Merge e0658cba20 into haskell-updates

ci/eval/compare/default.nix

@@ -161,12 +161,13 @@ let
     );
 
   inherit
-    (callPackage ./maintainers.nix { } {
+    (callPackage ./maintainers.nix {
       changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
       changedpathsjson = touchedFilesJson;
       removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
     })
-    maintainers
+    users
+    teams
     packages
     ;
 in
@@ -178,10 +179,12 @@ runCommand "compare"
       cmp-stats
       codeowners
     ];
-    maintainers = builtins.toJSON maintainers;
+    users = builtins.toJSON users;
+    teams = builtins.toJSON teams;
     packages = builtins.toJSON packages;
     passAsFile = [
-      "maintainers"
+      "users"
+      "teams"
       "packages"
     ];
   }
@@ -262,6 +265,7 @@ runCommand "compare"
 
     done
 
-    cp "$maintainersPath" "$out/maintainers.json"
+    cp "$usersPath" "$out/maintainers.json"
+    cp "$teamsPath" "$out/teams.json"
     cp "$packagesPath" "$out/packages.json"
   ''

ci/eval/compare/maintainers.nix

@@ -1,7 +1,5 @@
 {
   lib,
-}:
-{
   changedattrs,
   changedpathsjson,
   removedattrs,
@@ -51,15 +49,16 @@ let
         # updates to .json files.
         # TODO: Support by-name package sets.
         filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # TODO: Refactor this so we can ping entire teams instead of the individual members.
-        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-        maintainers = package.meta.maintainers or [ ];
+        # meta.maintainers also contains all individual team members.
+        # We only want to ping individuals if they're added individually as maintainers, not via teams.
+        users = package.meta.nonTeamMaintainers or [ ];
+        teams = package.meta.teams or [ ];
       }
     ))
     # No need to match up packages without maintainers with their files.
     # This also filters out attributes where `packge = null`, which is the
     # case for libintl, for example.
-    (lib.filter (pkg: pkg.maintainers != [ ]))
+    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
   ];
 
   relevantFilenames =
@@ -94,20 +93,44 @@ let
 
   attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
 
-  listToPing = lib.concatMap (
+  userPings =
     pkg:
     map (maintainer: {
-      id = maintainer.githubId;
-      inherit (maintainer) github;
+      type = "user";
+      userId = maintainer.githubId;
       packageName = pkg.name;
-      dueToFiles = pkg.filenames;
-    }) pkg.maintainers
+    });
+
+  teamPings =
+    pkg: team:
+    if team ? github then
+      [
+        {
+          type = "team";
+          teamId = team.githubId;
+          packageName = pkg.name;
+        }
+      ]
+    else
+      userPings pkg team.members;
+
+  maintainersToPing = lib.concatMap (
+    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
   ) attrsWithModifiedFiles;
 
-  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
+  byType = lib.groupBy (ping: ping.type) maintainersToPing;
+
+  byUser = lib.pipe (byType.user or [ ]) [
+    (lib.groupBy (ping: toString ping.userId))
+    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
+  ];
+  byTeam = lib.pipe (byType.team or [ ]) [
+    (lib.groupBy (ping: toString ping.teamId))
+    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
+  ];
 in
 {
-  maintainers = lib.mapAttrs (_: lib.catAttrs "packageName") byMaintainer;
-
-  packages = lib.catAttrs "packageName" listToPing;
+  users = byUser;
+  teams = byTeam;
+  packages = lib.catAttrs "name" attrsWithModifiedFiles;
 }

ci/github-script/bot.js

@@ -12,6 +12,12 @@ module.exports = async ({ github, context, core, dry }) => {
   // Detect if running in a fork (not NixOS/nixpkgs)
   const isFork = context.repo.owner !== 'NixOS'
 
+  const orgId = (
+    await github.rest.orgs.get({
+      org: context.repo.owner,
+    })
+  ).data.id
+
   async function downloadMaintainerMap(branch) {
     let run
 
@@ -160,6 +166,28 @@ module.exports = async ({ github, context, core, dry }) => {
     return users[id]
   }
 
+  // Same for teams
+  const teams = {}
+  function getTeam(id) {
+    if (!teams[id]) {
+      teams[id] = github
+        .request({
+          method: 'GET',
+          url: '/organizations/{orgId}/team/{id}',
+          orgId,
+          id,
+        })
+        .then((resp) => resp.data)
+        .catch((e) => {
+          // Team may have been deleted
+          if (e.status === 404) return null
+          throw e
+        })
+    }
+
+    return teams[id]
+  }
+
   async function handlePullRequest({ item, stats, events }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
@@ -192,17 +220,49 @@ module.exports = async ({ github, context, core, dry }) => {
     })
 
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    // Accounts could be deleted as well, so don't count them.
     const reviews = (
-      await github.paginate(github.rest.pulls.listReviews, {
-        ...context.repo,
-        pull_number,
-      })
-    ).filter(
+      await github.graphql(
+        `query($owner: String!, $repo: String!, $pr: Int!) {
+        repository(owner: $owner, name: $repo) {
+          pullRequest(number: $pr) {
+            # Unlikely that there's ever more than 100 reviews, so let's not bother,
+            # but once https://github.com/actions/github-script/issues/309 is resolved,
+            # it would be easy to enable pagination.
+            reviews(first: 100) {
+              nodes {
+                state
+                user: author {
+                  # Only get users, no bots
+                  ... on User {
+                    login
+                    # Set the id field in the resulting JSON to GraphQL's databaseId
+                    # databaseId in GraphQL-land is the same as id in REST-land
+                    id: databaseId
+                  }
+                }
+                onBehalfOf(first: 100) {
+                  nodes {
+                    slug
+                  }
+                }
+              }
+            }
+          }
+        }
+      }`,
+        {
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          pr: pull_number,
+        },
+      )
+    ).repository.pullRequest.reviews.nodes.filter(
       (r) =>
-        r.user &&
-        !r.user.login.endsWith('[bot]') &&
-        r.user.type !== 'Bot' &&
+        // The `... on User` makes it such that .login only exists for users,
+        // but we still need to filter the others out.
+        // Accounts could be deleted as well, so don't count them.
+        r.user?.login &&
+        // Also exclude author reviews, can't request their review in any case
         r.user.id !== pull_request.user?.id,
     )
 
@@ -402,6 +462,16 @@ module.exports = async ({ github, context, core, dry }) => {
           if (e.code !== 'ENOENT') throw e
         }
 
+        let team_maintainers = []
+        try {
+          team_maintainers = Object.keys(
+            JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')),
+          ).map((id) => parseInt(id))
+        } catch (e) {
+          // Older artifacts don't have the teams.json, yet.
+          if (e.code !== 'ENOENT') throw e
+        }
+
         // We set this label earlier already, but the current PR state can be very different
         // after handleReviewers has requested reviews, so update it in this case to prevent
         // this label from flip-flopping.
@@ -414,14 +484,15 @@ module.exports = async ({ github, context, core, dry }) => {
           pull_request,
           reviews,
           // TODO: Use maintainer map instead of the artifact.
-          maintainers: Object.keys(
+          user_maintainers: Object.keys(
             JSON.parse(
               await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
             ),
           ).map((id) => parseInt(id)),
+          team_maintainers,
           owners,
-          getTeamMembers,
           getUser,
+          getTeam,
         })
       }
     }

ci/github-script/merge.js

@@ -171,7 +171,7 @@ async function handleMerge({
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return 'Merge completed (dry)'
+      return ['Merge completed (dry)']
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter

ci/github-script/reviewers.js

@@ -6,28 +6,29 @@ async function handleReviewers({
   dry,
   pull_request,
   reviews,
-  maintainers,
+  user_maintainers,
+  team_maintainers,
   owners,
-  getTeamMembers,
   getUser,
+  getTeam,
 }) {
   const pull_number = pull_request.number
 
-  const requested_reviewers = new Set(
-    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-  )
-  log(
-    'reviewers - requested_reviewers',
-    Array.from(requested_reviewers).join(', '),
-  )
+  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
+  const users_reached = new Set([
+    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+    ...reviews.map(({ user }) => user.login.toLowerCase()),
+  ])
+  log('reviewers - users_reached', Array.from(users_reached).join(', '))
 
-  const existing_reviewers = new Set(
-    reviews.map(({ user }) => user?.login.toLowerCase()).filter(Boolean),
-  )
-  log(
-    'reviewers - existing_reviewers',
-    Array.from(existing_reviewers).join(', '),
-  )
+  // Same for teams
+  const teams_reached = new Set([
+    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
+    ...reviews.flatMap(({ onBehalfOf }) =>
+      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
+    ),
+  ])
+  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
 
   // Early sanity check, before we start making any API requests. The list of maintainers
   // does not have duplicates so the only user to filter out from this list would be the
@@ -35,16 +36,17 @@ async function handleReviewers({
   // further down again.
   // This is to protect against huge treewides consuming all our API requests for no
   // reason.
-  if (maintainers.length > 16) {
+  if (user_maintainers.length + team_maintainers.length > 16) {
     core.warning('Too many potential reviewers, skipping review requests.')
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const users = new Set([
+  // Users that should be reached
+  var users_to_reach = new Set([
     ...(
       await Promise.all(
-        maintainers.map(async (id) => {
+        user_maintainers.map(async (id) => {
           const user = await getUser(id)
           // User may have deleted their account
           return user?.login?.toLowerCase()
@@ -55,76 +57,109 @@ async function handleReviewers({
       .filter((handle) => handle && !handle.includes('/'))
       .map((handle) => handle.toLowerCase()),
   ])
-  log('reviewers - users', Array.from(users).join(', '))
-
-  const teams = new Set(
-    owners
-      .map((handle) => handle.split('/'))
-      .filter(([org, slug]) => org === context.repo.owner && slug)
-      .map(([, slug]) => slug),
-  )
-  log('reviewers - teams', Array.from(teams).join(', '))
-
-  const team_members = new Set(
-    (await Promise.all(Array.from(teams, getTeamMembers)))
-      .flat(1)
-      .map(({ login }) => login.toLowerCase()),
-  )
-  log('reviewers - team_members', Array.from(team_members).join(', '))
-
-  const new_reviewers = users
-    .union(team_members)
     // We can't request a review from the author.
     .difference(new Set([pull_request.user?.login.toLowerCase()]))
-  log('reviewers - new_reviewers', Array.from(new_reviewers).join(', '))
 
   // Filter users to repository collaborators. If they're not, they can't be requested
   // for review. In that case, they probably missed their invite to the maintainers team.
-  const reviewers = (
-    await Promise.all(
-      Array.from(new_reviewers, async (username) => {
-        // TODO: Restructure this file to only do the collaborator check for those users
-        // who were not already part of a team. Being a member of a team makes them
-        // collaborators by definition.
-        try {
-          await github.rest.repos.checkCollaborator({
-            ...context.repo,
-            username,
-          })
-          return username
-        } catch (e) {
-          if (e.status !== 404) throw e
-          core.warning(
-            `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
-          )
-        }
-      }),
-    )
-  ).filter(Boolean)
-  log('reviewers - reviewers', reviewers.join(', '))
+  users_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(users_to_reach, async (username) => {
+          // TODO: Restructure this file to only do the collaborator check for those users
+          // who were not already part of a team. Being a member of a team makes them
+          // collaborators by definition.
+          try {
+            await github.rest.repos.checkCollaborator({
+              ...context.repo,
+              username,
+            })
+            return username
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - users_to_reach', Array.from(users_to_reach).join(', '))
 
