into staging-next

2026-04-20 18:21:31 +00:00
parent 5affd239b8 1a2cead235
commit 4b35cf2ff2
81 changed files with 2194 additions and 714 deletions
@@ -178,6 +178,8 @@

 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).

+- `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`.
+
 - The `man-pages` package's outputs have been split. The manual pages are installed into the `man` output, which is installed by default. Binaries (including `diffman-git`, `mansect`, `pdfman`, and `sortman`) are installed into the `out` output, which is not installed by default.

 - All Log4Shell vulnerability scanners were removed, as they were all unmaintained upstream and are no longer relevant given that the vulnerability has been fixed upstream for several years.
@@ -29373,6 +29373,12 @@
    githubId = 78392041;
    name = "Winter";
  };
+  winterec = {
+    github = "winterec";
+    githubId = 9159652;
+    name = "Edward";
+    keys = [ { fingerprint = "0BC2F3C6AE5D73DAE870CB0E8AE4DE0EFB6CC443"; } ];
+  };
  wirew0rm = {
    email = "alex@wirew0rm.de";
    github = "wirew0rm";
@@ -10,8 +10,8 @@
 # Desktop users are recommended to either:
 # 1. Stop buffyboard once your DE is started.
 #   e.g. `services.buffyboard.unitConfig.Conflicts = [ "my-de.service" ];`
-# 2. Configure your DE to ignore input events from buffyboard (product-id=25209; vendor-id=26214; name=rd)
-#   e.g. `echo 'input "26214:25209:rd" events disabled' > ~/.config/sway/config`
+# 2. Configure your DE to ignore input events from buffyboard (product-id=0; vendor-id=0; name=buffyboard)
+#   e.g. `echo 'input "0:0:buffyboard" events disabled' > ~/.config/sway/config`

 {
  config,
@@ -68,6 +68,24 @@ in
        type = types.submodule {
          freeformType = ini.type;

+          options.keyboard.haptic_feedback = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Enable or disable vibrations when pressing keys.
+            '';
+          };
+
+          options.keyboard.sticky_shift = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Changes shift key behavior. When true, the keyboard remains in uppercase mode until
+              the shift key is pressed again (sticky). When false, the keyboard switches back to
+              lowercase mode and the shift key deactivates after a non-modifier key is pressed.
+            '';
+          };
+
          options.input.pointer = mkOption {
            type = types.nullOr types.bool;
            default = null;
@@ -7,7 +7,7 @@
    inherit (pkgs) mysql84;
  };
  perconaPackages = {
-    inherit (pkgs) percona-server_8_0 percona-server_8_4;
+    inherit (pkgs) percona-server_8_4;
  };
  mkTestName =
    pkg: "mariadb_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
@@ -24,13 +24,13 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.33.1";
+  version = "2.34.0";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-rBXJ5BT/1TFySOgC1wpgOz4tcOF9flHplfonYGOA9Ac=" "zip";
-    i686-linux = fetch "linux_386" "sha256-2Hh+ML+hewwZATrh01kPXoNBdYWN3dI2ZqfLBiH/gK8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-ge+4thdTnymQYFQ2G9qwh9i3zsY13W1M5za1CXybUqI=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-LuOI9r1VRnL9IGsK4vy4ENOS64xdpIZ+ZskIkUJ0s34=" "zip";
+    i686-linux = fetch "linux_386" "sha256-VvqEyDHEIY3BsgubiJKXql1WEnwXHkSHpFvCcKBIeYw=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-sbydXPoT0Vo3r2gyZBdl4OMtOejbhvra5JM4wB6Ex5s=" "zip";
    aarch64-darwin =
-      fetch "apple_universal" "sha256-+3NI4BIazI21m6teLBvKalCTN8cx6RhFqwXnkNK6tjQ="
+      fetch "apple_universal" "sha256-9h+Z7INYcJcWeVQ9QnXKjtT5QyV2J+dP857qSOpBAy8="
        "pkg";
    x86_64-darwin = aarch64-darwin;
  };
@@ -6,19 +6,19 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "alioth";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "alioth";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VkyR9NOxv5PVuW172Sw2ign6sApDnKTnH2BBlVl6GFk=";
+    hash = "sha256-Ny/YrXHo4qP8NDiRNtXv843RjJKzKFuSH20ZoGp3ODQ=";
  };

  # Checks use `debug_assert_eq!`
  checkType = "debug";

-  cargoHash = "sha256-NUbu2AL5gD7OOskNGO0pitJaTlgCYxAr6GYyv8nuytI=";
+  cargoHash = "sha256-eWozwXaVtR/3k7w7+tPzK1xlt9/DtvTYC+YPL/A+sU0=";

  separateDebugInfo = true;

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "4.8.14.1";
+  version = "4.8.14.5";

  src = fetchFromGitHub {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-NZku10mU6Psl03lT4ITYhjWDkKH70RAw+axUuKe22j0=";
+    hash = "sha256-ijo6PC1Be06K8hxvgjybLvU80xEYUPahBV4f5JqabLc=";
    fetchSubmodules = true;
  };

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Intel AMT® SoL client + tools";
-    homepage = "https://www.kraxel.org/cgit/amtterm/";
+    homepage = "https://github.com/kraxel/amtterm";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
  };
@@ -15,10 +15,10 @@

 let
  source = {
-    version = "2.33.1";
-    hash = "sha256-O1AurSUq3MNcSchQlC/UfPO2KoB4dBBsONAQ2Bmxk9o=";
-    npmDepsHash = "sha256-NVHKPiT4GFiFVVyO7z/fZtU8Zf4o/LM1PmUs6zwzZF0=";
-    clientNpmDepsHash = "sha256-KWGnFeXxOVGqAruB9k/FqQfQNG6JrZFUQpo0Ls8jEYA=";
+    version = "2.33.2";
+    hash = "sha256-YsKUoJ0SlBO3fAbMvzaEEIgo90HclB+0iLVIH4LDmEY=";
+    npmDepsHash = "sha256-h/5brNurUEMHTSu2PGODhRtIenGzhsNM558i85Cs86w=";
+    clientNpmDepsHash = "sha256-EbXkHRjOE1A7Sk4MhbJFuBwG/VY+SHhHYjscsXkSMjU=";
  };

  src = fetchFromGitHub {
@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
  pname = "authelia";
-  version = "4.39.18";
+  version = "4.39.19";

  src = fetchFromGitHub {
    owner = "authelia";
    repo = "authelia";
    rev = "v${version}";
-    hash = "sha256-IROdncF3TC1X9000jw0RGtrcFrzqRpG7g2QuLGQ/Q4k=";
+    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
  };
  vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-ki/jXNT9dIno1UIcDgBcsLdiKcaiw/dwnff3t9xv07o=";
+  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
 }
@@ -8,17 +8,17 @@

 buildGoModule (finalAttrs: {
  pname = "bento";
-  version = "1.16.2";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "warpstreamlabs";
    repo = "bento";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SNX80JTX4jqbcCQWP+HlQaXTkODOYzbDN1KQ4iOZqYs=";
+    hash = "sha256-VfXXGtcn4bUTtIL39nusHciw3Rv2A4xL6s1fGnmBTZ0=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-N5CRU4Mv9e8kHXUXP95cNe02DkoEhJWcypF4vkEaMBA=";
+  vendorHash = "sha256-eVZd24c3imolyrt97gNrm1ro8VBMYH4fbzTzzSk4iEI=";

  subPackages = [
    "cmd/bento"
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "boulder";
-  version = "0.20260331.0";
+  version = "0.20260413.0";

  src = fetchFromGitHub {
    owner = "letsencrypt";
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
      find $out -name .git -print0 | xargs -0 rm -rf
      popd
    '';
-    hash = "sha256-2kYZp/cU9OuXmy8EDoX7htqlM7NpAl45Nf2S5MTVn6Y=";
+    hash = "sha256-8saRz7g0KsXNr5oR4a2qd4kKDR686J0TIFMzsX/zlV0=";
  };

  vendorHash = null;
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "cpuinfo";
-  version = "0-unstable-2026-03-12";
+  version = "0-unstable-2026-04-15";

  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "cpuinfo";
-    rev = "7607ca500436b37ad23fb8d18614bec7796b68a7";
-    hash = "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg=";
+    rev = "d05fbcd57dc096718c4979e7c054e628f1f3520b";
+    hash = "sha256-GF88Y83G9hh3gze0n4wySH9ix3PSGhaZey3t2aej0BQ=";
  };

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "cpu-info";
    maintainers = with lib.maintainers; [ pawelchcki ];
    pkgConfigModules = [ "libcpuinfo" ];
-    # https://github.com/pytorch/cpuinfo/blob/7607ca500436b37ad23fb8d18614bec7796b68a7/CMakeLists.txt#L98
+    # https://github.com/pytorch/cpuinfo/blob/d05fbcd57dc096718c4979e7c054e628f1f3520b/CMakeLists.txt#L98
    platforms = lib.platforms.x86 ++ lib.platforms.aarch ++ lib.platforms.riscv;
  };
 })
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "croaring";
-  version = "4.3.1";
+  version = "4.6.1";

  src = fetchFromGitHub {
    owner = "RoaringBitmap";
    repo = "CRoaring";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c4o8AMCtDGLChXxJKJyxkWhuYu7axqLb2ce8IOGk920=";
+    hash = "sha256-wks7kkF0va7RUJXY74ku/yWTSsHQKlFczfhAHyuNudM=";
  };

  # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor
@@ -28,6 +28,15 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

+  postPatch = ''
+    # Fixes the build of dependent projects by updating the supported
+    # CMake version.
+    # Issue: https://github.com/RoaringBitmap/CRoaring/issues/793
+    # PR: https://github.com/RoaringBitmap/CRoaring/pull/794
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '2.8...3.15' '3.15'
+  '';
+
  preConfigure = ''
    mkdir -p dependencies/.cache
    ln -s ${
@@ -49,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
      asl20
      mit
    ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
    platforms = lib.platforms.all;
  };
 })
@@ -0,0 +1,13 @@
+Submodule build contains modified content
+diff --git a/build/rust/allocator/lib.rs b/build/rust/allocator/lib.rs
+index 4b834e322..1970d664e 100644
+--- a/build/rust/allocator/lib.rs
+++ b/build/rust/allocator/lib.rs
+@@ -87,7 +87,6 @@ mod both_allocators {
+     /// rustc-generated shims we must define this symbol, since we are opting in
+     /// to unstable functionality. See https://github.com/rust-lang/rust/issues/123015
+     #[rustc_std_internal_symbol]
+-    #[linkage = "weak"]
+     fn __rust_no_alloc_shim_is_unstable_v2() {}
+ 
+     #[cfg(not(RUST_ALLOCATOR_NIGHTLY_CAPABILITY))]
@@ -1,12 +1,169 @@
-# auto-generated file -- DO NOT EDIT!
-{ fetchLibrustyV8 }:
-
-fetchLibrustyV8 {
-  version = "147.0.0";
-  shas = {
-    x86_64-linux = "sha256-PXLRowkOBRVWeonQDTN6e4BQlSLK/kobCX7eE0Y1NLY=";
-    aarch64-linux = "sha256-6jaFVmmYYOZNZmk6UHUAGyibSBQn51Ie57hB7CIZBFI=";
-    x86_64-darwin = "sha256-yTrxJ5ABXg1r0myZqy4J3m/ivYdXnsgG089PrD5cMhY=";
-    aarch64-darwin = "sha256-HVr7hNzZk4qQTct2Px7DvSJAnyq1duJCqJawY475SR4=";
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  rustPlatform,
+  rustc,
+  rustc-unwrapped,
+  rust-bindgen,
+  rust-analyzer,
+  rustfmt,
+  cargo,
+  clippy,
+  llvmPackages ? rustc.llvmPackages,
+  pkg-config,
+  stdenv,
+  glib,
+  glibc,
+  icu,
+  python3,
+  gn,
+  ninja,
+  xcbuild,
+  apple-sdk_15,
+  symlinkJoin,
+  deno,
+}:
+let
+  rustToolchain = symlinkJoin {
+    name = "rusty-v8-rust-toolchain";
+    paths = [
+      rustc
+      rustc-unwrapped
+      rust-bindgen
+      rust-analyzer
+      rustfmt
+      cargo
+      clippy
+      llvmPackages.libclang.lib
+    ];
+    postBuild = ''
+      mkdir -p "$out/lib/rustlib/src/rust"
+      cp -r '${rustPlatform.rustcSrc}'/* "$out/lib/rustlib/src/rust/"
+      chmod u+w "$out/lib/rustlib/src/rust/library/"
+      ln -s '${rustPlatform.rustVendorSrc}' "$out/lib/rustlib/src/rust/library/vendor"
+    '';
  };
-}
+
+  clangBasePath = symlinkJoin {
+    name = "rusty-v8-llvm-toolchain";
+    paths = [
+      llvmPackages.clang-unwrapped.lib
+      llvmPackages.clang
+      llvmPackages.llvm
+      llvmPackages.lld
+    ];
+    postBuild =
+      if stdenv.targetPlatform.isDarwin then
+        ''
+          dir="$out/lib/clang/${lib.versions.major llvmPackages.clang.version}/lib/darwin/"
+          mkdir -p "$dir"
+          ln -s ${llvmPackages.compiler-rt}/lib/darwin/libclang_rt.osx* "$dir/libclang_rt.osx${stdenv.hostPlatform.extensions.staticLibrary}"
+        ''
+      else
+        ''
+          dir="$out/lib/clang/${lib.versions.major llvmPackages.clang.version}/lib/${stdenv.hostPlatform.config}/"
+          mkdir -p "$dir"
+          ln -s ${llvmPackages.compiler-rt}/lib/linux/libclang_rt.builtins-* "$dir/libclang_rt.builtins${stdenv.hostPlatform.extensions.staticLibrary}"
+        '';
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rusty-v8";
+  version = "147.1.0";
+
+  src = fetchFromGitHub {
+    owner = "denoland";
+    repo = "rusty_v8";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-USCQtK5pJBpU1FTLMQ/bNwJXnVNkdX/EtCWqs2kVL50=";
+  };
+
+  patches = [
+    ./librusty_v8_no_downloads.patch
+    (fetchpatch {
+      name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7539408
+      url = "https://chromium.googlesource.com/chromium/src/+/acb47d9a6b56c4889a2ed4216e9968cfc740086c^!?format=TEXT";
+      decode = "base64 -d";
+      revert = true;
+      includes = [ "build/config/compiler/BUILD.gn" ];
+      hash = "sha256-0yEK66IEyS8xABDHY4W8oIvl4Ga1JfL1wxQy8PhXyqI=";
+    })
+    ./librusty_v8_revert_-fno-lifetime-dse.patch
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch
+  ];
+
+  cargoHash = "sha256-FKwXdms9j+izRKsm5TKJ8Ct8lvBuG/tYXfNzVsbs8cM=";
+
+  nativeBuildInputs = [
+    llvmPackages.clang
+    python3
+    pkg-config
+    llvmPackages.lld
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isLinux [
+    glibc
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    xcbuild
+  ];
+  buildInputs = [
+    glib
+    icu
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
+  env = {
+    V8_FROM_SOURCE = 1;
+    PYTHON = "python3";
+    NINJA = lib.getExe ninja;
+    GN = lib.getExe gn;
+    RUSTC_BOOTSTRAP = 1;
+    EXTRA_GN_ARGS = lib.concatStringsSep " " (
+      [
+        "use_sysroot=false" # prevent download of debian sysroot
+        "clang_version=\"${lib.versions.major llvmPackages.clang.version}\""
+        "rustc_version=\"${rustc.version}\""
+        "rust_sysroot_absolute=\"${rustToolchain}\""
+        "rust_bindgen_root=\"${rustToolchain}\""
+        "use_chromium_rust_toolchain=true"
+        # To accomodate our newer rustc compiler
+        "removed_rust_stdlib_libs=[\"adler\"]"
+        "added_rust_stdlib_libs=[\"adler2\"]"
+      ]
+      ++ lib.optional stdenv.targetPlatform.isDarwin "mac_deployment_target=\"${stdenv.targetPlatform.darwinMinVersion}\""
+    );
+    LIBCLANG_PATH = lib.makeLibraryPath [ llvmPackages.libclang ];
+    CLANG_BASE_PATH = clangBasePath;
+  };
+
+  buildFeatures = [ "simdutf" ];
+
+  checkFlags = [
+    # These tests probably fail due to a more recent rustc version (upstream: 1.89.0, here: 1.93.0)
+    "--skip=ui"
+    "--skip=scope"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    cp target/*/release/gn_out/obj/librusty_v8${stdenv.hostPlatform.extensions.staticLibrary} $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Rust bindings for the V8 JavaScript engine";
+    homepage = "https://github.com/denoland/rusty_v8";
+    license = lib.licenses.mit;
+    maintainers = deno.meta.maintainers;
+    platforms = deno.meta.platforms;
+  };
+})
@@ -0,0 +1,30 @@
+diff --git a/build.rs b/build.rs
+index 970e88bb..afb92e8a 100644
+--- a/build.rs
+++ b/build.rs
+@@ -251,7 +251,6 @@ fn build_v8(is_asan: bool) {
+     download_ninja_gn_binaries();
+   }
+ 
+-  download_rust_toolchain();
+ 
+   // `#[cfg(...)]` attributes don't work as expected from build.rs -- they refer to the configuration
+   // of the host system which the build.rs script will be running on. In short, `cfg!(target_<os/arch>)`
+@@ -461,17 +460,6 @@ fn maybe_clone_repo(dest: &str, repo: &str) {
+ }
+ 
+ fn maybe_install_sysroot(arch: &str) {
+-  let sysroot_path = format!("build/linux/debian_sid_{arch}-sysroot");
+-  if !PathBuf::from(sysroot_path).is_dir() {
+-    assert!(
+-      Command::new(python())
+-        .arg("./build/linux/sysroot_scripts/install-sysroot.py")
+-        .arg(format!("--arch={arch}"))
+-        .status()
+-        .unwrap()
+-        .success()
+-    );
+-  }
+ }
+ 
+ fn download_ninja_gn_binaries() {
@@ -0,0 +1,19 @@
+Submodule build contains modified content
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index ff8022f04..59699e1d4 100644
+--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
+@@ -625,13 +625,6 @@ config("compiler") {
+       ]
+     }
+ 
+-    # The performance improvement does not seem worth the risk. See
+-    # https://crbug.com/484082200 for background and https://crrev.com/c/7593035
+-    # for discussion.
+-    if (!is_wasm) {
+-      cflags += [ "-fno-lifetime-dse" ]
+-    }
+-
+     # TODO(hans): Remove this once Clang generates better optimized debug info
+     # by default. https://crbug.com/765793
+     cflags += [
@@ -9,9 +9,7 @@
  protobuf,
  installShellFiles,
  makeBinaryWrapper,
-  librusty_v8 ? callPackage ./librusty_v8.nix {
-    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
-  },
+  librusty_v8 ? callPackage ./librusty_v8.nix { },
  libffi,
  sqlite,
  lld,
@@ -244,7 +242,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  passthru = {
-    updateScript = ./update/update.ts;
+    updateScript = ./update.sh;
    tests = callPackage ./tests { };
    inherit librusty_v8;
  };
@@ -267,6 +265,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    maintainers = with lib.maintainers; [
      jk
      ofalvai
+      mynacol
    ];
    platforms = [
      "x86_64-linux"
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update curl yq
+
+old_version="$(nix-instantiate --raw --eval -A deno.version)"
+
+nix-update deno
+
+new_version="$(nix-instantiate --raw --eval -A deno.version)"
+
+if [ "$old_version" = "$new_version" ]; then
+  echo "No deno update, nothing to do"
+  exit 0
+fi
+
+new_v8_version="$(curl -sL "https://raw.githubusercontent.com/denoland/deno/refs/tags/v$new_version/Cargo.lock" | \
+  tomlq -r ".package[] | select(.name == \"v8\") | .version")"
+
+nix-update deno.librusty_v8 "--version=$new_v8_version"
@@ -1,51 +0,0 @@
-interface GHRelease {
-  tag_name: string;
-}
-
-const decode = (buffer: Uint8Array) => new TextDecoder("utf-8").decode(buffer);
-export const run = async (command: string, args: string[]) => {
-  const cmd = new Deno.Command(command, { args });
-  const { code, stdout, stderr } = await cmd.output();
-  if (code !== 0) {
-    const error = decode(stderr).trimEnd();
-    // Known error we can ignore
-    if (error.includes("'allow-unsafe-native-code-during-evaluation'")) {
-      // Extract the target sha256 out of the error
-      const target = "  got:    sha256:";
-      const match = error
-        .split("\n")
-        .find((l) => l.includes(target))
-        ?.split(target)[1];
-      if (typeof match !== "undefined") {
-        return match;
-      }
-    }
-    throw new Error(error);
-  }
-  return decode(stdout).trimEnd();
-};
-
-// Exports
-export const versionRegExp = /\d+\.\d+\.\d+/;
-export const sha256RegExp = /[a-z0-9]{52}|sha256-.{44}/;
-
-export const getExistingVersion = async (filePath: string) =>
-  read(filePath).then(
-    (s) => s.match(genValueRegExp("version", versionRegExp))?.shift() || "",
-  );
-
-export const getLatestVersion = (owner: string, repo: string) =>
-  fetch(`https://api.github.com/repos/${owner}/${repo}/releases`)
-    .then((res) => res.json())
-    .then((res: GHRelease[]) => res[0].tag_name);
-
-// The (?<=) and (?=) allow replace to only change inside
-// Match the regex passed in or empty
-export const genValueRegExp = (key: string, regex: RegExp) =>
-  new RegExp(`(?<=${key} = ")(${regex.source}|)(?=")`);
-
-export const logger = (name: string) => (...a: any) =>
-  console.log(`[${name}]`, ...a);
-
-export const read = Deno.readTextFile;
-export const write = Deno.writeTextFile;
@@ -1,67 +0,0 @@
-import {
-  genValueRegExp,
-  logger,
-  read,
-  run,
-  sha256RegExp,
-  versionRegExp,
-  write,
-} from "./common.ts";
-
-interface Replacer {
-  regex: RegExp;
-  value: string;
-}
-
-const log = logger("src");
-
-const prefetchHash = (nixpkgs: string, version: string) =>
-  run("nurl", ["https://github.com/denoland/deno", version, "-H", "-n", nixpkgs, "-S"]);
-const prefetchCargoHash = (nixpkgs: string) =>
-  run(
-    "nurl",
-    ["-e", `(import ${nixpkgs} {}).deno.cargoDeps.overrideAttrs (_: { hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; })`]
-  );
-
-const replace = (str: string, replacers: Replacer[]) =>
-  replacers.reduce(
-    (str, r) => str.replace(r.regex, r.value),
-    str,
-  );
-
-const updateNix = (filePath: string, replacers: Replacer[]) =>
-  read(filePath).then((str) => write(filePath, replace(str, replacers)));
-
-const genVerReplacer = (k: string, value: string): Replacer => (
-  { regex: genValueRegExp(k, versionRegExp), value }
-);
-const genShaReplacer = (k: string, value: string): Replacer => (
-  { regex: genValueRegExp(k, sha256RegExp), value }
-);
-
-export async function updateSrc(
-  filePath: string,
-  nixpkgs: string,
-  denoVersion: string,
-) {
-  log("Starting src update");
-  const trimVersion = denoVersion.substring(1);
-  log("Fetching hash for:", trimVersion);
-  const sha256 = await prefetchHash(nixpkgs, denoVersion);
-  log("sha256 to update:", sha256);
-  await updateNix(
-    filePath,
-    [
-      genVerReplacer("version", trimVersion),
-      genShaReplacer("hash", sha256),
-    ],
-  );
-  log("Fetching cargoHash for:", sha256);
-  const cargoHash = await prefetchCargoHash(nixpkgs);
-  log("cargoHash to update:", cargoHash);
-  await updateNix(
-    filePath,
-    [genShaReplacer("cargoHash", cargoHash)],
-  );
-  log("Finished src update");
-}
@@ -1,43 +0,0 @@
-#!/usr/bin/env nix-shell
-/*
-#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nurl
-*/
-import { getExistingVersion, getLatestVersion, logger } from "./common.ts";
-import { Architecture, updateLibrustyV8 } from "./librusty_v8.ts";
-import { updateSrc } from "./src.ts";
-
-const log = logger("update");
-// TODO: Getting current file position to more-safely point to nixpkgs root
-const nixpkgs = Deno.cwd();
-// TODO: Read values from default.nix
-const owner = "denoland";
-const repo = "deno";
-const denoDir = `${nixpkgs}/pkgs/by-name/de/${repo}`;
-const src = `${denoDir}/package.nix`;
-const librusty_v8 = `${denoDir}/librusty_v8.nix`;
-const architectures: Architecture[] = [
-  { nix: "x86_64-linux", rust: "x86_64-unknown-linux-gnu" },
-  { nix: "aarch64-linux", rust: "aarch64-unknown-linux-gnu" },
-  { nix: "x86_64-darwin", rust: "x86_64-apple-darwin" },
-  { nix: "aarch64-darwin", rust: "aarch64-apple-darwin" },
-];
-
-log("Updating deno");
-
-log("Getting latest deno version");
-const version = await getLatestVersion(owner, repo);
-const existingVersion = await getExistingVersion(src);
-const trimVersion = version.substr(1); // Strip v from v0.0.0
-log("Latest version:   ", trimVersion);
-log("Extracted version:", existingVersion);
-if (trimVersion === existingVersion) {
-  log("Version already matches latest, skipping...");
-  Deno.exit(0);
-}
-
-const tasks = [
-  updateSrc(src, nixpkgs, version),
-  updateLibrustyV8(librusty_v8, owner, repo, version, architectures),
-];
-await Promise.all(tasks);
-log("Updating deno complete");
@@ -59,13 +59,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "easyeffects";
-  version = "8.1.8";
+  version = "8.2.0";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "easyeffects";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-U0+OGxej5my2KpqzRTiHrB80arkWT1mxHOSxOCDsnb0=";
+    hash = "sha256-HBCYXFFDOhwVebwPIduYNGJ61LFw9lOTZyYmt1k6CuA=";
  };

