Merge master into staging-next

pkgs/by-name/bl/blueutil/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  llvmPackages,
   testers,
   nix-update-script,
 }:
@@ -17,7 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Qw5c9dp7wpuOcQSLsg1pfJ+NbrEtme2o6nKD3Ba3A3M=";
   };
 
+  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
+  nativeBuildInputs = [ llvmPackages.lld ];
+
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
+  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
+  env.NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/da/darktable/package.nix

@@ -103,7 +103,8 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook3
     saxon # Use Saxon instead of libxslt to fix XSLT generate-id() consistency issues
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     SDL2
@@ -184,6 +185,12 @@ stdenv.mkDerivation rec {
     "-DUSE_KWALLET=OFF"
   ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Work around ld64's libc++ hardening issue.
+    # TODO: Remove once #536365 reaches this branch.
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   # darktable changed its rpath handling in commit
   # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
   # binaries can't find libdarktable.so, so change LD_LIBRARY_PATH in

pkgs/by-name/gt/gtk4/package.nix

@@ -60,6 +60,7 @@
   compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages,
   cups,
   libexecinfo,
+  llvmPackages,
   broadwaySupport ? true,
   testers,
   darwinMinVersionHook,
@@ -130,6 +131,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals vulkanSupport [
     shaderc # for glslc
   ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
+    llvmPackages.lld
+  ]
   ++ finalAttrs.setupHooks;
 
   buildInputs = [
@@ -221,6 +226,10 @@ stdenv.mkDerivation (finalAttrs: {
   }
   // lib.optionalAttrs stdenv.hostPlatform.isMusl {
     NIX_LDFLAGS = "-lexecinfo";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
+    NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
   };
 
   postPatch = ''

pkgs/by-name/ma/mactop/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  llvmPackages,
   versionCheckHook,
   nix-update-script,
 }:
@@ -21,6 +22,14 @@ buildGoModule rec {
 
   proxyVendor = true;
 
+  nativeBuildInputs = [ llvmPackages.lld ];
+
+  env = {
+    # Work around ld64's libc++ hardening issue.
+    # TODO: Remove once #536365 reaches this branch.
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/no/noti/package.nix

@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromCodeberg,
+  llvmPackages,
   installShellFiles,
 }:
 
@@ -18,10 +20,19 @@ buildGoModule (finalAttrs: {
 
   vendorHash = null;
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   subPackages = [ "cmd/noti" ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Work around ld64's libc++ hardening issue.
+    # TODO: Remove once #536365 reaches this branch.
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/py/pyxel/package.nix

@@ -11,36 +11,26 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyxel";
-  version = "2.8.10";
+  version = "2.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kitao";
     repo = "pyxel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+SitYe2HFA6rwqk5lipcKFdBy69zdAhw3Q+Nb0iBx6s=";
+    hash = "sha256-k86VRX25yVNZvsnsWl0EYGd8njhx9yl6gkqI7mznjEs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "add-Cargo.lock.patch";
-      url = "https://github.com/kitao/pyxel/commit/821286112ea0c26141aa64b25aaa076611a2a91d.patch";
-      excludes = [ "CHANGELOG.md" ];
-      hash = "sha256-XtFdtmprPKrdjFOzEsNMJjc4PpNv6KDtWX2Hes2IKe0=";
-    })
-  ];
-
   cargoRoot = "crates";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs)
       src
-      patches
       pname
       version
       cargoRoot
       ;
-    hash = "sha256-SGrQmGZeM2NcooDqCTO2HOXgLg7h+VvDIierDacqSFs=";
+    hash = "sha256-tpJSUdjdXwXK/n1nyMga5uTk7TAz/JLQVN0rSdbKxGk=";
   };
 
   buildAndTestSubdir = "python";
@@ -62,6 +52,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2";
 
+  preBuild = ''
+    # logic taken from Makefile
+    cp LICENSE README.md python/pyxel/
+  '';
+
   # Tests want to use the display
   doCheck = false;
 

pkgs/by-name/qb/qbittorrent/package.nix

@@ -17,6 +17,7 @@
   wrapGAppsHook3,
   zlib,
   nixosTests,
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,6 +36,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     wrapGAppsHook3
     qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # TODO: Remove once #536365 reaches this branch
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -60,6 +65,11 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!webuiSupport) [ "-DWEBUI=OFF" ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # TODO: Remove once #536365 reaches this branch
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   qtWrapperArgs = lib.optionals trackerSearch [ "--prefix PATH : ${lib.makeBinPath [ python3 ]}" ];
 
   dontWrapGApps = true;

pkgs/by-name/st/stats/package.nix

@@ -3,6 +3,8 @@
   swiftPackages,
   fetchFromGitHub,
   leveldb,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
   perl,
   actool,
   makeWrapper,
@@ -88,6 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
     actool
     makeWrapper
     rcodesign
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ];
 
   buildInputs = [ leveldb ];
@@ -126,6 +130,8 @@ stdenv.mkDerivation (finalAttrs: {
       # The Swift compiler in nixpkgs uses SDK 14 headers (which compile fine), but without
       # this flag the linker records SDK 14 and macOS withholds it (Liquid Glass)
       -Xlinker -platform_version -Xlinker macos -Xlinker 14.0 -Xlinker 26.0
+      # TODO: Clean up on `staging`
+      -use-ld=lld
     )
 
     buildFramework() {

pkgs/by-name/st/stevenblack-blocklist/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.94";
+  version = "3.16.97";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-vVEf9FAXT4QgwM2BZF593JVD7NpTlwXdy9JXrnufhAo=";
+    hash = "sha256-5r8r57m+Ilce6Onu/svc05yyrLGH5S65RixbwqlpmPU=";
   };
 
   outputs = [

pkgs/by-name/vi/vikunja/package.nix

@@ -47,6 +47,11 @@ let
       pnpm_10
     ];
 
+    postPatch = ''
+      substituteInPlace src/version.json \
+        --replace-fail '"dev"' '"${finalAttrs.version}"'
+    '';
+
     doCheck = true;
 
     postBuild = ''