-  if (reviewers.length > 15) {
+  // Similar for teams
+  var teams_to_reach = new Set([
+    ...(
+      await Promise.all(
+        team_maintainers.map(async (id) => {
+          const team = await getTeam(id)
+          // Team may have been deleted
+          return team?.slug?.toLowerCase()
+        }),
+      )
+    ).filter(Boolean),
+    ...owners
+      .map((handle) => handle.split('/'))
+      .filter(
+        ([org, slug]) =>
+          org.toLowerCase() === context.repo.owner.toLowerCase() && slug,
+      )
+      .map(([, slug]) => slug.toLowerCase()),
+  ])
+  teams_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(teams_to_reach, async (slug) => {
+          try {
+            await github.rest.teams.checkPermissionsForRepoInOrg({
+              org: context.repo.owner,
+              team_slug: slug,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            })
+            return slug
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', '))
+
+  if (users_to_reach.size + teams_to_reach.size > 15) {
     core.warning(
-      `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`,
+      `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`,
     )
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const non_requested_reviewers = new Set(reviewers)
-    .difference(requested_reviewers)
-    // We don't want to rerequest reviews from people who already reviewed.
-    .difference(existing_reviewers)
-  log(
-    'reviewers - non_requested_reviewers',
-    Array.from(non_requested_reviewers).join(', '),
+  // We don't want to rerequest reviews from people who already reviewed or were requested
+  const users_not_yet_reached = Array.from(
+    users_to_reach.difference(users_reached),
   )
+  log('reviewers - users_not_yet_reached', users_not_yet_reached.join(', '))
+  // We don't want to rerequest reviews from teams who already reviewed or were requested
+  const teams_not_yet_reached = Array.from(
+    teams_to_reach.difference(teams_reached),
+  )
+  log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', '))
 
-  if (non_requested_reviewers.size === 0) {
+  if (
+    users_not_yet_reached.length === 0 &&
+    teams_not_yet_reached.length === 0
+  ) {
     log('Has reviewer changes', 'false (skipped)')
   } else if (dry) {
     core.info(
-      `Requesting reviewers for #${pull_number}: ${Array.from(non_requested_reviewers).join(', ')} (dry)`,
+      `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
+    )
+    core.info(
+      `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
     )
   } else {
     // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
@@ -134,15 +169,17 @@ async function handleReviewers({
     await github.rest.pulls.requestReviewers({
       ...context.repo,
       pull_number,
-      reviewers,
+      reviewers: users_not_yet_reached,
+      team_reviewers: teams_not_yet_reached,
     })
   }
 
   // Return a boolean on whether the "needs: reviewers" label should be set.
   return (
-    non_requested_reviewers.size === 0 &&
-    existing_reviewers.size === 0 &&
-    requested_reviewers.size === 0
+    users_not_yet_reached.length === 0 &&
+    teams_not_yet_reached.length === 0 &&
+    users_reached.size === 0 &&
+    teams_reached.size === 0
   )
 }
 

doc/release-notes/rl-2605.section.md

@@ -101,6 +101,8 @@
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
+- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
+
 - The `services.yggdrasil` module has been refactored with the following breaking changes:
   - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.
   - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).

maintainers/github-teams.json

@@ -209,9 +209,11 @@
       "domenkozar": 126339,
       "donn": 12652988,
       "dwt": 57199,
+      "eclairevoyant": 848000,
       "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
+      "fulsomenko": 14945057,
       "gador": 1883533,
       "griff": 4368,
       "groodt": 343415,
@@ -240,7 +242,6 @@
       "mstone": 412508,
       "n8henrie": 1234956,
       "ofalvai": 1694986,
-      "pasqui23": 6931743,
       "prusnak": 42201,
       "reckenrode": 7413633,
       "ryand56": 22267679,
@@ -422,8 +423,7 @@
     "maintainers": {
       "Mic92": 96200,
       "kalbasit": 87115,
-      "katexochen": 49727155,
-      "zowoq": 59103226
+      "katexochen": 49727155
     },
     "members": {
       "mfrw": 4929861,
@@ -524,7 +524,7 @@
     "members": {
       "K900": 386765,
       "Ma27": 6025220,
-      "TredwellGit": 61860346
+      "zowoq": 59103226
     },
     "name": "Linux kernel"
   },
@@ -550,8 +550,7 @@
     "members": {
       "9999years": 15312184,
       "Qyriad": 1542224,
-      "RaitoBezarius": 314564,
-      "alois31": 36605164
+      "RaitoBezarius": 314564
     },
     "name": "Lix maintainers"
   },
@@ -691,7 +690,6 @@
       "0x4A6F": 9675338,
       "MattSturgeon": 5046562,
       "Sereja313": 112060595,
-      "dasJ": 4971975,
       "dyegoaurelio": 42411160
     },
     "name": "nix-formatting"
@@ -707,6 +705,7 @@
       "Mic92": 96200,
       "Radvendii": 1239929,
       "edolstra": 1148549,
+      "lovesegfault": 7243783,
       "xokdvium": 145775305
     },
     "name": "Nix team"
@@ -740,8 +739,7 @@
     "id": 14317027,
     "maintainers": {
       "alyssais": 2768870,
-      "emilazy": 18535642,
-      "wolfgangwalther": 9132420
+      "emilazy": 18535642
     },
     "members": {},
     "name": "Nixpkgs core"

maintainers/maintainer-list.nix

@@ -25082,12 +25082,6 @@
     githubId = 8904314;
     name = "Konstantin Nick";
   };
-  squalus = {
-    email = "squalus@squalus.net";
-    github = "squalus";
-    githubId = 36899624;
-    name = "squalus";
-  };
   squarepear = {
     email = "contact@jeffreyharmon.dev";
     github = "SquarePear";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -36,6 +36,8 @@
 
 - [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable).
 
+- [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable).
+
 - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
 
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
@@ -127,6 +129,17 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `geph` package's built-in GUI `geph5-client-gui` has been [removed](https://github.com/geph-official/geph5/commit/f2221fb8386312daf2cef05483ebb353ff48bdb4) by the upstream. All users who wish to continue using the GUI should install the `gephgui-wry`, which is consistent with the official release version.
 
+- `services.vikunja` has been updated to Vikunja [v1.0.0](https://vikunja.io/changelog/whats-new-in-vikunja-1.0.0/), which introduces multiple breaking changes.
+  Notable breaking changes:
+  - CORS is enabled by default. The module now sets
+    `services.vikunja.settings.service.publicurl` by default. Custom overrides must ensure it is
+    set or disable CORS, otherwise Vikunja will fail to start.
+  - API route and response changes may affect integrations.
+  - Configuration format and option changes require review of existing settings (including OpenID
+    provider configuration and metrics/log settings).
+  - SQLite paths are now relative to `service.rootpath` unless absolute. Startup now validates file
+    storage and OAuth providers.
+
 ## Other Notable Changes {#sec-release-26.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -843,6 +843,7 @@
   ./services/misc/dump1090-fa.nix
   ./services/misc/dwm-status.nix
   ./services/misc/dysnomia.nix
+  ./services/misc/elephant.nix
   ./services/misc/errbot.nix
   ./services/misc/ersatztv.nix
   ./services/misc/etebase-server.nix

nixos/modules/programs/captive-browser.nix

@@ -142,20 +142,9 @@ in
         else if config.networking.useNetworkd then
           "${cfg.package}/bin/systemd-networkd-dns ${iface [ ]}"
         else
-          "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface [ "-i" ]} -O dns --script ${pkgs.writeShellScript "udhcp-script" ''
-            if [ "$1" = bound ]; then
-              echo "$dns"
-            fi
-          ''}"
+          throw "programs.captive-browser.dhcp-dns must be set"
       );
 
-    security.wrappers.udhcpc = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_raw+p";
-      source = "${pkgs.busybox}/bin/udhcpc";
-    };
-
     security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
       owner = "root";
       group = "root";

nixos/modules/services/audio/navidrome.nix

@@ -161,7 +161,8 @@ in
             ];
             RestrictRealtime = true;
             LockPersonality = true;
-            MemoryDenyWriteExecute = true;
+            # 0.60.0 Taglib introduces WASM JIT that requires this
+            MemoryDenyWriteExecute = false;
             UMask = "0066";
             ProtectHostname = true;
           };

nixos/modules/services/misc/elephant.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.elephant;
+in
+{
+  options.services.elephant = {
+    enable = lib.mkEnableOption "Elephant application launcher backend";
+
+    package = lib.mkPackageOption pkgs "elephant" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.user.services.elephant = {
+      description = "Elephant application launcher backend";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 10;
+        ExecStart = "${cfg.package}/bin/elephant";
+      };
+    };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    saadndm
+  ];
+}

nixos/modules/services/networking/ssh/sshd.nix

@@ -345,6 +345,15 @@ in
           NOTE: this will override default listening on all local addresses and port 22.
           NOTE: setting this option won't automatically enable given ports
           in firewall configuration.
+          NOTE: If the IP address is not available at boot time, the following has
+          to be added to make sure sshd will wait for dhcp configuration:
+          ```nix
+          systemd.services.sshd = {
+            wants = [ "network-online.target" ];
+            after = [ "network-online.target" ];
+          };
+          ```
+          See the following issue for details: <https://github.com/NixOS/nixpkgs/issues/105570>
         '';
       };
 

nixos/modules/services/networking/wpa_supplicant.nix

@@ -117,9 +117,24 @@ let
 
       path = [ pkgs.wpa_supplicant ];
       serviceConfig = {
+        RuntimeDirectory = "wpa_supplicant";
+        ExecStartPre =
+          lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [
+            # set up imperative config file
+            "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+          ]
+          ++ lib.optionals cfg.userControlled [
+            # set up client sockets directory
+            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
+          ];
+      }
+      // lib.optionalAttrs cfg.enableHardening {
         User = "wpa_supplicant";
         Group = "wpa_supplicant";
-        RuntimeDirectory = "wpa_supplicant";
         AmbientCapabilities = [
           "CAP_NET_ADMIN"
           "CAP_NET_RAW"
@@ -180,20 +195,6 @@ let
         ];
         SystemCallArchitectures = "native";
         UMask = "0077";
-
-        ExecStartPre =
-          lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [
-            # set up imperative config file
-            "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
-          ]
-          ++ lib.optionals cfg.userControlled [
-            # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
-            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
-            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
-          ];
       };
 
       script = ''
@@ -598,6 +599,22 @@ in
         '';
       };
 