  nativeBuildInputs = [
@@ -2,32 +2,32 @@
  stdenvNoCC,
  lib,
  fetchzip,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "edukai";
-  version = "5.0";
+  version = "5.1";

  src = fetchzip {
-    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai-${version}.zip";
-    sha256 = "sha256-3+w9n6GJQg9+HfHYukC7tlm4GVs8vEOO23hrLw6qjTY=";
+    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai-${finalAttrs.version}.zip";
+    hash = "sha256-B4TwTPX1dsq6rB4YunY6q2yx2OJhNhmn3an/dJwDPJc=";
  };

-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    mv *.ttf $out/share/fonts/
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "MOE Standard Kai Font, a Chinese font by the Ministry of Education, ROC (Taiwan)";
    longDescription = ''
-      The MOE Standard Kai Font is a kai (regular srcipt) font
-      provided by
-      the Midistry of Education, Republic of China (Taiwan).
-      It currently includes 13,076 Chinese characters.
+      The MOE Standard Kai Font is a kai (regular script) font
+      provided by the Ministry of Education, Republic of China (Taiwan).
+      It currently includes 13,084 Chinese characters.
    '';
-    homepage = "http://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=47";
+    homepage = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai.pdf";
    license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
  };
-}
+})
@@ -2,35 +2,33 @@
  stdenvNoCC,
  lib,
  fetchzip,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "eduli";
  version = "3.0";

  src = fetchzip {
-    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-3.0.zip";
+    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-${finalAttrs.version}.zip";
    hash = "sha256-bDQtLugYPWwJJNusBLEJrgIVufocRK4NIR0CCGaTkyw=";
  };

-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    for name in *.ttf; do
-      mv "$name" "$out/share/fonts/$(echo $name | sed -r 's/(.*)\(.*\)\.ttf/\1.ttf/')"
-    done
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "MOE Li Font, a clerical Chinese font by the Ministry of Education, ROC (Taiwan)";
    longDescription = ''
-      The MOE Li Font is a li (clerical srcipt) font
-      provided by
-      the Midistry of Education, Republic of China (Taiwan).
+      The MOE Li Font is a li (clerical script) font provided by
+      the Ministry of Education, Republic of China (Taiwan).
      It currently includes 4,808 Chinese characters.
      The clerical script (lishu) is an archaic style of Chinese calligraphy.
    '';
-    homepage = "http://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=49";
+    homepage = "https://language.moe.gov.tw/material/info?m=9fe3fb11-c3d5-41f2-b029-6d18a2c2fd0d";
    license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
  };
-}
+})
@@ -2,30 +2,31 @@
  stdenvNoCC,
  lib,
  fetchzip,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "edusong";
-  version = "4.0";
+  version = "4.4";

  src = fetchzip {
    name = "edusong-${finalAttrs.version}";
    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/eduSong_Unicode.zip";
-    hash = "sha256-4NBnwMrYufeZbgSiD2fAhe4tuy0aAA5u9tWwjQQjEQk=";
+    hash = "sha256-+wH6I0sOfzytstDNT81LMuqknGQuYekl31e1tYaDvRg=";
  };

-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    mv eduSong_Unicode*.ttf $out/share/fonts/eduSong_Unicode\(2024年12月\).ttf
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "MOE Song font, a Song-style Chinese character typeface";
    longDescription = ''
      A Song-style Chinese character typeface published by the Ministry of Education of the Republic of China (Taiwan). The Song style is also referred to as 宋體, 宋体, sòngtǐ, 明體, 明体, or míngtǐ, in Chinese; 명조체, 明朝體, or myeongjo in Korean; 明朝体, みんちょうたい, or minchōtai in Japanese.
    '';
-    homepage = "https://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=48";
+    homepage = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edusun.pdf";
    license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
  };
 })
@@ -7,22 +7,17 @@

 buildGoModule (finalAttrs: {
  pname = "glauth";
-  version = "2.4.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "glauth";
    repo = "glauth";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-UUTL+ZnHRSYuD/TUYpsuo+Nu90kpA8ZL4XaGz6in3ME=";
+    tag = "GLAuth-v${finalAttrs.version}";
+    hash = "sha256-9aymP2zhp2DaqqrC1tiTicqnzBvAHGdx4KHKXkYNNsg=";
  };

  vendorHash = "sha256-Lijy0LFy0PgWogdzYRNPFOkLym6Gf9qG4R+Bm91eYJg=";

-  postPatch = ''
-    substituteInPlace v2/internal/version/const.go \
-      --replace-fail '"v2.3.1"' '"v${finalAttrs.version}"'
-  '';
-
  # Builds without go workspace fail with mysterious errors
  overrideModAttrs = _: {
    buildPhase = ''
@@ -0,0 +1,21 @@
+# not a stable interface, do not reference outside the goose-cli package but make a
+# copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}
@@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "145.0.0"; # From source's Cargo.lock
+  shas = {
+    x86_64-linux = "sha256-chV1PAx40UH3Ute5k3lLrgfhih39Rm3KqE+mTna6ysE=";
+    aarch64-linux = "sha256-4IivYskhUSsMLZY97+g23UtUYh4p5jk7CzhMbMyqXyY=";
+    x86_64-darwin = "sha256-1jUuC+z7saQfPYILNyRJanD4+zOOhXU2ac/LFoytwho=";
+    aarch64-darwin = "sha256-yHa1eydVCrfYGgrZANbzgmmf25p7ui1VMas2A7BhG6k=";
+  };
+}
@@ -1,17 +1,37 @@
 {
  lib,
  stdenv,
+  callPackage,
  fetchFromGitHub,
  fetchurl,
  rustPlatform,
+  cmake,
  dbus,
  libxcb,
  pkg-config,
  protobuf,
  openssl,
+  cacert,
  writableTmpDirAsHomeHook,
+  versionCheckHook,
  nix-update-script,
  llvmPackages,
+  makeWrapper,
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+  },
+
+  # Extension(s) Dependencies
+  python3,
+  bash,
+  # X11
+  xdotool,
+  wmctrl,
+  xclip,
+  xwininfo,
+  # Wayland
+  wtype,
+  wl-clipboard,
 }:

 let
@@ -28,16 +48,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "goose-cli";
-  version = "1.23.2";
+  version = "1.28.0";

  src = fetchFromGitHub {
    owner = "block";
    repo = "goose";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Zwb3y9XhtmKxJG6XOIHl49YVZMBsYtOPePM7heJfEvE=";
+    hash = "sha256-/1TtsnNiLoTkvyeFR282qSpo+Jt3pvFxduJ7lyzsTXI=";
  };

-  cargoHash = "sha256-G6Jok2OfSlOVlkF62gxivrKM0VlGqWFNdR0pQh79A0Q=";
+  cargoHash = "sha256-bhnbSjGqyWbQd5PjZ116JH91vjVy6R/+iBlNKL6debg=";

  cargoBuildFlags = [
    "--bin"
@@ -47,8 +67,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ];

  nativeBuildInputs = [
+    cmake
    pkg-config
    protobuf
+    rustPlatform.bindgenHook
+    makeWrapper
  ];

  buildInputs = [
@@ -57,7 +80,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];

-  env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
+  env = {
+    LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
+    RUSTY_V8_ARCHIVE = librusty_v8;
+  };

  preBuild = ''
    mkdir -p tokenizer_files/Xenova--gpt-4o tokenizer_files/Xenova--claude-tokenizer
@@ -65,7 +91,32 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ln -s ${claude-tokenizer} tokenizer_files/Xenova--claude-tokenizer/tokenizer.json
  '';

-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  postFixup = ''
+    wrapProgram $out/bin/goose \
+      --prefix PATH : ${
+        lib.makeBinPath (
+          [
+            bash
+            python3
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            # X11
+            xdotool
+            wmctrl
+            xclip
+            xwininfo
+            # Wayland
+            wtype
+            wl-clipboard
+          ]
+        )
+      }
+  '';
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    cacert
+  ];

  __darwinAllowLocalNetworking = true;

@@ -108,6 +159,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=context_mgmt::auto_compact::tests::test_auto_compact_respects_config"
    "--skip=scheduler::tests::test_scheduled_session_has_schedule_id"
  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # Broken on aarch64-linux: request capture races across session_id_propagation_test cases
+    "--skip=test_session_id_matches_across_calls"
+    "--skip=test_session_id_propagation_to_llm"
+  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "--skip=logging::tests::test_log_file_name_no_session"
    "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_basic"
@@ -117,6 +173,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=test_session_id_propagation_to_llm"
  ];

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
  passthru.updateScript = nix-update-script { };

