Merge master into staging-next

2025-09-06 12:05:56 +00:00
parent 3bdbbf59dc 887bb085bf
commit 5c32d7788d
70 changed files with 1186 additions and 829 deletions
@@ -210,7 +210,7 @@ The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.
 This document details our standards for commit messages, reviews, licensing of contributions, etc...
 Everyone should read and understand these standards before submitting a pull request.

-### Rebasing between branches (i.e. from master to staging)
+### Rebasing between branches (i.e. from `master` to `staging`)
 [rebase]: #rebasing-between-branches-ie-from-master-to-staging

 Sometimes, changes must be rebased between branches.
@@ -271,8 +271,8 @@ To manually create a backport, follow [the standard pull request process][pr-cre
  Here is [an example](https://github.com/nixos/nixpkgs/commit/5688c39af5a6c5f3d646343443683da880eaefb8).

 > [!Warning]
-> Ensure the commits exist on the master branch.
-> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
+> Ensure the commits exist on the `master` branch.
+> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the `master` pull request.

 - In the pull request description, link to the original pull request to `master`.
  The pull request title should include `[YY.MM]` matching the release you're backporting to.
@@ -460,7 +460,7 @@ Is the change [acceptable for releases][release-acceptable] and do you wish to h
  - Yes: Use the `master` branch and [backport the pull request](#how-to-backport-pull-requests).
  - No: Create separate pull requests to the `master` and `release-YY.MM` branches.

-If the change causes a [mass rebuild][mass-rebuild], use the staging branch instead:
+If the change causes a [mass rebuild][mass-rebuild], use the `staging` branch instead:
 - Mass rebuilds to `master` should go to `staging` instead.
 - Mass rebuilds to `release-YY.MM` should go to `staging-YY.MM` instead.

@@ -492,8 +492,8 @@ In addition, major package version updates with breaking changes are also accept

 Which changes cause mass rebuilds is not formally defined.
 In order to help the decision, CI automatically assigns [`rebuild` labels](https://github.com/NixOS/nixpkgs/labels?q=rebuild) to pull requests based on the number of packages they cause rebuilds for.
-As a rule of thumb, if the number of rebuilds is **over 500**, it can be considered a mass rebuild.
-To get a sense for what changes are considered mass rebuilds, see [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged).
+As a rule of thumb, if the number of rebuilds is **500 or more**, consider targeting the `staging` branch instead of `master`; if the number is **1000 or more**, the pull request causes a mass rebuild, and should target the `staging` branch.
+See [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged) to get a sense for what changes are considered mass rebuilds.

 ## Commit conventions
 [commit-conventions]: #commit-conventions
@@ -337,7 +337,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/compilers/idris2 @mattpolzin

 # Bazel
-/pkgs/development/tools/build-managers/bazel @Profpatsch
+/pkgs/by-name/ba/bazel_7 @Profpatsch

 # NixOS modules for e-mail and dns services
 /nixos/modules/services/mail/mailman.nix    @peti
@@ -10083,6 +10083,12 @@
    githubId = 665472;
    matrix = "@hehongbo:matrix.org";
  };
+  heichro = {
+    github = "heichro";
+    githubId = 76887148;
+    keys = [ { fingerprint = "BBA7 9E8E 17FE 9C3F BFEA  61E8 30D0 186F 4E19 7E48"; } ];
+    name = "heichro";
+  };
  heijligen = {
    email = "src@posteo.de";
    github = "heijligen";
@@ -21771,6 +21777,18 @@
    githubId = 10631029;
    name = "Richard Ipsum";
  };
+  richardjacton = {
+    email = "richardjacton@richardjacton.net";
+    github = "richardjacton";
+    githubId = 6893043;
+    name = "Richard J. Acton";
+    matrix = "@richardjacton:matrix.org";
+    keys = [
+      {
+        fingerprint = "5EE1 1764 8462 E5A3 610C  1964 8E5D EFCF C330 7916";
+      }
+    ];
+  };
  richiejp = {
    email = "io@richiejp.com";
    github = "richiejp";
@@ -6,6 +6,8 @@

 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting [](#opt-system.rebuild.enableNg) to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option.

+- `rEFInd`, a graphical boot manager for UEFI systems, can now be used through [](#opt-boot.loader.refind.enable).
+
 - Secure boot support can now be enabled for the Limine bootloader through {option}`boot.loader.limine.secureBoot.enable`. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.

