Merge commit cb8ff21c into haskell-updates

.editorconfig

@@ -24,7 +24,7 @@ insert_final_newline = false
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
 # Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
-[*.{bash,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+[*.{bash,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
@@ -32,7 +32,7 @@ indent_style = space
 indent_size = 1
 
 # Match json/lockfiles/markdown/nix/ruby files, set indent width of two
-[*.{json,lock,md,nix,rb}]
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two

ci/.editorconfig

@@ -1,4 +0,0 @@
-# TODO: Move to top-level via staging PR
-[*.js]
-indent_style = space
-indent_size = 2

doc/hooks/meson.section.md

@@ -91,3 +91,4 @@ Meson setup hook.
 
 - `prefixKey`
 - `enableParallelBuilding`
+- `enableParallelChecking`

doc/hooks/versionCheckHook.section.md

@@ -31,7 +31,7 @@ It does so in a clean environment (using `env --ignore-environment`), and it che
 The variables that this phase control are:
 
 - `dontVersionCheck`: Disable adding this hook to the [`preInstallCheckHooks`](#ssec-installCheck-phase). Useful if you do want to load the bash functions of the hook, but run them differently.
-- `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults roughly to `${placeholder "out"}/bin/${pname}`. Using `$out` in the value of this variable won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder` is unavoidable.
+- `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults to using the first non-empty value `$binary` out of `${NIX_MAIN_PROGRAM}` and `${pname}`, in that order, to build roughly `${placeholder "out"}/bin/$binary`. `${NIX_MAIN_PROGRAM}`'s value comes from `meta.mainProgram`, and does not normally need to be set explicitly. When setting `versionCheckProgram`, using `$out` directly won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder "out"` is unavoidable.
 - `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--help` and then `--version`. Examples: `version`, `-V`, `-v`.
 - `versionCheckKeepEnvironment`: A list of environment variables to keep and pass to the command. Only those variables should be added to this list that are actually required for the version command to work. If it is not feasible to explicitly list all these environment variables you can set this parameter to the special value `"*"` to disable the `--ignore-environment` flag and thus keep all environment variables.
 - `preVersionCheck`: A hook to run before the check is done.

doc/languages-frameworks/cuda.section.md

@@ -65,97 +65,6 @@ for your specific card(s).
 Library maintainers should consult [NVCC Docs](https://docs.nvidia.com/cuda/cuda-compiler-driver-nvcc/)
 and release notes for their software package.
 
-## Adding a new CUDA release {#adding-a-new-cuda-release}
-
-> **WARNING**
->
-> This section of the docs is still very much in progress. Feedback is welcome in GitHub Issues tagging @NixOS/cuda-maintainers or on [Matrix](https://matrix.to/#/#cuda:nixos.org).
-
-The CUDA Toolkit is a suite of CUDA libraries and software meant to provide a development environment for CUDA-accelerated applications. Until the release of CUDA 11.4, NVIDIA had only made the CUDA Toolkit available as a multi-gigabyte runfile installer, which we provide through the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute. From CUDA 11.4 and onwards, NVIDIA has also provided CUDA redistributables (“CUDA-redist”): individually packaged CUDA Toolkit components meant to facilitate redistribution and inclusion in downstream projects. These packages are available in the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
-
-All new projects should use the CUDA redistributables available in [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) in place of [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit), as they are much easier to maintain and update.
-
-### Updating CUDA redistributables {#updating-cuda-redistributables}
-
-1. Go to NVIDIA's index of CUDA redistributables: <https://developer.download.nvidia.com/compute/cuda/redist/>
-2. Make a note of the new version of CUDA available.
-3. Run
-
-   ```bash
-   nix run github:connorbaker/cuda-redist-find-features -- \
-      download-manifests \
-      --log-level DEBUG \
-      --version <newest CUDA version> \
-      https://developer.download.nvidia.com/compute/cuda/redist \
-      ./pkgs/development/cuda-modules/cuda/manifests
-   ```
-
-   This will download a copy of the manifest for the new version of CUDA.
-4. Run
-
-   ```bash
-   nix run github:connorbaker/cuda-redist-find-features -- \
-      process-manifests \
-      --log-level DEBUG \
-      --version <newest CUDA version> \
-      https://developer.download.nvidia.com/compute/cuda/redist \
-      ./pkgs/development/cuda-modules/cuda/manifests
-   ```
-
-   This will generate a `redistrib_features_<newest CUDA version>.json` file in the same directory as the manifest.
-5. Update the `cudaVersionMap` attribute set in `pkgs/development/cuda-modules/cuda/extension.nix`.
-
-### Updating cuTensor {#updating-cutensor}
-
-1. Repeat the steps present in [Updating CUDA redistributables](#updating-cuda-redistributables) with the following changes:
-   - Use the index of cuTensor redistributables: <https://developer.download.nvidia.com/compute/cutensor/redist>
-   - Use the newest version of cuTensor available instead of the newest version of CUDA.
-   - Use `pkgs/development/cuda-modules/cutensor/manifests` instead of `pkgs/development/cuda-modules/cuda/manifests`.
-   - Skip the step of updating `cudaVersionMap` in `pkgs/development/cuda-modules/cuda/extension.nix`.
-
-### Updating supported compilers and GPUs {#updating-supported-compilers-and-gpus}
-
-1. Update `nvccCompatibilities` in `pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix` to include the newest release of NVCC, as well as any newly supported host compilers.
-2. Update `cudaCapabilityToInfo` in `pkgs/development/cuda-modules/_cuda/db/bootstrap/cuda.nix` to include any new GPUs supported by the new release of CUDA.
-
-### Updating the CUDA Toolkit runfile installer {#updating-the-cuda-toolkit}
-
-> **WARNING**
->
-> While the CUDA Toolkit runfile installer is still available in Nixpkgs as the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute, its use is not recommended and should it be considered deprecated. Please migrate to the CUDA redistributables provided by the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
->
-> To ensure packages relying on the CUDA Toolkit runfile installer continue to build, it will continue to be updated until a migration path is available.
-
-1. Go to NVIDIA's CUDA Toolkit runfile installer download page: <https://developer.nvidia.com/cuda-downloads>
-2. Select the appropriate OS, architecture, distribution, and version, and installer type.
-
-   - For example: Linux, x86_64, Ubuntu, 22.04, runfile (local)
-   - NOTE: Typically, we use the Ubuntu runfile. It is unclear if the runfile for other distributions will work.
-
-3. Take the link provided by the installer instructions on the webpage after selecting the installer type and get its hash by running:
-
-   ```bash
-   nix store prefetch-file --hash-type sha256 <link>
-   ```
-
-4. Update `pkgs/development/cuda-modules/cudatoolkit/releases.nix` to include the release.
-
-### Updating the CUDA package set {#updating-the-cuda-package-set}
-
-1. Include a new `cudaPackages_<major>_<minor>` package set in `pkgs/top-level/all-packages.nix`.
-
-   - NOTE: Changing the default CUDA package set should occur in a separate PR, allowing time for additional testing.
-
-2. Successfully build the closure of the new package set, updating `pkgs/development/cuda-modules/cuda/overrides.nix` as needed. Below are some common failures:
-
-| Unable to ... | During ... | Reason | Solution | Note |
-| --- | --- | --- | --- | --- |
-| Find headers | `configurePhase` or `buildPhase` | Missing dependency on a `dev` output | Add the missing dependency | The `dev` output typically contain the headers |
-| Find libraries | `configurePhase` | Missing dependency on a `dev` output | Add the missing dependency | The `dev` output typically contain CMake configuration files |
-| Find libraries | `buildPhase` or `patchelf` | Missing dependency on a `lib` or `static` output | Add the missing dependency | The `lib` or `static` output typically contain the libraries |
-
-In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=autoAddDriverRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.
-
 ## Running Docker or Podman containers with CUDA support {#cuda-docker-podman}
 
 It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).
@@ -201,7 +110,7 @@ $ nix run nixpkgs#jq -- -r '.devices[].name' < /var/run/cdi/nvidia-container-too
 all
 ```
 
-### Specifying what devices to expose to the container {#specifying-what-devices-to-expose-to-the-container}
+### Specifying what devices to expose to the container {#cuda-specifying-what-devices-to-expose-to-the-container}
 
 You can choose what devices are exposed to your containers by using the identifier on the generated CDI specification. Like follows:
 
@@ -222,7 +131,7 @@ GPU 1: NVIDIA GeForce RTX 2080 SUPER (UUID: <REDACTED>)
 By default, the NVIDIA Container Toolkit will use the GPU index to identify specific devices. You can change the way to identify what devices to expose by using the `hardware.nvidia-container-toolkit.device-name-strategy` NixOS attribute.
 :::
 
-### Using docker-compose {#using-docker-compose}
+### Using docker-compose {#cuda-using-docker-compose}
 
 It's possible to expose GPU's to a `docker-compose` environment as well. With a `docker-compose.yaml` file like follows:
 
@@ -256,3 +165,142 @@ services:
             - nvidia.com/gpu=0
             - nvidia.com/gpu=1
 ```
+
+## Contributing {#cuda-contributing}
+
+::: {.warning}
+This section of the docs is still very much in progress. Feedback is welcome in GitHub Issues tagging @NixOS/cuda-maintainers or on [Matrix](https://matrix.to/#/#cuda:nixos.org).
+:::
+
+### Package set maintenance {#cuda-package-set-maintenance}
+
+The CUDA Toolkit is a suite of CUDA libraries and software meant to provide a development environment for CUDA-accelerated applications. Until the release of CUDA 11.4, NVIDIA had only made the CUDA Toolkit available as a multi-gigabyte runfile installer, which we provide through the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute. From CUDA 11.4 and onwards, NVIDIA has also provided CUDA redistributables (“CUDA-redist”): individually packaged CUDA Toolkit components meant to facilitate redistribution and inclusion in downstream projects. These packages are available in the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
+
+All new projects should use the CUDA redistributables available in [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) in place of [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit), as they are much easier to maintain and update.
+
+#### Updating redistributables {#cuda-updating-redistributables}
+
+1. Go to NVIDIA's index of CUDA redistributables: <https://developer.download.nvidia.com/compute/cuda/redist/>
+2. Make a note of the new version of CUDA available.
+3. Run
+
+   ```bash
+   nix run github:connorbaker/cuda-redist-find-features -- \
+      download-manifests \
+      --log-level DEBUG \
+      --version <newest CUDA version> \
+      https://developer.download.nvidia.com/compute/cuda/redist \
+      ./pkgs/development/cuda-modules/cuda/manifests
+   ```
+
+   This will download a copy of the manifest for the new version of CUDA.
+4. Run
+
+   ```bash
+   nix run github:connorbaker/cuda-redist-find-features -- \
+      process-manifests \
+      --log-level DEBUG \
+      --version <newest CUDA version> \
+      https://developer.download.nvidia.com/compute/cuda/redist \
+      ./pkgs/development/cuda-modules/cuda/manifests
+   ```
+
+   This will generate a `redistrib_features_<newest CUDA version>.json` file in the same directory as the manifest.
+5. Update the `cudaVersionMap` attribute set in `pkgs/development/cuda-modules/cuda/extension.nix`.
+
+#### Updating cuTensor {#cuda-updating-cutensor}
+
+1. Repeat the steps present in [Updating CUDA redistributables](#cuda-updating-redistributables) with the following changes:
+   - Use the index of cuTensor redistributables: <https://developer.download.nvidia.com/compute/cutensor/redist>
+   - Use the newest version of cuTensor available instead of the newest version of CUDA.
+   - Use `pkgs/development/cuda-modules/cutensor/manifests` instead of `pkgs/development/cuda-modules/cuda/manifests`.
+   - Skip the step of updating `cudaVersionMap` in `pkgs/development/cuda-modules/cuda/extension.nix`.
+
+#### Updating supported compilers and GPUs {#cuda-updating-supported-compilers-and-gpus}
+
+1. Update `nvccCompatibilities` in `pkgs/development/cuda-modules/_cuda/data/nvcc.nix` to include the newest release of NVCC, as well as any newly supported host compilers.
+2. Update `cudaCapabilityToInfo` in `pkgs/development/cuda-modules/_cuda/data/cuda.nix` to include any new GPUs supported by the new release of CUDA.
+
+#### Updating the CUDA Toolkit runfile installer {#cuda-updating-the-cuda-toolkit}
+
+::: {.warning}
+While the CUDA Toolkit runfile installer is still available in Nixpkgs as the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute, its use is not recommended, and it should be considered deprecated. Please migrate to the CUDA redistributables provided by the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
+
+To ensure packages relying on the CUDA Toolkit runfile installer continue to build, it will continue to be updated until a migration path is available.
+:::
+
+1. Go to NVIDIA's CUDA Toolkit runfile installer download page: <https://developer.nvidia.com/cuda-downloads>
+2. Select the appropriate OS, architecture, distribution, and version, and installer type.
+
+   - For example: Linux, x86_64, Ubuntu, 22.04, runfile (local)
+   - NOTE: Typically, we use the Ubuntu runfile. It is unclear if the runfile for other distributions will work.
+
+3. Take the link provided by the installer instructions on the webpage after selecting the installer type and get its hash by running:
+
+   ```bash
+   nix store prefetch-file --hash-type sha256 <link>
+   ```
+
+4. Update `pkgs/development/cuda-modules/cudatoolkit/releases.nix` to include the release.
+
+#### Updating the CUDA package set {#cuda-updating-the-cuda-package-set}
+
+1. Include a new `cudaPackages_<major>_<minor>` package set in `pkgs/top-level/all-packages.nix`.
+
+   - NOTE: Changing the default CUDA package set should occur in a separate PR, allowing time for additional testing.
+
+2. Successfully build the closure of the new package set, updating `pkgs/development/cuda-modules/cuda/overrides.nix` as needed. Below are some common failures:
+
+| Unable to ...  | During ...                       | Reason                                           | Solution                   | Note                                                         |
+| -------------- | -------------------------------- | ------------------------------------------------ | -------------------------- | ------------------------------------------------------------ |
+| Find headers   | `configurePhase` or `buildPhase` | Missing dependency on a `dev` output             | Add the missing dependency | The `dev` output typically contains the headers               |
+| Find libraries | `configurePhase`                 | Missing dependency on a `dev` output             | Add the missing dependency | The `dev` output typically contains CMake configuration files |
+| Find libraries | `buildPhase` or `patchelf`       | Missing dependency on a `lib` or `static` output | Add the missing dependency | The `lib` or `static` output typically contains the libraries |
+
+Failure to run the resulting binary is typically the most challenging to diagnose, as it may involve a combination of the aforementioned issues. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. Try the following debugging steps:
+
+1. First ensure that dependencies are patched with [`autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=autoAddDriverRunpath).
+2. Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool.
+3. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.
+
+### Writing tests {#cuda-writing-tests}
+
+::: {.caution}
+The existence of `passthru.testers` and `passthru.tests` should be considered an implementation detail -- they are not meant to be a public or stable interface.
+:::
+
+In general, there are two attribute sets in `passthru` that are used to build and run tests for CUDA packages: `passthru.testers` and `passthru.tests`. Each attribute set may contain an attribute set named `cuda`, which contains CUDA-specific derivations. The `cuda` attribute set is used to separate CUDA-specific derivations from those which support multiple implementations (e.g., OpenCL, ROCm, etc.) or have different licenses. For an example of such generic derivations, see the `magma` package.
+
+::: {.note}
+Derivations are nested under the `cuda` attribute due to an OfBorg quirk: if evaluation fails (e.g., because of unfree licenses), the entire enclosing attribute set is discarded. This prevents other attributes in the set from being discovered, evaluated, or built.
+:::
+
+#### `passthru.testers` {#cuda-passthru-testers}
+
+Attributes added to `passthru.testers` are derivations which produce an executable which runs a test. The produced executable should:
+
+- Take care to set up the environment, make temporary directories, and so on.
+- Be registered as the derivation's `meta.mainProgram` so that it can be run directly.
+
+::: {.note}
+Testers which always require CUDA should be placed in `passthru.testers.cuda`, while those which are generic should be placed in `passthru.testers`.
+:::
+
+The `passthru.testers` attribute set allows running tests outside the Nix sandbox. There are a number of reasons why this is useful, since such a test:
+
+- Can be run on non-NixOS systems, when wrapped with utilities like `nixGL` or `nix-gl-host`.
+- Has network access patterns which are difficult or impossible to sandbox.
+- Is free to produce output which is not deterministic, such as timing information.
+
+#### `passthru.tests` {#cuda-passthru-tests}
+
+Attributes added to `passthru.tests` are derivations which run tests inside the Nix sandbox. Tests should:
+
+- Use the executables produced by `passthru.testers`, where possible, to avoid duplication of test logic.
+- Include `requiredSystemFeatures = [ "cuda" ];`, possibly conditioned on the value of `cudaSupport` if they are generic, to ensure that they are only run on systems exposing a CUDA-capable GPU.
+
+::: {.note}
+Tests which always require CUDA should be placed in `passthru.tests.cuda`, while those which are generic should be placed in `passthru.tests`.
+:::
+
+This is useful for tests which are deterministic (e.g., checking exit codes) and which can be provided with all necessary resources in the sandbox.