  meta = {
@@ -128,6 +188,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
      cloudripper
      thardin
      brittonr
+      miniharinn
+      caniko
    ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+buildcpath() {
+  local path after
+  while (( $# )); do
+    case $1 in
+        -isystem|-cxx-isystem)
+            shift
+            path=$path${path:+':'}$1
+            ;;
+        -idirafter)
+            shift
+            after=$after${after:+':'}$1
+            ;;
+    esac
+    shift
+  done
+  echo $path${after:+':'}$after
+}
+
+export CPATH=${CPATH}${CPATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                               $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+export CPLUS_INCLUDE_PATH=${CPLUS_INCLUDE_PATH}${CPLUS_INCLUDE_PATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                                                                      $(<@clang@/nix-support/libcxx-cxxflags) \
+                                                                                      $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+
+exec -a "$0" @unwrapped@/bin/$(basename $0) "$@"
@@ -0,0 +1,43 @@
+# Wrapper for clang tools (clang-scan-deps, clang-check, etc.) that sets
+# CPATH and CPLUS_INCLUDE_PATH so they can find C/C++ standard library headers.
+#
+# This is needed because tools like clang-scan-deps are invoked directly by
+# build systems (e.g., CMake's C++20 module scanning) without going through
+# the cc-wrapper, so they don't get the flags that tell them where headers are.
+{
+  lib,
+  stdenv,
+  unwrapped,
+  wrapper,
+}:
+stdenv.mkDerivation {
+  pname = "intel-llvm-clang-tools";
+  version = unwrapped.version;
+
+  dontUnpack = true;
+
+  # These are used in substituteAll for the wrapper script
+  inherit unwrapped;
+  clang = wrapper;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    substituteAll ${./clang-tools-wrapper} $out/bin/.clang-tool-wrapper
+    chmod +x $out/bin/.clang-tool-wrapper
+
+    for tool in clang-scan-deps clang-check clang-extdef-mapping clang-refactor clang-tidy; do
+      if [[ -e $unwrapped/bin/$tool ]]; then
+        ln -s $out/bin/.clang-tool-wrapper $out/bin/$tool
+      fi
+    done
+
+    runHook postInstall
+  '';
+
+  meta = unwrapped.meta // {
+    description = "Wrapped Intel LLVM clang tools with proper include paths";
+  };
+}
@@ -0,0 +1,746 @@
+diff --git a/bolt/CMakeLists.txt b/bolt/CMakeLists.txt
+index 5c7d51e1e398..9158552fa09b 100644
+--- a/bolt/CMakeLists.txt
+++ b/bolt/CMakeLists.txt
+@@ -55,9 +55,9 @@ if(BOLT_BUILT_STANDALONE)
+   include_directories(${LLVM_INCLUDE_DIRS})
+   link_directories("${LLVM_LIBRARY_DIR}")
+ 
+-  set( CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_INSTALL_BINDIR}" )
+-  set( CMAKE_LIBRARY_OUTPUT_DIRECTORY "${CMAKE_INSTALL_LIBDIR}/${LLVM_LIBDIR_SUFFIX}" )
+-  set( CMAKE_ARCHIVE_OUTPUT_DIRECTORY "${CMAKE_INSTALL_LIBDIR}/${LLVM_LIBDIR_SUFFIX}")
+  set( CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin" )
+  set( CMAKE_LIBRARY_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}" )
+  set( CMAKE_ARCHIVE_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}")
+ endif() # standalone
+ 
+ # Determine default set of targets to build -- the intersection of
+diff --git a/bolt/runtime/CMakeLists.txt b/bolt/runtime/CMakeLists.txt
+index 63f178bd263c..55c582313e47 100644
+--- a/bolt/runtime/CMakeLists.txt
+++ b/bolt/runtime/CMakeLists.txt
+@@ -64,8 +64,8 @@ target_include_directories(bolt_rt_instr PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
+ target_compile_options(bolt_rt_hugify PRIVATE ${BOLT_RT_FLAGS})
+ target_include_directories(bolt_rt_hugify PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
+ 
+-install(TARGETS bolt_rt_instr DESTINATION "lib${LLVM_LIBDIR_SUFFIX}")
+-install(TARGETS bolt_rt_hugify DESTINATION "lib${LLVM_LIBDIR_SUFFIX}")
+install(TARGETS bolt_rt_instr DESTINATION ${CMAKE_INSTALL_LIBDIR})
+install(TARGETS bolt_rt_hugify DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ 
+ if (CMAKE_CXX_COMPILER_ID MATCHES ".*Clang.*" AND CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+   add_library(bolt_rt_instr_osx STATIC
+@@ -77,7 +77,7 @@ if (CMAKE_CXX_COMPILER_ID MATCHES ".*Clang.*" AND CMAKE_SYSTEM_NAME STREQUAL "Da
+   target_compile_options(bolt_rt_instr_osx PRIVATE
+     -target x86_64-apple-darwin19.6.0
+     ${BOLT_RT_FLAGS})
+-  install(TARGETS bolt_rt_instr_osx DESTINATION "lib${LLVM_LIBDIR_SUFFIX}")
+  install(TARGETS bolt_rt_instr_osx DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ 
+   if(NOT BOLT_BUILT_STANDALONE)
+     add_custom_command(TARGET bolt_rt_instr_osx POST_BUILD
+diff --git a/clang/cmake/caches/CrossWinToARMLinux.cmake b/clang/cmake/caches/CrossWinToARMLinux.cmake
+index c47c4ac3bb73..721eb2cfd302 100644
+--- a/clang/cmake/caches/CrossWinToARMLinux.cmake
+++ b/clang/cmake/caches/CrossWinToARMLinux.cmake
+@@ -152,7 +152,7 @@ endif()
+ # Set up RPATH for the target runtime/builtin libraries.
+ # See some details here: https://reviews.llvm.org/D91099
+ if (NOT DEFINED RUNTIMES_INSTALL_RPATH)
+-  set(RUNTIMES_INSTALL_RPATH                "\$ORIGIN/../lib;${CMAKE_INSTALL_PREFIX}/lib")
+  set(RUNTIMES_INSTALL_RPATH                "\$ORIGIN/../lib;${CMAKE_INSTALL_FULL_LIBDIR}")
+ endif()
+ 
+ set(LLVM_BUILTIN_TARGETS                    "${TOOLCHAIN_TARGET_TRIPLE}" CACHE STRING "")
+diff --git a/clang/cmake/modules/AddClang.cmake b/clang/cmake/modules/AddClang.cmake
+index 4059fc3e986c..2b2500ad655c 100644
+--- a/clang/cmake/modules/AddClang.cmake
+++ b/clang/cmake/modules/AddClang.cmake
+@@ -134,8 +134,8 @@ macro(add_clang_library name)
+         install(TARGETS ${lib}
+           COMPONENT ${lib}
+           ${export_to_clangtargets}
+-          LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-          ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+          LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+          ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+           RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+         if (NOT LLVM_ENABLE_IDE)
+diff --git a/clang/tools/scan-build-py/CMakeLists.txt b/clang/tools/scan-build-py/CMakeLists.txt
+index 9273eb5ed977..8251d75bc52e 100644
+--- a/clang/tools/scan-build-py/CMakeLists.txt
+++ b/clang/tools/scan-build-py/CMakeLists.txt
+@@ -88,7 +88,7 @@ foreach(lib ${LibScanbuild})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/${lib})
+   install(FILES lib/libscanbuild/${lib}
+-          DESTINATION lib/libscanbuild
+          DESTINATION ${CMAKE_INSTALL_LIBDIR}/libscanbuild
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -106,7 +106,7 @@ foreach(resource ${LibScanbuildResources})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/resources/${resource})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources/${resource})
+   install(FILES lib/libscanbuild/resources/${resource}
+-          DESTINATION lib/libscanbuild/resources
+          DESTINATION ${CMAKE_INSTALL_LIBDIR}/libscanbuild/resources
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -122,7 +122,7 @@ foreach(lib ${LibEar})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libear/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libear/${lib})
+   install(FILES lib/libear/${lib}
+-          DESTINATION lib/libear
+          DESTINATION ${CMAKE_INSTALL_LIBDIR}/libear
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+diff --git a/cmake/Modules/GNUInstallPackageDir.cmake b/cmake/Modules/GNUInstallPackageDir.cmake
+index e4a058e68f4f..e4e84b6fc057 100644
+--- a/cmake/Modules/GNUInstallPackageDir.cmake
+++ b/cmake/Modules/GNUInstallPackageDir.cmake
+@@ -29,5 +29,5 @@ macro(_GNUInstallPackageDir_cache_path var default description)
+   _GNUInstallPackageDir_cache_convert_to_path("${var}" "${description}")
+ endmacro()
+ 
+-_GNUInstallPackageDir_cache_path(CMAKE_INSTALL_PACKAGEDIR "lib${LLVM_LIBDIR_SUFFIX}/cmake"
+_GNUInstallPackageDir_cache_path(CMAKE_INSTALL_PACKAGEDIR "${CMAKE_INSTALL_LIBDIR}/cmake"
+   "Directories containing installed CMake modules (lib/cmake)")
+diff --git a/cmake/Modules/GetClangResourceDir.cmake b/cmake/Modules/GetClangResourceDir.cmake
+index 518220188f96..d8b046fdca4c 100644
+--- a/cmake/Modules/GetClangResourceDir.cmake
+++ b/cmake/Modules/GetClangResourceDir.cmake
+@@ -16,7 +16,7 @@ function(get_clang_resource_dir out_var)
+     if (NOT CLANG_VERSION_MAJOR)
+       string(REGEX MATCH "^[0-9]+" CLANG_VERSION_MAJOR ${PACKAGE_VERSION})
+     endif()
+-    set(ret_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION_MAJOR})
+    set(ret_dir ${CMAKE_INSTALL_LIBDIR}/clang/${CLANG_VERSION_MAJOR})
+   endif()
+ 
+   if(ARG_PREFIX)
+diff --git a/compiler-rt/cmake/Modules/CompilerRTAIXUtils.cmake b/compiler-rt/cmake/Modules/CompilerRTAIXUtils.cmake
+index 20400014869e..a4fe2fafe616 100644
+--- a/compiler-rt/cmake/Modules/CompilerRTAIXUtils.cmake
+++ b/compiler-rt/cmake/Modules/CompilerRTAIXUtils.cmake
+@@ -53,7 +53,7 @@ macro(archive_aix_libatomic name libname)
+     # setting _install_rpath on AIX for reference.
+     if(LLVM_LIBRARY_OUTPUT_INTDIR AND CMAKE_INSTALL_PREFIX)
+       set(output_dir "${LLVM_LIBRARY_OUTPUT_INTDIR}")
+-      set(install_dir "${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
+      set(install_dir "${CMAKE_INSTALL_FULL_LIBDIR}")
+     else()
+       get_compiler_rt_output_dir(${COMPILER_RT_DEFAULT_TARGET_ARCH} output_dir)
+       get_compiler_rt_install_dir(${COMPILER_RT_DEFAULT_TARGET_ARCH} install_dir)
+diff --git a/flang/cmake/modules/AddFlang.cmake b/flang/cmake/modules/AddFlang.cmake
+index ca233103ccdb..3e4dd9a58c5f 100644
+--- a/flang/cmake/modules/AddFlang.cmake
+++ b/flang/cmake/modules/AddFlang.cmake
+@@ -81,8 +81,8 @@ function(add_flang_library name)
+       install(TARGETS ${name}
+         COMPONENT ${name}
+         ${export_to_flangtargets}
+-        LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-        ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+         RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+       if (NOT LLVM_ENABLE_IDE)
+diff --git a/libclc/libclc.pc.in b/libclc/libclc.pc.in
+index 3a9e58b3ef0c..60f8c0fdf75d 100644
+--- a/libclc/libclc.pc.in
+++ b/libclc/libclc.pc.in
+@@ -1,4 +1,4 @@
+-libexecdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_DATADIR@/clc
+libexecdir=@CMAKE_INSTALL_FULL_DATAROOTDIR@/clc
+ 
+ Name: libclc
+ Description: Library requirements of the OpenCL C programming language
+diff --git a/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in b/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in
+index f0782c28ce3e..32fc542db557 100644
+--- a/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in
+++ b/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in
+@@ -1,6 +1,6 @@
+ lit_config.load_config(config, '@CMAKE_CURRENT_BINARY_DIR@/cmake-bridge.cfg')
+ 
+-libc_linker_script = '@CMAKE_INSTALL_PREFIX@/lib/picolibcpp.ld'
+libc_linker_script = '@CMAKE_INSTALL_FULL_LIBDIR@/picolibcpp.ld'
+ 
+ config.substitutions.append(('%{flags}', '--sysroot=@CMAKE_INSTALL_PREFIX@'))
+ 
+diff --git a/libcxxabi/test/configs/armv7m-picolibc-libc++abi.cfg.in b/libcxxabi/test/configs/armv7m-picolibc-libc++abi.cfg.in
+index e61efbb303fc..a73c58584567 100644
+--- a/libcxxabi/test/configs/armv7m-picolibc-libc++abi.cfg.in
+++ b/libcxxabi/test/configs/armv7m-picolibc-libc++abi.cfg.in
+@@ -1,6 +1,6 @@
+ lit_config.load_config(config, '@CMAKE_CURRENT_BINARY_DIR@/cmake-bridge.cfg')
+ 
+-libc_linker_script = '@CMAKE_INSTALL_PREFIX@/lib/picolibcpp.ld'
+libc_linker_script = '@CMAKE_INSTALL_FULL_LIBDIR@/picolibcpp.ld'
+ 
+ config.substitutions.append(('%{flags}', '--sysroot=@CMAKE_INSTALL_PREFIX@'))
+ 
+diff --git a/libdevice/cmake/modules/SYCLLibdevice.cmake b/libdevice/cmake/modules/SYCLLibdevice.cmake
+index 21989df43c00..36aee071dd96 100644
+--- a/libdevice/cmake/modules/SYCLLibdevice.cmake
+++ b/libdevice/cmake/modules/SYCLLibdevice.cmake
+@@ -12,16 +12,16 @@ else()
+   set(obj-suffix o)
+   set(obj-new-offload-suffix new.o)
+   set(spv_binary_dir "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
+-  set(install_dest_spv lib${LLVM_LIBDIR_SUFFIX})
+  set(install_dest_spv ${CMAKE_INSTALL_LIBDIR})
+   set(devicelib_host_static_obj libsycl-devicelib-host.a)
+   set(devicelib_host_static_obj-new-offload libsycl-devicelib-host.new.a)
+ endif()
+ set(spv-suffix spv)
+ set(bc-suffix bc)
+ set(bc_binary_dir "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
+-set(install_dest_obj lib${LLVM_LIBDIR_SUFFIX})
+-set(install_dest_obj-new-offload lib${LLVM_LIBDIR_SUFFIX})
+-set(install_dest_bc lib${LLVM_LIBDIR_SUFFIX})
+set(install_dest_obj ${CMAKE_INSTALL_LIBDIR})
+set(install_dest_obj-new-offload ${CMAKE_INSTALL_LIBDIR})
+set(install_dest_bc ${CMAKE_INSTALL_LIBDIR})
+ 
+ string(CONCAT sycl_targets_opt
+   "-fsycl-targets="
+diff --git a/libunwind/test/configs/armv7m-picolibc-libunwind.cfg.in b/libunwind/test/configs/armv7m-picolibc-libunwind.cfg.in
+index 6ffdd70c6177..fadb6b3cb02f 100644
+--- a/libunwind/test/configs/armv7m-picolibc-libunwind.cfg.in
+++ b/libunwind/test/configs/armv7m-picolibc-libunwind.cfg.in
+@@ -1,6 +1,6 @@
+ lit_config.load_config(config, '@CMAKE_CURRENT_BINARY_DIR@/cmake-bridge.cfg')
+ 
+-libc_linker_script = '@CMAKE_INSTALL_PREFIX@/lib/picolibcpp.ld'
+libc_linker_script = '@CMAKE_INSTALL_FULL_LIBDIR@/picolibcpp.ld'
+ 
+ config.substitutions.append(('%{flags}', '--sysroot=@CMAKE_INSTALL_PREFIX@'))
+ 
+diff --git a/lld/cmake/modules/AddLLD.cmake b/lld/cmake/modules/AddLLD.cmake
+index 37f73afa915f..1f70cfe4fc05 100644
+--- a/lld/cmake/modules/AddLLD.cmake
+++ b/lld/cmake/modules/AddLLD.cmake
+@@ -17,8 +17,8 @@ macro(add_lld_library name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${export_to_lldtargets}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+       RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+     if (NOT CMAKE_CONFIGURATION_TYPES)
+diff --git a/lldb/cmake/modules/AddLLDB.cmake b/lldb/cmake/modules/AddLLDB.cmake
+index 5d58abf237f5..fd2edc4e3a66 100644
+--- a/lldb/cmake/modules/AddLLDB.cmake
+++ b/lldb/cmake/modules/AddLLDB.cmake
+@@ -106,7 +106,7 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
+    set(install_dest ${CMAKE_INSTALL_LIBDIR})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+diff --git a/lldb/tools/intel-features/CMakeLists.txt b/lldb/tools/intel-features/CMakeLists.txt
+index 7d48491ec89a..cb5f751a80ca 100644
+--- a/lldb/tools/intel-features/CMakeLists.txt
+++ b/lldb/tools/intel-features/CMakeLists.txt
+@@ -30,4 +30,4 @@ add_lldb_library(lldbIntelFeatures SHARED
+   )
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
+  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
+diff --git a/llvm-spirv/LLVMSPIRVLib.pc.in b/llvm-spirv/LLVMSPIRVLib.pc.in
+index 814c59251611..7188084e8061 100644
+--- a/llvm-spirv/LLVMSPIRVLib.pc.in
+++ b/llvm-spirv/LLVMSPIRVLib.pc.in
+@@ -1,7 +1,7 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${prefix}/lib@LLVM_LIBDIR_SUFFIX@
+-includedir=${prefix}/include
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: LLVMSPIRVLib
+ Description: LLVM/SPIR-V bi-directional translator
+diff --git a/llvm/CMakeLists.txt b/llvm/CMakeLists.txt
+index 9bbd39abd558..78b8da693007 100644
+--- a/llvm/CMakeLists.txt
+++ b/llvm/CMakeLists.txt
+@@ -1207,9 +1207,9 @@ if (NOT TENSORFLOW_AOT_PATH STREQUAL "")
+   add_subdirectory(${TENSORFLOW_AOT_PATH}/xla_aot_runtime_src
+     ${CMAKE_ARCHIVE_OUTPUT_DIRECTORY}/tf_runtime)
+   install(TARGETS tf_xla_runtime EXPORT LLVMExports
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT tf_xla_runtime)
+   install(TARGETS tf_xla_runtime EXPORT LLVMDevelopmentExports
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT tf_xla_runtime)
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS tf_xla_runtime)
+   # Once we add more modules, we should handle this more automatically.
+   if (DEFINED LLVM_OVERRIDE_MODEL_HEADER_INLINERSIZEMODEL)
+diff --git a/llvm/cmake/modules/AddLLVM.cmake b/llvm/cmake/modules/AddLLVM.cmake
+index 7d40d309d538..5844f0f2a2fa 100644
+--- a/llvm/cmake/modules/AddLLVM.cmake
+++ b/llvm/cmake/modules/AddLLVM.cmake
+@@ -974,8 +974,8 @@ macro(add_llvm_library name)
+       endif()
+       install(TARGETS ${name}
+               ${export_to_llvmexports}
+-              LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+-              ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+              LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT ${name}
+              ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT ${name}
+               RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT ${name})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+@@ -2284,7 +2284,7 @@ function(llvm_install_library_symlink name dest type)
+     set(LLVM_LINK_OR_COPY copy)
+   endif()
+ 
+-  set(output_dir lib${LLVM_LIBDIR_SUFFIX})
+  set(output_dir ${CMAKE_INSTALL_LIBDIR})
+   if((WIN32 OR CYGWIN) AND "${type}" STREQUAL "SHARED")
+     set(output_dir "${CMAKE_INSTALL_BINDIR}")
+   endif()
+@@ -2566,10 +2566,10 @@ function(llvm_setup_rpath name)
+     # Since BUILD_SHARED_LIBS is only recommended for use by developers,
+     # hardcode the rpath to build/install lib dir first in this mode.
+     # FIXME: update this when there is better solution.
+-    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_FULL_LIBDIR}" ${extra_libdir})
+   elseif(UNIX)
+-    set(_build_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+-    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}")
+    set(_build_rpath "${CMAKE_INSTALL_FULL_LIBDIR}" ${extra_libdir})
+    set(_install_rpath "${CMAKE_INSTALL_FULL_LIBDIR}")
+     if("${CMAKE_SYSTEM_NAME}" MATCHES "(FreeBSD|DragonFly)")
+       set_property(TARGET ${name} APPEND_STRING PROPERTY
+                    LINK_FLAGS " -Wl,-z,origin ")
+diff --git a/llvm/cmake/modules/AddOCaml.cmake b/llvm/cmake/modules/AddOCaml.cmake
+index 2d9116b08a52..076649279eb2 100644
+--- a/llvm/cmake/modules/AddOCaml.cmake
+++ b/llvm/cmake/modules/AddOCaml.cmake
+@@ -147,9 +147,9 @@ function(add_ocaml_library name)
+   endforeach()
+ 
+   if( APPLE )
+-    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
+    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}")
+   elseif( UNIX )
+-    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
+    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}")
+   endif()
+   list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
+ 
+diff --git a/llvm/cmake/modules/CMakeLists.txt b/llvm/cmake/modules/CMakeLists.txt
+index ef4cfa3acdb5..2ab47d564f76 100644
+--- a/llvm/cmake/modules/CMakeLists.txt
+++ b/llvm/cmake/modules/CMakeLists.txt
+@@ -130,7 +130,7 @@ set(LLVM_CONFIG_INCLUDE_DIRS
+   )
+ list(REMOVE_DUPLICATES LLVM_CONFIG_INCLUDE_DIRS)
+ 
+-extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "lib\${LLVM_LIBDIR_SUFFIX}")
+extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "${CMAKE_INSTALL_LIBDIR}")
+ set(LLVM_CONFIG_LIBRARY_DIRS
+   "${LLVM_CONFIG_LIBRARY_DIR}"
+   # FIXME: Should there be other entries here?
+diff --git a/llvm/include/llvm/SYCLLowerIR/CMakeLists.txt b/llvm/include/llvm/SYCLLowerIR/CMakeLists.txt
+index fee74421f102..99c7f2920a9b 100644
+--- a/llvm/include/llvm/SYCLLowerIR/CMakeLists.txt
+++ b/llvm/include/llvm/SYCLLowerIR/CMakeLists.txt
+@@ -8,5 +8,5 @@ tablegen(LLVM DeviceConfigFile.inc -gen-dynamic-tables)
+ add_public_tablegen_target(DeviceConfigFile)
+ install(FILES "${CMAKE_CURRENT_SOURCE_DIR}/DeviceConfigFile.hpp"
+               "${CMAKE_CURRENT_BINARY_DIR}/DeviceConfigFile.inc"
+-        DESTINATION include/llvm/SYCLLowerIR
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm/SYCLLowerIR
+         COMPONENT DeviceConfigFile)
+diff --git a/llvm/lib/ExecutionEngine/Interpreter/CMakeLists.txt b/llvm/lib/ExecutionEngine/Interpreter/CMakeLists.txt
+index 8046bca2b1a4..997bd51e2b10 100644
+--- a/llvm/lib/ExecutionEngine/Interpreter/CMakeLists.txt
+++ b/llvm/lib/ExecutionEngine/Interpreter/CMakeLists.txt
+@@ -21,4 +21,4 @@ configure_file(
+   Interpreter.h
+   ${LLVM_BINARY_DIR}/include/llvm/ExecutionEngine/Interpreter/Interpreter.h)
+ 
+-install(FILES Interpreter.h DESTINATION include/llvm/ExecutionEngine/Interpreter)