+      enableHardening = mkOption {
+        default = true;
+        description = ''
+          Whether to apply security hardening measures to wpa_supplicant.
+          These include limiting access to the filesystem, devices and network
+          capabilities.
+
+          ::: {.note}
+          Disabling this will increase the potential attack surface if the
+          wpa_supplicant daemon becomes compromised, but it may be necessary
+          for more complex enterprise networks (for example requiring
+          access to mutable files, smart cards or TPM devices).
+          :::
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

nixos/modules/services/web-apps/vikunja.nix

@@ -111,7 +111,7 @@ in
       };
       service = {
         interface = "${cfg.address}:${toString cfg.port}";
-        frontendurl = "${cfg.frontendScheme}://${cfg.frontendHostname}/";
+        publicurl = "${cfg.frontendScheme}://${cfg.frontendHostname}/";
       };
       files = {
         basepath = "/var/lib/vikunja/files";

nixos/tests/systemd-coredump.nix

@@ -17,8 +17,8 @@ in
 
 {
   name = "systemd-coredump";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ squalus ];
+  meta = {
+    maintainers = [ ];
   };
 
   nodes.machine1 = { pkgs, lib, ... }: commonConfig;

nixos/tests/wpa_supplicant.nix

@@ -226,6 +226,19 @@ in
           machine.succeed(dbus_command)  # as root
           machine.succeed(f"sudo -g wpa_supplicant {dbus_command}")  # as wpa_supplicant group
 
+      with subtest("D-Bus auto-starting is working"):
+          # stop service
+          machine.systemctl("stop wpa_supplicant.service")
+          machine.require_unit_state("wpa_supplicant.service", "inactive")
+
+          # send wake up
+          dbus_command = "dbus-send --system --print-reply --dest=fi.w1.wpa_supplicant1 " \
+                         "/fi/w1/wpa_supplicant1 fi.w1.wpa_supplicant1.GetInterface string:wlan0"
+          machine.succeed(dbus_command)
+
+          # should be up again
+          machine.require_unit_state("wpa_supplicant.service", "active")
+
       # generated configuration file
       config_file = "/etc/static/wpa_supplicant/nixos.conf"
 

pkgs/applications/blockchains/bitcoin-knots/default.nix

@@ -164,9 +164,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_GUI" true)
   ];
 
-  NIX_LDFLAGS = lib.optionals (
-    stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic
-  ) "-levent_core";
+  env = lib.optionalAttrs (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic) {
+    NIX_LDFLAGS = "-levent_core";
+  };
 
   nativeCheckInputs = [ python3 ];
 

pkgs/applications/blockchains/bitcoin/default.nix

@@ -165,9 +165,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_GUI" true)
   ];
 
-  NIX_LDFLAGS = lib.optionals (
-    stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic
-  ) "-levent_core";
+  env = lib.optionalAttrs (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic) {
+    NIX_LDFLAGS = "-levent_core";
+  };
 
   nativeCheckInputs = [ python3 ];
 

pkgs/applications/editors/cudatext/default.nix

@@ -81,7 +81,11 @@ stdenv.mkDerivation rec {
   ++ lib.optional (widgetset == "gtk3") gtk3
   ++ lib.optional (widgetset == "qt5") libsForQt5.libqtpas;
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  env.NIX_LDFLAGS = toString [
+    "--as-needed"
+    "-rpath"
+    (lib.makeLibraryPath buildInputs)
+  ];
 
   buildPhase =
     lib.concatStringsSep "\n" (

pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix

@@ -47,9 +47,6 @@ lib.packagesFromDirectoryRecursive {
 
   zstd = callPackage ./manual-packages/zstd { inherit (pkgs) zstd; };
 
-  # From old emacsPackages (pre emacsPackagesNg)
-  cedille = callPackage ./manual-packages/cedille { inherit (pkgs) cedille; };
-
   # camelCase aliases for some of the kebab-case expressions above
   colorThemeSolarized = self.color-theme-solarized;
   emacsSessionManagement = self.session-management-for-emacs;

pkgs/applications/editors/emacs/elisp-packages/manual-packages/cedille/default.nix

@@ -1,38 +0,0 @@
-{
-  stdenv,
-  cedille,
-  emacs,
-}:
-
-stdenv.mkDerivation {
-  pname = "cedille-mode";
-
-  inherit (cedille) version src;
-
-  buildInputs = [ emacs ];
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    install -d $out/share/emacs/site-lisp
-    install se-mode/*.el se-mode/*.elc $out/share/emacs/site-lisp
-    install cedille-mode/*.el cedille-mode/*.elc $out/share/emacs/site-lisp
-    install *.el *.elc $out/share/emacs/site-lisp
-    substituteInPlace $out/share/emacs/site-lisp/cedille-mode.el \
-      --replace /usr/bin/cedille ${cedille}/bin/cedille
-
-    runHook postInstall
-  '';
-
-  meta = {
-    inherit (cedille.meta)
-      homepage
-      license
-      maintainers
-      platforms
-      ;
-    description = "Emacs major mode for Cedille";
-  };
-}

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.56.2";
-    hash = "sha256-CtRtOPrLI4KW6nsK/sTvbPN43jkcS5ZxkXw18ydTBpQ=";
+    version = "3.57.1";
+    hash = "sha256-EBRuYqZ6UTuu2FRjxdDCRqRm4DKzH/3yWyOypoIxJRU=";
   };
 
   meta = {

pkgs/applications/editors/vscode/vscode.nix

@@ -36,20 +36,20 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-RqBae6s6y2XnXqtKbrKkMRwALKLfNE7mBFwOwwomG10=";
-      x86_64-darwin = "sha256-3N7xZIJsgQPX6izaH8ZoXy3SLcbXCNwJvE8ahFwVfF8=";
-      aarch64-linux = "sha256-8WigXl83hXEA7qsG6dOYKVSVISRDDpqJyv7L+9ks40Q=";
-      aarch64-darwin = "sha256-ZJ0QKqkFQYz3V7TEalM3sFJnqYnKBgQVqPXdsi2c+80=";
-      armv7l-linux = "sha256-m78hRkaI1nlqdeeP3t0HiNCUzNneMXxyenC8RmtuC68=";
+      x86_64-linux = "sha256-N8dBXYpBbaymuGWFb8+77/4yJ6Meo5eqoYpnlsjGlN8=";
+      x86_64-darwin = "sha256-li+29ukZXvwBihnHti+AntMNwhr3g1tOOdmalZchL40=";
+      aarch64-linux = "sha256-ASzpE721RBAiVFxnGCRMCWj/RFa+TpxA4gaZJFxk7I0=";
+      aarch64-darwin = "sha256-afaADPPWJlW3HdWGAMDuibGhBtR7toEm2T58jR/nsic=";
+      armv7l-linux = "sha256-BgG1RglSISrKm+KRq7AXhp7EUOssts2LSLCVqSD7E/Q=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.108.2";
+  version = "1.109.0";
 
   # This is used for VS Code - Remote SSH test
-  rev = "c9d77990917f3102ada88be140d28b038d1dd7c7";
+  rev = "bdd88df003631aaa0bcbe057cb0a940b80a476fa";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -82,7 +82,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-bUnM+editWCYiiqR3mlIw4BRrM5gHd6T2GO65VKTDSE=";
+      hash = "sha256-qdXYNkc7u1s/HexmK3Dwc4H/nsfoyhL0/c8TgK94JwU=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/emulators/libretro/cores/np2kai.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "np2kai";
-  version = "0-unstable-2026-01-31";
+  version = "0-unstable-2026-02-01";
 
   src = fetchFromGitHub {
     owner = "AZO234";
     repo = "NP2kai";
-    rev = "696c03b5d2cc6d67450b62276fb945d791fa6be1";
-    hash = "sha256-usaQl1q9U+Qwe/ZxOyrDxTUr1ifbPljQrxRc7uoQWLA=";
+    rev = "15676585b9a370e874ea9309252bd8236df3f642";
+    hash = "sha256-Zaay3JYCjv1eohNTC/9AYD0ZrvNaz9X4A4D6CkB/n+4=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/coolreader/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coolreader";
-  version = "3.2.58";
+  version = "3.2.59";
 
   src = fetchFromGitHub {
     owner = "buggins";
     repo = "coolreader";
     rev = "cr${version}";
-    sha256 = "sha256-DUcYUFxPPSPvoEUEbKYEAGxFeFGQCfOFA0+SegoC4oI=";
+    sha256 = "sha256-RgVEOaNBaEuPBC75B8PdCkbqMvEzNmnEYmiI1ny/WFQ=";
   };
 
   patches = [ ./cmake_policy_version_3_5.patch ];

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -715,22 +715,22 @@
     "vendorHash": "sha256-baqt8ZBmPQpKZIb/7tb44p7xf8azBawks4mQxtAqIpc="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-4YCixNM2I/v8pn6CAiNQf2tXKTeNjAWpHGDF3yOwIYs=",
+    "hash": "sha256-vDGr0g/yhLTr+oyXxbM7v2TyecYRAvx40crCi3ug5Lk=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.85.0",
+    "rev": "v1.86.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-1GqI6cFy386osELaG474OeQX33wIAIEABb/bL5ezs6Q=",
+    "hash": "sha256-6xJf+67xcxZLraRvbKkazNis44V2EP67nHjyCeV832A=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.87.2",
+    "rev": "v1.88.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vKu5ytMAhIYKoPNfuxpyBT9gRdSAR4wFI/7A9K+RiAo="
+    "vendorHash": "sha256-KjhTp/Sjf4pxbsrWc4EZAD/NAtr0U7yieYd6s2NQHHc="
   },
   "icinga_icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -87,7 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   # Undefined symbols for architecture arm64: "_gpg_strerror"
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lgpg-error";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-lgpg-error";
+  };
 
   # Dino looks for plugins with a .so filename extension, even on macOS where
   # .dylib is appropriate, and despite the fact that it builds said plugins with

pkgs/applications/networking/instant-messengers/linphone/default.nix

@@ -8,8 +8,8 @@ makeScopeWithSplicing' {
   extra = self: {
     mkLinphoneDerivation = self.mk-linphone-derivation;
 
-    linphoneSdkVersion = "5.4.48";
-    linphoneSdkHash = "sha256-sOkq73YWbhpKJOk1dVc4tkg2+RuGyRK8/t4ckMIVVG8=";
+    linphoneSdkVersion = "5.4.85";
+    linphoneSdkHash = "sha256-mdJDCuCaZlcQ92P6oMgH/8iWgm8hGz8gTVUilC+yaSU=";
   };
   f =
     self:

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/always-install-desktop-files.patch