doc/languages-frameworks/javascript.section.md

@@ -444,6 +444,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "...";
+    fetcherVersion = 2;
   };
 })
 ```
@@ -558,6 +559,41 @@ set `prePnpmInstall` to the right commands to run. For example:
 
 In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
 
+#### PNPM `fetcherVersion` {#javascript-pnpm-fetcherVersion}
+
+This is the version of the output of `pnpm.fetchDeps`, if you haven't set it already, you can use `1` with your current hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # you can use your already set hash here
+    fetcherVersion = 1;
+  };
+}
+```
+
+After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # clear this hash and generate a new one
+    fetcherVersion = 2;
+  };
+}
+```
+
+This variable ensures that we can make changes to the output of `pnpm.fetchDeps` without breaking existing hashes.
+Changes can include workarounds or bug fixes to existing PNPM issues.
+
+##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
+
+- 1: Initial version, nothing special
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 
 ### Yarn {#javascript-yarn}
 

doc/redirects.json

@@ -2756,33 +2756,53 @@
   "cuda": [
     "index.html#cuda"
   ],
-  "adding-a-new-cuda-release": [
-    "index.html#adding-a-new-cuda-release"
-  ],
-  "updating-cuda-redistributables": [
-    "index.html#updating-cuda-redistributables"
-  ],
-  "updating-cutensor": [
-    "index.html#updating-cutensor"
-  ],
-  "updating-supported-compilers-and-gpus": [
-    "index.html#updating-supported-compilers-and-gpus"
-  ],
-  "updating-the-cuda-toolkit": [
-    "index.html#updating-the-cuda-toolkit"
-  ],
-  "updating-the-cuda-package-set": [
-    "index.html#updating-the-cuda-package-set"
+  "cuda-contributing": [
+    "index.html#cuda-contributing"
   ],
   "cuda-docker-podman": [
     "index.html#cuda-docker-podman"
   ],
-  "specifying-what-devices-to-expose-to-the-container": [
+  "cuda-package-set-maintenance": [
+    "index.html#cuda-package-set-maintenance",
+    "index.html#adding-a-new-cuda-release"
+  ],
+  "cuda-passthru-testers": [
+    "index.html#cuda-passthru-testers"
+  ],
+  "cuda-passthru-tests": [
+    "index.html#cuda-passthru-tests"
+  ],
+  "cuda-specifying-what-devices-to-expose-to-the-container": [
+    "index.html#cuda-specifying-what-devices-to-expose-to-the-container",
     "index.html#specifying-what-devices-to-expose-to-the-container"
   ],
-  "using-docker-compose": [
+  "cuda-updating-redistributables": [
+    "index.html#cuda-updating-redistributables",
+    "index.html#updating-cuda-redistributables"
+  ],
+  "cuda-updating-cutensor": [
+    "index.html#cuda-updating-cutensor",
+    "index.html#updating-cutensor"
+  ],
+  "cuda-updating-supported-compilers-and-gpus": [
+    "index.html#cuda-updating-supported-compilers-and-gpus",
+    "index.html#updating-supported-compilers-and-gpus"
+  ],
+  "cuda-updating-the-cuda-package-set": [
+    "index.html#cuda-updating-the-cuda-package-set",
+    "index.html#updating-the-cuda-package-set"
+  ],
+  "cuda-updating-the-cuda-toolkit": [
+    "index.html#cuda-updating-the-cuda-toolkit",
+    "index.html#updating-the-cuda-toolkit"
+  ],
+  "cuda-using-docker-compose": [
+    "index.html#cuda-using-docker-compose",
     "index.html#using-docker-compose"
   ],
+  "cuda-writing-tests": [
+    "index.html#cuda-writing-tests"
+  ],
   "cuelang": [
     "index.html#cuelang"
   ],
@@ -3027,7 +3047,7 @@
   "ex-buildGoModule": [
     "index.html#ex-buildGoModule"
   ],
-  "ssec-go-toolchain-versions" : [
+  "ssec-go-toolchain-versions": [
     "index.html#ssec-go-toolchain-versions"
   ],
   "buildGoModule-goModules-override": [
@@ -3327,6 +3347,12 @@
   "javascript-pnpm-extraCommands": [
     "index.html#javascript-pnpm-extraCommands"
   ],
+  "javascript-pnpm-fetcherVersion": [
+    "index.html#javascript-pnpm-fetcherVersion"
+  ],
+  "javascript-pnpm-fetcherVersion-versionHistory": [
+    "index.html#javascript-pnpm-fetcherVersion-versionHistory"
+  ],
   "javascript-yarn": [
     "index.html#javascript-yarn"
   ],

doc/release-notes/rl-2511.section.md

@@ -20,6 +20,8 @@
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 - `command-not-found` package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.
 
+- Derivations setting both `separateDebugInfo` and one of `allowedReferences`, `allowedRequistes`, `disallowedReferences` or `disallowedRequisites` must now set `__structuredAttrs` to `true`. The effect of reference whitelisting or blacklisting will be disabled on the `debug` output created by `separateDebugInfo`.
+
 - `victoriametrics` no longer contains VictoriaLogs components. These have been separated into the new package `victorialogs`.
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
@@ -41,6 +43,8 @@
   of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
   make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
 
+- `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -54,6 +58,19 @@
 - `gramps` has been updated to 6.0.0
   Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.
 
+- `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
+
+- `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
+
+
+- The debug outputs produced by `separateDebugInfo = true;` now contain symlinks mapping build-ids to the original source and ELF file.
+  Specifically, if `$out/bin/ninja` has build-id `483bd7f7229bdb06462222e1e353e4f37e15c293`, then
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.executable` is a symlink to `$out/bin/ninja`
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.source` is a symlink to the value of `$src` during build
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.sourceoverlay` is a symlink to a directory with the same structure as the expanded `$sourceRoot` but containing only a copy of files which were patched during the build
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.debug` is the file containing debug symbols (like before).
+
+
 ## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

doc/stdenv/stdenv.chapter.md

@@ -1415,7 +1415,7 @@ This setup hook checks for, reports, and (by default) fails builds when "broken"
 This hook can be disabled by setting `dontCheckForBrokenSymlinks`.
 
 ::: {.note}
-The hook only considers symlinks with targets inside the Nix store.
+The hook only considers symlinks with targets inside the Nix store or $TMPDIR directory (typically /nix/store and /build in the builder environment, the later being where build is executed).
 :::
 
 ::: {.note}

flake.nix

@@ -209,11 +209,14 @@
       */
       legacyPackages = forAllSystems (
         system:
-        (import ./. { inherit system; }).extend (
-          final: prev: {
-            lib = prev.lib.extend libVersionInfoOverlay;
-          }
-        )
+        (import ./. {
+          inherit system;
+          overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
+            (final: prev: {
+              lib = prev.lib.extend libVersionInfoOverlay;
+            })
+          ];
+        })
       );
 
       /**

maintainers/maintainer-list.nix

@@ -8868,6 +8868,12 @@
     github = "fzakaria";
     githubId = 605070;
   };
+  fzdslr = {
+    name = "FZDSLR";
+    email = "fzdslr@outlook.com";
+    github = "fzdslr";
+    githubId = 62922415;
+  };
   gabesoft = {
     email = "gabesoft@gmail.com";
     github = "gabesoft";
@@ -18305,6 +18311,13 @@
     githubId = 1254858;
     keys = [ { fingerprint = "BE62 7373 8E61 6D6D 1B3A  08E8 A21A 0202 4881 6103"; } ];
   };
+  notohh = {
+    email = "contact@notohh.dev";
+    github = "notohh";
+    githubId = 31116143;
+    name = "notohh";
+    keys = [ { fingerprint = "C3CB 3B31 AF3F 986C 39E0  BE5B BD47 506D 475E E86D"; } ];
+  };
   notthebee = {
     email = "moe@notthebe.ee";
     github = "notthebee";
@@ -19389,12 +19402,6 @@
     name = "Michael Bergmeister";
     githubId = 53442728;
   };
-  paveloom = {
-    email = "contact@paveloom.dev";
-    github = "paveloom";
-    githubId = 49961859;
-    name = "Pavel Sobolev";
-  };
   pawelchcki = {
     email = "pawel.chcki@gmail.com";
     github = "pawelchcki";
@@ -23093,6 +23100,12 @@
     githubId = 251028;
     name = "Shell Turner";
   };
+  shellhazard = {
+    email = "shellhazard@tutanota.com";
+    github = "shellhazard";
+    githubId = 10951745;
+    name = "shellhazard";
+  };
   shelvacu = {
     name = "Shelvacu";
     email = "nix-maint@shelvacu.com";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -56,6 +56,8 @@
 
 - [Sharkey](https://joinsharkey.org), a Sharkish microblogging platform. Available as [services.sharkey](#opt-services.sharkey.enable).
 
+- [fw-fanctrl](https://github.com/TamtamHero/fw-fanctrl), a simple systemd service to better control Framework Laptop's fan(s). Available as [hardware.fw-fanctrl](#opt-hardware.fw-fanctrl.enable).
+
 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
 
 - [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
@@ -66,6 +68,8 @@
 
 - The Perl implementation of the `switch-to-configuration` program is removed. All switchable systems now use the Rust rewrite. Any prior usage of `system.switch.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.
 
+- The `no-broken-symlink` build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).
+
 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
 
 - The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).

nixos/modules/hardware/fw-fanctrl.nix

@@ -0,0 +1,129 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.fw-fanctrl;
+
+  configFormat = pkgs.formats.json { };
+  configOption = configFormat.generate "config.json" cfg.config;
+
+  configFile = pkgs.runCommand "configFile" { } ''
+    ${lib.getExe pkgs.jq} -s '.[0] * .[1]' ${pkgs.fw-fanctrl}/share/fw-fanctrl/config.json ${configOption} > $out
+  '';
+in
+{
+  options.hardware.fw-fanctrl = {
+    enable = lib.mkEnableOption "the fw-fanctrl systemd service and install the needed packages";
+
+    disableBatteryTempCheck = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Disable checking battery temperature sensor
+      '';
+    };
+
+    config = lib.mkOption {
+      default = { };
+      description = ''
+        Additional config entries for the fw-fanctrl service (documentation: https://github.com/TamtamHero/fw-fanctrl/blob/main/doc/configuration.md)
+      '';
+      type = lib.types.submodule {
+        freeformType = configFormat.type;
+        options = {
+          defaultStrategy = lib.mkOption {
+            type = lib.types.str;
+            default = "lazy";
+            description = "Default strategy to use";
+          };
+
+          strategyOnDischarging = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+            description = "Default strategy on discharging";
+          };
+
+          strategies = lib.mkOption {
+            default = null;
+            description = ''
+              Additional strategies which can be used by fw-fanctrl
+            '';
+            type = lib.types.nullOr (
+              lib.types.attrsOf (
+                lib.types.submodule {
+                  options = {
+                    fanSpeedUpdateFrequency = lib.mkOption {
+                      type = lib.types.ints.unsigned;
+                      default = 5;
+                      description = "How often the fan speed should be updated in seconds";
+                    };
+
+                    movingAverageInterval = lib.mkOption {
+                      type = lib.types.ints.unsigned;
+                      default = 25;
+                      description = "Interval (seconds) of the last temperatures to use to calculate the average temperature";
+                    };
+
+                    speedCurve = lib.mkOption {
+                      default = [ ];
+                      description = "How should the speed curve look like";
+                      type = lib.types.listOf (
+                        lib.types.submodule {
+                          options = {
+                            temp = lib.mkOption {
+                              type = lib.types.int;
+                              default = 0;
+                              description = "Temperature in °C at which the fan speed should be changed";
+                            };
+
+                            speed = lib.mkOption {
+                              type = lib.types.ints.between 0 100;
+                              default = 0;
+                              description = "Percent how fast the fan should run at";
+                            };
+
+                          };
+                        }
+                      );
+                    };
+                  };
+                }
+              )
+            );
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      fw-fanctrl
+      fw-ectool
+    ];
+
+    systemd.services.fw-fanctrl = {
+      description = "Framework Fan Controller";
+      after = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = "${lib.getExe pkgs.fw-fanctrl} --output-format JSON run --config ${configFile} --silent ${lib.optionalString cfg.disableBatteryTempCheck "--no-battery-sensors"}";
+        ExecStopPost = "${lib.getExe pkgs.fw-ectool} autofanctrl";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # Create suspend config
+    environment.etc."systemd/system-sleep/fw-fanctrl-suspend.sh".source =
+      "${pkgs.fw-fanctrl}/share/fw-fanctrl/fw-fanctrl-suspend";
+  };
+
+  meta = {
+    maintainers = pkgs.fw-fanctrl.meta.maintainers;
+  };
+}

nixos/modules/module-list.nix

@@ -67,6 +67,7 @@
   ./hardware/digitalbitbox.nix
   ./hardware/flipperzero.nix
   ./hardware/flirc.nix
+  ./hardware/fw-fanctrl.nix
   ./hardware/glasgow.nix
   ./hardware/gpgsmartcards.nix
   ./hardware/graphics.nix

nixos/modules/services/cluster/spark/default.nix

@@ -104,7 +104,7 @@ in
           path = with pkgs; [
             procps
             openssh
-            nettools
+            net-tools
           ];
           description = "spark master service.";
           after = [ "network.target" ];
@@ -133,7 +133,7 @@ in
           path = with pkgs; [
             procps
             openssh
-            nettools
+            net-tools
             rsync
           ];
           description = "spark master service.";

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -424,7 +424,7 @@ in
       ];
       path = [
         hydra-package
-        pkgs.nettools
+        pkgs.net-tools
         pkgs.openssh
         pkgs.bzip2
         config.nix.package
@@ -459,7 +459,7 @@ in
       ];
       path = with pkgs; [
         hydra-package
-        nettools
+        net-tools
         jq
       ];
       restartTriggers = [ hydraConf ];

nixos/modules/services/desktops/profile-sync-daemon.nix

@@ -43,7 +43,7 @@ in
               rsync
               kmod
               gawk
-              nettools
+              net-tools
               util-linux
               profile-sync-daemon
             ];
@@ -69,7 +69,7 @@ in
               rsync
               kmod
               gawk
-              nettools
+              net-tools
               util-linux
               profile-sync-daemon
             ];

nixos/modules/services/mail/postfix.nix

@@ -894,7 +894,7 @@ in
             ${lib.concatStringsSep "\n" (