+install(FILES Interpreter.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm/ExecutionEngine/Interpreter)
+diff --git a/llvm/tools/llvm-config/BuildVariables.inc.in b/llvm/tools/llvm-config/BuildVariables.inc.in
+index e4e1d449bf4d..890e1f164d97 100644
+--- a/llvm/tools/llvm-config/BuildVariables.inc.in
+++ b/llvm/tools/llvm-config/BuildVariables.inc.in
+@@ -23,6 +23,7 @@
+ #define LLVM_CXXFLAGS "@LLVM_CXXFLAGS@"
+ #define LLVM_BUILDMODE "@LLVM_BUILDMODE@"
+ #define LLVM_LIBDIR_SUFFIX "@LLVM_LIBDIR_SUFFIX@"
+#define LLVM_INSTALL_FULL_LIBDIR "@CMAKE_INSTALL_FULL_LIBDIR@"
+ #define LLVM_INSTALL_INCLUDEDIR "@CMAKE_INSTALL_INCLUDEDIR@"
+ #define LLVM_INSTALL_PACKAGE_DIR "@LLVM_INSTALL_PACKAGE_DIR@"
+ #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
+diff --git a/llvm/tools/llvm-config/llvm-config.cpp b/llvm/tools/llvm-config/llvm-config.cpp
+index 020b1b5e093d..bfb58ce73a2b 100644
+--- a/llvm/tools/llvm-config/llvm-config.cpp
+++ b/llvm/tools/llvm-config/llvm-config.cpp
+@@ -364,7 +364,7 @@ int main(int argc, char **argv) {
+       sys::path::make_absolute(ActivePrefix, Path);
+       ActiveBinDir = std::string(Path);
+     }
+-    ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
+    ActiveLibDir = LLVM_INSTALL_FULL_LIBDIR;
+     {
+       SmallString<256> Path(LLVM_INSTALL_PACKAGE_DIR);
+       sys::path::make_absolute(ActivePrefix, Path);
+diff --git a/mlir/cmake/modules/AddMLIR.cmake b/mlir/cmake/modules/AddMLIR.cmake
+index 6589458ab789..9bff1af30631 100644
+--- a/mlir/cmake/modules/AddMLIR.cmake
+++ b/mlir/cmake/modules/AddMLIR.cmake
+@@ -638,13 +638,13 @@ function(add_mlir_library_install name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${export_to_mlirtargets}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+       RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}"
+       # Note that CMake will create a directory like:
+       #   objects-${CMAKE_BUILD_TYPE}/obj.LibName
+       # and put object files there.
+-      OBJECTS DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+      OBJECTS DESTINATION ${CMAKE_INSTALL_LIBDIR}
+     )
+ 
+     if (NOT LLVM_ENABLE_IDE)
+diff --git a/mlir/cmake/modules/AddMLIRPython.cmake b/mlir/cmake/modules/AddMLIRPython.cmake
+index fa6aec8a603a..4e1b61ff12fe 100644
+--- a/mlir/cmake/modules/AddMLIRPython.cmake
+++ b/mlir/cmake/modules/AddMLIRPython.cmake
+@@ -567,7 +567,7 @@ function(mlir_python_setup_extension_rpath target)
+     set_property(TARGET ${target} APPEND PROPERTY
+       BUILD_RPATH "${_real_lib_dir}")
+     set_property(TARGET ${target} APPEND PROPERTY
+-      INSTALL_RPATH "${_origin_prefix}/${ARG_RELATIVE_INSTALL_ROOT}/lib${LLVM_LIBDIR_SUFFIX}")
+      INSTALL_RPATH "${CMAKE_INSTALL_FULL_LIBDIR}")
+   endif()
+ endfunction()
+ 
+diff --git a/offload/liboffload/CMakeLists.txt b/offload/liboffload/CMakeLists.txt
+index 62480dad1cac..d6f0a0282c47 100644
+--- a/offload/liboffload/CMakeLists.txt
+++ b/offload/liboffload/CMakeLists.txt
+@@ -45,5 +45,5 @@ set_target_properties(LLVMOffload PROPERTIES
+                       BUILD_RPATH "$ORIGIN:${CMAKE_CURRENT_BINARY_DIR}/..")
+ install(TARGETS LLVMOffload LIBRARY COMPONENT LLVMOffload DESTINATION "${OFFLOAD_INSTALL_LIBDIR}")
+ 
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload)
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload)
+diff --git a/openmp/libompd/gdb-plugin/CMakeLists.txt b/openmp/libompd/gdb-plugin/CMakeLists.txt
+index 20cb4680e4cb..66a77274f9c8 100644
+--- a/openmp/libompd/gdb-plugin/CMakeLists.txt
+++ b/openmp/libompd/gdb-plugin/CMakeLists.txt
+@@ -36,5 +36,5 @@ target_link_libraries (ompdModule ${CMAKE_DL_LIBS})
+ set_target_properties (ompdModule PROPERTIES PREFIX "")
+ set_target_properties (ompdModule PROPERTIES LIBRARY_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd/")
+ 
+-install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION share/gdb/python/ PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
+install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/gdb/python/ PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
+ 
+diff --git a/polly/cmake/polly_macros.cmake b/polly/cmake/polly_macros.cmake
+index 9bd7b0b0ea59..1232f5f0d748 100644
+--- a/polly/cmake/polly_macros.cmake
+++ b/polly/cmake/polly_macros.cmake
+@@ -46,8 +46,8 @@ macro(add_polly_library name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${exports}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+     add_llvm_install_targets(install-${name}
+       COMPONENT ${name})
+   endif()
+diff --git a/sycl/CMakeLists.txt b/sycl/CMakeLists.txt
+index cb2220e9fbc1..eec767d4f874 100644
+--- a/sycl/CMakeLists.txt
+++ b/sycl/CMakeLists.txt
+@@ -362,13 +362,13 @@ if (NOT WIN32)
+   install(FILES
+     "${CMAKE_CURRENT_SOURCE_DIR}/gdb/libsycl.so-gdb.py"
+     RENAME "libsycl.so.${SYCL_VERSION_STRING}-gdb.py"
+-    DESTINATION "lib${LLVM_LIBDIR_SUFFIX}/"
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/
+     COMPONENT sycl-headers-extras)
+   if (SYCL_ENABLE_MAJOR_RELEASE_PREVIEW_LIB)
+     install(FILES
+       "${CMAKE_CURRENT_SOURCE_DIR}/gdb/libsycl.so-gdb.py"
+       RENAME "libsycl-preview.so.${SYCL_VERSION_STRING}-gdb.py"
+-      DESTINATION "lib${LLVM_LIBDIR_SUFFIX}/"
+      DESTINATION ${CMAKE_INSTALL_LIBDIR}/
+       COMPONENT sycl-headers-extras)
+   endif()
+ endif()
+diff --git a/sycl/cmake/modules/BuildUnifiedRuntime.cmake b/sycl/cmake/modules/BuildUnifiedRuntime.cmake
+index 73e52e59f2be..aa0eac5c1dee 100644
+--- a/sycl/cmake/modules/BuildUnifiedRuntime.cmake
+++ b/sycl/cmake/modules/BuildUnifiedRuntime.cmake
+@@ -108,9 +108,9 @@ find_package(Threads REQUIRED)
+ if(TARGET UnifiedRuntimeLoader)
+   # Install the UR loader.
+   install(TARGETS ur_loader
+-    LIBRARY DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT unified-runtime-loader
+-    ARCHIVE DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT unified-runtime-loader
+-    RUNTIME DESTINATION "bin" COMPONENT unified-runtime-loader
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-runtime-loader
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-runtime-loader
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader
+   )
+ endif()
+ 
+@@ -120,8 +120,8 @@ function(add_sycl_ur_adapter NAME)
+   add_dependencies(UnifiedRuntimeAdapters ur_adapter_${NAME})
+ 
+   install(TARGETS ur_adapter_${NAME}
+-    LIBRARY DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT ur_adapter_${NAME}
+-    RUNTIME DESTINATION "bin" COMPONENT ur_adapter_${NAME})
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT ur_adapter_${NAME}
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_adapter_${NAME})
+ 
+   set(manifest_file
+     ${CMAKE_CURRENT_BINARY_DIR}/install_manifest_ur_adapter_${NAME}.txt)
+@@ -274,24 +274,24 @@ if(CMAKE_SYSTEM_NAME STREQUAL Windows)
+   # Add the debug UR runtime libraries to the parent install.
+   install(
+     FILES ${URD_INSTALL_DIR}/bin/ur_loaderd.dll
+-    DESTINATION "bin" COMPONENT unified-runtime-loader)
+    DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader)
+   foreach(adapter ${SYCL_ENABLE_BACKENDS})
+     install(
+       FILES ${URD_INSTALL_DIR}/bin/ur_adapter_${adapter}d.dll
+-      DESTINATION "bin" COMPONENT ur_adapter_${adapter})
+      DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_adapter_${adapter})
+     add_dependencies(install-sycl-ur-adapter-${adapter} unified-runtimed)
+   endforeach()
+   if(UMF_BUILD_SHARED_LIBRARY)
+     # Also install umfd.dll
+     install(
+       FILES ${URD_INSTALL_DIR}/bin/umfd.dll
+-      DESTINATION "bin" COMPONENT unified-memory-framework)
+      DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-memory-framework)
+   endif()
+ endif()
+ 
+ if(TARGET umf)
+   install(TARGETS umf
+-    LIBRARY DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT unified-memory-framework
+-    ARCHIVE DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT unified-memory-framework
+-    RUNTIME DESTINATION "bin" COMPONENT unified-memory-framework)
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-memory-framework
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-memory-framework
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-memory-framework)
+ endif()
+diff --git a/sycl/cmake/modules/SYCLUtils.cmake b/sycl/cmake/modules/SYCLUtils.cmake
+index f469b2604760..a8728bdfb5b1 100644
+--- a/sycl/cmake/modules/SYCLUtils.cmake
+++ b/sycl/cmake/modules/SYCLUtils.cmake
+@@ -13,7 +13,7 @@ macro(add_stripped_pdb ARG_TARGET_NAME)
+     target_link_options(${ARG_TARGET_NAME}
+                         PRIVATE "LINKER:/PDBSTRIPPED:${ARG_TARGET_NAME}.stripped.pdb")
+     install(FILES "${CMAKE_CURRENT_BINARY_DIR}/${ARG_TARGET_NAME}.stripped.pdb"
+-            DESTINATION ${CMAKE_INSTALL_PREFIX}/bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             RENAME "${ARG_TARGET_NAME}.pdb"
+             COMPONENT ${ARG_TARGET_NAME}
+             OPTIONAL)
+diff --git a/sycl/source/CMakeLists.txt b/sycl/source/CMakeLists.txt
+index be262a28d809..36da90e63179 100644
+--- a/sycl/source/CMakeLists.txt
+++ b/sycl/source/CMakeLists.txt
+@@ -191,7 +191,7 @@ function(add_sycl_rt_library LIB_NAME LIB_OBJ_NAME)
+         COMMENT "Creating version-agnostic copy of the import library.")
+       install(
+         FILES ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${ARG_IMPLIB_NAME}.lib
+-        DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT sycl)
+        DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT sycl)
+     endif()
+   endif()
+ 
+@@ -430,6 +430,6 @@ if (WIN32)
+ endif()
+ 
+ install(TARGETS ${SYCL_RT_LIBS}
+-  ARCHIVE DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT sycl
+-  LIBRARY DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT sycl
+-  RUNTIME DESTINATION "bin" COMPONENT sycl)
+  ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT sycl
+  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT sycl
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT sycl)
+diff --git a/sycl/test/CMakeLists.txt b/sycl/test/CMakeLists.txt
+index 4e7607e74931..d400c6b11d89 100644
+--- a/sycl/test/CMakeLists.txt
+++ b/sycl/test/CMakeLists.txt
+@@ -8,7 +8,7 @@ set(LLVM_BUILD_BINARY_DIRS "${LLVM_BINARY_DIR}/bin/")
+ set(LLVM_BUILD_LIBRARY_DIRS "${LLVM_BINARY_DIR}/lib/")
+ 
+ set(RT_TEST_ARGS ${RT_TEST_ARGS} "-v")
+-set(DEPLOY_RT_TEST_ARGS ${DEPLOY_RT_TEST_ARGS} "-v -D SYCL_TOOLS_DIR=${CMAKE_INSTALL_PREFIX}/bin -D SYCL_LIBS_DIR=${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX} -D SYCL_INCLUDE=${CMAKE_INSTALL_PREFIX}/${SYCL_INCLUDE_DIR}")
+set(DEPLOY_RT_TEST_ARGS ${DEPLOY_RT_TEST_ARGS} "-v -D SYCL_TOOLS_DIR=${CMAKE_INSTALL_FULL_BINDIR} -D SYCL_LIBS_DIR=${CMAKE_INSTALL_FULL_LIBDIR} -D SYCL_INCLUDE=${CMAKE_INSTALL_PREFIX}/${SYCL_INCLUDE_DIR}")
+ 
+ find_package(Threads REQUIRED)
+ set(SYCL_THREADS_LIB ${CMAKE_THREAD_LIBS_INIT})
+diff --git a/sycl/tools/sycl-ls/CMakeLists.txt b/sycl/tools/sycl-ls/CMakeLists.txt
+index a1cb33c6553b..7d93fbb79144 100644
+--- a/sycl/tools/sycl-ls/CMakeLists.txt
+++ b/sycl/tools/sycl-ls/CMakeLists.txt
+@@ -26,4 +26,4 @@ if (WIN32)
+   target_link_options(sycl-ls PRIVATE LINKER:/DEPENDENTLOADFLAG:0x900)
+ endif()
+ install(TARGETS sycl-ls
+-  RUNTIME DESTINATION "bin" COMPONENT sycl-ls)
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT sycl-ls)
+diff --git a/sycl/tools/syclbin-dump/CMakeLists.txt b/sycl/tools/syclbin-dump/CMakeLists.txt
+index d1eb71823f64..9bf370bdcbe4 100644
+--- a/sycl/tools/syclbin-dump/CMakeLists.txt
+++ b/sycl/tools/syclbin-dump/CMakeLists.txt
+@@ -22,4 +22,4 @@ endif()
+ add_dependencies(sycl-toolchain syclbin-dump)
+ 
+ install(TARGETS syclbin-dump
+-  RUNTIME DESTINATION "bin" COMPONENT syclbin-dump)
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT syclbin-dump)
+diff --git a/sycl/ur_win_proxy_loader/CMakeLists.txt b/sycl/ur_win_proxy_loader/CMakeLists.txt
+index 940fcd28299e..eac609967521 100644
+--- a/sycl/ur_win_proxy_loader/CMakeLists.txt
+++ b/sycl/ur_win_proxy_loader/CMakeLists.txt
+@@ -14,7 +14,7 @@ configure_file(../../llvm/resources/windows_version_resource.rc ${CMAKE_CURRENT_
+ add_library(ur_win_proxy_loader SHARED  ur_win_proxy_loader.cpp  ${CMAKE_CURRENT_BINARY_DIR}/versioninfo.rc)
+ add_dependencies(ur_win_proxy_loader UnifiedRuntimeLoader)
+ install(TARGETS ur_win_proxy_loader
+-  RUNTIME DESTINATION "bin" COMPONENT ur_win_proxy_loader
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_win_proxy_loader
+ )
+ 
+ if (MSVC)
+@@ -65,5 +65,5 @@ if (MSVC)
+   target_link_options(ur_win_proxy_loaderd PRIVATE LINKER:/DEPENDENTLOADFLAG:0x2000)
+   target_link_options(ur_win_proxy_loader PRIVATE LINKER:/DEPENDENTLOADFLAG:0x2000)
+   install(TARGETS ur_win_proxy_loaderd
+-    RUNTIME DESTINATION "bin" COMPONENT ur_win_proxy_loader)
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_win_proxy_loader)
+ endif()
+diff --git a/unified-runtime/CMakeLists.txt b/unified-runtime/CMakeLists.txt
+index 9115f52617c4..d23fd880ab99 100644
+--- a/unified-runtime/CMakeLists.txt
+++ b/unified-runtime/CMakeLists.txt
+@@ -361,7 +361,7 @@ target_include_directories(ur_headers INTERFACE
+ # Add the include directory and the headers target to the install.
+ install(
+     DIRECTORY "${PROJECT_SOURCE_DIR}/include/"
+-    DESTINATION include COMPONENT ur_headers)
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} COMPONENT ur_headers)
+ install(
+     TARGETS ur_headers
+     EXPORT ${PROJECT_NAME}-targets)
+@@ -384,7 +384,7 @@ install(
+     EXPORT ${PROJECT_NAME}-targets
+     FILE ${PROJECT_NAME}-targets.cmake
+     NAMESPACE ${PROJECT_NAME}::
+-    DESTINATION lib/cmake/${PROJECT_NAME})
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+ 
+ # Configure the package versions file for use in find_package when installed.
+ write_basic_package_version_file(
+@@ -395,14 +395,14 @@ write_basic_package_version_file(
+ configure_package_config_file(
+     ${PROJECT_SOURCE_DIR}/cmake/${PROJECT_NAME}-config.cmake.in
+     ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config.cmake
+-    INSTALL_DESTINATION lib/cmake/${PROJECT_NAME})
+    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+ 
+ # Add the package files to the install.
+ install(
+     FILES
+         ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config.cmake
+         ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config-version.cmake
+-    DESTINATION lib/cmake/${PROJECT_NAME})
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+ 
+ set(API_JSON_FILE ${PROJECT_BINARY_DIR}/unified_runtime.json)
+ 
+diff --git a/unified-runtime/source/loader/libur_loader.pc.in b/unified-runtime/source/loader/libur_loader.pc.in
+index d79c3a9da8bd..6aac2abcd9ea 100644
+--- a/unified-runtime/source/loader/libur_loader.pc.in
+++ b/unified-runtime/source/loader/libur_loader.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/include
+-libdir=${prefix}/lib
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ 
+ Name: Unified Runtime Loader
+diff --git a/xpti/src/CMakeLists.txt b/xpti/src/CMakeLists.txt
+index 1d7e371e98a1..8d3e1a8b4ec3 100644
+--- a/xpti/src/CMakeLists.txt
+++ b/xpti/src/CMakeLists.txt
+@@ -11,9 +11,9 @@ macro(add_xpti_lib target_name)
+ 
+   # Set the location of the library installation
+   install(TARGETS ${target_name}
+-    RUNTIME DESTINATION bin COMPONENT xpti
+-    LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT xpti
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT xpti
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT xpti
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT xpti
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT xpti
+   )
+ endmacro()
+ 
+diff --git a/xptifw/CMakeLists.txt b/xptifw/CMakeLists.txt
+index 00a9c71ba289..dd590e688b8f 100644
+--- a/xptifw/CMakeLists.txt
+++ b/xptifw/CMakeLists.txt
+@@ -13,9 +13,9 @@ set(SAMPLES_DIR ${CMAKE_CURRENT_LIST_DIR}/samples)
+ if (NOT DEFINED XPTI_DIR) # don't overwrite if already set
+   if (NOT DEFINED XPTI_SOURCE_DIR)
+     # If XPTI_SOURCE_DIR is not provided then assume that xpti is in-tree and not external.
+-    set(XPTI_DIR ${CMAKE_CURRENT_LIST_DIR}/../xpti)
+    get_filename_component(XPTI_DIR ${CMAKE_CURRENT_LIST_DIR}/../xpti ABSOLUTE)
+   else()
+-    set(XPTI_DIR ${XPTI_SOURCE_DIR}/../xpti)
+    get_filename_component(XPTI_DIR ${XPTI_SOURCE_DIR}/../xpti ABSOLUTE)
+   endif()
+ endif()
+ 
+diff --git a/xptifw/src/CMakeLists.txt b/xptifw/src/CMakeLists.txt
+index 1026bc505f4e..5816b3a75cf5 100644
+--- a/xptifw/src/CMakeLists.txt
+++ b/xptifw/src/CMakeLists.txt
+@@ -81,9 +81,9 @@ function(add_xpti_library LIB_NAME)
+   # Set the location of the library installation
+   include(GNUInstallDirs)
+   install(TARGETS ${LIB_NAME}
+-    RUNTIME DESTINATION bin COMPONENT xptifw
+-    LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT xptifw
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT xptifw
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT xptifw
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT xptifw
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT xptifw
+   )
+ endfunction(add_xpti_library)
+ 
@@ -0,0 +1,144 @@
+{
+  callPackage,
+  newScope,
+  wrapCCWith,
+  symlinkJoin,
+  overrideCC,
+  lib,
+  fetchFromGitHub,
+}:
+let
+  # This derivation uses makeScope to help with overriding.
+  #
+  # To override the source and other basics:
+  #  pkgs.intel-llvm.overrideScope (final: prev: {
+  #    version = ..;
+  #    src = ..;
+  #    # If setting src, you'll probably also want to set this.
+  #    commitDate = ..;
+  #  })
+  #
+  # To override something inside unified-runtime:
+  #  pkgs.intel-llvm.overrideScope (final: prev: {
+  #    make-unified-runtime = args: (prev.make-unified-runtime args)
+  #      .override { .. }
+  #      .overrideAttrs { .. }
+  #  })
+  scope = lib.makeScope newScope (self: {
+    # == Parameters for overriding ==
+
+    llvmMajorVersion = "22";
+
+    version = "unstable-2025-11-14";
+
+    src = fetchFromGitHub {
+      owner = "intel";
+      repo = "llvm";
+      # Latest commit which doesn't require dependency versions newer than
+      # what's available in nixpkgs as of 2026-01-13.
+      # Commits after require newer level-zero and pre-release unified memory framework.
+      rev = "ab3dc98de0fd1ada9df12b138de1e1f8b715cc27";
+      hash = "sha256-oHk8kQVNsyC9vrOsDqVoFLYl2yMMaTgpQnAW9iHZLfE=";
+    };
+
+    # If you override src, you'll probably also want to override this,
+    # as some packages check for this date to decide what features the compiler supports
+    commitDate = "20251114";
+
+    vc-intrinsics-src = fetchFromGitHub {
+      owner = "intel";
+      repo = "vc-intrinsics";
+      # See llvm/lib/SYCLLowerIR/CMakeLists.txt:17
+      rev = "60cea7590bd022d95f5cf336ee765033bd114d69";
+      sha256 = "sha256-1K16UEa6DHoP2ukSx58OXJdtDWyUyHkq5Gd2DUj1644=";
+    };
+
+    # ===============================
+
+    make-unified-runtime =
+      {
+        levelZeroSupport,
+        cudaSupport,
+        rocmSupport,
+        rocmGpuTargets,
+        nativeCpuSupport,
+      }:
+      callPackage ./unified-runtime.nix {
+        intel-llvm-src = self.src;
+        inherit
+          levelZeroSupport
+          cudaSupport
+          rocmSupport
+          rocmGpuTargets
+          nativeCpuSupport
+          ;
+        # This could theoretically be disabled if you for some reason
+        # didn't want to build the backend, however OpenCL will get
+        # pulled in as a dependency either way so there is little point.
+        openclSupport = true;
+      };
+
+    unwrapped = callPackage ./unwrapped.nix {
+      inherit (self)
+        llvmMajorVersion
+        src
+        version
+        commitDate
+        vc-intrinsics-src
+        make-unified-runtime
+        ;
+    };
+
+    wrapper =
+      (wrapCCWith {
+        cc = self.unwrapped;
+        # This is needed for tools like clang-scan-deps to find headers.
+        # The build commands here are the same as the vanilla LLVM derivation.
+        extraBuildCommands = ''
+          rsrc="$out/resource-root"
+          mkdir "$rsrc"
+          echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+          ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
+        '';
+      }).overrideAttrs
+        (old: {