@@ -0,0 +1,17 @@
+diff --git a/cmake/install/install.cmake b/cmake/install/install.cmake
+index 710e8fa31..636e3cff4 100644
+--- a/cmake/install/install.cmake
++++ b/cmake/install/install.cmake
+@@ -325,3 +325,11 @@ if(${ENABLE_APP_PACKAGING})
+ 	endif()
+ 	include(CPack)
+ endif()
++
++configure_file("${CMAKE_SOURCE_DIR}/cmake/install/linux/linphone.desktop.cmake" "${CMAKE_BINARY_DIR}/cmake/install/linux/${EXECUTABLE_NAME}.desktop" @ONLY)
++install(FILES "${CMAKE_BINARY_DIR}/cmake/install/linux/${EXECUTABLE_NAME}.desktop" DESTINATION "${CMAKE_INSTALL_DATADIR}/applications" PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
++install(FILES "${CMAKE_SOURCE_DIR}/Linphone/data/image/logo.svg" DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/icons/hicolor/scalable/apps/" RENAME "${EXECUTABLE_NAME}.svg")
++set(ICON_DIRS 16x16 22x22 24x24 32x32 64x64 128x128 256x256)
++foreach (DIR ${ICON_DIRS})
++  install(FILES "${CMAKE_SOURCE_DIR}/Linphone/data/icon/hicolor/${DIR}/apps/icon.png" DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/icons/hicolor/${DIR}/apps/" RENAME "${EXECUTABLE_NAME}.png")
++endforeach ()
+

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix

@@ -11,13 +11,14 @@
   fetchFromGitLab,
   lib,
   liblinphone,
-  libsForQt5,
   lime,
+  linphoneSdkVersion,
   mediastreamer2,
   minizip-ng,
   msopenh264,
   python3,
   python3Packages,
+  qt6Packages,
   stdenv,
   symlinkJoin,
   xercesc,
@@ -39,23 +40,21 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linphone-desktop";
-  version = "5.3.1";
+  version = "6.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.linphone.org";
     owner = "public";
     group = "BC";
     repo = "linphone-desktop";
-    rev = finalAttrs.version;
-    hash = "sha256-TO9JNsOnx4sTJEkai0nDKNyZWcLuGoWfuKLBM79tQvs=";
+    tag = finalAttrs.version;
+    hash = "sha256-jCnovCFdPJExD0+ZLhU9np1R5uN+mPlSPi/Nb1aOD0U=";
   };
 
   patches = [
-    ./require-finding-packages.patch
-    ./remove-bc-versions.patch
     ./do-not-override-install-prefix.patch
-    ./fix-translation-dirs.patch
-    ./unset-qml-dir.patch
+    ./do-not-manually-compute-sdk-version.patch
+    ./always-install-desktop-files.patch
 
     # .mkv recordings are broken in NixOS and other distros (see
     # https://github.com/NixOS/nixpkgs/issues/219551), and simply changing the
@@ -67,7 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     # Made by BC
     bctoolbox
-    belcard
     belle-sip
     belr
     liblinphone
@@ -79,9 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     xercesc
     minizip-ng
-    libsForQt5.qtgraphicaleffects
-    libsForQt5.qtmultimedia
-    libsForQt5.qtquickcontrols2
+    qt6Packages.qtbase
+    qt6Packages.qtnetworkauth
     zxing-cpp
     boost
 
@@ -91,8 +88,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    libsForQt5.qttools
-    libsForQt5.wrapQtAppsHook
+    qt6Packages.qttools
+    qt6Packages.wrapQtAppsHook
     python3
     doxygen
   ];
@@ -115,18 +112,26 @@ stdenv.mkDerivation (finalAttrs: {
     "-DLINPHONEAPP_VERSION=${finalAttrs.version}"
     "-DLINPHONE_QT_ONLY=ON"
     "-DLINPHONEAPP_INSTALL_PREFIX=${placeholder "out"}"
-    "-DLINPHONE_QML_DIR=${placeholder "out"}/${libsForQt5.qtbase.qtQmlPrefix}/ui"
+    "-DLINPHONE_QML_DIR=${placeholder "out"}/${qt6Packages.qtbase.qtQmlPrefix}/ui"
+    "-DLINPHONESDK_VERSION=${linphoneSdkVersion}"
+    "-DENABLE_APP_PACKAGE_ROOTCA=OFF"
 
     # normally set by the custom find modules, which we have disabled
     "-DLibLinphone_TARGET=liblinphone"
     "-DLinphoneCxx_TARGET=liblinphone++"
     "-DISpell_SOURCE_DIR=${bc-ispell.src}"
+
+    # used in Linphone's CMakeLists.txt
+    "-DLINPHONEAPP_VERSION=${finalAttrs.version}"
   ];
 
+  # error: invalid conversion from 'int' to 'const char*'
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+
   preConfigure = ''
     # custom "find" modules are causing issues during build,
     # as they are blinding cmake to nix dependencies
-    rm -rf linphone-app/cmake
+    rm -rf cmake/Modules
   '';
 
   preInstall = ''

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/do-not-manually-compute-sdk-version.patch

@@ -0,0 +1,20 @@
+diff --git a/Linphone/CMakeLists.txt b/Linphone/CMakeLists.txt
+index 776fd415a..8fa2d3ab6 100644
+--- a/Linphone/CMakeLists.txt
++++ b/Linphone/CMakeLists.txt
+@@ -71,14 +71,6 @@ execute_process(
+     OUTPUT_STRIP_TRAILING_WHITESPACE
+ )
+ 
+-set(LINPHONESDK_VERSION)
+-execute_process(
+-    COMMAND git describe
+-    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/external/linphone-sdk
+-    OUTPUT_VARIABLE LINPHONESDK_VERSION
+-    OUTPUT_STRIP_TRAILING_WHITESPACE
+-)
+-
+ include(application_info.cmake)
+ string(TIMESTAMP CURRENT_YEAR "%Y")
+ if(NOT APPLICATION_START_LICENCE OR "${CURRENT_YEAR}" STREQUAL "${APPLICATION_START_LICENCE}")
+

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/do-not-override-install-prefix.patch

@@ -1,16 +1,15 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 312df041d..43500be48 100644
+index 793a4bb15..446d5b721 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -116,11 +116,6 @@ endif ()
+@@ -117,10 +117,6 @@ endif ()
  #------------------------------------------------------------------------------
  # Prepare gobal CMAKE configuration specific to the current project
- 
+ set(CMAKE_POSITION_INDEPENDENT_CODE ON)#Needed for Qt
 -if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
 -	set(CMAKE_INSTALL_PREFIX "${CMAKE_BINARY_DIR}/OUTPUT" CACHE PATH "Default linphone-app installation prefix" FORCE)
 -	set(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT FALSE)
 -endif()
--
+ 
  if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
  	message(STATUS "Setting build type to 'RelWithDebInfo' as none was specified")
- 	set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING "Choose the type of build, options are: Debug Release RelWithDebInfo" FORCE)

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/fix-translation-dirs.patch

@@ -1,15 +0,0 @@
-diff --git a/linphone-app/assets/languages/CMakeLists.txt b/linphone-app/assets/languages/CMakeLists.txt
-index ffe2b6a5b..12f02bdfe 100644
---- a/linphone-app/assets/languages/CMakeLists.txt
-+++ b/linphone-app/assets/languages/CMakeLists.txt
-@@ -32,8 +32,8 @@ file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/${I18N_FILENAME}" "${I18N_CONTENT}")
- 
- #Files or directories to inspect for translations references
- set(TRANSLATION_SOURCES)
--list(APPEND TRANSLATION_SOURCES "${PROJECT_SOURCE_DIR}/src")
--list(APPEND TRANSLATION_SOURCES "${PROJECT_SOURCE_DIR}/ui")
-+list(APPEND TRANSLATION_SOURCES "${PROJECT_SOURCE_DIR}/linphone-app/src")
-+list(APPEND TRANSLATION_SOURCES "${PROJECT_SOURCE_DIR}/linphone-app/ui")
- 
- if (WIN32)
-   foreach (lang ${LANGUAGES})

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/record-in-wav-format.patch

@@ -1,48 +1,39 @@
-diff --git a/linphone-app/src/components/call/CallModel.cpp b/linphone-app/src/components/call/CallModel.cpp
-index d0286a89a..483bc35e4 100644
---- a/linphone-app/src/components/call/CallModel.cpp
-+++ b/linphone-app/src/components/call/CallModel.cpp
-@@ -289,7 +289,7 @@ void CallModel::setRecordFile (const shared_ptr<linphone::CallParams> &callParam
- 	callParams->setRecordFile(Utils::appStringToCoreString(
- 								  CoreManager::getInstance()->getSettingsModel()->getSavedCallsFolder()
- 								  .append(generateSavedFilename())
--								  .append(".mkv")
-+								  .append(".wav")
- 								  ));
- }
- 
-@@ -303,7 +303,7 @@ void CallModel::setRecordFile (const shared_ptr<linphone::CallParams> &callParam
- 	callParams->setRecordFile(Utils::appStringToCoreString(
- 								  CoreManager::getInstance()->getSettingsModel()->getSavedCallsFolder()
- 								  .append(generateSavedFilename(from, to))
--								  .append(".mkv")
-+								  .append(".wav")
- 								  ));
- }
- 
-diff --git a/linphone-app/src/components/conference/ConferenceProxyModel.cpp b/linphone-app/src/components/conference/ConferenceProxyModel.cpp
-index 0cf654dd4..931c0e5cf 100644
---- a/linphone-app/src/components/conference/ConferenceProxyModel.cpp
-+++ b/linphone-app/src/components/conference/ConferenceProxyModel.cpp
-@@ -84,7 +84,7 @@ void ConferenceProxyModel::startRecording () {
- 
- 
-   mLastRecordFile = 
--      QStringLiteral("%1%2.mkv")
-+      QStringLiteral("%1%2.wav")
-         .arg(coreManager->getSettingsModel()->getSavedCallsFolder())
-         .arg(QDateTime::currentDateTime().toString("yyyy-MM-dd_hh-mm-ss"));
-   conference->startRecording(Utils::appStringToCoreString(mLastRecordFile) );
-diff --git a/linphone-app/src/components/recorder/RecorderModel.cpp b/linphone-app/src/components/recorder/RecorderModel.cpp
-index 0d17ff6f8..5c6d7c679 100644
---- a/linphone-app/src/components/recorder/RecorderModel.cpp
-+++ b/linphone-app/src/components/recorder/RecorderModel.cpp
-@@ -83,7 +83,7 @@ QDateTime RecorderModel::getDateTimeSavedFilename(const QString& filename){
- 
- void RecorderModel::start(){
+diff --git a/Linphone/model/call/CallModel.cpp b/Linphone/model/call/CallModel.cpp
+index 366bbe86f..7bac43ad5 100644
+--- a/Linphone/model/call/CallModel.cpp
++++ b/Linphone/model/call/CallModel.cpp
+@@ -56,7 +56,7 @@ void CallModel::accept(bool withVideo) {
+ 	params->setRecordFile(
+ 	    Paths::getCapturesDirPath()
+ 	        .append(Utils::generateSavedFilename(QString::fromStdString(mMonitor->getToAddress()->getUsername()), ""))
+-	        .append(".mkv")
++	        .append(".wav")
+ 	        .toStdString());
+ 	// Answer with local call address.
+ 	auto localAddress = mMonitor->getCallLog()->getLocalAddress();
+diff --git a/Linphone/model/recorder/RecorderModel.cpp b/Linphone/model/recorder/RecorderModel.cpp
+index 7883ed150..1b1820620 100644
+--- a/Linphone/model/recorder/RecorderModel.cpp
++++ b/Linphone/model/recorder/RecorderModel.cpp
+@@ -82,7 +82,7 @@ void RecorderModel::start() {
+ 	mustBeInLinphoneThread(log().arg(Q_FUNC_INFO));
  	bool soFarSoGood;
--	QString filename = QStringLiteral("vocal_%1.mkv")
-+	QString filename = QStringLiteral("vocal_%1.wav")
- 			.arg(QDateTime::currentDateTime().toString("yyyy-MM-dd_hh-mm-ss-zzz"));
+ 	QString filename =
+-	    QStringLiteral("vocal_%1.mka").arg(QDateTime::currentDateTime().toString("yyyy-MM-dd_hh-mm-ss-zzz"));
++	    QStringLiteral("vocal_%1.wav").arg(QDateTime::currentDateTime().toString("yyyy-MM-dd_hh-mm-ss-zzz"));
  	const QString safeFilePath = Utils::getSafeFilePath(
- 				QStringLiteral("%1%2")
+ 	    QStringLiteral("%1%2").arg(SettingsModel::getInstance()->getSavedCallsFolder()).arg(filename), &soFarSoGood);
+ 
+diff --git a/Linphone/model/tool/ToolModel.cpp b/Linphone/model/tool/ToolModel.cpp
+index 18edeca7c..70c88516f 100644
+--- a/Linphone/model/tool/ToolModel.cpp
++++ b/Linphone/model/tool/ToolModel.cpp
+@@ -353,7 +353,7 @@ bool ToolModel::createCall(const QString &sipAddress,
+ 		params->setRecordFile(
+ 		    Paths::getCapturesDirPath()
+ 		        .append(Utils::generateSavedFilename(QString::fromStdString(address->getUsername()), ""))
+-		        .append(".mkv")
++		        .append(".wav")
+ 		        .toStdString());
+ 	}
+ 