               lib.mapAttrsToList (to: from: ''
                 ln -sf ${from} /var/lib/postfix/conf/${to}
-                ${pkgs.postfix}/bin/postmap /var/lib/postfix/conf/${to}
+                ${pkgs.postfix}/bin/postmap -o -p /var/lib/postfix/conf/${to}
               '') cfg.mapFiles
             )}
 

nixos/modules/services/mail/spamassassin.nix

@@ -98,7 +98,7 @@ in
           # loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
           loadplugin Mail::SpamAssassin::Plugin::SpamCop
           loadplugin Mail::SpamAssassin::Plugin::SPF
-          #loadplugin Mail::SpamAssassin::Plugin::TextCat
+          loadplugin Mail::SpamAssassin::Plugin::TextCat
           # loadplugin Mail::SpamAssassin::Plugin::TxRep
           loadplugin Mail::SpamAssassin::Plugin::URIDetail
           loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
@@ -183,6 +183,11 @@ in
         "sa-update.service"
       ];
 
+      reloadTriggers = [
+        config.environment.etc."mail/spamassassin/init.pre".source
+        config.environment.etc."mail/spamassassin/local.cf".source
+      ];
+
       serviceConfig = {
         User = "spamd";
         Group = "spamd";

nixos/modules/services/misc/invidious-router.nix

@@ -101,6 +101,10 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.invidious-router = {
       wantedBy = [ "multi-user.target" ];
+
+      after = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
+
       serviceConfig = {
         Restart = "on-failure";
         ExecStart = "${lib.getExe cfg.package} --configfile ${configFile}";

nixos/modules/services/misc/klipper.nix

@@ -112,6 +112,12 @@ in
         '';
       };
 
+      extraSettings = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Extra lines to append to the generated Klipper configuration.";
+      };
+
       firmwares = lib.mkOption {
         description = "Firmwares klipper should manage";
         default = { };
@@ -166,6 +172,10 @@ in
         assertion = (cfg.configFile != null) != (cfg.settings != null);
         message = "You need to either specify services.klipper.settings or services.klipper.configFile.";
       }
+      {
+        assertion = (cfg.configFile != null) -> (cfg.extraSettings == "");
+        message = "You can't use services.klipper.extraSettings with services.klipper.configFile.";
+      }
     ];
 
     services.klipper = lib.mkIf cfg.octoprintIntegration {
@@ -180,7 +190,10 @@ in
           + lib.optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}"
           + lib.optionalString (cfg.logFile != null) " --logfile=${cfg.logFile}";
         printerConfig =
-          if cfg.settings != null then format.generate "klipper.cfg" cfg.settings else cfg.configFile;
+          if cfg.settings != null then
+            builtins.toFile "klipper.cfg" ((format.generate "" cfg.settings).text + cfg.extraSettings)
+          else
+            cfg.configFile;
       in
       {
         description = "Klipper 3D Printer Firmware";

nixos/modules/services/misc/redlib.nix

@@ -95,6 +95,47 @@ in
       environment = mapAttrs (_: v: if isBool v then boolToString' v else toString v) cfg.settings;
       serviceConfig =
         {
+          # Hardening
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@mount"
+            "~@swap"
+            "~@resources"
+            "~@reboot"
+            "~@raw-io"
+            "~@obsolete"
+            "~@module"
+            "~@debug"
+            "~@cpu-emulation"
+            "~@clock"
+            "~@privileged"
+          ];
+          UMask = "0027";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} ${args}"
@@ -111,6 +152,7 @@ in
               # A private user cannot have process capabilities on the host's user
               # namespace and thus CAP_NET_BIND_SERVICE has no effect.
               PrivateUsers = true;
+              CapabilityBoundingSet = false;
             }
         );
     };

nixos/modules/services/misc/zoneminder.nix

@@ -45,7 +45,7 @@ let
   defaultsFile = pkgs.writeText "60-defaults.conf" ''
     # 01-system-paths.conf
     ${dirStanzas home}
-    ZM_PATH_ARP=${lib.getBin pkgs.nettools}/bin/arp
+    ZM_PATH_ARP=${lib.getBin pkgs.net-tools}/bin/arp
     ZM_PATH_LOGS=/var/log/${dirName}
     ZM_PATH_MAP=/dev/shm
     ZM_PATH_SOCKS=/run/${dirName}

nixos/modules/services/monitoring/zabbix-agent.nix

@@ -59,9 +59,9 @@ in
 
       extraPackages = mkOption {
         type = types.listOf types.package;
-        default = with pkgs; [ nettools ];
-        defaultText = literalExpression "with pkgs; [ nettools ]";
-        example = literalExpression "with pkgs; [ nettools mysql ]";
+        default = with pkgs; [ net-tools ];
+        defaultText = literalExpression "with pkgs; [ net-tools ]";
+        example = literalExpression "with pkgs; [ net-tools mysql ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/monitoring/zabbix-proxy.nix

@@ -91,11 +91,11 @@ in
       extraPackages = mkOption {
         type = types.listOf types.package;
         default = with pkgs; [
-          nettools
+          net-tools
           nmap
           traceroute
         ];
-        defaultText = literalExpression "[ nettools nmap traceroute ]";
+        defaultText = literalExpression "[ net-tools nmap traceroute ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/monitoring/zabbix-server.nix

@@ -88,11 +88,11 @@ in
       extraPackages = mkOption {
         type = types.listOf types.package;
         default = with pkgs; [
-          nettools
+          net-tools
           nmap
           traceroute
         ];
-        defaultText = literalExpression "[ nettools nmap traceroute ]";
+        defaultText = literalExpression "[ net-tools nmap traceroute ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/networking/libreswan.nix

@@ -165,7 +165,7 @@ in
         procps
         nssTools
         iptables
-        nettools
+        net-tools
       ];
       preStart = lib.optionalString cfg.disableRedirects ''
         # Disable send/receive redirects

nixos/modules/services/networking/openvpn.nix

@@ -74,7 +74,7 @@ let
       path = [
         pkgs.iptables
         pkgs.iproute2
-        pkgs.nettools
+        pkgs.net-tools
       ];
 
       serviceConfig.ExecStart = "@${openvpn}/sbin/openvpn openvpn --suppress-timestamps --config ${configFile}";

nixos/modules/services/networking/pihole-ftl.md

@@ -22,6 +22,7 @@ Example configuration:
 {
   services.pihole-ftl = {
     enable = true;
+    openFirewallDNS = true;
     openFirewallDHCP = true;
     queryLogDeleter.enable = true;
     lists = [

nixos/modules/services/networking/pihole-ftl.nix

@@ -56,6 +56,12 @@ in
       example = "3";
     };
 
+    openFirewallDNS = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open ports in the firewall for pihole-FTL's DNS server.";
+    };
+
     openFirewallDHCP = mkOption {
       type = types.bool;
       default = false;
@@ -434,11 +440,15 @@ in
     };
 
     networking.firewall = lib.mkMerge [
-      (mkIf cfg.openFirewallDHCP {
+      (mkIf cfg.openFirewallDNS {
         allowedUDPPorts = [ 53 ];
         allowedTCPPorts = [ 53 ];
       })
 
+      (mkIf cfg.openFirewallDHCP {
+        allowedUDPPorts = [ 67 ];
+      })
+
       (mkIf cfg.openFirewallWebserver {
         allowedTCPPorts = lib.pipe cfg.settings.webserver.port [
           (lib.splitString ",")

nixos/modules/services/networking/tetrd.nix

@@ -80,8 +80,8 @@
             builtins.storeDir
             "/etc/ssl"
             "/etc/static/ssl"
-            "${pkgs.nettools}/bin/route:/usr/bin/route"
-            "${pkgs.nettools}/bin/ifconfig:/usr/bin/ifconfig"
+            "${pkgs.net-tools}/bin/route:/usr/bin/route"
+            "${pkgs.net-tools}/bin/ifconfig:/usr/bin/ifconfig"
           ];
 
           BindPaths = [

nixos/modules/services/system/cloud-init.nix

@@ -11,7 +11,7 @@ let
     [
       cloud-init
       iproute2
-      nettools
+      net-tools
       openssh
       shadow
       util-linux

nixos/modules/services/web-apps/froide-govplan.nix

@@ -182,6 +182,7 @@ in
             StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/froide-govplan") "froide-govplan";
             User = "govplan";
             Group = "govplan";
+            TimeoutStartSec = "5m";
           };
           after = [
             "postgresql.target"
@@ -191,7 +192,7 @@ in
           wantedBy = [ "multi-user.target" ];
           environment =
             {
-              PYTHONPATH = pkg.pythonPath;
+              PYTHONPATH = "${pkg.pythonPath}:${pkg}/${pkg.python.sitePackages}";
               GDAL_LIBRARY_PATH = "${pkgs.gdal}/lib/libgdal.so";
               GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c.so";
             }

nixos/modules/services/x11/terminal-server.nix

@@ -36,7 +36,7 @@ with lib;
         pkgs.which
         pkgs.openssl
         pkgs.xorg.xauth
-        pkgs.nettools
+        pkgs.net-tools
         pkgs.shadow
         pkgs.procps
         pkgs.util-linux

nixos/modules/system/boot/systemd/oomd.nix

@@ -45,6 +45,8 @@ in
       "systemd-oomd.service"
       "systemd-oomd.socket"
     ];
+    # TODO: Added upstream in upcoming systemd release. Good to drop once we use v258 or later
+    systemd.services.systemd-oomd.after = [ "systemd-sysusers.service" ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = lib.generators.toINI { } {

nixos/modules/virtualisation/digital-ocean-config.nix

@@ -144,7 +144,7 @@ with lib;
         systemd.services.digitalocean-set-hostname = mkIf (hostName == "") {
           path = [
             pkgs.curl
-            pkgs.nettools
+            pkgs.net-tools
           ];
           description = "Set hostname provided by Digitalocean";
           wantedBy = [ "network.target" ];

nixos/modules/virtualisation/vagrant-guest.nix

@@ -23,7 +23,7 @@ in
   environment.systemPackages = with pkgs; [
     findutils
     iputils
-    nettools
+    net-tools
     netcat
     nfs-utils
     rsync

nixos/modules/virtualisation/waagent.nix

@@ -351,7 +351,7 @@ in
           parted
 
           # for hostname
-          nettools
+          net-tools
           # for pidof
           procps
           # for useradd, usermod

nixos/tests/all-tests.nix

@@ -1528,7 +1528,7 @@ in
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
-  vscodium = discoverTests (import ./vscodium.nix);
+  vscodium = import ./vscodium.nix { inherit runTest; };
   vsftpd = runTest ./vsftpd.nix;
   waagent = runTest ./waagent.nix;
   wakapi = runTest ./wakapi.nix;

nixos/tests/flaresolverr.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 {
   name = "flaresolverr";
-  meta.maintainers = with lib.maintainers; [ paveloom ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { pkgs, ... }:

nixos/tests/sing-box.nix

@@ -57,8 +57,6 @@ let
       "${hosts."${server_host}"}/32"
     ];
     strict_route = false;
-    sniff = true;
-    sniff_override_destination = false;
   };
 
   tproxyPort = 1081;
@@ -219,6 +217,9 @@ in
                 tag = "outbound:direct";
               }
             ];
+            route = {
+              default_interface = "eth1";
+            };
           };
         };
       };
@@ -267,6 +268,7 @@ in
               vmessOutbound
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
               rules = [
                 {
@@ -315,25 +317,28 @@ in
                 type = "block";
                 tag = "outbound:block";
               }
+            ];
+            endpoints = [
               {
-                type = "direct";
-                tag = "outbound:direct";
-              }
-              {
-                detour = "outbound:direct";
                 type = "wireguard";
                 tag = "outbound:wireguard";
-                interface_name = "wg0";
-                local_address = [ "10.23.42.2/32" ];
+                name = "wg0";
+                address = [ "10.23.42.2/32" ];
                 mtu = 1280;
                 private_key = wg-keys.peer1.privateKey;
-                peer_public_key = wg-keys.peer0.publicKey;
-                server = server_host;
-                server_port = 2408;
-                system_interface = true;
+                peers = [
+                  {
+                    address = server_host;
+                    port = 2408;
+                    public_key = wg-keys.peer0.publicKey;
+                    allowed_ips = [ "0.0.0.0/0" ];
+                  }
+                ];
+                system = true;
               }
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
             };
           };
@@ -377,8 +382,6 @@ in
                 listen = "0.0.0.0";
                 listen_port = tproxyPort;
                 udp_fragment = true;
-                sniff = true;
-                sniff_override_destination = false;
               }
             ];
             outbounds = [
@@ -393,6 +396,7 @@ in
               vmessOutbound
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
               rules = [
                 {
@@ -434,7 +438,7 @@ in
               independent_cache = true;
               fakeip = {
                 enabled = true;
-                "inet4_range" = "198.18.0.0/16";
+                inet4_range = "198.18.0.0/16";
               };
               servers = [
                 {
@@ -458,7 +462,6 @@ in
                     "AAAA"
                   ];
                   server = "dns:fakeip";
-
                 }
               ];
             };
@@ -474,17 +477,17 @@ in
                 type = "direct";
                 tag = "outbound:direct";
               }
-              {
-                type = "dns";
-                tag = "outbound:dns";
-              }
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:direct";
               rules = [
+                {
+                  action = "sniff";
+                }
                 {
                   protocol = "dns";
-                  outbound = "outbound:dns";
+                  action = "hijack-dns";
                 }
               ];
             };

nixos/tests/vscodium.nix

@@ -1,12 +1,13 @@
+{ runTest }:
 let
   tests = {
     wayland =
-      { pkgs, ... }:
+      { lib, pkgs, ... }:
       {
         imports = [ ./common/wayland-cage.nix ];
 
         # We scale vscodium to help OCR find the small "Untitled" text.
-        services.cage.program = "${pkgs.vscodium}/bin/codium --force-device-scale-factor=2";
+        services.cage.program = "${lib.getExe pkgs.vscodium} --force-device-scale-factor=2";
 
         environment.variables.NIXOS_OZONE_WL = "1";
         environment.variables.DISPLAY = "do not use";
@@ -14,7 +15,7 @@ let
         fonts.packages = with pkgs; [ dejavu_fonts ];
       };
     xorg =
-      { pkgs, ... }:
+      { lib, pkgs, ... }:
       {
         imports = [
           ./common/user-account.nix
@@ -24,7 +25,7 @@ let
         virtualisation.memorySize = 2047;
         services.xserver.enable = true;
         services.xserver.displayManager.sessionCommands = ''
-          ${pkgs.vscodium}/bin/codium --force-device-scale-factor=2
+          ${lib.getExe pkgs.vscodium} --force-device-scale-factor=2
         '';
         test-support.displayManager.auto.user = "alice";
       };
@@ -32,21 +33,18 @@ let
 
   mkTest =
     name: machine:
-    import ./make-test-python.nix (
-      { pkgs, ... }:
+    runTest (
