Merge master into staging-nixos

nixos/modules/programs/wayland/uwsm.nix

@@ -24,6 +24,19 @@ let
         passthru.providedSessions = [ "${opts.name}-uwsm" ];
       };
     });
+
+  desktopEntries = lib.mapAttrsToList (
+    name: value:
+    mk_uwsm_desktop_entry {
+      inherit name;
+      inherit (value)
+        prettyName
+        comment
+        binPath
+        extraArgs
+        ;
+    }
+  ) cfg.waylandCompositors;
 in
 {
   options.programs.uwsm = {
@@ -126,18 +139,8 @@ in
       }
 
       (lib.mkIf (cfg.waylandCompositors != { }) {
-        environment.systemPackages = lib.mapAttrsToList (
-          name: value:
-          mk_uwsm_desktop_entry {
-            inherit name;
-            inherit (value)
-              prettyName
-              comment
-              binPath
-              extraArgs
-              ;
-          }
-        ) cfg.waylandCompositors;
+        environment.systemPackages = desktopEntries;
+        services.displayManager.sessionPackages = desktopEntries;
       })
     ]
   );

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -79,8 +79,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.7.0esr";
-    sha512 = "92746d87ca2d5a59082c25aa3c3a816e5bf24ae3e095f8ec478a60c5cd890faea392ff98b5b510cc9a89b155240dce9d06c7ddd0f17f564722acc65105fb6cd2";
+    version = "140.7.1esr";
+    sha512 = "2d0f61758b0428eb4eb8294c58d914e03842c9ad7685cd2eec26c723cc1491634f90fc9fcf5ad6d3f13738e141e96c692cd8ff1599869346e3247a0cae2349f4";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bitrise";
-  version = "2.37.0";
+  version = "2.38.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CxWFqrgj/oYsD3yBjR4fdh7FSAaGZnbC6OB9H1VH+m0=";
+    hash = "sha256-WF6+HgGePOvwdo1nU75ifnH8Fddk1vmSyNOOQER4awo=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

pkgs/by-name/ci/cilium-cli/package.nix

@@ -5,6 +5,7 @@
   cilium-cli,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   testers,
 }:
 
@@ -21,6 +22,10 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  # Required to workaround install check error:
+  # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied
+  nativeInstallCheckInputs = [ writableTmpDirAsHomeHook ];
+
   vendorHash = null;
 
   subPackages = [ "cmd/cilium" ];
@@ -31,10 +36,6 @@ buildGoModule (finalAttrs: {
     "-X=github.com/cilium/cilium/cilium-cli/defaults.CLIVersion=${finalAttrs.version}"
   ];
 
-  # Required to workaround install check error:
-  # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied
-  HOME = "$TMPDIR";
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cilium \
       --bash <($out/bin/cilium completion bash) \

pkgs/by-name/db/dbus_java/package.nix

@@ -15,11 +15,14 @@ stdenv.mkDerivation (finalAttrs: {
     url = "https://dbus.freedesktop.org/releases/dbus-java/dbus-java-${finalAttrs.version}.tar.gz";
     sha256 = "0cyaxd8x6sxmi6pklkkx45j311a6w51fxl4jc5j3inc4cailwh5y";
   };
-  JAVA_HOME = jdk8;
-  JAVA = "${jdk8}/bin/java";
-  PREFIX = "\${out}";
-  JAVAUNIXLIBDIR = "${libmatthew_java}/lib/jni";
-  JAVAUNIXJARDIR = "${libmatthew_java}/share/java";
+
+  env = {
+    JAVA_HOME = jdk8;
+    JAVA = "${jdk8}/bin/java";
+    PREFIX = "\${out}";
+    JAVAUNIXLIBDIR = "${libmatthew_java}/lib/jni";
+    JAVAUNIXJARDIR = "${libmatthew_java}/share/java";
+  };
   buildInputs = [
     gettext
     jdk8

pkgs/by-name/fl/flac/package.nix

@@ -38,11 +38,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
-  CFLAGS = [
-    "-O3"
-    "-funroll-loops"
-  ];
-  CXXFLAGS = [ "-O3" ];
+  env = {
+    CFLAGS = toString [
+      "-O3"
+      "-funroll-loops"
+    ];
+    CXXFLAGS = toString [ "-O3" ];
+  };
 
   patches = [ ./package.patch ];
   doCheck = true;

pkgs/by-name/fl/fluxcd/package.nix

@@ -5,6 +5,7 @@
   installShellFiles,
   lib,
   stdenv,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -46,11 +47,11 @@ buildGoModule rec {
 