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/remove-bc-versions.patch

@@ -1,15 +0,0 @@
-diff --git a/linphone-app/CMakeLists.txt b/linphone-app/CMakeLists.txt
-index d40842fa2..7d7bc57d8 100644
---- a/linphone-app/CMakeLists.txt
-+++ b/linphone-app/CMakeLists.txt
-@@ -40,10 +40,8 @@ set(version_minor)
- set(version_patch)
- set(identifiers )
- set(metadata )
--bc_parse_full_version("${LINPHONEAPP_VERSION}" version_major version_minor version_patch identifiers metadata)
- 
- 
--project(linphoneqt VERSION "${version_major}.${version_minor}.${version_patch}")
- 
- if(ENABLE_BUILD_VERBOSE)
- 	#message("CMAKE_PREFIX_PATH ${CMAKE_PREFIX_PATH}")

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/require-finding-packages.patch

@@ -1,41 +0,0 @@
-diff --git a/linphone-app/CMakeLists.txt b/linphone-app/CMakeLists.txt
-index d40842fa2..5ea1330ca 100644
---- a/linphone-app/CMakeLists.txt
-+++ b/linphone-app/CMakeLists.txt
-@@ -24,14 +24,11 @@ cmake_minimum_required(VERSION 3.22)
- 
- 
- #Linphone targets
--set(LINPHONE_PACKAGES LinphoneCxx Mediastreamer2 Belcard LibLinphone)
-+set(LINPHONE_PACKAGES LinphoneCxx Mediastreamer2 BelCard LibLinphone)
- 
- list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
- 
--find_package(BCToolbox)
--if(NOT BCToolbox_FOUND)
--	find_package(bctoolbox CONFIG REQUIRED)
--endif()
-+find_package(BCToolbox REQUIRED)
- if(NOT LINPHONEAPP_VERSION)
- 	bc_compute_full_version(LINPHONEAPP_VERSION)
- endif()
-@@ -105,17 +102,14 @@ set(ENABLE_DB_STORAGE ON CACHE BOOLEAN "Enable Storage")
- 
- foreach(PACKAGE ${LINPHONE_PACKAGES})
- 	message(STATUS "Trying to find ${PACKAGE}")
--	find_package(${PACKAGE})
--	if(NOT ${PACKAGE}_FOUND)
--		find_package(${PACKAGE} CONFIG REQUIRED)
--	endif()
-+  find_package(${PACKAGE} REQUIRED)
- endforeach()
- 
- set(PLUGIN_TARGETS ${LinphoneCxx_TARGET})
- set(APP_TARGETS ${LinphoneCxx_TARGET}
- 				${BCToolbox_TARGET}#Logger/App
- 				${Mediastreamer2_TARGET}#MediastreamerUtils
--				${Belcard_TARGET}#VCard Model
-+				${BelCard_TARGET}#VCard Model
- 				${LibLinphone_TARGET})#MediastreamerUtils
- 
- ####################################

pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/unset-qml-dir.patch

@@ -1,13 +0,0 @@
-diff --git a/linphone-app/CMakeLists.txt b/linphone-app/CMakeLists.txt
-index d40842fa2..112d45711 100644
---- a/linphone-app/CMakeLists.txt
-+++ b/linphone-app/CMakeLists.txt
-@@ -54,7 +54,6 @@ include(CheckCXXCompilerFlag)
- 
- 
- set(TARGET_NAME linphone-qt)
--set(LINPHONE_QML_DIR "WORK/qml_files/ui")
- set_property(GLOBAL PROPERTY TARGET_SUPPORTS_SHARED_LIBS true)
- set(CMAKE_CXX_STANDARD 14)
- 
-

pkgs/applications/networking/instant-messengers/linphone/mediastreamer2/default.nix

@@ -9,7 +9,7 @@
   libxext,
   libopus,
   libpulseaudio,
-  libsForQt5,
+  qt6Packages,
   libv4l,
   libvpx,
   mkLinphoneDerivation,
@@ -35,8 +35,8 @@ mkLinphoneDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     python3
-    libsForQt5.qtbase
-    libsForQt5.qtdeclarative
+    qt6Packages.qtbase
+    qt6Packages.qtdeclarative
   ];
 
   propagatedBuildInputs = [

pkgs/applications/networking/instant-messengers/linphone/mk-linphone-derivation/default.nix

@@ -1,11 +1,38 @@
 {
   stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
   lib,
   cmake,
   linphoneSdkVersion,
   linphoneSdkHash,
 }:
+let
+  # linphone-sdk is hosted on BC's Gitlab instance, however since it imposes
+  # a heavy rate limit / throttling when attempting to fetch submodules, we use their
+  # GitHub mirror instead.
+  src = fetchFromGitHub {
+    owner = "BelledonneCommunications";
+    repo = "linphone-sdk";
+    tag = linphoneSdkVersion;
+    hash = linphoneSdkHash;
+    leaveDotGit = true;
+    postFetch = ''
+      cd $out
+      git remote add origin https://github.com/BelledonneCommunications/linphone-sdk.git
+      git reset --hard HEAD
+      # `external` submodules are hardcoded to resolve to BC's Gitlab instance,
+      # however, since we manually package all required external modules anyway,
+      # we do not need to also fetch them here.
+      #
+      # We also use `--jobs 1` to avoid hitting BC's rate limit for the handful of
+      # hardcoded submodules that we _do_ need.
+      for submodule in $(git config --file .gitmodules --get-regexp path | awk '{print $2}' | grep -v '^external/.*$'); do
+        git submodule update --init --recursive --jobs 1 "$submodule"
+      done
+      find "$out" -name .git -type d -print0 | xargs -0 rm -rf
+    '';
+  };
+in
 lib.extendMkDerivation {
   constructDrv = stdenv.mkDerivation;
 
@@ -25,15 +52,7 @@ lib.extendMkDerivation {
     {
       version = linphoneSdkVersion;
 
-      src = fetchFromGitLab {
-        domain = "gitlab.linphone.org";
-        owner = "public";
-        group = "BC";
-        repo = "linphone-sdk";
-        tag = linphoneSdkVersion;
-        hash = linphoneSdkHash;
-        fetchSubmodules = true;
-      };
+      inherit src;
 
       nativeBuildInputs = [
         cmake

pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix

@@ -52,9 +52,9 @@ lib.makeScope newScope (
 
     purple-xmpp-http-upload = callPackage ./purple-xmpp-http-upload { };
 
-    tdlib-purple = callPackage ./tdlib-purple { };
   }
   // lib.optionalAttrs config.allowAliases {
+    tdlib-purple = throw "'pidginPackages.tdlib-purple' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
     purple-matrix = throw "'pidginPackages.purple-matrix' has been unmaintained since April 2022, so it was removed.";
     pidgin-skypeweb = throw "'pidginPackages.pidgin-skypeweb' has been removed since Skype was shut down in May 2025.";
     purple-hangouts = throw "'pidginPackages.purple-hangouts' has been removed as Hangouts Classic is obsolete and migrated to Google Chat.";

pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/tdlib-purple/default.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  libwebp,
-  pidgin,
-  tdlib,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "tdlib-purple";
-  version = "0.8.1";
-
-  src = fetchFromGitHub {
-    owner = "ars3niy";
-    repo = "tdlib-purple";
-    rev = "v${version}";
-    sha256 = "sha256-mrowzTtNLyMc2WwLVIop8Mg2DbyiQs0OPXmJuM9QUnM=";
-  };
-
-  patches = [
-    # Update to tdlib 1.8.0
-    (fetchpatch {
-      url = "https://github.com/ars3niy/tdlib-purple/commit/8c87b899ddbec32ec6ab4a34ddf0dc770f97d396.patch";
-      sha256 = "sha256-sysPYPno+wS8mZwQAXtX5eVnhwKAZrtr5gXuddN3mko=";
-    })
-  ];
-
-  preConfigure = ''
-    sed -i -e 's|DESTINATION.*PURPLE_PLUGIN_DIR}|DESTINATION "lib/purple-2|' CMakeLists.txt
-    sed -i -e 's|DESTINATION.*PURPLE_DATA_DIR}|DESTINATION "share|' CMakeLists.txt
-  '';
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    libwebp
-    pidgin
-    tdlib
-  ];
-
-  cmakeFlags = [ "-DNoVoip=True" ]; # libtgvoip required
-
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ "-U__ARM_NEON__" ]
-  );
-
-  meta = {
-    homepage = "https://github.com/ars3niy/tdlib-purple";
-    description = "libpurple Telegram plugin using tdlib";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ sikmir ];
-    platforms = lib.platforms.unix;
-
-    # tdlib-purple is not actively maintained and currently not
-    # compatible with recent versions of tdlib
-    broken = true;
-  };
-}

pkgs/applications/science/logic/cedille/Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch

@@ -1,31 +0,0 @@
-From 563f023aba1034f4f433f412302b825b059ef5a5 Mon Sep 17 00:00:00 2001
-From: Mark Barbone <mark.l.barbone@gmail.com>
-Date: Sun, 19 Jul 2020 17:24:30 -0400
-Subject: [PATCH] Fix to-string.agda to compile with Agda 2.6.1
-
----
-Adapted from https://github.com/cedille/cedille/pull/156.
-
- src/to-string.agda | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/to-string.agda b/src/to-string.agda
-index 2505942..051a2da 100644
---- a/src/to-string.agda
-+++ b/src/to-string.agda
-@@ -100,9 +100,9 @@ no-parens {TK} _ _ _ = tt
- no-parens {QUALIF} _ _ _ = tt
- no-parens {ARG} _ _ _ = tt
- 
--pattern ced-ops-drop-spine = cedille-options.options.mk-options _ _ _ _ ff _ _ _ ff _
--pattern ced-ops-conv-arr = cedille-options.options.mk-options _ _ _ _ _ _ _ _ ff _
--pattern ced-ops-conv-abs = cedille-options.options.mk-options _ _ _ _ _ _ _ _ tt _
-+pattern ced-ops-drop-spine = cedille-options.mk-options _ _ _ _ ff _ _ _ ff _
-+pattern ced-ops-conv-arr = cedille-options.mk-options _ _ _ _ _ _ _ _ ff _
-+pattern ced-ops-conv-abs = cedille-options.mk-options _ _ _ _ _ _ _ _ tt _
- 
- drop-spine : cedille-options.options → {ed : exprd} → ctxt → ⟦ ed ⟧ → ⟦ ed ⟧
- drop-spine ops @ ced-ops-drop-spine = h
--- 
-2.27.0
-

pkgs/applications/science/logic/cedille/default.nix

@@ -1,67 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  alex,
-  happy,
-  Agda,
-  buildPackages,
-  ghcWithPackages,
-}:
-
-stdenv.mkDerivation rec {
-  version = "1.1.2";
-  pname = "cedille";
-
-  src = fetchFromGitHub {
-    owner = "cedille";
-    repo = "cedille";
-    rev = "v${version}";
-    sha256 = "1j745q9sd32fhcb96wjq6xvyqq1k6imppjnya6x0n99fyfnqzvg9";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    ./Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch
-  ];
-
-  nativeBuildInputs = [
-    alex
-    happy
-  ];
-  buildInputs = [
-    Agda
-    (ghcWithPackages (ps: [ ps.ieee ]))
-  ];
-
-  LANG = "en_US.UTF-8";
-  LOCALE_ARCHIVE = lib.optionalString (
-    stdenv.buildPlatform.libc == "glibc"
-  ) "${buildPackages.glibcLocales}/lib/locale/locale-archive";
-
-  postPatch = ''
-    patchShebangs create-libraries.sh
-  '';
-
-  installPhase = ''
-    install -Dm755 -t $out/bin/ cedille
-    install -Dm755 -t $out/bin/ core/cedille-core
-    install -Dm644 -t $out/share/info docs/info/cedille-info-main.info
-
-    mkdir -p $out/lib/
-    cp -r lib/ $out/lib/cedille/
-  '';
-
-  meta = {
-    description = "Interactive theorem-prover and dependently typed programming language, based on extrinsic (aka Curry-style) type theory";
-    homepage = "https://cedille.github.io/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ mpickering ];
-    platforms = lib.platforms.unix;
-
-    # Broken due to Agda update.  See
-    # https://github.com/NixOS/nixpkgs/pull/129606#issuecomment-881107449.
-    broken = true;
-    hydraPlatforms = lib.platforms.none;
-  };
-}

pkgs/build-support/build-mozilla-mach/default.nix

@@ -367,10 +367,6 @@ buildStdenv.mkDerivation {
     "-l"
   ];
 
-  # if not explicitly set, wrong cc from buildStdenv would be used
-  HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc";
-  HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++";
-
   nativeBuildInputs = [
     autoconf
     cargo
@@ -643,7 +639,12 @@ buildStdenv.mkDerivation {
   makeFlags = extraMakeFlags;
   separateDebugInfo = enableDebugSymbols;
   enableParallelBuilding = true;
-  env = lib.optionalAttrs stdenv.hostPlatform.isMusl {
+  env = {
+    # if not explicitly set, wrong cc from buildStdenv would be used
+    HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc";
+    HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isMusl {
     # Firefox relies on nonstandard behavior of the glibc dynamic linker. It re-uses
     # previously loaded libraries even though they are not in the rpath of the newly loaded binary.
     # On musl we have to explicitly set the rpath to include these libraries.

pkgs/by-name/_1/_1password-cli/package.nix

@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.32.0";
+  version = "2.33.0-beta.01";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-7t8Ar6vF8lU3fPy5Gw9jtUkcx9gYKg6AFDB8/3QBvbk=" "zip";
-    i686-linux = fetch "linux_386" "sha256-+KSi87muDH/A8LNH7iDPQC/CnZhTpvFNSw1cuewqaXI=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-4I7lSey6I4mQ7dDtuOASnZzAItFYkIDZ8UMsqb0q5tE=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-jCz7m3X38SM4DwBDYu7J7rxzLECKftETrXvZwzWjfXA=" "zip";
+    i686-linux = fetch "linux_386" "sha256-kM4RD1hqa1JOcsDmPcGeojL5wu359UZkJnVbwlpEgFM=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-CWYKsd3TpTUaORgXrM1CVjBMJPPhMvSAb7kJARy+oVo=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-PVSI/iYsjphNqs0DGQlzRhmvnwj4RHcNODE2nbQ8CO0="
+      fetch "apple_universal" "sha256-+rdXdnpX0ucoecv/dNRA5L/GOe0bVgEPKl7pn0qNxm8="
         "pkg";
     x86_64-darwin = aarch64-darwin;
   };

pkgs/by-name/_2/_2048-in-terminal/package.nix

@@ -6,7 +6,7 @@
   pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "2048-in-terminal";
   version = "0-unstable-2022-06-13";
 
@@ -28,10 +28,10 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     description = "Animated console version of the 2048 game";
     mainProgram = "2048-in-terminal";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/_2/_20kly/package.nix

@@ -4,7 +4,7 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "20kly";
   version = "1.5.0";
 
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "20kly";
     repo = "20kly";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "1zxsxg49a02k7zidx3kgk2maa0vv0n1f9wrl5vch07sq3ghvpphx";
   };
 
@@ -45,4 +45,4 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fgaz ];
   };
-}
+})

pkgs/by-name/_3/_3mux/package.nix

@@ -6,14 +6,14 @@
   makeWrapper,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "3mux";
   version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "aaronjanse";
     repo = "3mux";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-QT4QXTlJf2NfTqXE4GF759EoW6Ri12lxDyodyEFc+ag=";
   };
 
@@ -64,4 +64,4 @@ buildGoModule rec {
     ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/aa/aaa/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aaa";
   version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "DomesticMoth";
     repo = "aaa";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-gIOlPjZOcmVLi9oOn4gBv6F+3Eq6t5b/3fKzoFqxclw=";
   };
 
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ asciimoth ];
     mainProgram = "aaa";
   };
-}
+})

pkgs/by-name/aa/aaaaxy/package.nix

@@ -20,14 +20,14 @@
   strip-nondeterminism,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "aaaaxy";
   version = "1.6.301";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = "aaaaxy";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-MWJ1k7Ps9jZa+AVNrvqRGMr3Mb0jd54NxGGylDI8VXo=";
     fetchSubmodules = true;
   };
@@ -136,4 +136,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ Luflosi ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/aa/aab/package.nix

@@ -4,7 +4,7 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "aab";
   version = "1.0.0-dev.5";
   pyproject = true;
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "glutanimate";
     repo = "anki-addon-builder";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-92Xqxgb9MLhSIa5EN3Rdk4aJlRfzEWqKmXFe604Q354=";
   };
 
@@ -45,4 +45,4 @@ python3.pkgs.buildPythonApplication rec {
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ eljamm ];
   };
-}
+})

pkgs/by-name/aa/aactivator/package.nix

@@ -4,7 +4,7 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aactivator";
   version = "2.0.0";
   pyproject = true;
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Yelp";
     repo = "aactivator";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-vnBDtLEvU1jHbb5/MXAulXaBaugdCZdLQSP2b8P6SiQ=";
   };
 
@@ -38,4 +38,4 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "aactivator";
     maintainers = with lib.maintainers; [ keller00 ];
   };
-}
+})

pkgs/by-name/aa/aarch64-esr-decoder/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aarch64-esr-decoder";
   version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "aarch64-esr-decoder";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-ZpSrz7iwwzNrK+bFTMn5MPx4Zjceao9NKhjAyjuPLWY=";
   };
 
@@ -20,9 +20,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Utility for decoding aarch64 ESR register values";
     homepage = "https://github.com/google/aarch64-esr-decoder";
-    changelog = "https://github.com/google/aarch64-esr-decoder/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/google/aarch64-esr-decoder/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jmbaur ];
     mainProgram = "aarch64-esr-decoder";
   };
-}
+})

pkgs/by-name/aa/aardvark-dns/package.nix

@@ -5,14 +5,14 @@
   nixosTests,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aardvark-dns";
   version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "aardvark-dns";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-NJ1ViJpN6fBO9U1RkCkqyr6JXiHa5zX1BQAGGqKWVYY=";
   };
 
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   passthru.tests = { inherit (nixosTests) podman; };
 
   meta = {
-    changelog = "https://github.com/containers/aardvark-dns/releases/tag/${src.rev}";
+    changelog = "https://github.com/containers/aardvark-dns/releases/tag/${finalAttrs.src.rev}";
     description = "Authoritative dns server for A/AAAA container records";
     homepage = "https://github.com/containers/aardvark-dns";
     license = lib.licenses.asl20;
@@ -29,4 +29,4 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.linux;
     mainProgram = "aardvark-dns";
   };
-}
+})

pkgs/by-name/ab/ab-av1/package.nix

@@ -6,14 +6,14 @@
   stdenv,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ab-av1";
   version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-EPQUm51H/yY0O1x6QAx1a+VeCgTYoJ19BAcEY52Oduo=";
   };
 
@@ -31,9 +31,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "AV1 re-encoding using ffmpeg, svt-av1 & vmaf";
     homepage = "https://github.com/alexheretic/ab-av1";
-    changelog = "https://github.com/alexheretic/ab-av1/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/alexheretic/ab-av1/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "ab-av1";
   };
-}
+})

pkgs/by-name/ab/abctl/package.nix

@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "abctl";
   version = "0.30.3";
 
   src = fetchFromGitHub {
     owner = "airbytehq";
     repo = "abctl";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pQvLFfj7/uZQUqtWAsTcw2RQ3KHFuoQCBP3lBvb2LTs=";
   };
 
@@ -38,10 +38,10 @@ buildGoModule rec {
   meta = {
     description = "Airbyte's CLI for managing local Airbyte installations";
     homepage = "https://airbyte.com/";
-    changelog = "https://github.com/airbytehq/abctl/releases/tag/v${version}";
+    changelog = "https://github.com/airbytehq/abctl/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ xelden ];
     mainProgram = "abctl";
     broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})

pkgs/by-name/ac/accerciser/package.nix

@@ -17,14 +17,14 @@
   librsvg,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "accerciser";
   version = "3.48.0";
 
   pyproject = false;
 
   src = fetchurl {
-    url = "mirror://gnome/sources/accerciser/${lib.versions.majorMinor version}/accerciser-${version}.tar.xz";
+    url = "mirror://gnome/sources/accerciser/${lib.versions.majorMinor finalAttrs.version}/accerciser-${finalAttrs.version}.tar.xz";
     hash = "sha256-kCiOiQCidKOu4gUw6zkWRZlK6YZyIJFroPXEZ3v+n00=";
   };
 