 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17.
@@ -1817,6 +1817,7 @@
  ./system/boot/loader/init-script/init-script.nix
  ./system/boot/loader/limine/limine.nix
  ./system/boot/loader/loader.nix
+  ./system/boot/loader/refind/refind.nix
  ./system/boot/loader/systemd-boot/systemd-boot.nix
  ./system/boot/luksroot.nix
  ./system/boot/modprobe.nix
@@ -0,0 +1,344 @@
+#!@python3@/bin/python3 -B
+
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+import datetime
+import json
+from ctypes import CDLL
+import os
+import psutil
+import re
+import shutil
+import subprocess
+import textwrap
+
+
+refind_dir = None
+libc = CDLL("libc.so.6")
+install_config = json.load(open('@configPath@', 'r'))
+
+
+def config(*path: str) -> Optional[Any]:
+    result = install_config
+    for component in path:
+        result = result[component]
+    return result
+
+
+def get_system_path(profile: str = 'system', gen: Optional[str] = None, spec: Optional[str] = None) -> str:
+    basename = f'{profile}-{gen}-link' if gen is not None else profile
+    profiles_dir = '/nix/var/nix/profiles'
+    if profile == 'system':
+        result = os.path.join(profiles_dir, basename)
+    else:
+        result = os.path.join(profiles_dir, 'system-profiles', basename)
+
+    if spec is not None:
+        result = os.path.join(result, 'specialisation', spec)
+
+    return result
+
+
+def get_profiles() -> List[str]:
+    profiles_dir = '/nix/var/nix/profiles/system-profiles/'
+    dirs = os.listdir(profiles_dir) if os.path.isdir(profiles_dir) else []
+
+    return [path for path in dirs if not path.endswith('-link')]
+
+
+def get_gens(profile: str = 'system') -> List[Tuple[int, List[str]]]:
+    nix_env = os.path.join(config('nixPath'), 'bin', 'nix-env')
+    output = subprocess.check_output([
+        nix_env, '--list-generations',
+        '-p', get_system_path(profile),
+        '--option', 'build-users-group', '',
+    ], universal_newlines=True)
+
+    gen_lines = output.splitlines()
+    gen_nums = [int(line.split()[0]) for line in gen_lines]
+
+    return [gen for gen in gen_nums][-config('maxGenerations'):]
+
+
+def is_encrypted(device: str) -> bool:
+    for name, _ in config('luksDevices'):
+        if os.readlink(os.path.join('/dev/mapper', name)) == os.readlink(device):
+            return True
+
+    return False
+
+
+def is_fs_type_supported(fs_type: str) -> bool:
+    return fs_type.startswith('vfat')
+
+
+paths = {}
+
+def get_copied_path_uri(path: str, target: str) -> str:
+    package_id = os.path.basename(os.path.dirname(path))
+    suffix = os.path.basename(path)
+    dest_file = f'{package_id}-{suffix}'
+    dest_path = os.path.join(refind_dir, target, dest_file)
+
+    if not os.path.exists(dest_path):
+        copy_file(path, dest_path)
+    else:
+        paths[dest_path] = True
+
+    return os.path.join('/efi/refind', target, dest_file)
+
+def get_path_uri(path: str) -> str:
+    return get_copied_path_uri(path, "")
+
+
+def get_file_uri(profile: str, gen: Optional[str], spec: Optional[str], name: str) -> str:
+    gen_path = get_system_path(profile, gen, spec)
+    path_in_store = os.path.realpath(os.path.join(gen_path, name))
+    return get_path_uri(path_in_store)
+
+
+def get_kernel_uri(kernel_path: str) -> str:
+    return get_copied_path_uri(kernel_path, "kernels")
+
+
+@dataclass
+class BootSpec:
+    system: str
+    init: str
+    kernel: str
+    kernelParams: List[str]
+    label: str
+    toplevel: str
+    specialisations: Dict[str, "BootSpec"]
+    initrd: str | None = None
+    initrdSecrets: str | None = None
+
+
+def bootjson_to_bootspec(bootjson: dict) -> BootSpec:
+    specialisations = bootjson['org.nixos.specialisation.v1']
+    specialisations = {k: bootjson_to_bootspec(v) for k, v in specialisations.items()}
+    return BootSpec(
+        **bootjson['org.nixos.bootspec.v1'],
+        specialisations=specialisations,
+    )
+
+
+def config_entry(is_sub: bool, bootspec: BootSpec, label: str, time: str) -> str:
+    entry = ""
+    if is_sub:
+        entry += 'sub'
+
+    entry += f'menuentry "{label}" {{\n'
+    entry += '  loader ' + get_kernel_uri(bootspec.kernel) + '\n'
+
+    if bootspec.initrd:
+        entry += '  initrd ' + get_kernel_uri(bootspec.initrd) + '\n'
+
+    entry += '  options "' + ' '.join(['init=' + bootspec.init] + bootspec.kernelParams).strip() + '"\n'
+    entry += '}\n'
+    return entry
+
+
+def generate_config_entry(profile: str, gen: str, special: bool, group_name: str) -> str:
+    time = datetime.datetime.fromtimestamp(os.stat(get_system_path(profile,gen), follow_symlinks=False).st_mtime).strftime("%F %H:%M:%S")
+    boot_json = json.load(open(os.path.join(get_system_path(profile, gen), 'boot.json'), 'r'))
+    boot_spec = bootjson_to_bootspec(boot_json)
+
+    specialisation_list = boot_spec.specialisations.items()
+    entry = ""
+
+    if len(specialisation_list) > 0:
+        entry += f'menuentry "NixOS {group_name} Generation {gen}" {{\n'
+        entry += config_entry(True, boot_spec, f'Default', str(time))
+
+        for spec, spec_boot_spec in specialisation_list:
+            entry += config_entry(True, spec_boot_spec, f'{spec}', str(time))
+
+        entry += '}\n'
+    else:
+        entry += config_entry(False, boot_spec, f'NixOS {group_name} Generation {gen}', str(time))
+    return entry
+
+
+def find_disk_device(part: str) -> str:
+    part = os.path.realpath(part)
+    part = part.removeprefix('/dev/')
+    disk = os.path.realpath(os.path.join('/sys', 'class', 'block', part))
+    disk = os.path.dirname(disk)
+
+    return os.path.join('/dev', os.path.basename(disk))
+
+
+def find_mounted_device(path: str) -> str:
+    path = os.path.abspath(path)
+
+    while not os.path.ismount(path):
+        path = os.path.dirname(path)
+
+    devices = [x for x in psutil.disk_partitions() if x.mountpoint == path]
+
+    assert len(devices) == 1
+    return devices[0].device
+
+
+def copy_file(from_path: str, to_path: str):
+    dirname = os.path.dirname(to_path)
+
+    if not os.path.exists(dirname):
+        os.makedirs(dirname)
+
+    shutil.copyfile(from_path, to_path + ".tmp")
+    os.rename(to_path + ".tmp", to_path)
+
+    paths[to_path] = True
+
+
+def install_bootloader() -> None:
+    global refind_dir
+
+    refind_dir = os.path.join(str(config('efiMountPoint')), 'efi', 'refind')
+
+    if not os.path.exists(refind_dir):
+        os.makedirs(refind_dir)
+    else:
+        for dir, dirs, files in os.walk(refind_dir, topdown=True):
+            for file in files:
+                paths[os.path.join(dir, file)] = False
+
+    profiles = [('system', get_gens())]
+
+    for profile in get_profiles():
+        profiles += [(profile, get_gens(profile))]
+
+    timeout = config('timeout')
+
+    last_gen = get_gens()[-1]
+    last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))
+    last_gen_boot_spec = bootjson_to_bootspec(last_gen_json)
+
+    config_file = str(config('extraConfig')) + '\n'
+    config_file += textwrap.dedent(f'''
+        timeout {timeout}
+        default_selection {3 if len(last_gen_boot_spec.specialisations.items()) > 0 else 2}
+    ''')
+
+    config_file += textwrap.dedent('''
+        # NixOS boot entries start here
+    ''')
+
+    for (profile, gens) in profiles:
+        group_name = 'default profile' if profile == 'system' else f"profile '{profile}'"
+        isFirst = True
+
+        for gen in sorted(gens, key=lambda x: x, reverse=True):
+            config_file += generate_config_entry(profile, gen, isFirst, group_name)
+            isFirst = False
+
+    config_file_path = os.path.join(refind_dir, 'refind.conf')
+    config_file += '\n# NixOS boot entries end here\n\n'
+
+    with open(f"{config_file_path}.tmp", 'w') as file:
+        file.truncate()
+        file.write(config_file.strip())
+        file.flush()
+        os.fsync(file.fileno())
+    os.rename(f"{config_file_path}.tmp", config_file_path)
+
+    paths[config_file_path] = True
+
+    for dest_path, source_path in config('additionalFiles').items():
+        dest_path = os.path.join(refind_dir, dest_path)
+
+        copy_file(source_path, dest_path)
+
+    cpu_family = config('hostArchitecture', 'family')
+    if cpu_family == 'x86':
+        if config('hostArchitecture', 'bits') == 32:
+            boot_file = 'BOOTIA32.EFI'
+            efi_file = 'refind_ia32.efi'
+        elif config('hostArchitecture', 'bits') == 64:
+            boot_file = 'BOOTX64.EFI'
+            efi_file = 'refind_x64.efi'
+    elif cpu_family == 'arm':
+        if config('hostArchitecture', 'arch') == 'armv8-a' and config('hostArchitecture', 'bits') == 64:
+            boot_file = 'BOOTAA64.EFI'
+            efi_file = 'refind_aa64.efi'
+        else:
+            raise Exception(f'Unsupported CPU arch: {config("hostArchitecture", "arch")}')
+    else:
+        raise Exception(f'Unsupported CPU family: {cpu_family}')
+
+    efi_path = os.path.join(config('refindPath'), 'share', 'refind', efi_file)
+    dest_path = os.path.join(config('efiMountPoint'), 'efi', 'boot' if config('efiRemovable') else 'refind', boot_file)
+
+    copy_file(efi_path, dest_path)
+
+    if not config('efiRemovable') and not config('canTouchEfiVariables'):
+        print('warning: boot.loader.efi.canTouchEfiVariables is set to false while boot.loader.limine.efiInstallAsRemovable.\n  This may render the system unbootable.')
+
+    if config('canTouchEfiVariables'):
+        if config('efiRemovable'):
+            print('note: boot.loader.limine.efiInstallAsRemovable is true, no need to add EFI entry.')
+        else:
+            efibootmgr = os.path.join(str(config('efiBootMgrPath')), 'bin', 'efibootmgr')
+            efi_partition = find_mounted_device(str(config('efiMountPoint')))
+            efi_disk = find_disk_device(efi_partition)
+
+            efibootmgr_output = subprocess.check_output([efibootmgr], stderr=subprocess.STDOUT, universal_newlines=True)
+
+            # Check the output of `efibootmgr` to find if rEFInd is already installed and present in the boot record
+            refind_boot_entry = None
+            if matches := re.findall(r'Boot([0-9a-fA-F]{4})\*? rEFInd', efibootmgr_output):
+                refind_boot_entry = matches[0]
+
+            # If there's already a Limine entry, replace it
+            if refind_boot_entry:
+                boot_order = re.findall(r'BootOrder: ((?:[0-9a-fA-F]{4},?)*)', efibootmgr_output)[0]
+
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-b', refind_boot_entry,
+                    '-B',
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-c',
+                    '-b', refind_boot_entry,
+                    '-d', efi_disk,
+                    '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                    '-l', f'\\efi\\refind\\{boot_file}',
+                    '-L', 'rEFInd',
+                    '-o', boot_order,
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+            else:
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-c',
+                    '-d', efi_disk,
+                    '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                    '-l', f'\\efi\\refind\\{boot_file}',
+                    '-L', 'rEFInd',
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+
+    print("removing unused boot files...")
+    for path in paths:
+        if not paths[path]:
+            os.remove(path)
+
+
+def main() -> None:
+    try:
+        install_bootloader()
+    finally:
+        # Since fat32 provides little recovery facilities after a crash,
+        # it can leave the system in an unbootable state, when a crash/outage
+        # happens shortly after an update. To decrease the likelihood of this
+        # event sync the efi filesystem after each update.
+        rc = libc.syncfs(os.open(f"{config('efiMountPoint')}", os.O_RDONLY))
+        if rc != 0:
+            print(f"could not sync {config('efiMountPoint')}: {os.strerror(rc)}", file=sys.stderr)
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,117 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    literalExpression
+    types
+    ;
+
+  cfg = config.boot.loader.refind;
+  efi = config.boot.loader.efi;
+  refindInstallConfig = pkgs.writeText "refind-install.json" (
+    builtins.toJSON {
+      nixPath = config.nix.package;
+      efiBootMgrPath = pkgs.efibootmgr;
+      refindPath = cfg.package;
+      efiMountPoint = efi.efiSysMountPoint;
+      fileSystems = config.fileSystems;
+      luksDevices = config.boot.initrd.luks.devices;
+      canTouchEfiVariables = efi.canTouchEfiVariables;
+      efiRemovable = cfg.efiInstallAsRemovable;
+      maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
+      hostArchitecture = pkgs.stdenv.hostPlatform.parsed.cpu;
+      timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else 10;
+      extraConfig = cfg.extraConfig;
+      additionalFiles = cfg.additionalFiles;
+    }
+  );
+in
+{
+  meta = {
+    inherit (pkgs.refind.meta) maintainers;
+  };
+
+  options = {
+    boot.loader.refind = {
+      enable = mkEnableOption "the rEFInd boot loader";
+      extraConfig = lib.mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          A string which is prepended to refind.conf.
+        '';
+      };
+      package = lib.mkPackageOption pkgs "refind" { };
+      maxGenerations = lib.mkOption {
+        default = null;
+        example = 50;
+        type = types.nullOr types.int;
+        description = ''
+          Maximum number of latest generations in the boot menu.
+          Useful to prevent boot partition of running out of disk space.
+          `null` means no limit i.e. all generations that were not
+          garbage collected yet.
+        '';
+      };
+      additionalFiles = mkOption {
+        default = { };
+        type = types.attrsOf types.path;
+        example = literalExpression ''
+          { "efi/memtest86/memtest86.efi" = "''${pkgs.memtest86-efi}/BOOTX64.efi"; }
+        '';
+        description = ''
+          A set of files to be copied to {file}`/boot`. Each attribute name denotes the
+          destination file name in {file}`/boot`, while the corresponding attribute value
+          specifies the source file.
+        '';
+      };
+      efiInstallAsRemovable = mkEnableOption null // {
+        default = !efi.canTouchEfiVariables;
+        defaultText = literalExpression "!config.boot.loader.efi.canTouchEfiVariables";
+        description = ''
+          Whether or not to install the rEFInd EFI files as removable.
+
+          See {option}`boot.loader.grub.efiInstallAsRemovable`
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          pkgs.stdenv.hostPlatform.isx86_64
+          || pkgs.stdenv.hostPlatform.isi686
+          || pkgs.stdenv.hostPlatform.isAarch64;
+        message = "rEFInd can only be installed on aarch64 & x86 platforms";
+      }
+      {
+        assertion = pkgs.stdenv.hostPlatform.isEfi;
+        message = "rEFInd can only be installed on UEFI platforms";
+      }
+    ];
+
+    # Common attribute for boot loaders so only one of them can be
+    # set at once.
+    system = {
+      boot.loader.id = "refind";
+      build.installBootLoader = pkgs.replaceVarsWith {
+        src = ./refind-install.py;
+        isExecutable = true;
+        replacements = {
+          python3 = pkgs.python3.withPackages (python-packages: [ python-packages.psutil ]);
+          configPath = refindInstallConfig;
+        };
+      };
+    };
+  };
+}
@@ -1291,6 +1291,7 @@ in
  redis = handleTest ./redis.nix { };
  redlib = runTest ./redlib.nix;
  redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
+  refind = runTest ./refind.nix;
  renovate = runTest ./renovate.nix;
  replace-dependencies = handleTest ./replace-dependencies { };
  reposilite = runTest ./reposilite.nix;
@@ -0,0 +1,25 @@
+{ lib, pkgs, ... }:
+{
+  name = "refind";
+  meta = {
+    inherit (pkgs.refind.meta) maintainers;
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.useBootLoader = true;
+      virtualisation.useEFIBoot = true;
+
+      boot.loader.grub.enable = false;
+      boot.loader.efi.canTouchEfiVariables = true;
+      boot.loader.refind.enable = true;
+      boot.loader.timeout = 1;
+    };
+
+  testScript = ''
+    machine.start()
+    with subtest('Machine boots correctly'):
+      machine.wait_for_unit('multi-user.target')
+  '';
+}
@@ -11998,6 +11998,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  oklch-color-picker-nvim = buildVimPlugin {
+    pname = "oklch-color-picker.nvim";
+    version = "2025-09-04";
+    src = fetchFromGitHub {
+      owner = "eero-lehtinen";
+      repo = "oklch-color-picker.nvim";
+      rev = "ae318113cd7d0e4988b6b059327c2778911f1187";
+      sha256 = "0xhraf89b1ppijqmg1gnwp4gvnnmf8h86n8d6s8ydgj910jvagzm";
+    };
+    meta.homepage = "https://github.com/eero-lehtinen/oklch-color-picker.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  ollama-nvim = buildVimPlugin {
    pname = "ollama.nvim";
    version = "2024-06-09";
@@ -921,6 +921,7 @@ https://github.com/nvimdev/oceanic-material/,,
 https://github.com/mhartington/oceanic-next/,,
 https://github.com/pwntester/octo.nvim/,,
 https://github.com/refractalize/oil-git-status.nvim/,HEAD,
+https://github.com/eero-lehtinen/oklch-color-picker.nvim/,HEAD,
 https://github.com/nomnivore/ollama.nvim/,HEAD,
 https://github.com/yonlu/omni.vim/,,
 https://github.com/Hoffs/omnisharp-extended-lsp.nvim/,HEAD,
@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
  core = "pcsx2";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-08-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "ps2";
-    rev = "c26b06ac2752a11ee47abc6f9c73595ee874341c";
-    hash = "sha256-c7y1jCRQd/o4RTrOeqltcH8HOwrb+BLtaw//0ZWW4E0=";
+    rev = "b0e6c4d7f4abc8cfbf2c55322fc5009a685bc042";
+    hash = "sha256-6cpVsituAWX6sVP5JUvT7KjYZ7SzvD95EB90e2UxJ9A=";
    fetchSubmodules = true;
  };