+          # OpenCL needs to be passed through
+          propagatedBuildInputs = old.propagatedBuildInputs ++ self.unwrapped.propagatedBuildInputs;
+        });
+
+    clang-tools-wrapper = callPackage ./clang-tools.nix {
+      inherit (self) unwrapped wrapper;
+    };
+
+    # We merge everything into one by default to avoid issues with path-lookup.
+    # intel-llvm provides the SYCL library, so unlike regular LLVM libraries,
+    # its libraries are equally important as the compiler itself.
+    # Splitting is nonetheless important, as otherwise the binaries go over the Hydra limit.
+    merged = symlinkJoin {
+      inherit (self.unwrapped) pname version meta;
+
+      strictDeps = true;
+      __structuredAttrs = true;
+
+      paths = with self; [
+        # Order is important, we want files from the wrappers to take precedence
+        wrapper
+        clang-tools-wrapper
+
+        unwrapped.out
+        unwrapped.dev
+        unwrapped.lib
+      ];
+
+      passthru = self.unwrapped.passthru // {
+        inherit (self) stdenv;
+        unwrapped = self.unwrapped;
+        tests = callPackage ./tests.nix { inherit (self) stdenv; };
+
+        overrideScope = newF: (self.overrideScope newF).merged;
+      };
+    };
+    stdenv = overrideCC self.unwrapped.baseLlvm.stdenv self.merged;
+  });
+in
+scope.merged
@@ -0,0 +1,17 @@
+diff --git a/sycl-jit/jit-compiler/utils/generate.py b/sycl-jit/jit-compiler/utils/generate.py
+index 449723b8fa26..ecba44efe071 100644
+--- a/sycl-jit/jit-compiler/utils/generate.py
+++ b/sycl-jit/jit-compiler/utils/generate.py
+@@ -49,6 +49,12 @@ const resource_file ToolchainFiles[] = {"""
+         def process_dir(dir):
+             for root, _, files in os.walk(dir):
+                 for file in files:
+                    # Skip CMake files, because they contain absolute install paths, causing cyclic dependencies.
+                    # They aren't ever used as it seems, so excluding them won't break anything.
+                    if file in ['CMakeLists.txt', 'cmake_install.cmake'] or file.endswith('.cmake'):
+                        print(f"[nix-compat patch] Skipping embedding of sycl-jit CMake file: {os.path.join(root, file)}")
+                        continue
+
+                     file_path = os.path.join(root, file)
+                     process_file(file_path)
+ 
@@ -0,0 +1,39 @@
+{
+  stdenv,
+  writeTextFile,
+}:
+{
+  sycl-compile = stdenv.mkDerivation {
+    name = "intel-llvm-test-sycl-compile";
+
+    src = writeTextFile {
+      name = "test.cpp";
+      text = ''
+        #include <sycl/sycl.hpp>
+        #include <iostream>
+
+        int main() {
+          sycl::queue q;
+          std::cout << "SYCL queue created successfully" << std::endl;
+          return 0;
+        }
+      '';
+    };
+
+    dontUnpack = true;
+
+    buildPhase = ''
+      echo "Checking if a basic SYCL program can compile..."
+      clang++ -fsycl $src -o test
+    '';
+
+    installPhase = ''
+      mkdir -p $out/bin
+      cp test $out/bin/sycl-test
+    '';
+
+    meta = {
+      description = "Test that intel-llvm can compile a basic SYCL program";
+    };
+  };
+}
@@ -0,0 +1,185 @@
+{
+  stdenv,
+  lib,
+  cmake,
+  ninja,
+  unified-memory-framework,
+  zlib,
+  libbacktrace,
+  hwloc,
+  python3,
+  symlinkJoin,
+  level-zero,
+  intel-compute-runtime,
+  opencl-headers,
+  ocl-icd,
+  hdrhistogram_c,
+  gtest,
+  pkg-config,
+  lit,
+  filecheck,
+  rocmPackages ? { },
+  rocmGpuTargets ? lib.optionalString (rocmPackages ? clr.gpuTargets) (
+    builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets
+  ),
+  cudaPackages ? { },
+  intel-llvm-src,
+  levelZeroSupport,
+  openclSupport,
+  cudaSupport,
+  rocmSupport,
+  nativeCpuSupport,
+}:
+let
+  rocmtoolkit_joined = symlinkJoin {
+    name = "rocm-merged";
+
+    paths = with rocmPackages; [
+      clr
+      rocm-comgr
+      hsakmt
+    ];
+  };
+
+  cudatoolkit_joined = symlinkJoin {
+    name = "cuda-merged";
+
+    paths = with cudaPackages; [
+      cuda_cudart
+      cuda_nvcc
+      cuda_nvml_dev.include
+      cuda_nvml_dev.stubs
+      cuda_cupti.include
+      cuda_cupti.lib
+    ];
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  name = "unified-runtime";
+  version = "0.12.0";
+
+  src = intel-llvm-src;
+  sourceRoot = "source/unified-runtime";
+
+  doCheck = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    python3
+    pkg-config
+  ];
+
+  buildInputs = [
+    (unified-memory-framework.override { useJemalloc = false; })
+    zlib
+    libbacktrace
+    hwloc
+    hdrhistogram_c
+  ]
+  ++ lib.optionals openclSupport [
+    opencl-headers
+    ocl-icd
+  ]
+  ++ lib.optionals rocmSupport [
+    rocmtoolkit_joined
+  ]
+  ++ lib.optionals cudaSupport [
+    cudatoolkit_joined
+  ]
+  ++ lib.optionals levelZeroSupport [
+    level-zero
+    intel-compute-runtime
+  ];
+
+  nativeCheckInputs = [
+    gtest
+    lit
+    filecheck
+  ];
+
+  postPatch = ''
+    # `NO_CMAKE_PACKAGE_REGISTRY` prevents it from finding OpenCL, so we unset it
+    # Note that this cmake file is imported in various places, not just unified-runtime
+    # See also: https://github.com/intel/llvm/issues/19635#issuecomment-3247008981
+    substituteInPlace cmake/FetchOpenCL.cmake \
+        --replace-fail "NO_CMAKE_PACKAGE_REGISTRY" ""
+  ''
+  + lib.optionalString finalAttrs.doCheck ''
+    # These tests don't run without setting UR_DPCXX,
+    # however they aren't properly excluded, causing lit to fail.
+    rm test/adapters/hip/lit.cfg.py
+    rm test/adapters/cuda/lit.cfg.py
+
+    # Exclude tests that don't play well with the sandbox
+    cat >> test/lit.cfg.py <<'EOF'
+    # Conformance tests need to have an adapter to run on.
+    # Within the sandbox, the only possible option is the CPU adapter.
+    # If we don't have that, much of the conformance suite will fail, so we exclude it entirely.
+    ${lib.optionalString (!nativeCpuSupport) "config.excludes.add('conformance')"}
+
+    config.excludes.add('asan.cpp')
+    config.excludes.add('loader_lifetime.test')
+    EOF
+  '';
+
+  preCheck = lib.optionalString levelZeroSupport ''
+    export LD_LIBRARY_PATH="${intel-compute-runtime.drivers}/lib''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+    (lib.cmakeBool "FETCHCONTENT_QUIET" false)
+
+    (lib.cmakeBool "UR_ENABLE_LATENCY_HISTOGRAM" true)
+
+    (lib.cmakeBool "UR_BUILD_TESTS" finalAttrs.doCheck)
+    # The test hello_world.test depends on the hello_world example, so build examples when testing
+    (lib.cmakeBool "UR_BUILD_EXAMPLES" finalAttrs.doCheck)
+
+    (lib.cmakeBool "UR_BUILD_ADAPTER_L0" levelZeroSupport)
+    (lib.cmakeBool "UR_BUILD_ADAPTER_L0_V2" levelZeroSupport)
+    (lib.cmakeBool "UR_BUILD_ADAPTER_OPENCL" openclSupport)
+    (lib.cmakeBool "UR_BUILD_ADAPTER_CUDA" cudaSupport)
+    (lib.cmakeBool "UR_BUILD_ADAPTER_HIP" rocmSupport)
+    (lib.cmakeBool "UR_BUILD_ADAPTER_NATIVE_CPU" nativeCpuSupport)
+
+    # In the sandbox we only have native_cpu available,
+    # so we won't be able to test on any other backend.
+    (lib.cmakeFeature "UR_CONFORMANCE_SELECTOR" "native_cpu:*")
+  ]
+  ++ lib.optionals rocmSupport [
+    (lib.cmakeFeature "UR_HIP_ROCM_DIR" "${rocmtoolkit_joined}")
+    (lib.cmakeFeature "GPU_TARGETS" rocmGpuTargets)
+  ]
+  ++ lib.optionals cudaSupport [
+    (lib.cmakeFeature "CUDAToolkit_ROOT" "${cudatoolkit_joined}")
+    (lib.cmakeFeature "CUDAToolkit_CUPTI_INCLUDE_DIR" "${cudatoolkit_joined}/include")
+    (lib.cmakeFeature "CUDA_cupti_LIBRARY" "${cudatoolkit_joined}/lib/libcupti.so")
+  ];
+
+  passthru.backends =
+    lib.optionals levelZeroSupport [
+      "level_zero"
+      "level_zero_v2"
+    ]
+    ++ lib.optional cudaSupport "cuda"
+    ++ lib.optional rocmSupport "hip"
+    ++ lib.optional nativeCpuSupport "native_cpu"
+    ++ lib.optional openclSupport "opencl";
+
+  meta = {
+    description = "Intel LLVM-based compiler with SYCL support";
+    longDescription = ''
+      Intel's LLVM-based compiler toolchain with Data Parallel C++ (DPC++)
+      and SYCL support for heterogeneous computing across CPUs, GPUs, and FPGAs.
+    '';
+    homepage = "https://github.com/intel/llvm";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ blenderfreaky ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
@@ -0,0 +1,323 @@
+{
+  # Parameters for overriding
+  src,
+  version,
+  commitDate,
+  llvmMajorVersion,
+  vc-intrinsics-src,
+  make-unified-runtime,
+  # Regular dependencies
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  python3,
+  pkg-config,
+  zstd,
+  hwloc,
+  emhash,
+  level-zero,
+  opencl-headers,
+  libxml2,
+  libedit,
+  llvmPackages_22,
+  parallel-hashmap,
+  spirv-headers,
+  spirv-tools,
+  zlib,
+  wrapCC,
+  graphviz-nox,
+  rocmPackages ? { },
+  rocmGpuTargets ? lib.optionalString (rocmPackages ? clr.gpuTargets) (
+    builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets
+  ),
+  config,
+  cudaSupport ? config.cudaSupport,
+  rocmSupport ? config.rocmSupport,
+  # TODO: Should there be a flag like config.levelZeroSupport?
+  # NOTE: Level Zero does not always fail gracefully, so when not explicitly set by the user,
+  #       and other acceleration is already selected, disable it by default.
+  levelZeroSupport ? !(cudaSupport || rocmSupport),
+  nativeCpuSupport ? true,
+  enableManpages ? true,
+}:
+let
+  # See the postPatch phase for details on why this is used
+  ccWrapperStub = wrapCC (
+    stdenv.mkDerivation {
+      name = "ccWrapperStub";
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/bin
+        cat > $out/bin/clang-${llvmMajorVersion} <<'EOF'
+        #!/bin/sh
+        exec "$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}" "$@"
+        EOF
+        chmod +x $out/bin/clang-${llvmMajorVersion}
+        cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang
+        cp $out/bin/clang-${llvmMajorVersion} $out/bin/clang++
+      '';
+      passthru.isClang = true;
+    }
+  );
+
+  # We use the in-tree unified-runtime, but we need all the same flags as the out-of-tree version.
+  # Rather than duplicating the flags, we import them from unified-runtime.nix.
+  #
+  # This also lets us quickly test unified-runtime in isolation for debugging backend issues.
+  # If the build LLVM fails due to issues with finding level-zero/ROCm/etc.,
+  # it's a lot quicker to just rebuild unified-runtime instead of all of LLVM.
+  #
+  # As unified-runtime is the interface between LLVM and the backends,
+  # that is where most failures relating to backends should happen in.
+  unified-runtime = make-unified-runtime {
+    inherit
+      levelZeroSupport
+      cudaSupport
+      rocmSupport
+      rocmGpuTargets
+      nativeCpuSupport
+      ;
+  };
+in
+# Tip: This build plays nice with ccacheStdenv.
+#      Replace stdenv here to make debugging less tedious.
+stdenv.mkDerivation (finalAttrs: {
+  pname = "intel-llvm";
+
+  inherit src version commitDate;
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+    "python"
+    # Not adding (conditionally) a "man" output here to avoid complexity in the
+    # wrapper, that is not worth it for a few kb.
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    python3
+    llvmPackages_22.bintools # For lld
+    pkg-config
+    zlib
+  ]
+  ++ lib.optionals enableManpages [
+    python3.pkgs.sphinx
+    python3.pkgs.myst-parser
+    graphviz-nox
+  ];
+
+  buildInputs = [
+    spirv-tools
+    libxml2
+    hwloc
+    emhash
+    parallel-hashmap
+    # Static ZSTD is required by sycl, see sycl/source/CMakeLists.txt:163
+    # Intels CMake/build system also enabled `LLVM_USE_STATIC_ZSTD` by default,
+    # so at no point does it link to a non-static ZSTD library.
+    # This may be related to the fork not supporting building shared libraries;
+    #  https://github.com/intel/llvm/issues/19060
+    (zstd.override { static = true; })
+  ]
+  ++ unified-runtime.buildInputs;
+
+  propagatedBuildInputs = [
+    zlib
+    libedit
+    opencl-headers
+  ];
+
+  cmakeBuildType = "Release";
+
+  patches = [
+    # Fix paths so the output can be split properly
+    ./gnu-install-dirs.patch
+    # sycl-jit bundles several files, among which are CMake files.
+    # The CMake files are bundled, yet not actually used.
+    # As the CMake files in question contain absolute install paths,
+    # they cause cycles in the outputs and break the build,
+    # so we simply exclude them.
+    ./sycl-jit-exclude-cmake-files.patch
+  ];
+
+  postPatch = ''
+    # Parts of libdevice are built using the freshly-built compiler.
+    # As it tries to link to system libraries, we need to wrap it with the
+    # usual nix cc-wrapper.
+    # Since the compiler to be wrapped is not available at this point,
+    # we use a stub that points to where it will be later on
+    # in `$NIX_BUILD_TOP/source/build/bin/clang-${llvmMajorVersion}`
+    substituteInPlace libdevice/cmake/modules/SYCLLibdevice.cmake \
+      --replace-fail "\''${clang_exe}" "${ccWrapperStub}/bin/clang++"
+
+    # When running without this, their CMake code copies files from the Nix store.
+    # As the Nix store is read-only and COPY copies permissions by default,
+    # this will lead to the copied files also being read-only.
+    # As CMake at a later point wants to write into copied folders, this causes
+    # the build to fail with a (rather cryptic) permission error.
+    # By setting NO_SOURCE_PERMISSIONS we side-step this issue.
+    # Note in case of future build failures: if there are executables in any of the copied folders,
+    # we may need to add special handling to set the executable permissions.
+    # See also: https://github.com/intel/llvm/issues/19635#issuecomment-3134830708
+    sed -i '/file(COPY / { /NO_SOURCE_PERMISSIONS/! s/)\s*$/ NO_SOURCE_PERMISSIONS)/ }' \
+      unified-runtime/cmake/FetchLevelZero.cmake \
+      sycl/CMakeLists.txt \
+      sycl/cmake/modules/FetchEmhash.cmake
+
+    # `NO_CMAKE_PACKAGE_REGISTRY` prevents it from finding OpenCL, so we unset it
+    # Note that this cmake file is imported in various places, not just unified-runtime
+    # See also: https://github.com/intel/llvm/issues/19635#issuecomment-3247008981
+    substituteInPlace unified-runtime/cmake/FetchOpenCL.cmake \
+        --replace-fail "NO_CMAKE_PACKAGE_REGISTRY" ""
+  '';
+
+  preConfigure = ''
+    flags=$(python buildbot/configure.py \
+        --print-cmake-flags \
+        -t Release \
+        --docs \
+        --cmake-gen Ninja \
+        ${lib.optionalString cudaSupport "--cuda"} \
+        ${lib.optionalString rocmSupport "--hip"} \
+        ${lib.optionalString nativeCpuSupport "--native_cpu"} \
+        --use-lld \
+        ${lib.optionalString levelZeroSupport "--l0-headers ${lib.getInclude level-zero}/include/level_zero"} \
+        ${lib.optionalString levelZeroSupport "--l0-loader ${lib.getLib level-zero}/lib/libze_loader.so"} \
+    )
+
+    # We eval because flags is separated as shell-escaped strings.
+    # We can't just split by space because it may contain escaped spaces,
+    # so we just let bash handle it.
+    # NOTE: We prepend, so that flags we set manually override what the build script does.
+    eval "prependToVar cmakeFlags $flags"
+
+    # Remove the install prefix flag
+    cmakeFlags=(''${cmakeFlags[@]/-DCMAKE_INSTALL_PREFIX=$NIX_BUILD_TOP\/source\/build\/install})
+  '';
+
+  cmakeDir = "llvm";
+
+  cmakeFlags = [
+    (lib.cmakeBool "LLVM_INSTALL_UTILS" true)
+
+    (lib.cmakeBool "LLVM_BUILD_TESTS" false)
+    (lib.cmakeBool "LLVM_INCLUDE_TESTS" false)
+    (lib.cmakeBool "MLIR_INCLUDE_TESTS" false)
+    (lib.cmakeBool "SYCL_INCLUDE_TESTS" false)
+
+    (lib.cmakeFeature "LLVM_ENABLE_ZSTD" "FORCE_ON")
+    (lib.cmakeFeature "LLVM_ENABLE_ZLIB" "FORCE_ON")
+    (lib.cmakeBool "LLVM_ENABLE_THREADS" true)
+
+    # Intels LLVM fork does not support building shared libraries,
+    # see https://github.com/intel/llvm/issues/19060
+    (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+    (lib.cmakeBool "LLVM_LINK_LLVM_DYLIB" false)
+    (lib.cmakeBool "LLVM_BUILD_LLVM_DYLIB" false)
+
+    # See https://github.com/intel/llvm/issues/19692
+    (lib.cmakeFeature "SYCL_COMPILER_VERSION" commitDate)
+
+    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+    (lib.cmakeBool "FETCHCONTENT_QUIET" false)
+
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_VC-INTRINSICS" "${vc-intrinsics-src}")
+    (lib.cmakeFeature "LLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR" "${spirv-headers.src}")
+
+    # Ideally, we'd set this to "${placeholder "lib"}/lib/clang/${clangMajorVersion}",
+    # however this breaks the libdevice build.
+    # Instead, we just deal with it in postInstall
+    (lib.cmakeFeature "CLANG_RESOURCE_DIR" "../lib/clang/${llvmMajorVersion}")
+    (lib.cmakeFeature "LLVM_INSTALL_PACKAGE_DIR" "${placeholder "dev"}/lib/cmake/llvm")
+
+    (lib.cmakeBool "LLVM_INCLUDE_DOCS" enableManpages)
+    (lib.cmakeBool "MLIR_INCLUDE_DOCS" enableManpages)
+    (lib.cmakeBool "LLVM_BUILD_DOCS" enableManpages)
+    (lib.cmakeBool "LLVM_ENABLE_SPHINX" enableManpages)
+    (lib.cmakeBool "SPHINX_OUTPUT_MAN" enableManpages)
+
+    # The buildbot script always enables level-zero no matter what.
+    # To allow disabling level-zero, we override its flag here,
+    # so it gets excluded when not enabled.
+    (lib.cmakeFeature "SYCL_ENABLE_BACKENDS" (
+      lib.strings.concatStringsSep ";" unified-runtime.backends
+    ))
+  ]
+  ++ unified-runtime.cmakeFlags;
+
+  # This hardening option causes compilation errors when compiling for amdgcn, spirv and others
+  # Must be disabled during intel-llvm's own build (especially for libdevice)
+  hardeningDisable = [ "zerocallusedregs" ];
+
+  requiredSystemFeatures = [ "big-parallel" ];
+  enableParallelBuilding = true;
+
+  # The vast majority of tests work, however many of the more relevant
+  # ones struggle due to the lack of wrapping, causing it to
+  # not discover the standard library.
+  # If the wrapper is used instead however, other tests will fail
+  # that test CLI edge cases, and with the wrapper,
+  # those will differ compared to the vanilla build,
+  # making the tests fail.
+  doCheck = false;
+
+  # Copied from the regular LLVM derivation:
+  #  pkgs/development/compilers/llvm/common/llvm/default.nix
+  postInstall = ''
+    mkdir -p $python/share
+    mv $out/share/opt-viewer $python/share/opt-viewer
+
+    # If this stays in $out/bin, it'll create a circular reference
+    moveToOutput "bin/llvm-config*" "$dev"
+
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${lib.toLower finalAttrs.finalPackage.cmakeBuildType}.cmake" \
+      --replace-fail "$out/bin/llvm-config" "$dev/bin/llvm-config"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
+      --replace-fail 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
+
+    # As explained above, this lands in $out, but we want it in $lib and we need to fix it by hand.
+    moveToOutput "lib/clang/${llvmMajorVersion}" "$lib"
+    substituteInPlace "$dev/include/clang/Config/config.h" \
+      --replace-fail "../lib/clang/${llvmMajorVersion}" "$lib/lib/clang/${llvmMajorVersion}"
+  '';
+
+  passthru = {
+    isClang = true;
+
+    inherit unified-runtime;
+
+    # This is for easily referencing version-compatible LLVM libraries
+    # and tools that aren't built in this derivation,
+    # as well as nix tooling, such as the stdenv.
+    baseLlvm = llvmPackages_22;
+
+    inherit llvmMajorVersion;
+
+    # This hardening option causes compilation errors when compiling for amdgcn, spirv and others
+    hardeningUnsupportedFlags = [ "zerocallusedregs" ];
+  };
+
+  meta = {
+    description = "Intel LLVM-based compiler with SYCL support";
+    longDescription = ''
+      Intel's LLVM-based compiler toolchain with Data Parallel C++ (DPC++)
+      and SYCL support for heterogeneous computing across CPUs, GPUs, and FPGAs.
+    '';
+    homepage = "https://github.com/intel/llvm";
+    mainProgram = "clang";
+    license = with lib.licenses; [
+      ncsa
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ kilyanni ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubelogin";
-  version = "1.36.0";
+  version = "1.36.1";