@@ -71,11 +71,11 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/accerciser";
-    changelog = "https://gitlab.gnome.org/GNOME/accerciser/-/blob/${version}/NEWS?ref_type=tags";
+    changelog = "https://gitlab.gnome.org/GNOME/accerciser/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
     description = "Interactive Python accessibility explorer";
     mainProgram = "accerciser";
     teams = [ lib.teams.gnome ];
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ac/acd-cli/package.nix

@@ -5,7 +5,7 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "acd-cli";
   version = "0.3.2";
   format = "setuptools";
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "yadayada";
     repo = "acd_cli";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-132CW5EcsgDZOeauBpNyXoFS2Q5rKPqqHIoIKobJDig=";
   };
 
@@ -47,4 +47,4 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/yadayada/acd_cli";
     license = lib.licenses.gpl2;
   };
-}
+})

pkgs/by-name/ac/acme-dns/package.nix

@@ -6,7 +6,7 @@
   stdenv,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "acme-dns";
   # Unstable version to allow building with toolchains later than EOL Go 1.22,
   # see https://github.com/joohoi/acme-dns/issues/365
@@ -38,11 +38,11 @@ buildGoModule rec {
   meta = {
     description = "Limited DNS server to handle ACME DNS challenges easily and securely";
     homepage = "https://github.com/joohoi/acme-dns";
-    changelog = "https://github.com/joohoi/acme-dns/releases/tag/${src.rev}";
+    changelog = "https://github.com/joohoi/acme-dns/releases/tag/${finalAttrs.src.rev}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ emilylange ];
     mainProgram = "acme-dns";
     # Tests time out on darwin.
     broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})

pkgs/by-name/ac/acpic/package.nix

@@ -4,13 +4,13 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "acpic";
   version = "1.0.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit version pname;
+    inherit (finalAttrs) version pname;
     hash = "sha256-vQ9VxCNbOmqHIY3e1wq1wNJl5ywfU2tm62gDg3vKvcg=";
   };
 
@@ -34,4 +34,4 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.wtfpl;
     maintainers = with lib.maintainers; [ aacebedo ];
   };
-}
+})

pkgs/by-name/ac/acr-cli/package.nix

@@ -6,14 +6,14 @@
   nix-update-script,
   acr-cli,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "acr-cli";
   version = "0.17";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "acr-cli";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-mS6IgeQqjdruSlsr2cssdbsTOWM4STBqp/RtrWXG9/c=";
   };
 
@@ -22,8 +22,8 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/Azure/acr-cli/version.Version=${version}"
-    "-X=github.com/Azure/acr-cli/version.Revision=${src.rev}"
+    "-X=github.com/Azure/acr-cli/version.Version=${finalAttrs.version}"
+    "-X=github.com/Azure/acr-cli/version.Revision=${finalAttrs.src.rev}"
   ];
 
   executable = [ "acr" ];
@@ -42,4 +42,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ hausken ];
     mainProgram = "acr-cli";
   };
-}
+})

pkgs/by-name/ac/actionlint/package.nix

@@ -9,7 +9,7 @@
   shellcheck,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "actionlint";
   version = "1.7.10";
 
@@ -18,7 +18,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "rhysd";
     repo = "actionlint";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-KnvFzV1VDivt7JL1lavM9wgaxdsdnEiLAk/pmzkXi+c=";
   };
 
@@ -45,15 +45,15 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/rhysd/actionlint.version=${version}"
+    "-X github.com/rhysd/actionlint.version=${finalAttrs.version}"
   ];
 
   meta = {
     homepage = "https://rhysd.github.io/actionlint/";
     description = "Static checker for GitHub Actions workflow files";
-    changelog = "https://github.com/rhysd/actionlint/raw/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/rhysd/actionlint/raw/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ momeemt ];
     mainProgram = "actionlint";
   };
-}
+})

pkgs/by-name/ad/ad-miner/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "ad-miner";
   version = "1.8.1";
   pyproject = true;
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-iI7jiENPYCIVJnIG/M4ft4dkR2Ja21gzR+ISeyZvUEo=";
   };
 
@@ -36,9 +36,9 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Active Directory audit tool that leverages cypher queries to crunch data from Bloodhound";
     homepage = "https://github.com/Mazars-Tech/AD_Miner";
-    changelog = "https://github.com/Mazars-Tech/AD_Miner/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/Mazars-Tech/AD_Miner/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "AD-miner";
   };
-}
+})

pkgs/by-name/ad/ad/package.nix

@@ -6,14 +6,14 @@
   versionCheckHook,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ad";
   version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "sminez";
     repo = "ad";
-    tag = version;
+    tag = finalAttrs.version;
     sha256 = "0rd4krklpnvaimzblqx2ckab6lk4apkmvnqr618gnx8i5f4nyl6m";
   };
 
@@ -58,4 +58,4 @@ rustPlatform.buildRustPackage rec {
     # https://github.com/sminez/ad/issues/28
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ad/adafruit-ampy/package.nix

@@ -4,13 +4,13 @@
   fetchPypi,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "adafruit-ampy";
   version = "1.1.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     sha256 = "f4cba36f564096f2aafd173f7fbabb845365cc3bb3f41c37541edf98b58d3976";
   };
 
@@ -34,4 +34,4 @@ python3.pkgs.buildPythonApplication rec {
     maintainers = [ ];
     mainProgram = "ampy";
   };
-}
+})

pkgs/by-name/ad/adalanche/package.nix

@@ -5,14 +5,14 @@
   libpcap,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adalanche";
   version = "2024.1.11";
 
   src = fetchFromGitHub {
     owner = "lkarlslund";
     repo = "adalanche";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SJa2PQCXTYdv5jMucpJOD2gC7Qk2dNdINHW4ZvLXSLw=";
   };
 
@@ -25,15 +25,15 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/lkarlslund/adalanche/modules/version.Version=${version}"
+    "-X=github.com/lkarlslund/adalanche/modules/version.Version=${finalAttrs.version}"
   ];
 
   meta = {
     description = "Active Directory ACL Visualizer and Explorer";
     homepage = "https://github.com/lkarlslund/adalanche";
-    changelog = "https://github.com/lkarlslund/Adalanche/releases/tag/v${version}";
+    changelog = "https://github.com/lkarlslund/Adalanche/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "adalanche";
   };
-}
+})

pkgs/by-name/ad/adbfs-rootless/package.nix

@@ -7,7 +7,7 @@
   android-tools,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "adbfs-rootless";
   version = "0-unstable-2023-03-21";
 
@@ -37,9 +37,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Mount Android phones on Linux with adb, no root required";
     mainProgram = "adbfs";
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ad/adbtuifm/package.nix

@@ -3,23 +3,23 @@
   fetchFromGitHub,
   lib,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adbtuifm";
   version = "0.5.8";
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = "adbtuifm";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-TK93O9XwMrsrQT3EG0969HYMtYkK0a4PzG9FSTqHxAY=";
   };
   vendorHash = "sha256-voVoowjM90OGWXF4REEevO8XEzT7azRYiDay4bnGBks=";
   meta = {
     description = "TUI-based file manager for the Android Debug Bridge";
     homepage = "https://github.com/darkhz/adbtuifm";
-    changelog = "https://github.com/darkhz/adbtuifm/releases/tag/v${version}";
+    changelog = "https://github.com/darkhz/adbtuifm/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ daru-san ];
     mainProgram = "adbtuifm";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ad/add-determinism/package.nix

@@ -7,14 +7,14 @@
   stdenv,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "add-determinism";
   version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "keszybz";
     repo = "add-determinism";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-wy0jle1Fhq4wpxMY1IeS3FGHOOaH0Bu8qhvmaIRAJyI=";
   };
 
@@ -52,4 +52,4 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.all;
     mainProgram = "add-det";
   };
-}
+})

pkgs/by-name/ad/addic7ed-cli/package.nix

@@ -4,13 +4,13 @@
   fetchPypi,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "addic7ed-cli";
   version = "1.4.6";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     sha256 = "182cpwxpdybsgl1nps850ysvvjbqlnx149kri4hxhgm58nqq0qf5";
   };
 
@@ -35,4 +35,4 @@ python3Packages.buildPythonApplication rec {
     platforms = lib.platforms.unix;
     mainProgram = "addic7ed";
   };
-}
+})

pkgs/by-name/ad/addlicense/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "addlicense";
   version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "addlicense";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-SM2fPfSqtc6LO+6Uk/sb/IMThXdE8yvk52jK3vF9EfE=";
   };
 
@@ -26,4 +26,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ SuperSandro2000 ];
     mainProgram = "addlicense";
   };
-}
+})

pkgs/by-name/ad/addwater/package.nix

@@ -13,7 +13,7 @@
   nix-update-script,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "addwater";
   version = "1.2.7";
   # built with meson, not a python format
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "largestgithubuseronearth";
     repo = "addwater";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-NZOjY+cskKn+BppqBSJyFR1JdDL56whDW19a15cvShE=";
   };
 
@@ -56,4 +56,4 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "addwater";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ad/adguardian/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adguardian";
   version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "Lissy93";
     repo = "AdGuardian-Term";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-WxrSmCwLnXXs5g/hN3xWE66P5n0RD/L9MJpf5N2iNtY=";
   };
 
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})

pkgs/by-name/ad/adidnsdump/package.nix

@@ -4,7 +4,7 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "adidnsdump";
   version = "1.4.0";
   pyproject = true;
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "dirkjanm";
     repo = "adidnsdump";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-gKOIZuXYm8ltaajmOZXulPX5dI4fWz4xiZ8W0kPpcRk=";
   };
 
@@ -28,9 +28,9 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Active Directory Integrated DNS dumping by any authenticated user";
     homepage = "https://github.com/dirkjanm/adidnsdump";
-    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/${src.tag}";
+    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "adidnsdump";
   };
-}
+})

pkgs/by-name/ad/adif-multitool/package.nix

@@ -3,7 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adif-multitool";
   version = "0.1.20";
 
@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "flwyd";
     repo = "adif-multitool";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-qeAH8UTyEZn8As3wTjluONpjeT/5l9zicN5+8uwnbLo=";
   };
 
@@ -23,4 +23,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ mafo ];
     mainProgram = "adifmt";
   };
-}
+})

pkgs/by-name/ad/adlplug/package.nix

@@ -66,7 +66,7 @@ stdenv.mkDerivation {
     ./cmake-v4.patch
   ];
 
-  NIX_LDFLAGS = toString (
+  env.NIX_LDFLAGS = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [
       # Framework that JUCE needs which don't get linked properly
       "-framework CoreAudioKit"

pkgs/by-name/ad/adrgen/package.nix

@@ -6,14 +6,14 @@
   adrgen,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adrgen";
   version = "0.4.1-beta";
 
   src = fetchFromGitHub {
     owner = "asiermarques";
     repo = "adrgen";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-9EiJe5shhwbjLIvUQMUTSGTgCA+r3RdkLkPRPoWvZ3g=";
   };
 