   subPackages = [ "cmd/flux" ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # Required to workaround test error:
   #   panic: mkdir /homeless-shelter: permission denied
-  HOME = "$TMPDIR";
-
-  nativeBuildInputs = [ installShellFiles ];
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   doInstallCheck = true;
   installCheckPhase = ''

pkgs/by-name/gd/gdevelop/darwin.nix

@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-zBUWAFsaa+GenaHDRYNlwMs3BmyOIQ3sr/YYCX1ytEE=";
+    hash = "sha256-qukv1lD17FW0IOjOcJeh8kt4O9cwK/wzNEH0+vdr6NA=";
   };
 
   sourceRoot = ".";

pkgs/by-name/gd/gdevelop/linux.nix

@@ -13,7 +13,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-1XmKHyUuNcY1efWKLSsEoh+dvSmzUFz3FaoO/iTD7QY=";
+        hash = "sha256-hElD8VUC17Q/1sMy+ASidhoY9svGNncDf7IUfKkFfZU=";
       }
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";

pkgs/by-name/gd/gdevelop/package.nix

@@ -4,7 +4,7 @@
   callPackage,
 }:
 let
-  version = "5.6.252";
+  version = "5.6.257";
   pname = "gdevelop";
   meta = {
     description = "Graphical Game Development Studio";

pkgs/by-name/go/go2tv/package.nix

@@ -16,16 +16,16 @@
 
 buildGoModule rec {
   pname = "go2tv" + lib.optionalString (!withGui) "-lite";
-  version = "1.19.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "alexballas";
     repo = "go2tv";
     tag = "v${version}";
-    hash = "sha256-aE40mS3wcZHQIPyE9YEv5tRkrz4nClF8Brsbt0M0jK4=";
+    hash = "sha256-oyd6H3U799el9xcte3mOJo0m2YQTZ/vZjFdM2F7Cha8=";
   };
 
-  vendorHash = "sha256-jtQSAP/QiSeLn37bg2uapzMBYGo9QvuH4V2YgmPrDN8=";
+  vendorHash = "sha256-2eEB6yfWFD7X3+qQenRoMiyzHH9i/gDg0IuOo/gUBFw=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/hd/hdfview/package.nix

@@ -40,8 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
     stripJavaArchivesHook
   ];
 
-  HDFLIBS = (hdf4.override { javaSupport = true; }).out;
-  HDF5LIBS = (hdf5.override { javaSupport = true; }).out;
+  env = {
+    HDFLIBS = (hdf4.override { javaSupport = true; }).out;
+    HDF5LIBS = (hdf5.override { javaSupport = true; }).out;
+  };
 
   buildPhase =
     let

pkgs/by-name/ho/hottext/package.nix

@@ -19,7 +19,7 @@ buildNimPackage (finalAttrs: {
 
   lockFile = ./lock.json;
 
-  HOTTEXT_FONT_PATH = "${gentium-plus}/share/fonts/truetype/GentiumPlus-Regular.ttf";
+  env.HOTTEXT_FONT_PATH = "${gentium-plus}/share/fonts/truetype/GentiumPlus-Regular.ttf";
 
   desktopItem = makeDesktopItem {
     categories = [ "Utility" ];

pkgs/by-name/ju/juledoc/package.nix

@@ -18,7 +18,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ julec.hook ];
 
-  JULE_OUT_NAME = "juledoc";
+  env.JULE_OUT_NAME = "juledoc";
 
   meta = {
     description = "Official documentation generator for the Jule programming language";

pkgs/by-name/ju/julefmt/package.nix

@@ -18,7 +18,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ julec.hook ];
 
-  JULE_OUT_NAME = "julefmt";
+  env.JULE_OUT_NAME = "julefmt";
 
   meta = {
     description = "Official formatter tool for the Jule programming language";

pkgs/by-name/ku/kubevela/package.nix

@@ -2,13 +2,16 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   lib,
   stdenv,
   testers,
   kubevela,
   nix-update-script,
 }:
-
+let
+  canGenerateShellCompletions = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
 buildGoModule (finalAttrs: {
   pname = "kubevela";
   version = "1.10.6";
@@ -32,17 +35,20 @@ buildGoModule (finalAttrs: {
 
   env.CGO_ENABLED = 0;
 
-  # Workaround for permission issue in shell completion
-  HOME = "$TMPDIR";
-
   installPhase = ''
     runHook preInstall
     install -Dm755 "$GOPATH/bin/cli" -T $out/bin/vela
     runHook postInstall
   '';
 