  src = fetchFromGitHub {
    owner = "int128";
    repo = "kubelogin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-v6kNz75+xRQHfTfBKpKaNZodQzZNmJiF+WX0wJfGZ2M=";
+    hash = "sha256-leM2C6Ba2H9AU916NAVKEk6zoAWCIn43URQ/SEA8Xwc=";
  };

  subPackages = [ "." ];
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
    "-X main.version=v${finalAttrs.version}"
  ];

-  vendorHash = "sha256-f9Umpdlb6m38J05CanNJktS1T31SBSy1T1rOCzBUYkQ=";
+  vendorHash = "sha256-vAbPLlQEku9KySHpdTvQHYHtxyi7/mUvytuyrP9wkHE=";

  # test all packages
  preCheck = ''
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "livekit";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "livekit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-D1OQUWaDnB4tBy5Rf5hnuqT8CHGnLZKKdpoe+Oe1LpM=";
+    hash = "sha256-9YWZIZXXphsyYXaBFSUHNyulcBmob7vExkI+LM4DeFY=";
  };

-  vendorHash = "sha256-LoJNJZPeS3vZlfFYBJ03XzooVFzSMGgmgbQ8yAq5BhA=";
+  vendorHash = "sha256-Fa2GHoXP8jm5aiPXLz9newQR/KAoUgJ3Pv/Bw2IYsrA=";

  subPackages = [ "cmd/server" ];

@@ -49,7 +49,7 @@ stdenv.mkDerivation {
  ];

  buildInputs =
-    lib.forEach selectedApplets (x: x.buildInputs)
+    lib.concatMap (x: x.buildInputs) selectedApplets
    ++ selectedApplets
    ++ [ mate-panel ]
    ++ mate-panel.buildInputs
@@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minder";
-  version = "2.0.8";
+  version = "2.0.9";

  src = fetchFromGitHub {
    owner = "phase1geo";
    repo = "minder";
    tag = finalAttrs.version;
-    hash = "sha256-5W2ff0TJPQnuUAqw4oRjUv/h1x1goVfUsYPyrqDwc9Q=";
+    hash = "sha256-QPXgxWOftTZaybBB1GjGZVFNBzZiKiSDHIPEYElsY/8=";
  };

  nativeBuildInputs = [
@@ -9,12 +9,12 @@
 }:
 let
  pname = "models-dev";
-  version = "0-unstable-2026-04-11";
+  version = "0-unstable-2026-04-20";
  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "models.dev";
-    rev = "f07262370fe55447966ec90eb9b45f93239e5b88";
-    hash = "sha256-noDM0g7YfAXJ7SpqtW9hT56ZpAXMjMTgQ6SzU+b7UZY=";
+    rev = "2ccecb60118eb569f15da8421944c92b01eae361";
+    hash = "sha256-zQ384Ik3xVtCDpRoFh8WQXQiXo5a3Mlq80gYzD2iMOg=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -58,7 +58,7 @@ let
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-E78Hb4ByMfYL/IZG911dX6XRRKNJ0UbQUWMSv0dclFo=";
+    outputHash = "sha256-O2e9O2qu3QS/8MBdZtUNlE8fm4BumFtHMjUt7AYzzks=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -9,7 +9,7 @@

 let
  pname = "notesnook";
-  version = "3.3.12";
+  version = "3.3.14";

  inherit (stdenv.hostPlatform) system;
  throwSystem = throw "Unsupported system: ${system}";
@@ -27,10 +27,10 @@ let
    url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
    hash =
      {
-        x86_64-linux = "sha256-KW5FstIDT/5qdWZuprLzeR1LzBsoYLGq6D6xBiPKY7w=";
-        aarch64-linux = "sha256-54yew9wo1wYbzCupvZsnM+2F3xL2WZ5Uj76CQFkW5+o=";
-        x86_64-darwin = "sha256-g/NnQq8A4ithTp3ajFuRzfpRCCKZqIqdSFnH1EkW9mc=";
-        aarch64-darwin = "sha256-bEX5vObXYEOeS48bQniA1gzDMHtvQrmYa3uZ6CTLnwo=";
+        x86_64-linux = "sha256-fI9EI+XltHztwqVLLzHW49NqXNrxw4xZ1nxjEoz3D2o=";
+        aarch64-linux = "sha256-efg+g2ROR7rlWrcmeqL4y+YgbrOP/9Ylr5RqiLtMCNY=";
+        x86_64-darwin = "sha256-+cbrTM1w2nOROJvJOr4NBYyXw583aa3xOwYZVf10BCs=";
+        aarch64-darwin = "sha256-70EB93WXp8ds3izCvaAetmZgIq1PMNCTXXAgBcH1DSM=";
      }
      .${system} or throwSystem;
  };
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_skim";
-  version = "0.25.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "idanarye";
    repo = "nu_plugin_skim";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uS6xCefVPnYmNl1MLHOk6WDwHgoJFyRcsmbxoVHvwZg=";
+    hash = "sha256-2bhPRYbOGUMbc5BVHAJpVFPq9iDpNh8dKvZZN2cqkxw=";
  };

-  cargoHash = "sha256-bT7RqN102o85Z+g/psz7KVq7ZCaE9Tk5huMxAMAO2J0=";
+  cargoHash = "sha256-HyMDgs41pRSUBg30F3IWU2hWSE8S41aLxWMp06gN0zk=";

  nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];

@@ -14,13 +14,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "openasar";
-  version = "0-unstable-2026-03-28";
+  version = "0-unstable-2026-04-18";

  src = fetchFromGitHub {
    owner = "GooseMod";
    repo = "OpenAsar";
-    rev = "2fa6bb6145320cb72c033bfffbf8162c5386a32f";
-    hash = "sha256-uzIbtoWCBbVpIxfc75H4isOOTJItH01S7hWzb17oDcg=";
+    rev = "6232c4f44ddf26d1256ae201aa539eadccd71b24";
+    hash = "sha256-ktS0aqv9BSFuZ44A1ux3QsXAHO5z7B33psaJ3Q7+nYk=";
  };

  postPatch = ''
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "pat";
-  version = "0.19.2";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "la5nta";
    repo = "pat";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-a/tWKo65szgu8zTsy6xVh7DXojxA9X8jUIVHi900iWE=";
+    hash = "sha256-AYaHslPYNSl/s0d7gBxmC7IRvDGEezxzbABJSgRFuPg=";
  };

-  vendorHash = "sha256-mneQyYZ7B0euRciFQru6S7F0IKXTxIceiF5JL18W2C8=";
+  vendorHash = "sha256-HkCXbJJFOlcp0Q9XcM1HC64EDWe/rn/nMpdpNOpgYFM=";

  ldflags = [
    "-s"
@@ -24,18 +24,17 @@
  libsoup_3,
  libspelling,
  sqlite,
-  webkitgtk_6_0,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "planify";
-  version = "4.18.3";
+  version = "4.19.0";

  src = fetchFromGitHub {
    owner = "alainm23";
    repo = "planify";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VCLXQnB3JhhK3UvnGTfR+mZ/AYGQ2YNxa6hD4QCUfjM=";
+    hash = "sha256-swZ8kpfDLxe48PqHLiCjxYbsS7RILCPTPHybtrJi0rA=";
  };

  nativeBuildInputs = [
@@ -66,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
    libsoup_3
    libspelling
    sqlite
-    webkitgtk_6_0
  ];

  meta = {
@@ -17,7 +17,7 @@

 buildGoModule (finalAttrs: {
  pname = "rclone";
-  version = "1.73.4";
+  version = "1.73.5";

  outputs = [
    "out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    owner = "rclone";
    repo = "rclone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-A97O2N21MdGDdDXa8TLCVlKy9TIRPrEQ43mzQOtfBO8=";
+    hash = "sha256-9oWxL6VHPOl0IJgc7uBWfDkJlUBMvqsEQR8kVH37DZo=";
  };

  vendorHash = "sha256-ZEkZbP2r9PFAURkJNR1829VgaL1GXq72mt5Hnz5++kY=";
@@ -8,14 +8,14 @@
 }:
 buildDartApplication rec {
  pname = "serverpod_cli";
-  version = "3.4.6";
+  version = "3.4.7";

  # Fetch the whole monorepo
  src = fetchFromGitHub {
    owner = "serverpod";
    repo = "serverpod";
    tag = version;
-    hash = "sha256-VWwyCNBc3AZ+RvDWVOneazNtbm2DUJCfc5VZNmLQUBg=";
+    hash = "sha256-Axp8dmrAtcaiWAKB3H7e/ybUAIPx3++EVxRpwhGy/1U=";
  };

  sourceRoot = "${src.name}/tools/serverpod_cli";
@@ -194,11 +194,11 @@
      "dependency": "transitive",
      "description": {
        "name": "dart_mappable",
-        "sha256": "97526bd5e1b1739be5c7379c51d391d074b6bbd109e6e92be49028ecb1a9853c",
+        "sha256": "960746478faaa68ed6b9d3c6fd03c87c7b8614e6c33e75fe1b0c6d7a60adcf29",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.7.0"
+      "version": "4.8.0"
    },
    "dart_style": {
      "dependency": "direct main",
@@ -514,51 +514,51 @@
      "dependency": "transitive",
      "description": {
        "name": "serverpod_client",
-        "sha256": "3b6c6b2d0acc064df75225436f9bdf97f9af17547b58024b231e44195e1f7f2a",
+        "sha256": "215f3d535f4e6beb2e8d1a7fcc467709d0d65454ae4bf33661d7f2b63f965bf3",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.6"
+      "version": "3.4.7"
    },
    "serverpod_lints": {
      "dependency": "direct dev",
      "description": {
        "name": "serverpod_lints",
-        "sha256": "f033e4234d74558150cc683db4065fedb5a14d9452353155cf593d98ef59d85e",
+        "sha256": "d7f2e10538dda09bd3cf3f770b5201dac5aec9d59c3bc0f859d16a8c5ac0c324",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.6"
+      "version": "3.4.7"
    },
    "serverpod_serialization": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_serialization",
-        "sha256": "8e6a5421c0ecea309938b76a20228a421d8b3f96bb3e9c227be1ccac1fe0fb33",
+        "sha256": "2ddb7e6eda049925c8114f25ad58ed5bee86ebff020b146d5c9c35e153a8a925",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.6"
+      "version": "3.4.7"
    },
    "serverpod_service_client": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_service_client",
-        "sha256": "2934809a7205cf3d4990adccb2966a8bcf42024304adb908bf9e527236ca51c7",
+        "sha256": "e8aa179181262cf3352748941d70952b366edd60697f30ce03c7f43cd7cb50f5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.6"
+      "version": "3.4.7"
    },
    "serverpod_shared": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_shared",
-        "sha256": "27b807dc27a41c10ddf57fd977fcc22245b6d46b8f24190efaf7260c270b860a",
+        "sha256": "7b9720d2e0419cf9c79c1b246f9d799729246fbda5d225eaaf95051647a74764",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.6"
+      "version": "3.4.7"
    },
    "shelf": {
      "dependency": "transitive",
@@ -754,11 +754,11 @@
      "dependency": "transitive",
      "description": {
        "name": "vm_service",
-        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
+        "sha256": "046d3928e16fa4dc46e8350415661755ab759d9fc97fc21b5ab295f71e4f0499",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "15.0.2"
+      "version": "15.1.0"
    },
    "watcher": {
      "dependency": "direct main",
@@ -27,6 +27,7 @@
  libxkbcommon,
  wayland,
  fontconfig,
+  dbus,
  alsaSupport ? stdenv.hostPlatform.isLinux,
  jackSupport ? stdenv.hostPlatform.isLinux,
  pipewireSupport ? stdenv.hostPlatform.isLinux,
@@ -99,6 +100,7 @@ buildDotnetModule rec {
    libxkbcommon
    wayland
    fontconfig.lib
+    dbus
  ]
  ++ lib.optional alsaSupport alsa-lib
  ++ lib.optional jackSupport libjack2
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 let
-  version = "0.22.1";
+  version = "0.23.1";
 in
 {
  inherit version;
@@ -9,7 +9,7 @@ in
    owner = "Donkie";
    repo = "Spoolman";
    rev = "v${version}";
-    hash = "sha256-EVGpwcjEh4u8Vtgu2LypqMqArYLZe7oh1qYhGZpgjh0=";
+    hash = "sha256-Oa/cNmpc0hWRf0EQI5aXIE/p9//Sos5Nj3QFEjKgj5o=";
  };

  meta = {
@@ -10,7 +10,7 @@ buildNpmPackage {

  src = "${common.src}/client";