+      { lib, ... }:
       {
         inherit name;
 
-        nodes = {
-          "${name}" = machine;
-        };
+        nodes."${name}" = machine;
+
+        meta.maintainers = with lib.maintainers; [
+          synthetica
+          turion
+        ];
 
-        meta = with pkgs.lib.maintainers; {
-          maintainers = [
-            synthetica
-            turion
-          ];
-        };
         enableOCR = true;
 
         testScript = ''
@@ -91,6 +89,5 @@ let
         '';
       }
     );
-
 in
-builtins.mapAttrs (k: v: mkTest k v) tests
+builtins.mapAttrs mkTest tests

nixos/tests/whisparr.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 {
   name = "whisparr";
-  meta.maintainers = [ lib.maintainers.paveloom ];
+  meta.maintainers = [ ];
 
   nodes.machine =
     { pkgs, ... }:

pkgs/applications/audio/mopidy/tidal.nix

@@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {
     pytest-mock
   ];
 
-  pytestFlagsArray = [ "tests/" ];
+  enabledTestPaths = [ "tests/" ];
 
   meta = {
     description = "Mopidy extension for playing music from Tidal";

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.10";
+  version = "1.33.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-h7LBf+DJedPvOO7O/2Nis1sorIWJ+/GFS1vnXJq2VXw=";
+    hash = "sha256-IpDjrt5vTRY+GhdFIWWvM8qtS18JSPmUKc+i2Dhfqp0=";
   };
 
   outputs = [

pkgs/applications/audio/youtube-music/default.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/applications/display-managers/lightdm/default.nix

@@ -8,8 +8,8 @@
   plymouth,
   pam,
   pkg-config,
-  autoconf,
-  automake,
+  autoreconfHook,
+  gettext,
   libtool,
   libxcb,
   glib,
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    autoconf
-    automake
+    autoreconfHook
+    gettext
     yelp-tools
     yelp-xsl
     gobject-introspection
@@ -88,6 +88,9 @@ stdenv.mkDerivation rec {
     (replaceVars ./fix-paths.patch {
       plymouth = "${plymouth}/bin/plymouth";
     })
+
+    # glib gettext is deprecated and broken, so use regular gettext instead
+    ./use-regular-gettext.patch
   ];
 
   dontWrapQtApps = true;

pkgs/applications/display-managers/lightdm/use-regular-gettext.patch

@@ -0,0 +1,13 @@
+diff --git a/configure.ac b/configure.ac
+index 6f2e706f..6307dd59 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -195,6 +195,8 @@ dnl Internationalization
+ dnl ###########################################################################
+ 
+ IT_PROG_INTLTOOL(0.35.0)
++AM_GNU_GETTEXT([external])
++AM_GNU_GETTEXT_VERSION([0.21])
+ AC_SUBST(GETTEXT_PACKAGE, lightdm)
+ AC_DEFINE_UNQUOTED(GETTEXT_PACKAGE, "$GETTEXT_PACKAGE", Gettext package)
+ 

pkgs/applications/editors/jetbrains/default.nix

@@ -37,6 +37,7 @@ in
   libX11,
 
   vmopts ? null,
+  forceWayland ? false,
 }:
 
 let
@@ -83,9 +84,13 @@ let
       inherit
         pname
         jdk
-        extraWrapperArgs
         extraBuildInputs
         ;
+      extraWrapperArgs =
+        extraWrapperArgs
+        ++ lib.optionals (stdenv.hostPlatform.isLinux && forceWayland) [
+          ''--add-flags "\''${WAYLAND_DISPLAY:+-Dawt.toolkit.name=WLToolkit}"''
+        ];
       extraLdPath = extraLdPath ++ lib.optionals (stdenv.hostPlatform.isLinux) [ libGL ];
       src =
         if fromSource then

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1401";
+  version = "9.1.1475";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-oYde6i5coECUzQQEMo0dvkOXFimKe4y2aGoV2nVLx58=";
+    hash = "sha256-KKUzS0dS9K/jlfP+igyLX1Fwjb7Y5ZAzGLjqHvkA3bs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix

@@ -8,19 +8,19 @@
   gitMinimal,
 }:
 let
-  version = "1.4.1";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
+    hash = "sha256-R95i3dDVBfH0oxTdK0F0ami0SAk0VVONXIlX6ZF0kmk=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";
+    cargoHash = "sha256-pWBOPMUy/gXeujaowlp2I6kqD+Q95h+f9mXl231DN88=";
 
     nativeBuildInputs = [ gitMinimal ];
 

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.81.0";
-    hash = "sha256-zuE+KR0iLEkQrxxS835ZYq20yxWgV1S14bay4shqVWg=";
+    version = "1.83.0";
+    hash = "sha256-BicMVFpCmG3/NnBJUG5w8B/5039SWx6kAv8SC+Vaj5c=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2453,8 +2453,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.54";
-          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
+          version = "1.1.57";
+          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.16.0";
-    hash = "sha256-JBHdwvlJ4BHlphABT2ViR03R4zRVSwkHkOw1n3bNzAQ=";
+    version = "0.16.1";
+    hash = "sha256-uhAUSXB7ULNmkRSHqfbo3T3AZ3TiUaIqEZL4YwkWxtY=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.22.6";
-    hash = "sha256-Gu1QcGLJVSiFCO7C6q1fVbi5MOztdKyFFyEhxxCpfUE=";
+    version = "3.23.8";
+    hash = "sha256-2k9a27sbKYcrKVFRSdneUAV/bN0Y2Q5a7vorFRmgQPo=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-06-16";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "8c48d34327f5ffc44892899cf2567feaa9bbf72a";
-    hash = "sha256-u5kxj4Sl7LpivEuNhTec8Z2u3Dw/X8xFDBQ++hQAtFc=";
+    rev = "92894e7bdb6304d23278dc77f8a9fa7212450f6e";
+    hash = "sha256-uA/pm3DyT0VCyq85DzZGXjSGrKQ9uoEIfrs839ta97s=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/pcsx2.nix

@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "f8c9740897cbba47ee5ecda9f1c34d73daf81379";
-    hash = "sha256-2/CYjilppD/7o3G4kNMUTbEP91DQYct0ojHwShNy8cw=";
+    rev = "553770c8d886acb12ff43d06b83215f46be89acc";
+    hash = "sha256-C2uASKAol7PB3TEdLPCHlcUdRcaYlFwngnviY3rBklE=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-07-01";
+  version = "0-unstable-2025-07-09";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "5fa3b71304aec0d2a70569bd38c87433f719e6ce";
-    hash = "sha256-t61xAqghmOmZJzAxU2Ez1ALQ8jjuHZKwmrNoRA9L+4k=";
+    rev = "ae9afb4e45e8de35382fb98c55d13dec9fcf8ed8";
+    hash = "sha256-HWKhgGChPGhRmrXXbjEvBt0coGpQ1JAPUTd8Ze4yKww=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix

@@ -58,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     umockdev
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "test"
   ];
 

pkgs/applications/graphics/krita/default.nix

@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.2.9";
+  version = "5.2.10";
   kde-channel = "stable";
-  hash = "sha256-CMmvVW3r8mkxvWUGeS45G0t6MzSlog9RazJJBDNKy6Y=";
+  hash = "sha256-pJrJcrO7lkU0h3XPFpOADL9zXINcqfn1Thep4fMHctU=";
 }

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -12,13 +12,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "6.1.6.7";
+  version = "6.1.7.8";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-XdnKcWzw/d7yLG2efgw/gQ8UkPjExigffbomTD3YUgE=";
+    hash = "sha256-bdjkYrfaC/5rKqRmKr+NVmCMU871WJFNRdh92i8GJF8=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;

pkgs/applications/misc/ArchiSteamFarm/deps.json

@@ -276,8 +276,8 @@
   },
   {
     "pname": "Markdig.Signed",
-    "version": "0.41.1",
-    "hash": "sha256-A8dOAwZ9hMVPk8xZBaJOo0gu5Z01JQZiz0uZbIZA2eU="
+    "version": "0.41.3",
+    "hash": "sha256-r4DrP47vgky0+AbNBFso7AwwzAHgrioK2B08UIxEaNI="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
@@ -286,13 +286,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "9.0.5",
-    "hash": "sha256-v2T37X1dm/NG0ZJWk6cXB9lf8tOc6JI4uxFPqmV7ne0="
-  },
-  {
-    "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "6.0.0",
-    "hash": "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="
+    "version": "9.0.6",
+    "hash": "sha256-Kk1WNf1BS+9LjjXjBrYb1YCr+23W9PJ+B9Kv2OBv2Oc="
   },
   {
     "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@@ -431,23 +426,23 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.11.0",
-    "hash": "sha256-qTBsPDE2FD/JA/n7P9g5FQPu7whUyX1X2HS62StxfLM="
+    "version": "8.12.1",
+    "hash": "sha256-gG2S/1+fPV74J9EE3oI3FKG/bRX/F7ujRvGTgxZ4r1A="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.11.0",
-    "hash": "sha256-JayQNiEiMsvpoAM993VNfJOyAYkatRoFBuLO+ZBzBGo="
+    "version": "8.12.1",
+    "hash": "sha256-NF1kPBAfiNEIsiyNSUSPwPJMEvdk6IMC+95PdqearuM="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.11.0",
-    "hash": "sha256-aBJSBytPxw+t68O94B8Sj+PjtBi9c2Csy5x7xyVV4m8="
+    "version": "8.12.1",
+    "hash": "sha256-zliqyeeJ9hvPUxm+rWCHGAH+aR+OeIxNhcKxM6G5AEc="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.11.0",
-    "hash": "sha256-9sg63wXOJa2HrQBsC3w0vXsWww7FvCnjrtoaf7OsyuA="
+    "version": "8.12.1",
+    "hash": "sha256-brSDa39ISF1+N8u/b/x27IN3wiu+sTll2nMf+IqWPS0="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -471,23 +466,23 @@
   },
   {
     "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.7.1",
-    "hash": "sha256-HpIgMY0LRyeeipkW+rjhsqZnso3bWUTP5GZ4EJfkR0w="
+    "version": "1.7.3",
+    "hash": "sha256-Z6WsY2FCUbNnT5HJd7IOrfOvqknVXp6PWzTVeb0idVg="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "1.7.1",
-    "hash": "sha256-LrNo9GKe7cFL7JXKU4h1jpiGxp5465MRJFWhErfOYOs="
+    "version": "1.7.3",
+    "hash": "sha256-QX6Oo6uI9XWRbgrjdHxzROIhTHm12ai6wIDtDuqDJwA="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.7.1",
-    "hash": "sha256-zaDOAoEA4CF6/7rXLBO5f5d8PpcqB7hKlwdEWzaFsNk="
+    "version": "1.7.3",
+    "hash": "sha256-PTee04FHyTHx/gF5NLckXuVje807G51MzkPrZ1gkgCw="
   },
   {
     "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.7.1",
-    "hash": "sha256-6o3qqXK6dxybHybl2k/aY2flxPc2z/1VQMWQPm2Ns0g="
+    "version": "1.7.3",
+    "hash": "sha256-8d+wZmucfSO7PsviHjVxYB4q6NcjgxvnCUpLePq35sM="
   },
   {
     "pname": "Microsoft.Testing.Platform",
@@ -496,13 +491,13 @@
   },
   {
     "pname": "Microsoft.Testing.Platform",
-    "version": "1.7.1",
-    "hash": "sha256-YJ41q1VXvFZh/TWo3tutGQnhNCrxv/QbDLTxCS4b/w4="
+    "version": "1.7.3",
+    "hash": "sha256-cavX11P5o9rooqC3ZHw5h002OKRg2ZNR/VaRwpNTQYA="
   },
   {
     "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.7.1",
-    "hash": "sha256-j/JO5dVIHWTbUO12ZZJdQ5CB2TcBqGfZTcmVFuT3nyA="
+    "version": "1.7.3",
+    "hash": "sha256-cREl529UQ/c5atT8KimMgrgNdy6MrAd0sBGT8sXRRPM="
   },
   {
     "pname": "Microsoft.TestPlatform.AdapterUtilities",
@@ -526,23 +521,23 @@
   },
   {
     "pname": "MSTest",
-    "version": "3.9.1",
-    "hash": "sha256-7gpZKkbGRA4kjUMHrE5pgM3jQhzYQxO3RB5OfDz0Ed4="
+    "version": "3.9.3",
+    "hash": "sha256-sfvkUW4AZEmFduiSZYh3ZuXgE8/boC7gYMMleP4nkUA="
   },
   {
     "pname": "MSTest.Analyzers",
-    "version": "3.9.1",
-    "hash": "sha256-jr5UOnoX2mHFjMgo/e//4Fi736mkaYj6ChFuwP8jC2w="
+    "version": "3.9.3",
+    "hash": "sha256-uD74gJNVNSQNsxyzf/5kxCBFbgIY7pYdUrKZihAyLi4="
   },
   {
     "pname": "MSTest.TestAdapter",
-    "version": "3.9.1",
-    "hash": "sha256-nlX47U5Yxds0BXJtwWtMPY+HbEFO8TRr7yC+GS1laxU="
+    "version": "3.9.3",
+    "hash": "sha256-0krWgHpALFJMX707/SMN7b5ryEgm7taCoxtC4WBaglM="
   },
   {
     "pname": "MSTest.TestFramework",
-    "version": "3.9.1",
-    "hash": "sha256-ORwTveV9nPnx4s9av8EFt8MQ4G0pF9M8Ped/ibZXvG4="
+    "version": "3.9.3",
+    "hash": "sha256-kkW155gzuv0xjiucutNs4RjF9g2NEIZ39+nruRun4As="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -646,13 +641,13 @@
   },
   {
     "pname": "Scalar.AspNetCore",
-    "version": "2.4.4",
-    "hash": "sha256-MyNRQMFXIRf6znM3SL3P+Z8jO+3Q5i23TDQuG+ZUcTY="
+    "version": "2.5.3",
+    "hash": "sha256-5rMpkchzxeO3/694RvaVzuQS9Xqd7YGDbBzqCkNyhFs="
   },
   {
     "pname": "SteamKit2",
-    "version": "3.2.0",
-    "hash": "sha256-hB/36fP9kf+1mIx+hTELUMHe8ZkmSKxOK41ZzOaBa3E="
+    "version": "3.3.0",
+    "hash": "sha256-/NxnVDatdrqIXCjs0P4gRjHq42r/K+wOv3JO5yiAIjU="
   },
   {
     "pname": "System.Buffers",
@@ -671,33 +666,33 @@
   },
   {
     "pname": "System.Composition",
-    "version": "9.0.5",
-    "hash": "sha256-Y8MPR8xot93lo4jAgVJ101M+JN973CpvOlCSYUK7wxc="
+    "version": "9.0.6",
+    "hash": "sha256-p8Oa6kjNnwzUPiotQZaLKNd5HWyaLAUrXDEb9+qGe4c="
   },
   {
     "pname": "System.Composition.AttributedModel",
-    "version": "9.0.5",
-    "hash": "sha256-CkqRwQGCRteSmN+nRF0rm8wGf2QA7gfqsVF8lBTg9EE="
+    "version": "9.0.6",
+    "hash": "sha256-39rilNPGuizRbLS9uJf8xKUsJwP6OrwlIrC0b2n2ujI="
   },
   {
     "pname": "System.Composition.Convention",
-    "version": "9.0.5",
-    "hash": "sha256-iaSaDpiep+8dthACDpgN0GJ5jRqLVzCVEKNOHUuy3/0="
+    "version": "9.0.6",
+    "hash": "sha256-/+Os5orfTZ45G+SSccBV21OGlbmqI71wZDTCbzvI3DI="
   },
   {
     "pname": "System.Composition.Hosting",
-    "version": "9.0.5",
-    "hash": "sha256-P98I/5Vs08bDObpicSzHXigXiadJA5uIKqd78WABU40="
+    "version": "9.0.6",
+    "hash": "sha256-krp3xyEOHtF/TRu7GPKaNXe+uKhDRhlNBWAD+eAfyYg="
   },
   {
     "pname": "System.Composition.Runtime",
-    "version": "9.0.5",
-    "hash": "sha256-o4yiU61i6X2Tn20pUrf/psESngE/nGHTlJSe4S7qIQ0="
+    "version": "9.0.6",
+    "hash": "sha256-ou4oVkNKVFcHgBsiKxmBfwLCDRberIlwD1uvR2XfMT8="
   },
   {
     "pname": "System.Composition.TypedParts",
-    "version": "9.0.5",
-    "hash": "sha256-+09hA4PfsR9BLHkV1aadh8Jx10AwcFrG+49U0vMATPU="
+    "version": "9.0.6",
+    "hash": "sha256-2z3Pi2vu6Acyn988JeM2B5jKYxCg8LqV8p+4Z4e094g="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -711,13 +706,13 @@
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "9.0.4",
-    "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU="
+    "version": "9.0.5",
+    "hash": "sha256-hMAhIhYl1QhtD21kSitvSnsNd9KgSydIRvjwZ/1iFes="
   },
   {
     "pname": "System.Linq.Async",
-    "version": "6.0.1",
-    "hash": "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="
+    "version": "6.0.3",
+    "hash": "sha256-i+2XnsOJnD7R/vCFtadp+lwrkDNAscANes2Ur0MSTl8="
   },
   {
     "pname": "System.Memory",
@@ -746,8 +741,8 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.5",
-    "hash": "sha256-Ed2Ea4ssYYHBBeFs0Vva+G8lEF5VFcm+DWJl/xi7arY="
+    "version": "9.0.6",
+    "hash": "sha256-WMa3KDeFuOLyIZduYd+9PCyx7usJMRu/q2x3eOw9MAQ="
   },
   {
     "pname": "System.Security.Principal.Windows",

pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix

@@ -7,7 +7,7 @@
 
 buildNpmPackage rec {
   pname = "asf-ui";
-  version = "9920764dafb0a7a87c355d9c87aff285e41494be";
+  version = "b984a9de784afb9d11364b3541961888cab8e025";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
     rev = version;
-    hash = "sha256-w4pYFCdJiHocy41az4/tjWdBwAdI68RV/N8I0Onsofg=";
+    hash = "sha256-qipcDwn6Jte8MRUIgmYSuMzs4sewItlzFIeupYKkg+A=";
   };
 
-  npmDepsHash = "sha256-V9u+n4CTB+BU0zeiB8vLpFkI2VJGArU6WL+PFfi624M=";
+  npmDepsHash = "sha256-UhakvqDoWxt/nudEqUZcp8Bk0sIdYSXCYHv8YbsrWDU=";
 
   installPhase = ''
     runHook preInstall

pkgs/applications/misc/electrum/default.nix

@@ -134,7 +134,7 @@ python3.pkgs.buildPythonApplication rec {
     pycryptodomex
   ];
 
-  pytestFlagsArray = [ "tests" ];
+  enabledTestPaths = [ "tests" ];
 
   postCheck = ''
     $out/bin/electrum help >/dev/null

pkgs/applications/misc/electrum/ltc.nix

@@ -159,7 +159,7 @@ python3.pkgs.buildPythonApplication {
   ];
   buildInputs = lib.optional stdenv.hostPlatform.isLinux qtwayland;
 
-  pytestFlagsArray = [ "electrum_ltc/tests" ];
+  enabledTestPaths = [ "electrum_ltc/tests" ];
 
   disabledTests = [
     "test_loop" # test tries to bind 127.0.0.1 causing permission error

pkgs/applications/misc/gpxsee/default.nix

@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "13.44";
+  version = "13.45";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     tag = finalAttrs.version;