-  nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals canGenerateShellCompletions [
+    writableTmpDirAsHomeHook # Workaround for permission issue in shell completion
+  ];
+
+  postInstall = lib.optionalString canGenerateShellCompletions ''
     installShellCompletion --cmd vela \
       --bash <($out/bin/vela completion bash) \
       --zsh <($out/bin/vela completion zsh)

pkgs/by-name/lc/lcevcdec/package.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lcevcdec";
-  version = "4.0.4";
+  version = "4.0.5";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "v-novaltd";
     repo = "LCEVCdec";
     tag = finalAttrs.version;
-    hash = "sha256-49ZDTYdsgv/RxUZlhIDrqJ3a3QCYA4pGG0QgOpKxzrI=";
+    hash = "sha256-Ib+2B9o9XUbiEqlP43jKYzvY2pzsFRaS/ZjMn1YgvHE=";
   };
 
   postPatch = ''

pkgs/by-name/le/leiningen/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-tyGlc69jF4TyfMtS5xnm0Sh9nTlRrVbTFtOPfs+oGqI=";
   };
 
-  JARNAME = "leiningen-${finalAttrs.version}-standalone.jar";
+  env.JARNAME = "leiningen-${finalAttrs.version}-standalone.jar";
 
   dontUnpack = true;
 

pkgs/by-name/ns/nspr/package.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace configure.in --replace '@executable_path/' "$out/lib/"
   '';
 
-  HOST_CC = "cc";
+  env.HOST_CC = "cc";
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   configureFlags = [
     "--enable-optimize"

pkgs/by-name/op/open-scq30/package.nix

@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-3K+/CpTGWSjCRa2vOEcDvLIiZMdntugIqnzkXF4wkng=";
 
-  INSTALL_PREFIX = placeholder "out";
+  env.INSTALL_PREFIX = placeholder "out";
 
   # Requires headphones
   doCheck = false;

pkgs/by-name/pk/pkl/package.nix

@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     gradleFlagsArray+=(-DcommitId=$(cat .commit-hash))
   '';
 
-  JAVA_TOOL_OPTIONS = "-Dfile.encoding=utf-8";
+  env.JAVA_TOOL_OPTIONS = "-Dfile.encoding=utf-8";
   __darwinAllowLocalNetworking = true;
 
   preCheck = ''

pkgs/by-name/py/pyprland/package.nix

@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   # NOTE: this is required for the imports check below to work properly
-  HYPRLAND_INSTANCE_SIGNATURE = "dummy";
+  env.HYPRLAND_INSTANCE_SIGNATURE = "dummy";
 
   pythonImportsCheck = [
     "pyprland"

pkgs/by-name/ra/ramalama/package.nix

@@ -7,6 +7,7 @@
   llama-cpp-vulkan,
   podman,
   withPodman ? true,
+  writableTmpDirAsHomeHook,
 
   # passthru
   ramalama,
@@ -14,14 +15,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ramalama";
-  version = "0.15.0";
+  version = "0.17.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "ramalama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0R7y1PpAxXzSlhfOFHf3cWPzZ544fYVUL0w7jOFSuAU=";
+    hash = "sha256-BXUWNP3yxuDsL1gY28oWhlu+vTIezYpDbScUsOulyYA=";
   };
 
   build-system = with python3Packages; [
@@ -31,6 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   dependencies = with python3Packages; [
     argcomplete
+    bcrypt
     pyyaml
     jsonschema
     jinja2
@@ -69,8 +71,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   nativeCheckInputs = [
-    python3Packages.pytestCheckHook
     podman
+    python3Packages.pytestCheckHook
+    python3Packages.requests
+    writableTmpDirAsHomeHook
   ];
 
   preCheck = ''

pkgs/by-name/ri/ripe-atlas-tools/package.nix

@@ -3,6 +3,7 @@
   python3,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
@@ -61,6 +62,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
+    writableTmpDirAsHomeHook # for cache generation.
   ];
 
   disabledTests = [
@@ -85,8 +87,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "tests/test_docs.py"
   ];
 
-  HOME = "$TMPDIR"; # for cache generation.
-
   # Necessary because it confuse the tests when it does "from ripe.atlas.sagan import X"
   # version.py is used by Sphinx tests.
   preCheck = ''

pkgs/by-name/sa/sailsd/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsailing
   ];
 