-  npmDepsHash = "sha256-E4DvEOSHfwwM0C+vTRMDQbCNv2IDyFOFwfqszrI+uOA=";
+  npmDepsHash = "sha256-8ojD7xMxRE9+b4O7vJdwKwrg8aYukYc3l+LF5enKFgA=";

  VITE_APIURL = "/api/v1";

@@ -10,6 +10,13 @@ let
  common = callPackage ./common.nix { };
  frontend = callPackage ./frontend.nix { };
  python = python312;
+  hishel_0_1 = python.pkgs.hishel.overrideAttrs (old: rec {
+    version = "0.1.5";
+    src = old.src.override {
+      tag = version;
+      hash = "sha256-OyQR/ruowNk5z4ITRHcIJn1kc0xLZiofmxajf6hNR9k=";
+    };
+  });
 in

 python.pkgs.buildPythonPackage rec {
@@ -21,22 +28,39 @@ python.pkgs.buildPythonPackage rec {

  nativeBuildInputs = [
    makeWrapper
-    python.pkgs.pdm-backend
+    python.pkgs.setuptools
    python.pkgs.pythonRelaxDepsHook
  ];

-  pythonRelaxDeps = [ "setuptools" ];
+  pythonRelaxDeps = [
+    "setuptools"
+    "websockets"
+  ];

  postPatch = ''
    substituteInPlace pyproject.toml --replace-fail psycopg2-binary psycopg2
+
+    # upstream removed [build-system] in 0.23.x, causing setuptools
+    # to fail on the flat layout with multiple top-level directories
+    cat >> pyproject.toml <<EOF
+
+    [build-system]
+    requires = ["setuptools"]
+    build-backend = "setuptools.build_meta"
+
+    [tool.setuptools.packages.find]
+    include = ["spoolman*"]
+    EOF
  '';

  propagatedBuildInputs = with python.pkgs; [
    uvloop
    alembic
+    aiomysql
+    anysqlite
    asyncpg
    fastapi
-    hishel
+    hishel_0_1
    httptools
    httpx
    aiosqlite
@@ -9,17 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "sqlc";
-  version = "1.30.0";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "sqlc-dev";
    repo = "sqlc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ns0FIGu+aOuRFBYHrAqWUiYCwHE5XQqlR3AFKy5lq4E=";
+    hash = "sha256-1HQXj3rmfPyOw3Cex3jRByEwzXhcYpWpj8w4Z2Cylp8=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-jivqXwuq6wbNQFW8BlBZIKBLpIotA2MMR5iywODycpY=";
+  vendorHash = "sha256-SVc7XZERh47hhfTr9bExjZcZrNz0FO/OVEQYbPVqSWM=";

  subPackages = [ "cmd/sqlc" ];

@@ -56,12 +56,6 @@ let
            xz
            zenity

-            # Steam expects it to be /sbin specifically
-            (pkgs.runCommand "sbin-ldconfig" { } ''
-              mkdir -p $out/sbin
-              ln -s /bin/ldconfig $out/sbin/ldconfig
-            '')
-
            # crashes on startup if it can't find libx11 locale files
            (pkgs.runCommand "xorg-locale" { } ''
              mkdir -p $out
@@ -133,6 +127,13 @@ let

        inherit extraPreBwrapCmds;

+        # Steam expects /sbin/ldconfig to exist, and since SinceRT3
+        # symlinking it results in a symlink loop in nested containers.
+        # Thus, just copy it.
+        extraBuildCommands = ''
+          cp -f $out/usr/{bin,sbin}/ldconfig
+        '';
+
        extraBwrapArgs = [
          # Steam will dump crash reports here, make those more accessible
          "--bind-try /tmp/dumps /tmp/dumps"
@@ -10,14 +10,14 @@ let
  platform =
    if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
  hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-xL2D05My1EgM8d6ku5+2GqYLwcyWljqyMowb8A1lsh0=";
-    "x86_64-linux" = "sha256-exI0jZ4LXcUXYcYL6wVXZhmjD4LFvTzqy+IaokmLs/M=";
-    "aarch64-linux" = "sha256-MBUpe8o0/0sa4qSGmzv3CYrDDqGiiW/NrUnmmfn0dBc=";
+    "universal-macos" = "sha256-PzlZt+Fou0I4360thQJ3gihGQkH40DrlLZh+i7Uds0o=";
+    "x86_64-linux" = "sha256-7bjM+3sN/D9reEhZ2iwWMghyjp0/8rXVauzY2OdW9rI=";
+    "aarch64-linux" = "sha256-P+7zui/lpc7ilrpNsyB9v+K/WaeuG8jUsbQEH6xEmpk=";
  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tigerbeetle";
-  version = "0.16.78";
+  version = "0.17.0";

  src = fetchzip {
    url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "trinity";
-  version = "1.9-unstable-2025-09-02";
+  version = "1.9-unstable-2026-04-11";

  src = fetchFromGitHub {
    owner = "kernelslacker";
    repo = "trinity";
-    rev = "294c46522620afffd7b57af7ef743131ff55a488";
-    hash = "sha256-Fm9bwJ/ofDgSbe/YUgl22Rf0F+NCV32xLPA2kw36zFs=";
+    rev = "4ecfd4492750cc7a92e0ccba197a308c5456b564";
+    hash = "sha256-4n44ZqA7T9SoQdUwXa4LJIDwyU91rV0lRMGiQqxTn1c=";
  };

  postPatch = ''
@@ -43,9 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
    onetbb
    level-zero
  ]
-  ++ lib.optionals useJemalloc [
-    hwloc
-  ]
  ++ lib.optionals cudaSupport [
    cudaPackages.cuda_cudart
  ]
@@ -55,6 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
    gbenchmark
  ];

+  propagatedBuildInputs = [
+    hwloc
+  ];
+
  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "unified-memory-framework";
@@ -72,6 +73,14 @@ stdenv.mkDerivation (finalAttrs: {
    # causing the package to link to /build
    substituteInPlace CMakeLists.txt \
      --replace-fail "\''${jemalloc_targ_BINARY_DIR}" "$out/jemalloc"
+
+    # $<BUILD_INTERFACE:hwloc> only links hwloc at build time, so the installed
+    # cmake targets omit it. Downstream static consumers (e.g. UR adapters in
+    # intel-llvm) then fail to link. Export hwloc unconditionally instead.
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail \
+        'set(UMF_LIBS umf_utils umf_ba umf_coarse $<BUILD_INTERFACE:''${UMF_HWLOC_NAME}>)' \
+        'set(UMF_LIBS umf_utils umf_ba umf_coarse ''${UMF_HWLOC_NAME})'
  '';

  # If included, jemalloc needs to be vendored, as they don't support using a pre-built version
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waytrogen";
-  version = "0.9.3";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "nikolaizombie1";
    repo = "waytrogen";
    tag = finalAttrs.version;
-    hash = "sha256-0WBV6s6THXSg8HabnFFi+Gco+sXy7zQO21IgXykMBHc=";
+    hash = "sha256-+1HiTmJAkhd+zbLAyRRk9tHDbR7qcslkfJ2HyGipZCo=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "yabai";
-  version = "7.1.22";
+  version = "7.1.23";

  src =
    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@@ -66,13 +66,13 @@ stdenv.mkDerivation (finalAttrs: {
      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
      "aarch64-darwin" = fetchzip {
        url = "https://github.com/asmvik/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-a7ieZhQvt7YyLdBNYg0HhSl2BQRG+WdM2DYntNRLgyU=";
+        hash = "sha256-p8LHuAhmkKNPkRNIw4NHpAA+/oQPMI34H21mlUiwK+M=";
      };
      "x86_64-darwin" = fetchFromGitHub {
        owner = "asmvik";
        repo = "yabai";
        rev = "v${finalAttrs.version}";
-        hash = "sha256-T3sZhJpoZJKQhZpGDyEhpw+dMXoaFO9PEd0g0jDcihc=";
+        hash = "sha256-6fvjwn2MBJ8LKShR3evLyS3BfoJ4yYtnaCif7c9faxc=";
      };
    };

@@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "zsh-forgit";
-  version = "26.04.1";
+  version = "26.04.2";

  src = fetchFromGitHub {
    owner = "wfxr";
    repo = "forgit";
    tag = finalAttrs.version;
-    hash = "sha256-/tG//6s0km8IUJXI4f++/UUCTAOYTDE/C5bbkHFhdNY=";
+    hash = "sha256-/zFws4/QkAuoV2edtxW3jK1HbftigYNZzTkSg5Y4Phg=";
  };

  strictDeps = true;
@@ -8,26 +8,24 @@
  ninja,
  vala,
  desktop-file-utils,
-  gtk3,
-  granite,
-  libhandy,
-  libnotify,
-  vte,
+  gtk4,
+  granite7,
+  libadwaita,
+  vte-gtk4,
  libgee,
  pcre2,
-  wrapGAppsHook3,
-  xvfb-run,
+  wrapGAppsHook4,
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-terminal";
-  version = "7.2.0";
+  version = "8.0.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "terminal";
    tag = version;
-    hash = "sha256-fYOX48zGJY/1iIcL0SaHLyt/c6tr9qTeH1i5hTsZvvE=";
+    hash = "sha256-IzLaM9FPMRGJKvlXktyrhDYSyP4LJ8yFW8/FmsmZjU4=";
  };

  nativeBuildInputs = [
@@ -36,18 +34,16 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    vala
-    wrapGAppsHook3
-    xvfb-run
+    wrapGAppsHook4
  ];

  buildInputs = [
-    granite
-    gtk3
+    granite7
+    gtk4
+    libadwaita
    libgee
-    libhandy
-    libnotify
    pcre2
-    vte
+    vte-gtk4
  ];

  passthru = {
@@ -1,19 +0,0 @@
-{ callPackage, fetchurl, ... }@args:
-
-callPackage ./generic.nix (
-  args
-  // rec {
-    version = "1.77.0";
-
-    src = fetchurl {
-      urls = [
-        "mirror://sourceforge/boost/boost_${builtins.replaceStrings [ "." ] [ "_" ] version}.tar.bz2"
-        "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${
-          builtins.replaceStrings [ "." ] [ "_" ] version
-        }.tar.bz2"
-      ];
-      # SHA256 from http://www.boost.org/users/history/version_1_77_0.html
-      sha256 = "sha256-/J+F/AMOIzFCkIJBr3qEbmBjCqc4jeml+vsfOiaECFQ=";
-    };
-  }
-)
@@ -20,7 +20,6 @@ let
    );
 in
 {
-  boost177 = makeBoost ./1.77.nix;
  boost178 = makeBoost ./1.78.nix;
  boost179 = makeBoost ./1.79.nix;
  boost180 = makeBoost ./1.80.nix;
@@ -59,10 +59,6 @@ in
    version = "70.1";
    hash = "sha256-jSBUKMF78Tu1NTAGae0oszihV7HAGuZtMdDT4tR8P9U=";
  };
-  icu69 = make-icu {
-    version = "69.1";
-    hash = "sha256-TLp7es0dPELES7DBS+ZjcJjH+vKzMM6Ha8XzuRXQl0U=";
-  };
  icu67 = make-icu {
    version = "67.1";
    hash = "sha256-lKgM1vJRpTvSqZf28bWsZlP+eR36tm4esCJ3QPuG1dw=";
@@ -1008,15 +1008,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "fzf-lua";
-      version = "0.0.2565-1";
+      version = "0.0.2615-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2565-1.rockspec";
-          sha256 = "1ipcw3xx7ahspr57nn400v1zvdxqcf1685dh7dynsishw5y2fny1";
+          url = "mirror://luarocks/fzf-lua-0.0.2615-1.rockspec";
+          sha256 = "04y7lh9mm7lj605xpsrb6p142mpmnnisf781slfmcsgl2zbm4pk9";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/9f0432fdd7825ab163520045831a40b6df82ea28.zip";
-        sha256 = "0m416my25nc9crawfbhp4askng69xcnhvwwbsvkvakv2ak1i2bbh";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/cebf88881a4fab2c20a2a950269953417af1c3e8.zip";
+        sha256 = "13b4zrx4j2pnl9sh6mcyx120gm29flk7zr03vkik2difpcpdi518";
      };

      disabled = luaOlder "5.1";
@@ -1105,15 +1105,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "grug-far.nvim";
-      version = "1.6.65-1";
+      version = "1.6.67-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.65-1.rockspec";
-          sha256 = "111gpirhbxha8ynih644vdw6qahqxfil19wvzbci9wc1s8d1097k";
+          url = "mirror://luarocks/grug-far.nvim-1.6.67-1.rockspec";
+          sha256 = "1bjkfzi6l7mzsz5345jh0a69rmsk16xmp94dx47iidrflqpqmbd8";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/37d0eafc6a2dcf8641aa19fc2a8db5e391b7f16b.zip";
-        sha256 = "0gk1fq4pyhzc1pd7dnzdvvzkszxih7shwk4fn2gfkhh7av9n0pac";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/21604255d0e8f9968322f61f2b6c09e5efe1285a.zip";
+        sha256 = "1vc4c0wdj3il8ig8jdb56870zwkriw3ql306vyjfl5ii7z4jbrnz";
      };

      disabled = luaOlder "5.1";
@@ -1136,15 +1136,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "haskell-tools.nvim";
-      version = "8.1.1-1";
+      version = "9.0.1-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/haskell-tools.nvim-8.1.1-1.rockspec";
-          sha256 = "06k911dmlfwf0nnswpi454xph96waymvqjywbqrs3k517p1ch2dw";
+          url = "mirror://luarocks/haskell-tools.nvim-9.0.1-1.rockspec";
+          sha256 = "0gjwv0hijxzb8hmdv6ana77adyvwszx4j4lr8dddikpggd3i6iw0";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v8.1.1.zip";
-        sha256 = "178a8qgrigcnf662xzbw7yzh400vyhl7xvacv4k1sy5rk7f236l3";
+        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v9.0.1.zip";
+        sha256 = "1sfwm86zz9pdk9w937knlm9dj4ai29rx0zx0r59accgl0rzaav7j";
      };

      disabled = luaOlder "5.1";
@@ -1920,17 +1920,17 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "ltreesitter";
-      version = "0.2.0-1";
+      version = "0.3.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/ltreesitter-0.2.0-1.rockspec";
-          sha256 = "0qhmx73hkskzmf5s3yv843234ri8n3gqj4dad79b018j5ilwiria";
+          url = "mirror://luarocks/ltreesitter-0.3.0-1.rockspec";
+          sha256 = "1vb8jbdl36syqmd4sjqswsqy42rq59kchxk4sx0ns9va4c0kim4v";
        }).outPath;
      src = fetchFromGitHub {
        owner = "euclidianAce";
        repo = "ltreesitter";
-        tag = "v0.2.0";
-        hash = "sha256-PYM6UAwp8w0qZxua5G6RFXI78Q6L3Vlc3eolXlNrN8k=";
+        tag = "v0.3.0";
+        hash = "sha256-tiNcc/1hnY8GWgpdlBfOTA7400916tqiAXeXJLfgtNE=";
      };

      meta = {
@@ -3277,17 +3277,17 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "lualine.nvim";
-      version = "scm-2";
+      version = "scm-3";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/lualine.nvim-scm-2.rockspec";
-          sha256 = "0lfwmiq9jcrxyhg6qk7l7znab356lwndrp52b9f3h86a48v5ywj0";
+          url = "mirror://luarocks/lualine.nvim-scm-3.rockspec";
+          sha256 = "1d2wxz9qvczy9l3rislaiwgiwdsvphws0s5y59gcpdnvfl353scx";
        }).outPath;
      src = fetchFromGitHub {
        owner = "nvim-lualine";
        repo = "lualine.nvim";
-        rev = "f5d2a8570f8b736ddb9bb4be504355bcd6e15ec8";
-        hash = "sha256-woyw4T0rG5Q3ipbsvI0F094tzJ8bnOOlaCzsibi/AKw=";
+        rev = "a905eeebc4e63fdc48b5135d3bf8aea5618fb21c";
+        hash = "sha256-PHunrG0yd3pDw3c1S9w1AXQx5/1nT68M+mjxT53enmM=";
      };

      disabled = luaOlder "5.1";
@@ -5137,8 +5137,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "nvim-lua";
        repo = "plenary.nvim";
-        rev = "b9fd5226c2f76c951fc8ed5923d85e4de065e509";
-        hash = "sha256-9Un7ekhBxcnmFE1xjCCFTZ7eqIbmXvQexpnhduAg4M0=";
+        rev = "74b06c6c75e4eeb3108ec01852001636d85a932b";
+        hash = "sha256-nkfETDkPiE+Kd2BWYZijgUp9bP8RgFwRmvqJz2BMuq4=";
      };

      disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -5411,15 +5411,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "rocks.nvim";
-      version = "2.47.4-1";
+      version = "2.47.5-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/rocks.nvim-2.47.4-1.rockspec";
-          sha256 = "0wc3ddd926qq186yvsh5ylyxygr1wg5a72p1ch4d8hrgnddpb3ii";
+          url = "mirror://luarocks/rocks.nvim-2.47.5-1.rockspec";
+          sha256 = "1zxywv6sa6cwzf072fz7cdhq96zw420kzc7dczrb50r7jh7sczxx";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.47.4.zip";
-        sha256 = "1gzy55m1d86wg5skf6pczd9d6wxrmh9bly32asw6rbs6k4fz0lpb";
+        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.47.5.zip";
+        sha256 = "1a109916ldarqxc1sfi7n0a2ifslhcwlhf6hp6jsisx3gm8v2nv9";
      };

      disabled = lua.luaversion != "5.1";
@@ -5495,21 +5495,21 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "rustaceanvim";
-      version = "9.0.1-2";
+      version = "9.0.2-2";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-9.0.1-2.rockspec";
-          sha256 = "0r33jq01qyrspl2vsk0bv5bx32ycyyhkhylfs5xxrilgpzv0rh5h";
+          url = "mirror://luarocks/rustaceanvim-9.0.2-2.rockspec";
+          sha256 = "09vq53b68a9ywilb7fa1bsn52wmdzdvbflih0p8ppjzsk1lyilsv";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.1.zip";
-        sha256 = "1vzp5vf5wpkpsp40zwwkl9l29ifiap4h2hr8wxjhgznsjk3y8y5y";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.2.zip";
+        sha256 = "0kmd12d234fwrikhz33y7npdmyi7ahldb9mjdwlvl3kgq0lkpg74";
      };

      disabled = lua.luaversion != "5.1";

      meta = {
-        homepage = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.1.zip";
+        homepage = "https://github.com/mrcjkb/rustaceanvim/archive/refs/tags/v9.0.2.zip";
        maintainers = with lib.maintainers; [ mrcjkb ];
        license.fullName = "GPL-2.0-only";
        description = "🦀 Supercharge your Rust experience in Neovim! A heavily modified fork of rust-tools.nvim";
@@ -5882,8 +5882,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "nvim-telescope";
        repo = "telescope.nvim";
-        rev = "48d2656e54d3e3953ae647153ccdaffa50d4d76b";
-        hash = "sha256-PtNTNzNk6V5SoxytHk6KYiY1LreMug7Qw3B7WtyHeHs=";
+        rev = "028d9a0695a0cc4cfa893889f8c408ed7ccc8adc";
+        hash = "sha256-xU/lozREXuXkjBq8L94sLwyEE6f7k8Q3y0BkjPssB1Y=";
      };

      disabled = lua.luaversion != "5.1";
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "elevenlabs";
-  version = "2.42.0";
+  version = "2.43.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elevenlabs";
    repo = "elevenlabs-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HLKaT+781V889MO471T1Hj+ED7k3SGPtwt9NIA/bmWQ=";
+    hash = "sha256-w8IvjwC1X81BhPgTcHWx/vDL9M/ZoHUNsvTySmN0qW0=";
  };

  build-system = [ poetry-core ];
@@ -5,8 +5,7 @@
  fetchFromGitHub,

  # build-system
-  jupyter-packaging,
-  setuptools,
+  hatchling,

  # dependencies
  narwhals,
@@ -38,31 +37,23 @@

 buildPythonPackage (finalAttrs: {
  pname = "plotly";
-  version = "6.6.0";
+  version = "6.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "plotly";
    repo = "plotly.py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-t1IYu3PL/B71fhX5LVQrjAKkQSjPC+wZjMnBp4kPTNY=";
+    hash = "sha256-gykhl1aBgKCkJVv507UJk4xdYaruV/aU+JLYmvyFYbY=";
  };

  patches = [
-    # https://numpy.org/devdocs/release/2.4.0-notes.html#removed-interpolation-parameter-from-quantile-and-percentile-functions
-    # Upstream PR: https://github.com/plotly/plotly.py/pull/5505
-    ./numpy-2.4-percentile-interpolation.patch
-
    # https://numpy.org/devdocs/release/2.4.0-notes.html#removed-numpy-in1d
    # Upstream PR: https://github.com/plotly/plotly.py/pull/5522
    ./numpy-2.4-in1d.patch
  ];