-    hash = "sha256-eFANrUMESQVsZwTfz20VW2Qf7hiSgtkeKszCiJ8i/jk=";
+    hash = "sha256-3GPpr8L+oMHCGXo3RVaky6EjDrEiBERRU6w56o17Xhc=";
   };
 
   buildInputs =

pkgs/applications/misc/mbutil/default.nix

@@ -23,7 +23,7 @@ buildPythonApplication rec {
   build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
-  pytestFlagsArray = [ "test/test.py" ];
+  enabledTestPaths = [ "test/test.py" ];
 
   meta = {
     description = "Importer and exporter for MBTiles";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -171,22 +171,22 @@
     "vendorHash": null
   },
   "bigip": {
-    "hash": "sha256-JGsleJiOo2wnIObvbQpvpmfc/CUaznVDIiNFX+eetW8=",
+    "hash": "sha256-lhN9YPufx6JITEhwLfqUMudXKTJqFdRCPkS+lTZpmH8=",
     "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
     "owner": "F5Networks",
     "repo": "terraform-provider-bigip",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-ZFHe91xPeKTdLRnOyFECjg1/7G2RPGpXSgaZOFrnDpY=",
+    "hash": "sha256-McRv7POFoxkehhDQWIzMY96e/Uv+lc5L0bKVlzITBZA=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.47.0",
+    "rev": "v2.48.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AcHndbTWMMsE7CSnLtUdnfyIfkKVfmOobNOhvtrTh4I="
+    "vendorHash": "sha256-ok73U0WWFGXp5TJ7sp7U9umq7DlChCw7fSyFmbifwKE="
   },
   "bitwarden": {
     "hash": "sha256-eqWyKPzSINSZcO8Ho0WHTeVDOxbUynOzupXu6vzTtuU=",
@@ -552,11 +552,11 @@
     "vendorHash": "sha256-QTcWJlwE6s4nEPSg6svzIhsJo9p9rk1gQiSr4qSTfns="
   },
   "gridscale": {
-    "hash": "sha256-GHKGlqAFWVPmD7NRFcm651XBVzTtNy8mb/sKtjULkB4=",
+    "hash": "sha256-zD3KiTLKALVOvFOewWyrd65p0XmLOi/bSIP27dXwveU=",
     "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
     "owner": "gridscale",
     "repo": "terraform-provider-gridscale",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1147,13 +1147,13 @@
     "vendorHash": null
   },
   "sakuracloud": {
-    "hash": "sha256-vIP7hlPvx7o8/uXpg6TOEeoDL9FGaTBdXzziOyLrdGY=",
+    "hash": "sha256-IbR3m0s5LCC9tIOC67yn2yI6lssnIlc/pB6XIf0UOuk=",
     "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
     "owner": "sacloud",
     "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.28.0",
+    "rev": "v2.28.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-hJmMNxlhyzcnguLFJih/K1CSZHIOspTgCJ8nyVjT7mg="
+    "vendorHash": "sha256-HKmIl/GjGJZmhWLrK3lMjYo1F5nmo+U9ZpvBo5hDH/0="
   },
   "scaleway": {
     "hash": "sha256-3MLtSOcMCIl3pFJH/xKK/fPQcRrW2Nx4b2jCZiUE2aw=",

pkgs/applications/networking/firehol/default.nix

@@ -10,7 +10,7 @@
   iptables,
   iputils,
   kmod,
-  nettools,
+  net-tools,
   procps,
   tcpdump,
   traceroute,
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     iptables
     iputils
     kmod
-    nettools
+    net-tools
     procps
     tcpdump
     traceroute

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -32,7 +32,7 @@
   gst-plugins-good,
   gst-plugins-bad,
   gst-vaapi,
-  webrtc-audio-processing_1,
+  webrtc-audio-processing,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     gst-plugins-good # contains rtpbin, required for VP9
     gst-plugins-bad # required for H264, MSDK
     gst-vaapi # required for VAAPI
-    webrtc-audio-processing_1
+    webrtc-audio-processing
   ];
 
   doCheck = true;

pkgs/applications/networking/instant-messengers/jami/default.nix

@@ -30,7 +30,7 @@
   secp256k1,
   speex,
   udev,
-  webrtc-audio-processing,
+  webrtc-audio-processing_0_3,
   yaml-cpp,
   zlib,
 
@@ -220,7 +220,7 @@ stdenv.mkDerivation rec {
       secp256k1
       speex
       udev
-      webrtc-audio-processing
+      webrtc-audio-processing_0_3
       yaml-cpp
       zlib
     ];

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -95,8 +95,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "140.0";
-    sha512 = "2e9a5fb44b21eba3e3295205142bfad666a65f9eea43118388968320597a940cf3c5675fbcf458fbbaa9e1bb85fe8a663feda6461b7e23f7103c5bb7a1103bd4";
+    version = "140.0.1";
+    sha512 = "fbef1d0228c49fc9c11425b6be03bb7e44e6abc6f2027ee23317270ca2c6b0a935bb41b38667acf014bd9e1166cbe62754f1e919e04f2355dc4c833e015c78b8";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/applications/office/libreoffice/skip-broken-tests.patch

@@ -1,6 +1,8 @@
+diff --git a/desktop/qa/desktop_lib/test_desktop_lib.cxx b/desktop/qa/desktop_lib/test_desktop_lib.cxx
+index 231aea8d0f3c..214a23c82562 100644
 --- a/desktop/qa/desktop_lib/test_desktop_lib.cxx
 +++ b/desktop/qa/desktop_lib/test_desktop_lib.cxx
-@@ -595,6 +595,8 @@ void DesktopLOKTest::testGetFilterTypes()
+@@ -603,6 +603,8 @@ void DesktopLOKTest::testGetFilterTypes()
  
  void DesktopLOKTest::testSearchCalc()
  {
@@ -9,7 +11,7 @@
      LibLibreOffice_Impl aOffice;
      LibLODocument_Impl* pDocument = loadDoc("search.ods");
      pDocument->pClass->initializeForRendering(pDocument, nullptr);
-@@ -625,6 +627,8 @@ void DesktopLOKTest::testSearchCalc()
+@@ -633,6 +635,8 @@ void DesktopLOKTest::testSearchCalc()
  
  void DesktopLOKTest::testSearchAllNotificationsCalc()
  {
@@ -18,6 +20,8 @@
      LibLibreOffice_Impl aOffice;
      LibLODocument_Impl* pDocument = loadDoc("search.ods");
      pDocument->pClass->initializeForRendering(pDocument, nullptr);
+diff --git a/svgio/qa/cppunit/data/tdf160386.svg b/svgio/qa/cppunit/data/tdf160386.svg
+index 1644b0d15514..cf429508bcd4 100644
 --- a/svgio/qa/cppunit/data/tdf160386.svg
 +++ b/svgio/qa/cppunit/data/tdf160386.svg
 @@ -8,7 +8,6 @@
@@ -28,9 +32,11 @@
      <text systemLanguage="ru">Привет!</text>
      <text>☺</text>
    </switch>
+diff --git a/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx b/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
+index d8093e57a4e8..c95a742a68d3 100644
 --- a/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
 +++ b/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
-@@ -361,6 +361,8 @@ void checkIssuePosition(std::shared_ptr<sfx::AccessibilityIssue> const& pIssue,
+@@ -422,6 +422,8 @@ void checkIssuePosition(std::shared_ptr<sfx::AccessibilityIssue> const& pIssue,
  
  CPPUNIT_TEST_FIXTURE(AccessibilityCheckTest, testOnlineNodeSplitAppend)
  {
@@ -39,9 +45,11 @@
      // Checks the a11y checker is setting the a11y issues to the nodes
      // correctly when splitting and appending nodes (through undo), which
      // happen on editing all the time.
+diff --git a/sw/qa/core/text/text.cxx b/sw/qa/core/text/text.cxx
+index b81146642bd4..2094b7ea9477 100644
 --- a/sw/qa/core/text/text.cxx
 +++ b/sw/qa/core/text/text.cxx
-@@ -1630,6 +1630,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
+@@ -1596,6 +1596,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
  
  CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testTdf129810)
  {
@@ -50,9 +58,23 @@
      // Load the document.
      // The document embeds a subset of "Source Han Serif SC" so that it works
      // even when the font is not installed.
+diff --git a/sw/qa/extras/docbookexport/docbookexport.cxx b/sw/qa/extras/docbookexport/docbookexport.cxx
+index e7543d99577e..f44f92a47c7e 100644
+--- a/sw/qa/extras/docbookexport/docbookexport.cxx
++++ b/sw/qa/extras/docbookexport/docbookexport.cxx
+@@ -21,6 +21,7 @@ public:
+ 
+ CPPUNIT_TEST_FIXTURE(DocbookExportTest, testsimple)
+ {
++    return; // fails on latest libxml
+     createSwDoc("simple.docx");
+     save(mpFilter);
+     xmlDocUniquePtr pDoc = parseXml(maTempFile);
+diff --git a/sw/qa/extras/htmlimport/htmlimport.cxx b/sw/qa/extras/htmlimport/htmlimport.cxx
+index 6cf8f22647b9..12848713771b 100644
 --- a/sw/qa/extras/htmlimport/htmlimport.cxx
 +++ b/sw/qa/extras/htmlimport/htmlimport.cxx
-@@ -308,6 +308,8 @@ CPPUNIT_TEST_FIXTURE(HtmlImportTest, testTableBorder1px)
+@@ -297,6 +297,8 @@ CPPUNIT_TEST_FIXTURE(HtmlImportTest, testTableBorder1px)
  
  CPPUNIT_TEST_FIXTURE(HtmlImportTest, testOutlineLevel)
  {
@@ -61,9 +83,11 @@
      createSwWebDoc("outline-level.html");
      // This was 0, HTML imported into Writer lost the outline numbering for
      // Heading 1 styles.
+diff --git a/sw/qa/extras/layout/layout3.cxx b/sw/qa/extras/layout/layout3.cxx
+index e53d22c8fd1a..2f9decb0d931 100644
 --- a/sw/qa/extras/layout/layout3.cxx
 +++ b/sw/qa/extras/layout/layout3.cxx
-@@ -1038,6 +1038,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf158658c)
+@@ -1388,6 +1388,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf158658c)
  
  CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf155177)
  {
@@ -72,6 +96,8 @@
      createSwDoc("tdf155177-1-min.odt");
  
      uno::Reference<beans::XPropertySet> xStyle(
+diff --git a/sw/qa/extras/odfimport/odfimport.cxx b/sw/qa/extras/odfimport/odfimport.cxx
+index 794b3bd16ed4..3feaadd7a20f 100644
 --- a/sw/qa/extras/odfimport/odfimport.cxx
 +++ b/sw/qa/extras/odfimport/odfimport.cxx
 @@ -602,6 +602,8 @@ CPPUNIT_TEST_FIXTURE(Test, testFdo56272)
@@ -83,18 +109,20 @@
      createSwDoc("incorrectsum.odt");
      Scheduler::ProcessEventsToIdle();
      uno::Reference<text::XTextTablesSupplier> xTablesSupplier(mxComponent, uno::UNO_QUERY);
+diff --git a/sw/qa/extras/tiledrendering/tiledrendering.cxx b/sw/qa/extras/tiledrendering/tiledrendering.cxx
+index 4ebc4be96149..85b8908e16b9 100644
 --- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
 +++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
-@@ -2762,6 +2762,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDeleteNodeRedlineCallback)
+@@ -2538,6 +2538,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testVisCursorInvalidation)
  
- CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testVisCursorInvalidation)
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDeselectCustomShape)
  {
 +    return; // flaky on some backends?
 +
      SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
-     ViewCallback aView1;
-     int nView1 = SfxLokHelper::getView();
-@@ -3048,6 +3050,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
+     SwWrtShell* pWrtShell = getSwDocShell()->GetWrtShell();
+     SwShellCursor* pShellCursor = pWrtShell->getShellCursor(false);
+@@ -2745,6 +2747,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
  
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testTdf43244_SpacesOnMargin)
  {
@@ -103,7 +131,7 @@
      // Load a document where the top left tile contains
      // paragraph and line break symbols with redlining.
      SwXTextDocument* pXTextDocument = createDoc("tdf43244_SpacesOnMargin.odt");
-@@ -4091,6 +4095,7 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
+@@ -3786,6 +3790,7 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
  // toggling Formatting Marks on/off for one view should have no effect on other views
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testToggleFormattingMarks)
  {
@@ -111,13 +139,15 @@
      SwXTextDocument* pXTextDocument = createDoc();
      int nView1 = SfxLokHelper::getView();
  
+diff --git a/sw/qa/extras/uiwriter/uiwriter5.cxx b/sw/qa/extras/uiwriter/uiwriter5.cxx
+index e37df27fd817..937c12e8c4c5 100644
 --- a/sw/qa/extras/uiwriter/uiwriter5.cxx
 +++ b/sw/qa/extras/uiwriter/uiwriter5.cxx
-@@ -1571,6 +1571,7 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldContentOperations)
+@@ -1549,6 +1549,7 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldContentOperations)
  
  CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldCurrentDateHandling)
  {
 +    return; // flaky on KF6
      createSwDoc();
      SwDoc* pDoc = getSwDoc();
-     CPPUNIT_ASSERT(pDoc);
+     IDocumentMarkAccess* pMarkAccess = pDoc->getIDocumentMarkAccess();

pkgs/applications/office/scribus/default.nix

@@ -4,14 +4,27 @@
   cmake,
   cups,
   fetchurl,
+  fetchpatch,
   fontconfig,
   freetype,
+  graphicsmagick,
   harfbuzzFull,
   hunspell,
   lcms2,
+  libcdr,
+  libfreehand,
   libjpeg,
+  libjxl,
+  libmspub,
+  libpagemaker,
+  libqxp,
+  librevenge,
+  libsysprof-capture,
   libtiff,
+  libvisio,
+  libwpg,
   libxml2,
+  libzmf,
   pixman,
   pkg-config,
   podofo_0_10,
@@ -20,7 +33,7 @@
   python3,
   lib,
   stdenv,
-  qt5,
+  qt6,
 }:
 
 let
@@ -32,17 +45,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.6.4";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UzvnrwOs+qc27F96P8JWKr0gD+9coqfN7gK19E1hgp4=";
+    hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -51,37 +64,63 @@ stdenv.mkDerivation (finalAttrs: {
     cups
     fontconfig
     freetype
+    graphicsmagick
     harfbuzzFull
     hunspell
     lcms2
+    libcdr
+    libfreehand
     libjpeg
+    libjxl
+    libpagemaker
+    libqxp
+    librevenge
+    libsysprof-capture
     libtiff
+    libvisio
+    libwpg
     libxml2
+    libzmf
     pixman
     podofo_0_10
     poppler
     poppler_data
     pythonEnv
-    qt5.qtbase
-    qt5.qtimageformats
-    qt5.qttools
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtimageformats
+    qt6.qtsvg
+    qt6.qttools
+  ] ++ lib.optionals libmspub.meta.available [ libmspub ];
+
+  cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable";
+      hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable";
+      hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg=";
+    })
   ];
 
-  meta = with lib; {
-    maintainers = with maintainers; [
-      arthsmn
-    ];
+  meta = {
+    maintainers = with lib.maintainers; [ arthsmn ];
     description = "Desktop Publishing (DTP) and Layout program";
     mainProgram = "scribus";
     homepage = "https://www.scribus.net";
     # There are a lot of licenses...
     # https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
-    license = with licenses; [
+    license = with lib.licenses; [
       bsd3
       gpl2Plus
       mit
       publicDomain
     ];
+    platforms = lib.platforms.all;
     broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/applications/science/misc/sasview/default.nix

@@ -59,7 +59,7 @@ python3.pkgs.buildPythonApplication rec {
     unittest-xml-reporting
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "test"
   ];
 

pkgs/applications/version-management/git/default.nix

@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.49.0";
+  version = "2.50.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -89,11 +89,12 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-YYGQz1kLfp9sEfkfI7HSZ82Yw6szuFBBbYdY+LWoVig=";
+    hash = "sha256-3/PAAOQArOOmO4pvizt2uI7P3/1FBKBKukJINyzewEU=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
   separateDebugInfo = true;
+  __structuredAttrs = true;
 
   hardeningDisable = [ "format" ];
 
@@ -116,7 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
       # Fix references to gettext introduced by ./git-sh-i18n.patch
       substituteInPlace git-sh-i18n.sh \
           --subst-var-by gettext ${gettext}
-
+    ''
+    + lib.optionalString doInstallCheck ''
       # ensure we are using the correct shell when executing the test scripts
       patchShebangs t/*.sh
     ''
@@ -165,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   # required to support pthread_cancel()
-  NIX_LDFLAGS =
+  env.NIX_LDFLAGS =
     lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
     + lib.optionalString (stdenv.hostPlatform.isFreeBSD) "-lthr";
 
@@ -282,10 +284,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall =
     ''
-      notSupported() {
-        unlink $1 || true
-      }
-
       # Set up the flags array for make in the same way as for the main install
       # phase from stdenv.
       local flagsArray=(