@@ -22,7 +22,7 @@ buildGoModule rec {
   passthru.tests.version = testers.testVersion {
     package = adrgen;
     command = "adrgen version";
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   meta = {
@@ -32,4 +32,4 @@ buildGoModule rec {
     maintainers = [ ];
     mainProgram = "adrgen";
   };
-}
+})

pkgs/by-name/ad/adrs/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adrs";
   version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "joshrotenberg";
     repo = "adrs";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-PAvn1yIptyiVG96BNXHPgc5rYEHyCTo42hh88dwxrhA=";
   };
 
@@ -27,4 +27,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ dannixon ];
     mainProgram = "adrs";
   };
-}
+})

pkgs/by-name/ad/adwsteamgtk/package.nix

@@ -11,7 +11,7 @@
   wrapGAppsHook4,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adwsteamgtk";
   version = "0.8.0";
   # built with meson, not a python format
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Foldex";
     repo = "AdwSteamGtk";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-n+BNqa+SHB1V1INHooc0VpeqZ2Dy1Byt7mrbJc2MXts=";
   };
 
@@ -50,4 +50,4 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "adwaita-steam-gtk";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ae/aeacus/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "aeacus";
   version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "elysium-suite";
     repo = "aeacus";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-LMsfogcz3CoShQDqyshMshb+iz2r0k5I7NDLXevMakI=";
   };
 
@@ -28,10 +28,10 @@ buildGoModule rec {
   meta = {
     description = "Vulnerability remediation scoring system";
     homepage = "https://github.com/elysium-suite/aeacus";
-    changelog = "https://github.com/elysium-suite/aeacus/releases/tag/v${version}";
+    changelog = "https://github.com/elysium-suite/aeacus/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "aeacus";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ae/aeolus/package.nix

@@ -13,12 +13,12 @@
   aeolus-stops,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aeolus";
   version = "0.10.4";
 
   src = fetchurl {
-    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/aeolus-${version}.tar.bz2";
+    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/aeolus-${finalAttrs.version}.tar.bz2";
     sha256 = "sha256-J9xrd/N4LrvGgi89Yj4ob4ZPUAEchrXJJQ+YVJ29Qhk=";
   };
 
@@ -68,4 +68,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "aeolus";
   };
-}
+})

pkgs/by-name/ae/aerogramme/package.nix

@@ -7,13 +7,13 @@
   openssl,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aerogramme";
   version = "0.3.0";
 
   src = fetchgit {
     url = "https://git.deuxfleurs.fr/Deuxfleurs/aerogramme/";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-ER+P/XGqNzTLwDLK5EBZq/Dl29ZZKl2FdxDb+oLEJ8Y=";
   };
 
@@ -46,4 +46,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "aerogramme";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ae/aescrypt/package.nix

@@ -14,7 +14,9 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-4uGS0LReq5dI7+Wel7ZWzFXx+utZWi93q4TUSw7AhNI=";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-liconv";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-liconv";
+  };
 
   preBuild = ''
     substituteInPlace src/Makefile --replace "CC=gcc" "CC?=gcc"

pkgs/by-name/ae/aewan/package.nix

@@ -10,12 +10,12 @@
 let
   stdenv = gccStdenv;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aewan";
   version = "1.0.01";
 
   src = fetchurl {
-    url = "mirror://sourceforge/aewan/aewan-${version}.tar.gz";
+    url = "mirror://sourceforge/aewan/aewan-${finalAttrs.version}.tar.gz";
     sha256 = "5266dec5e185e530b792522821c97dfa5f9e3892d0dca5e881d0c30ceac21817";
   };
 
@@ -53,4 +53,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/af/afew/package.nix

@@ -7,13 +7,13 @@
   afew,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "afew";
   version = "3.0.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     sha256 = "0wpfqbqjlfb9z0hafvdhkm7qw56cr9kfy6n8vb0q42dwlghpz1ff";
   };
 
@@ -66,4 +66,4 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ flokli ];
   };
-}
+})

pkgs/by-name/af/aften/package.nix

@@ -5,11 +5,11 @@
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aften";
   version = "0.0.8";
   src = fetchurl {
-    url = "mirror://sourceforge/aften/aften-${version}.tar.bz2";
+    url = "mirror://sourceforge/aften/aften-${finalAttrs.version}.tar.bz2";
     sha256 = "02hc5x9vkgng1v9bzvza9985ifrjd7fjr7nlpvazp4mv6dr89k47";
   };
 
@@ -38,4 +38,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ emilytrau ];
   };
-}
+})

pkgs/by-name/af/afterburn/package.nix

@@ -6,14 +6,14 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "afterburn";
   version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "afterburn";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-APVbrR4V2Go7ba+1AFZKi0eBxRnT2bm+Fy2/KmvhsjE=";
   };
 
@@ -43,4 +43,4 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.linux;
     mainProgram = "afterburn";
   };
-}
+})

pkgs/by-name/ag/age-plugin-1p/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "age-plugin-1p";
   version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "Enzime";
     repo = "age-plugin-1p";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QYHHD7wOgRxRVkUOjwMz5DV8oxlb9mmb2K4HPoISguU=";
   };
 
@@ -30,4 +30,4 @@ buildGoModule rec {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ Enzime ];
   };
-}
+})

pkgs/by-name/ag/age-plugin-fido2-hmac/package.nix

@@ -22,14 +22,14 @@ let
     EOF
   '';
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "age-plugin-fido2-hmac";
   version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "olastor";
     repo = "age-plugin-fido2-hmac";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-8DO62uISwleJB/NFH7U8xhfT5bcda+d+7U6LXvySsD0=";
   };
 
@@ -38,7 +38,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=v${version}"
+    "-X main.version=v${finalAttrs.version}"
   ];
 
   buildInputs = [ libfido2 ];
@@ -52,4 +52,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ matthewcroughan ];
     mainProgram = "age-plugin-fido2-hmac";
   };
-}
+})

pkgs/by-name/ag/age-plugin-ledger/package.nix

@@ -8,14 +8,14 @@
   rage,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "age-plugin-ledger";
   version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "Ledger-Donjon";
     repo = "age-plugin-ledger";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-g5GbWXhaGEafiM3qkGlRXHcOzPZl2pbDWEBPg4gQWcg=";
   };
 
@@ -44,4 +44,4 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [ erdnaxe ];
   };
-}
+})

pkgs/by-name/ag/age-plugin-sss/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "age-plugin-sss";
   version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "olastor";
     repo = "age-plugin-sss";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QNu2Sp0CxYYXuMzf7X0mMYI677ICu5emOM4F9HlKhHA=";
   };
 
@@ -20,7 +20,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=v${version}"
+    "-X main.version=v${finalAttrs.version}"
   ];
 
   meta = {
@@ -30,4 +30,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ arbel-arad ];
     mainProgram = "age-plugin-sss";
   };
-}
+})

pkgs/by-name/ag/age-plugin-yubikey/package.nix

@@ -8,7 +8,7 @@
   pcsclite,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "age-plugin-yubikey";
   version = "0.5.0-unstable-2024-11-02";
 
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
     description = "YubiKey plugin for age";
     mainProgram = "age-plugin-yubikey";
     homepage = "https://github.com/str4d/age-plugin-yubikey";
-    changelog = "https://github.com/str4d/age-plugin-yubikey/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/str4d/age-plugin-yubikey/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = with lib.licenses; [
       mit
       asl20
@@ -45,4 +45,4 @@ rustPlatform.buildRustPackage rec {
       adamcstephens
     ];
   };
-}
+})

pkgs/by-name/ag/agebox/package.nix

@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "agebox";
   version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "slok";
     repo = "agebox";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/FTNvGV7PsJmpSU1dI/kjfiY5G7shomvLd3bvFqORfg=";
   };
 
@@ -19,15 +19,15 @@ buildGoModule rec {
 
   ldflags = [
     "-s"
-    "-X main.Version=${version}"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   meta = {
     homepage = "https://github.com/slok/agebox";
-    changelog = "https://github.com/slok/agebox/releases/tag/v${version}";
+    changelog = "https://github.com/slok/agebox/releases/tag/v${finalAttrs.version}";
     description = "Age based repository file encryption gitops tool";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ lesuisse ];
     mainProgram = "agebox";
   };
-}
+})

pkgs/by-name/ag/agnos/package.nix

@@ -6,14 +6,14 @@
   openssl,
   pkg-config,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "agnos";
   version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "krtab";
     repo = "agnos";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-wHzKHduxqG7PBsGK39lCRyzhf47mdjCXhn3W1pOXQO0=";
   };
 
@@ -30,4 +30,4 @@ rustPlatform.buildRustPackage rec {
   };
 
   passthru.tests = nixosTests.agnos;
-}
+})

pkgs/by-name/ah/ahoviewer/package.nix

@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional useUnrar unrar;
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postPatch = "patchShebangs version.sh";
 

pkgs/by-name/ai/aiac/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "aiac";
   version = "5.3.0";
   excludedPackages = [ ".ci" ];
@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "gofireflyio";
     repo = "aiac";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Lk3Bmzg1owkIWzz7jgq1YpdPyRzyZ7aNoWPIU5aWzu0=";
   };
 
@@ -20,7 +20,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/gofireflyio/aiac/v4/libaiac.Version=v${version}"
+    "-X github.com/gofireflyio/aiac/v4/libaiac.Version=v${finalAttrs.version}"
   ];
 
   meta = {
@@ -30,4 +30,4 @@ buildGoModule rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ qjoly ];
   };
-}
+})

pkgs/by-name/ai/aichat/package.nix

@@ -8,14 +8,14 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aichat";
   version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "aichat";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-xgTGii1xGtCc1OLoC53HAtQ+KVZNO1plB2GVtVBBlqs=";
   };
 
@@ -46,4 +46,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ mwdomino ];
     mainProgram = "aichat";
   };
-}
+})

pkgs/by-name/ai/aiger/package.nix

@@ -7,14 +7,14 @@
   picosat,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aiger";
   version = "1.9.20";
 
   src = fetchFromGitHub {
     owner = "arminbiere";
     repo = "aiger";
-    tag = "rel-${version}";
+    tag = "rel-${finalAttrs.version}";
     hash = "sha256-ggkxITuD8phq3VF6tGc/JWQGBhTfPxBdnRobKswYVa4=";
   };
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   pkgconfigItems = [
     (makePkgconfigItem {
       name = "aiger";
-      inherit version;
+      inherit (finalAttrs) version;
       cflags = [ "-I\${includedir}" ];
       libs = [
         "-L\${libdir}"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
         includedir = "@includedir@";
         libdir = "@libdir@";
       };
-      inherit (meta) description;
+      inherit (finalAttrs.meta) description;
     })
   ];
 
@@ -84,4 +84,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ thoughtpolice ];
     platforms = lib.platforms.unix;
   };
-}
+})