  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail '"hatch", ' "" \
-      --replace-fail "jupyter_packaging~=0.10.0" jupyter_packaging
-
    # `pytest_ignore_collect` takes only `collection_path` starting with
    # pytest 9. Most of the paths referenced in `plotly/conftest.py`
    # don't exist anymore and wouldn't be collected anyway, so we can just
@@ -75,8 +66,7 @@ buildPythonPackage (finalAttrs: {
  env.SKIP_NPM = true;

  build-system = [
-    setuptools
-    jupyter-packaging
+    hatchling
  ];

  dependencies = [
@@ -1,17 +0,0 @@
-diff --git a/plotly/figure_factory/_violin.py b/plotly/figure_factory/_violin.py
-index 55924e692..e89db0e11 100644
--- a/plotly/figure_factory/_violin.py
-+++ b/plotly/figure_factory/_violin.py
-@@ -17,9 +17,9 @@ def calc_stats(data):
-     x = np.asarray(data, float)
-     vals_min = np.min(x)
-     vals_max = np.max(x)
-    q2 = np.percentile(x, 50, interpolation="linear")
-    q1 = np.percentile(x, 25, interpolation="lower")
-    q3 = np.percentile(x, 75, interpolation="higher")
-+    q2 = np.percentile(x, 50, method="linear")
-+    q1 = np.percentile(x, 25, method="lower")
-+    q3 = np.percentile(x, 75, method="higher")
-     iqr = q3 - q1
-     whisker_dist = 1.5 * iqr
- 
@@ -75,14 +75,14 @@ in
 {
  inherit mkTmuxPlugin;

-  battery = mkTmuxPlugin {
+  battery = mkTmuxPlugin rec {
    pluginName = "battery";
-    version = "unstable-2019-07-04";
+    version = "2.0.0";
    src = fetchFromGitHub {
      owner = "tmux-plugins";
      repo = "tmux-battery";
-      rev = "f8b8e8451990365e0c98c38c184962e4f83b793b";
-      hash = "sha256-NfKaM4dPt7YaxG7kHMNxf95Mz0hIEhxqlVi2Obr+Da4=";
+      tag = "v${version}";
+      hash = "sha256-kyUrJdraDDye8WEBP2RgHN7kHmafToYtLmrMJ9u0f+0=";
    };
  };

@@ -242,12 +242,12 @@ in

  dotbar = mkTmuxPlugin rec {
    pluginName = "dotbar";
-    version = "0.3.0";
+    version = "0.3.2";
    src = fetchFromGitHub {
      owner = "vaaleyard";
      repo = "tmux-dotbar";
      tag = version;
-      hash = "sha256-n9k18pJnd5mnp9a7VsMBmEHDwo3j06K6/G6p7/DTyIY=";
+      hash = "sha256-WaRKepmPqiE+W8Tm0dBc6hGiqqZP122eXjrG0rJnt0w=";
    };
    meta = {
      homepage = "https://github.com/vaaleyard/tmux-dotbar";
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
  owner = "bcpearce";
  domain = "gtfs_realtime";
-  version = "0.4.6";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "bcpearce";
    repo = "homeassistant-gtfs-realtime";
    tag = version;
-    hash = "sha256-gsrEbcoFdbDkXR0qvrqkDXymXcyzLr48YcL87wfOAjU=";
+    hash = "sha256-swqq2KY12EuDUnhnZ0zU8uIla7jvKLzvySnXU+vg/Jg=";
  };

  dependencies = [ gtfs-station-stop ];
@@ -1,216 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  gitUpdater,
-  bison,
-  cmake,
-  pkg-config,
-  boost,
-  icu,
-  libedit,
-  libevent,
-  lz4,
-  ncurses,
-  openssl,
-  perl,
-  protobuf,
-  re2,
-  readline,
-  zlib,
-  zstd,
-  libfido2,
-  numactl,
-  cctools,
-  developer_cmds,
-  libtirpc,
-  rpcsvc-proto,
-  curl,
-  DarwinTools,
-  nixosTests,
-  coreutils,
-  procps,
-  gnused,
-  gnugrep,
-  hostname,
-  makeWrapper,
-  # Percona-specific deps
-  cyrus_sasl,
-  gnumake,
-  openldap,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "percona-server";
-  version = "8.0.45-36";
-
-  src = fetchurl {
-    url = "https://downloads.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-E3zbJKH1uK+9H+84RXuY6tjXPjzHPCKjxvrMlKs4cd4=";
-  };
-
-  nativeBuildInputs = [
-    bison
-    cmake
-    pkg-config
-    makeWrapper
-    # required for scripts/CMakeLists.txt
-    coreutils
-    gnugrep
-    procps
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ];
-
-  patches = [
-    # fixes using -DWITH_SSL=system with CMAKE_PREFIX_PATH on darwin
-    # https://github.com/Homebrew/homebrew-core/pull/204799
-    (fetchpatch {
-      name = "fix-system-ssl-darwin.patch";
-      url = "https://github.com/percona/percona-server/pull/5537/commits/a693e5d67abf6f27f5284c86361604babec529c6.patch";
-      hash = "sha256-fFBy3AYTMLvHvbsh0g0UvuPkmVMKZzxPsxeBKbsN8Ho=";
-    })
-    ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
-    ./coredumper-explicitly-import-unistd.patch # fix build on aarch64-linux
-  ];
-
-  ## NOTE: MySQL upstream frequently twiddles the invocations of libtool. When updating, you might proactively grep for libtool references.
-  postPatch = ''
-    substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool
-    substituteInPlace cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
-    # The rocksdb setup script is called with `env -i` and cannot find anything in PATH.
-    patchShebangs storage/rocksdb/get_rocksdb_files.sh
-    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace mktemp ${coreutils}/bin/mktemp
-    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace "rm $MKFILE" "${coreutils}/bin/rm $MKFILE"
-    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace "make --" "${gnumake}/bin/make --"
-  '';
-
-  buildInputs = [
-    boost
-    (curl.override { inherit openssl; })
-    icu
-    libedit
-    libevent
-    lz4
-    ncurses
-    openssl
-    protobuf
-    re2
-    readline
-    zlib
-    zstd
-    libfido2
-    openldap
-    perl
-    cyrus_sasl
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    numactl
-    libtirpc
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    cctools
-    developer_cmds
-    DarwinTools
-  ];
-
-  outputs = [
-    "out"
-    "static"
-  ];
-
-  cmakeFlags = [
-    # Percona-specific flags.
-    "-DPORTABLE=1"
-    "-DWITH_LDAP=system"
-    "-DROCKSDB_DISABLE_AVX2=1"
-    "-DROCKSDB_DISABLE_MARCH_NATIVE=1"
-
-    # Flags taken from mysql package.
-    "-DFORCE_UNSUPPORTED_COMPILER=1" # To configure on Darwin.
-    "-DWITH_ROUTER=OFF" # It may be packaged separately.
-    "-DWITH_SYSTEM_LIBS=ON"
-    "-DWITH_UNIT_TESTS=OFF"
-    "-DMYSQL_UNIX_ADDR=/run/mysqld/mysqld.sock"
-    "-DMYSQL_DATADIR=/var/lib/mysql"
-    "-DINSTALL_INFODIR=share/mysql/docs"
-    "-DINSTALL_MANDIR=share/man"
-    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
-    "-DINSTALL_INCLUDEDIR=include/mysql"
-    "-DINSTALL_DOCREADMEDIR=share/mysql"
-    "-DINSTALL_SUPPORTFILESDIR=share/mysql"
-    "-DINSTALL_MYSQLSHAREDIR=share/mysql"
-    "-DINSTALL_MYSQLTESTDIR="
-    "-DINSTALL_DOCDIR=share/mysql/docs"
-    "-DINSTALL_SHAREDIR=share/mysql"
-  ];
-
-  postInstall = ''
-    moveToOutput "lib/*.a" $static
-    so=${stdenv.hostPlatform.extensions.sharedLibrary}
-    ln -s libperconaserverclient$so $out/lib/libmysqlclient_r$so
-
-    wrapProgram $out/bin/mysqld_safe --prefix PATH : ${
-      lib.makeBinPath [
-        coreutils
-        procps
-        gnugrep
-        gnused
-        hostname
-      ]
-    }
-    wrapProgram $out/bin/mysql_config --prefix PATH : ${
-      lib.makeBinPath [
-        coreutils
-        gnused
-      ]
-    }
-    wrapProgram $out/bin/ps_mysqld_helper --prefix PATH : ${
-      lib.makeBinPath [
-        coreutils
-        gnugrep
-      ]
-    }
-    wrapProgram $out/bin/ps-admin --prefix PATH : ${
-      lib.makeBinPath [
-        coreutils
-        gnugrep
-      ]
-    }
-    wrapProgram $out/bin/mysqld_multi --prefix PATH : ${
-      lib.makeBinPath [
-        coreutils
-        gnugrep
-      ]
-    }
-  '';
-
-  passthru = {
-    client = finalAttrs.finalPackage;
-    connector-c = finalAttrs.finalPackage;
-    server = finalAttrs.finalPackage;
-    mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.percona-server =
-      nixosTests.mysql."percona-server_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
-    updateScript = gitUpdater {
-      url = "https://github.com/percona/percona-server";
-      rev-prefix = "Percona-Server-";
-      allowedVersions = "${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\..+";
-    };
-  };
-
-  meta = {
-    homepage = "https://www.percona.com/software/mysql-database/percona-server";
-    description = ''
-      A free, fully compatible, enhanced, open source drop-in replacement for
-      MySQL® that provides superior performance, scalability and instrumentation.
-      Long-term support release.
-    '';
-    license = lib.licenses.gpl2Only;
-    maintainers = [
-      lib.maintainers.leona
-      lib.maintainers.osnyx
-    ];
-    platforms = lib.platforms.unix;
-  };
-})
@@ -1,12 +1,4 @@
 pkgs: {
-  # old lts
-  percona-server_8_0 = pkgs.callPackage ./8_0.nix {
-    inherit (pkgs.darwin) developer_cmds DarwinTools;
-    boost = pkgs.boost177; # Configure checks for specific version.
-    icu = pkgs.icu69;
-    # newer versions cause linking failures against `libabsl_spinlock_wait`
-    protobuf = pkgs.protobuf_21;
-  };
  percona-server_8_4 = pkgs.callPackage ./8_4.nix {
    inherit (pkgs.darwin) developer_cmds DarwinTools;
    # newer versions cause linking failures against `libabsl_spinlock_wait`
@@ -1,16 +0,0 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (
-  args
-  // {
-    version = "8.0.35-34";
-    hash = "sha256-DqjDBLSQqlWazWJjdb+n7RwqSe/OMlZI2ca/JNTX2W8=";
-
-    # includes https://github.com/Percona-Lab/libkmip.git
-    fetchSubmodules = true;
-
-    extraPatches = [
-      ./abi-check.patch
-    ];
-  }
-)
@@ -1,7 +1,4 @@
 pkgs: {
-  percona-xtrabackup_8_0 = pkgs.callPackage ./8_0.nix {
-    boost = pkgs.boost177;
-  };
  percona-xtrabackup_8_4 = pkgs.callPackage ./8_4.nix { };
  percona-xtrabackup = pkgs.percona-xtrabackup_8_4;
 }
@@ -2,12 +2,15 @@
  lib,
  rustPlatform,
  fetchFromGitea,
+  fetchpatch2,
+  installShellFiles,
  openssl,
  pkg-config,
  protobuf,
  cacert,
  nix-update-script,
  nixosTests,
+  stdenv,
 }:
 let
  generic =
@@ -34,6 +37,7 @@ let
      inherit cargoHash cargoPatches;

      nativeBuildInputs = [
+        installShellFiles
        protobuf
        pkg-config
      ];
@@ -48,7 +52,7 @@ let

      env.OPENSSL_NO_VENDOR = true;

-      # See https://git.deuxfleurs.fr/Deuxfleurs/garage/src/tag/v2.2.0/nix/compile.nix#L71-L78
+      # See https://git.deuxfleurs.fr/Deuxfleurs/garage/src/tag/v2.3.0/nix/compile.nix#L71-L78
      # on version changes for checking if changes are required here
      buildFeatures = [
        "bundled-libs"
@@ -64,6 +68,16 @@ let
        "telemetry-otlp"
      ];

+      postInstall =
+        lib.optionalString
+          ((lib.versionAtLeast version "2.3.0") && (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
+          ''
+            installShellCompletion --cmd garage \
+              --bash <($out/bin/garage completions bash) \
+              --fish <($out/bin/garage completions fish) \
+              --zsh <($out/bin/garage completions zsh)
+          '';
+
      passthru = {
        tests = nixosTests."garage_${lib.versions.major version}";
        updateScript = nix-update-script {
@@ -99,9 +113,16 @@ rec {
  };

  garage_2 = generic {
-    version = "2.2.0";
-    hash = "sha256-UaWHZPV0/Jgeiwvvr9V9Gqthn5KXErLx8gL4JdBRDVs=";
-    cargoHash = "sha256-U6Wipvlw3XdKUBNZMznENJ9m+9fzP9Nb6217+Kytu7s=";
+    version = "2.3.0";
+    hash = "sha256-CqHcaVGgXL/jjqq7XN+kzEp6xoNgwBfGpMKYbTd78Ys=";
+    cargoHash = "sha256-ANh97G/2/KtCMN4gldteq6ROduk1AQJkI5zS9n97OJY=";
+    cargoPatches = [
+      (fetchpatch2 {
+        # fix: prevent depending on aws-lc via reqwest
+        url = "https://git.deuxfleurs.fr/Deuxfleurs/garage/commit/7c18abb664d891cdb696b478058b7506e3d53f44.patch";
+        hash = "sha256-f/+vDOC+kcmJVLtx1Y6OepoJBZhX30DULwSLnyQN5aI=";
+      })
+    ];
  };

  garage = garage_1;
@@ -397,6 +397,7 @@ mapAliases {
  blueberry = throw "'blueberry' has been removed as it is unmaintained upstream. Consider using blueman instead"; # Added 2026-03-09
  bmap-tools = throw "'bmap-tools' has been renamed to/replaced by 'bmaptool'"; # Converted to throw 2025-10-27
  bob = throw "'bob' has been removed as it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-12-29
+  boost177 = throw "Boost 1.77 has been removed as it is obsolete and no longer used by anything in Nixpkgs"; # Added 2026-04-20
  botan2 = throw "botan2 has been removed as it is EOL"; # Added 2025-10-20
  bower2nix = throw "bower2nix has been removed as bower was removed. It is recommended to migrate to yarn."; # Added 2025-09-17
  brasero-original = throw "'brasero-original' has been renamed to/replaced by 'brasero-unwrapped'"; # Converted to throw 2025-10-27
@@ -928,6 +929,7 @@ mapAliases {
  i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
  i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
  ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
+  icu69 = throw "ICU 69 has been removed as it is obsolete and no longer used by anything in Nixpkgs"; # Added 2026-04-20
  igvm-tooling = throw "'igvm-tooling' has been removed as it is poorly maintained upstream and a dependency has been marked insecure."; # Added 2025-09-03
  ikos = throw "ikos has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
  imagemagick6 = throw "'imagemagick6' was removed because it is outdated. Use 'imagemagick' instead."; # added 2026-02-27
@@ -1585,8 +1587,10 @@ mapAliases {
  pell = throw "'pell' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18
  pentablet-driver = throw "'pentablet-driver' has been renamed to/replaced by 'xp-pen-g430-driver'"; # Converted to throw 2025-10-27
  perceptual-diff = throw "perceptual-diff was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
+  percona-server_8_0 = throw "'percona-server_8_0' reaches end of life on 2026-04-30 and has been removed. Use 'percona-server_8_4'"; # Added 2026-04-09
  percona-server_innovation = throw "'percona-server_innovation' has been renamed to/replaced by 'percona-server'"; # Converted to throw 2025-10-27
  percona-server_lts = throw "'percona-server_lts' has been renamed to/replaced by 'percona-server'"; # Converted to throw 2025-10-27
+  percona-xtrabackup_8_0 = throw "'percona-xtrabackup_8_0' reaches end of life on 2026-04-30 and has been removed. Use 'percona-xtrabackup_8_4'"; # Added 2026-04-09
  percona-xtrabackup_innovation = throw "'percona-xtrabackup_innovation' has been renamed to/replaced by 'percona-xtrabackup'"; # Converted to throw 2025-10-27
  percona-xtrabackup_lts = throw "'percona-xtrabackup_lts' has been renamed to/replaced by 'percona-xtrabackup'"; # Converted to throw 2025-10-27
  peruse = throw "'peruse' has been removed as it depends on KDE Gear 5, which has reached EOL"; # Added 2025-08-20
@@ -3126,12 +3126,10 @@ with pkgs;
  patchutils_0_4_2 = callPackage ../tools/text/patchutils/0.4.2.nix { };

  inherit (import ../servers/sql/percona-server pkgs)
-    percona-server_8_0
    percona-server_8_4
    percona-server
    ;
  inherit (import ../tools/backup/percona-xtrabackup pkgs)
-    percona-xtrabackup_8_0
    percona-xtrabackup_8_4
    percona-xtrabackup
    ;
@@ -6099,7 +6097,6 @@ with pkgs;
      callPackage ../os-specific/linux/bionic-prebuilt { };

  inherit (callPackage ../development/libraries/boost { inherit (buildPackages) boost-build; })
-    boost177
    boost178
    boost179
    boost180
@@ -6522,7 +6519,6 @@ with pkgs;
    icu64
    icu66
    icu67
-    icu69
    icu70
    icu71
    icu72