@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "143.0b7";
+  version = "143.0b8";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bf71930c7a5ab2c4ccc4f0179702491bd314763c469501f68df6cef0f1db57da6f16da77bc5d7692c0f5edf8ce616d8f927d2fa59c5c386217b9022a8e9802f8";
+    sha512 = "bf8e78abcc1cf6c8b48a591d0185c85195a818de0d13bafa3f004ad9c76364a2c07cacdf09fe0ae2e290d9cbce7b8c3ba4b57793cd3d39240023ef53eea08377";
  };

  meta = {
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "143.0b7";
+  version = "143.0b8";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "0c1c3af3412b14425df005b53af00e8af526cb6e0bc36f32f6bce1f4332959f35ffed4b795a40e004a41fea9747a7b7c7f6cacfd70b6ef4f54b47556cdc31ec5";
+    sha512 = "89152a4dd3e17f68d7991fae65a6365a2273fcbef28c245a76e9e068a1f12c486a7d0c6d3cb8988c1c9955b15809fa93e117e25b04f9b1a9d449e685cbf30cfc";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
@@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "airgorah";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "martin-olivier";
    repo = "airgorah";
    tag = "v${version}";
-    hash = "sha256-cIb40TKkk3gfy4dTP8WyZqQkRGj5nItaQ3NSfexCUOA=";
+    hash = "sha256-6TH+DRDtWajZjHNmFSKL4XJK+AuDNUbWKRPRryOpSGY=";
  };

-  cargoHash = "sha256-3Les/A9fBBjU6NSVVEyXCbjrNSdaEgCl5pZ36ceRDQg=";
+  cargoHash = "sha256-LiSaNyqsKBZ5nNP7mws1pjhVwTXNBF6e1wSUdG/qYog=";

  nativeBuildInputs = [
    pkg-config
@@ -369,7 +369,7 @@ stdenv.mkDerivation rec {
    # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
    # This is breaking the build of any C target. This patch removes the last
    # argument if it's found to be an empty string.
-    ../trim-last-argument-to-gcc-if-empty.patch
+    ./trim-last-argument-to-gcc-if-empty.patch

    # --experimental_strict_action_env (which may one day become the default
    # see bazelbuild/bazel#2574) hardcodes the default
@@ -377,13 +377,13 @@ stdenv.mkDerivation rec {
    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
    # So we are replacing this bazel paths by defaultShellPath,
    # improving hermeticity and making it work in nixos.
-    (replaceVars ../strict_action_env.patch {
+    (replaceVars ./strict_action_env.patch {
      strictActionEnvPatch = defaultShellPath;
    })

    # bazel reads its system bazelrc in /etc
    # override this path to a builtin one
-    (replaceVars ../bazel_rc.patch {
+    (replaceVars ./bazel_rc.patch {
      bazelSystemBazelRCPath = bazelRC;
    })
  ]
@@ -90,29 +90,33 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {

  dontCargoSetupPostUnpack = true;

-  # Should not be necessary after 25.9
-  patches = lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
-    url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
-    sha256 = "7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
-  });
+  patches =
+    lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
+      # Disable building WASM lexer
+      url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
+      sha256 = "7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
+    })
+    ++
+
+      lib.optional (lib.versions.majorMinor version == "25.8" && stdenv.hostPlatform.isDarwin)
+        (fetchpatch {
+          # Do not intercept memalign on darwin
+          url = "https://github.com/ClickHouse/ClickHouse/commit/0cfd2dbe981727fb650f3b9935f5e7e7e843180f.patch";
+          sha256 = "1iNYZbugX2g2dxNR1ZiUthzPnhLUR8g118aG23yhgUo=";
+        });

  postPatch = ''
    patchShebangs src/ utils/
-
-    sed -i 's|/usr/bin/env perl|"${lib.getExe perl}"|' contrib/openssl-cmake/CMakeLists.txt
-
-    substituteInPlace utils/list-licenses/list-licenses.sh \
-      --replace-fail '$(git rev-parse --show-toplevel)' "$NIX_BUILD_TOP/$sourceRoot"
-  ''
-  + lib.optionalString (lib.versions.majorMinor version <= "25.6") ''
-    substituteInPlace src/Storages/System/StorageSystemLicenses.sh \
-       --replace-fail '$(git rev-parse --show-toplevel)' "$NIX_BUILD_TOP/$sourceRoot"
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    substituteInPlace cmake/tools.cmake \
      --replace-fail 'gfind' 'find' \
      --replace-fail 'ggrep' 'grep' \
      --replace-fail '--ld-path=''${LLD_PATH}' '-fuse-ld=lld'
+
+    substituteInPlace utils/list-licenses/list-licenses.sh \
+      --replace-fail 'gfind' 'find' \
+      --replace-fail 'ggrep' 'grep'
  ''
  # Rust is handled by cmake
  + lib.optionalString rustSupport ''
@@ -12,18 +12,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.29.0";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-YCQfycmDPRxMAqo57tt/6IXkUn1JIPTzEHMNbt7m3w0=";
+    hash = "sha256-9dWVf5Q7sDfAbRIGvUqqwEouJRnS//ujlFvqZ/a8zBk=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-kGjpqkV0OJW8mOW/OhyfXoTgLHHrtHQcw9c8zyVtzgs=";
+  cargoHash = "sha256-qJn2oN/9LVLhHnaNp+x9cUEMODrGrgV3SiR0ykIx7B4=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "emmylua_doc_cli";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "EmmyLuaLs";
    repo = "emmylua-analyzer-rust";
    tag = finalAttrs.version;
-    hash = "sha256-IXoiXfRnGOZQ7c8AJaK8OGjqp1bczd/tKjtpbYdCZlU=";
+    hash = "sha256-93PlsVvlUravsnW7YBCii04jCEJPP+6U2vYbVBjcX8M=";
  };

  buildAndTestSubdir = "crates/emmylua_doc_cli";