-  INSTALL_PATH = "$(out)";
+  env.INSTALL_PATH = "$(out)";
 
   postUnpack = ''
     rmdir $sourceRoot/libsailing

pkgs/by-name/ti/timelimit/package.nix

@@ -20,8 +20,11 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   installFlags = [ "PREFIX=$(out)" ];
-  INSTALL_PROGRAM = "install -m755";
-  INSTALL_DATA = "install -m644";
+
+  env = {
+    INSTALL_PROGRAM = "install -m755";
+    INSTALL_DATA = "install -m644";
+  };
 
   meta = {
     description = "Execute a command and terminates the spawned process after a given time with a given signal";

pkgs/by-name/tu/tunefish/package.nix

@@ -13,6 +13,7 @@
   libxext,
   libxinerama,
   libxrandr,
+  writableTmpDirAsHomeHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     python3
+    writableTmpDirAsHomeHook # silences build warnings
   ];
 
   buildInputs = [
@@ -52,9 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
     "CONFIG=Release"
   ];
 
-  # silences build warnings
-  HOME = "/build";
-
   postPatch = ''
     patchShebangs src/tunefish4/generate-lv2-ttl.py
   '';

pkgs/by-name/wi/wiimms-iso-tools/package.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace Makefile --replace gcc "$CC"
   '';
 
-  INSTALL_PATH = "$out";
+  env.INSTALL_PATH = "$out";
 
   installPhase = ''
     mkdir "$out"

pkgs/by-name/xp/xpra/package.nix

@@ -126,7 +126,12 @@ effectiveBuildPythonApplication rec {
     patchShebangs --build fs/bin/build_cuda_kernels.py
   '';
 
-  INCLUDE_DIRS = "${pam}/include";
+  env = {
+    # error: 'import_cairo' defined but not used
+    NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+
+    INCLUDE_DIRS = "${pam}/include";
+  };
 
   nativeBuildInputs = [
     clang
@@ -224,9 +229,6 @@ effectiveBuildPythonApplication rec {
       ]
     );
 
-  # error: 'import_cairo' defined but not used
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
-
   setupPyBuildFlags = [
     "--with-Xdummy"
     "--without-Xdummy_wrapper"

pkgs/development/python-modules/django-cte/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "django-cte";
-  version = "2.0.0";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dimagi";
     repo = "django-cte";
     tag = "v${version}";
-    hash = "sha256-DPbvmxTh24gTGvqzBg1VVN1LHxhGc+r81RITCuyccfw=";
+    hash = "sha256-pXTnk3Z+6jiqq7Q2JTpHxZSNHaTRT3lAAeuHTQIuzBM=";
   };
 
   build-system = [

pkgs/development/python-modules/hy/default.nix

@@ -24,7 +24,7 @@ buildPythonPackage rec {
   };
 
   # https://github.com/hylang/hy/blob/1.0a4/get_version.py#L9-L10
-  HY_VERSION = version;
+  env.HY_VERSION = version;
 
   build-system = [ setuptools ];
 

pkgs/development/python-modules/sphinx-favicon/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sphinx-favicon";
-  version = "1.0.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tcmetzger";
     repo = "sphinx-favicon";
     tag = "v${version}";
-    hash = "sha256-Arcjj+6WWuSfufh8oqrDyAtjp07j1JEuw2YlmFcfL3U=";
+    hash = "sha256-8zKG145BttlE8HYJ0H8O762TYC9KeIO8L9UfgNDs+i8=";
   };
 
   build-system = [

pkgs/os-specific/linux/busybox/default.nix

@@ -3,6 +3,7 @@
   lib,
   buildPackages,
   fetchurl,
+  fetchpatch,
   fetchFromGitLab,
   enableStatic ? stdenv.hostPlatform.isStatic,
   enableMinimal ? false,
@@ -76,6 +77,19 @@ stdenv.mkDerivation rec {
     # Fix aarch64 build failure: sha1_process_block64_shaNI is x86-specific
     # https://lists.busybox.net/pipermail/busybox/2024-September/090943.html
     ./fix-aarch64-sha1.patch
+    # archival: disallow path traversals (CVE-2023-39810)
+    (fetchpatch {
+      name = "CVE-2023-39810.patch";
+      url = "https://git.busybox.net/busybox/patch/?id=9a8796436b9b0641e13480811902ea2ac57881d3";
+      hash = "sha256-pOARbCwiucrkNITBoOMpLF3GniYvJiyBeBi2/Aw2JY8=";
+    })
+    # tar: strip unsafe hardlink components - GNU tar does the same
+    (fetchpatch {
+      name = "CVE-2026-26157_CVE-2026-26158.patch";
+      url = "https://git.busybox.net/busybox/patch/?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb";
+      excludes = [ "networking/httpd_ratelimit_cgi.c" ]; # New since release.
+      hash = "sha256-Msm9sDZrVx7ofunnvnTS73SPKUUpR3Tv5xZ/wBd+rts=";
+    })
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;