@@ -303,7 +301,6 @@ stdenv.mkDerivation (finalAttrs: {
       mkdir -p $out/share/git
       cp -a contrib $out/share/git/
       mkdir -p $out/share/bash-completion/completions
-      ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/git
       ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
       # only readme, developed in another repo
       rm -r contrib/hooks/multimail
@@ -382,8 +379,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''
       else
         ''
-          # replace git-svn by notification script
-          notSupported $out/libexec/git-core/git-svn
+          rm $out/libexec/git-core/git-svn
         ''
     )
 
@@ -396,14 +392,13 @@ stdenv.mkDerivation (finalAttrs: {
         ''
       else
         ''
-          # replace git-send-email by notification script
-          notSupported $out/libexec/git-core/git-send-email
+          rm $out/libexec/git-core/git-send-email
         ''
     )
 
     + lib.optionalString withManual ''
       # Install man pages
-      make "''${flagsArray[@]}" cmd-list.made install install-html \
+      make "''${flagsArray[@]}" install install-html \
         -C Documentation
     ''
 
@@ -420,9 +415,8 @@ stdenv.mkDerivation (finalAttrs: {
         ''
       else
         ''
-          # Don't wrap Tcl/Tk, replace them by notification scripts
           for prog in bin/gitk libexec/git-core/git-gui; do
-            notSupported "$out/$prog"
+            rm "$out/$prog"
           done
         ''
     )
@@ -573,6 +567,8 @@ stdenv.mkDerivation (finalAttrs: {
       wmertens
       globin
       kashw2
+      me-and
+      philiptaron
     ];
     mainProgram = "git";
   };

pkgs/applications/video/mpv/scripts/quality-menu.nix

@@ -8,13 +8,13 @@
 
 buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-uaU4W72P7zhHzxmfr59icCAl1mJ3ycLGzkGcYasHllI=";
+    hash = "sha256-W+6OYjh0S7nYrNC/P9sF7t6p1Rt/awOtO865cr6qtR0=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

pkgs/applications/virtualization/qemu/default.nix

@@ -144,11 +144,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.0.0";
+  version = "10.0.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-IsB1YB/c+MeyZxqDnr3O8dTylz62c1JU/S4b0PMLOJY=";
+    hash = "sha256-73hvI5jLUYRgD2mu9NXWke/URXajz/QSbTjUxv7Id1k=";
   };
 
   depsBuildBuild =

pkgs/applications/virtualization/virtualbox/default.nix

@@ -35,7 +35,7 @@
   alsa-lib,
   curl,
   libvpx,
-  nettools,
+  net-tools,
   dbus,
   replaceVars,
   gsoap,
@@ -263,7 +263,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   postPatch = ''
-    sed -i -e 's|/sbin/ifconfig|${nettools}/bin/ifconfig|' \
+    sed -i -e 's|/sbin/ifconfig|${net-tools}/bin/ifconfig|' \
       src/VBox/HostDrivers/adpctl/VBoxNetAdpCtl.cpp
   '';
 

pkgs/applications/window-managers/awesome/default.nix

@@ -20,7 +20,7 @@
   gobject-introspection,
   which,
   dbus,
-  nettools,
+  net-tools,
   git,
   doxygen,
   xmlto,
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     libstartup_notification
     libxdg_basedir
     lua
-    nettools
+    net-tools
     pango
     xcb-util-cursor
     xorg.libXau

pkgs/build-support/buildenv/builder.pl

@@ -9,8 +9,8 @@ use JSON::PP;
 
 STDOUT->autoflush(1);
 
-$SIG{__WARN__} = sub { warn "warning: ", @_ };
-$SIG{__DIE__}  = sub { die "error: ", @_ };
+$SIG{__WARN__} = sub { warn "pkgs.buildEnv warning: ", @_ };
+$SIG{__DIE__}  = sub { die "pkgs.buildEnv error: ", @_ };
 
 my $out = $ENV{"out"};
 my $extraPrefix = $ENV{"extraPrefix"};
@@ -109,7 +109,7 @@ sub findFiles($relName, $target, $baseName, $ignoreCollisions, $checkCollisionCo
     # The store path must not be a file when not ignoreSingleFileOutputs
     if (-f $target && isStorePath $target) {
         if ($ignoreSingleFileOutputs) {
-            warn "The store path $target is a file and can't be merged into an environment using pkgs.buildEnv";
+            warn "The store path $target is a file and can't be merged into an environment using pkgs.buildEnv, ignoring it";
             return;
         } else {
             die "The store path $target is a file and can't be merged into an environment using pkgs.buildEnv!";
@@ -173,12 +173,12 @@ sub findFiles($relName, $target, $baseName, $ignoreCollisions, $checkCollisionCo
         my $oldTargetRef = prependDangling($oldTarget);
 
         if ($ignoreCollisions) {
-            warn "collision between $targetRef and $oldTargetRef\n" if $ignoreCollisions == 1;
+            warn "colliding subpath (ignored): $targetRef and $oldTargetRef\n" if $ignoreCollisions == 1;
             return;
         } elsif ($checkCollisionContents && checkCollision($oldTarget, $target)) {
             return;
         } else {
-            die "collision between $targetRef and $oldTargetRef\n";
+            die "two given paths contain a conflicting subpath:\n  $targetRef and\n  $oldTargetRef\nhint: this may be caused by two different versions of the same package in buildEnv's `paths` parameter\nhint: `pkgs.nix-diff` can be used to compare derivations\n";
         }
     }
 

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -18,21 +18,6 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
   hardeningEnableMap["fortify"]=1
 fi
 
-# Remove unsupported flags.
-for flag in @hardening_unsupported_flags@; do
-  unset -v "hardeningEnableMap[$flag]"
-  # fortify being unsupported implies fortify3 is unsupported
-  if [[ "$flag" = 'fortify' ]] ; then
-    unset -v "hardeningEnableMap['fortify3']"
-  fi
-done
-
-# now make fortify and fortify3 mutually exclusive
-if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
-  unset -v "hardeningEnableMap['fortify']"
-fi
-
-
 # strictflexarrays3 implies strictflexarrays1 enablement - make explicit before
 # we filter unsupported flags because unsupporting strictflexarrays3
 # doesn't mean we should unsupport strictflexarrays1 too
@@ -40,15 +25,26 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   hardeningEnableMap["strictflexarrays1"]=1
 fi
 
+
 # Remove unsupported flags.
 for flag in @hardening_unsupported_flags@; do
   unset -v "hardeningEnableMap[$flag]"
+  # fortify being unsupported implies fortify3 is unsupported
+  if [[ "$flag" = 'fortify' ]] ; then
+    unset -v "hardeningEnableMap['fortify3']"
+  fi
   # strictflexarrays1 being unsupported implies strictflexarrays3 is unsupported
   if [[ "$flag" = 'strictflexarrays1' ]] ; then
     unset -v "hardeningEnableMap['strictflexarrays3']"
   fi
 done
 
+
+# now make fortify and fortify3 mutually exclusive
+if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
+  unset -v "hardeningEnableMap['fortify']"
+fi
+
 # now make strictflexarrays1 and strictflexarrays3 mutually exclusive
 if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   unset -v "hardeningEnableMap['strictflexarrays1']"

pkgs/build-support/cc-wrapper/default.nix

@@ -726,6 +726,15 @@ stdenvNoCC.mkDerivation {
       echo "-isystem ${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
+    # GCC NG friendly libc++
+    + optionalString (libcxx != null && libcxx.isGNU or false) ''
+      for dir in ${getDev libcxx}/include/c++/*; do
+        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+      done
+      for dir in ${getDev libcxx}/include/c++/*/${targetPlatform.config}; do
+        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+      done
+    ''
 
     ##
     ## Initial CFLAGS

pkgs/build-support/fetchurl/mirrors.nix

@@ -69,12 +69,6 @@
   gnome = [
     # This one redirects to some mirror closeby, so it should be all you need
     "https://download.gnome.org/"
-
-    "https://fr2.rpmfind.net/linux/gnome.org/"
-    "https://ftp.acc.umu.se/pub/GNOME/"
-    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
-    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
-    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
   ];
 
   # GNU (https://www.gnu.org/prep/ftp.html)

pkgs/build-support/node/fetch-yarn-deps/common.js

@@ -3,17 +3,17 @@ const path = require('path')
 // This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
 // so that fixup_yarn_lock produces the same paths
 const urlToName = url => {
-	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
 
-	if (url.startsWith('file:')) {
-		return url
-	} else if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
-		return path.basename(url)
-	} else {
-		return url
-			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-	}
+  if (url.startsWith('file:')) {
+    return url
+  } else if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+    return path.basename(url)
+  } else {
+    return url
+      .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+      .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+  }
 }
 
 module.exports = { urlToName };

pkgs/build-support/node/fetch-yarn-deps/fixup.js

@@ -7,79 +7,79 @@ const lockfile = require('./yarnpkg-lockfile.js')
 const { urlToName } = require('./common.js')
 
 const fixupYarnLock = async (lockContents, verbose) => {
-	const lockData = lockfile.parse(lockContents)
+  const lockData = lockfile.parse(lockContents)
 
-	const fixedData = Object.fromEntries(
-		Object.entries(lockData.object)
-		.map(([dep, pkg]) => {
-			if (pkg.resolved === undefined) {
-				console.warn(`no resolved URL for package ${dep}`)
-				var maybeFile = dep.split("@", 2)[1]
-				if (maybeFile.startsWith("file:")) {
-					console.log(`Rewriting URL for local file dependency ${dep}`)
-					pkg.resolved = maybeFile
-				}
-				return [dep, pkg]
-			}
-			const [ url, hash ] = pkg.resolved.split("#", 2)
+  const fixedData = Object.fromEntries(
+    Object.entries(lockData.object)
+    .map(([dep, pkg]) => {
+      if (pkg.resolved === undefined) {
+        console.warn(`no resolved URL for package ${dep}`)
+        var maybeFile = dep.split("@", 2)[1]
+        if (maybeFile.startsWith("file:")) {
+          console.log(`Rewriting URL for local file dependency ${dep}`)
+          pkg.resolved = maybeFile
+        }
+        return [dep, pkg]
+      }
+      const [ url, hash ] = pkg.resolved.split("#", 2)
 
-			if (hash || url.startsWith("https://codeload.github.com/")) {
-				if (verbose) console.log(`Removing integrity for git dependency ${dep}`)
-				delete pkg.integrity
-			}
+      if (hash || url.startsWith("https://codeload.github.com/")) {
+        if (verbose) console.log(`Removing integrity for git dependency ${dep}`)
+        delete pkg.integrity
+      }
 
-			if (verbose) console.log(`Rewriting URL ${url} for dependency ${dep}`)
-			pkg.resolved = urlToName(url)
-			if (hash)
-				pkg.resolved += `#${hash}`
+      if (verbose) console.log(`Rewriting URL ${url} for dependency ${dep}`)
+      pkg.resolved = urlToName(url)
+      if (hash)
+        pkg.resolved += `#${hash}`
 
-			return [dep, pkg]
-		})
-	)
+      return [dep, pkg]
+    })
+  )
 
-	if (verbose) console.log('Done')
+  if (verbose) console.log('Done')
 
-	return fixedData
+  return fixedData
 }
 
 const showUsage = async () => {
-	process.stderr.write(`
+  process.stderr.write(`
 syntax: fixup-yarn-lock [path to yarn.lock] [options]
 
 Options:
   -h --help         Show this help
   -v --verbose      Verbose output
 `)
-	process.exit(1)
+  process.exit(1)
 }
 
 const main = async () => {
-	const args = process.argv.slice(2)
-	let next, lockFile, verbose
-	while (next = args.shift()) {
-		if (next == '--verbose' || next == '-v') {
-			verbose = true
-		} else if (next == '--help' || next == '-h') {
-			showUsage()
-		} else if (!lockFile) {
-			lockFile = next
-		} else {
-			showUsage()
-		}
-	}
-	let lockContents
-	try {
-		lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
-	} catch {
-		showUsage()
-	}
+  const args = process.argv.slice(2)
+  let next, lockFile, verbose
+  while (next = args.shift()) {
+    if (next == '--verbose' || next == '-v') {
+      verbose = true
+    } else if (next == '--help' || next == '-h') {
+      showUsage()
+    } else if (!lockFile) {
+      lockFile = next
+    } else {
+      showUsage()
+    }
+  }
+  let lockContents
+  try {
+    lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+  } catch {
+    showUsage()
+  }
 
-	const fixedData = await fixupYarnLock(lockContents, verbose)
-	await fs.promises.writeFile(lockFile || 'yarn.lock', lockfile.stringify(fixedData))
+  const fixedData = await fixupYarnLock(lockContents, verbose)
+  await fs.promises.writeFile(lockFile || 'yarn.lock', lockfile.stringify(fixedData))
 }
 
 main()
-	.catch(e => {
-		console.error(e)
-		process.exit(1)
-	})
+  .catch(e => {
+    console.error(e)
+    process.exit(1)
+  })

pkgs/build-support/node/fetch-yarn-deps/index.js

@@ -15,155 +15,155 @@ const { urlToName } = require('./common.js')
 const execFile = promisify(child_process.execFile)
 
 const exec = async (...args) => {
-	const res = await execFile(...args)
-	if (res.error) throw new Error(res.stderr)
-	return res
+  const res = await execFile(...args)
+  if (res.error) throw new Error(res.stderr)
+  return res
 }
 
 const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
-	return new Promise((resolve, reject) => {
-		const get = (url, redirects = 0) => https.get(url, (res) => {
-			if(redirects > 10) {
-				reject('Too many redirects!');
-				return;
-			}
-			if(res.statusCode === 301 || res.statusCode === 302) {
-				return get(res.headers.location, redirects + 1)
-			}
-			const file = fs.createWriteStream(fileName)
-			const hash = crypto.createHash(hashType)
-			res.pipe(file)
-			res.pipe(hash).setEncoding('hex')
-			res.on('end', () => {
-				file.close()
-				const h = hash.read()
-				if (expectedHash === undefined){
-					console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
-				} else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
-				resolve()
-			})
-			res.on('error', e => reject(e))
-		})
-		get(url)
-	})
+  return new Promise((resolve, reject) => {
+    const get = (url, redirects = 0) => https.get(url, (res) => {
+      if(redirects > 10) {
+        reject('Too many redirects!');
+        return;
+      }
+      if(res.statusCode === 301 || res.statusCode === 302) {
+        return get(res.headers.location, redirects + 1)
+      }
+      const file = fs.createWriteStream(fileName)
+      const hash = crypto.createHash(hashType)
+      res.pipe(file)
+      res.pipe(hash).setEncoding('hex')
+      res.on('end', () => {
+        file.close()
+        const h = hash.read()
+        if (expectedHash === undefined){
+          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+        resolve()
+      })
+      res.on('error', e => reject(e))
+    })
+    get(url)
+  })
 }
 
 const downloadGit = async (fileName, url, rev) => {
-	await exec('nix-prefetch-git', [
-		'--out', fileName + '.tmp',
-		'--url', url,
-		'--rev', rev,
-		'--builder'
-	])
+  await exec('nix-prefetch-git', [
+    '--out', fileName + '.tmp',
+    '--url', url,
+    '--rev', rev,
+    '--builder'
+  ])
 
-	await exec('tar', [
-		// hopefully make it reproducible across runs and systems
-		'--owner=0', '--group=0', '--numeric-owner', '--format=gnu', '--sort=name', '--mtime=@1',
+  await exec('tar', [
+    // hopefully make it reproducible across runs and systems
+    '--owner=0', '--group=0', '--numeric-owner', '--format=gnu', '--sort=name', '--mtime=@1',
 
-		// Set u+w because tar-fs can't unpack archives with read-only dirs: https://github.com/mafintosh/tar-fs/issues/79