-  cargoHash = "sha256-7QQipbnqelLdzQr+lIORyQNM9SS5yHaJLQ31M52lYCw=";
+  cargoHash = "sha256-SbsYlIVWDpBU2bxJqXUtOiMHkOoa8Up27X7rVKLLLm0=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -0,0 +1,21 @@
+diff --git a/src/raster_to_epson.c b/src/raster_to_epson.c
+index 6e621c8..a5ca797 100644
+--- a/src/raster_to_epson.c
+++ b/src/raster_to_epson.c
+@@ -438,14 +438,14 @@ static int print_page (void)
+ 					break;
+ 				}
+ 
+-				if (eps_raster_print(raster_h, image_raw, pageRegion.bytesPerLine, pageRegion.width, &nraster)) {
+				if (eps_raster_print(raster_h, image_raw, pageRegion.bytesPerLine, pageRegion.width, (int *) &nraster)) {
+ 					error  = 1;
+ 					break;
+ 				}
+ 			}
+ 
+ 			// flushing page
+-			eps_raster_print(raster_h, NULL, 0, 0, &nraster);
+			eps_raster_print(raster_h, NULL, 0, 0, (int *) &nraster);
+ 
+ 			bAbort = (error) ? TRUE : FALSE;
+ 			if (epcgEndPage (bAbort)) {
@@ -0,0 +1,23 @@
+diff --git a/src/pagemanager/pagemanager.c b/src/pagemanager/pagemanager.c
+index 029e6d3..2881585 100644
+--- a/src/pagemanager/pagemanager.c
+++ b/src/pagemanager/pagemanager.c
+@@ -23,6 +23,7 @@
+ #include "debuglog.h"
+ #include "memory.h"
+ #include "raster.h"
+#include "raster-helper.h"
+ #include "pagemanager.h"
+
+ extern int JobCanceled;
+diff --git a/src/raster_to_epson.c b/src/raster_to_epson.c
+index 6e621c8..6eea77c 100644
+--- a/src/raster_to_epson.c
+++ b/src/raster_to_epson.c
+@@ -36,6 +36,7 @@
+ #include "raster.h"
+ #include "memory.h"
+ #include "raster_to_epson.h"
+#include "raster-helper.h"
+ #include "pagemanager.h"
+ #include "filter_option.h"
@@ -0,0 +1,131 @@
+{
+  autoreconfHook,
+  cups,
+  libjpeg,
+  rpmextract,
+  fetchurl,
+  lib,
+  stdenv,
+}:
+
+let
+  srcdirs = {
+    filter = "epson-inkjet-printer-filter-1.0.0";
+    driver = "epson-inkjet-printer-workforce-840-series-1.0.0";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "epson-inkjet-printer-workforce-840-series";
+  version = "1.0.0";
+
+  # The Epson may be unreliable, and it has been since sometime in
+  # 2024. Non-browser requests using commands like fetchurl receive a
+  # 403 error, an access denied response -- last checked on
+  # 2025-08-21.
+  #
+  # Therefore, an archive.org link has been added as a fallback
+  # option just in case.
+  src = fetchurl {
+    # NOTE: Don't forget to update the webarchive link too!
+    urls = [
+      "https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-workforce-840-series-${finalAttrs.version}-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-workforce-840-series-${finalAttrs.version}-1lsb3.2.src.rpm"
+    ];
+    hash = "sha256-rTYnEmgzqR/wOZYYIe2rO9x2cX8s2qDyTuRaTjzJjbg=";
+  };
+  sourceRoot = srcdirs.filter;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    rpmextract
+  ];
+  buildInputs = [
+    cups
+    libjpeg
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    rpmextract "$src"
+    for i in ${lib.concatStringsSep " " (builtins.attrValues srcdirs)}; do
+        tar xvf "$i".tar.gz
+    done
+
+    runHook postUnpack
+  '';
+
+  # Both patches fix errors that occur when building with GCC 14.
+  #
+  # eps_raster_print-cast.patch fixes 'error: passing argument 5 of
+  # ‘eps_raster_print’ from incompatible pointer type' in file
+  # raster_to_epson.c
+  #
+  # include-raster-helper.patch fixes 'error: implicit declaration of
+  # function' in files pagemanager.c and raster_to_epson.c
+  patches = [
+    ./eps_raster_print-cast.patch
+    ./include-raster-helper.patch
+  ];
+
+  installPhase =
+    let
+      filterdir = "$out/lib/cups/filter";
+      docdir = "$out/share/doc/epson-inkjet-printer-workforce-840-series";
+      ppddir = "$out/share/cups/model/epson-inkjet-printer-workforce-840-series";
+      libdir =
+        if stdenv.hostPlatform.isx86_64 then
+          "lib64"
+        else
+          throw "Platforms other than x86_64-linux are not (yet) supported.";
+    in
+    ''
+      runHook preInstall
+
+      mkdir -p "$out" "${docdir}" "${filterdir}" "${ppddir}"
+      cp src/epson_inkjet_printer_filter "${filterdir}"
+
+      cp AUTHORS COPYING COPYING.EPSON COPYING.LIB "${docdir}"
+
+      cd ../${srcdirs.driver}
+      cp Manual.txt README "${docdir}"
+      for ppd in ppds/*; do
+          substituteInPlace "$ppd" --replace-fail '/opt/epson-inkjet-printer-workforce-840-series/cups/lib' "$out/lib/cups"
+          gzip -c "$ppd" > "${ppddir}/''${ppd#*/}"
+      done
+      cp -r resource watermark ${libdir} "$out"
+
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "Proprietary CUPS drivers for Epson inkjet printers";
+    longDescription = ''
+      This software is a filter program used with the Common UNIX Printing
+      System (CUPS) under Linux. It supplies high quality printing with
+      Seiko Epson Color Ink Jet Printers.
+
+      This printer driver is supporting the following printers.
+
+      Epson Stylus Office BX925
+      Epson WorkForce 840
+
+      To use the driver adjust your configuration.nix file:
+      ```nix
+      {
+        services.printing = {
+          enable = true;
+          drivers = [ pkgs.epson-inkjet-printer-workforce-840-series ];
+        };
+      }
+      ```
+    '';
+    downloadPage = "http://download.ebz.epson.net/dsc/du/02/DriverDownloadInfo.do?LG2=EN&CN2=&DSCMI=16839&DSCCHK=3d7bc6bdfca08006abfb859fb1967183156a7252";
+    license = with lib.licenses; [
+      lgpl21
+      epson
+    ];
+    maintainers = with lib.maintainers; [ heichro ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
@@ -33,10 +33,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoHash = "sha256-AdatJNDqIoRHfaf81iFhOs2JGLIxy7agFJj96bFPj00=";

  npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-izCl3pE15ocEGYOYCUR1iTR+82nDB06Ed4YOGRGByfI=";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-ehXGLpCCN+BNqtwjEatcfR0kQHj5WOofTDR5mLSVW0U=";
  };

+  patches = [
+    # Remove after https://github.com/gulbanana/gg/pull/68 is released
+    ./update-tauri-npm-to-match-cargo.patch
+  ];
+
  nativeBuildInputs = [
    cargo-tauri.hook
    nodejs
@@ -0,0 +1,81 @@
+From 627de4bd148229a1feb327262b9f0b2a75077ed3 Mon Sep 17 00:00:00 2001
+From: Mitchell Skaggs <skaggsm333@gmail.com>
+Date: Mon, 1 Sep 2025 19:02:19 -0500
+Subject: [PATCH] update `@tauri-apps/api` and `@tauri-apps/plugin-shell` to
+ match Cargo versions
+
+In Tauri *CLI* versions >=2.8.0, the build fails if NPM and Cargo versions
+are not aligned. This is not a new requirement, this merely verifies an
+existing requirement. The CLI version in Nixpkgs was updated and now
+detects this already-existing error.
+
+This pulls the NPM versions up to match the existing Cargo versions
+without touching any other dependencies.
+---
+ package-lock.json | 18 +++++++++---------
+ package.json      |  4 ++--
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/package-lock.json b/package-lock.json
+index 3affe19..ebe27e7 100644
+--- a/package-lock.json
+++ b/package-lock.json
+@@ -9,8 +9,8 @@
+       "version": "0.29.0",
+       "dependencies": {
+         "@catppuccin/palette": "^1.0.3",
+-        "@tauri-apps/api": "^2.0.0-beta.0",
+-        "@tauri-apps/plugin-shell": "^2.0.0-beta.0",
+        "@tauri-apps/api": "^2.4.1",
+        "@tauri-apps/plugin-shell": "2.2.1",
+         "feather-icons": "^4.29.1",
+         "modern-normalize": "^2.0.0"
+       },
+@@ -793,9 +793,9 @@
+       }
+     },
+     "node_modules/@tauri-apps/api": {
+-      "version": "2.1.1",
+-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
+-      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.4.1.tgz",
+      "integrity": "sha512-5sYwZCSJb6PBGbBL4kt7CnE5HHbBqwH+ovmOW6ZVju3nX4E3JX6tt2kRklFEH7xMOIwR0btRkZktuLhKvyEQYg==",
+       "license": "Apache-2.0 OR MIT",
+       "funding": {
+         "type": "opencollective",
+@@ -1002,9 +1002,9 @@
+       }
+     },
+     "node_modules/@tauri-apps/plugin-shell": {
+-      "version": "2.0.1",
+-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.0.1.tgz",
+-      "integrity": "sha512-akU1b77sw3qHiynrK0s930y8zKmcdrSD60htjH+mFZqv5WaakZA/XxHR3/sF1nNv9Mgmt/Shls37HwnOr00aSw==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.1.tgz",
+      "integrity": "sha512-G1GFYyWe/KlCsymuLiNImUgC8zGY0tI0Y3p8JgBCWduR5IEXlIJS+JuG1qtveitwYXlfJrsExt3enhv5l2/yhA==",
+       "license": "MIT OR Apache-2.0",
+       "dependencies": {
+         "@tauri-apps/api": "^2.0.0"
+@@ -2054,4 +2054,4 @@
+       "license": "ISC"
+     }
+   }
+-}
+\ No newline at end of file
+}
+diff --git a/package.json b/package.json
+index 6000620..9d61871 100644
+--- a/package.json
+++ b/package.json
+@@ -14,8 +14,8 @@
+   },
+   "dependencies": {
+     "@catppuccin/palette": "^1.0.3",
+-    "@tauri-apps/api": "^2.0.0-beta.0",
+-    "@tauri-apps/plugin-shell": "^2.0.0-beta.0",
+    "@tauri-apps/api": "^2.4.1",
+    "@tauri-apps/plugin-shell": "2.2.1",
+     "feather-icons": "^4.29.1",
+     "modern-normalize": "^2.0.0"
+   },
@@ -0,0 +1,73 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "globus-cli";
+  version = "3.36.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "globus";
+    repo = "globus-cli";
+    tag = version;
+    hash = "sha256-Phu7nXMICSBFUX8wfzwA4ORBJIkhTDCMCqTyZvcG93c=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    ruamel-yaml
+  ];
+
+  dependencies = with python3Packages; [
+    globus-sdk
+    click
+    jmespath
+    packaging
+    typing-extensions
+    requests
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest
+    pytest-xdist
+    pytest-timeout
+    responses
+
+    click
+    requests
+    pyjwt
+    cryptography
+    packaging
+    typing-extensions
+
+    pytestCheckHook
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "version";
+
+  postInstall = ''
+    mkdir -p completions/{bash,zsh}
+    $out/bin/globus --bash-completer > completions/bash/globus
+    $out/bin/globus --zsh-completer > completions/zsh/_globus
+    installShellCompletion \
+      --bash completions/bash/globus \
+      --zsh completions/zsh/_globus
+  '';
+
+  meta = {
+    mainProgram = "globus";
+    description = "Command-line interface to Globus REST APIs, including the Transfer API and the Globus Auth API";
+    homepage = "https://github.com/globus/globus-cli";
+    changelog = "https://github.com/globus/globus-cli/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.richardjacton ];
+  };
+}
@@ -6,7 +6,7 @@
 }:

 let
-  version = "1.7.49.2";
+  version = "1.7.49.4";
 in
 stdenvNoCC.mkDerivation {
  pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {

  src = fetchzip {
    url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-Yu7uFoim12pe4OT/dSsQVcZ6nyYGKWLJbsfLFtI05Z8=";
+    hash = "sha256-ZOhZ5O5s8P4nqjSsLEu4RpyTfZ34YBi0itETwcRdIPQ=";
  };

  patches = [
@@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  grub2_xen,
-}:
-
-let
-  efiSystemsBuild = {
-    i686-linux.target = "i386";
-    x86_64-linux.target = "x86_64";
-    armv7l-linux.target = "arm";
-    aarch64-linux.target = "aarch64";
-    riscv32-linux.target = "riscv32";
-    riscv64-linux.target = "riscv64";
-  };
-
-in
-(
-
-  stdenv.mkDerivation rec {
-    name = "pvgrub-image";
-
-    configs = ./configs;
-
-    buildInputs = [ grub2_xen ];
-
-    buildCommand = ''
-      cp "${configs}"/* .
-      tar -cf memdisk.tar grub.cfg
-      # We include all modules except all_video.mod as otherwise grub will fail printing "no symbol table"
-      # if we include it.
-      grub-mkimage -O "${
-        efiSystemsBuild.${stdenv.hostPlatform.system}.target
-      }-xen" -c grub-bootstrap.cfg \
-        -m memdisk.tar -o "grub-${efiSystemsBuild.${stdenv.hostPlatform.system}.target}-xen.bin" \
-        $(ls "${grub2_xen}/lib/grub/${
-          efiSystemsBuild.${stdenv.hostPlatform.system}.target
-        }-xen/" |grep 'mod''$'|grep -v '^all_video\.mod''$')
-      mkdir -p "$out/lib/grub-xen"
-      cp "grub-${efiSystemsBuild.${stdenv.hostPlatform.system}.target}-xen.bin" $out/lib/grub-xen/
-    '';
-
-    meta = with lib; {
-      description = "PvGrub image for use for booting PV Xen guests";
-
-      longDescription = ''
-        This package provides a PvGrub image for booting Para-Virtualized (PV)
-        Xen guests
-      '';
-
-      platforms = platforms.gnu ++ platforms.linux;
-    };
-  }
-)
@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  grub2_xen,
+  grub2_xen_pvh,
+  grubPlatform ? "xen_pvh",
+}:
+
+assert lib.assertOneOf "grubPlatform" grubPlatform [
+  "xen"
+  "xen_pvh"
+];
+let
+  targets = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = if grubPlatform == "xen_pvh" then "i386" else "x86_64";
+  };
+in
+stdenv.mkDerivation {
+  name = "grub2_${grubPlatform}_image";
+
+  env = {
+    GRUB_CONFIGS = "${./configs}";
+    GRUB_FORMAT = "${targets.${stdenv.buildPlatform.system}.target}-${grubPlatform}";
+  };
+
+  buildInputs =
+    lib.optional (grubPlatform == "xen") grub2_xen
+    ++ lib.optional (grubPlatform == "xen_pvh") grub2_xen_pvh;
+
+  dontUnpack = true;
+
+  buildPhase = ''
+    cp "$GRUB_CONFIGS"/* .
+    tar -cf memdisk.tar grub.cfg
+    grub-mkimage \
+      -O "$GRUB_FORMAT" \
+      -c grub-bootstrap.cfg \
+      -m memdisk.tar \
+      -o grub-"$GRUB_FORMAT".bin \
+      ${if grubPlatform == "xen_pvh" then grub2_xen_pvh else grub2_xen}/lib/grub/"$GRUB_FORMAT"/*.mod
+  '';
+
+  installPhase = ''
+    mkdir -p "$out/lib/grub-${grubPlatform}"
+    cp grub-"$GRUB_FORMAT".bin $out/lib/grub-${grubPlatform}/
+  '';
+
+  dontFixup = true;
+
+  meta = {
+    description = "PvGrub2 image for booting ${
+      if grubPlatform == "xen_pvh" then "PVH" else "PV"
+    } Xen guests";
+
+    longDescription =
+      if (grubPlatform == "xen_pvh") then
+        ''
+          This package provides a prebuilt PvGrub2 image for booting PVH Xen
+          guests (also commonly referred to as PvhGrub2), which searches for
+          `grub.cfg` on the guest disk and interprets it to load the kernel,
+          eliminating the need to copy the guest kernel to the Dom0.
+
+          You will need `pkgs.grub2_xen_pvh` to build a customized PvhGrub2
+          image. See [PvGrub2](https://wiki.xenproject.org/wiki/PvGrub2) for
+          more explanations.
+        ''
+      else
+        ''
+          This package provides a prebuilt PvGrub2 image for booting PV Xen
+          guests, which searches for `grub.cfg` on the guest disk and interprets
+          it to load the kernel, eliminating the need to copy the guest kernel
+          to the Dom0.
+
+          You will need `pkgs.grub2_xen` to build a customized PvGrub2 image.
+          See [PvGrub2](https://wiki.xenproject.org/wiki/PvGrub2) for more
+          explanations.
+        '';
+
+    teams = [ lib.teams.xen ];
+    platforms = lib.attrNames targets;
+  };
+}
@@ -10,7 +10,7 @@
  kddockwidgets,
  kdePackages,
  libelf,
-  linuxPackages,
+  perf,
  qt6,
  rustc-demangle,
  zstd,
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
  qtWrapperArgs = [
    "--suffix PATH : ${
      lib.makeBinPath [
-        linuxPackages.perf
+        perf
        binutils
      ]
    }"
@@ -0,0 +1,62 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  installShellFiles,
+  oniguruma,
+  rust-jemalloc-sys,
+  stdenv,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mado";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "akiomik";
+    repo = "mado";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wAuV4w0dKfUbJVLTdp59/u4y13SPy3wkRfTlpvyE/zY=";
+  };
+
+  cargoHash = "sha256-fkalUnPkjjzhLaACh+WQP4tG5VzZ7wmrh5T1DVgSDwM=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+  ];
+
+  buildInputs = [
+    oniguruma
+    rust-jemalloc-sys
+  ];
+
+  env = {
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  };
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd mado \
+      --bash <($out/bin/mado generate-shell-completion bash) \
+      --zsh <($out/bin/mado generate-shell-completion zsh) \
+      --fish <($out/bin/mado generate-shell-completion fish)
+  '';
+
+  checkFlags = [
+    #   # seem to be slightly broken inside of the build sandbox
+    "--skip=check_empty_stdin_with_file"
+    "--skip=check_stdin"
+    "--skip=check_stdin_with_file"
+    "--skip=generate_shell_completion_invalid"
+    "--skip=unknown_command"
+  ];
+
+  meta = {
+    description = "Markdown linter written in Rust";
+    homepage = "https://github.com/akiomik/mado";
+    changelog = "https://github.com/akiomik/mado/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jasonxue1 ];
+    mainProgram = "mado";
+  };
+})
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook-i18n-helpers";
-  version = "0.3.5";
+  version = "0.3.6";

  src = fetchFromGitHub {
    owner = "google";
    repo = "mdbook-i18n-helpers";
    # TODO fix once upstream uses semver for tags again
    tag = "mdbook-i18n-helpers-${version}";
-    hash = "sha256-FdguzuYpMl6i1dvoPNE1Bk+GTmeTrqLUY/sVRsbETtU=";
+    hash = "sha256-9sJ9FK85UzY3ggh3h1fipbh0LraTvQJ0ZfhSGcahiDM=";
  };

-  cargoHash = "sha256-ZBGMfJA2diPvvoIXPosUs4ngXU9/GMGa4GAlKIjwm8s=";
+  cargoHash = "sha256-ZinW9UFp03LXtk+9vuSNojVZtaA7uBlrpdapY48nZdY=";

  meta = {
    description = "Helpers for a mdbook i18n workflow based on Gettext";
@@ -22,12 +22,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "0.6.3";
+  version = "0.6.4";
  src = fetchFromGitHub {
    owner = "sst";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hufgCO3g0WZT4+hX1lqmhvrthFO30c0NS3ryNJMmOxo=";
+    hash = "sha256-o7SzDGbWgCh8cMNK+PeLxAw0bQMKFouHdedUslpA6gw=";
  };

  tui = buildGoModule {
@@ -135,6 +135,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      --define OPENCODE_TUI_PATH="'${finalAttrs.tui}/bin/tui'" \
      --define OPENCODE_VERSION="'${finalAttrs.version}'" \
      --compile \
+      --compile-exec-argv="--" \
      --target=${bun-target.${stdenvNoCC.hostPlatform.system}} \
      --outfile=opencode \
      ./packages/opencode/src/index.ts \
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "openlinkhub";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "jurkovic-nikola";
    repo = "OpenLinkHub";
    tag = version;
-    hash = "sha256-kEbJwCAs2gTNs0z8A3kOl1O4HQ4L5+urTo+hLh6vOPM=";
+    hash = "sha256-fmWfHJ6alB+UlHlUrwMQ/npv7SuMjAz5hT0UGhB7O/E=";
  };

  proxyVendor = true;
@@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchurl,
-  kernel,
+  linux_latest,
  elfutils,
  python3,
  newt,
@@ -20,14 +20,11 @@
  binutils-unwrapped,
  libiberty,
  audit,
-  libbfd,
-  libbfd_2_38,
  libopcodes,
-  libopcodes_2_38,
  libpfm,
  libtraceevent,
  openssl,
-  systemtap,
+  systemtap-unwrapped,
  numactl,
  zlib,
  babeltrace,
@@ -57,43 +54,28 @@ in

 stdenv.mkDerivation {
  pname = "perf-linux";
-  inherit (kernel) version src;
+  inherit (linux_latest) version src;

  strictDeps = true;

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  patches =
-    lib.optionals (lib.versionAtLeast kernel.version "5.10" && lib.versionOlder kernel.version "6.13")
-      [
-        # fix wrong path to dmesg
-        ./fix-dmesg-path.diff
-      ];
-
  postPatch = ''
    # Linux scripts
    patchShebangs scripts
    patchShebangs tools/perf/check-headers.sh
-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "6.3") ''
    # perf-specific scripts
    patchShebangs tools/perf/pmu-events
-  ''
-  + ''
    cd tools/perf

    for x in util/build-id.c util/dso.c; do
      substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
    done

-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
    substituteInPlace scripts/python/flamegraph.py \
      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"

-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
    patchShebangs pmu-events/jevents.py
  '';

@@ -137,33 +119,14 @@ stdenv.mkDerivation {
    numactl
    python3
    babeltrace
+    libopcodes
+    libpfm
+    python3.pkgs.setuptools
  ]
-  ++ (
-    if (lib.versionAtLeast kernel.version "5.19") then
-      [
-        libbfd
-        libopcodes
-      ]
-    else
-      [
-        libbfd_2_38
-        libopcodes_2_38
-      ]
-  )
-  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap) systemtap.stapBuild
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap-unwrapped) systemtap-unwrapped
  ++ lib.optional withGtk gtk2
  ++ lib.optional withZstd zstd
-  ++ lib.optional withLibcap libcap
-  ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
-  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools
-  # Python 3.12 no longer includes distutils, not needed for 6.0 and newer.
-  ++
-    lib.optional
-      (!(lib.versionAtLeast kernel.version "6.0") && lib.versionAtLeast python3.version "3.12")
-      [
-        python3.pkgs.distutils
-        python3.pkgs.packaging
-      ];
+  ++ lib.optional withLibcap libcap;

  env.NIX_CFLAGS_COMPILE = toString [
    "-Wno-error=cpp"
@@ -206,6 +169,5 @@ stdenv.mkDerivation {
    mainProgram = "perf";
    maintainers = with maintainers; [ tobim ];
    platforms = platforms.linux;
-    broken = kernel.kernelOlder "5";
  };
 }
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "postgres-lsp";
-  version = "0.10.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "supabase-community";
    repo = "postgres-language-server";
    tag = finalAttrs.version;
-    hash = "sha256-RwUX5EXRyvmC8LCnlQQIbqnLGn7XYXjLsI9UurCAThs=";
+    hash = "sha256-0Q8MxKeh12STWIJ9441uTz+qQXEJjCESj21C4X8CBC4=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-qs/M9+iZCx75wv+UcRRH4hjEuNDsnJYKAvnd0DNaRQ8=";
+  cargoHash = "sha256-oIbS5BUpNOXwiRconqJI/jdXeX05FIZVNl2kYt+79wY=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
@@ -71,6 +71,11 @@ python3.pkgs.buildPythonApplication rec {
    python3.pkgs.pytestCheckHook
  ];

+  # Enable when https://github.com/containers/ramalama/pull/1891 is released
+  disabledTests = [
+    "test_ollama_model_pull"
+  ];
+
  passthru = {
    tests = {
      withoutPodman = ramalama.override {
@@ -163,6 +163,7 @@ stdenv.mkDerivation rec {

  passthru.tests = {
    uefiCdrom = nixosTests.boot.uefiCdrom;
+    inherit (nixosTests) refind;
  };

  meta = with lib; {
@@ -183,7 +184,10 @@ stdenv.mkDerivation rec {
      Linux kernels that provide EFI stub support.
    '';
    homepage = "http://refind.sourceforge.net/";
-    maintainers = with maintainers; [ johnrtitor ];
+    maintainers = with maintainers; [
+      johnrtitor
+      RossComputerGuy
+    ];
    platforms = [
      "i686-linux"
      "x86_64-linux"
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "repomix";
-  version = "1.3.0";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "yamadashy";
    repo = "repomix";
    tag = "v${version}";
-    hash = "sha256-09neN7sh4TRM+rQBqCQHqW165i6+RY9IF67ft6OgyhI=";
+    hash = "sha256-65A8HN0Mp8QOEfIjiDZwr/qgWe57XTCdd1eBd3mm9fE=";
  };

-  npmDepsHash = "sha256-nLxIPwx+zvYCMZ6y9ntbWvrJvO4g5J7Tf9rYk26gyAs=";
+  npmDepsHash = "sha256-PfElq+C8kazP3OLF5LFAZitIXhVpWdj/fCyH2S7d/zg=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  pkg-config,
+  gettext,
+  cpio,
+  elfutils,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "systemtap";
+  version = "5.2";
+
+  src = fetchgit {
+    url = "git://sourceware.org/git/systemtap.git";
+    rev = "release-${finalAttrs.version}";
+    hash = "sha256-SUPNarZW8vdK9hQaI2kU+rfKWIPiXB4BvJvRNC1T9tU=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cpio
+    python3
+    python3.pkgs.setuptools
+  ];
+  buildInputs = [
+    elfutils
+    gettext
+    python3
+  ];
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://sourceware.org/systemtap/";
+    description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
+    license = lib.licenses.gpl2;
+    platforms = lib.systems.inspect.patterns.isGnu;
+  };
+})
@@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  fetchFromGitea,
+  installShellFiles,
 }:

 buildGoModule rec {
@@ -28,4 +29,20 @@ buildGoModule rec {
    ];
    mainProgram = "tea";
  };
+
+  ldflags = [
+    "-X code.gitea.io/tea/cmd.Version=${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd tea \
+      --bash <($out/bin/tea completion bash) \
+      --fish <($out/bin/tea completion fish) \
+      --zsh <($out/bin/tea completion zsh)
+
+    mkdir $out/share/powershell/ -p
+    $out/bin/tea completion pwsh > $out/share/powershell/tea.Completion.ps1
+  '';
 }
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ultrastardx";
-  version = "2025.8.0";
+  version = "2025.9.0";

  src = fetchFromGitHub {
    owner = "UltraStar-Deluxe";
    repo = "USDX";
    rev = "v${version}";
-    hash = "sha256-rliUJNhvbXbD+ELxwutCoQs6BO1DyJ8J/+mmYHPuvQE=";
+    hash = "sha256-SQqmcFchXaYNKzQHjBcisZTjAN9TTWuKXv657yWGghw=";
  };

  nativeBuildInputs = [
@@ -19,14 +19,14 @@ python3Packages.buildPythonApplication rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2025.08.27";
+  version = "2025.09.05";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "yt-dlp";
    repo = "yt-dlp";
    tag = version;
-    hash = "sha256-E8++/gK/SpY93UW/9U266Qj1Kkn6CeNou7bKTqpCgFw=";
+    hash = "sha256-9y6OUVm6hNTTi5FFmd9DHcmAMrvSmDD+4kDe00aMTDI=";
  };

  postPatch = ''
@@ -136,6 +136,8 @@ buildPythonPackage rec {
    # zeno, gptqmodel, japanese_leaderboard; all = [...];
  };

+  pythonRelaxDeps = [ "datasets" ];
+
  pythonImportsCheck = [ "lm_eval" ];