-		'--mode', 'u+w',
+    // Set u+w because tar-fs can't unpack archives with read-only dirs: https://github.com/mafintosh/tar-fs/issues/79
+    '--mode', 'u+w',
 
-		'-C', fileName + '.tmp',
-		'-cf', fileName, '.'
-	])
+    '-C', fileName + '.tmp',
+    '-cf', fileName, '.'
+  ])
 
-	await exec('rm', [ '-rf', fileName + '.tmp', ])
+  await exec('rm', [ '-rf', fileName + '.tmp', ])
 }
 
 const isGitUrl = pattern => {
-	// https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/exotics/git-resolver.js#L15-L47
-	const GIT_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.com', 'bitbucket.org']
-	const GIT_PATTERN_MATCHERS = [/^git:/, /^git\+.+:/, /^ssh:/, /^https?:.+\.git$/, /^https?:.+\.git#.+/]
+  // https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/exotics/git-resolver.js#L15-L47
+  const GIT_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.com', 'bitbucket.org']
+  const GIT_PATTERN_MATCHERS = [/^git:/, /^git\+.+:/, /^ssh:/, /^https?:.+\.git$/, /^https?:.+\.git#.+/]
 
-	for (const matcher of GIT_PATTERN_MATCHERS) if (matcher.test(pattern)) return true
+  for (const matcher of GIT_PATTERN_MATCHERS) if (matcher.test(pattern)) return true
 
-	const {hostname, path} = url.parse(pattern)
-	if (hostname && path && GIT_HOSTS.indexOf(hostname) >= 0
-		// only if dependency is pointing to a git repo,
-		// e.g. facebook/flow and not file in a git repo facebook/flow/archive/v1.0.0.tar.gz
-		&& path.split('/').filter(p => !!p).length === 2
-	) return true
+  const {hostname, path} = url.parse(pattern)
+  if (hostname && path && GIT_HOSTS.indexOf(hostname) >= 0
+    // only if dependency is pointing to a git repo,
+    // e.g. facebook/flow and not file in a git repo facebook/flow/archive/v1.0.0.tar.gz
+    && path.split('/').filter(p => !!p).length === 2
+  ) return true
 
-	return false
+  return false
 }
 
 const downloadPkg = (pkg, verbose) => {
-	for (let marker of ['@file:', '@link:']) {
-		const split = pkg.key.split(marker)
-		if (split.length == 2) {
-			console.info(`ignoring lockfile entry "${split[0]}" which points at path "${split[1]}"`)
-			return
-		} else if (split.length > 2) {
-			throw new Error(`The lockfile entry key "${pkg.key}" contains "${marker}" more than once. Processing is not implemented.`)
-		}
-	}
+  for (let marker of ['@file:', '@link:']) {
+    const split = pkg.key.split(marker)
+    if (split.length == 2) {
+      console.info(`ignoring lockfile entry "${split[0]}" which points at path "${split[1]}"`)
+      return
+    } else if (split.length > 2) {
+      throw new Error(`The lockfile entry key "${pkg.key}" contains "${marker}" more than once. Processing is not implemented.`)
+    }
+  }
 
-	if (pkg.resolved === undefined) {
-		throw new Error(`The lockfile entry with key "${pkg.key}" cannot be downloaded because it is missing the "resolved" attribute, which should contain the URL to download from. The lockfile might be invalid.`)
-	}
+  if (pkg.resolved === undefined) {
+    throw new Error(`The lockfile entry with key "${pkg.key}" cannot be downloaded because it is missing the "resolved" attribute, which should contain the URL to download from. The lockfile might be invalid.`)
+  }
 
-	const [ url, hash ] = pkg.resolved.split('#')
-	if (verbose) console.log('downloading ' + url)
-	const fileName = urlToName(url)
-	const s = url.split('/')
-	if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
-		return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1])
-	} else if (url.startsWith('https://github.com/') && url.endsWith('.tar.gz') &&
-		(
-			s.length <= 5 ||    // https://github.com/owner/repo.tgz#feedface...
-			s[5] == "archive"   // https://github.com/owner/repo/archive/refs/tags/v0.220.1.tar.gz
-		)) {
-		return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1].replace(/.tar.gz$/, ''))
-	} else if (isGitUrl(url)) {
-		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
-	} else if (url.startsWith('https://')) {
-		if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
-			const [ type, checksum ] = pkg.integrity.split('-')
-			return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), type)
-		}
-		return downloadFileHttps(fileName, url, hash)
-	} else if (url.startsWith('file:')) {
-		console.warn(`ignoring unsupported file:path url "${url}"`)
-	} else {
-		throw new Error('don\'t know how to download "' + url + '"')
-	}
+  const [ url, hash ] = pkg.resolved.split('#')
+  if (verbose) console.log('downloading ' + url)
+  const fileName = urlToName(url)
+  const s = url.split('/')
+  if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
+    return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1])
+  } else if (url.startsWith('https://github.com/') && url.endsWith('.tar.gz') &&
+    (
+      s.length <= 5 ||    // https://github.com/owner/repo.tgz#feedface...
+      s[5] == "archive"   // https://github.com/owner/repo/archive/refs/tags/v0.220.1.tar.gz
+    )) {
+    return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1].replace(/.tar.gz$/, ''))
+  } else if (isGitUrl(url)) {
+    return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
+  } else if (url.startsWith('https://')) {
+    if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
+      const [ type, checksum ] = pkg.integrity.split('-')
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), type)
+    }
+    return downloadFileHttps(fileName, url, hash)
+  } else if (url.startsWith('file:')) {
+    console.warn(`ignoring unsupported file:path url "${url}"`)
+  } else {
+    throw new Error('don\'t know how to download "' + url + '"')
+  }
 }
 
 const performParallel = tasks => {
-	const worker = async () => {
-		while (tasks.length > 0) await tasks.shift()()
-	}
+  const worker = async () => {
+    while (tasks.length > 0) await tasks.shift()()
+  }
 
-	const workers = []
-	for (let i = 0; i < 4; i++) {
-		workers.push(worker())
-	}
+  const workers = []
+  for (let i = 0; i < 4; i++) {
+    workers.push(worker())
+  }
 
-	return Promise.all(workers)
+  return Promise.all(workers)
 }
 
 // This could be implemented using [`Map.groupBy`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map/groupBy),
 // but that method is only supported starting with Node 21
 const uniqueBy = (arr, callback) => {
-	const map = new Map()
-	for (const elem of arr) {
-		map.set(callback(elem), elem)
-	}
-	return [...map.values()]
+  const map = new Map()
+  for (const elem of arr) {
+    map.set(callback(elem), elem)
+  }
+  return [...map.values()]
 }
 
 const prefetchYarnDeps = async (lockContents, verbose) => {
-	const lockData = lockfile.parse(lockContents)
-	await performParallel(
-		uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
-		.map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
-	)
-	await fs.promises.writeFile('yarn.lock', lockContents)
-	if (verbose) console.log('Done')
+  const lockData = lockfile.parse(lockContents)
+  await performParallel(
+    uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+  )
+  await fs.promises.writeFile('yarn.lock', lockContents)
+  if (verbose) console.log('Done')
 }
 
 const showUsage = async () => {
-	process.stderr.write(`
+  process.stderr.write(`
 syntax: prefetch-yarn-deps [path to yarn.lock] [options]
 
 Options:
@@ -171,50 +171,50 @@ Options:
   -v --verbose      Verbose output
   --builder         Only perform the download to current directory, then exit
 `)
-	process.exit(1)
+  process.exit(1)
 }
 
 const main = async () => {
-	const args = process.argv.slice(2)
-	let next, lockFile, verbose, isBuilder
-	while (next = args.shift()) {
-		if (next == '--builder') {
-			isBuilder = true
-		} else if (next == '--verbose' || next == '-v') {
-			verbose = true
-		} else if (next == '--help' || next == '-h') {
-			showUsage()
-		} else if (!lockFile) {
-			lockFile = next
-		} else {
-			showUsage()
-		}
-	}
-	let lockContents
-	try {
-		lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
-	} catch {
-		showUsage()
-	}
+  const args = process.argv.slice(2)
+  let next, lockFile, verbose, isBuilder
+  while (next = args.shift()) {
+    if (next == '--builder') {
+      isBuilder = true
+    } else if (next == '--verbose' || next == '-v') {
+      verbose = true
+    } else if (next == '--help' || next == '-h') {
+      showUsage()
+    } else if (!lockFile) {
+      lockFile = next
+    } else {
+      showUsage()
+    }
+  }
+  let lockContents
+  try {
+    lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+  } catch {
+    showUsage()
+  }
 
-	if (isBuilder) {
-		await prefetchYarnDeps(lockContents, verbose)
-	} else {
-		const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
+  if (isBuilder) {
+    await prefetchYarnDeps(lockContents, verbose)
+  } else {
+    const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
 
-		try {
-			process.chdir(tmpDir.trim())
-			await prefetchYarnDeps(lockContents, verbose)
-			const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
-			console.log(hash)
-		} finally {
-			await exec('rm', [ '-rf', tmpDir.trim() ])
-		}
-	}
+    try {
+      process.chdir(tmpDir.trim())
+      await prefetchYarnDeps(lockContents, verbose)
+      const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
+      console.log(hash)
+    } finally {
+      await exec('rm', [ '-rf', tmpDir.trim() ])
+    }
+  }
 }
 
 main()
-	.catch(e => {
-		console.error(e)
-		process.exit(1)
-	})
+  .catch(e => {
+    console.error(e)
+    process.exit(1)
+  })

pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js

@@ -69,19 +69,17 @@ async function main() {
       // Don't unlink this file, we just wrote it.
       managed.delete(file);
 
-      // Link to a temporary dummy path and rename.
-      // This is to get some degree of atomicity.
+      // Link file
       try {
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.symlink(sourcePath, targetPath);
       } catch (err) {
+        // If the target file already exists remove it and try again
         if (err.code !== "EEXIST") {
           throw err;
         }
-
-        await fs.promises.unlink(targetPath + "-nix-hook-temp");
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.unlink(targetPath);
+        await fs.promises.symlink(sourcePath, targetPath);
       }
-      await fs.promises.rename(targetPath + "-nix-hook-temp", targetPath);
     })
   );
 

pkgs/build-support/php/build-pecl.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation (
       # PHP extensions correctly.
       # See the corresponding PR: https://github.com/Mic92/nix-update/pull/123
       isPhpExtension = true;
-      updateScript = nix-update-script { };
+      updateScript = passthru.updateScript or (nix-update-script { });
     };
   }
 )

pkgs/build-support/rust/build-rust-package/default.nix

@@ -22,6 +22,7 @@ lib.extendMkDerivation {
     "depsExtraArgs"
     "cargoUpdateHook"
     "cargoLock"
+    "useFetchCargoVendor"
   ];
 
   extendDrvArgs =

pkgs/build-support/rust/hooks/default.nix

@@ -91,13 +91,21 @@
         lib.optionalString (stdenv.hostPlatform.config != stdenv.targetPlatform.config) ''
           [target."${stdenv.targetPlatform.rust.rustcTarget}"]
           "linker" = "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc"
-          "rustflags" = [ "-C", "target-feature=${
-            if pkgsTargetTarget.stdenv.targetPlatform.isStatic then "+" else "-"
-          }crt-static" ]
+          "rustflags" = [ ${
+            lib.concatStringsSep ", " (
+              [
+                ''"-Ctarget-feature=${if stdenv.targetPlatform.isStatic then "+" else "-"}crt-static"''
+              ]
+              ++ lib.optional (!stdenv.targetPlatform.isx86_32) ''"-Cforce-frame-pointers=yes"''
+            )
+          } ]
         ''
         + ''
           [target."${stdenv.hostPlatform.rust.rustcTarget}"]
           "linker" = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+          "rustflags" = [ ${
+            lib.optionalString (!stdenv.hostPlatform.isx86_32) ''"-Cforce-frame-pointers=yes"''
+          } ]
         '';
     };
 

pkgs/build-support/setup-hooks/audit-tmpdir.sh

@@ -15,27 +15,54 @@ auditTmpdir() {
 
     echo "checking for references to $TMPDIR/ in $dir..."
 
-    _processFile() {
-        local file="$1"
-        if isELF "$file"; then
-            if { printf :; patchelf --print-rpath "$file"; } | grep -q -F ":$TMPDIR/"; then
-                echo "RPATH of binary $file contains a forbidden reference to $TMPDIR/"
-                exit 1
-            fi
-        elif isScript "$file"; then
-            filename=${i##*/}
-            dir=${i%/*}
-            if [ -e "$dir/.$filename-wrapped" ]; then
-                if grep -q -F "$TMPDIR/" "$file"; then
-                    echo "wrapper script $file contains a forbidden reference to $TMPDIR/"
-                    exit 1
+    local tmpdir elf_fifo script_fifo
+    tmpdir="$(mktemp -d)"
+    elf_fifo="$tmpdir/elf"
+    script_fifo="$tmpdir/script"
+    mkfifo "$elf_fifo" "$script_fifo"
+
+    # Classifier: identify ELF and script files
+    (
+        find "$dir" -type f -not -path '*/.build-id/*' -print0 \
+        | while IFS= read -r -d $'\0' file; do
+            if isELF "$file"; then
+                printf '%s\0' "$file" >&3
+            elif isScript "$file"; then
+                filename=${file##*/}
+                dir=${file%/*}
+                if [ -e "$dir/.$filename-wrapped" ]; then
+                    printf '%s\0' "$file" >&4
                 fi
             fi
-        fi
-    }
+        done
+        exec 3>&- 4>&-
+    ) 3> "$elf_fifo" 4> "$script_fifo" &
 
-    find "$dir" -type f -not -path '*/.build-id/*' -print0 \
-    | parallelMap _processFile
+    # Handler: check RPATHs concurrently
+    (
+        xargs -0 -r -P "$NIX_BUILD_CORES" -n 1 sh -c '
+            if { printf :; patchelf --print-rpath "$1"; } | grep -q -F ":$TMPDIR/"; then
+                echo "RPATH of binary $1 contains a forbidden reference to $TMPDIR/"
+                exit 1
+            fi
+        ' _ < "$elf_fifo"
+    ) &
+    local pid_elf=$!
 
-    unset -f _processFile
+    # Handler: check wrapper scripts concurrently
+    local pid_script
+    (
+        xargs -0 -r -P "$NIX_BUILD_CORES" -n 1 sh -c '
+            if grep -q -F "$TMPDIR/" "$1"; then
+                echo "wrapper script $1 contains a forbidden reference to $TMPDIR/"
+                exit 1
+            fi
+        ' _ < "$script_fifo"
+    ) &
+    local pid_script=$!
+
+    wait "$pid_elf" || { echo "Some binaries contain forbidden references to $TMPDIR/. Check the error above!"; exit 1; }
+    wait "$pid_script" || { echo "Some scripts contain forbidden references to $TMPDIR/. Check the error above!"; exit 1; }
+
+    rm -r "$tmpdir"
 }

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -95,6 +95,7 @@ autoPatchelfPostFixup() {
     if [[ -z "${dontAutoPatchelf-}" ]]; then
         autoPatchelf -- $(for output in $(getAllOutputNames); do
             [ -e "${!output}" ] || continue
+            [ "${output}" = debug ] && continue
             echo "${!output}"
         done)
     fi

pkgs/build-support/setup-hooks/no-broken-symlinks.sh

@@ -51,6 +51,12 @@ noBrokenSymlinks() {
       symlinkTarget="$(realpath --no-symlinks --canonicalize-missing "$pathParent/$symlinkTarget")"
     fi
 
+    # use $TMPDIR like audit-tmpdir.sh
+    if [[ $symlinkTarget = "$TMPDIR"/* ]]; then
+      nixErrorLog "the symlink $path points to $TMPDIR directory: $symlinkTarget"
+      numDanglingSymlinks+=1
+      continue
+    fi
     if [[ $symlinkTarget != "$NIX_STORE"/* ]]; then
       nixInfoLog "symlink $path points outside the Nix store; ignoring"
       continue

pkgs/build-support/setup-hooks/parallel.sh

@@ -1,89 +0,0 @@
-# Parallel execution utilities
-# These functions provide a framework for parallel processing of jobs from stdin
-
-# parallelRun - Execute a command in parallel across multiple cores
-#
-# Reads null-delimited jobs from stdin and distributes them across NIX_BUILD_CORES
-# worker processes. Each worker executes the provided command, receiving jobs
-# via stdin in null-delimited format.
-#
-# Usage: some_producer | parallelRun command [args...]
-#
-# The command receives jobs one at a time via stdin (null-delimited).
-#
-# Example:
-#   find . -name '*.log' -print0 | parallelRun sh -c '
-#     while read -r -d "" file; do gzip "$file"; done
-#   '
-parallelRun() {
-    local pids
-    local lock
-    pids=()
-    lock=$(mktemp -u)
-    mkfifo "$lock"
-    for ((i=0; i<NIX_BUILD_CORES; i++)); do
-        {
-            exec 3<"$lock"  # fd-3 = read side of lock
-            exec 4>"$lock"  # fd-4 = write side of lock (push token back)
-            local job
-
-            while :; do
-                # Acquire the lock: blocks until a token can be read
-                read -r -n1 >/dev/null <&3
-
-                # read one job from stdin
-                # This is guarded by the lock above in order to prevent
-                # multiple workers from reading from stdin simultaneously.
-                if ! IFS= read -r -d '' job; then
-                    # If stdin is closed, release lock and exit
-                    printf 'x' >&4
-                    break
-                fi
-
-                # Release the lock: write a token back to the lock FIFO
-                printf 'y' >&4
-
-                # Forward job to the worker process' stdin
-                printf '%s\0' "$job"
-
-            done \
-            | "$@" # launch the worker process
-        } &
-        pids[$i]=$!
-    done
-    # launch the workers by writing a token to the lock FIFO
-    printf 'a' >"$lock" &
-    # Wait for all workers to finish
-    for pid in "${pids[@]}"; do
-        if ! wait "$pid"; then
-            echo "A parallel job failed with exit code $? (check for errors above)" >&2
-            echo -e "Failing Command:\n  $@" >&2
-            exit 1
-        fi
-    done
-    rm "$lock"
-}
-
-# parallelMap - Apply a shell function to each job in parallel
-#
-# A higher-level wrapper around parallelRun that applies a shell function to each
-# null-delimited job from stdin. The shell function receives each job as its first
-# argument.
-#
-# Usage: some_producer | parallelMap shell_function [additional_args...]
-#
-# The shell function is called as: shell_function job [additional_args...]
-# for each job read from stdin.
-#
-# Example:
-#   compress() { gzip "$1" }
-#   find . -name '*.log' -print0 | parallelMap compress
-parallelMap() {
-    _wrapper() {
-        while IFS= read -r -d '' job; do
-            "$@" "$job"
-        done
-    }
-    parallelRun _wrapper "$@"
-    unset -f _wrapper
-}

pkgs/build-support/setup-hooks/patch-shebangs.sh

@@ -68,6 +68,31 @@ patchShebangs() {
         return 0
     fi
 
+    # like sponge from moreutils but in pure bash
+    _sponge() {
+        local content
+        local target
+        local restoreReadOnly
+        content=""
+        target="$1"
+
+        # Make file writable if it is read-only
+        if [[ ! -w "$target" ]]; then
+            chmod +w "$target"
+            restoreReadOnly=true
+        fi
+
+        while IFS= read -r line || [[ -n "$line" ]]; do
+            content+="$line"$'\n'
+        done
+        printf '%s' "$content" > "$target"
+
+        # Restore read-only if it was read-only before
+        if [[ -n "${restoreReadOnly:-}" ]]; then
+            chmod -w "$target"
+        fi
+    }
+
     local f
     while IFS= read -r -d $'\0' f; do
         isScript "$f" || continue
@@ -126,11 +151,14 @@ patchShebangs() {
 
                 # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
                 timestamp=$(stat --printf "%y" "$f")
-                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+                sed -e "1 s|.*|#\!$escapedInterpreterLine|" "$f" | _sponge "$f"
+
                 touch --date "$timestamp" "$f"
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
+
+    unset -f _sponge
 }
 
 patchShebangsAuto () {

pkgs/build-support/setup-hooks/separate-debug-info.sh

@@ -3,18 +3,47 @@ export NIX_LDFLAGS+=" --compress-debug-sections=zlib"
 export NIX_CFLAGS_COMPILE+=" -ggdb -Wa,--compress-debug-sections"
 export NIX_RUSTFLAGS+=" -g -C strip=none"
 
+cksumAlgo=sha256
+
 fixupOutputHooks+=(_separateDebugInfo)
+postUnpackHooks+=(_recordPristineSourceHashes)
+
+_recordPristineSourceHashes() {
+    # shellcheck disable=2154
+    [ -e "$sourceRoot" ] || return 0
+
+    local checksumFileName=__nix_source_checksums
+    echo "separate-debug-info: recording checksum of source files for debug support..."
+    find "$sourceRoot" -type f -exec cksum -a "$cksumAlgo" '{}' \+ > "$checksumFileName"
+    recordedSourceChecksumsFileName="$(readlink -f "$checksumFileName")"
+}
 
 _separateDebugInfo() {
+    # shellcheck disable=2154
     [ -e "$prefix" ] || return 0
 
-    local dst="${debug:-$out}"
-    if [ "$prefix" = "$dst" ]; then return 0; fi
+    local debugOutput="${debug:-$out}"
+    if [ "$prefix" = "$debugOutput" ]; then return 0; fi
 
     # in case there is nothing to strip, don't fail the build
-    mkdir -p "$dst"
+    mkdir -p "$debugOutput"
 
-    dst="$dst/lib/debug/.build-id"
+    local dst="$debugOutput/lib/debug/.build-id"
+
+    local source
+    local sourceOverlay
+    # shellcheck disable=2154
+    if [ -e "$src" ]; then
+        source="$src"
+        if [ -n "${recordedSourceChecksumsFileName:-}" ]; then
+            sourceOverlay="$debugOutput/src/overlay"
+        else
+            sourceOverlay=""
+        fi
+    else
+        source=""
+        sourceOverlay=""
+    fi
 
     # Find executables and dynamic libraries.
     local i
@@ -25,30 +54,64 @@ _separateDebugInfo() {
         [ -z "${OBJCOPY:-}" ] && echo "_separateDebugInfo: '\$OBJCOPY' variable is empty, skipping." 1>&2 && break
 
         # Extract the Build ID. FIXME: there's probably a cleaner way.
-        local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
+        local id
+        id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
         if [ "${#id}" != 40 ]; then
             echo "could not find build ID of $i, skipping" >&2
             continue
         fi
 
+
         # Extract the debug info.
         echo "separating debug info from $i (build ID $id)"
 
-        destDir=$dst/${id:0:2}
-        destFile=$dst/${id:0:2}/${id:2}.debug
+        local debuginfoDir="$dst/${id:0:2}"
+        local buildIdPrefix="$debuginfoDir/${id:2}"
+        local debuginfoFile="$buildIdPrefix.debug"
+        local executableSymlink="$buildIdPrefix.executable"
+        local sourceSymlink="$buildIdPrefix.source"
+        local sourceOverlaySymlink="$buildIdPrefix.sourceoverlay"
 
-        mkdir -p "$destDir"
+        mkdir -p "$debuginfoDir"
 
-        if [ -f "$destFile" ]; then
+        if [ -f "$debuginfoFile" ]; then
             echo "separate-debug-info: warning: multiple files with build id $id found, overwriting"
         fi
 
         # This may fail, e.g. if the binary is for a different
         # architecture than we're building for.  (This happens with
         # firmware blobs in QEMU.)
-        if $OBJCOPY --only-keep-debug "$i" "$destFile"; then
+        if $OBJCOPY --only-keep-debug "$i" "$debuginfoFile"; then
             # If we succeeded, also a create a symlink <original-name>.debug.
-            ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
+            ln -sfn "$debuginfoFile" "$dst/../$(basename "$i")"
+            # also create a symlink mapping the build-id to the original elf file and the source
+            # debuginfod protocol relies on it
+            ln -sfn "$i" "$executableSymlink"
+            if [ -n "$source" ]; then
+                ln -sfn "$source" "$sourceSymlink"
+            fi
+            if [ -n "$sourceOverlay" ]; then
+                # create it lazily
+                if [ ! -d "$sourceOverlay" ]; then
+                    echo "separate-debug-info: copying patched source files to $sourceOverlay..."
+                    mkdir -p "$sourceOverlay"
+                    pushd "$(dirname "$recordedSourceChecksumsFileName")" || { echo "separate-debug-info: failed to cd parent directory of $recordedSourceChecksumsFileName"; return 1; }
+                    while IFS= read -r -d $'\0'  modifiedSourceFile; do
+                        if [ -z "$modifiedSourceFile" ]; then
+                            continue
+                        fi
+                        # this can happen with files with '\n' in their name
+                        if [ ! -f "$modifiedSourceFile" ]; then
+                            echo "separate-debug-info: cannot save modified source file $modifiedSourceFile: does not exist. ignoring"
+                            continue
+                        fi
+                        mkdir -p "$sourceOverlay/$(dirname "$modifiedSourceFile")"
+                        cp -v "$modifiedSourceFile" "$sourceOverlay/$modifiedSourceFile"
+                    done < <(LANG=C cksum -a "$cksumAlgo" --check --ignore-missing --quiet "$recordedSourceChecksumsFileName" 2>&1 | sed -n -e 's/: FAILED$/\x00/p' | sed -z -e 's/^\n//')
+                    popd || { echo "separate-debug-info: failed to popd" ; return 1; }
+                fi
+                ln -sfn "$sourceOverlay" "$sourceOverlaySymlink"
+            fi
         else
             # If we failed, try to clean up unnecessary directories
             rmdir -p "$dst/${id:0:2}" --ignore-fail-on-non-empty

pkgs/build-support/setup-hooks/tests/default.nix

@@ -1,23 +0,0 @@
-{
-  stdenv,
-}:
-{
-  # test based on bootstrap tools to prevent rebuilding stdenv on each change
-  parallel =
-    (derivation {
-      name = "test-parallel-hook";
-      system = stdenv.system;
-      builder = "${stdenv.bootstrapTools}/bin/bash";
-      PATH = "${stdenv.bootstrapTools}/bin";
-      args = [
-        "-c"
-        ''
-          . ${../parallel.sh}
-          . ${./test-parallel.sh}
-        ''
-      ];
-    })
-    // {
-      meta = { };
-    };
-}

pkgs/build-support/setup-hooks/tests/test-parallel.sh

@@ -1,146 +0,0 @@
-export NIX_BUILD_CORES=4
-
-echo "Testing worker distribution..."
-
-# Generate 100 jobs to ensure all workers get some
-for i in {1..100}; do
-  printf "job%d\0" $i
-done | parallelRun sh -c '
-  while IFS= read -r -d "" job; do
-    sleep 0.05  # Simulate some work
-    echo "Worker $$ processed $job" >> /tmp/worker-output
-  done
-'
-
-# Check that all 4 workers were actually utilized
-worker_count=$(sort /tmp/worker-output | cut -d" " -f2 | sort -u | wc -l)
-if [ "$worker_count" -ne 4 ]; then
-  echo "ERROR: Expected exactly 4 workers, got $worker_count"
-  cat /tmp/worker-output
-  exit 1
-fi
-echo "SUCCESS: All 4 workers participated"
-rm -f /tmp/worker-output
-
-echo "Testing error propagation..."
-
-# Test that errors from workers are propagated
-if printf "job1\0job2\0job3\0" | parallelRun sh -c '
-  while IFS= read -r -d "" job; do
-    if [ "$job" = "job2" ]; then
-      echo "Worker failing on $job" >&2
-      exit 1
-    fi
-    echo "Worker processed $job"
-  done
-' 2>/dev/null; then
-  echo "ERROR: Expected command to fail but it succeeded"
-  exit 1
-else
-  echo "SUCCESS: Error was properly propagated"
-fi
-
-echo "Testing error message..."
-
-error_output=$(printf "job1\0job2\0job3\0" | parallelRun sh -c '
-  while IFS= read -r -d "" job; do
-    if [ "$job" = "job2" ]; then
-      echo "Worker failing on $job" >&2
-      exit 1
-    fi
-    echo "Worker processed $job"
-  done
-' 2>&1 || true)
-
-if [[ "$error_output" != *"job failed"* ]]; then
-  echo "ERROR: Expected 'job failed' in error message, got: $error_output"
-  exit 1
-fi
-echo "SUCCESS: Error message was displayed"
-
-echo "Testing Verify all jobs are processed when no errors occur..."
-
-# Generate jobs and count processed ones
-for i in {1..10}; do
-  printf "job%d\0" $i
-done | parallelRun sh -c '
-  while IFS= read -r -d "" job; do
-    echo "$job" >> /tmp/processed-jobs
-  done
-'
-
-processed_count=$(wc -l < /tmp/processed-jobs)
-if [ "$processed_count" -ne 10 ]; then
-  echo "ERROR: Expected 10 jobs processed, got $processed_count"
-  exit 1
-fi
-echo "SUCCESS: All 10 jobs were processed"
-rm -f /tmp/processed-jobs
-
-echo "All parallelRun tests passed!"
-
-# ---------------------------------------------------------------------
-
-echo "Testing parallelMap basic functionality..."
-
-# Define a test function
-testFunc() {
-  echo "Processing: $1" >> /tmp/map-output
-}
-
-# Test that parallelMap calls the function with each job
-for i in {1..5}; do
-  printf "item%d\0" $i
-done | parallelMap testFunc
-
-# Check all jobs were processed
-processed_map_count=$(wc -l < /tmp/map-output)
-if [ "$processed_map_count" -ne 5 ]; then
-  echo "ERROR: Expected 5 items processed by parallelMap, got $processed_map_count"
-  exit 1
-fi
-echo "SUCCESS: parallelMap processed all 5 items"
-rm -f /tmp/map-output
-
-echo "Testing parallelMap error propagation..."
-
-# Define a function that fails on specific input
-failFunc() {
-  if [ "$1" = "item2" ]; then
-    echo "Function failing on $1" >&2
-    exit 1
-  fi
-  echo "Function processed $1"
-}
-
-# Test that errors are propagated
-if printf "item1\0item2\0item3\0" | parallelMap failFunc 2>/dev/null; then
-  echo "ERROR: Expected parallelMap to fail but it succeeded"
-  exit 1
-else
-  echo "SUCCESS: parallelMap error was properly propagated"
-fi
-
-echo "Testing parallelMap with additional arguments..."
-
-# Define a function that uses additional arguments
-argFunc() {
-  echo "$1: $2" >> /tmp/map-args-output
-}
-
-# Test with additional arguments
-for i in {1..3}; do
-  printf "value%d\0" $i
-done | parallelMap argFunc "PREFIX"
-
-# Check output contains the prefix
-if ! grep -q "PREFIX: value1" /tmp/map-args-output; then
-  echo "ERROR: parallelMap did not pass additional arguments correctly"
-  cat /tmp/map-args-output
-  exit 1
-fi
-echo "SUCCESS: parallelMap passed additional arguments correctly"
-rm -f /tmp/map-args-output
-
-echo "All parallelRun and parallelMap tests passed!"
-touch $out

pkgs/build-support/trivial-builders/default.nix

@@ -671,8 +671,8 @@ rec {
           throw "linkFarm entries must be either attrs or a list!";
 
       linkCommands = lib.mapAttrsToList (name: path: ''
-        mkdir -p "$(dirname ${lib.escapeShellArg "${name}"})"
-        ln -s ${lib.escapeShellArg "${path}"} ${lib.escapeShellArg "${name}"}
+        mkdir -p -- "$(dirname -- ${lib.escapeShellArg "${name}"})"
+        ln -s -- ${lib.escapeShellArg "${path}"} ${lib.escapeShellArg "${name}"}
       '') entries';
     in
     runCommand name