  nativeCheckInputs = [
@@ -1,7 +0,0 @@
-# The Bazel build tool
-
-https://bazel.build/
-
-The bazel tool requires regular maintenance, especially under darwin, so we created a maintainers team.
-
-Please ping @NixOS/bazel in your github PR/issue to increase your chance of a quick turnaround, thanks!
@@ -1,52 +0,0 @@
-{
-  writeText,
-  bazel,
-  runLocal,
-  bazelTest,
-  distDir,
-  extraBazelArgs ? "",
-}:
-
-# Tests that certain executables are available in bazel-executed bash shells.
-
-let
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-  '';
-
-  fileIn = writeText "input.txt" ''
-    one
-    two
-    three
-  '';
-
-  fileBUILD = writeText "BUILD" ''
-    genrule(
-      name = "tool_usage",
-      srcs = [ ":input.txt" ],
-      outs = [ "output.txt" ],
-      cmd = "cat $(location :input.txt) | gzip - | gunzip - | awk '/t/' > $@",
-    )
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } ''
-    mkdir $out
-    cp ${WORKSPACE} $out/WORKSPACE
-    cp ${fileIn} $out/input.txt
-    cp ${fileBUILD} $out/BUILD
-  '';
-
-  testBazel = bazelTest {
-    name = "bazel-test-bash-tools";
-    bazelPkg = bazel;
-    inherit workspaceDir;
-
-    bazelScript = ''
-      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir} ${extraBazelArgs}
-      cp bazel-bin/output.txt $out
-      echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
-    '';
-  };
-
-in
-testBazel
@@ -1,62 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  bazel-examples,
-  stdenv,
-  cctools,
-  darwin,
-  extraBazelArgs ? "",
-  lib,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  distDir,
-}:
-
-let
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      cp -r ${bazel-examples}/cpp-tutorial/stage3 $out
-      find $out -type d -exec chmod 755 {} \;
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-cpp";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      ${bazel}/bin/bazel build //... \
-        --verbose_failures \
-        --distdir=${distDir} \
-        --curses=no \
-        ${extraBazelArgs} \
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
-    '';
-  };
-
-in
-testBazel
@@ -1,73 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  bazel-examples,
-  stdenv,
-  cctools,
-  extraBazelArgs ? "",
-  lib,
-  openjdk8,
-  jdk11_headless,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      cp -r ${bazel-examples}/java-tutorial $out
-      find $out -type d -exec chmod 755 {} \;
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-java";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    buildInputs = [
-      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
-    ];
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        run \
-        --announce_rc \
-        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version) "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"} \
-        --distdir=${distDir} \
-        --verbose_failures \
-        --curses=no \
-        --strict_java_deps=off \
-        //:ProjectRunner \
-    ''
-    + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-      --host_javabase='@local_jdk//:jdk' \
-      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-      --javabase='@local_jdk//:jdk' \
-    ''
-    + extraBazelArgs;
-  };
-
-in
-testBazel
@@ -1,194 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  fetchFromGitHub,
-  fetchurl,
-  stdenv,
-  cctools,
-  lib,
-  openjdk8,
-  jdk11_headless,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-  com_google_protobuf = fetchFromGitHub {
-    owner = "protocolbuffers";
-    repo = "protobuf";
-    rev = "v3.13.0";
-    sha256 = "1nqsvi2yfr93kiwlinz8z7c68ilg1j75b2vcpzxzvripxx5h6xhd";
-  };
-
-  bazel_skylib = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "bazel-skylib";
-    rev = "2ec2e6d715e993d96ad6222770805b5bd25399ae";
-    sha256 = "1z2r2vx6kj102zvp3j032djyv99ski1x1sl4i3p6mswnzrzna86s";
-  };
-
-  rules_python = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_python";
-    rev = "c8c79aae9aa1b61d199ad03d5fe06338febd0774";
-    sha256 = "1zn58wv5wcylpi0xj7riw34i1jjpqahanxx8y9srwrv0v93b6pqz";
-  };
-
-  rules_proto = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_proto";
-    rev = "a0761ed101b939e19d83b2da5f59034bffc19c12";
-    sha256 = "09lqfj5fxm1fywxr5w8pnpqd859gb6751jka9fhxjxjzs33glhqf";
-  };
-
-  net_zlib = fetchurl rec {
-    url = "https://zlib.net/zlib-1.2.11.tar.gz";
-    sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
-
-    passthru.sha256 = sha256;
-  };
-
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-
-    load("//:proto-support.bzl", "protobuf_deps")
-    protobuf_deps()
-    load("@rules_proto//proto:repositories.bzl", "rules_proto_toolchains")
-    rules_proto_toolchains()
-  '';
-
-  protoSupport = writeText "proto-support.bzl" ''
-    """Load dependencies needed to compile the protobuf library as a 3rd-party consumer."""
-
-    load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-    def protobuf_deps():
-        """Loads common dependencies needed to compile the protobuf library."""
-
-        if "zlib" not in native.existing_rules():
-            # proto_library, cc_proto_library, and java_proto_library rules implicitly
-            # depend on @com_google_protobuf for protoc and proto runtimes.
-            # This statement defines the @com_google_protobuf repo.
-            native.local_repository(
-                name = "com_google_protobuf",
-                path = "${com_google_protobuf}",
-            )
-            native.local_repository(
-                name = "bazel_skylib",
-                path = "${bazel_skylib}",
-            )
-            native.local_repository(
-                name = "rules_proto",
-                path = "${rules_proto}",
-            )
-            native.local_repository(
-                name = "rules_python",
-                path = "${rules_python}",
-            )
-
-            http_archive(
-                name = "zlib",
-                build_file = "@com_google_protobuf//:third_party/zlib.BUILD",
-                sha256 = "${net_zlib.sha256}",
-                strip_prefix = "zlib-1.2.11",
-                urls = ["file://${net_zlib}"],
-            )
-  '';
-
-  personProto = writeText "person.proto" ''
-    syntax = "proto3";
-
-    package person;
-
-    message Person {
-      string name = 1;
-      int32 id = 2;
-      string email = 3;
-    }
-  '';
-
-  personBUILD = writeText "BUILD" ''
-    load("@rules_proto//proto:defs.bzl", "proto_library")
-
-    proto_library(
-        name = "person_proto",
-        srcs = ["person.proto"],
-        visibility = ["//visibility:public"],
-    )
-
-    java_proto_library(
-        name = "person_java_proto",
-        deps = [":person_proto"],
-    )
-
-    cc_proto_library(
-        name = "person_cc_proto",
-        deps = [":person_proto"],
-    )
-  '';
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      mkdir $out
-      cp ${WORKSPACE} $out/WORKSPACE
-      touch $out/BUILD.bazel
-      cp ${protoSupport} $out/proto-support.bzl
-      mkdir $out/person
-      cp ${personProto} $out/person/person.proto
-      cp ${personBUILD} $out/person/BUILD.bazel
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-protocol-buffers";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    buildInputs = [
-      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
-    ];
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        build \
-        --distdir=${distDir} \
-        --verbose_failures \
-        --curses=no \
-        --subcommands \
-        --strict_java_deps=off \
-        --strict_proto_deps=off \
-        //... \
-    ''
-    + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-      --host_javabase='@local_jdk//:jdk' \
-      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-      --javabase='@local_jdk//:jdk' \
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
-    '';
-  };
-
-in
-testBazel
@@ -1,89 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  stdenv,
-  cctools,
-  extraBazelArgs ? "",
-  lib,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-  '';
-
-  pythonLib = writeText "lib.py" ''
-    def foo():
-      return 43
-  '';
-
-  pythonBin = writeText "bin.py" ''
-    from lib import foo
-
-    assert foo() == 43
-  '';
-
-  pythonBUILD = writeText "BUILD" ''
-    py_library(
-      name = "lib",
-      srcs = [ "lib.py" ],
-    )
-
-    py_binary(
-      name = "bin",
-      srcs = [ "bin.py" ],
-      imports = [ "." ],
-      deps = [ ":lib" ],
-    )
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      mkdir $out
-      cp ${WORKSPACE} $out/WORKSPACE
-      mkdir $out/python
-      cp ${pythonLib} $out/python/lib.py
-      cp ${pythonBin} $out/python/bin.py
-      cp ${pythonBUILD} $out/python/BUILD.bazel
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-builtin-rules";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        run \
-        --distdir=${distDir} \
-        ${extraBazelArgs} \
-        //python:bin
-    '';
-  };
-
-in
-testBazel
@@ -1,62 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  extracted,
-  ripgrep,
-  runLocal,
-  unzip,
-  ...
-}:
-
-# Tests that all shebangs are patched appropriately.
-# #!/usr/bin/... should be replaced by Nix store references.
-# #!.../bin/env python should be replaced by Nix store reference to the python interpreter.
-
-let
-
-  workspaceDir = runLocal "our_workspace" { } "mkdir $out";
-
-  testBazel = bazelTest {
-    name = "bazel-test-shebangs";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      set -ueo pipefail
-      FAIL=
-      check_shebangs() {
-        local dir="$1"
-        { rg -e '#!/usr/bin' -e '#![^[:space:]]*/bin/env' $dir -e && echo && FAIL=1; } || true
-      }
-      extract() {
-        local dir="$1"
-        find "$dir" -type f '(' -name '*.zip' -or -name '*.jar' ')' -print0 \
-        | while IFS="" read -r -d "" zip ; do
-          echo "Extracting $zip"
-          local unzipped="$zip-UNPACKED"
-          mkdir -p "$unzipped"
-          unzip -qq $zip -d "$unzipped"
-          extract "$unzipped"
-          rm -rf "$unzipped" "$zip" || true
-        done
-        check_shebangs "$dir"
-      }
-
-      mkdir install_root
-      cp --no-preserve=all -r ${extracted bazel}/install/*/* install_root/
-      extract ./install_root
-
-      if [[ $FAIL = 1 ]]; then
-        echo "Found files in the bazel distribution with illegal shebangs." >&2
-        echo "Replace those by explicit Nix store paths." >&2
-        echo "Python scripts should not use \`bin/env python' but the Python interpreter's store path." >&2
-        exit 1
-      fi
-    '';
-    buildInputs = [
-      unzip
-      ripgrep
-    ];
-  };
-
-in
-testBazel
@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import json
-
-if len(sys.argv) == 1:
-    print("usage: ./this-script WORKSPACE", file=sys.stderr)
-    print("Takes the bazel WORKSPACE file and reads all archives into a json dict (by evaling it as python code)", file=sys.stderr)
-    print("Hail Eris.", file=sys.stderr)
-    sys.exit(1)
-
-http_archives = []
-
-# just the kw args are the dict { name, sha256, urls … }
-def http_archive(**kw):
-    http_archives.append(kw)
-# like http_file
-def http_file(**kw):
-    http_archives.append(kw)
-
-# this is inverted from http_archive/http_file and bundles multiple archives
-def distdir_tar(**kw):
-    for archive_name in kw['archives']:
-        http_archives.append({
-            "name": archive_name,
-            "sha256": kw['sha256'][archive_name],
-            "urls": kw['urls'][archive_name]
-        })
-
-# stubs for symbols we are not interested in
-# might need to be expanded if new bazel releases add symbols to the workspace
-def workspace(name): pass
-def load(*args): pass
-def bind(**kw): pass
-def list_source_repository(**kw): pass
-def new_local_repository(**kw): pass
-def local_repository(**kw): pass
-DOC_VERSIONS = []
-def stardoc_repositories(**kw): pass
-def skydoc_repositories(**kw): pass
-def rules_sass_dependencies(**kw): pass
-def node_repositories(**kw): pass
-def sass_repositories(**kw): pass
-def register_execution_platforms(*args): pass
-def rbe_autoconfig(*args, **kw): pass
-def rules_pkg_dependencies(*args, **kw): pass
-def winsdk_configure(*args, **kw): pass
-def register_local_rc_exe_toolchains(*args, **kw): pass
-def register_toolchains(*args, **kw): pass
-def debian_deps(): pass
-def grpc_deps(): pass
-def grpc_extra_deps(): pass
-def bazel_skylib_workspace(): pass
-
-# execute the WORKSPACE like it was python code in this module,
-# using all the function stubs from above.
-with open(sys.argv[1]) as f:
-    exec(f.read())
-
-# transform to a dict with the names as keys
-d = { el['name']: el for el in http_archives }
-
-print(json.dumps(d, sort_keys=True, indent=4))
@@ -1,11 +1,8 @@
 {
  lib,
-  fetchgit,
-  pkg-config,
-  gettext,
  runCommand,
  makeWrapper,
-  cpio,
+  systemtap-unwrapped,
  elfutils,
  kernel,
  gnumake,
@@ -15,33 +12,8 @@
 }:

 let
-  ## fetchgit info
-  url = "git://sourceware.org/git/systemtap.git";
-  rev = "release-${version}";
-  hash = "sha256-SUPNarZW8vdK9hQaI2kU+rfKWIPiXB4BvJvRNC1T9tU=";
-  version = "5.2";
-
  inherit (kernel) stdenv;

-  ## stap binaries
-  stapBuild = stdenv.mkDerivation {
-    pname = "systemtap";
-    inherit version;
-    src = fetchgit { inherit url rev hash; };
-    nativeBuildInputs = [
-      pkg-config
-      cpio
-      python3
-      python3.pkgs.setuptools
-    ];
-    buildInputs = [
-      elfutils
-      gettext
-      python3
-    ];
-    enableParallelBuilding = true;
-  };
-
  ## symlink farm for --sysroot flag
  sysroot = runCommand "systemtap-sysroot-${kernel.version}" { } ''
    mkdir -p $out/boot $out/usr/lib/debug
@@ -53,17 +25,12 @@ let
  pypkgs = with python3.pkgs; makePythonPath [ pyparsing ];

 in
-runCommand "systemtap-${version}"
+runCommand "systemtap-${systemtap-unwrapped.version}"
  {
-    inherit stapBuild;
+    stapBuild = systemtap-unwrapped;
    nativeBuildInputs = [ makeWrapper ];
    passthru.tests = { inherit (nixosTests.systemtap) linux_default linux_latest; };
-    meta = {
-      homepage = "https://sourceware.org/systemtap/";
-      description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
-      license = lib.licenses.gpl2;
-      platforms = lib.systems.inspect.patterns.isGnu;
-    };
+    inherit (systemtap-unwrapped) meta;
  }
  (
    ''
@@ -1,11 +0,0 @@
--- a/tools/perf/util/evsel.c	2023-10-20 15:50:53.011023294 +0200
-+++ b/tools/perf/util/evsel.c	2023-10-20 15:51:03.205997633 +0200
-@@ -3076,7 +3076,7 @@
- 
- 	return scnprintf(msg, size,
- 	"The sys_perf_event_open() syscall returned with %d (%s) for event (%s).\n"
-	"/bin/dmesg | grep -i perf may provide additional information.\n",
-+	"\"dmesg | grep -i perf\" may provide additional information.\n",
- 			 err, str_error_r(err, sbuf, sizeof(sbuf)), evsel__name(evsel));
- }
- 
@@ -23,9 +23,9 @@ let
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.16.3"; # lqx
+      version = "6.16.5"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "0y7ym3kcy936p3kz71dx411l7pms53cfqbq8h8dp9vxw9vhjkh5n"; # lqx
+      sha256 = "149pkbzsx1z5b8qizf03nz5b4p7in0kbyy8d35svvzrljr6dzjqn"; # lqx
      isLqx = true;
    };
  };
@@ -21,13 +21,13 @@ let
 in
 postgresqlBuildExtension (finalAttrs: {
  pname = "omnigres";
-  version = "0-unstable-2025-08-24";
+  version = "0-unstable-2025-09-05";

  src = fetchFromGitHub {
    owner = "omnigres";
    repo = "omnigres";
-    rev = "8d986ca6c6ebc099af9ffec26bac06b39368b222";
-    hash = "sha256-3oKzLPyusvDf3Tptd7udkzpMhac6gWmSlevzHV0t5CY=";
+    rev = "f9ec95c59a786835f38629a2e04a4784a460fba1";
+    hash = "sha256-F1vG+iAlixdWwW3LIovzwnuL75QTCDlF40QOUD5dNZk=";
  };

  # This matches postInstall of PostgreSQL's generic.nix, which does this for the PGXS Makefile.
@@ -28,6 +28,7 @@
  efiSupport ? false,
  zfsSupport ? false,
  xenSupport ? false,
+  xenPvhSupport ? false,
  kbdcompSupport ? false,
  ckbcomp,
 }:
@@ -65,6 +66,11 @@ let
    x86_64-linux.target = "x86_64";
  };

+  xenPvhSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386"; # Xen PVH is only i386 on x86.
+  };
+
  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);

  gnulib = fetchgit {
@@ -84,7 +90,8 @@ let
 in

 assert zfsSupport -> zfs != null;
-assert !(efiSupport && xenSupport);
+assert !(efiSupport && (xenSupport || xenPvhSupport));
+assert !(xenSupport && xenPvhSupport);

 stdenv.mkDerivation rec {
  pname = "grub";
@@ -609,6 +616,10 @@ stdenv.mkDerivation rec {
  ++ lib.optionals xenSupport [
    "--with-platform=xen"
    "--target=${xenSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals xenPvhSupport [
+    "--with-platform=xen_pvh"
+    "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
  ];

  # save target that grub is compiled for
@@ -660,6 +671,8 @@ stdenv.mkDerivation rec {
        lib.attrNames efiSystemsBuild
      else if xenSupport then
        lib.attrNames xenSystemsBuild
+      else if xenPvhSupport then
+        lib.attrNames xenPvhSystemsBuild
      else
        platforms.gnu ++ platforms.linux;

@@ -3061,6 +3061,14 @@ with pkgs;
    xenSupport = true;
  };

+  grub2_xen_pvh = grub2.override {
+    xenPvhSupport = true;
+  };
+
+  grub2_pvgrub_image = grub2_pvhgrub_image.override {
+    grubPlatform = "xen";
+  };
+
  grub4dos = callPackage ../tools/misc/grub4dos {
    stdenv = stdenv_32bit;
  };
@@ -5626,10 +5634,6 @@ with pkgs;
    );
  buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };

-  cargo-flamegraph = callPackage ../by-name/ca/cargo-flamegraph/package.nix {
-    inherit (linuxPackages) perf;
-  };
-
  defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };

  inherit (callPackages ../development/tools/rust/cargo-pgrx { })
@@ -6479,7 +6483,7 @@ with pkgs;

  bazel = bazel_7;

-  bazel_7 = callPackage ../development/tools/build-managers/bazel/bazel_7 {
+  bazel_7 = callPackage ../by-name/ba/bazel_7/package.nix {
    inherit (darwin) sigtool;
    buildJdk = jdk21_headless;
    runJdk = jdk21_headless;
@@ -7023,7 +7027,6 @@ with pkgs;
  pycritty = with python3Packages; toPythonApplication pycritty;

  qtcreator = qt6Packages.callPackage ../development/tools/qtcreator {
-    inherit (linuxPackages) perf;
    llvmPackages = llvmPackages_21;
    stdenv = llvmPackages_21.stdenv;
  };
@@ -584,8 +584,6 @@ in

        netatop = callPackage ../os-specific/linux/netatop { };

-        perf = callPackage ../os-specific/linux/kernel/perf { };
-
        prl-tools = callPackage ../os-specific/linux/prl-tools { };

        isgx = callPackage ../os-specific/linux/isgx { };
@@ -714,6 +712,7 @@ in
        xmm7360-pci = throw "Support for the XMM7360 WWAN card was added to the iosm kmod in mainline kernel version 5.18";
        amdgpu-pro = throw "amdgpu-pro was removed due to lack of maintenance"; # Added 2024-06-16
        kvdo = throw "kvdo was removed, because it was added to mainline in kernel version 6.9"; # Added 2024-07-08
+        perf = lib.warnOnInstantiate "linuxPackages.perf is now perf" pkgs.perf; # Added 2025-08-28
        system76-power = lib.warnOnInstantiate "kernelPackages.system76-power is now pkgs.system76-power" pkgs.system76-power; # Added 2024-10-16
        system76-scheduler = lib.warnOnInstantiate "kernelPackages.system76-scheduler is now pkgs.system76-scheduler" pkgs.system76-scheduler; # Added 2024-10-16
        tuxedo-keyboard = self.tuxedo-drivers; # Added 2024-09-28
@@ -255,12 +255,11 @@ lib.makeScope pkgs.newScope (
      phpstan = callPackage ../development/php-packages/phpstan { };

      psalm = callPackage ../development/php-packages/psalm { };
-
-      psysh = callPackage ../development/php-packages/psysh { };
    }
    // lib.optionalAttrs config.allowAliases {
      phpcbf = throw "`phpcbf` is now deprecated, use `php-codesniffer` instead which contains both `phpcs` and `phpcbf`.";
      phpcs = throw "`phpcs` is now deprecated, use `php-codesniffer` instead which contains both `phpcs` and `phpcbf`.";
+      psysh = throw "`php8${lib.versions.minor php.version}Packages.psysh` is now deprecated, use `psysh`";
    };

    # This is a set of PHP extensions meant to be used in php.buildEnv